@kusinta/iot-schema 0.2.0-beta.5 → 0.2.0-beta.51

package/src/kusinta/iot/signaling/v1/signaling_pb.d.ts

@@ -2,9 +2,12 @@
 // @generated from file kusinta/iot/signaling/v1/signaling.proto (package kusinta.iot.signaling.v1, syntax proto3)
 /* eslint-disable */
 
-import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
 import type { Message } from "@bufbuild/protobuf";
 import type { GatewayId, UserId } from "../../identity/v1/identity_pb.js";
+import type { AccountLinkCancelled, AccountLinked, AccountLinkResult, RefreshToken, RevokeToken, TokenRefreshed, TokenRevoked } from "../../accountlink/v1/account_link_pb.js";
+import type { ConnectorKind } from "../../common/v1/types_pb.js";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
 
 /**
  * Describes the file kusinta/iot/signaling/v1/signaling.proto.
@@ -76,10 +79,26 @@ export declare type IceCandidate = Message<"kusinta.iot.signaling.v1.IceCandidat
 export declare const IceCandidateSchema: GenMessage<IceCandidate>;
 
 /**
- * Empty keepalive. The gateway sends this periodically on the GatewayConnect
- * stream so the otherwise-idle bidi request keeps producing DATA frames, which
- * resets the inactivity timers on any proxy between the two ends and stops it
- * from tearing the stream down. Carries no routing target and is dropped on receipt.
+ * Empty keepalive, sent periodically on a stream that would otherwise fall
+ * silent. The DATA frames it produces reset the inactivity timers on any proxy
+ * between the two ends and stop it tearing the stream down. Carries no routing
+ * target and is dropped on receipt.
+ *
+ * Carried on two arms, each covering a half that falls silent while neither end
+ * has anything to say: the building-server gateway sends it upstream on
+ * GatewayConnect, and the api-server sends it downstream to the app on
+ * UserConnectResponse. The remaining halves have no arm — an app leg's upstream
+ * that goes idle is one the client can write on whenever it needs to.
+ *
+ * Never an acknowledgement. A heartbeat answers no message and must not be
+ * treated as confirming one.
+ *
+ * On GatewayConnect it also lets the api-server judge whether the gateway is
+ * present. A gateway is present while its stream is open, and never lets it
+ * carry nothing for more than 30 seconds: a heartbeat fills any longer silence.
+ * A stream that has carried nothing for 90 seconds may be taken as gone, even
+ * when the transport has not yet said so. That is the gateway's presence and
+ * nothing more: a present gateway may still have lost its devices.
  *
  * @generated from message kusinta.iot.signaling.v1.HeartBeat
  */
@@ -124,6 +143,23 @@ export declare type UserHandshakeAck = Message<"kusinta.iot.signaling.v1.UserHan
    * @generated from field: string reason = 2;
    */
   reason: string;
+
+  /**
+   * How often the api-server will send a HeartBeat on this stream, in
+   * milliseconds.
+   *
+   * Advisory, and a client must not refuse a stream over it: a client that has
+   * seen no traffic at all for a small multiple of this may take the stream for
+   * gone and reattach with the same session_id, which is the difference between
+   * a renegotiation that stalls and one that reconnects. The server is free to
+   * answer with a different value on the next session.
+   *
+   * Zero means the server is not heartbeating this stream, and a client must
+   * then not infer anything from silence.
+   *
+   * @generated from field: uint32 heartbeat_interval_ms = 3;
+   */
+  heartbeatIntervalMs: number;
 };
 
 /**
@@ -141,13 +177,18 @@ export declare const UserHandshakeAckSchema: GenMessage<UserHandshakeAck>;
  */
 export declare type GatewayConnectRequest = Message<"kusinta.iot.signaling.v1.GatewayConnectRequest"> & {
   /**
+   * On redeem_invite_result, the user who redeemed (RedeemInvite). Unset on an
+   * acknowledgement and on the accountlink.v1 arms, which are to no user.
+   *
    * @generated from field: kusinta.iot.identity.v1.UserId target_user_id = 1;
    */
   targetUserId?: UserId | undefined;
 
   /**
    * The session of target_user_id this message answers. See the contract above.
-   * Ignored on a heartbeat, which carries no routing target at all.
+   * Ignored on a heartbeat, which carries no routing target at all, and on
+   * redeem_invite_result, the acknowledgements and the accountlink.v1 arms, which
+   * belong to no session.
    *
    * @generated from field: string session_id = 5;
    */
@@ -174,6 +215,48 @@ export declare type GatewayConnectRequest = Message<"kusinta.iot.signaling.v1.Ga
      */
     value: HeartBeat;
     case: "heartbeat";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.signaling.v1.RedeemInviteResult redeem_invite_result = 6;
+     */
+    value: RedeemInviteResult;
+    case: "redeemInviteResult";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.signaling.v1.VouchedAdministratorsApplied vouched_administrators_applied = 7;
+     */
+    value: VouchedAdministratorsApplied;
+    case: "vouchedAdministratorsApplied";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.signaling.v1.TransferOutcomeApplied transfer_outcome_applied = 8;
+     */
+    value: TransferOutcomeApplied;
+    case: "transferOutcomeApplied";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.signaling.v1.GatewayWiped wiped = 9;
+     */
+    value: GatewayWiped;
+    case: "wiped";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.accountlink.v1.AccountLinkResult account_link_result = 10;
+     */
+    value: AccountLinkResult;
+    case: "accountLinkResult";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.accountlink.v1.RefreshToken refresh_token = 11;
+     */
+    value: RefreshToken;
+    case: "refreshToken";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.accountlink.v1.RevokeToken revoke_token = 12;
+     */
+    value: RevokeToken;
+    case: "revokeToken";
   } | { case: undefined; value?: undefined };
 };
 
@@ -190,6 +273,11 @@ export declare const GatewayConnectRequestSchema: GenMessage<GatewayConnectReque
  */
 export declare type GatewayConnectResponse = Message<"kusinta.iot.signaling.v1.GatewayConnectResponse"> & {
   /**
+   * On redeem_invite, the user redeeming: the sub of the token the api-server
+   * verified, and never a value the user supplied. Unset on what concerns the
+   * gateway itself (stream_opened, vouched_administrators, transfer_outcome,
+   * gateway_deleted) and on the accountlink.v1 arms, which are from no user.
