@kusinta/iot-schema 0.1.0-beta.9 → 0.2.0-beta.2

package/src/kusinta/iot/vendor/v1/vendor_options_pb.d.ts

@@ -0,0 +1,50 @@
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file kusinta/iot/vendor/v1/vendor_options.proto (package kusinta.iot.vendor.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenExtension, GenFile } from "@bufbuild/protobuf/codegenv2";
+import type { FieldOptions, MessageOptions } from "@bufbuild/protobuf/wkt";
+
+/**
+ * Describes the file kusinta/iot/vendor/v1/vendor_options.proto.
+ */
+export declare const file_kusinta_iot_vendor_v1_vendor_options: GenFile;
+
+/**
+ * The vendor parameter this field carries, in the vendor's own spelling — e.g.
+ * "LEVEL", not "level". Matches device.v1.PropertyUpdate.attribute_name byte for byte
+ * when that update names a vendor extension.
+ *
+ * This and the Matter annotations are mutually exclusive: a field is either a Matter
+ * attribute or a vendor parameter. Which branch a PropertyUpdate takes is decided by
+ * whether it names a vendor extension, never by inspecting both.
+ *
+ * Must be unique within the message it appears in — the vendor branch matches one
+ * field of one message, so a repeat would make resolution ambiguous.
+ *
+ * @generated from extension: string vendor_attribute = 50004;
+ */
+export declare const vendor_attribute: GenExtension<FieldOptions, string>;
+
+/**
+ * The stable key identifying a vendor extension message, e.g. "homematic.thermostat".
+ * Matches device.v1.PropertyUpdate.vendor_extension byte for byte, and is what selects
+ * the Endpoint.vendor_properties case.
+ *
+ * One key per message carried in Endpoint.vendor_properties, so the vendor branch of the
+ * resolution rule is the same shape as the Matter branch: pick a message by a message
+ * option, then one field by a field option. Nothing nests.
+ *
+ * Form: "<vendor>.<what the message models>", lower_snake_case on both sides —
+ * "homematic.thermostat", and a humidity one would be "homematic.humidity_sensor". The
+ * vendor half alone is NOT a key: a vendor has one message per device type it extends,
+ * and two sharing a key would make the branch non-deterministic. A test asserts they
+ * are distinct, but it cannot tell you which of two is wrong, so keep to the form.
+ *
+ * Not derived from the package or message name — this is the authoritative spelling,
+ * exactly as matter_attribute is on the Matter side.
+ *
+ * @generated from extension: string vendor_extension = 50005;
+ */
+export declare const vendor_extension: GenExtension<MessageOptions, string>;
+

package/src/kusinta/iot/vendor/v1/vendor_options_pb.js

@@ -0,0 +1,53 @@
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file kusinta/iot/vendor/v1/vendor_options.proto (package kusinta.iot.vendor.v1, syntax proto3)
+/* eslint-disable */
+
+import { extDesc, fileDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_google_protobuf_descriptor } from "@bufbuild/protobuf/wkt";
+
+/**
+ * Describes the file kusinta/iot/vendor/v1/vendor_options.proto.
+ */
+export const file_kusinta_iot_vendor_v1_vendor_options = /*@__PURE__*/
+  fileDesc("CiprdXNpbnRhL2lvdC92ZW5kb3IvdjEvdmVuZG9yX29wdGlvbnMucHJvdG8SFWt1c2ludGEuaW90LnZlbmRvci52MTpKChB2ZW5kb3JfYXR0cmlidXRlEh0uZ29vZ2xlLnByb3RvYnVmLkZpZWxkT3B0aW9ucxjUhgMgASgJUg92ZW5kb3JBdHRyaWJ1dGU6TAoQdmVuZG9yX2V4dGVuc2lvbhIfLmdvb2dsZS5wcm90b2J1Zi5NZXNzYWdlT3B0aW9ucxjVhgMgASgJUg92ZW5kb3JFeHRlbnNpb25iBnByb3RvMw", [file_google_protobuf_descriptor]);
+
+/**
+ * The vendor parameter this field carries, in the vendor's own spelling — e.g.
+ * "LEVEL", not "level". Matches device.v1.PropertyUpdate.attribute_name byte for byte
+ * when that update names a vendor extension.
+ *
+ * This and the Matter annotations are mutually exclusive: a field is either a Matter
+ * attribute or a vendor parameter. Which branch a PropertyUpdate takes is decided by
+ * whether it names a vendor extension, never by inspecting both.
+ *
+ * Must be unique within the message it appears in — the vendor branch matches one
+ * field of one message, so a repeat would make resolution ambiguous.
+ *
+ * @generated from extension: string vendor_attribute = 50004;
+ */
+export const vendor_attribute = /*@__PURE__*/
+  extDesc(file_kusinta_iot_vendor_v1_vendor_options, 0);
+
+/**
+ * The stable key identifying a vendor extension message, e.g. "homematic.thermostat".
+ * Matches device.v1.PropertyUpdate.vendor_extension byte for byte, and is what selects
+ * the Endpoint.vendor_properties case.
+ *
+ * One key per message carried in Endpoint.vendor_properties, so the vendor branch of the
+ * resolution rule is the same shape as the Matter branch: pick a message by a message
+ * option, then one field by a field option. Nothing nests.
+ *
+ * Form: "<vendor>.<what the message models>", lower_snake_case on both sides —
+ * "homematic.thermostat", and a humidity one would be "homematic.humidity_sensor". The
+ * vendor half alone is NOT a key: a vendor has one message per device type it extends,
+ * and two sharing a key would make the branch non-deterministic. A test asserts they
+ * are distinct, but it cannot tell you which of two is wrong, so keep to the form.
+ *
+ * Not derived from the package or message name — this is the authoritative spelling,
+ * exactly as matter_attribute is on the Matter side.
+ *
+ * @generated from extension: string vendor_extension = 50005;
+ */
+export const vendor_extension = /*@__PURE__*/
+  extDesc(file_kusinta_iot_vendor_v1_vendor_options, 1);
+

