@kusinta/iot-schema 0.2.0-beta.4 → 0.2.0-beta.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kusinta/iot-schema",
-  "version": "0.2.0-beta.4",
+  "version": "0.2.0-beta.41",
   "type": "module",
   "license": "MIT",
   "files": ["src"],
@@ -10,6 +10,7 @@
   },
   "exports": {
     "./common":                 "./src/kusinta/iot/common/v1/types_pb.js",
+    "./common/pairing":         "./src/kusinta/iot/common/v1/pairing_pb.js",
     "./identity":               "./src/kusinta/iot/identity/v1/identity_pb.js",
     "./device":                 "./src/kusinta/iot/device/v1/device_pb.js",
     "./device/descriptor":      "./src/kusinta/iot/device/v1/descriptor_pb.js",
@@ -20,20 +21,31 @@
     "./device/event":           "./src/kusinta/iot/device/v1/device_event_pb.js",
     "./vendor/options":         "./src/kusinta/iot/vendor/v1/vendor_options_pb.js",
     "./vendor/homematic":       "./src/kusinta/iot/vendor/homematic/v1/homematic_pb.js",
+    "./vendor/lorawan":         "./src/kusinta/iot/vendor/lorawan/v1/lorawan_pb.js",
     "./space":                  "./src/kusinta/iot/space/v1/space_pb.js",
     "./access":                 "./src/kusinta/iot/access/v1/acl_pb.js",
     "./access/roles":           "./src/kusinta/iot/access/v1/roles_pb.js",
+    "./account-link":           "./src/kusinta/iot/accountlink/v1/account_link_pb.js",
+    "./link":                   "./src/kusinta/iot/link/v1/link_pb.js",
+    "./climate":                "./src/kusinta/iot/climate/v1/climate_pb.js",
+    "./commissioning":          "./src/kusinta/iot/commissioning/v1/commissioning_pb.js",
+    "./heating":                "./src/kusinta/iot/heating/v1/heating_pb.js",
     "./connector":              "./src/kusinta/iot/connector/v1/connector_pb.js",
     "./connector/service":      "./src/kusinta/iot/connector/v1/connector_service_pb.js",
     "./webrtc":                 "./src/kusinta/iot/webrtc/v1/envelope_pb.js",
     "./webrtc/app-token":       "./src/kusinta/iot/webrtc/v1/app_token_pb.js",
     "./webrtc/command":         "./src/kusinta/iot/webrtc/v1/command_pb.js",
     "./webrtc/device-state":    "./src/kusinta/iot/webrtc/v1/device_state_pb.js",
+    "./webrtc/household":       "./src/kusinta/iot/webrtc/v1/household_pb.js",
+    "./webrtc/invite":          "./src/kusinta/iot/webrtc/v1/invite_pb.js",
+    "./webrtc/members":         "./src/kusinta/iot/webrtc/v1/members_pb.js",
     "./webrtc/management":      "./src/kusinta/iot/webrtc/v1/management_pb.js",
     "./webrtc/permission-push": "./src/kusinta/iot/webrtc/v1/permission_push_pb.js",
     "./webrtc/setpoint-mode":   "./src/kusinta/iot/webrtc/v1/setpoint_mode_pb.js",
     "./registration":           "./src/kusinta/iot/registration/v1/registration_pb.js",
     "./registration/service":   "./src/kusinta/iot/registration/v1/registration_service_pb.js",
+    "./reporting":              "./src/kusinta/iot/reporting/v1/reporting_pb.js",
+    "./reporting/service":      "./src/kusinta/iot/reporting/v1/reporting_service_pb.js",
     "./signaling":              "./src/kusinta/iot/signaling/v1/signaling_pb.js",
     "./signaling/service":      "./src/kusinta/iot/signaling/v1/signaling_service_pb.js"
   },

package/src/kusinta/iot/access/v1/acl_pb.d.ts

@@ -2,10 +2,10 @@
 // @generated from file kusinta/iot/access/v1/acl.proto (package kusinta.iot.access.v1, syntax proto3)
 /* eslint-disable */
 
-import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
 import type { Message } from "@bufbuild/protobuf";
 import type { DeviceId, GatewayId, UserId } from "../../identity/v1/identity_pb.js";
-import type { PermissionAction, Role } from "./roles_pb.js";
+import type { MembershipRelation, PermissionAction, Role } from "./roles_pb.js";
 import type { Timestamp } from "@bufbuild/protobuf/wkt";
 
 /**
@@ -304,6 +304,26 @@ export declare type DeviceAcl = Message<"kusinta.iot.access.v1.DeviceAcl"> & {
    * @generated from field: repeated kusinta.iot.access.v1.EventRef allowed_event_refs = 10;
    */
   allowedEventRefs: EventRef[];
+
+  /**
+   * How the user stands to the home this device is filed in, where that shaped this ACL.
+   * See MembershipRelation in roles.proto.
+   *
+   * SERVICE: the user sees this building device in someone's home as service, whatever
+   * relation their membership records. They hold no action on it — allowed_actions is empty
+   * — and are sent no reading or event of it. The Device they are sent carries its
+   * description only: its endpoints with their device types and implemented lists, and no
+   * property value. What keeps it working comes as a webrtc.v1.ServiceStatus instead. An
+   * app should show its readings as withheld, not missing. RESIDENT: the user lives in the
+   * home the device is filed in, whether or not they also own it; a household admin is given
+   * RESIDENT here too, since they see the device as any resident does. UNSPECIFIED: neither
+   * applies — the device is not in a home, or the user reaches it only by owning it.
+   *
+   * Descriptive, like role: allowed_actions and the ref lists are what is enforced.
+   *
+   * @generated from field: kusinta.iot.access.v1.MembershipRelation relation = 11;
+   */
+  relation: MembershipRelation;
 };
 
