@kusinta/iot-schema 0.1.0-beta.9 → 0.2.0-beta.10

package/src/kusinta/iot/webrtc/v1/app_token_pb.d.ts

@@ -0,0 +1,152 @@
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file kusinta/iot/webrtc/v1/app_token.proto (package kusinta.iot.webrtc.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { Message } from "@bufbuild/protobuf";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import type { Role } from "../../access/v1/roles_pb.js";
+
+/**
+ * Describes the file kusinta/iot/webrtc/v1/app_token.proto.
+ */
+export declare const file_kusinta_iot_webrtc_v1_app_token: GenFile;
+
+/**
+ * AppTokenClaims is the contract for the payload of the JWT carried in
+ * AppHandshake.jwt. It is the single source of truth shared between the
+ * api-server (which mints the token) and the gateway (which validates it
+ * locally against the api-server's public key).
+ *
+ * This message is NOT sent on the wire — the wire value stays the signed,
+ * compact JWS string in AppHandshake.jwt. The fields here document the claim
+ * names and types each side must agree on. JWT libraries emit registered
+ * claims (iss/aud/sub) as flat strings and timestamps as NumericDate
+ * (seconds since the Unix epoch), so map to/from your native JWT library
+ * rather than serializing this message directly into the token.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.AppTokenClaims
+ */
+export declare type AppTokenClaims = Message<"kusinta.iot.webrtc.v1.AppTokenClaims"> & {
+  /**
+   * Registered claims (RFC 7519).
+   * Issuer: the api-server's issuer identifier, agreed out of band. A fixed
+   * string both sides compare exactly — not derived from anything here.
+   *
+   * @generated from field: string iss = 1;
+   */
+  iss: string;
+
+  /**
+   * audience: the target GatewayId value
+   *
+   * @generated from field: string aud = 2;
+   */
+  aud: string;
+
+  /**
+   * subject: the UserId value
+   *
+   * @generated from field: string sub = 3;
+   */
+  sub: string;
+
+  /**
+   * issued-at  (JWT NumericDate on the wire)
+   *
+   * @generated from field: google.protobuf.Timestamp iat = 4;
+   */
+  iat?: Timestamp | undefined;
+
+  /**
+   * expiry     (JWT NumericDate on the wire)
+   *
+   * @generated from field: google.protobuf.Timestamp exp = 5;
+   */
+  exp?: Timestamp | undefined;
+
+  /**
+   * Custom claims.
+   * A user may hold several roles at once (e.g. resident + gateway admin), so
+   * this is a list. Carried in the JWT as an array of enum NAME strings
+   * (e.g. ["ROLE_RESIDENT", "ROLE_GATEWAY_ADMIN"]), matching proto3 canonical
+   * JSON enum encoding — not integer values. This keeps the claim
+   * self-describing and aligns with text-typed role storage on the api-server.
+   *
+   * @generated from field: repeated kusinta.iot.access.v1.Role roles = 6;
+   */
+  roles: Role[];
+
+  /**
+   * RFC 7800 confirmation claim. Binds the token to the DTLS certificate of the
+   * connection it may be presented on: the validator compares this against the
+   * fingerprint of the live peer and rejects on mismatch, so a token replayed on
+   * a different connection is not usable. Without it the token is a pure bearer
+   * credential — possession alone is the whole proof.
+   *
+   * Carried in the JWT as the nested object RFC 7800 specifies:
+   *   "cnf": { "x5t#S256": "<base64url SHA-256 thumbprint of the peer's DER certificate>" }
+   *
+   * MANDATORY. The issuer MUST set it on every token, and the validator MUST
+   * reject a token that arrives without one. proto3 cannot express that, and
+   * the claim is a JSON object in a JWT rather than a field on this message on
+   * the wire, so nothing mechanical enforces it — it is a contract both sides
+   * implement or the binding is worthless. A validator that treats an absent
+   * cnf as "fall back to bearer" reopens the exact replay this claim closes,
+   * and gives any holder of a stolen token a way to opt out of the check by
+   * stripping it.
+   *
+   * Rollout order, since a mandatory claim cannot appear on both sides at once:
+   * the api-server must be issuing cnf on every token BEFORE the gateway begins
+   * rejecting tokens that lack it. Reverse that order and every live session is
+   * refused. Tokens are short-TTL, so the gap between the two deployments need
+   * only exceed one token lifetime.
+   *
+   * @generated from field: kusinta.iot.webrtc.v1.Confirmation cnf = 7;
+   */
+  cnf?: Confirmation | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.AppTokenClaims.
+ * Use `create(AppTokenClaimsSchema)` to create a new message.
+ */
+export declare const AppTokenClaimsSchema: GenMessage<AppTokenClaims>;
+
+/**
+ * RFC 7800 confirmation, the value of the "cnf" claim. A separate message
+ * because the claim is a nested JSON object in the token, not a flat string.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.Confirmation
+ */
+export declare type Confirmation = Message<"kusinta.iot.webrtc.v1.Confirmation"> & {
+  /**
+   * JWT claim name "x5t#S256" — the proto field cannot carry the "#", so the
+   * mapping to and from the JWT is by hand on both sides.
+   *
+   * ENCODING, pinned deliberately: base64url (unpadded) of the SHA-256 digest
+   * over the peer's DER-encoded certificate. WebRTC stacks hand you the same
+   * digest in the SDP `a=fingerprint:sha-256` attribute in a DIFFERENT form —
+   * uppercase, colon-separated hex — and the two will never compare equal.
+   * Issuer and validator must both normalise to the base64url form here; left
+   * unstated, each side can derive a correct value and never match.
+   *
+   * A DTLS fingerprint names a CERTIFICATE, not a connection: WebRTC permits
+   * reusing one certificate across several peer connections, and a new
+   * connection normally brings a new certificate. It is therefore neither
+   * unique per connection nor stable across reconnects, and must not be used as
+   * a session or connection key. It is a credential — it proves the peer holds
+   * the private key for the certificate the token was issued against, which is
+   * exactly and only what a confirmation claim needs.
+   *
+   * @generated from field: string x5t_s256 = 1;
+   */
+  x5tS256: string;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.Confirmation.
+ * Use `create(ConfirmationSchema)` to create a new message.
+ */
+export declare const ConfirmationSchema: GenMessage<Confirmation>;
+

