@kusinta/iot-schema 0.2.0-beta.27 → 0.2.0-beta.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kusinta/iot-schema",
-  "version": "0.2.0-beta.27",
+  "version": "0.2.0-beta.29",
   "type": "module",
   "license": "MIT",
   "files": ["src"],

package/src/kusinta/iot/space/v1/space_pb.d.ts

@@ -145,6 +145,20 @@ export declare type SpaceMember = Message<"kusinta.iot.space.v1.SpaceMember"> &
    * @generated from field: kusinta.iot.access.v1.MembershipRelation relation = 2;
    */
   relation: MembershipRelation;
+
+  /**
+   * The name the member gave, self-chosen and not verified, so the app shows it as the name
+   * they gave rather than as an identity. Given only to a caller who is a resident of the
+   * apartment the member is filed on, or on one of its rooms: the people they live with,
+   * and anyone filed on their home as service, whom webrtc.v1.PrivacyDisclosure already
+   * names to them. Empty for every other caller — a property owner, an administrator,
+   * service, and residents of any other home — and for a member whose name the gateway has
+   * not learnt. A caller who is a resident of the home reads an empty name as not known;
+   * anyone else is given none. Residents are never named anywhere else.
+   *
+   * @generated from field: string name = 3;
+   */
+  name: string;
 };
 
 /**

package/src/kusinta/iot/space/v1/space_pb.js

@@ -11,7 +11,7 @@ import { file_kusinta_iot_identity_v1_identity } from "../../identity/v1/identit
  * Describes the file kusinta/iot/space/v1/space.proto.
  */
 export const file_kusinta_iot_space_v1_space = /*@__PURE__*/
-  fileDesc("CiBrdXNpbnRhL2lvdC9zcGFjZS92MS9zcGFjZS5wcm90bxIUa3VzaW50YS5pb3Quc3BhY2UudjEi3AQKBVNwYWNlEjIKCHNwYWNlX2lkGAEgASgLMiAua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuU3BhY2VJZBI0CgpzcGFjZV90eXBlGAIgASgOMiAua3VzaW50YS5pb3QuY29tbW9uLnYxLlNwYWNlVHlwZRIMCgRuYW1lGAMgASgJEhMKC2Rlc2NyaXB0aW9uGAQgASgJEg0KBWZsb29yGAUgASgFEjkKD3BhcmVudF9zcGFjZV9pZBgGIAEoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQSNwoNc3ViX3NwYWNlX2lkcxgHIAMoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQSNQoKZGV2aWNlX2lkcxgIIAMoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkEj0KEHJlc2lkZW50X3VzZXJfaWQYCSABKAsyHy5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5Vc2VySWRCAhgBEjQKCXRlbmFudF9pZBgKIAEoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlRlbmFudElkEjYKCmdhdGV3YXlfaWQYCyABKAsyIi5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5HYXRld2F5SWQSEQoJdGltZV96b25lGAwgASgJEjIKB21lbWJlcnMYDSADKAsyIS5rdXNpbnRhLmlvdC5zcGFjZS52MS5TcGFjZU1lbWJlchIYChBtZW1iZXJzX3dpdGhoZWxkGA4gASgIInwKC1NwYWNlTWVtYmVyEjAKB3VzZXJfaWQYASABKAsyHy5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5Vc2VySWQSOwoIcmVsYXRpb24YAiABKA4yKS5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuTWVtYmVyc2hpcFJlbGF0aW9uQgJIAWIGcHJvdG8z", [file_kusinta_iot_access_v1_roles, file_kusinta_iot_common_v1_types, file_kusinta_iot_identity_v1_identity]);
+  fileDesc("CiBrdXNpbnRhL2lvdC9zcGFjZS92MS9zcGFjZS5wcm90bxIUa3VzaW50YS5pb3Quc3BhY2UudjEi3AQKBVNwYWNlEjIKCHNwYWNlX2lkGAEgASgLMiAua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuU3BhY2VJZBI0CgpzcGFjZV90eXBlGAIgASgOMiAua3VzaW50YS5pb3QuY29tbW9uLnYxLlNwYWNlVHlwZRIMCgRuYW1lGAMgASgJEhMKC2Rlc2NyaXB0aW9uGAQgASgJEg0KBWZsb29yGAUgASgFEjkKD3BhcmVudF9zcGFjZV9pZBgGIAEoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQSNwoNc3ViX3NwYWNlX2lkcxgHIAMoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQSNQoKZGV2aWNlX2lkcxgIIAMoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkEj0KEHJlc2lkZW50X3VzZXJfaWQYCSABKAsyHy5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5Vc2VySWRCAhgBEjQKCXRlbmFudF9pZBgKIAEoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlRlbmFudElkEjYKCmdhdGV3YXlfaWQYCyABKAsyIi5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5HYXRld2F5SWQSEQoJdGltZV96b25lGAwgASgJEjIKB21lbWJlcnMYDSADKAsyIS5rdXNpbnRhLmlvdC5zcGFjZS52MS5TcGFjZU1lbWJlchIYChBtZW1iZXJzX3dpdGhoZWxkGA4gASgIIooBCgtTcGFjZU1lbWJlchIwCgd1c2VyX2lkGAEgASgLMh8ua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuVXNlcklkEjsKCHJlbGF0aW9uGAIgASgOMikua3VzaW50YS5pb3QuYWNjZXNzLnYxLk1lbWJlcnNoaXBSZWxhdGlvbhIMCgRuYW1lGAMgASgJQgJIAWIGcHJvdG8z", [file_kusinta_iot_access_v1_roles, file_kusinta_iot_common_v1_types, file_kusinta_iot_identity_v1_identity]);
 