package/src/kusinta/iot/webrtc/v1/app_token_pb.d.ts

@@ -0,0 +1,152 @@
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file kusinta/iot/webrtc/v1/app_token.proto (package kusinta.iot.webrtc.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { Message } from "@bufbuild/protobuf";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import type { Role } from "../../access/v1/roles_pb.js";
+
+/**
+ * Describes the file kusinta/iot/webrtc/v1/app_token.proto.
+ */
+export declare const file_kusinta_iot_webrtc_v1_app_token: GenFile;
+
+/**
+ * AppTokenClaims is the contract for the payload of the JWT carried in
+ * AppHandshake.jwt. It is the single source of truth shared between the
+ * api-server (which mints the token) and the gateway (which validates it
+ * locally against the api-server's public key).
+ *
+ * This message is NOT sent on the wire — the wire value stays the signed,
+ * compact JWS string in AppHandshake.jwt. The fields here document the claim
+ * names and types each side must agree on. JWT libraries emit registered
+ * claims (iss/aud/sub) as flat strings and timestamps as NumericDate
+ * (seconds since the Unix epoch), so map to/from your native JWT library
+ * rather than serializing this message directly into the token.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.AppTokenClaims
+ */
+export declare type AppTokenClaims = Message<"kusinta.iot.webrtc.v1.AppTokenClaims"> & {
+  /**
+   * Registered claims (RFC 7519).
+   * Issuer: the api-server's issuer identifier, agreed out of band. A fixed
+   * string both sides compare exactly — not derived from anything here.
+   *
+   * @generated from field: string iss = 1;
+   */
+  iss: string;
+
+  /**
+   * audience: the target GatewayId value
+   *
+   * @generated from field: string aud = 2;
+   */
+  aud: string;
+
+  /**
+   * subject: the UserId value
+   *
+   * @generated from field: string sub = 3;
+   */
+  sub: string;
+
+  /**
+   * issued-at  (JWT NumericDate on the wire)
+   *
+   * @generated from field: google.protobuf.Timestamp iat = 4;
+   */
+  iat?: Timestamp | undefined;
+
+  /**
+   * expiry     (JWT NumericDate on the wire)
+   *
+   * @generated from field: google.protobuf.Timestamp exp = 5;
+   */
+  exp?: Timestamp | undefined;
+
+  /**
+   * Custom claims.
+   * A user may hold several roles at once (e.g. resident + gateway admin), so
+   * this is a list. Carried in the JWT as an array of enum NAME strings
+   * (e.g. ["ROLE_RESIDENT", "ROLE_GATEWAY_ADMIN"]), matching proto3 canonical
+   * JSON enum encoding — not integer values. This keeps the claim
+   * self-describing and aligns with text-typed role storage on the api-server.
+   *
+   * @generated from field: repeated kusinta.iot.access.v1.Role roles = 6;
+   */
+  roles: Role[];
+
+  /**
+   * RFC 7800 confirmation claim. Binds the token to the DTLS certificate of the
+   * connection it may be presented on: the validator compares this against the
+   * fingerprint of the live peer and rejects on mismatch, so a token replayed on
+   * a different connection is not usable. Without it the token is a pure bearer
+   * credential — possession alone is the whole proof.
+   *
+   * Carried in the JWT as the nested object RFC 7800 specifies:
+   *   "cnf": { "x5t#S256": "<base64url SHA-256 thumbprint of the peer's DER certificate>" }
+   *
+   * MANDATORY. The issuer MUST set it on every token, and the validator MUST
+   * reject a token that arrives without one. proto3 cannot express that, and
+   * the claim is a JSON object in a JWT rather than a field on this message on
+   * the wire, so nothing mechanical enforces it — it is a contract both sides
+   * implement or the binding is worthless. A validator that treats an absent
+   * cnf as "fall back to bearer" reopens the exact replay this claim closes,
+   * and gives any holder of a stolen token a way to opt out of the check by
+   * stripping it.
+   *
+   * Rollout order, since a mandatory claim cannot appear on both sides at once:
+   * the api-server must be issuing cnf on every token BEFORE the gateway begins
+   * rejecting tokens that lack it. Reverse that order and every live session is
+   * refused. Tokens are short-TTL, so the gap between the two deployments need
+   * only exceed one token lifetime.
+   *
+   * @generated from field: kusinta.iot.webrtc.v1.Confirmation cnf = 7;
+   */
+  cnf?: Confirmation | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.AppTokenClaims.
+ * Use `create(AppTokenClaimsSchema)` to create a new message.
+ */
+export declare const AppTokenClaimsSchema: GenMessage<AppTokenClaims>;
+
+/**
+ * RFC 7800 confirmation, the value of the "cnf" claim. A separate message
+ * because the claim is a nested JSON object in the token, not a flat string.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.Confirmation
+ */
+export declare type Confirmation = Message<"kusinta.iot.webrtc.v1.Confirmation"> & {
+  /**
+   * JWT claim name "x5t#S256" — the proto field cannot carry the "#", so the
+   * mapping to and from the JWT is by hand on both sides.
+   *
+   * ENCODING, pinned deliberately: base64url (unpadded) of the SHA-256 digest
+   * over the peer's DER-encoded certificate. WebRTC stacks hand you the same
+   * digest in the SDP `a=fingerprint:sha-256` attribute in a DIFFERENT form —
+   * uppercase, colon-separated hex — and the two will never compare equal.
+   * Issuer and validator must both normalise to the base64url form here; left
+   * unstated, each side can derive a correct value and never match.
+   *
+   * A DTLS fingerprint names a CERTIFICATE, not a connection: WebRTC permits
+   * reusing one certificate across several peer connections, and a new
+   * connection normally brings a new certificate. It is therefore neither
+   * unique per connection nor stable across reconnects, and must not be used as
+   * a session or connection key. It is a credential — it proves the peer holds
+   * the private key for the certificate the token was issued against, which is
+   * exactly and only what a confirmation claim needs.
+   *
+   * @generated from field: string x5t_s256 = 1;
+   */
+  x5tS256: string;
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.Confirmation.
+ * Use `create(ConfirmationSchema)` to create a new message.
+ */
+export declare const ConfirmationSchema: GenMessage<Confirmation>;
+

