@spine-event-engine/proto 2.0.0-snapshot.25 → 2.0.0-snapshot.26

package/generated/spine/client/app_query_pb.ts

@@ -0,0 +1,98 @@
+/*
+ * Generated by Spine TypeScript. Do not edit manually.
+ * Source Proto: spine/client/app_query.proto
+ */
+
+
+
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated from file spine/client/app_query.proto (package spine.client, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import type { Any } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_any } from "@bufbuild/protobuf/wkt";
+import type { QueryId } from "./query_pb.js";
+import { file_spine_client_query } from "./query_pb.js";
+import type { ActorContext } from "../core/actor_context_pb.js";
+import { file_spine_core_actor_context } from "../core/actor_context_pb.js";
+import type { Response } from "../core/response_pb.js";
+import { file_spine_core_response } from "../core/response_pb.js";
+import { file_spine_options } from "../options_pb.js";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file spine/client/app_query.proto.
+ * Generated from Proto: spine/client/app_query.proto.
+ */
+export const file_spine_client_app_query: GenFile = /*@__PURE__*/
+  fileDesc("ChxzcGluZS9jbGllbnQvYXBwX3F1ZXJ5LnByb3RvEgxzcGluZS5jbGllbnQimQEKCEFwcFF1ZXJ5EisKAmlkGAEgASgLMhUuc3BpbmUuY2xpZW50LlF1ZXJ5SWRCCKCFJAHohSQBEisKB21lc3NhZ2UYAiABKAsyFC5nb29nbGUucHJvdG9idWYuQW55QgSghSQBEjMKB2NvbnRleHQYAyABKAsyGC5zcGluZS5jb3JlLkFjdG9yQ29udGV4dEIIoIUkAeiFJAEiZwoQQXBwUXVlcnlSZXNwb25zZRIsCghyZXNwb25zZRgBIAEoCzIULnNwaW5lLmNvcmUuUmVzcG9uc2VCBKCFJAESJQoHbWVzc2FnZRgCIAMoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlCMwoPaW8uc3BpbmUuY2xpZW50Qg1BcHBRdWVyeVByb3RvUAGqjSQNdHlwZS5zcGluZS5pb2IGcHJvdG8z", [file_google_protobuf_any, file_spine_client_query, file_spine_core_actor_context, file_spine_core_response, file_spine_options]);
+
+/**
+ * One application-defined read request.
+ *
+ * @generated from message spine.client.AppQuery
+ * Generated from Proto: spine/client/app_query.proto.
+ */
+export type AppQuery = Message<"spine.client.AppQuery"> & {
+  /**
+   * Identifies this read request for response correlation.
+   *
+   * @generated from field: spine.client.QueryId id = 1;
+   */
+  id?: QueryId | undefined;
+
+  /**
+   * Carries the application-defined Query message.
+   *
+   * @generated from field: google.protobuf.Any message = 2;
+   */
+  message?: Any | undefined;
+
+  /**
+   * Records the actor and time admitted for this request.
+   *
+   * @generated from field: spine.core.ActorContext context = 3;
+   */
+  context?: ActorContext | undefined;
+};
+
+/**
+ * Describes the message spine.client.AppQuery.
+ * Use `create(AppQuerySchema)` to create a new message.
+ * Generated from Proto: spine/client/app_query.proto.
+ */
+export const AppQuerySchema: GenMessage<AppQuery> = /*@__PURE__*/
+  messageDesc(file_spine_client_app_query, 0);
+
+/**
+ * The transport response for an application-defined read.
+ *
+ * @generated from message spine.client.AppQueryResponse
+ * Generated from Proto: spine/client/app_query.proto.
+ */
+export type AppQueryResponse = Message<"spine.client.AppQueryResponse"> & {
+  /**
+   * Reports whether the application read completed or failed.
+   *
+   * @generated from field: spine.core.Response response = 1;
+   */
+  response?: Response | undefined;
+
+  /**
+   * Contains the paired application Response after a successful read.
+   *
+   * @generated from field: repeated google.protobuf.Any message = 2;
+   */
+  message: Any[];
+};
+
+/**
+ * Describes the message spine.client.AppQueryResponse.
+ * Use `create(AppQueryResponseSchema)` to create a new message.
+ * Generated from Proto: spine/client/app_query.proto.
+ */
+export const AppQueryResponseSchema: GenMessage<AppQueryResponse> = /*@__PURE__*/
+  messageDesc(file_spine_client_app_query, 1);
+