 /**
  * Describes the message kusinta.iot.space.v1.Space.

package/src/kusinta/iot/webrtc/v1/device_state_pb.d.ts

@@ -7,6 +7,7 @@ import type { Message } from "@bufbuild/protobuf";
 import type { Device } from "../../device/v1/device_pb.js";
 import type { EffectivePermissions } from "../../access/v1/acl_pb.js";
 import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import type { SessionRoles } from "./permission_push_pb.js";
 import type { DeviceId } from "../../identity/v1/identity_pb.js";
 import type { PropertyUpdate } from "../../device/v1/property_update_pb.js";
 
@@ -46,6 +47,14 @@ export declare type DeviceStateSnapshot = Message<"kusinta.iot.webrtc.v1.DeviceS
    * @generated from field: repeated kusinta.iot.webrtc.v1.ServiceStatus service_statuses = 4;
    */
   serviceStatuses: ServiceStatus[];
+
+  /**
+   * The roles the gateway holds for the session as it opens (see SessionRoles). Every
+   * LivePermissionUpdate after it carries them again.
+   *
+   * @generated from field: kusinta.iot.webrtc.v1.SessionRoles session_roles = 5;
+   */
+  sessionRoles?: SessionRoles | undefined;
 };
 
 /**

package/src/kusinta/iot/webrtc/v1/device_state_pb.js

@@ -8,12 +8,13 @@ import { file_kusinta_iot_access_v1_acl } from "../../access/v1/acl_pb.js";
 import { file_kusinta_iot_device_v1_device } from "../../device/v1/device_pb.js";
 import { file_kusinta_iot_device_v1_property_update } from "../../device/v1/property_update_pb.js";
 import { file_kusinta_iot_identity_v1_identity } from "../../identity/v1/identity_pb.js";
+import { file_kusinta_iot_webrtc_v1_permission_push } from "./permission_push_pb.js";
 
