@spine-event-engine/proto 2.0.0-snapshot.25 → 2.0.0-snapshot.28

package/generated/spine/auth/authenticated_subscription_pb.ts

@@ -15,6 +15,8 @@ import type { Timestamp } from "@bufbuild/protobuf/wkt";
 import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 import type { Subscription, SubscriptionId } from "../client/subscription_pb.js";
 import { file_spine_client_subscription } from "../client/subscription_pb.js";
+import type { SubscriptionReaderBinding } from "../client/subscription_record_pb.js";
+import { file_spine_client_subscription_record } from "../client/subscription_record_pb.js";
 import { file_spine_options } from "../options_pb.js";
 import type { Message } from "@bufbuild/protobuf";
 
@@ -23,7 +25,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Generated from Proto: spine/auth/authenticated_subscription.proto.
  */
 export const file_spine_auth_authenticated_subscription: GenFile = /*@__PURE__*/
-  fileDesc("CitzcGluZS9hdXRoL2F1dGhlbnRpY2F0ZWRfc3Vic2NyaXB0aW9uLnByb3RvEgpzcGluZS5hdXRoIsoBCiBHYXRld2F5QXV0aGVudGljYXRlZFN1YnNjcmlwdGlvbhIyCgJpZBgBIAEoCzIcLnNwaW5lLmNsaWVudC5TdWJzY3JpcHRpb25JZEIIoIUkAeiFJAESOgoMc3Vic2NyaXB0aW9uGAIgASgLMhouc3BpbmUuY2xpZW50LlN1YnNjcmlwdGlvbkIIoIUkAeiFJAESNgoMd2hlbl9leHBpcmVzGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEIEoIUkAUITUAGqjSQNdHlwZS5zcGluZS5pb2IGcHJvdG8z", [file_google_protobuf_timestamp, file_spine_client_subscription, file_spine_options]);
+  fileDesc("CitzcGluZS9hdXRoL2F1dGhlbnRpY2F0ZWRfc3Vic2NyaXB0aW9uLnByb3RvEgpzcGluZS5hdXRoIoMCCiBHYXRld2F5QXV0aGVudGljYXRlZFN1YnNjcmlwdGlvbhIyCgJpZBgBIAEoCzIcLnNwaW5lLmNsaWVudC5TdWJzY3JpcHRpb25JZEIIoIUkAeiFJAESOgoMc3Vic2NyaXB0aW9uGAIgASgLMhouc3BpbmUuY2xpZW50LlN1YnNjcmlwdGlvbkIIoIUkAeiFJAESNgoMd2hlbl9leHBpcmVzGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEIEoIUkARI3CgZyZWFkZXIYBCABKAsyJy5zcGluZS5jbGllbnQuU3Vic2NyaXB0aW9uUmVhZGVyQmluZGluZ0ITUAGqjSQNdHlwZS5zcGluZS5pb2IGcHJvdG8z", [file_google_protobuf_timestamp, file_spine_client_subscription, file_spine_client_subscription_record, file_spine_options]);
 
 /**
  * A subscription accepted through an authenticated Gateway request.
@@ -52,6 +54,13 @@ export type GatewayAuthenticatedSubscription = Message<"spine.auth.GatewayAuthen
    * @generated from field: google.protobuf.Timestamp when_expires = 3;
    */
   whenExpires?: Timestamp | undefined;
+
+  /**
+   * Verified reader identity required to reuse this subscription.
+   *
+   * @generated from field: spine.client.SubscriptionReaderBinding reader = 4;
+   */
+  reader?: SubscriptionReaderBinding | undefined;
 };
 