package/generated/spine/client/filters_pb.ts

@@ -23,7 +23,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Generated from Proto: spine/client/filters.proto.
  */
 export const file_spine_client_filters: GenFile = /*@__PURE__*/
-  fileDesc("ChpzcGluZS9jbGllbnQvZmlsdGVycy5wcm90bxIMc3BpbmUuY2xpZW50IpEBCgZUYXJnZXQSEgoEdHlwZRgBIAEoCUIEoIUkARIVCgtpbmNsdWRlX2FsbBgCIAEoCEgAEjQKB2ZpbHRlcnMYAyABKAsyGy5zcGluZS5jbGllbnQuVGFyZ2V0RmlsdGVyc0IE6IUkAUgAOhHaiyQNCgtUYXJnZXRNaXhpbkITCgljcml0ZXJpb24SBqKKJAIIASKLAQoNVGFyZ2V0RmlsdGVycxIvCglpZF9maWx0ZXIYASABKAsyFi5zcGluZS5jbGllbnQuSWRGaWx0ZXJCBOiFJAESMwoGZmlsdGVyGAIgAygLMh0uc3BpbmUuY2xpZW50LkNvbXBvc2l0ZUZpbHRlckIE6IUkAToU8ookEGlkX2ZpbHRlcnxmaWx0ZXIioQIKD0NvbXBvc2l0ZUZpbHRlchIqCgZmaWx0ZXIYASADKAsyFC5zcGluZS5jbGllbnQuRmlsdGVyQgTohSQBEkcKCG9wZXJhdG9yGAIgASgOMi8uc3BpbmUuY2xpZW50LkNvbXBvc2l0ZUZpbHRlci5Db21wb3NpdGVPcGVyYXRvckIEoIUkARI9ChBjb21wb3NpdGVfZmlsdGVyGAMgAygLMh0uc3BpbmUuY2xpZW50LkNvbXBvc2l0ZUZpbHRlckIE6IUkASI+ChFDb21wb3NpdGVPcGVyYXRvchIUChBDQ0ZfQ09fVU5ERUZJTkVEEAASBwoDQUxMEAESCgoGRUlUSEVSEAI6GtqLJBYKFENvbXBvc2l0ZUZpbHRlck1peGluIqICCgZGaWx0ZXISLwoKZmllbGRfcGF0aBgBIAEoCzIVLnNwaW5lLmJhc2UuRmllbGRQYXRoQgSghSQBEikKBXZhbHVlGAIgASgLMhQuZ29vZ2xlLnByb3RvYnVmLkFueUIEoIUkARI1CghvcGVyYXRvchgDIAEoDjIdLnNwaW5lLmNsaWVudC5GaWx0ZXIuT3BlcmF0b3JCBKCFJAEicgoIT3BlcmF0b3ISEQoNQ0ZPX1VOREVGSU5FRBAAEgkKBUVRVUFMEAESEAoMR1JFQVRFUl9USEFOEAISDQoJTEVTU19USEFOEAQSFAoQR1JFQVRFUl9PUl9FUVVBTBAFEhEKDUxFU1NfT1JfRVFVQUwQBjoR2oskDQoLRmlsdGVyTWl4aW4iNgoISWRGaWx0ZXISKgoCaWQYASADKAsyFC5nb29nbGUucHJvdG9idWYuQW55QgighSQB6IUkAUIyCg9pby5zcGluZS5jbGllbnRCDEZpbHRlcnNQcm90b1ABqo0kDXR5cGUuc3BpbmUuaW9iBnByb3RvMw", [file_spine_options, file_google_protobuf_any, file_spine_base_field_path]);