 /**
  * Describes the file kusinta/iot/webrtc/v1/device_state.proto.
  */
 export const file_kusinta_iot_webrtc_v1_device_state = /*@__PURE__*/
-  fileDesc("CihrdXNpbnRhL2lvdC93ZWJydGMvdjEvZGV2aWNlX3N0YXRlLnByb3RvEhVrdXNpbnRhLmlvdC53ZWJydGMudjEi+wEKE0RldmljZVN0YXRlU25hcHNob3QSLgoHZGV2aWNlcxgBIAMoCzIdLmt1c2ludGEuaW90LmRldmljZS52MS5EZXZpY2USQAoLcGVybWlzc2lvbnMYAiABKAsyKy5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuRWZmZWN0aXZlUGVybWlzc2lvbnMSMgoOc25hcHNob3R0ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEj4KEHNlcnZpY2Vfc3RhdHVzZXMYBCADKAsyJC5rdXNpbnRhLmlvdC53ZWJydGMudjEuU2VydmljZVN0YXR1cyKIAwoNU2VydmljZVN0YXR1cxI0CglkZXZpY2VfaWQYASABKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZBIpCgVhc19vZhgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEQoJcmVhY2hhYmxlGAMgASgIEjUKEXVucmVhY2hhYmxlX3NpbmNlGAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIcCg9iYXR0ZXJ5X3BlcmNlbnQYBSABKA1IAIgBARITCgtiYXR0ZXJ5X2xvdxgGIAEoCBIiChpiYXR0ZXJ5X3JlcGxhY2VtZW50X25lZWRlZBgHIAEoCBIaCg1yYWRpb19xdWFsaXR5GAggASgNSAGIAQESMwoGZmF1bHRzGAkgAygOMiMua3VzaW50YS5pb3Qud2VicnRjLnYxLlNlcnZpY2VGYXVsdEISChBfYmF0dGVyeV9wZXJjZW50QhAKDl9yYWRpb19xdWFsaXR5Ik4KFFNlcnZpY2VTdGF0dXNDaGFuZ2VkEjYKCHN0YXR1c2VzGAEgAygLMiQua3VzaW50YS5pb3Qud2VicnRjLnYxLlNlcnZpY2VTdGF0dXMigQEKDlByb3BlcnR5UmVwb3J0EjUKBnVwZGF0ZRgBIAEoCzIlLmt1c2ludGEuaW90LmRldmljZS52MS5Qcm9wZXJ0eVVwZGF0ZRI4ChRnYXRld2F5X3Byb2Nlc3NlZF9hdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiPAoLRGV2aWNlQWRkZWQSLQoGZGV2aWNlGAEgASgLMh0ua3VzaW50YS5pb3QuZGV2aWNlLnYxLkRldmljZSJVCg1EZXZpY2VSZW1vdmVkEjQKCWRldmljZV9pZBgBIAEoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkEg4KBnJlYXNvbhgCIAEoCSpgCgxTZXJ2aWNlRmF1bHQSHQoZU0VSVklDRV9GQVVMVF9VTlNQRUNJRklFRBAAEhcKE1NFUlZJQ0VfRkFVTFRfRVJST1IQARIYChRTRVJWSUNFX0ZBVUxUX1RBTVBFUhACQgJIAWIGcHJvdG8z", [file_google_protobuf_timestamp, file_kusinta_iot_access_v1_acl, file_kusinta_iot_device_v1_device, file_kusinta_iot_device_v1_property_update, file_kusinta_iot_identity_v1_identity]);
+  fileDesc("CihrdXNpbnRhL2lvdC93ZWJydGMvdjEvZGV2aWNlX3N0YXRlLnByb3RvEhVrdXNpbnRhLmlvdC53ZWJydGMudjEitwIKE0RldmljZVN0YXRlU25hcHNob3QSLgoHZGV2aWNlcxgBIAMoCzIdLmt1c2ludGEuaW90LmRldmljZS52MS5EZXZpY2USQAoLcGVybWlzc2lvbnMYAiABKAsyKy5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuRWZmZWN0aXZlUGVybWlzc2lvbnMSMgoOc25hcHNob3R0ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEj4KEHNlcnZpY2Vfc3RhdHVzZXMYBCADKAsyJC5rdXNpbnRhLmlvdC53ZWJydGMudjEuU2VydmljZVN0YXR1cxI6Cg1zZXNzaW9uX3JvbGVzGAUgASgLMiMua3VzaW50YS5pb3Qud2VicnRjLnYxLlNlc3Npb25Sb2xlcyKIAwoNU2VydmljZVN0YXR1cxI0CglkZXZpY2VfaWQYASABKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZBIpCgVhc19vZhgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASEQoJcmVhY2hhYmxlGAMgASgIEjUKEXVucmVhY2hhYmxlX3NpbmNlGAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIcCg9iYXR0ZXJ5X3BlcmNlbnQYBSABKA1IAIgBARITCgtiYXR0ZXJ5X2xvdxgGIAEoCBIiChpiYXR0ZXJ5X3JlcGxhY2VtZW50X25lZWRlZBgHIAEoCBIaCg1yYWRpb19xdWFsaXR5GAggASgNSAGIAQESMwoGZmF1bHRzGAkgAygOMiMua3VzaW50YS5pb3Qud2VicnRjLnYxLlNlcnZpY2VGYXVsdEISChBfYmF0dGVyeV9wZXJjZW50QhAKDl9yYWRpb19xdWFsaXR5Ik4KFFNlcnZpY2VTdGF0dXNDaGFuZ2VkEjYKCHN0YXR1c2VzGAEgAygLMiQua3VzaW50YS5pb3Qud2VicnRjLnYxLlNlcnZpY2VTdGF0dXMigQEKDlByb3BlcnR5UmVwb3J0EjUKBnVwZGF0ZRgBIAEoCzIlLmt1c2ludGEuaW90LmRldmljZS52MS5Qcm9wZXJ0eVVwZGF0ZRI4ChRnYXRld2F5X3Byb2Nlc3NlZF9hdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiPAoLRGV2aWNlQWRkZWQSLQoGZGV2aWNlGAEgASgLMh0ua3VzaW50YS5pb3QuZGV2aWNlLnYxLkRldmljZSJVCg1EZXZpY2VSZW1vdmVkEjQKCWRldmljZV9pZBgBIAEoCzIhLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkRldmljZUlkEg4KBnJlYXNvbhgCIAEoCSpgCgxTZXJ2aWNlRmF1bHQSHQoZU0VSVklDRV9GQVVMVF9VTlNQRUNJRklFRBAAEhcKE1NFUlZJQ0VfRkFVTFRfRVJST1IQARIYChRTRVJWSUNFX0ZBVUxUX1RBTVBFUhACQgJIAWIGcHJvdG8z", [file_google_protobuf_timestamp, file_kusinta_iot_access_v1_acl, file_kusinta_iot_device_v1_device, file_kusinta_iot_device_v1_property_update, file_kusinta_iot_identity_v1_identity, file_kusinta_iot_webrtc_v1_permission_push]);
 