 /**
@@ -361,3 +381,101 @@ export declare type EffectivePermissions = Message<"kusinta.iot.access.v1.Effect
  */
 export declare const EffectivePermissionsSchema: GenMessage<EffectivePermissions>;
 
+/**
+ * What service sees of a home, as a resident is told it in webrtc.v1.PrivacyDisclosure.
+ * Each names part of a webrtc.v1.ServiceStatus, of a device's description, of how the
+ * home is set up, or of who lives there; with the climate summary the disclosure names
+ * separately, nothing else of the home reaches service.
+ *
+ * @generated from enum kusinta.iot.access.v1.ServiceSignal
+ */
+export enum ServiceSignal {
+  /**
+   * @generated from enum value: SERVICE_SIGNAL_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Whether the device is reachable, and since which quarter hour it has not been.
+   *
+   * @generated from enum value: SERVICE_SIGNAL_REACHABILITY = 1;
+   */
+  REACHABILITY = 1,
+
+  /**
+   * Its remaining charge in steps of ten, and low-battery and replacement warnings.
+   *
+   * @generated from enum value: SERVICE_SIGNAL_BATTERY = 2;
+   */
+  BATTERY = 2,
+
+  /**
+   * How good its radio link is.
+   *
+   * @generated from enum value: SERVICE_SIGNAL_RADIO_LINK = 3;
+   */
+  RADIO_LINK = 3,
+
+  /**
+   * Its firmware version: DeviceDescriptor.software_version_string, sent to service.
+   *
+   * @generated from enum value: SERVICE_SIGNAL_FIRMWARE = 4;
+   */
+  FIRMWARE = 4,
+
+  /**
+   * Faults it reports about itself: errors and tampering. Not configuration it has yet to
+   * take, which would show when its residents changed a setting.
+   *
+   * @generated from enum value: SERVICE_SIGNAL_FAULT = 5;
+   */
+  FAULT = 5,
+
+  /**
+   * What the device is — its description, every field of device.v1.DeviceDescriptor but
+   * claimed_at: type, name, vendor, product, serial number, versions, ownership, asset
+   * owner, lifecycle and connector; its endpoints and what each supports — and where it is filed. A
+   * bridged_by naming a device the recipient may not see, such as a bridge a resident owns,
+   * is unset. Always disclosed together with FIRMWARE, whose
+   * version it carries. Not when it was claimed: the only times service is given of a
+   * device are the quarter hours of its webrtc.v1.ServiceStatus, and the moments it appears
+   * to them, changes and is taken away from them, which they see as they happen.
+   *
+   * @generated from enum value: SERVICE_SIGNAL_FILING = 6;
+   */
+  FILING = 6,
+
+  /**
+   * How the home is set up: the apartment and its rooms, their names and descriptions, the
+   * rooms' limits, and the building's sensors in them.
+   *
+   * @generated from enum value: SERVICE_SIGNAL_ROOM_SETUP = 7;
+   */
+  ROOM_SETUP = 7,
+
+  /**
+   * Which of the building's devices are linked to which, for what, and whether device to
+   * device or through the gateway — not how a link is set or what it is doing. A link shows
+   * as it is made and as it is removed, and changes for service at no other time.
+   *
+   * @generated from enum value: SERVICE_SIGNAL_LINKS = 8;
+   */
+  LINKS = 8,
+
+  /**
+   * Who is filed on the home, and how, as space.v1.Space.members tells it to a caller who
+   * does not live there: each residency under its own residency id and since when, never
+   * who holds it (MembershipRelation, RESIDENCY IDS); service, and memberships recorded
+   * with no relation, by user id, and staff among them by name. Shown to the property owner
+   * and the gateway administrator only, not to every party with service reach.
+   *
+   * @generated from enum value: SERVICE_SIGNAL_RESIDENTS = 9;
+   */
+  RESIDENTS = 9,
+}
+
+/**
+ * Describes the enum kusinta.iot.access.v1.ServiceSignal.
+ */
+export declare const ServiceSignalSchema: GenEnum<ServiceSignal>;
+

package/src/kusinta/iot/access/v1/acl_pb.js

@@ -2,16 +2,16 @@
 // @generated from file kusinta/iot/access/v1/acl.proto (package kusinta.iot.access.v1, syntax proto3)
 /* eslint-disable */
 
-import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import { enumDesc, fileDesc, messageDesc, tsEnum } from "@bufbuild/protobuf/codegenv2";
 import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
-import { file_kusinta_iot_identity_v1_identity } from "../../identity/v1/identity_pb.js";
 import { file_kusinta_iot_access_v1_roles } from "./roles_pb.js";
+import { file_kusinta_iot_identity_v1_identity } from "../../identity/v1/identity_pb.js";
 