 /**

package/generated/spine/auth/oidc_flow_pb.ts

@@ -0,0 +1,171 @@
+/*
+ * Generated by Spine TypeScript. Do not edit manually.
+ * Source Proto: spine/auth/oidc_flow.proto
+ */
+
+
+
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated from file spine/auth/oidc_flow.proto (package spine.auth, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { AuthenticatedPrincipal } from "./authenticated_principal_pb.js";
+import { file_spine_auth_authenticated_principal } from "./authenticated_principal_pb.js";
+import { file_spine_options } from "../options_pb.js";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file spine/auth/oidc_flow.proto.
+ * Generated from Proto: spine/auth/oidc_flow.proto.
+ */
+export const file_spine_auth_oidc_flow: GenFile = /*@__PURE__*/
+  fileDesc("ChpzcGluZS9hdXRoL29pZGNfZmxvdy5wcm90bxIKc3BpbmUuYXV0aCKeAgoUT2lkY0xvZ2luVHJhbnNhY3Rpb24SFQoNbG9va3VwX2RpZ2VzdBgBIAEoCRIPCgdmbG93X2lkGAIgASgJEhcKD3Byb3ZpZGVyX2lzc3VlchgDIAEoCRIRCgljbGllbnRfaWQYBCABKAkSFAoMY2FsbGJhY2tfdXJpGAUgASgJEg0KBW5vbmNlGAYgASgJEh4KFnByb3ZpZGVyX2NvZGVfdmVyaWZpZXIYByABKAkSHgoWYnJvd3Nlcl9jb2RlX2NoYWxsZW5nZRgIIAEoCRIbChNwb3N0X2xvZ2luX3JlZGlyZWN0GAkgASgJEjAKDHdoZW5fZXhwaXJlcxgKIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAi3gEKDk9pZGNMb2dpbkdyYW50EhUKDWxvb2t1cF9kaWdlc3QYASABKAkSDwoHZmxvd19pZBgCIAEoCRI1CglwcmluY2lwYWwYAyABKAsyIi5zcGluZS5hdXRoLkF1dGhlbnRpY2F0ZWRQcmluY2lwYWwSHgoWYnJvd3Nlcl9jb2RlX2NoYWxsZW5nZRgEIAEoCRIbChNwb3N0X2xvZ2luX3JlZGlyZWN0GAUgASgJEjAKDHdoZW5fZXhwaXJlcxgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCE1ABqo0kDXR5cGUuc3BpbmUuaW9iBnByb3RvMw", [file_google_protobuf_timestamp, file_spine_auth_authenticated_principal, file_spine_options]);
+
+/**
+ * One flow-qualified authorization-code transaction, consumed before provider exchange.
+ *
+ * @generated from message spine.auth.OidcLoginTransaction
+ * Generated from Proto: spine/auth/oidc_flow.proto.
+ */
+export type OidcLoginTransaction = Message<"spine.auth.OidcLoginTransaction"> & {
+  /**
+   * SHA-256 lookup digest bound to the flow and browser state.
+   *
+   * @generated from field: string lookup_digest = 1;
+   */
+  lookupDigest: string;
+
+  /**
+   * Application-selected identity of the login flow.
+   *
+   * @generated from field: string flow_id = 2;
+   */
+  flowId: string;
+
+  /**
+   * Trusted issuer selected when the flow was started.
+   *
+   * @generated from field: string provider_issuer = 3;
+   */
+  providerIssuer: string;
+
+  /**
+   * OAuth client configured for the provider exchange.
+   *
+   * @generated from field: string client_id = 4;
+   */
+  clientId: string;
+
+  /**
+   * Exact registered callback URI, including static query parameters.
+   *
+   * @generated from field: string callback_uri = 5;
+   */
+  callbackUri: string;
+
+  /**
+   * Random nonce expected in the verified ID token.
+   *
+   * @generated from field: string nonce = 6;
+   */
+  nonce: string;
+
+  /**
+   * Provider PKCE verifier retained only until callback consumption.
+   *
+   * @generated from field: string provider_code_verifier = 7;
+   */
+  providerCodeVerifier: string;
+
+  /**
+   * Browser PKCE challenge required before application-session issuance.
+   *
+   * @generated from field: string browser_code_challenge = 8;
+   */
+  browserCodeChallenge: string;
+
+  /**
+   * Application redirect selected from the flow allowlist.
+   *
+   * @generated from field: string post_login_redirect = 9;
+   */
+  postLoginRedirect: string;
+
+  /**
+   * Exact deadline for accepting the callback.
+   *
+   * @generated from field: google.protobuf.Timestamp when_expires = 10;
+   */
+  whenExpires?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message spine.auth.OidcLoginTransaction.
+ * Use `create(OidcLoginTransactionSchema)` to create a new message.
+ * Generated from Proto: spine/auth/oidc_flow.proto.
+ */
+export const OidcLoginTransactionSchema: GenMessage<OidcLoginTransaction> = /*@__PURE__*/
+  messageDesc(file_spine_auth_oidc_flow, 0);
+
+/**
+ * One flow-qualified application grant, consumed before session issuance.
+ *
+ * @generated from message spine.auth.OidcLoginGrant
+ * Generated from Proto: spine/auth/oidc_flow.proto.
+ */
+export type OidcLoginGrant = Message<"spine.auth.OidcLoginGrant"> & {
+  /**
+   * SHA-256 lookup digest bound to the flow and random grant.
+   *
+   * @generated from field: string lookup_digest = 1;
+   */
+  lookupDigest: string;
+
+  /**
+   * Application-selected identity of the login flow.
+   *
+   * @generated from field: string flow_id = 2;
+   */
+  flowId: string;
+
+  /**
+   * Complete mapped principal with optional attributes presence.
+   *
+   * @generated from field: spine.auth.AuthenticatedPrincipal principal = 3;
+   */
+  principal?: AuthenticatedPrincipal | undefined;
+
+  /**
+   * Browser PKCE challenge copied from the consumed transaction.
+   *
+   * @generated from field: string browser_code_challenge = 4;
+   */
+  browserCodeChallenge: string;
+
+  /**
+   * Allowlisted application redirect from the consumed transaction.
+   *
+   * @generated from field: string post_login_redirect = 5;
+   */
+  postLoginRedirect: string;
+
+  /**
+   * Exact deadline for exchanging the application grant.
+   *
+   * @generated from field: google.protobuf.Timestamp when_expires = 6;
+   */
+  whenExpires?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message spine.auth.OidcLoginGrant.
+ * Use `create(OidcLoginGrantSchema)` to create a new message.
+ * Generated from Proto: spine/auth/oidc_flow.proto.
+ */
+export const OidcLoginGrantSchema: GenMessage<OidcLoginGrant> = /*@__PURE__*/
+  messageDesc(file_spine_auth_oidc_flow, 1);
+