+  fileDesc("ChpzcGluZS9jbGllbnQvZmlsdGVycy5wcm90bxIMc3BpbmUuY2xpZW50IpEBCgZUYXJnZXQSEgoEdHlwZRgBIAEoCUIEoIUkARIVCgtpbmNsdWRlX2FsbBgCIAEoCEgAEjQKB2ZpbHRlcnMYAyABKAsyGy5zcGluZS5jbGllbnQuVGFyZ2V0RmlsdGVyc0IE6IUkAUgAOhHaiyQNCgtUYXJnZXRNaXhpbkITCgljcml0ZXJpb24SBqKKJAIIASKNAQoNVGFyZ2V0RmlsdGVycxIvCglpZF9maWx0ZXIYASABKAsyFi5zcGluZS5jbGllbnQuSWRGaWx0ZXJCBOiFJAESMwoGZmlsdGVyGAIgAygLMh0uc3BpbmUuY2xpZW50LkNvbXBvc2l0ZUZpbHRlckIE6IUkAToWoowkEgoQaWRfZmlsdGVyfGZpbHRlciKhAgoPQ29tcG9zaXRlRmlsdGVyEioKBmZpbHRlchgBIAMoCzIULnNwaW5lLmNsaWVudC5GaWx0ZXJCBOiFJAESRwoIb3BlcmF0b3IYAiABKA4yLy5zcGluZS5jbGllbnQuQ29tcG9zaXRlRmlsdGVyLkNvbXBvc2l0ZU9wZXJhdG9yQgSghSQBEj0KEGNvbXBvc2l0ZV9maWx0ZXIYAyADKAsyHS5zcGluZS5jbGllbnQuQ29tcG9zaXRlRmlsdGVyQgTohSQBIj4KEUNvbXBvc2l0ZU9wZXJhdG9yEhQKEENDRl9DT19VTkRFRklORUQQABIHCgNBTEwQARIKCgZFSVRIRVIQAjoa2oskFgoUQ29tcG9zaXRlRmlsdGVyTWl4aW4iogIKBkZpbHRlchIvCgpmaWVsZF9wYXRoGAEgASgLMhUuc3BpbmUuYmFzZS5GaWVsZFBhdGhCBKCFJAESKQoFdmFsdWUYAiABKAsyFC5nb29nbGUucHJvdG9idWYuQW55QgSghSQBEjUKCG9wZXJhdG9yGAMgASgOMh0uc3BpbmUuY2xpZW50LkZpbHRlci5PcGVyYXRvckIEoIUkASJyCghPcGVyYXRvchIRCg1DRk9fVU5ERUZJTkVEEAASCQoFRVFVQUwQARIQCgxHUkVBVEVSX1RIQU4QAhINCglMRVNTX1RIQU4QBBIUChBHUkVBVEVSX09SX0VRVUFMEAUSEQoNTEVTU19PUl9FUVVBTBAGOhHaiyQNCgtGaWx0ZXJNaXhpbiI2CghJZEZpbHRlchIqCgJpZBgBIAMoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlCCKCFJAHohSQBQjIKD2lvLnNwaW5lLmNsaWVudEIMRmlsdGVyc1Byb3RvUAGqjSQNdHlwZS5zcGluZS5pb2IGcHJvdG8z", [file_spine_options, file_google_protobuf_any, file_spine_base_field_path]);
 