 /**
  * Describes the file kusinta/iot/access/v1/acl.proto.
  */
 export const file_kusinta_iot_access_v1_acl = /*@__PURE__*/
-  fileDesc("Ch9rdXNpbnRhL2lvdC9hY2Nlc3MvdjEvYWNsLnByb3RvEhVrdXNpbnRhLmlvdC5hY2Nlc3MudjEirgEKDEF0dHJpYnV0ZVJlZhIWCg5hdHRyaWJ1dGVfbmFtZRgBIAEoCRISCgpjbHVzdGVyX2lkGAIgASgNEhQKDGF0dHJpYnV0ZV9pZBgEIAEoDRIYCgtlbmRwb2ludF9pZBgDIAEoDUgAiAEBEh0KEHZlbmRvcl9leHRlbnNpb24YBSABKAlIAYgBAUIOCgxfZW5kcG9pbnRfaWRCEwoRX3ZlbmRvcl9leHRlbnNpb24iZQoKQ29tbWFuZFJlZhISCgpjbHVzdGVyX2lkGAEgASgNEhkKEW1hdHRlcl9jb21tYW5kX2lkGAIgASgNEhgKC2VuZHBvaW50X2lkGAMgASgNSACIAQFCDgoMX2VuZHBvaW50X2lkIloKCEV2ZW50UmVmEhIKCmNsdXN0ZXJfaWQYASABKA0SEAoIZXZlbnRfaWQYAiABKA0SGAoLZW5kcG9pbnRfaWQYAyABKA1IAIgBAUIOCgxfZW5kcG9pbnRfaWQi5wEKElByb3BlcnR5Q29uc3RyYWludBI2CglhdHRyaWJ1dGUYCCABKAsyIy5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuQXR0cmlidXRlUmVmEhEKB2ludF9tYXgYAiABKBFIABIRCgdpbnRfbWluGAMgASgRSAASEgoIdWludF9tYXgYBCABKA1IABISCgh1aW50X21pbhgFIAEoDUgAQgwKCmNvbnN0cmFpbnRKBAgBEAJKBAgGEAdKBAgHEAhSDmF0dHJpYnV0ZV9uYW1lUg5jbHVzdGVyX2lkX2hleFILZW5kcG9pbnRfaWQihgQKCURldmljZUFjbBI0CglkZXZpY2VfaWQYASABKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZBIwCgd1c2VyX2lkGAIgASgLMh8ua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuVXNlcklkEikKBHJvbGUYAyABKA4yGy5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuUm9sZRJACg9hbGxvd2VkX2FjdGlvbnMYBCADKA4yJy5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuUGVybWlzc2lvbkFjdGlvbhJDChZhbGxvd2VkX2F0dHJpYnV0ZV9yZWZzGAcgAygLMiMua3VzaW50YS5pb3QuYWNjZXNzLnYxLkF0dHJpYnV0ZVJlZhJHChRwcm9wZXJ0eV9jb25zdHJhaW50cxgGIAMoCzIpLmt1c2ludGEuaW90LmFjY2Vzcy52MS5Qcm9wZXJ0eUNvbnN0cmFpbnQSPwoUYWxsb3dlZF9jb21tYW5kX3JlZnMYCSADKAsyIS5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuQ29tbWFuZFJlZhI7ChJhbGxvd2VkX2V2ZW50X3JlZnMYCiADKAsyHy5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuRXZlbnRSZWZKBAgFEAZSEmFsbG93ZWRfYXR0cmlidXRlcyLlAQoURWZmZWN0aXZlUGVybWlzc2lvbnMSMAoHdXNlcl9pZBgBIAEoCzIfLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLlVzZXJJZBI2CgpnYXRld2F5X2lkGAIgASgLMiIua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuR2F0ZXdheUlkEjUKC2RldmljZV9hY2xzGAMgAygLMiAua3VzaW50YS5pb3QuYWNjZXNzLnYxLkRldmljZUFjbBIsCgh2YWxpZF9hdBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCAkgBYgZwcm90bzM", [file_google_protobuf_timestamp, file_kusinta_iot_identity_v1_identity, file_kusinta_iot_access_v1_roles]);