package/generated/spine/auth/opaque_session_pb.ts

@@ -0,0 +1,71 @@
+/*
+ * Generated by Spine TypeScript. Do not edit manually.
+ * Source Proto: spine/auth/opaque_session.proto
+ */
+
+
+
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated from file spine/auth/opaque_session.proto (package spine.auth, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { AuthenticatedPrincipal } from "./authenticated_principal_pb.js";
+import { file_spine_auth_authenticated_principal } from "./authenticated_principal_pb.js";
+import { file_spine_options } from "../options_pb.js";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file spine/auth/opaque_session.proto.
+ * Generated from Proto: spine/auth/opaque_session.proto.
+ */
+export const file_spine_auth_opaque_session: GenFile = /*@__PURE__*/
+  fileDesc("Ch9zcGluZS9hdXRoL29wYXF1ZV9zZXNzaW9uLnByb3RvEgpzcGluZS5hdXRoIp4BChNPcGFxdWVTZXNzaW9uUmVjb3JkEgoKAmlkGAEgASgJEhIKCmdlbmVyYXRpb24YAiABKAkSNQoJcHJpbmNpcGFsGAMgASgLMiIuc3BpbmUuYXV0aC5BdXRoZW50aWNhdGVkUHJpbmNpcGFsEjAKDHdoZW5fZXhwaXJlcxgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCE1ABqo0kDXR5cGUuc3BpbmUuaW9iBnByb3RvMw", [file_google_protobuf_timestamp, file_spine_auth_authenticated_principal, file_spine_options]);
+
+/**
+ * Durable state behind one stable opaque-session reference.
+ *
+ * @generated from message spine.auth.OpaqueSessionRecord
+ * Generated from Proto: spine/auth/opaque_session.proto.
+ */
+export type OpaqueSessionRecord = Message<"spine.auth.OpaqueSessionRecord"> & {
+  /**
+   * Stable random session reference used as the storage slot identifier.
+   *
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * Random credential generation changed by each successful rotation.
+   *
+   * @generated from field: string generation = 2;
+   */
+  generation: string;
+
+  /**
+   * Complete authenticated principal, including optional claims presence.
+   *
+   * @generated from field: spine.auth.AuthenticatedPrincipal principal = 3;
+   */
+  principal?: AuthenticatedPrincipal | undefined;
+
+  /**
+   * Exact authoritative application deadline.
+   *
+   * @generated from field: google.protobuf.Timestamp when_expires = 4;
+   */
+  whenExpires?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message spine.auth.OpaqueSessionRecord.
+ * Use `create(OpaqueSessionRecordSchema)` to create a new message.
+ * Generated from Proto: spine/auth/opaque_session.proto.
+ */
+export const OpaqueSessionRecordSchema: GenMessage<OpaqueSessionRecord> = /*@__PURE__*/
+  messageDesc(file_spine_auth_opaque_session, 0);
+