package/src/kusinta/iot/webrtc/v1/app_token_pb.js

@@ -0,0 +1,28 @@
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file kusinta/iot/webrtc/v1/app_token.proto (package kusinta.iot.webrtc.v1, syntax proto3)
+/* eslint-disable */
+
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_kusinta_iot_access_v1_roles } from "../../access/v1/roles_pb.js";
+
+/**
+ * Describes the file kusinta/iot/webrtc/v1/app_token.proto.
+ */
+export const file_kusinta_iot_webrtc_v1_app_token = /*@__PURE__*/
+  fileDesc("CiVrdXNpbnRhL2lvdC93ZWJydGMvdjEvYXBwX3Rva2VuLnByb3RvEhVrdXNpbnRhLmlvdC53ZWJydGMudjEi5wEKDkFwcFRva2VuQ2xhaW1zEgsKA2lzcxgBIAEoCRILCgNhdWQYAiABKAkSCwoDc3ViGAMgASgJEicKA2lhdBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASJwoDZXhwGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIqCgVyb2xlcxgGIAMoDjIbLmt1c2ludGEuaW90LmFjY2Vzcy52MS5Sb2xlEjAKA2NuZhgHIAEoCzIjLmt1c2ludGEuaW90LndlYnJ0Yy52MS5Db25maXJtYXRpb24iIAoMQ29uZmlybWF0aW9uEhAKCHg1dF9zMjU2GAEgASgJQgJIAWIGcHJvdG8z", [file_google_protobuf_timestamp, file_kusinta_iot_access_v1_roles]);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.AppTokenClaims.
+ * Use `create(AppTokenClaimsSchema)` to create a new message.
+ */
+export const AppTokenClaimsSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_app_token, 0);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.Confirmation.
+ * Use `create(ConfirmationSchema)` to create a new message.
+ */
+export const ConfirmationSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_app_token, 1);
+

package/src/kusinta/iot/webrtc/v1/command_pb.d.ts

@@ -2,10 +2,13 @@
 // @generated from file kusinta/iot/webrtc/v1/command.proto (package kusinta.iot.webrtc.v1, syntax proto3)
 /* eslint-disable */
 
-import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
 import type { Message } from "@bufbuild/protobuf";
+import type { SetpointAdjustMode } from "./setpoint_mode_pb.js";
 import type { DeviceId } from "../../identity/v1/identity_pb.js";
 import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import type { AttributeRef } from "../../access/v1/acl_pb.js";
+import type { AttributeValue } from "../../device/v1/cluster_state_pb.js";
 
 /**
  * Describes the file kusinta/iot/webrtc/v1/command.proto.
@@ -13,17 +16,24 @@ import type { Timestamp } from "@bufbuild/protobuf/wkt";
 export declare const file_kusinta_iot_webrtc_v1_command: GenFile;
 