+  fileDesc("Ch9rdXNpbnRhL2lvdC9hY2Nlc3MvdjEvYWNsLnByb3RvEhVrdXNpbnRhLmlvdC5hY2Nlc3MudjEirgEKDEF0dHJpYnV0ZVJlZhIWCg5hdHRyaWJ1dGVfbmFtZRgBIAEoCRISCgpjbHVzdGVyX2lkGAIgASgNEhQKDGF0dHJpYnV0ZV9pZBgEIAEoDRIYCgtlbmRwb2ludF9pZBgDIAEoDUgAiAEBEh0KEHZlbmRvcl9leHRlbnNpb24YBSABKAlIAYgBAUIOCgxfZW5kcG9pbnRfaWRCEwoRX3ZlbmRvcl9leHRlbnNpb24iZQoKQ29tbWFuZFJlZhISCgpjbHVzdGVyX2lkGAEgASgNEhkKEW1hdHRlcl9jb21tYW5kX2lkGAIgASgNEhgKC2VuZHBvaW50X2lkGAMgASgNSACIAQFCDgoMX2VuZHBvaW50X2lkIloKCEV2ZW50UmVmEhIKCmNsdXN0ZXJfaWQYASABKA0SEAoIZXZlbnRfaWQYAiABKA0SGAoLZW5kcG9pbnRfaWQYAyABKA1IAIgBAUIOCgxfZW5kcG9pbnRfaWQi5wEKElByb3BlcnR5Q29uc3RyYWludBI2CglhdHRyaWJ1dGUYCCABKAsyIy5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuQXR0cmlidXRlUmVmEhEKB2ludF9tYXgYAiABKBFIABIRCgdpbnRfbWluGAMgASgRSAASEgoIdWludF9tYXgYBCABKA1IABISCgh1aW50X21pbhgFIAEoDUgAQgwKCmNvbnN0cmFpbnRKBAgBEAJKBAgGEAdKBAgHEAhSDmF0dHJpYnV0ZV9uYW1lUg5jbHVzdGVyX2lkX2hleFILZW5kcG9pbnRfaWQiwwQKCURldmljZUFjbBI0CglkZXZpY2VfaWQYASABKAsyIS5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5EZXZpY2VJZBIwCgd1c2VyX2lkGAIgASgLMh8ua3VzaW50YS5pb3QuaWRlbnRpdHkudjEuVXNlcklkEikKBHJvbGUYAyABKA4yGy5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuUm9sZRJACg9hbGxvd2VkX2FjdGlvbnMYBCADKA4yJy5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuUGVybWlzc2lvbkFjdGlvbhJDChZhbGxvd2VkX2F0dHJpYnV0ZV9yZWZzGAcgAygLMiMua3VzaW50YS5pb3QuYWNjZXNzLnYxLkF0dHJpYnV0ZVJlZhJHChRwcm9wZXJ0eV9jb25zdHJhaW50cxgGIAMoCzIpLmt1c2ludGEuaW90LmFjY2Vzcy52MS5Qcm9wZXJ0eUNvbnN0cmFpbnQSPwoUYWxsb3dlZF9jb21tYW5kX3JlZnMYCSADKAsyIS5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuQ29tbWFuZFJlZhI7ChJhbGxvd2VkX2V2ZW50X3JlZnMYCiADKAsyHy5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuRXZlbnRSZWYSOwoIcmVsYXRpb24YCyABKA4yKS5rdXNpbnRhLmlvdC5hY2Nlc3MudjEuTWVtYmVyc2hpcFJlbGF0aW9uSgQIBRAGUhJhbGxvd2VkX2F0dHJpYnV0ZXMi5QEKFEVmZmVjdGl2ZVBlcm1pc3Npb25zEjAKB3VzZXJfaWQYASABKAsyHy5rdXNpbnRhLmlvdC5pZGVudGl0eS52MS5Vc2VySWQSNgoKZ2F0ZXdheV9pZBgCIAEoCzIiLmt1c2ludGEuaW90LmlkZW50aXR5LnYxLkdhdGV3YXlJZBI1CgtkZXZpY2VfYWNscxgDIAMoCzIgLmt1c2ludGEuaW90LmFjY2Vzcy52MS5EZXZpY2VBY2wSLAoIdmFsaWRfYXQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wKrQCCg1TZXJ2aWNlU2lnbmFsEh4KGlNFUlZJQ0VfU0lHTkFMX1VOU1BFQ0lGSUVEEAASHwobU0VSVklDRV9TSUdOQUxfUkVBQ0hBQklMSVRZEAESGgoWU0VSVklDRV9TSUdOQUxfQkFUVEVSWRACEh0KGVNFUlZJQ0VfU0lHTkFMX1JBRElPX0xJTksQAxIbChdTRVJWSUNFX1NJR05BTF9GSVJNV0FSRRAEEhgKFFNFUlZJQ0VfU0lHTkFMX0ZBVUxUEAUSGQoVU0VSVklDRV9TSUdOQUxfRklMSU5HEAYSHQoZU0VSVklDRV9TSUdOQUxfUk9PTV9TRVRVUBAHEhgKFFNFUlZJQ0VfU0lHTkFMX0xJTktTEAgSHAoYU0VSVklDRV9TSUdOQUxfUkVTSURFTlRTEAlCAkgBYgZwcm90bzM", [file_google_protobuf_timestamp, file_kusinta_iot_access_v1_roles, file_kusinta_iot_identity_v1_identity]);
 