+   *
    * @generated from field: kusinta.iot.identity.v1.UserId from_user_id = 1;
    */
   fromUserId?: UserId | undefined;
@@ -197,7 +285,8 @@ export declare type GatewayConnectResponse = Message<"kusinta.iot.signaling.v1.G
   /**
    * The session of from_user_id this message originates from — the value the
    * gateway must echo on the GatewayConnectRequest that answers it. See the
-   * contract above.
+   * contract above. Unset on redeem_invite, on what concerns the gateway itself
+   * and on the accountlink.v1 arms, which belong to no session.
    *
    * @generated from field: string session_id = 4;
    */
@@ -218,6 +307,60 @@ export declare type GatewayConnectResponse = Message<"kusinta.iot.signaling.v1.G
      */
     value: IceCandidate;
     case: "iceCandidate";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.signaling.v1.RedeemInvite redeem_invite = 5;
+     */
+    value: RedeemInvite;
+    case: "redeemInvite";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.signaling.v1.VouchedAdministrators vouched_administrators = 6;
+     */
+    value: VouchedAdministrators;
+    case: "vouchedAdministrators";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.signaling.v1.TransferOutcome transfer_outcome = 7;
+     */
+    value: TransferOutcome;
+    case: "transferOutcome";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.signaling.v1.GatewayStreamOpened stream_opened = 8;
+     */
+    value: GatewayStreamOpened;
+    case: "streamOpened";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.signaling.v1.GatewayDeleted gateway_deleted = 9;
+     */
+    value: GatewayDeleted;
+    case: "gatewayDeleted";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.accountlink.v1.AccountLinked account_linked = 10;
+     */
+    value: AccountLinked;
+    case: "accountLinked";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.accountlink.v1.TokenRefreshed token_refreshed = 11;
+     */
+    value: TokenRefreshed;
+    case: "tokenRefreshed";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.accountlink.v1.TokenRevoked token_revoked = 12;
+     */
+    value: TokenRevoked;
+    case: "tokenRevoked";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.accountlink.v1.AccountLinkCancelled account_link_cancelled = 13;
+     */
+    value: AccountLinkCancelled;
+    case: "accountLinkCancelled";
   } | { case: undefined; value?: undefined };
 };
 
@@ -227,6 +370,497 @@ export declare type GatewayConnectResponse = Message<"kusinta.iot.signaling.v1.G
  */
 export declare const GatewayConnectResponseSchema: GenMessage<GatewayConnectResponse>;
 
+/**
+ * A person redeeming an invite (webrtc.v1 CreateInvite), api-server → gateway.
+ * Answered with a RedeemInviteResult carrying the same request_id.
+ *
+ * The api-server sends it only to the gateway whose invite routes hold the
+ * secret's hash (reporting.v1.ReportInviteRoutesRequest), and only for a user
+ * whose account has a verified email: it answers a user without one itself,
+ * before routing. A hash held by more than one gateway routes nowhere and is
+ * answered as INVALID.
+ *
+ * A code is 40 bits, few enough to guess at. The api-server limits how often each
+ * user, and each client address, may redeem, and answers past that limit itself.
+ *
+ * The api-server waits at least 30 seconds for the result. With no result by
+ * then, or no stream to send on, it tells the user to try again later; the redeem
+ * may or may not have been done. Trying again is safe: a redeem is idempotent for
+ * its user (see RedeemOutcome).
+ *
+ * @generated from message kusinta.iot.signaling.v1.RedeemInvite
+ */
+export declare type RedeemInvite = Message<"kusinta.iot.signaling.v1.RedeemInvite"> & {
+  /**
+   * Minted by the api-server, opaque, unique among its redeems in flight.
+   *
+   * @generated from field: string request_id = 1;
+   */
+  requestId: string;
+
+  /**
+   * The secret as the user gave it: the token from a link, or the code as typed.
+   * The gateway hashes and normalises as webrtc.v1 invite.proto says.
+   *
+   * @generated from oneof kusinta.iot.signaling.v1.RedeemInvite.secret
+   */
+  secret: {
+    /**
+     * @generated from field: string token = 2;
+     */
+    value: string;
+    case: "token";
+  } | {
+    /**
+     * @generated from field: string code = 3;
+     */
+    value: string;
+    case: "code";
+  } | { case: undefined; value?: undefined };
+
+  /**
+   * The display name the user's token carries, for the join request it may make, by the
+   * same rule as webrtc.v1.AppTokenClaims.name: the identity provider's display-name claim
+   * alone, never a username or an email address. May be empty.
+   *
+   * @generated from field: string display_name = 4;
+   */
+  displayName: string;
+
+  /**
+   * The verified email address of the user's account, as their token states it.
+   * Never an address the token does not mark verified.