 /**
- * Maps to Matter SetpointRaiseLower command (Thermostat cluster 0x0201).
+ * Adjusts a setpoint by a delta. Maps to the Matter SetpointRaiseLower command
+ * (Thermostat cluster 0x0201).
+ *
+ * A delta needs a base, and only the producer holds one. On a battery-powered device
+ * that wakes on a multi-minute cycle the producer often has no current base and MUST
+ * refuse the command rather than guess at one — guessing moves a real radiator to a
+ * temperature nobody asked for. Prefer ThermostatSetpointWriteParams where the caller
+ * already knows the absolute value it wants; it has no such failure mode.
  *
  * @generated from message kusinta.iot.webrtc.v1.ThermostatSetpointParams
  */
 export declare type ThermostatSetpointParams = Message<"kusinta.iot.webrtc.v1.ThermostatSetpointParams"> & {
   /**
-   * SetpointAdjustMode: Heat=1, Cool=2, Both=3
+   * absent = the producer stated no mode
    *
-   * @generated from field: uint32 mode = 1;
+   * @generated from field: optional kusinta.iot.webrtc.v1.SetpointAdjustMode mode = 1;
    */
-  mode: number;
+  mode?: SetpointAdjustMode | undefined;
 
   /**
    * centidegrees delta
@@ -67,20 +77,17 @@ export declare type LevelControlParams = Message<"kusinta.iot.webrtc.v1.LevelCon
 export declare const LevelControlParamsSchema: GenMessage<LevelControlParams>;
 
 /**
- * Maps to Matter On and Off commands (On/Off cluster 0x0006).
+ * Arguments for the Matter On/Off cluster's Off (0x00), On (0x01) and Toggle (0x02)
+ * commands — of which there are none: all three take no arguments.
+ *
+ * Which of the three is meant is DeviceCommand.matter_command_id, and only that. The
+ * message previously carried `on` and `toggle` booleans, a second encoding of the same
+ * choice in a different shape, so a command could say Toggle in one field and On in
+ * another and parse cleanly. Empty is the honest form.
  *
  * @generated from message kusinta.iot.webrtc.v1.OnOffParams
  */
 export declare type OnOffParams = Message<"kusinta.iot.webrtc.v1.OnOffParams"> & {
-  /**
-   * @generated from field: bool on = 1;
-   */
-  on: boolean;
-
-  /**
-   * @generated from field: bool toggle = 2;
-   */
-  toggle: boolean;
 };
 
 /**
@@ -110,18 +117,16 @@ export declare type WindowCoveringLiftParams = Message<"kusinta.iot.webrtc.v1.Wi
 export declare const WindowCoveringLiftParamsSchema: GenMessage<WindowCoveringLiftParams>;
 
 /**
- * Maps to Matter LockDoor/UnlockDoor commands (Door Lock cluster 0x0101).
+ * Arguments for the Matter Door Lock cluster's LockDoor (0x00) and UnlockDoor (0x01),
+ * which take an optional PIN and nothing else.
+ *
+ * lock_state is gone: it restated LockDoor/UnlockDoor as Locked=1/Unlocked=2, a second
+ * selector in a THIRD numbering, disagreeing with both Matter's command IDs and its
+ * LockState attribute. Which operation is meant is DeviceCommand.matter_command_id.
  *
  * @generated from message kusinta.iot.webrtc.v1.DoorLockParams
  */
 export declare type DoorLockParams = Message<"kusinta.iot.webrtc.v1.DoorLockParams"> & {
-  /**
-   * Locked=1, Unlocked=2
-   *
-   * @generated from field: uint32 lock_state = 1;
-   */
-  lockState: number;
-
   /**
    * optional PIN
    *
@@ -137,15 +142,41 @@ export declare type DoorLockParams = Message<"kusinta.iot.webrtc.v1.DoorLockPara
 export declare const DoorLockParamsSchema: GenMessage<DoorLockParams>;
 
 /**
+ * A command an app asks the gateway to run on a device.
+ *
+ * Authorization
+ *
+ * An app MAY send any command; it does not decide whether it is allowed. The gateway
+ * authorizes every DeviceCommand against the caller's access.v1.DeviceAcl for the target
+ * device before forwarding it to a connector: PERMISSION_ACTION_INVOKE must be granted,
+ * and allowed_command_refs must reach this (endpoint, cluster_id, matter_command_id).
+ *
+ * NOT allowed_attribute_refs, and NOT PropertyConstraint. Both name attributes, and a
+ * command is not an attribute — the two are numbered independently within a cluster, so an
+ * attribute ref cannot name a command at all. A constraint bounds an attribute's value;
+ * this message carries command arguments, and ThermostatSetpointParams.amount is a DELTA,
+ * which cannot be compared against a bound without first resolving it to an absolute using
+ * a base the gateway may not hold. Where a setpoint must be bounded, bound the write:
+ * AttributeWriteRequest carries the absolute value a PropertyConstraint can be applied to.
+ *
+ * A refusal comes back as an ordinary CommandResult with success = false and an error,
+ * NOT as a session-level GatewayError: one command being refused says nothing about the
+ * session, which continues. A command for a device the caller cannot reach is refused the
+ * same way whether or not it exists, so no result reveals a device the user may not see.
+ *
  * @generated from message kusinta.iot.webrtc.v1.DeviceCommand
  */
 export declare type DeviceCommand = Message<"kusinta.iot.webrtc.v1.DeviceCommand"> & {
   /**
-   * UUID, matched in CommandResult
+   * Was command_id. Renamed because Matter has its own numeric command ID, added below,
+   * and two fields called "command id" meaning entirely different things in one message is
+   * a trap. Same name as AttributeWriteRequest.request_id, which correlates the same way.
+   *
+   * UUID, matched in the result
    *
-   * @generated from field: string command_id = 1;
+   * @generated from field: string request_id = 1;
    */
-  commandId: string;
+  requestId: string;
 