 /**
  * Describes the message kusinta.iot.access.v1.AttributeRef.
@@ -55,3 +55,20 @@ export const DeviceAclSchema = /*@__PURE__*/
 export const EffectivePermissionsSchema = /*@__PURE__*/
   messageDesc(file_kusinta_iot_access_v1_acl, 5);
 
+/**
+ * Describes the enum kusinta.iot.access.v1.ServiceSignal.
+ */
+export const ServiceSignalSchema = /*@__PURE__*/
+  enumDesc(file_kusinta_iot_access_v1_acl, 0);
+
+/**
+ * What service sees of a home, as a resident is told it in webrtc.v1.PrivacyDisclosure.
+ * Each names part of a webrtc.v1.ServiceStatus, of a device's description, of how the
+ * home is set up, or of who lives there; with the climate summary the disclosure names
+ * separately, nothing else of the home reaches service.
+ *
+ * @generated from enum kusinta.iot.access.v1.ServiceSignal
+ */
+export const ServiceSignal = /*@__PURE__*/
+  tsEnum(ServiceSignalSchema);
+

package/src/kusinta/iot/access/v1/roles_pb.d.ts

@@ -21,10 +21,13 @@ export declare const file_kusinta_iot_access_v1_roles: GenFile;
  * The gateway resolves the two together into DeviceAcl.allowed_actions, per device. A
  * role narrows what may appear there; it does not put anything there on its own.
  *
- * Carried in the app's token as webrtc.v1.AppTokenClaims.roles, as an array of proto3
- * canonical enum NAME strings (e.g. ["ROLE_RESIDENT", "ROLE_GATEWAY_ADMIN"]) rather than
- * integers, so the claim stays self-describing. A user may hold several at once and the
- * effective ceiling is their union.
+ * The building-server gateway holds each user's roles itself and authorises from what it
+ * holds. The one role it cannot know is the administration of the organisation that owns it,
+ * which the api-server keeps: that one it takes from the app's token
+ * (webrtc.v1.AppTokenClaims.roles), and the api-server tells it who those administrators are
+ * (signaling.v1.VouchedAdministrators), which can end that administration but never grant it. The api-server learns the rest from the gateway
+ * (reporting.v1.GatewayMember). A user may hold several at once and the effective ceiling is
+ * their union.
  *
  * UNORDERED. These are categories, not levels: a technician is not "more than" a
  * resident, and there is no >= comparison to make between them. Anything needing a graded
@@ -36,6 +39,15 @@ export declare const file_kusinta_iot_access_v1_roles: GenFile;
  * gateway-wide role alone would not grant. That widening is the gateway's to apply and is
  * visible to the app only in the resolved DeviceAcl.
  *
+ * STAFF. A user who holds ROLE_TECHNICIAN, ROLE_PROPERTY_OWNER or ROLE_GATEWAY_ADMIN on a
+ * gateway is staff there: they serve the building rather than live in it. Wherever this
+ * schema says "staff" or "a staff member" it means exactly that, as the gateway holds roles,
+ * every vouched administrator included; holding ROLE_RESIDENT besides changes nothing. The
+ * term carries one rule about people: staff are named to whoever may list every member; a
+ * resident is named only to the people they live with; and where anyone lives is told by
+ * user id only to their own household, and to anyone else only under a residency id
+ * (MembershipRelation, RESIDENCY IDS).
+ *
  * @generated from enum kusinta.iot.access.v1.Role
  */
 export enum Role {
@@ -172,3 +184,144 @@ export enum PermissionAction {
  */
 export declare const PermissionActionSchema: GenEnum<PermissionAction>;
 