 /**
  * Defines the target type and filters.

package/generated/spine/client/query_service_pb.ts

@@ -14,6 +14,8 @@ import { fileDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
 import { file_spine_options } from "../options_pb.js";
 import type { QueryResponseSchema, QuerySchema } from "./query_pb.js";
 import { file_spine_client_query } from "./query_pb.js";
+import type { AppQueryResponseSchema, AppQuerySchema } from "./app_query_pb.js";
+import { file_spine_client_app_query } from "./app_query_pb.js";
 import { file_google_protobuf_type } from "@bufbuild/protobuf/wkt";
 
 /**
@@ -21,7 +23,7 @@ import { file_google_protobuf_type } from "@bufbuild/protobuf/wkt";
  * Generated from Proto: spine/client/query_service.proto.
  */
 export const file_spine_client_query_service: GenFile = /*@__PURE__*/
-  fileDesc("CiBzcGluZS9jbGllbnQvcXVlcnlfc2VydmljZS5wcm90bxIMc3BpbmUuY2xpZW50MkgKDFF1ZXJ5U2VydmljZRI4CgRSZWFkEhMuc3BpbmUuY2xpZW50LlF1ZXJ5Ghsuc3BpbmUuY2xpZW50LlF1ZXJ5UmVzcG9uc2VCPAoUaW8uc3BpbmUuY2xpZW50LmdycGNCEVF1ZXJ5U2VydmljZVByb3RvUAGqjSQNdHlwZS5zcGluZS5pb2IGcHJvdG8z", [file_spine_options, file_spine_client_query, file_google_protobuf_type]);
+  fileDesc("CiBzcGluZS9jbGllbnQvcXVlcnlfc2VydmljZS5wcm90bxIMc3BpbmUuY2xpZW50MosBCgxRdWVyeVNlcnZpY2USOAoEUmVhZBITLnNwaW5lLmNsaWVudC5RdWVyeRobLnNwaW5lLmNsaWVudC5RdWVyeVJlc3BvbnNlEkEKB0V4ZWN1dGUSFi5zcGluZS5jbGllbnQuQXBwUXVlcnkaHi5zcGluZS5jbGllbnQuQXBwUXVlcnlSZXNwb25zZUI8ChRpby5zcGluZS5jbGllbnQuZ3JwY0IRUXVlcnlTZXJ2aWNlUHJvdG9QAaqNJA10eXBlLnNwaW5lLmlvYgZwcm90bzM", [file_spine_options, file_spine_client_query, file_spine_client_app_query, file_google_protobuf_type]);
 
 /**
  * A service for querying the read-side from clients.
@@ -40,6 +42,16 @@ export const QueryService: GenService<{
     input: typeof QuerySchema;
     output: typeof QueryResponseSchema;
   },
+  /**
+   * Executes an application-defined Query and returns its paired Response.
+   *
+   * @generated from rpc spine.client.QueryService.Execute
+   */
+  execute: {
+    methodKind: "unary";
+    input: typeof AppQuerySchema;
+    output: typeof AppQueryResponseSchema;
+  },
 }> = /*@__PURE__*/
   serviceDesc(file_spine_client_query_service, 0);
 