   /**
    * @generated from field: kusinta.iot.identity.v1.DeviceId device_id = 2;
@@ -153,16 +184,60 @@ export declare type DeviceCommand = Message<"kusinta.iot.webrtc.v1.DeviceCommand
   deviceId?: DeviceId | undefined;
 
   /**
-   * @generated from field: string cluster_id_hex = 3;
+   * The command's own PascalCase spelling, for logs and rendering.
+   *
+   * ADVISORY, and not validated against anything: nothing reconciles it with
+   * matter_command_id, so it can say "Toggle" beside an ID meaning On. A consumer MUST NOT
+   * route or authorize on it, and where the two disagree the ID wins. It is here so a
+   * refused or unresolvable command is legible to whoever reads the log.
+   *
+   * @generated from field: string command_name = 4;
    */
-  clusterIdHex: string;
+  commandName: string;
 
   /**
-   * PascalCase Matter command name
+   * e.g. 0x0201 for Thermostat
    *
-   * @generated from field: string command_name = 4;
+   * @generated from field: uint32 cluster_id = 12;
    */
-  commandName: string;
+  clusterId: number;
+
+  /**
+   * The Matter command ID within that cluster, e.g. 0x02 for On/Off's Toggle.
+   *
+   * What a consumer routes and authorizes on, matching Matter's own wire and the numeric
+   * Endpoint.clusters[].accepted_command_ids — so "does this device accept this command"
+   * is answerable before sending it rather than by watching it fail.
+   *
+   * Where the parameters case declares a (matter_command_id), this MUST equal it; where it
+   * declares only a (matter_command_cluster) — because several commands share the same
+   * arguments — this is what picks the command. cluster_id MUST equal the case's
+   * (matter_command_cluster) either way. A mismatch is malformed and is refused with
+   * COMMAND_ERROR_CODE_INVALID_COMMAND.
+   *
+   * raw_tlv has no annotation to check against, so there this is simply required.
+   *
+   * @generated from field: optional uint32 matter_command_id = 13;
+   */
+  matterCommandId?: number | undefined;
+
+  /**
+   * Which endpoint of the device to command. Required by rule — proto3 has no `required`,
+   * and `optional` is what makes "not stated" representable so a consumer can reject it
+   * rather than decode an omission to endpoint 0, which is the Matter root node.
+   *
+   * A device presents several
+   * endpoints and a command with no destination has no correct one — on a 4-channel
+   * actuator, picking any of them moves real hardware. Refuse an unaddressed command
+   * rather than guessing.
+   *
+   * No exemption for single-endpoint devices. A rule where the same message is valid or
+   * invalid depending on the shape of its target is a rule that works until a device
+   * grows an endpoint.
+   *
+   * @generated from field: optional uint32 endpoint_id = 11;
+   */
+  endpointId?: number | undefined;
 
   /**
    * @generated from oneof kusinta.iot.webrtc.v1.DeviceCommand.parameters
@@ -219,14 +294,16 @@ export declare const DeviceCommandSchema: GenMessage<DeviceCommand>;
  */
 export declare type CommandError = Message<"kusinta.iot.webrtc.v1.CommandError"> & {
   /**
-   * @generated from field: string code = 1;
+   * human-readable, for logs — never rendered to a user
+   *
+   * @generated from field: string message = 2;
    */
-  code: string;
+  message: string;
 
   /**
-   * @generated from field: string message = 2;
+   * @generated from field: kusinta.iot.webrtc.v1.CommandErrorCode code = 3;
    */
-  message: string;
+  code: CommandErrorCode;
 };
 
 /**
@@ -236,16 +313,23 @@ export declare type CommandError = Message<"kusinta.iot.webrtc.v1.CommandError">
 export declare const CommandErrorSchema: GenMessage<CommandError>;
 