package/generated/spine/auth/token_revocation_pb.ts

@@ -0,0 +1,76 @@
+/*
+ * Generated by Spine TypeScript. Do not edit manually.
+ * Source Proto: spine/auth/token_revocation.proto
+ */
+
+
+
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated from file spine/auth/token_revocation.proto (package spine.auth, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_spine_options } from "../options_pb.js";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file spine/auth/token_revocation.proto.
+ * Generated from Proto: spine/auth/token_revocation.proto.
+ */
+export const file_spine_auth_token_revocation: GenFile = /*@__PURE__*/
+  fileDesc("CiFzcGluZS9hdXRoL3Rva2VuX3Jldm9jYXRpb24ucHJvdG8SCnNwaW5lLmF1dGgigwEKD1Rva2VuUmV2b2NhdGlvbhIKCgJpZBgBIAEoCRIOCgZpc3N1ZXIYAiABKAkSEAoIYXVkaWVuY2UYAyABKAkSEAoIdG9rZW5faWQYBCABKAkSMAoMd2hlbl9leHBpcmVzGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEITUAGqjSQNdHlwZS5zcGluZS5pb2IGcHJvdG8z", [file_google_protobuf_timestamp, file_spine_options]);
+
+/**
+ * One scoped signed-token revocation retained through its last acceptance instant.
+ *
+ * @generated from message spine.auth.TokenRevocation
+ * Generated from Proto: spine/auth/token_revocation.proto.
+ */
+export type TokenRevocation = Message<"spine.auth.TokenRevocation"> & {
+  /**
+   * SHA-256 storage identity of the issuer, audience and token ID tuple.
+   *
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * Exact issuing service identity used to scope the token ID.
+   *
+   * @generated from field: string issuer = 2;
+   */
+  issuer: string;
+
+  /**
+   * Exact intended recipient identity used to scope the token ID.
+   *
+   * @generated from field: string audience = 3;
+   */
+  audience: string;
+
+  /**
+   * Token identifier retained for immediate revocation.
+   *
+   * @generated from field: string token_id = 4;
+   */
+  tokenId: string;
+
+  /**
+   * Inclusive last instant at which the token may still be accepted.
+   *
+   * @generated from field: google.protobuf.Timestamp when_expires = 5;
+   */
+  whenExpires?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message spine.auth.TokenRevocation.
+ * Use `create(TokenRevocationSchema)` to create a new message.
+ * Generated from Proto: spine/auth/token_revocation.proto.
+ */
+export const TokenRevocationSchema: GenMessage<TokenRevocation> = /*@__PURE__*/
+  messageDesc(file_spine_auth_token_revocation, 0);
+