+   *
+   * @generated from field: string verified_email = 5;
+   */
+  verifiedEmail: string;
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.RedeemInvite.
+ * Use `create(RedeemInviteSchema)` to create a new message.
+ */
+export declare const RedeemInviteSchema: GenMessage<RedeemInvite>;
+
+/**
+ * The answer to a RedeemInvite, gateway → api-server.
+ *
+ * @generated from message kusinta.iot.signaling.v1.RedeemInviteResult
+ */
+export declare type RedeemInviteResult = Message<"kusinta.iot.signaling.v1.RedeemInviteResult"> & {
+  /**
+   * As RedeemInvite.request_id.
+   *
+   * @generated from field: string request_id = 1;
+   */
+  requestId: string;
+
+  /**
+   * @generated from field: kusinta.iot.signaling.v1.RedeemOutcome outcome = 2;
+   */
+  outcome: RedeemOutcome;
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.RedeemInviteResult.
+ * Use `create(RedeemInviteResultSchema)` to create a new message.
+ */
+export declare const RedeemInviteResultSchema: GenMessage<RedeemInviteResult>;
+
+/**
+ * The api-server's first message on every GatewayConnect stream, sent before any other. It
+ * carries the ownership epoch of the gateway's owner record.
+ *
+ * OWNER OF RECORD. A gateway is owned by an organisation, which the api-server keeps; the
+ * organisation's administrators are the gateway's vouched administrators. The api-server
+ * vouches for them twice: in the token of each session one of them opens
+ * (webrtc.v1.AppTokenClaims.roles), and to the gateway, as the whole set
+ * (VouchedAdministrators). Neither can be changed on the gateway. A gateway moves to another
+ * organisation only by a transfer the receiving organisation accepted (TransferOutcome).
+ *
+ * OWNERSHIP EPOCH. An opaque id the api-server gives each owner record of a gateway. It is new
+ * at the first registration after the gateway was deleted, and only then: a revoke, a
+ * re-registration by the owning organisation and a transfer all keep it. The gateway takes it
+ * from the api-server's answer to its own registration (registration.v1.RegistrationComplete)
+ * and from this message, and from nowhere else: never from an app session, nor from anything an
+ * app hands over, the registration token included. It keeps the epoch it holds across restarts.
+ *
+ * Given an epoch other than the one it holds, the gateway wipes people and history (see
+ * GatewayDeleted, WIPE), space names included, before it admits any session or applies anything
+ * else from that registration or stream, and then holds the new epoch. A gateway holding no epoch takes the first it is given and wipes nothing. The
+ * epoch it holds, given again, changes nothing, so the same epoch twice wipes once.
+ *
+ * A gateway that holds an epoch treats a stream on which anything arrives before this message,
+ * or this message with an empty epoch, as not open: it applies nothing from it and closes it.
+ * So the api-server must send this message first on every stream before a gateway that
+ * requires it is deployed.
+ *
+ * @generated from message kusinta.iot.signaling.v1.GatewayStreamOpened
+ */
+export declare type GatewayStreamOpened = Message<"kusinta.iot.signaling.v1.GatewayStreamOpened"> & {
+  /**
+   * @generated from field: string ownership_epoch = 1;
+   */
+  ownershipEpoch: string;
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.GatewayStreamOpened.
+ * Use `create(GatewayStreamOpenedSchema)` to create a new message.
+ */
+export declare const GatewayStreamOpenedSchema: GenMessage<GatewayStreamOpened>;
+
+/**
+ * The gateway was deleted at the api-server, api-server → gateway: the owner record with
+ * ownership_epoch has ended, and the gateway decommissions at once. Sent to a connected gateway
+ * before the api-server ends its stream, and answered with GatewayWiped. A gateway offline when
+ * it is deleted learns it from the new epoch at its next registration instead
+ * (GatewayStreamOpened, OWNERSHIP EPOCH), and wipes then just as it would have now.
+ *
+ * A delete is not a revoke. A revoke ends the gateway's certificate and keeps its owner: it sends
+ * no notice and wipes nothing, and a revoked gateway registered again by the owning organisation
+ * keeps everything. A delete ends the owner record itself, so the gateway starts empty for
+ * whoever registers it next, and nothing about people is carried to an organisation that did not
+ * choose it.
+ *
+ * A notice naming the epoch the gateway holds makes it wipe at once, in the scope asked and
+ * before it applies anything else, and then hold no epoch. A repeat of the notice it last applied
+ * is acknowledged again as before and changes nothing; a notice naming any other epoch is
+ * ignored.
+ *
+ * WIPE. A wipe of people and history (WIPE_SCOPE_PEOPLE_AND_HISTORY) keeps the building's setup:
+ * its spaces, with their structure and types; its devices and how they are filed; device links;
+ * connector configuration; the building's time zone; and the gateway's own credentials and the
+ * settings that are not about people. Everything about people goes: every user, role,
+ * membership and residency, with its residency id; every invite, join request and promotion
+ * request; every name and email address; the vouched administrators and their version; every end
+ * of access; every device's ownership, an owned device staying filed where it is, released, as
+ * one of the building's own; every contact; and everything recorded per home — room history,
+ * climate summaries, events, targets, modes and routines — including what is still queued for the
+ * api-server about any of them, and the gateway's own records of who did what. No home is held
+ * vacant after it (webrtc.v1 household.proto, VACANCY SETBACK): with every residency gone,
+ * nothing is left to show that anyone lived in any home, so the setback ends in all of them. A
+ * home's own wipe (household.proto, WIPE) keeps it. Every open session ends, and none is
+ * admitted until the wipe is done.