 /**
  * Describes the message kusinta.iot.webrtc.v1.DeviceStateSnapshot.

package/src/kusinta/iot/webrtc/v1/invite_pb.d.ts

@@ -68,10 +68,11 @@ export declare type CreateInvite = Message<"kusinta.iot.webrtc.v1.CreateInvite">
    * on a RESIDENT invite it is INVALID_REQUEST, as is a time not after now. Unset for no
    * end. Both secrets expire no later than it.
    *
-   * It reaches only someone the redeem makes a technician: a user who held no role but
-   * ROLE_RESIDENT before. For anyone else redeeming the invite it is ignored, so an invite
-   * can neither shorten nor lengthen a member's access, nor put an end on a property owner
-   * or an administrator.
+   * It reaches only someone the redeem, or the approval of the join request it makes, makes
+   * a technician: a user who held no role but ROLE_RESIDENT before and is not the
+   * registering administrator. For anyone else it is ignored, so an invite can neither
+   * shorten nor lengthen a member's access, nor put an end on a property owner or an
+   * administrator. A join request the invite makes expires no later than it.
    *
    * @generated from field: google.protobuf.Timestamp access_until = 4;
    */
@@ -377,6 +378,15 @@ export declare type JoinRequest = Message<"kusinta.iot.webrtc.v1.JoinRequest"> &
    * @generated from field: string email = 9;
    */
   email: string;
+
+  /**
+   * The end of access the request asks for: CreateInvite.access_until of the invite that
+   * was redeemed, which the approval gives as that field says. Unset for none. The request
+   * expires no later than it, so it is never approved once the end has passed.
+   *
+   * @generated from field: google.protobuf.Timestamp access_until = 10;
+   */
+  accessUntil?: Timestamp | undefined;
 };
 