package/generated/spine/client/app_query_pb.ts

@@ -0,0 +1,98 @@
+/*
+ * Generated by Spine TypeScript. Do not edit manually.
+ * Source Proto: spine/client/app_query.proto
+ */
+
+
+
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated from file spine/client/app_query.proto (package spine.client, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import type { Any } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_any } from "@bufbuild/protobuf/wkt";
+import type { QueryId } from "./query_pb.js";
+import { file_spine_client_query } from "./query_pb.js";
+import type { ActorContext } from "../core/actor_context_pb.js";
+import { file_spine_core_actor_context } from "../core/actor_context_pb.js";
+import type { Response } from "../core/response_pb.js";
+import { file_spine_core_response } from "../core/response_pb.js";
+import { file_spine_options } from "../options_pb.js";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file spine/client/app_query.proto.
+ * Generated from Proto: spine/client/app_query.proto.
+ */
+export const file_spine_client_app_query: GenFile = /*@__PURE__*/
+  fileDesc("ChxzcGluZS9jbGllbnQvYXBwX3F1ZXJ5LnByb3RvEgxzcGluZS5jbGllbnQimQEKCEFwcFF1ZXJ5EisKAmlkGAEgASgLMhUuc3BpbmUuY2xpZW50LlF1ZXJ5SWRCCKCFJAHohSQBEisKB21lc3NhZ2UYAiABKAsyFC5nb29nbGUucHJvdG9idWYuQW55QgSghSQBEjMKB2NvbnRleHQYAyABKAsyGC5zcGluZS5jb3JlLkFjdG9yQ29udGV4dEIIoIUkAeiFJAEiZwoQQXBwUXVlcnlSZXNwb25zZRIsCghyZXNwb25zZRgBIAEoCzIULnNwaW5lLmNvcmUuUmVzcG9uc2VCBKCFJAESJQoHbWVzc2FnZRgCIAMoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlCMwoPaW8uc3BpbmUuY2xpZW50Qg1BcHBRdWVyeVByb3RvUAGqjSQNdHlwZS5zcGluZS5pb2IGcHJvdG8z", [file_google_protobuf_any, file_spine_client_query, file_spine_core_actor_context, file_spine_core_response, file_spine_options]);
+
+/**
+ * One application-defined read request.
+ *
+ * @generated from message spine.client.AppQuery
+ * Generated from Proto: spine/client/app_query.proto.
+ */
+export type AppQuery = Message<"spine.client.AppQuery"> & {
+  /**
+   * Identifies this read request for response correlation.
+   *
+   * @generated from field: spine.client.QueryId id = 1;
+   */
+  id?: QueryId | undefined;
+
+  /**
+   * Carries the application-defined Query message.
+   *
+   * @generated from field: google.protobuf.Any message = 2;
+   */
+  message?: Any | undefined;
+
+  /**
+   * Records the actor and time admitted for this request.
+   *
+   * @generated from field: spine.core.ActorContext context = 3;
+   */
+  context?: ActorContext | undefined;
+};
+
+/**
+ * Describes the message spine.client.AppQuery.
+ * Use `create(AppQuerySchema)` to create a new message.
+ * Generated from Proto: spine/client/app_query.proto.
+ */
+export const AppQuerySchema: GenMessage<AppQuery> = /*@__PURE__*/
+  messageDesc(file_spine_client_app_query, 0);
+
+/**
+ * The transport response for an application-defined read.
+ *
+ * @generated from message spine.client.AppQueryResponse
+ * Generated from Proto: spine/client/app_query.proto.
+ */
+export type AppQueryResponse = Message<"spine.client.AppQueryResponse"> & {
+  /**
+   * Reports whether the application read completed or failed.
+   *
+   * @generated from field: spine.core.Response response = 1;
+   */
+  response?: Response | undefined;
+
+  /**
+   * Contains the paired application Response after a successful read.
+   *
+   * @generated from field: repeated google.protobuf.Any message = 2;
+   */
+  message: Any[];
+};
+
+/**
+ * Describes the message spine.client.AppQueryResponse.
+ * Use `create(AppQueryResponseSchema)` to create a new message.
+ * Generated from Proto: spine/client/app_query.proto.
+ */
+export const AppQueryResponseSchema: GenMessage<AppQueryResponse> = /*@__PURE__*/
+  messageDesc(file_spine_client_app_query, 1);
+