+ *
+ * Logs. A wipe takes what the gateway itself keeps; the operating system's log of the host it
+ * runs on is not the gateway's to erase, and what it holds stays until the host's own retention
+ * drops it. A gateway SHOULD NOT write user ids or names to that log in normal operation, so that
+ * nothing about people outlives a wipe there.
+ *
+ * It always renames every space too, since a name can name a person ("Ilse's room"): each gets a
+ * generic name, its type and its number among the spaces of that type under the same parent,
+ * counted from 1 in the order the gateway lists them — "Apartment 1", "Floor 2", "Room 3". In
+ * English, as here, since nothing on the gateway knows the building's language. The renaming is
+ * part of the wipe: done in the same step, all of it or none, and keyed by the same epoch, so it
+ * is done once per epoch as the rest is.
+ * No space is removed or moved by it; each keeps its type, its place in the structure, its
+ * devices, its filing and its links.
+ *
+ * The gateway then reports as a gateway starting afresh does: on new streams, a snapshot with no
+ * members (reporting.v1.ReportMembersRequest), no service reach and no invite routes, so the
+ * api-server's record of who belongs to the gateway empties too.
+ *
+ * @generated from message kusinta.iot.signaling.v1.GatewayDeleted
+ */
+export declare type GatewayDeleted = Message<"kusinta.iot.signaling.v1.GatewayDeleted"> & {
+  /**
+   * @generated from field: string ownership_epoch = 1;
+   */
+  ownershipEpoch: string;
+
+  /**
+   * @generated from field: kusinta.iot.signaling.v1.WipeScope scope = 2;
+   */
+  scope: WipeScope;
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.GatewayDeleted.
+ * Use `create(GatewayDeletedSchema)` to create a new message.
+ */
+export declare const GatewayDeletedSchema: GenMessage<GatewayDeleted>;
+
+/**
+ * The gateway's acknowledgement of a GatewayDeleted, gateway → api-server: what it wiped.
+ *
+ * For WIPE_SCOPE_PEOPLE_AND_HISTORY, sent once the wipe is done. For WIPE_SCOPE_FACTORY_RESET,
+ * sent once everything but the gateway's credentials is gone and before it erases those, since
+ * sending needs them; the credentials go at once after. The api-server then revokes the gateway's
+ * certificate.
+ *
+ * @generated from message kusinta.iot.signaling.v1.GatewayWiped
+ */
+export declare type GatewayWiped = Message<"kusinta.iot.signaling.v1.GatewayWiped"> & {
+  /**
+   * As GatewayDeleted.ownership_epoch.
+   *
+   * @generated from field: string ownership_epoch = 1;
+   */
+  ownershipEpoch: string;
+
+  /**
+   * The scope the gateway applied: WIPE_SCOPE_PEOPLE_AND_HISTORY when it was asked for that, and
+   * when it was asked for a factory reset it does not perform.
+   *
+   * @generated from field: kusinta.iot.signaling.v1.WipeScope scope = 2;
+   */
+  scope: WipeScope;
+
+  /**
+   * With WIPE_SCOPE_FACTORY_RESET: each piece of other hardware that still holds pairings the
+   * reset could not reach, for the person who asked to reset it by hand. Empty otherwise.
+   *
+   * @generated from field: repeated kusinta.iot.signaling.v1.PairingsLeftBehind left_behind = 3;
+   */
+  leftBehind: PairingsLeftBehind[];
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.GatewayWiped.
+ * Use `create(GatewayWipedSchema)` to create a new message.
+ */
+export declare const GatewayWipedSchema: GenMessage<GatewayWiped>;
+
+/**
+ * Hardware a connector drives that keeps its own pairings through a factory reset.
+ *
+ * @generated from message kusinta.iot.signaling.v1.PairingsLeftBehind
+ */
+export declare type PairingsLeftBehind = Message<"kusinta.iot.signaling.v1.PairingsLeftBehind"> & {
+  /**
+   * As the connector described itself (webrtc.v1.ConnectorDescriptor): what kind of hardware,
+   * and its name, for a person.
+   *
+   * @generated from field: kusinta.iot.common.v1.ConnectorKind kind = 1;
+   */
+  kind: ConnectorKind;
+
+  /**
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.PairingsLeftBehind.
+ * Use `create(PairingsLeftBehindSchema)` to create a new message.
+ */
+export declare const PairingsLeftBehindSchema: GenMessage<PairingsLeftBehind>;
+
+/**
+ * The administrators of the organisation that owns the gateway, api-server → gateway: the whole
+ * set each time, never a change to it.
+ *
+ * The api-server sends it on every stream, after GatewayStreamOpened and any unacknowledged
+ * TransferOutcome, and again whenever the set or the organisation's name changes. It sends the
+ * newest set again on every stream until the gateway acknowledges its version
+ * (VouchedAdministratorsApplied).
+ *
+ * It grants nothing on its own. A session holds ROLE_GATEWAY_ADMIN as a vouched administrator
+ * only when the token it opened with carries it (webrtc.v1.AppTokenClaims.roles); a user named
+ * here who connects with a token that does not is no administrator in that session. What the set
+ * says is who the administrators are between their tokens:
+ *   * every user it names is a member of the gateway, listed as a vouched administrator
+ *     (webrtc.v1.MemberDetail.vouched_admin) and counted under ROLE_GATEWAY_ADMIN, whether or not
+ *     the gateway has seen them connect. Their name and email address are learnt from their own
+ *     tokens, and are unknown until then;
+ *   * their administration cannot be changed on the gateway (webrtc.v1 members.proto,
+ *     "vouched_admin");
+ *   * when a set the gateway applies drops a user, the gateway ends the administration of every
+ *     open session of theirs at once, without waiting for them to reconnect: the session loses
+ *     ROLE_GATEWAY_ADMIN as any change of role reaches it (webrtc.v1.LivePermissionUpdate,
+ *     session_roles), unless the gateway holds that role for them itself;
+ *   * a token issued (AppTokenClaims.iat, in whole seconds) no later than the second in which
+ *     the set the gateway holds was issued, for a user that set does not name, vouches for no
+ *     administration, so a token minted before a user was dropped cannot bring it back. A token
+ *     issued later is honoured whether or not the set names its user, since the set may lag
+ *     behind it.