package/generated/spine/client/subscription_record_pb.ts

@@ -11,8 +11,8 @@
 
 import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
 import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
-import type { Timestamp } from "@bufbuild/protobuf/wkt";
-import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Empty, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_empty, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 import type { Subscription, SubscriptionId } from "./subscription_pb.js";
 import { file_spine_client_subscription } from "./subscription_pb.js";
 import { file_spine_options } from "../options_pb.js";
@@ -23,7 +23,46 @@ import type { Message } from "@bufbuild/protobuf";
  * Generated from Proto: spine/client/subscription_record.proto.
  */
 export const file_spine_client_subscription_record: GenFile = /*@__PURE__*/
-  fileDesc("CiZzcGluZS9jbGllbnQvc3Vic2NyaXB0aW9uX3JlY29yZC5wcm90bxIMc3BpbmUuY2xpZW50IrECChJTdWJzY3JpcHRpb25SZWNvcmQSMgoCaWQYASABKAsyHC5zcGluZS5jbGllbnQuU3Vic2NyaXB0aW9uSWRCCKCFJAHohSQBEjoKDHN1YnNjcmlwdGlvbhgCIAEoCzIaLnNwaW5lLmNsaWVudC5TdWJzY3JpcHRpb25CCKCFJAHohSQBEjYKBnN0YXR1cxgDIAEoDjIgLnNwaW5lLmNsaWVudC5TdWJzY3JpcHRpb25TdGF0dXNCBKCFJAESNgoMd2hlbl9jcmVhdGVkGAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEIEoIUkARI7Chd3aGVuX2FjdGl2YXRpb25fZXhwaXJlcxgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAqQQoSU3Vic2NyaXB0aW9uU3RhdHVzEhIKDlNTX1VOU1BFQ0lGSUVEEAASCwoHUEVORElORxABEgoKBkFDVElWRRACQhNQAaqNJA10eXBlLnNwaW5lLmlvYgZwcm90bzM", [file_google_protobuf_timestamp, file_spine_client_subscription, file_spine_options]);
+  fileDesc("CiZzcGluZS9jbGllbnQvc3Vic2NyaXB0aW9uX3JlY29yZC5wcm90bxIMc3BpbmUuY2xpZW50ImwKGVN1YnNjcmlwdGlvblJlYWRlckJpbmRpbmcSFgoMcHJpbmNpcGFsX2lkGAEgASgJSAASKwoJYW5vbnltb3VzGAIgASgLMhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5SABCCgoIaWRlbnRpdHki6gIKElN1YnNjcmlwdGlvblJlY29yZBIyCgJpZBgBIAEoCzIcLnNwaW5lLmNsaWVudC5TdWJzY3JpcHRpb25JZEIIoIUkAeiFJAESOgoMc3Vic2NyaXB0aW9uGAIgASgLMhouc3BpbmUuY2xpZW50LlN1YnNjcmlwdGlvbkIIoIUkAeiFJAESNgoGc3RhdHVzGAMgASgOMiAuc3BpbmUuY2xpZW50LlN1YnNjcmlwdGlvblN0YXR1c0IEoIUkARI2Cgx3aGVuX2NyZWF0ZWQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgSghSQBEjsKF3doZW5fYWN0aXZhdGlvbl9leHBpcmVzGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI3CgZyZWFkZXIYBiABKAsyJy5zcGluZS5jbGllbnQuU3Vic2NyaXB0aW9uUmVhZGVyQmluZGluZypBChJTdWJzY3JpcHRpb25TdGF0dXMSEgoOU1NfVU5TUEVDSUZJRUQQABILCgdQRU5ESU5HEAESCgoGQUNUSVZFEAJCE1ABqo0kDXR5cGUuc3BpbmUuaW9iBnByb3RvMw", [file_google_protobuf_empty, file_google_protobuf_timestamp, file_spine_client_subscription, file_spine_options]);
+
+/**
+ * Stable verified reader identity retained with a subscription definition.
+ *
+ * @generated from message spine.client.SubscriptionReaderBinding
+ * Generated from Proto: spine/client/subscription_record.proto.
+ */
+export type SubscriptionReaderBinding = Message<"spine.client.SubscriptionReaderBinding"> & {
+  /**
+   * Exactly one admitted reader identity; absence cannot establish reader access.
+   *
+   * @generated from oneof spine.client.SubscriptionReaderBinding.identity
+   */
+  identity: {
+    /**
+     * Application-authenticated principal ID, never ActorContext or provider credentials.
+     *
+     * @generated from field: string principal_id = 1;
+     */
+    value: string;
+    case: "principalId";
+  } | {
+    /**
+     * Explicit admission without a principal or provider authority facts.
+     *
+     * @generated from field: google.protobuf.Empty anonymous = 2;
+     */
+    value: Empty;
+    case: "anonymous";
+  } | { case: undefined; value?: undefined };
+};
+
+/**
+ * Describes the message spine.client.SubscriptionReaderBinding.
+ * Use `create(SubscriptionReaderBindingSchema)` to create a new message.
+ * Generated from Proto: spine/client/subscription_record.proto.
+ */
+export const SubscriptionReaderBindingSchema: GenMessage<SubscriptionReaderBinding> = /*@__PURE__*/
+  messageDesc(file_spine_client_subscription_record, 0);
 
 /**
  * A stored definition of one subscription.
@@ -66,6 +105,13 @@ export type SubscriptionRecord = Message<"spine.client.SubscriptionRecord"> & {
    * @generated from field: google.protobuf.Timestamp when_activation_expires = 5;
    */
   whenActivationExpires?: Timestamp | undefined;
+
+  /**
+   * Stable reader identity admitted when this definition was created.
+   *
+   * @generated from field: spine.client.SubscriptionReaderBinding reader = 6;
+   */
+  reader?: SubscriptionReaderBinding | undefined;
 };
 