package/src/kusinta/iot/webrtc/v1/app_token_pb.js

@@ -0,0 +1,28 @@
+// @generated by protoc-gen-es v2.12.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file kusinta/iot/webrtc/v1/app_token.proto (package kusinta.iot.webrtc.v1, syntax proto3)
+/* eslint-disable */
+
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_kusinta_iot_access_v1_roles } from "../../access/v1/roles_pb.js";
+
+/**
+ * Describes the file kusinta/iot/webrtc/v1/app_token.proto.
+ */
+export const file_kusinta_iot_webrtc_v1_app_token = /*@__PURE__*/
+  fileDesc("CiVrdXNpbnRhL2lvdC93ZWJydGMvdjEvYXBwX3Rva2VuLnByb3RvEhVrdXNpbnRhLmlvdC53ZWJydGMudjEi5wEKDkFwcFRva2VuQ2xhaW1zEgsKA2lzcxgBIAEoCRILCgNhdWQYAiABKAkSCwoDc3ViGAMgASgJEicKA2lhdBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASJwoDZXhwGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIqCgVyb2xlcxgGIAMoDjIbLmt1c2ludGEuaW90LmFjY2Vzcy52MS5Sb2xlEjAKA2NuZhgHIAEoCzIjLmt1c2ludGEuaW90LndlYnJ0Yy52MS5Db25maXJtYXRpb24iIAoMQ29uZmlybWF0aW9uEhAKCHg1dF9zMjU2GAEgASgJQgJIAWIGcHJvdG8z", [file_google_protobuf_timestamp, file_kusinta_iot_access_v1_roles]);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.AppTokenClaims.
+ * Use `create(AppTokenClaimsSchema)` to create a new message.
+ */
+export const AppTokenClaimsSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_app_token, 0);
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.Confirmation.
+ * Use `create(ConfirmationSchema)` to create a new message.
+ */
+export const ConfirmationSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_app_token, 1);
+