+ *
+ * Safe to lose, repeat and reorder: the gateway applies a set only when its version is above the
+ * one it holds, ignores any other, and acknowledges each with the version it then holds. It keeps
+ * the set it holds, with its version and issued_at, across restarts, so a restart forgets nothing
+ * before the stream opens again. A wipe drops it, version included (GatewayDeleted, WIPE), so the
+ * versions of a new owner record start afresh.
+ *
+ * @generated from message kusinta.iot.signaling.v1.VouchedAdministrators
+ */
+export declare type VouchedAdministrators = Message<"kusinta.iot.signaling.v1.VouchedAdministrators"> & {
+  /**
+   * Above that of every set the api-server sent before under the same ownership epoch. Never zero.
+   *
+   * @generated from field: uint64 version = 1;
+   */
+  version: bigint;
+
+  /**
+   * Each administrator of the owning organisation, once. Never empty, since an organisation
+   * always has one. The set carries no one's name or email address.
+   *
+   * @generated from field: repeated kusinta.iot.identity.v1.UserId administrators = 2;
+   */
+  administrators: UserId[];
+
+  /**
+   * The owning organisation's name, as its administrators set it: what
+   * webrtc.v1.PrivacyDisclosure.owner_organisation_name tells. Never its organisation number.
+   *
+   * @generated from field: string organisation_name = 3;
+   */
+  organisationName: string;
+
+  /**
+   * When the api-server made this set, on the clock that sets AppTokenClaims.iat, so the two
+   * compare. Never earlier than an earlier version's.
+   *
+   * @generated from field: google.protobuf.Timestamp issued_at = 4;
+   */
+  issuedAt?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.VouchedAdministrators.
+ * Use `create(VouchedAdministratorsSchema)` to create a new message.
+ */
+export declare const VouchedAdministratorsSchema: GenMessage<VouchedAdministrators>;
+
+/**
+ * The gateway's acknowledgement of a VouchedAdministrators, gateway → api-server.
+ *
+ * @generated from message kusinta.iot.signaling.v1.VouchedAdministratorsApplied
+ */
+export declare type VouchedAdministratorsApplied = Message<"kusinta.iot.signaling.v1.VouchedAdministratorsApplied"> & {
+  /**
+   * The version the gateway holds once it has applied or ignored the set, which may be above
+   * the one acknowledged. The api-server sends no set at or below it again.
+   *
+   * @generated from field: uint64 version = 1;
+   */
+  version: bigint;
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.VouchedAdministratorsApplied.
+ * Use `create(VouchedAdministratorsAppliedSchema)` to create a new message.
+ */
+export declare const VouchedAdministratorsAppliedSchema: GenMessage<VouchedAdministratorsApplied>;
+
+/**
+ * A transfer of the gateway to another organisation, accepted by an administrator of the
+ * receiving one, api-server → gateway. It carries the receiving organisation's vouched set and
+ * what becomes of each outgoing staff member, and the gateway applies the two in one step — all
+ * of it or none — before anything after it on the stream. The ownership epoch is kept: residents,
+ * technicians, spaces and devices stay as they are.
+ *
+ * The api-server keeps an outcome until the gateway acknowledges it (TransferOutcomeApplied),
+ * through the gateway's offline spells, and sends it on every stream right after
+ * GatewayStreamOpened. While one is unacknowledged it sends the vouched set only inside it, as
+ * administrators, the newest set. Applying is idempotent by transfer_id: an outcome already
+ * applied is acknowledged again, its outgoing choices are not applied again, and its set is
+ * applied as any VouchedAdministrators is, by version.
+ *
+ * The outgoing staff are everyone named in outgoing and everyone holding ROLE_GATEWAY_ADMIN or
+ * ROLE_PROPERTY_OWNER on the gateway as the outcome is applied — save anyone the new set names,
+ * who is of the receiving organisation and is left as they are. The api-server names in outgoing
+ * every administrator of the sending organisation, and everyone it holds as reported with
+ * ROLE_GATEWAY_ADMIN or ROLE_PROPERTY_OWNER (reporting.v1.GatewayMember). Each outgoing staff
+ * member either:
+ *   * leaves: their choice is LEAVE, UNSPECIFIED or a value the gateway does not know, or they
+ *     are not named in outgoing at all, so a transfer keeps no one by omission. The gateway takes
+ *     every role it holds for them and every SERVICE membership, with the pending invites they
+ *     made as staff, as RemoveFromGateway by user id does from a caller who lives in none of
+ *     their homes. It never ends a residency, nor the invites they made as its resident;
+ *   * or stays as a technician: STAY_AS_TECHNICIAN. The gateway takes ROLE_GATEWAY_ADMIN and
+ *     ROLE_PROPERTY_OWNER as webrtc.v1.SetMemberRole taking them away does, gives
+ *     ROLE_TECHNICIAN, keeps their SERVICE memberships, files them SERVICE on every top-level
+ *     space they are not filed on, and sets access_until as webrtc.v1.SetAccessUntil does. One
+ *     whose access_until is not after the moment the outcome is applied leaves instead.