+/**
+ * How a member stands to a space they are filed in. Held per membership — set by
+ * webrtc.v1.AssignUserToSpace — unlike Role, which is gateway-wide. The two are independent:
+ * a technician who lives in an apartment is filed on it as RESIDENT, and a resident who
+ * looks after a building's plant room is filed there as SERVICE. RESIDENT is refused on a
+ * room: a home's residents live in all of it.
+ *
+ * HOUSEHOLD ADMIN. HOUSEHOLD_ADMIN is RESIDENT and more: a resident who also governs the
+ * home (webrtc.v1 household.proto). It is held on an apartment and nowhere else, and is never
+ * a role: the app's token, and every role the gateway holds, are the same with it as without
+ * it. Wherever this schema says RESIDENT, a resident or a home's residents, it means
+ * HOUSEHOLD_ADMIN too, unless it names HOUSEHOLD_ADMIN apart: what a household admin sees of
+ * the home, and when from, is exactly what a resident sees. A change between RESIDENT and
+ * HOUSEHOLD_ADMIN on the same apartment continues the residency below, with its id and its
+ * since; it is no relation change in the sense the residency rules use.
+ *
+ * A HOME is an apartment and the rooms in it. What a user learns of a home depends on how
+ * they reach it; where several apply, the first wins:
+ *
+ *   * As its resident — RESIDENT on the apartment. They see and operate everything filed
+ *     in it, and its history from the start of their current residency, never before: a new
+ *     tenant does not read the previous one's, nor learn when or by whom anything was
+ *     changed before they moved in: every time from before that a home's rooms and devices
+ *     carry — a reading's timestamp included — is unset for them, save a
+ *     webrtc.v1.ServiceStatus, which always carries its times and so gives none before the first
+ *     quarter hour of their residency, from that quarter hour on.
+ *   * As an installer under a commissioning grant on the home, while it is active — the
+ *     service view below, and on top of it what commissioning.v1 (GRANTS) lists: the home's
+ *     commissioning and heating records, and the readings a test they run is judged by while
+ *     it runs. Never its history, savings, comfort settings or device events, nor who lives
+ *     there.
+ *   * As service — SERVICE on the apartment, a room in it, or a building or floor above it,
+ *     or as the gateway's administrator. Of the building's own devices in what they reach of
+ *     the home — any
+ *     device no person owns — they see what each is and a webrtc.v1.ServiceStatus,
+ *     evaluated each quarter hour, and no reading, event or time of the device itself; they
+ *     operate none of them. Of what they reach of the home — from the room they are filed
+ *     on, or all of it — they see how its rooms are set up, with
+ *     RoomClimate.state_withheld marking what is not shown, and its links with
+ *     DeviceLink.details_withheld; modes on a home are not sent to them at all. Service
+ *     that reaches the apartment itself also gets its climate summary over the disclosed
+ *     period. What they newly see of the home reaches them as it happens; what they lose,
+ *     at once.
+ *   * Not at all — RESIDENT on a building or floor above it. Living in a building is not
+ *     living in every apartment in it.
+ *
+ * What was recorded while a room or device was in a home stays with the home after it
+ * leaves: its history, and the times and people it carries from then, are never given to
+ * whoever reaches it later.
+ *
+ * A residency starts when a user is assigned RESIDENT on an apartment while not already its
+ * resident — a membership recorded with no relation included, so its holder starts afresh —
+ * and ends with any other change to that membership. Assigning RESIDENT to a resident
+ * changes nothing. A space becoming an apartment starts the residency of each RESIDENT
+ * member on it, and ceasing to be one ends it — though it releases no device: what is no
+ * longer a home holds nobody's devices for a next tenant. A device in a space becoming an
+ * apartment, owned by someone who is not to be its resident, is taken out of that space.
+ *
+ * A device filed in a home counts as in the home wherever else it is also filed, a device a
+ * resident owns included: reaching it through another space shows it to nobody. A link
+ * never joins a device in a home to one outside it. Outside homes the relation changes
+ * nothing: what is filed there is visible to whoever reaches it. A device owned as RESIDENT
+ * is the exception everywhere, whoever owns it: it is visible to its owner and the RESIDENT
+ * members filed on the space it is filed in — for a device in a home, the home's residents
+ * alone, wherever else it is filed; never those who merely reach a space from above — and
+ * to nobody else. An owner who stops living in the home it is filed in gives it up: it is
+ * released, with no owner, and stays filed in the home alone, as one of the building's own
+ * devices there. A device given up so, or released, then appears to service as any device
+ * newly in the home does, as it happens; that much a release shows.
+ *
+ * Who may change a home's members, move its spaces or file devices into and out of it is
+ * restricted by the gateway, and a refused caller gets NOT_ENTITLED; within the household it
+ * is its household admins' (webrtc.v1 household.proto). This keeps a home's
+ * life — its readings, history and modes — from anyone but its residents by default; those
+ * who service the building get the service view above and no more. It does not keep the
+ * property owner or the administrator out by force — they hold the building's filing
+ * authority and the gateway itself — but it makes their seeing in a deliberate act on the
+ * home, such as filing themselves on it, rather than something handed out by default. They
+ * remove a resident who moves out, so they are shown every residency, and since when
+ * (webrtc.v1.ListGatewayMembers), but never who holds it (see RESIDENCY IDS).
+ *
+ * RESIDENCY IDS. To a caller who does not live in the home, a RESIDENT membership is told
+ * only under its residency id: an id the gateway mints for that residency alone, when it
+ * begins, holds for as long as it lasts unbroken, and never reuses. It is opaque, begins
+ * with "residency:", and is never a user's id or derived from one, so nothing told under it
+ * ties the residency to a name, a role or another membership — and nothing changes it when
+ * the person who holds it becomes staff or stops being staff (Role, STAFF). A relation
+ * change, or the residency ending, ends its id. The people of the home see one another
+ * under their user ids. Where a request below names a member, it says whether a residency
+ * id may stand for one; a request that does not say so refuses one as INVALID_REQUEST, so
+ * that no user is ever made under one.
+ *
+ * A membership recorded with no relation, made before relations existed, sees no more than
+ * either relation would where it is held: on an apartment or a room, a home as service; on a
+ * building or floor, no home at all. It is listed with UNSPECIFIED so that it can be found
+ * and assigned again.
+ *
+ * @generated from enum kusinta.iot.access.v1.MembershipRelation
+ */
+export enum MembershipRelation {
+  /**
+   * Names no relation. Invalid on a request, and refused rather than defaulted: which of
+   * the two a member is decides what they see of someone's home, and that must never be
+   * decided by an omission.
+   *
+   * @generated from enum value: MEMBERSHIP_RELATION_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Lives there.
+   *
+   * @generated from enum value: MEMBERSHIP_RELATION_RESIDENT = 1;
+   */
+  RESIDENT = 1,
+
+  /**
+   * Is there for the building rather than to live in it: its owner's people, a technician,
+   * the gateway's administrator.
+   *
+   * @generated from enum value: MEMBERSHIP_RELATION_SERVICE = 2;
+   */
+  SERVICE = 2,
+
+  /**
+   * Lives there and governs the home: a resident who may also manage it (webrtc.v1
+   * household.proto). On an apartment only; refused anywhere else.
+   *
+   * Rollout order: an app whose schema predates this value cannot tell it from an unknown
+   * relation, so app handling ships before or with the gateway that records it.
+   *
+   * @generated from enum value: MEMBERSHIP_RELATION_HOUSEHOLD_ADMIN = 3;
+   */
+  HOUSEHOLD_ADMIN = 3,
+}
+
+/**
+ * Describes the enum kusinta.iot.access.v1.MembershipRelation.
+ */
+export declare const MembershipRelationSchema: GenEnum<MembershipRelation>;
+