 /**
- * CommandResult travels gateway → Flutter app (GatewayMessage) and
- * connector → gateway (ConnectRequest via connector.proto import).
+ * CommandResult travels gateway → app (GatewayMessage) and
+ * connector → gateway (SessionRequest via connector.proto import).
+ *
+ * success = true means the command was ACCEPTED, not that the device confirmed it. For
+ * a battery-powered device that wakes on a multi-minute cycle, acceptance without
+ * confirmation is the normal path, not an edge case: waiting for the device would fail
+ * every write to a sleeping one.
  *
  * @generated from message kusinta.iot.webrtc.v1.CommandResult
  */
 export declare type CommandResult = Message<"kusinta.iot.webrtc.v1.CommandResult"> & {
   /**
-   * @generated from field: string command_id = 1;
+   * matches DeviceCommand.request_id
+   *
+   * @generated from field: string request_id = 1;
    */
-  commandId: string;
+  requestId: string;
 
   /**
    * @generated from field: bool success = 2;
@@ -261,6 +345,25 @@ export declare type CommandResult = Message<"kusinta.iot.webrtc.v1.CommandResult
    * @generated from field: google.protobuf.Timestamp completed_at = 4;
    */
   completedAt?: Timestamp | undefined;
+
+  /**
+   * When the producer's own optimistic window closes: by this time the value has either
+   * been confirmed by the device or restored to what it was, and either way the producer
+   * will have published a PropertyUpdate saying so.
+   *
+   * Set it when the producer applied the value optimistically and runs a rollback timer.
+   * It exists so a consumer can bound its wait without hardcoding a constant chasing a
+   * timer that lives in someone else's codebase and changes without notice.
+   *
+   * Absent means no claim — either the producer confirms synchronously, or it cannot
+   * state a bound. Absent is NOT "settles immediately".
+   *
+   * This bounds the wait; it does not label the values that arrive. Which update was the
+   * optimistic one is device.v1.PropertyUpdate.provenance.
+   *
+   * @generated from field: optional google.protobuf.Timestamp settles_by = 5;
+   */
+  settlesBy?: Timestamp | undefined;
 };
 
 /**
@@ -269,3 +372,138 @@ export declare type CommandResult = Message<"kusinta.iot.webrtc.v1.CommandResult
  */
 export declare const CommandResultSchema: GenMessage<CommandResult>;
 
+/**
+ * Writes one attribute of one endpoint. The carrier for PERMISSION_ACTION_WRITE, which
+ * until it existed authorized an operation no message performed.
+ *
+ * Deliberately not a DeviceCommand case. A write and an invoke are different operations in
+ * Matter carrying different authority: a user who may toggle a light is not thereby a user
+ * who may rewrite its attributes. Routing both through one message made INVOKE imply WRITE
+ * and left the distinction unenforceable.
+ *
+ * Lives here beside DeviceCommand rather than in envelope.proto because both legs carry
+ * it — the app sends one, and the gateway forwards it to a connector. That is the same
+ * reason DeviceCommand is here.
+ *
+ * Addressed by AttributeRef, so an access.v1.PropertyConstraint bounds the value by
+ * matching target directly rather than needing a rule per writable attribute.
+ *
+ * A relative adjust is NOT this. Thermostat SetpointRaiseLower is a genuine Matter command
+ * and stays a DeviceCommand; this is for writing an absolute value.
+ *
+ * Answered by CommandResult, correlated on request_id.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.AttributeWriteRequest
+ */
+export declare type AttributeWriteRequest = Message<"kusinta.iot.webrtc.v1.AttributeWriteRequest"> & {
+  /**
+   * UUID, matched in CommandResult
+   *
+   * @generated from field: string request_id = 1;
+   */
+  requestId: string;
+
+  /**
+   * @generated from field: kusinta.iot.identity.v1.DeviceId device_id = 2;
+   */
+  deviceId?: DeviceId | undefined;
+
+  /**
+   * Which attribute to write. endpoint_id is required here — an unaddressed write has no
+   * correct destination, exactly as for a command.
+   *
+   * @generated from field: kusinta.iot.access.v1.AttributeRef target = 3;
+   */
+  target?: AttributeRef | undefined;
+
+  /**
+   * @generated from field: kusinta.iot.device.v1.AttributeValue value = 4;
+   */
+  value?: AttributeValue | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.AttributeWriteRequest.
+ * Use `create(AttributeWriteRequestSchema)` to create a new message.
+ */
+export declare const AttributeWriteRequestSchema: GenMessage<AttributeWriteRequest>;
+
+/**
+ * Why a command was refused or failed, so an app can branch without string-matching a
+ * human sentence. Closed vocabulary for the same reason as GatewayErrorCode: the app leg
+ * is versioned together with the gateway, so clients can switch exhaustively.
+ *
+ * @generated from enum kusinta.iot.webrtc.v1.CommandErrorCode
+ */
+export enum CommandErrorCode {
+  /**
+   * Sender did not set a code, or sent one this client's schema does not know.
+   *
+   * @generated from enum value: COMMAND_ERROR_CODE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * The caller's DeviceAcl does not permit this command. Permanent: do not retry, and do
+   * not reveal whether the device exists. Also the answer for a device out of reach.
+   *
+   * @generated from enum value: COMMAND_ERROR_CODE_NOT_ENTITLED = 1;
+   */
+  NOT_ENTITLED = 1,
+
+  /**
+   * The value is outside a PropertyConstraint bounding it — a resident asking for a
+   * setpoint above the property owner's limit. About the USER's request, not the app's
+   * correctness: worth telling the user, and the limit is readable from their permissions.
+   *
+   * @generated from enum value: COMMAND_ERROR_CODE_CONSTRAINT_VIOLATED = 2;
+   */
+  CONSTRAINT_VIOLATED = 2,
+
+  /**
+   * Malformed: no endpoint_id, an unknown parameters case, a cluster the device does not
+   * have. A client bug — log it, do not retry.
+   *
+   * @generated from enum value: COMMAND_ERROR_CODE_INVALID_COMMAND = 3;
+   */
+  INVALID_COMMAND = 3,
+
+  /**
+   * No route to the device right now: its connector is disconnected, or the device did
+   * not answer. Transient, retrying is reasonable. NOT a statement that the device is
+   * gone — that is webrtc.v1.DeviceRemoved.
+   *
+   * @generated from enum value: COMMAND_ERROR_CODE_UNREACHABLE = 4;
+   */
+  UNREACHABLE = 4,
+
+  /**
+   * The gateway's own deadline passed with no answer from the connector. The command MAY
+   * still have run: this is the one code that says nothing about what happened to the
+   * device, so it is never a reason to roll back a displayed value.
+   *
+   * @generated from enum value: COMMAND_ERROR_CODE_TIMEOUT = 5;
+   */
+  TIMEOUT = 5,
+
+  /**
+   * The connector or the device refused it for a reason of its own — a mode the hardware
+   * will not accept, a locked device. Read message for specifics.
+   *
+   * @generated from enum value: COMMAND_ERROR_CODE_REJECTED_BY_DEVICE = 6;
+   */
+  REJECTED_BY_DEVICE = 6,
+
+  /**
+   * Gateway-side fault. Not the app's doing; retry cautiously.
+   *
+   * @generated from enum value: COMMAND_ERROR_CODE_INTERNAL = 7;
+   */
+  INTERNAL = 7,
+}
+
+/**
+ * Describes the enum kusinta.iot.webrtc.v1.CommandErrorCode.
+ */
+export declare const CommandErrorCodeSchema: GenEnum<CommandErrorCode>;
+