 /**
@@ -74,7 +120,7 @@ export type SubscriptionRecord = Message<"spine.client.SubscriptionRecord"> & {
  * Generated from Proto: spine/client/subscription_record.proto.
  */
 export const SubscriptionRecordSchema: GenMessage<SubscriptionRecord> = /*@__PURE__*/
-  messageDesc(file_spine_client_subscription_record, 0);
+  messageDesc(file_spine_client_subscription_record, 1);
 
 /**
  * A lifecycle status of a stored subscription.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spine-event-engine/proto",
-  "version": "2.0.0-snapshot.25",
+  "version": "2.0.0-snapshot.26",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {

package/proto/spine/auth/authenticated_subscription.proto

@@ -17,20 +17,29 @@ package spine.auth;
 
 import "google/protobuf/timestamp.proto";
 import "spine/client/subscription.proto";
+import "spine/client/subscription_record.proto";
 import "spine/options.proto";
 
-option (type_url_prefix) = "type.spine.io";
 option java_multiple_files = true;
+option (type_url_prefix) = "type.spine.io";
 
 // A subscription accepted through an authenticated Gateway request.
 message GatewayAuthenticatedSubscription {
+  // The identifier used to store this record.
+  spine.client.SubscriptionId id = 1 [
+    (required) = true,
+    (validate) = true
+  ];
 
-    // The identifier used to store this record.
-    spine.client.SubscriptionId id = 1 [(required) = true, (validate) = true];
+  // The authenticated subscription, including its Actor and Tenant context.
+  spine.client.Subscription subscription = 2 [
+    (required) = true,
+    (validate) = true
+  ];
 
-    // The authenticated subscription, including its Actor and Tenant context.
-    spine.client.Subscription subscription = 2 [(required) = true, (validate) = true];
+  // The time after which the authenticated subscription is no longer valid.
+  google.protobuf.Timestamp when_expires = 3 [(required) = true];
 
-    // The time after which the authenticated subscription is no longer valid.
-    google.protobuf.Timestamp when_expires = 3 [(required) = true];
+  // Verified reader identity required to reuse this subscription.
+  spine.client.SubscriptionReaderBinding reader = 4;
 }

package/proto/spine/client/app_query.proto

@@ -0,0 +1,55 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+syntax = "proto3";
+
+package spine.client;
+
+import "google/protobuf/any.proto";
+import "spine/client/query.proto";
+import "spine/core/actor_context.proto";
+import "spine/core/response.proto";
+import "spine/options.proto";
+
+option java_multiple_files = true;
+option java_outer_classname = "AppQueryProto";
+option java_package = "io.spine.client";
+option (type_url_prefix) = "type.spine.io";
+
+// One application-defined read request.
+message AppQuery {
+  // Identifies this read request for response correlation.
+  QueryId id = 1 [
+    (required) = true,
+    (validate) = true
+  ];
+
+  // Carries the application-defined Query message.
+  google.protobuf.Any message = 2 [(required) = true];
+
+  // Records the actor and time admitted for this request.
+  spine.core.ActorContext context = 3 [
+    (required) = true,
+    (validate) = true
+  ];
+}
+
+// The transport response for an application-defined read.
+message AppQueryResponse {
+  // Reports whether the application read completed or failed.
+  spine.core.Response response = 1 [(required) = true];
+
+  // Contains the paired application Response after a successful read.
+  repeated google.protobuf.Any message = 2;
+}

package/proto/spine/client/filters.proto

@@ -72,7 +72,7 @@ message Target {
 
 // The set of filters to narrow down the query results/subscription updates.
 message TargetFilters {
-    option (required_field) = "id_filter|filter";
+    option (require).fields = "id_filter|filter";
 
     // Match objects by their IDs.
     IdFilter id_filter = 1 [(validate) = true];

package/proto/spine/client/query_service.proto

@@ -36,6 +36,7 @@ option java_multiple_files = true;
 option java_outer_classname = "QueryServiceProto";
 
 import "spine/client/query.proto";
+import "spine/client/app_query.proto";
 import "google/protobuf/type.proto";
 
 // A service for querying the read-side from clients.
@@ -43,4 +44,7 @@ service QueryService {
 