package/src/kusinta/iot/access/v1/roles_pb.js

@@ -8,7 +8,7 @@ import { enumDesc, fileDesc, tsEnum } from "@bufbuild/protobuf/codegenv2";
  * Describes the file kusinta/iot/access/v1/roles.proto.
  */
 export const file_kusinta_iot_access_v1_roles = /*@__PURE__*/
-  fileDesc("CiFrdXNpbnRhL2lvdC9hY2Nlc3MvdjEvcm9sZXMucHJvdG8SFWt1c2ludGEuaW90LmFjY2Vzcy52MSp1CgRSb2xlEhQKEFJPTEVfVU5TUEVDSUZJRUQQABIRCg1ST0xFX1JFU0lERU5UEAESFwoTUk9MRV9QUk9QRVJUWV9PV05FUhACEhMKD1JPTEVfVEVDSE5JQ0lBThADEhYKElJPTEVfR0FURVdBWV9BRE1JThAEKq0BChBQZXJtaXNzaW9uQWN0aW9uEiEKHVBFUk1JU1NJT05fQUNUSU9OX1VOU1BFQ0lGSUVEEAASGgoWUEVSTUlTU0lPTl9BQ1RJT05fUkVBRBABEhsKF1BFUk1JU1NJT05fQUNUSU9OX1dSSVRFEAISHwobUEVSTUlTU0lPTl9BQ1RJT05fU1VCU0NSSUJFEAMSHAoYUEVSTUlTU0lPTl9BQ1RJT05fSU5WT0tFEARCAkgBYgZwcm90bzM");
+  fileDesc("CiFrdXNpbnRhL2lvdC9hY2Nlc3MvdjEvcm9sZXMucHJvdG8SFWt1c2ludGEuaW90LmFjY2Vzcy52MSp1CgRSb2xlEhQKEFJPTEVfVU5TUEVDSUZJRUQQABIRCg1ST0xFX1JFU0lERU5UEAESFwoTUk9MRV9QUk9QRVJUWV9PV05FUhACEhMKD1JPTEVfVEVDSE5JQ0lBThADEhYKElJPTEVfR0FURVdBWV9BRE1JThAEKq0BChBQZXJtaXNzaW9uQWN0aW9uEiEKHVBFUk1JU1NJT05fQUNUSU9OX1VOU1BFQ0lGSUVEEAASGgoWUEVSTUlTU0lPTl9BQ1RJT05fUkVBRBABEhsKF1BFUk1JU1NJT05fQUNUSU9OX1dSSVRFEAISHwobUEVSTUlTU0lPTl9BQ1RJT05fU1VCU0NSSUJFEAMSHAoYUEVSTUlTU0lPTl9BQ1RJT05fSU5WT0tFEAQqpQEKEk1lbWJlcnNoaXBSZWxhdGlvbhIjCh9NRU1CRVJTSElQX1JFTEFUSU9OX1VOU1BFQ0lGSUVEEAASIAocTUVNQkVSU0hJUF9SRUxBVElPTl9SRVNJREVOVBABEh8KG01FTUJFUlNISVBfUkVMQVRJT05fU0VSVklDRRACEicKI01FTUJFUlNISVBfUkVMQVRJT05fSE9VU0VIT0xEX0FETUlOEANCAkgBYgZwcm90bzM");
 
 /**
  * Describes the enum kusinta.iot.access.v1.Role.
@@ -28,10 +28,13 @@ export const RoleSchema = /*@__PURE__*/
  * The gateway resolves the two together into DeviceAcl.allowed_actions, per device. A
  * role narrows what may appear there; it does not put anything there on its own.
  *
- * Carried in the app's token as webrtc.v1.AppTokenClaims.roles, as an array of proto3
- * canonical enum NAME strings (e.g. ["ROLE_RESIDENT", "ROLE_GATEWAY_ADMIN"]) rather than
- * integers, so the claim stays self-describing. A user may hold several at once and the
- * effective ceiling is their union.
+ * The building-server gateway holds each user's roles itself and authorises from what it
+ * holds. The one role it cannot know is the administration of the organisation that owns it,
+ * which the api-server keeps: that one it takes from the app's token
+ * (webrtc.v1.AppTokenClaims.roles), and the api-server tells it who those administrators are
+ * (signaling.v1.VouchedAdministrators), which can end that administration but never grant it. The api-server learns the rest from the gateway
+ * (reporting.v1.GatewayMember). A user may hold several at once and the effective ceiling is
+ * their union.
  *
  * UNORDERED. These are categories, not levels: a technician is not "more than" a
  * resident, and there is no >= comparison to make between them. Anything needing a graded
@@ -43,6 +46,15 @@ export const RoleSchema = /*@__PURE__*/
  * gateway-wide role alone would not grant. That widening is the gateway's to apply and is
  * visible to the app only in the resolved DeviceAcl.
  *
+ * STAFF. A user who holds ROLE_TECHNICIAN, ROLE_PROPERTY_OWNER or ROLE_GATEWAY_ADMIN on a
+ * gateway is staff there: they serve the building rather than live in it. Wherever this
+ * schema says "staff" or "a staff member" it means exactly that, as the gateway holds roles,
+ * every vouched administrator included; holding ROLE_RESIDENT besides changes nothing. The
+ * term carries one rule about people: staff are named to whoever may list every member; a
+ * resident is named only to the people they live with; and where anyone lives is told by
+ * user id only to their own household, and to anyone else only under a residency id
+ * (MembershipRelation, RESIDENCY IDS).
+ *
  * @generated from enum kusinta.iot.access.v1.Role
  */
 export const Role = /*@__PURE__*/
@@ -70,3 +82,111 @@ export const PermissionActionSchema = /*@__PURE__*/
 export const PermissionAction = /*@__PURE__*/
   tsEnum(PermissionActionSchema);
 