package/src/kusinta/iot/webrtc/v1/command_pb.js

@@ -2,15 +2,19 @@
 // @generated from file kusinta/iot/webrtc/v1/command.proto (package kusinta.iot.webrtc.v1, syntax proto3)
 /* eslint-disable */
 
-import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import { enumDesc, fileDesc, messageDesc, tsEnum } from "@bufbuild/protobuf/codegenv2";
 import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_kusinta_iot_access_v1_acl } from "../../access/v1/acl_pb.js";
+import { file_kusinta_iot_device_v1_cluster_state } from "../../device/v1/cluster_state_pb.js";
+import { file_kusinta_iot_device_v1_matter_options } from "../../device/v1/matter_options_pb.js";
 import { file_kusinta_iot_identity_v1_identity } from "../../identity/v1/identity_pb.js";
+import { file_kusinta_iot_webrtc_v1_setpoint_mode } from "./setpoint_mode_pb.js";
 
 /**
  * Describes the file kusinta/iot/webrtc/v1/command.proto.
  */
 export const file_kusinta_iot_webrtc_v1_command = /*@__PURE__*/
-  fileDesc("CiNrdXNpbnRhL2lvdC93ZWJydGMvdjEvY29tbWFuZC5wcm90bxIVa3VzaW50YS5pb3Qud2VicnRjLnYxIjgKGFRoZXJtb3N0YXRTZXRwb2ludFBhcmFtcxIMCgRtb2RlGAEgASgNEg4KBmFtb3VudBgCIAEoESI8ChJMZXZlbENvbnRyb2xQYXJhbXMSDQoFbGV2ZWwYASABKA0SFwoPdHJhbnNpdGlvbl90aW1lGAIgASgNIikKC09uT2ZmUGFyYW1zEgoKAm9uGAEgASgIEg4KBnRvZ2dsZRgCIAEoCCI2ChhXaW5kb3dDb3ZlcmluZ0xpZnRQYXJhbXMSGgoSbGlmdF9wZXJjZW50MTAwdGhzGAEgASgNIjYKDkRvb3JMb2NrUGFyYW1zEhIKCmxvY2tfc3RhdGUYASABKA0SEAoIcGluX2NvZGUYAiABKAki/wMKDURldmljZUNvbW1hbmQSEgoKY29tbWFuZF9pZBgBIAEoCRI0CglkZXZpY2VfaWQYAiABKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZBIWCg5jbHVzdGVyX2lkX2hleBgDIAEoCRIUCgxjb21tYW5kX25hbWUYBCABKAkSTgoTdGhlcm1vc3RhdF9zZXRwb2ludBgFIAEoCzIvLmt1c2ludGEuaW90LndlYnJ0Yy52MS5UaGVybW9zdGF0U2V0cG9pbnRQYXJhbXNIABJCCg1sZXZlbF9jb250cm9sGAYgASgLMikua3VzaW50YS5pb3Qud2VicnRjLnYxLkxldmVsQ29udHJvbFBhcmFtc0gAEjQKBm9uX29mZhgHIAEoCzIiLmt1c2ludGEuaW90LndlYnJ0Yy52MS5Pbk9mZlBhcmFtc0gAEk8KFHdpbmRvd19jb3ZlcmluZ19saWZ0GAggASgLMi8ua3VzaW50YS5pb3Qud2VicnRjLnYxLldpbmRvd0NvdmVyaW5nTGlmdFBhcmFtc0gAEjoKCWRvb3JfbG9jaxgJIAEoCzIlLmt1c2ludGEuaW90LndlYnJ0Yy52MS5Eb29yTG9ja1BhcmFtc0gAEhEKB3Jhd190bHYYYyABKAxIAEIMCgpwYXJhbWV0ZXJzIi0KDENvbW1hbmRFcnJvchIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkimgEKDUNvbW1hbmRSZXN1bHQSEgoKY29tbWFuZF9pZBgBIAEoCRIPCgdzdWNjZXNzGAIgASgIEjIKBWVycm9yGAMgASgLMiMua3VzaW50YS5pb3Qud2VicnRjLnYxLkNvbW1hbmRFcnJvchIwCgxjb21wbGV0ZWRfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgJIAWIGcHJvdG8z", [file_google_protobuf_timestamp, file_kusinta_iot_identity_v1_identity]);