 /**

package/src/kusinta/iot/webrtc/v1/invite_pb.js

@@ -11,7 +11,7 @@ import { file_kusinta_iot_identity_v1_identity } from "../../identity/v1/identit
  * Describes the file kusinta/iot/webrtc/v1/invite.proto.
  */
 export const file_kusinta_iot_webrtc_v1_invite = /*@__PURE__*/
-  fileDesc("CiJrdXNpbnRhL2lvdC93ZWJydGMvdjEvaW52aXRlLnByb3RvEhVrdXNpbnRhLmlvdC53ZWJydGMudjEiwAEKDENyZWF0ZUludml0ZRIyCghzcGFjZV9pZBgBIAEoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQSOwoIcmVsYXRpb24YAiABKA4yKS5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuTWVtYmVyc2hpcFJlbGF0aW9uEg0KBWVtYWlsGAMgASgJEjAKDGFjY2Vzc191bnRpbBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiIQoMUmVzZW5kSW52aXRlEhEKCWludml0ZV9pZBgBIAEoCSIhCgxSZXZva2VJbnZpdGUSEQoJaW52aXRlX2lkGAEgASgJIigKE01hcmtJbnZpdGVFbWFpbFNlbnQSEQoJaW52aXRlX2lkGAEgASgJIkYKEExpc3RTcGFjZUludml0ZXMSMgoIc3BhY2VfaWQYASABKAsyIC5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5TcGFjZUlkIigKEkFwcHJvdmVKb2luUmVxdWVzdBISCgpyZXF1ZXN0X2lkGAEgASgJIiUKD0RlbnlKb2luUmVxdWVzdBISCgpyZXF1ZXN0X2lkGAEgASgJItADCgZJbnZpdGUSEQoJaW52aXRlX2lkGAEgASgJEjIKCHNwYWNlX2lkGAIgASgLMiAua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuU3BhY2VJZBI7CghyZWxhdGlvbhgDIAEoDjIpLmt1c2ludGEuaW90LmFjY2Vzcy52MS5NZW1iZXJzaGlwUmVsYXRpb24SMwoKY3JlYXRlZF9ieRgEIAEoCzIfLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlVzZXJJZBIuCgpjcmVhdGVkX2F0GAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI0ChB0b2tlbl9leHBpcmVzX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIzCg9jb2RlX2V4cGlyZXNfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEg0KBWVtYWlsGAggASgJEjEKDWVtYWlsX3NlbnRfYXQYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjAKDGFjY2Vzc191bnRpbBgKIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiWgoMSXNzdWVkSW52aXRlEi0KBmludml0ZRgBIAEoCzIdLmt1c2ludGEuaW90LndlYnJ0Yy52MS5JbnZpdGUSDQoFdG9rZW4YAiABKAkSDAoEY29kZRgDIAEoCSKAAwoLSm9pblJlcXVlc3QSEgoKcmVxdWVzdF9pZBgBIAEoCRIyCghzcGFjZV9pZBgCIAEoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQSOwoIcmVsYXRpb24YAyABKA4yKS5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuTWVtYmVyc2hpcFJlbGF0aW9uEjAKB3VzZXJfaWQYBCABKAsyHy5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5Vc2VySWQSFAoMZGlzcGxheV9uYW1lGAUgASgJEjMKCmludml0ZWRfYnkYBiABKAsyHy5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5Vc2VySWQSMAoMcmVxdWVzdGVkX2F0GAcgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpleHBpcmVzX2F0GAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBINCgVlbWFpbBgJIAEoCSKtAQoMU3BhY2VJbnZpdGVzEjIKCHNwYWNlX2lkGAEgASgLMiAua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuU3BhY2VJZBIuCgdpbnZpdGVzGAIgAygLMh0ua3VzaW50YS5pb3Qud2VicnRjLnYxLkludml0ZRI5Cg1qb2luX3JlcXVlc3RzGAMgAygLMiIua3VzaW50YS5pb3Qud2VicnRjLnYxLkpvaW5SZXF1ZXN0QgJIAWIGcHJvdG8z", [file_google_protobuf_timestamp, file_kusinta_iot_access_v1_roles, file_kusinta_iot_identity_v1_identity]);