     // Reads certain data from the read-side by setting the criteria via Query.
     rpc Read(Query) returns (QueryResponse);
+
+    // Executes an application-defined Query and returns its paired Response.
+    rpc Execute(AppQuery) returns (AppQueryResponse);
 }

package/proto/spine/client/subscription_record.proto

@@ -15,41 +15,61 @@ syntax = "proto3";
 
 package spine.client;
 
+import "google/protobuf/empty.proto";
 import "google/protobuf/timestamp.proto";
 import "spine/client/subscription.proto";
 import "spine/options.proto";
 
-option (type_url_prefix) = "type.spine.io";
 option java_multiple_files = true;
+option (type_url_prefix) = "type.spine.io";
 
 // A lifecycle status of a stored subscription.
 enum SubscriptionStatus {
+  // An unspecified status.
+  SS_UNSPECIFIED = 0;
 
-    // An unspecified status.
-    SS_UNSPECIFIED = 0;
+  // A subscription that is waiting for activation.
+  PENDING = 1;
+
+  // A subscription that delivers matching updates.
+  ACTIVE = 2;
+}
 
-    // A subscription that is waiting for activation.
-    PENDING = 1;
+// Stable verified reader identity retained with a subscription definition.
+message SubscriptionReaderBinding {
+  // Exactly one admitted reader identity; absence cannot establish reader access.
+  oneof identity {
+    // Application-authenticated principal ID, never ActorContext or provider credentials.
+    string principal_id = 1;
 
-    // A subscription that delivers matching updates.
-    ACTIVE = 2;
+    // Explicit admission without a principal or provider authority facts.
+    google.protobuf.Empty anonymous = 2;
+  }
 }
 
 // A stored definition of one subscription.
 message SubscriptionRecord {
+  // The identifier used to store this record.
+  SubscriptionId id = 1 [
+    (required) = true,
+    (validate) = true
+  ];
 
-    // The identifier used to store this record.
-    SubscriptionId id = 1 [(required) = true, (validate) = true];
+  // The subscription represented by this record.
+  Subscription subscription = 2 [
+    (required) = true,
+    (validate) = true
+  ];
 
-    // The subscription represented by this record.
-    Subscription subscription = 2 [(required) = true, (validate) = true];
+  // The current lifecycle status.
+  SubscriptionStatus status = 3 [(required) = true];
 
-    // The current lifecycle status.
-    SubscriptionStatus status = 3 [(required) = true];
+  // The time when the subscription was created.
+  google.protobuf.Timestamp when_created = 4 [(required) = true];
 
-    // The time when the subscription was created.
-    google.protobuf.Timestamp when_created = 4 [(required) = true];
+  // The deadline for activating a pending subscription.
+  google.protobuf.Timestamp when_activation_expires = 5;
 
-    // The deadline for activating a pending subscription.
-    google.protobuf.Timestamp when_activation_expires = 5;
+  // Stable reader identity admitted when this definition was created.
+  SubscriptionReaderBinding reader = 6;
 }