package/generated/spine/client/filters_pb.ts

@@ -23,7 +23,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Generated from Proto: spine/client/filters.proto.
  */
 export const file_spine_client_filters: GenFile = /*@__PURE__*/
-  fileDesc("ChpzcGluZS9jbGllbnQvZmlsdGVycy5wcm90bxIMc3BpbmUuY2xpZW50IpEBCgZUYXJnZXQSEgoEdHlwZRgBIAEoCUIEoIUkARIVCgtpbmNsdWRlX2FsbBgCIAEoCEgAEjQKB2ZpbHRlcnMYAyABKAsyGy5zcGluZS5jbGllbnQuVGFyZ2V0RmlsdGVyc0IE6IUkAUgAOhHaiyQNCgtUYXJnZXRNaXhpbkITCgljcml0ZXJpb24SBqKKJAIIASKLAQoNVGFyZ2V0RmlsdGVycxIvCglpZF9maWx0ZXIYASABKAsyFi5zcGluZS5jbGllbnQuSWRGaWx0ZXJCBOiFJAESMwoGZmlsdGVyGAIgAygLMh0uc3BpbmUuY2xpZW50LkNvbXBvc2l0ZUZpbHRlckIE6IUkAToU8ookEGlkX2ZpbHRlcnxmaWx0ZXIioQIKD0NvbXBvc2l0ZUZpbHRlchIqCgZmaWx0ZXIYASADKAsyFC5zcGluZS5jbGllbnQuRmlsdGVyQgTohSQBEkcKCG9wZXJhdG9yGAIgASgOMi8uc3BpbmUuY2xpZW50LkNvbXBvc2l0ZUZpbHRlci5Db21wb3NpdGVPcGVyYXRvckIEoIUkARI9ChBjb21wb3NpdGVfZmlsdGVyGAMgAygLMh0uc3BpbmUuY2xpZW50LkNvbXBvc2l0ZUZpbHRlckIE6IUkASI+ChFDb21wb3NpdGVPcGVyYXRvchIUChBDQ0ZfQ09fVU5ERUZJTkVEEAASBwoDQUxMEAESCgoGRUlUSEVSEAI6GtqLJBYKFENvbXBvc2l0ZUZpbHRlck1peGluIqICCgZGaWx0ZXISLwoKZmllbGRfcGF0aBgBIAEoCzIVLnNwaW5lLmJhc2UuRmllbGRQYXRoQgSghSQBEikKBXZhbHVlGAIgASgLMhQuZ29vZ2xlLnByb3RvYnVmLkFueUIEoIUkARI1CghvcGVyYXRvchgDIAEoDjIdLnNwaW5lLmNsaWVudC5GaWx0ZXIuT3BlcmF0b3JCBKCFJAEicgoIT3BlcmF0b3ISEQoNQ0ZPX1VOREVGSU5FRBAAEgkKBUVRVUFMEAESEAoMR1JFQVRFUl9USEFOEAISDQoJTEVTU19USEFOEAQSFAoQR1JFQVRFUl9PUl9FUVVBTBAFEhEKDUxFU1NfT1JfRVFVQUwQBjoR2oskDQoLRmlsdGVyTWl4aW4iNgoISWRGaWx0ZXISKgoCaWQYASADKAsyFC5nb29nbGUucHJvdG9idWYuQW55QgighSQB6IUkAUIyCg9pby5zcGluZS5jbGllbnRCDEZpbHRlcnNQcm90b1ABqo0kDXR5cGUuc3BpbmUuaW9iBnByb3RvMw", [file_spine_options, file_google_protobuf_any, file_spine_base_field_path]);
+  fileDesc("ChpzcGluZS9jbGllbnQvZmlsdGVycy5wcm90bxIMc3BpbmUuY2xpZW50IpEBCgZUYXJnZXQSEgoEdHlwZRgBIAEoCUIEoIUkARIVCgtpbmNsdWRlX2FsbBgCIAEoCEgAEjQKB2ZpbHRlcnMYAyABKAsyGy5zcGluZS5jbGllbnQuVGFyZ2V0RmlsdGVyc0IE6IUkAUgAOhHaiyQNCgtUYXJnZXRNaXhpbkITCgljcml0ZXJpb24SBqKKJAIIASKNAQoNVGFyZ2V0RmlsdGVycxIvCglpZF9maWx0ZXIYASABKAsyFi5zcGluZS5jbGllbnQuSWRGaWx0ZXJCBOiFJAESMwoGZmlsdGVyGAIgAygLMh0uc3BpbmUuY2xpZW50LkNvbXBvc2l0ZUZpbHRlckIE6IUkAToWoowkEgoQaWRfZmlsdGVyfGZpbHRlciKhAgoPQ29tcG9zaXRlRmlsdGVyEioKBmZpbHRlchgBIAMoCzIULnNwaW5lLmNsaWVudC5GaWx0ZXJCBOiFJAESRwoIb3BlcmF0b3IYAiABKA4yLy5zcGluZS5jbGllbnQuQ29tcG9zaXRlRmlsdGVyLkNvbXBvc2l0ZU9wZXJhdG9yQgSghSQBEj0KEGNvbXBvc2l0ZV9maWx0ZXIYAyADKAsyHS5zcGluZS5jbGllbnQuQ29tcG9zaXRlRmlsdGVyQgTohSQBIj4KEUNvbXBvc2l0ZU9wZXJhdG9yEhQKEENDRl9DT19VTkRFRklORUQQABIHCgNBTEwQARIKCgZFSVRIRVIQAjoa2oskFgoUQ29tcG9zaXRlRmlsdGVyTWl4aW4iogIKBkZpbHRlchIvCgpmaWVsZF9wYXRoGAEgASgLMhUuc3BpbmUuYmFzZS5GaWVsZFBhdGhCBKCFJAESKQoFdmFsdWUYAiABKAsyFC5nb29nbGUucHJvdG9idWYuQW55QgSghSQBEjUKCG9wZXJhdG9yGAMgASgOMh0uc3BpbmUuY2xpZW50LkZpbHRlci5PcGVyYXRvckIEoIUkASJyCghPcGVyYXRvchIRCg1DRk9fVU5ERUZJTkVEEAASCQoFRVFVQUwQARIQCgxHUkVBVEVSX1RIQU4QAhINCglMRVNTX1RIQU4QBBIUChBHUkVBVEVSX09SX0VRVUFMEAUSEQoNTEVTU19PUl9FUVVBTBAGOhHaiyQNCgtGaWx0ZXJNaXhpbiI2CghJZEZpbHRlchIqCgJpZBgBIAMoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnlCCKCFJAHohSQBQjIKD2lvLnNwaW5lLmNsaWVudEIMRmlsdGVyc1Byb3RvUAGqjSQNdHlwZS5zcGluZS5pb2IGcHJvdG8z", [file_spine_options, file_google_protobuf_any, file_spine_base_field_path]);
 