+ * Every change reaches the outgoing staff's open sessions at once, as a change of role does.
+ *
+ * @generated from message kusinta.iot.signaling.v1.TransferOutcome
+ */
+export declare type TransferOutcome = Message<"kusinta.iot.signaling.v1.TransferOutcome"> & {
+  /**
+   * Minted by the api-server, opaque, unique among the gateway's transfers.
+   *
+   * @generated from field: string transfer_id = 1;
+   */
+  transferId: string;
+
+  /**
+   * The receiving organisation's vouched set, as it stands.
+   *
+   * @generated from field: kusinta.iot.signaling.v1.VouchedAdministrators administrators = 2;
+   */
+  administrators?: VouchedAdministrators | undefined;
+
+  /**
+   * What becomes of each outgoing staff member, once each.
+   *
+   * @generated from field: repeated kusinta.iot.signaling.v1.OutgoingChoice outgoing = 3;
+   */
+  outgoing: OutgoingChoice[];
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.TransferOutcome.
+ * Use `create(TransferOutcomeSchema)` to create a new message.
+ */
+export declare const TransferOutcomeSchema: GenMessage<TransferOutcome>;
+
+/**
+ * What a transfer does with one outgoing staff member (TransferOutcome).
+ *
+ * @generated from message kusinta.iot.signaling.v1.OutgoingChoice
+ */
+export declare type OutgoingChoice = Message<"kusinta.iot.signaling.v1.OutgoingChoice"> & {
+  /**
+   * @generated from field: kusinta.iot.identity.v1.UserId user_id = 1;
+   */
+  userId?: UserId | undefined;
+
+  /**
+   * @generated from field: kusinta.iot.signaling.v1.OutgoingStaffChoice choice = 2;
+   */
+  choice: OutgoingStaffChoice;
+
+  /**
+   * When their access as a technician ends; unset for no end. Only with STAY_AS_TECHNICIAN, and
+   * ignored with any other choice.
+   *
+   * @generated from field: google.protobuf.Timestamp access_until = 3;
+   */
+  accessUntil?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.OutgoingChoice.
+ * Use `create(OutgoingChoiceSchema)` to create a new message.
+ */
+export declare const OutgoingChoiceSchema: GenMessage<OutgoingChoice>;
+
+/**
+ * The gateway's acknowledgement of a TransferOutcome, gateway → api-server: applied now or
+ * before. It acknowledges the outcome's vouched set too. The api-server sends the outcome no
+ * more.
+ *
+ * @generated from message kusinta.iot.signaling.v1.TransferOutcomeApplied
+ */
+export declare type TransferOutcomeApplied = Message<"kusinta.iot.signaling.v1.TransferOutcomeApplied"> & {
+  /**
+   * As TransferOutcome.transfer_id.
+   *
+   * @generated from field: string transfer_id = 1;
+   */
+  transferId: string;
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.TransferOutcomeApplied.
+ * Use `create(TransferOutcomeAppliedSchema)` to create a new message.
+ */
+export declare const TransferOutcomeAppliedSchema: GenMessage<TransferOutcomeApplied>;
+
 /**
  * Messages sent by the app (GatewaySignalingService.UserConnect stream).
  * Auth: Authorization: Bearer <jwt> in gRPC request metadata (validated by interceptor).
@@ -244,6 +878,10 @@ export declare type UserConnectRequest = Message<"kusinta.iot.signaling.v1.UserC
   sessionId: string;
 
   /**
+   * A payload added here, the handshake aside, belongs in UserSendRequest too:
+   * the half-duplex form of this leg carries the same upstream messages, and
+   * nothing fails if one of them is only added to one of the two.
+   *
    * @generated from oneof kusinta.iot.signaling.v1.UserConnectRequest.payload
    */
   payload: {
@@ -276,6 +914,10 @@ export declare const UserConnectRequestSchema: GenMessage<UserConnectRequest>;
 /**
  * Messages sent by the api-server to the app.
  *
+ * One oneof serves both forms of the leg: UserListenResponse wraps this message
+ * rather than restating its payloads, so an arm added here reaches the bidi and
+ * half-duplex forms alike.
+ *
  * @generated from message kusinta.iot.signaling.v1.UserConnectResponse
  */
 export declare type UserConnectResponse = Message<"kusinta.iot.signaling.v1.UserConnectResponse"> & {
@@ -283,6 +925,7 @@ export declare type UserConnectResponse = Message<"kusinta.iot.signaling.v1.User
    * Echoes the session_id of the stream this message is delivered on, so a
    * client can assert the relay routed to the session it thinks it is. See the
    * contract above.
+   * Ignored on a heartbeat, which carries no routing target at all.
    *
    * @generated from field: string session_id = 4;
    */
@@ -309,6 +952,22 @@ export declare type UserConnectResponse = Message<"kusinta.iot.signaling.v1.User
      */
     value: IceCandidate;
     case: "iceCandidate";
+  } | {
+    /**
+     * Keeps a silent stream alive. UserListen is downstream-only — the client
+     * opens it with a handshake and then writes nothing — so between the
+     * acknowledgement and an answer there is no traffic in either direction, and
+     * an idle negotiation can outlast a proxy's patience. Upstream cannot help:
+     * the client has nothing to send, and it is traffic *to* the client that
+     * resets a client-side idle timer.
+     *
+     * A client that does not know this arm sees an unset payload rather than an
+     * error, which is what the oneof buys.