+  fileDesc("CiNrdXNpbnRhL2lvdC93ZWJydGMvdjEvY29tbWFuZC5wcm90bxIVa3VzaW50YS5pb3Qud2VicnRjLnYxInwKGFRoZXJtb3N0YXRTZXRwb2ludFBhcmFtcxI8CgRtb2RlGAEgASgOMikua3VzaW50YS5pb3Qud2VicnRjLnYxLlNldHBvaW50QWRqdXN0TW9kZUgAiAEBEg4KBmFtb3VudBgCIAEoEToJuLUYgQTAtRgAQgcKBV9tb2RlIkYKEkxldmVsQ29udHJvbFBhcmFtcxINCgVsZXZlbBgBIAEoDRIXCg90cmFuc2l0aW9uX3RpbWUYAiABKA06CLi1GAjAtRgAIisKC09uT2ZmUGFyYW1zOgS4tRgGSgQIARACSgQIAhADUgJvblIGdG9nZ2xlIkEKGFdpbmRvd0NvdmVyaW5nTGlmdFBhcmFtcxIaChJsaWZ0X3BlcmNlbnQxMDB0aHMYASABKA06Cbi1GIICwLUYBSI7Cg5Eb29yTG9ja1BhcmFtcxIQCghwaW5fY29kZRgCIAEoCToFuLUYgQJKBAgBEAJSCmxvY2tfc3RhdGUikgUKDURldmljZUNvbW1hbmQSEgoKcmVxdWVzdF9pZBgBIAEoCRI0CglkZXZpY2VfaWQYAiABKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZBIUCgxjb21tYW5kX25hbWUYBCABKAkSEgoKY2x1c3Rlcl9pZBgMIAEoDRIeChFtYXR0ZXJfY29tbWFuZF9pZBgNIAEoDUgBiAEBEhgKC2VuZHBvaW50X2lkGAsgASgNSAKIAQESTgoTdGhlcm1vc3RhdF9zZXRwb2ludBgFIAEoCzIvLmt1c2ludGEuaW90LndlYnJ0Yy52MS5UaGVybW9zdGF0U2V0cG9pbnRQYXJhbXNIABJCCg1sZXZlbF9jb250cm9sGAYgASgLMikua3VzaW50YS5pb3Qud2VicnRjLnYxLkxldmVsQ29udHJvbFBhcmFtc0gAEjQKBm9uX29mZhgHIAEoCzIiLmt1c2ludGEuaW90LndlYnJ0Yy52MS5Pbk9mZlBhcmFtc0gAEk8KFHdpbmRvd19jb3ZlcmluZ19saWZ0GAggASgLMi8ua3VzaW50YS5pb3Qud2VicnRjLnYxLldpbmRvd0NvdmVyaW5nTGlmdFBhcmFtc0gAEjoKCWRvb3JfbG9jaxgJIAEoCzIlLmt1c2ludGEuaW90LndlYnJ0Yy52MS5Eb29yTG9ja1BhcmFtc0gAEhEKB3Jhd190bHYYYyABKAxIAEIMCgpwYXJhbWV0ZXJzQhQKEl9tYXR0ZXJfY29tbWFuZF9pZEIOCgxfZW5kcG9pbnRfaWRKBAgDEARKBAgKEAtSDmNsdXN0ZXJfaWRfaGV4Uhl0aGVybW9zdGF0X3NldHBvaW50X3dyaXRlIlwKDENvbW1hbmRFcnJvchIPCgdtZXNzYWdlGAIgASgJEjUKBGNvZGUYAyABKA4yJy5rdXNpbnRhLmlvdC53ZWJydGMudjEuQ29tbWFuZEVycm9yQ29kZUoECAEQAiLeAQoNQ29tbWFuZFJlc3VsdBISCgpyZXF1ZXN0X2lkGAEgASgJEg8KB3N1Y2Nlc3MYAiABKAgSMgoFZXJyb3IYAyABKAsyIy5rdXNpbnRhLmlvdC53ZWJydGMudjEuQ29tbWFuZEVycm9yEjAKDGNvbXBsZXRlZF9hdBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASMwoKc2V0dGxlc19ieRgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBIAIgBAUINCgtfc2V0dGxlc19ieSLMAQoVQXR0cmlidXRlV3JpdGVSZXF1ZXN0EhIKCnJlcXVlc3RfaWQYASABKAkSNAoJZGV2aWNlX2lkGAIgASgLMiEua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuRGV2aWNlSWQSMwoGdGFyZ2V0GAMgASgLMiMua3VzaW50YS5pb3QuYWNjZXNzLnYxLkF0dHJpYnV0ZVJlZhI0CgV2YWx1ZRgEIAEoCzIlLmt1c2ludGEuaW90LmRldmljZS52MS5BdHRyaWJ1dGVWYWx1ZSq/AgoQQ29tbWFuZEVycm9yQ29kZRIiCh5DT01NQU5EX0VSUk9SX0NPREVfVU5TUEVDSUZJRUQQABIjCh9DT01NQU5EX0VSUk9SX0NPREVfTk9UX0VOVElUTEVEEAESKgomQ09NTUFORF9FUlJPUl9DT0RFX0NPTlNUUkFJTlRfVklPTEFURUQQAhImCiJDT01NQU5EX0VSUk9SX0NPREVfSU5WQUxJRF9DT01NQU5EEAMSIgoeQ09NTUFORF9FUlJPUl9DT0RFX1VOUkVBQ0hBQkxFEAQSHgoaQ09NTUFORF9FUlJPUl9DT0RFX1RJTUVPVVQQBRIpCiVDT01NQU5EX0VSUk9SX0NPREVfUkVKRUNURURfQllfREVWSUNFEAYSHwobQ09NTUFORF9FUlJPUl9DT0RFX0lOVEVSTkFMEAdCAkgBYgZwcm90bzM", [file_google_protobuf_timestamp, file_kusinta_iot_access_v1_acl, file_kusinta_iot_device_v1_cluster_state, file_kusinta_iot_device_v1_matter_options, file_kusinta_iot_identity_v1_identity, file_kusinta_iot_webrtc_v1_setpoint_mode]);
 