 /**
  * Defines the target type and filters.

package/generated/spine/client/query_service_pb.ts

@@ -14,6 +14,8 @@ import { fileDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
 import { file_spine_options } from "../options_pb.js";
 import type { QueryResponseSchema, QuerySchema } from "./query_pb.js";
 import { file_spine_client_query } from "./query_pb.js";
+import type { AppQueryResponseSchema, AppQuerySchema } from "./app_query_pb.js";
+import { file_spine_client_app_query } from "./app_query_pb.js";
 import { file_google_protobuf_type } from "@bufbuild/protobuf/wkt";
 
 /**
@@ -21,7 +23,7 @@ import { file_google_protobuf_type } from "@bufbuild/protobuf/wkt";
  * Generated from Proto: spine/client/query_service.proto.
  */
 export const file_spine_client_query_service: GenFile = /*@__PURE__*/
-  fileDesc("CiBzcGluZS9jbGllbnQvcXVlcnlfc2VydmljZS5wcm90bxIMc3BpbmUuY2xpZW50MkgKDFF1ZXJ5U2VydmljZRI4CgRSZWFkEhMuc3BpbmUuY2xpZW50LlF1ZXJ5Ghsuc3BpbmUuY2xpZW50LlF1ZXJ5UmVzcG9uc2VCPAoUaW8uc3BpbmUuY2xpZW50LmdycGNCEVF1ZXJ5U2VydmljZVByb3RvUAGqjSQNdHlwZS5zcGluZS5pb2IGcHJvdG8z", [file_spine_options, file_spine_client_query, file_google_protobuf_type]);
+  fileDesc("CiBzcGluZS9jbGllbnQvcXVlcnlfc2VydmljZS5wcm90bxIMc3BpbmUuY2xpZW50MosBCgxRdWVyeVNlcnZpY2USOAoEUmVhZBITLnNwaW5lLmNsaWVudC5RdWVyeRobLnNwaW5lLmNsaWVudC5RdWVyeVJlc3BvbnNlEkEKB0V4ZWN1dGUSFi5zcGluZS5jbGllbnQuQXBwUXVlcnkaHi5zcGluZS5jbGllbnQuQXBwUXVlcnlSZXNwb25zZUI8ChRpby5zcGluZS5jbGllbnQuZ3JwY0IRUXVlcnlTZXJ2aWNlUHJvdG9QAaqNJA10eXBlLnNwaW5lLmlvYgZwcm90bzM", [file_spine_options, file_spine_client_query, file_spine_client_app_query, file_google_protobuf_type]);
 
 /**
  * A service for querying the read-side from clients.
@@ -40,6 +42,16 @@ export const QueryService: GenService<{
     input: typeof QuerySchema;
     output: typeof QueryResponseSchema;
   },
+  /**
+   * Executes an application-defined Query and returns its paired Response.
+   *
+   * @generated from rpc spine.client.QueryService.Execute
+   */
+  execute: {
+    methodKind: "unary";
+    input: typeof AppQuerySchema;
+    output: typeof AppQueryResponseSchema;
+  },
 }> = /*@__PURE__*/
   serviceDesc(file_spine_client_query_service, 0);
 