+     *
+     * @generated from field: kusinta.iot.signaling.v1.HeartBeat heartbeat = 5;
+     */
+    value: HeartBeat;
+    case: "heartbeat";
   } | { case: undefined; value?: undefined };
 };
 
@@ -318,3 +977,276 @@ export declare type UserConnectResponse = Message<"kusinta.iot.signaling.v1.User
  */
 export declare const UserConnectResponseSchema: GenMessage<UserConnectResponse>;
 
+/**
+ * The app leg of the protocol exists twice. UserConnect is one bidi stream, and
+ * is what a client uses when its transport can stream a request body. A client
+ * whose transport cannot — a browser, whose fetch API has no full-duplex request
+ * stream — uses UserListen and UserSend instead. Both forms carry the same
+ * messages and are served by the same relay: once a session is live, how it was
+ * opened is not observable.
+ *
+ * Opens the downstream half of a half-duplex app session, and carries the
+ * handshake that is the first frame of the bidi form. Field numbers are those of
+ * the equivalent UserConnectRequest, so the two cannot be confused on the wire.
+ *
+ * @generated from message kusinta.iot.signaling.v1.UserListenRequest
+ */
+export declare type UserListenRequest = Message<"kusinta.iot.signaling.v1.UserListenRequest"> & {
+  /**
+   * @generated from field: kusinta.iot.signaling.v1.UserHandshake handshake = 1;
+   */
+  handshake?: UserHandshake | undefined;
+
+  /**
+   * This client's session: opaque, minted by the client, stable across
+   * reconnects, never a credential, and required. See the contract above.
+   *
+   * @generated from field: string session_id = 4;
+   */
+  sessionId: string;
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.UserListenRequest.
+ * Use `create(UserListenRequestSchema)` to create a new message.
+ */
+export declare const UserListenRequestSchema: GenMessage<UserListenRequest>;
+
+/**
+ * One message of the downstream half. Wraps the response the bidi form delivers
+ * directly, rather than restating its payloads: a response message is not shared
+ * between two rpcs, and a second copy of the oneof would be free to drift from
+ * the first.
+ *
+ * @generated from message kusinta.iot.signaling.v1.UserListenResponse
+ */
+export declare type UserListenResponse = Message<"kusinta.iot.signaling.v1.UserListenResponse"> & {
+  /**
+   * @generated from field: kusinta.iot.signaling.v1.UserConnectResponse response = 1;
+   */
+  response?: UserConnectResponse | undefined;
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.UserListenResponse.
+ * Use `create(UserListenResponseSchema)` to create a new message.
+ */
+export declare const UserListenResponseSchema: GenMessage<UserListenResponse>;
+
+/**
+ * One upstream message of a half-duplex app session, delivered by its own call.
+ *
+ * The session must already be open, which is what makes ordering the caller's
+ * job: the handshake is acknowledged on the UserListen stream, and a UserSend
+ * issued before that acknowledgement names a session the relay does not hold
+ * yet. It is refused, not queued. Two sends racing each other can also arrive
+ * out of order, so a caller that must preserve order — an offer before the
+ * candidates that belong to it — issues them one at a time.
+ *
+ * @generated from message kusinta.iot.signaling.v1.UserSendRequest
+ */
+export declare type UserSendRequest = Message<"kusinta.iot.signaling.v1.UserSendRequest"> & {
+  /**
+   * The session to deliver into. See the contract above.
+   *
+   * @generated from field: string session_id = 4;
+   */
+  sessionId: string;
+
+  /**
+   * @generated from oneof kusinta.iot.signaling.v1.UserSendRequest.payload
+   */
+  payload: {
+    /**
+     * @generated from field: kusinta.iot.signaling.v1.SdpOffer offer = 2;
+     */
+    value: SdpOffer;
+    case: "offer";
+  } | {
+    /**
+     * @generated from field: kusinta.iot.signaling.v1.IceCandidate ice_candidate = 3;
+     */
+    value: IceCandidate;
+    case: "iceCandidate";
+  } | { case: undefined; value?: undefined };
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.UserSendRequest.
+ * Use `create(UserSendRequestSchema)` to create a new message.
+ */
+export declare const UserSendRequestSchema: GenMessage<UserSendRequest>;
+
+/**
+ * Empty. Delivery is acknowledged by the call succeeding; a message that could
+ * not be routed fails the call instead.
+ *
+ * @generated from message kusinta.iot.signaling.v1.UserSendResponse
+ */
+export declare type UserSendResponse = Message<"kusinta.iot.signaling.v1.UserSendResponse"> & {
+};
+
+/**
+ * Describes the message kusinta.iot.signaling.v1.UserSendResponse.
+ * Use `create(UserSendResponseSchema)` to create a new message.
+ */
+export declare const UserSendResponseSchema: GenMessage<UserSendResponse>;
+
+/**
+ * What redeeming an invite did, as the gateway decided it.
+ *
+ * A redeem is idempotent for its user: redeemed again by the same user, for as
+ * long as its secret would have lasted unused, a used invite answers JOINED if
+ * the user is filed on its space by then, and otherwise as it did the first time
+ * — so a denied request still answers PENDING_APPROVAL — except that one which
+ * filed the user, who has left that space since, answers INVALID. To anyone
+ * else it answers INVALID. So a user who never saw the first answer can safely
+ * try again.