package/proto/spine-sources.json

@@ -54,7 +54,11 @@
       "upstreamPath": "client/src/main/proto/spine/client/filters.proto",
       "sourceUrl": "https://github.com/SpineEventEngine/core-java/blob/a408b0d70dafd603efc55b89c8b4b6f3e8c19d3b/client/src/main/proto/spine/client/filters.proto",
       "rawUrl": "https://raw.githubusercontent.com/SpineEventEngine/core-java/a408b0d70dafd603efc55b89c8b4b6f3e8c19d3b/client/src/main/proto/spine/client/filters.proto",
-      "sha256": "e2b4eef3d4e873cb5f0bc80896c19e538442182cddb54fa796d0ec640dcca6a5"
+      "sha256": "e2b4eef3d4e873cb5f0bc80896c19e538442182cddb54fa796d0ec640dcca6a5",
+      "localAdaptation": {
+        "kind": "target-filters-require",
+        "sha256": "6655d6d56b5e42d4e38bd630970aa2b43e52a1589dbbaed1c0d6ea4304adcc9e"
+      }
     },
     {
       "localPath": "packages/proto/proto/spine/client/query_service.proto",
@@ -63,7 +67,11 @@
       "upstreamPath": "client/src/main/proto/spine/client/query_service.proto",
       "sourceUrl": "https://github.com/SpineEventEngine/core-java/blob/a408b0d70dafd603efc55b89c8b4b6f3e8c19d3b/client/src/main/proto/spine/client/query_service.proto",
       "rawUrl": "https://raw.githubusercontent.com/SpineEventEngine/core-java/a408b0d70dafd603efc55b89c8b4b6f3e8c19d3b/client/src/main/proto/spine/client/query_service.proto",
-      "sha256": "8ad31ac9e18d17c38ed3419f80210f60e7d1b4b1bfc94f0949ba993e19934f41"
+      "sha256": "8ad31ac9e18d17c38ed3419f80210f60e7d1b4b1bfc94f0949ba993e19934f41",
+      "localAdaptation": {
+        "kind": "query-service-execute",
+        "sha256": "af2ad517cb1db9b415390e56573d553a040f3ce62a0fe12c13f535d363ad8636"
+      }
     },
     {
       "localPath": "packages/proto/proto/spine/client/query.proto",
@@ -418,13 +426,17 @@
     }
   ],
   "ownedSources": [
+    {
+      "localPath": "packages/proto/proto/spine/client/app_query.proto",
+      "sha256": "b5b334232dc724f7de606e6655aefde7856a8be1e9742311aa3c23a3ae206140"
+    },
     {
       "localPath": "packages/proto/proto/spine/server/agent/acceptance_receipt.proto",
       "sha256": "daa0f8e724849523cb539b9b6a7503aa8eab0de3f23d926d1aa9d117bd44f007"
     },
     {
       "localPath": "packages/proto/proto/spine/auth/authenticated_subscription.proto",
-      "sha256": "b6436714f754e6d7c1a6bbd177c5a4f0b606d3c7c1adc4b86fa3c299210ffc76"
+      "sha256": "da3f4c1ff9a0b968bfed0193c8b43deb0bfd71d126b375ab8832532625d15553"
     },
     {
       "localPath": "packages/proto/proto/spine/auth/authentication_service.proto",
@@ -432,7 +444,7 @@
     },
     {
       "localPath": "packages/proto/proto/spine/client/subscription_record.proto",
-      "sha256": "4e760681afba8d531b00ae08f09e52fb298c969e24aeb830fc72d7292afedaf5"
+      "sha256": "614caf2608bf3fc36a419f887305ae6b7b1cfad657800b5bc3a5d886d396bd86"
     },
     {
       "localPath": "packages/proto/proto/spine/deployment/node_discovery.proto",

package/spine-proto-manifest.json

@@ -1,13 +1,14 @@
 {
   "formatVersion": 2,
   "packageName": "@spine-event-engine/proto",
-  "packageVersion": "2.0.0-snapshot.25",
+  "packageVersion": "2.0.0-snapshot.26",
   "protoFiles": [
     "grpc/health/v1/health.proto",
     "spine/auth/authenticated_subscription.proto",
     "spine/auth/authentication_service.proto",
     "spine/base/error.proto",
     "spine/base/field_path.proto",
+    "spine/client/app_query.proto",
     "spine/client/command_service.proto",
     "spine/client/entities.proto",
     "spine/client/filters.proto",
@@ -67,6 +68,7 @@
     "spine/auth/authentication_service.proto": "generated/spine/auth/authentication_service_pb.js",
     "spine/base/error.proto": "generated/spine/base/error_pb.js",
     "spine/base/field_path.proto": "generated/spine/base/field_path_pb.js",
+    "spine/client/app_query.proto": "generated/spine/client/app_query_pb.js",
     "spine/client/command_service.proto": "generated/spine/client/command_service_pb.js",
     "spine/client/entities.proto": "generated/spine/client/entities_pb.js",
     "spine/client/filters.proto": "generated/spine/client/filters_pb.js",
@@ -122,5 +124,5 @@
   },
   "dependencies": [],
   "moduleExport": "spineProtoModule",
-  "generationId": "cb452a495b14cc11b88343ee1f89421cbfda09d126a9450b87b25ee71cd99cad"
+  "generationId": "bd8cdb457b84a777fe525af300d80944f312fa9b37406bfe5c2501ccb2606076"
 }