+  fileDesc("CiJrdXNpbnRhL2lvdC93ZWJydGMvdjEvaW52aXRlLnByb3RvEhVrdXNpbnRhLmlvdC53ZWJydGMudjEiwAEKDENyZWF0ZUludml0ZRIyCghzcGFjZV9pZBgBIAEoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQSOwoIcmVsYXRpb24YAiABKA4yKS5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuTWVtYmVyc2hpcFJlbGF0aW9uEg0KBWVtYWlsGAMgASgJEjAKDGFjY2Vzc191bnRpbBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiIQoMUmVzZW5kSW52aXRlEhEKCWludml0ZV9pZBgBIAEoCSIhCgxSZXZva2VJbnZpdGUSEQoJaW52aXRlX2lkGAEgASgJIigKE01hcmtJbnZpdGVFbWFpbFNlbnQSEQoJaW52aXRlX2lkGAEgASgJIkYKEExpc3RTcGFjZUludml0ZXMSMgoIc3BhY2VfaWQYASABKAsyIC5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5TcGFjZUlkIigKEkFwcHJvdmVKb2luUmVxdWVzdBISCgpyZXF1ZXN0X2lkGAEgASgJIiUKD0RlbnlKb2luUmVxdWVzdBISCgpyZXF1ZXN0X2lkGAEgASgJItADCgZJbnZpdGUSEQoJaW52aXRlX2lkGAEgASgJEjIKCHNwYWNlX2lkGAIgASgLMiAua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuU3BhY2VJZBI7CghyZWxhdGlvbhgDIAEoDjIpLmt1c2ludGEuaW90LmFjY2Vzcy52MS5NZW1iZXJzaGlwUmVsYXRpb24SMwoKY3JlYXRlZF9ieRgEIAEoCzIfLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlVzZXJJZBIuCgpjcmVhdGVkX2F0GAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI0ChB0b2tlbl9leHBpcmVzX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIzCg9jb2RlX2V4cGlyZXNfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEg0KBWVtYWlsGAggASgJEjEKDWVtYWlsX3NlbnRfYXQYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjAKDGFjY2Vzc191bnRpbBgKIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiWgoMSXNzdWVkSW52aXRlEi0KBmludml0ZRgBIAEoCzIdLmt1c2ludGEuaW90LndlYnJ0Yy52MS5JbnZpdGUSDQoFdG9rZW4YAiABKAkSDAoEY29kZRgDIAEoCSKyAwoLSm9pblJlcXVlc3QSEgoKcmVxdWVzdF9pZBgBIAEoCRIyCghzcGFjZV9pZBgCIAEoCzIgLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlNwYWNlSWQSOwoIcmVsYXRpb24YAyABKA4yKS5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuTWVtYmVyc2hpcFJlbGF0aW9uEjAKB3VzZXJfaWQYBCABKAsyHy5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5Vc2VySWQSFAoMZGlzcGxheV9uYW1lGAUgASgJEjMKCmludml0ZWRfYnkYBiABKAsyHy5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5Vc2VySWQSMAoMcmVxdWVzdGVkX2F0GAcgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpleHBpcmVzX2F0GAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBINCgVlbWFpbBgJIAEoCRIwCgxhY2Nlc3NfdW50aWwYCiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIq0BCgxTcGFjZUludml0ZXMSMgoIc3BhY2VfaWQYASABKAsyIC5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5TcGFjZUlkEi4KB2ludml0ZXMYAiADKAsyHS5rdXNpbnRhLmlvdC53ZWJydGMudjEuSW52aXRlEjkKDWpvaW5fcmVxdWVzdHMYAyADKAsyIi5rdXNpbnRhLmlvdC53ZWJydGMudjEuSm9pblJlcXVlc3RCAkgBYgZwcm90bzM", [file_google_protobuf_timestamp, file_kusinta_iot_access_v1_roles, file_kusinta_iot_identity_v1_identity]);
 