+ *
+ * @generated from enum kusinta.iot.signaling.v1.RedeemOutcome
+ */
+export enum RedeemOutcome {
+  /**
+   * @generated from enum value: REDEEM_OUTCOME_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * The user is a member of the invite's space. Answered only once the
+   * api-server has applied the member report that names them
+   * (reporting.v1.GatewayMember), so the user can connect as soon as they are
+   * told. Also the answer for a user already filed on that space: the invite is
+   * used up, and their membership is left exactly as it was.
+   *
+   * @generated from enum value: REDEEM_OUTCOME_JOINED = 1;
+   */
+  JOINED = 1,
+
+  /**
+   * A join request was made (webrtc.v1.JoinRequest); the user becomes a member
+   * once it is approved. Also the answer for a user who already has one on that
+   * space.
+   *
+   * @generated from enum value: REDEEM_OUTCOME_PENDING_APPROVAL = 2;
+   */
+  PENDING_APPROVAL = 2,
+
+  /**
+   * No invite: unknown, expired, revoked, already used by someone else, a code
+   * for an invite bound to another address, or anything else that is not a
+   * live invite. One answer for all of them, so a redeem tells nothing about
+   * which secrets exist.
+   *
+   * @generated from enum value: REDEEM_OUTCOME_INVALID = 3;
+   */
+  INVALID = 3,
+
+  /**
+   * The invite is bound to an address (webrtc.v1.CreateInvite.email) that is not
+   * the user's verified one. Answered only to a token, which cannot be guessed;
+   * a code bound to another address answers INVALID. Never says which address
+   * it is bound to, and leaves the invite pending.
+   *
+   * @generated from enum value: REDEEM_OUTCOME_WRONG_ACCOUNT = 4;
+   */
+  WRONG_ACCOUNT = 4,
+
+  /**
+   * The invite appoints a household admin (webrtc.v1 household.proto, STAFF APPOINTMENT),
+   * and this user may not be appointed: they created it, or hold a staff role on the gateway.
+   * Also the answer to anyone outside the departing household redeeming a RESIDENT or
+   * HOUSEHOLD_ADMIN invite on a home whose vacated handover is pending (webrtc.v1
+   * household.proto, VACANCY). Leaves the invite pending, for the person it was meant for.
+   * Answered only to a user whose secret matched a live invite, so it tells nothing about
+   * which secrets exist. An
+   * appointment invite on a home that is no longer empty is no invite, and answers INVALID.
+   *
+   * Rollout order: the api-server handles it before a gateway sends it.
+   *
+   * @generated from enum value: REDEEM_OUTCOME_NOT_ELIGIBLE = 5;
+   */
+  NOT_ELIGIBLE = 5,
+}
+
+/**
+ * Describes the enum kusinta.iot.signaling.v1.RedeemOutcome.
+ */
+export declare const RedeemOutcomeSchema: GenEnum<RedeemOutcome>;
+
+/**
+ * How much a wipe takes (GatewayDeleted).
+ *
+ * @generated from enum kusinta.iot.signaling.v1.WipeScope
+ */
+export enum WipeScope {
+  /**
+   * Not stated. Read as PEOPLE_AND_HISTORY, as is any value the gateway does not know.
+   *
+   * @generated from enum value: WIPE_SCOPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Decommissioning: people and their history go, every space is given a generic name, and the
+   * rest of the building's setup stays (GatewayDeleted, WIPE).
+   *
+   * @generated from enum value: WIPE_SCOPE_PEOPLE_AND_HISTORY = 1;
+   */
+  PEOPLE_AND_HISTORY = 1,
+
+  /**
+   * Out of the box, for a gateway that is to be used anywhere else: everything the gateway holds
+   * goes — what a wipe of people and history takes and also the building's setup, the gateway's
+   * certificates, keys and registration, connector configuration, the readings connectors store
+   * on the gateway, and the log files it keeps itself (not the host's system log: see WIPE, Logs).
+   * What is held in other hardware is not reached: devices paired
+   * to a radio central the gateway drives stay paired there until that is reset too, and the
+   * gateway says so (GatewayWiped.left_behind).
+   *
+   * A gateway that does not perform a factory reset wipes people and history instead, and says
+   * so in GatewayWiped.scope.
+   *
+   * @generated from enum value: WIPE_SCOPE_FACTORY_RESET = 2;
+   */
+  FACTORY_RESET = 2,
+}
+
+/**
+ * Describes the enum kusinta.iot.signaling.v1.WipeScope.
+ */
+export declare const WipeScopeSchema: GenEnum<WipeScope>;
+
+/**
+ * Whether an outgoing staff member leaves the gateway or stays on it as a technician. Chosen
+ * per person by the sending organisation's administrator who offered the transfer.
+ *
+ * @generated from enum kusinta.iot.signaling.v1.OutgoingStaffChoice
+ */
+export enum OutgoingStaffChoice {
+  /**
+   * No choice stated. Read as LEAVE, as is any value the gateway does not know.
+   *
+   * @generated from enum value: OUTGOING_STAFF_CHOICE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * Leaves: every staff role and SERVICE membership goes, and no residency.
+   *
+   * @generated from enum value: OUTGOING_STAFF_CHOICE_LEAVE = 1;
+   */
+  LEAVE = 1,
+
+  /**
+   * Stays as a technician, with access_until as its end.
+   *
+   * @generated from enum value: OUTGOING_STAFF_CHOICE_STAY_AS_TECHNICIAN = 2;
+   */
+  STAY_AS_TECHNICIAN = 2,
+}
+
+/**
+ * Describes the enum kusinta.iot.signaling.v1.OutgoingStaffChoice.
+ */
+export declare const OutgoingStaffChoiceSchema: GenEnum<OutgoingStaffChoice>;
+