+/**
+ * Describes the enum kusinta.iot.access.v1.MembershipRelation.
+ */
+export const MembershipRelationSchema = /*@__PURE__*/
+  enumDesc(file_kusinta_iot_access_v1_roles, 2);
+
+/**
+ * How a member stands to a space they are filed in. Held per membership — set by
+ * webrtc.v1.AssignUserToSpace — unlike Role, which is gateway-wide. The two are independent:
+ * a technician who lives in an apartment is filed on it as RESIDENT, and a resident who
+ * looks after a building's plant room is filed there as SERVICE. RESIDENT is refused on a
+ * room: a home's residents live in all of it.
+ *
+ * HOUSEHOLD ADMIN. HOUSEHOLD_ADMIN is RESIDENT and more: a resident who also governs the
+ * home (webrtc.v1 household.proto). It is held on an apartment and nowhere else, and is never
+ * a role: the app's token, and every role the gateway holds, are the same with it as without
+ * it. Wherever this schema says RESIDENT, a resident or a home's residents, it means
+ * HOUSEHOLD_ADMIN too, unless it names HOUSEHOLD_ADMIN apart: what a household admin sees of
+ * the home, and when from, is exactly what a resident sees. A change between RESIDENT and
+ * HOUSEHOLD_ADMIN on the same apartment continues the residency below, with its id and its
+ * since; it is no relation change in the sense the residency rules use.
+ *
+ * A HOME is an apartment and the rooms in it. What a user learns of a home depends on how
+ * they reach it; where several apply, the first wins:
+ *
+ *   * As its resident — RESIDENT on the apartment. They see and operate everything filed
+ *     in it, and its history from the start of their current residency, never before: a new
+ *     tenant does not read the previous one's, nor learn when or by whom anything was
+ *     changed before they moved in: every time from before that a home's rooms and devices
+ *     carry — a reading's timestamp included — is unset for them, save a
+ *     webrtc.v1.ServiceStatus, which always carries its times and so gives none before the first
+ *     quarter hour of their residency, from that quarter hour on.
+ *   * As an installer under a commissioning grant on the home, while it is active — the
+ *     service view below, and on top of it what commissioning.v1 (GRANTS) lists: the home's
+ *     commissioning and heating records, and the readings a test they run is judged by while
+ *     it runs. Never its history, savings, comfort settings or device events, nor who lives
+ *     there.
+ *   * As service — SERVICE on the apartment, a room in it, or a building or floor above it,
+ *     or as the gateway's administrator. Of the building's own devices in what they reach of
+ *     the home — any
+ *     device no person owns — they see what each is and a webrtc.v1.ServiceStatus,
+ *     evaluated each quarter hour, and no reading, event or time of the device itself; they
+ *     operate none of them. Of what they reach of the home — from the room they are filed
+ *     on, or all of it — they see how its rooms are set up, with
+ *     RoomClimate.state_withheld marking what is not shown, and its links with
+ *     DeviceLink.details_withheld; modes on a home are not sent to them at all. Service
+ *     that reaches the apartment itself also gets its climate summary over the disclosed
+ *     period. What they newly see of the home reaches them as it happens; what they lose,
+ *     at once.
+ *   * Not at all — RESIDENT on a building or floor above it. Living in a building is not
+ *     living in every apartment in it.
+ *
+ * What was recorded while a room or device was in a home stays with the home after it
+ * leaves: its history, and the times and people it carries from then, are never given to
+ * whoever reaches it later.
+ *
+ * A residency starts when a user is assigned RESIDENT on an apartment while not already its
+ * resident — a membership recorded with no relation included, so its holder starts afresh —
+ * and ends with any other change to that membership. Assigning RESIDENT to a resident
+ * changes nothing. A space becoming an apartment starts the residency of each RESIDENT
+ * member on it, and ceasing to be one ends it — though it releases no device: what is no
+ * longer a home holds nobody's devices for a next tenant. A device in a space becoming an
+ * apartment, owned by someone who is not to be its resident, is taken out of that space.
+ *
+ * A device filed in a home counts as in the home wherever else it is also filed, a device a
+ * resident owns included: reaching it through another space shows it to nobody. A link
+ * never joins a device in a home to one outside it. Outside homes the relation changes
+ * nothing: what is filed there is visible to whoever reaches it. A device owned as RESIDENT
+ * is the exception everywhere, whoever owns it: it is visible to its owner and the RESIDENT
+ * members filed on the space it is filed in — for a device in a home, the home's residents
+ * alone, wherever else it is filed; never those who merely reach a space from above — and
+ * to nobody else. An owner who stops living in the home it is filed in gives it up: it is
+ * released, with no owner, and stays filed in the home alone, as one of the building's own
+ * devices there. A device given up so, or released, then appears to service as any device
+ * newly in the home does, as it happens; that much a release shows.
+ *
+ * Who may change a home's members, move its spaces or file devices into and out of it is
+ * restricted by the gateway, and a refused caller gets NOT_ENTITLED; within the household it
+ * is its household admins' (webrtc.v1 household.proto). This keeps a home's
+ * life — its readings, history and modes — from anyone but its residents by default; those
+ * who service the building get the service view above and no more. It does not keep the
+ * property owner or the administrator out by force — they hold the building's filing
+ * authority and the gateway itself — but it makes their seeing in a deliberate act on the
+ * home, such as filing themselves on it, rather than something handed out by default. They
+ * remove a resident who moves out, so they are shown every residency, and since when
+ * (webrtc.v1.ListGatewayMembers), but never who holds it (see RESIDENCY IDS).
+ *
+ * RESIDENCY IDS. To a caller who does not live in the home, a RESIDENT membership is told
+ * only under its residency id: an id the gateway mints for that residency alone, when it
+ * begins, holds for as long as it lasts unbroken, and never reuses. It is opaque, begins
+ * with "residency:", and is never a user's id or derived from one, so nothing told under it
+ * ties the residency to a name, a role or another membership — and nothing changes it when
+ * the person who holds it becomes staff or stops being staff (Role, STAFF). A relation
+ * change, or the residency ending, ends its id. The people of the home see one another
+ * under their user ids. Where a request below names a member, it says whether a residency
+ * id may stand for one; a request that does not say so refuses one as INVALID_REQUEST, so
+ * that no user is ever made under one.
+ *
+ * A membership recorded with no relation, made before relations existed, sees no more than
+ * either relation would where it is held: on an apartment or a room, a home as service; on a
+ * building or floor, no home at all. It is listed with UNSPECIFIED so that it can be found
+ * and assigned again.
+ *
+ * @generated from enum kusinta.iot.access.v1.MembershipRelation
+ */
+export const MembershipRelation = /*@__PURE__*/
+  tsEnum(MembershipRelationSchema);
+