 /**
  * Describes the message kusinta.iot.webrtc.v1.CreateInvite.

package/src/kusinta/iot/webrtc/v1/permission_push_pb.d.ts

@@ -6,6 +6,7 @@ import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
 import type { Message } from "@bufbuild/protobuf";
 import type { EffectivePermissions } from "../../access/v1/acl_pb.js";
 import type { DeviceId, SpaceId } from "../../identity/v1/identity_pb.js";
+import type { Role } from "../../access/v1/roles_pb.js";
 
 /**
  * Describes the file kusinta/iot/webrtc/v1/permission_push.proto.
@@ -71,6 +72,15 @@ export declare type LivePermissionUpdate = Message<"kusinta.iot.webrtc.v1.LivePe
    * @generated from field: repeated kusinta.iot.identity.v1.SpaceId reset_spaces = 5;
    */
   resetSpaces: SpaceId[];
+
+  /**
+   * The roles the session holds once this change has taken effect, as in
+   * DeviceStateSnapshot.session_roles. Set on every update, a change of role alone included,
+   * so that a promotion or demotion reaches an open app at once.
+   *
+   * @generated from field: kusinta.iot.webrtc.v1.SessionRoles session_roles = 6;
+   */
+  sessionRoles?: SessionRoles | undefined;
 };
 
 /**
@@ -79,3 +89,28 @@ export declare type LivePermissionUpdate = Message<"kusinta.iot.webrtc.v1.LivePe
  */
 export declare const LivePermissionUpdateSchema: GenMessage<LivePermissionUpdate>;
 
+/**
+ * The roles the gateway holds for a session's user: those it records for them, together
+ * with administration their token vouches for. The app MUST prefer these, while the session
+ * is up, over any other source of the user's roles on this gateway. They decide only what
+ * the app offers; the gateway still decides every request on its own.
+ *
+ * A gateway that sends them sets the field on every DeviceStateSnapshot and
+ * LivePermissionUpdate, so an unset field means a gateway that does not, and an empty list
+ * means the user holds no role.
+ *
+ * @generated from message kusinta.iot.webrtc.v1.SessionRoles
+ */
+export declare type SessionRoles = Message<"kusinta.iot.webrtc.v1.SessionRoles"> & {
+  /**
+   * @generated from field: repeated kusinta.iot.access.v1.Role roles = 1;
+   */
+  roles: Role[];
+};
+
+/**
+ * Describes the message kusinta.iot.webrtc.v1.SessionRoles.
+ * Use `create(SessionRolesSchema)` to create a new message.
+ */
+export declare const SessionRolesSchema: GenMessage<SessionRoles>;
+

package/src/kusinta/iot/webrtc/v1/permission_push_pb.js

@@ -4,13 +4,14 @@
 
 import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
 import { file_kusinta_iot_access_v1_acl } from "../../access/v1/acl_pb.js";
+import { file_kusinta_iot_access_v1_roles } from "../../access/v1/roles_pb.js";
 import { file_kusinta_iot_identity_v1_identity } from "../../identity/v1/identity_pb.js";
 