 /**
  * Describes the message kusinta.iot.webrtc.v1.ThermostatSetpointParams.
@@ -68,3 +72,26 @@ export const CommandErrorSchema = /*@__PURE__*/
 export const CommandResultSchema = /*@__PURE__*/
   messageDesc(file_kusinta_iot_webrtc_v1_command, 7);
 
+/**
+ * Describes the message kusinta.iot.webrtc.v1.AttributeWriteRequest.
+ * Use `create(AttributeWriteRequestSchema)` to create a new message.
+ */
+export const AttributeWriteRequestSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_command, 8);
+
+/**
+ * Describes the enum kusinta.iot.webrtc.v1.CommandErrorCode.
+ */
+export const CommandErrorCodeSchema = /*@__PURE__*/
+  enumDesc(file_kusinta_iot_webrtc_v1_command, 0);
+
+/**
+ * Why a command was refused or failed, so an app can branch without string-matching a
+ * human sentence. Closed vocabulary for the same reason as GatewayErrorCode: the app leg
+ * is versioned together with the gateway, so clients can switch exhaustively.
+ *
+ * @generated from enum kusinta.iot.webrtc.v1.CommandErrorCode
+ */
+export const CommandErrorCode = /*@__PURE__*/
+  tsEnum(CommandErrorCodeSchema);
+