 /**
  * Describes the file kusinta/iot/webrtc/v1/permission_push.proto.
  */
 export const file_kusinta_iot_webrtc_v1_permission_push = /*@__PURE__*/
-  fileDesc("CitrdXNpbnRhL2lvdC93ZWJydGMvdjEvcGVybWlzc2lvbl9wdXNoLnByb3RvEhVrdXNpbnRhLmlvdC53ZWJydGMudjEioQIKFExpdmVQZXJtaXNzaW9uVXBkYXRlEkQKD25ld19wZXJtaXNzaW9ucxgBIAEoCzIrLmt1c2ludGEuaW90LmFjY2Vzcy52MS5FZmZlY3RpdmVQZXJtaXNzaW9ucxI4Cg1hZGRlZF9kZXZpY2VzGAIgAygLMiEua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuRGV2aWNlSWQSOgoPcmVtb3ZlZF9kZXZpY2VzGAMgAygLMiEua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuRGV2aWNlSWQSFQoNY2hhbmdlX3JlYXNvbhgEIAEoCRI2CgxyZXNldF9zcGFjZXMYBSADKAsyIC5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5TcGFjZUlkQgJIAWIGcHJvdG8z", [file_kusinta_iot_access_v1_acl, file_kusinta_iot_identity_v1_identity]);
+  fileDesc("CitrdXNpbnRhL2lvdC93ZWJydGMvdjEvcGVybWlzc2lvbl9wdXNoLnByb3RvEhVrdXNpbnRhLmlvdC53ZWJydGMudjEi3QIKFExpdmVQZXJtaXNzaW9uVXBkYXRlEkQKD25ld19wZXJtaXNzaW9ucxgBIAEoCzIrLmt1c2ludGEuaW90LmFjY2Vzcy52MS5FZmZlY3RpdmVQZXJtaXNzaW9ucxI4Cg1hZGRlZF9kZXZpY2VzGAIgAygLMiEua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuRGV2aWNlSWQSOgoPcmVtb3ZlZF9kZXZpY2VzGAMgAygLMiEua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuRGV2aWNlSWQSFQoNY2hhbmdlX3JlYXNvbhgEIAEoCRI2CgxyZXNldF9zcGFjZXMYBSADKAsyIC5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5TcGFjZUlkEjoKDXNlc3Npb25fcm9sZXMYBiABKAsyIy5rdXNpbnRhLmlvdC53ZWJydGMudjEuU2Vzc2lvblJvbGVzIjoKDFNlc3Npb25Sb2xlcxIqCgVyb2xlcxgBIAMoDjIbLmt1c2ludGEuaW90LmFjY2Vzcy52MS5Sb2xlQgJIAWIGcHJvdG8z", [file_kusinta_iot_access_v1_acl, file_kusinta_iot_access_v1_roles, file_kusinta_iot_identity_v1_identity]);
 
 /**
  * Describes the message kusinta.iot.webrtc.v1.LivePermissionUpdate.
@@ -19,3 +20,10 @@ export const file_kusinta_iot_webrtc_v1_permission_push = /*@__PURE__*/
 export const LivePermissionUpdateSchema = /*@__PURE__*/
   messageDesc(file_kusinta_iot_webrtc_v1_permission_push, 0);
 
+/**
+ * Describes the message kusinta.iot.webrtc.v1.SessionRoles.
+ * Use `create(SessionRolesSchema)` to create a new message.
+ */
+export const SessionRolesSchema = /*@__PURE__*/
+  messageDesc(file_kusinta_iot_webrtc_v1_permission_push, 1);
+