package/generated/spine/client/subscription_record_pb.ts

@@ -11,8 +11,8 @@
 
 import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
 import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
-import type { Timestamp } from "@bufbuild/protobuf/wkt";
-import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Empty, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_empty, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 import type { Subscription, SubscriptionId } from "./subscription_pb.js";
 import { file_spine_client_subscription } from "./subscription_pb.js";
 import { file_spine_options } from "../options_pb.js";
@@ -23,7 +23,46 @@ import type { Message } from "@bufbuild/protobuf";
  * Generated from Proto: spine/client/subscription_record.proto.
  */
 export const file_spine_client_subscription_record: GenFile = /*@__PURE__*/
-  fileDesc("CiZzcGluZS9jbGllbnQvc3Vic2NyaXB0aW9uX3JlY29yZC5wcm90bxIMc3BpbmUuY2xpZW50IrECChJTdWJzY3JpcHRpb25SZWNvcmQSMgoCaWQYASABKAsyHC5zcGluZS5jbGllbnQuU3Vic2NyaXB0aW9uSWRCCKCFJAHohSQBEjoKDHN1YnNjcmlwdGlvbhgCIAEoCzIaLnNwaW5lLmNsaWVudC5TdWJzY3JpcHRpb25CCKCFJAHohSQBEjYKBnN0YXR1cxgDIAEoDjIgLnNwaW5lLmNsaWVudC5TdWJzY3JpcHRpb25TdGF0dXNCBKCFJAESNgoMd2hlbl9jcmVhdGVkGAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEIEoIUkARI7Chd3aGVuX2FjdGl2YXRpb25fZXhwaXJlcxgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAqQQoSU3Vic2NyaXB0aW9uU3RhdHVzEhIKDlNTX1VOU1BFQ0lGSUVEEAASCwoHUEVORElORxABEgoKBkFDVElWRRACQhNQAaqNJA10eXBlLnNwaW5lLmlvYgZwcm90bzM", [file_google_protobuf_timestamp, file_spine_client_subscription, file_spine_options]);
+  fileDesc("CiZzcGluZS9jbGllbnQvc3Vic2NyaXB0aW9uX3JlY29yZC5wcm90bxIMc3BpbmUuY2xpZW50ImwKGVN1YnNjcmlwdGlvblJlYWRlckJpbmRpbmcSFgoMcHJpbmNpcGFsX2lkGAEgASgJSAASKwoJYW5vbnltb3VzGAIgASgLMhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5SABCCgoIaWRlbnRpdHki6gIKElN1YnNjcmlwdGlvblJlY29yZBIyCgJpZBgBIAEoCzIcLnNwaW5lLmNsaWVudC5TdWJzY3JpcHRpb25JZEIIoIUkAeiFJAESOgoMc3Vic2NyaXB0aW9uGAIgASgLMhouc3BpbmUuY2xpZW50LlN1YnNjcmlwdGlvbkIIoIUkAeiFJAESNgoGc3RhdHVzGAMgASgOMiAuc3BpbmUuY2xpZW50LlN1YnNjcmlwdGlvblN0YXR1c0IEoIUkARI2Cgx3aGVuX2NyZWF0ZWQYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgSghSQBEjsKF3doZW5fYWN0aXZhdGlvbl9leHBpcmVzGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI3CgZyZWFkZXIYBiABKAsyJy5zcGluZS5jbGllbnQuU3Vic2NyaXB0aW9uUmVhZGVyQmluZGluZypBChJTdWJzY3JpcHRpb25TdGF0dXMSEgoOU1NfVU5TUEVDSUZJRUQQABILCgdQRU5ESU5HEAESCgoGQUNUSVZFEAJCE1ABqo0kDXR5cGUuc3BpbmUuaW9iBnByb3RvMw", [file_google_protobuf_empty, file_google_protobuf_timestamp, file_spine_client_subscription, file_spine_options]);
+
+/**
+ * Stable verified reader identity retained with a subscription definition.
+ *
+ * @generated from message spine.client.SubscriptionReaderBinding
+ * Generated from Proto: spine/client/subscription_record.proto.
+ */
+export type SubscriptionReaderBinding = Message<"spine.client.SubscriptionReaderBinding"> & {
+  /**
+   * Exactly one admitted reader identity; absence cannot establish reader access.
+   *
+   * @generated from oneof spine.client.SubscriptionReaderBinding.identity
+   */
+  identity: {
+    /**
+     * Application-authenticated principal ID, never ActorContext or provider credentials.
+     *
+     * @generated from field: string principal_id = 1;
+     */
+    value: string;
+    case: "principalId";
+  } | {
+    /**
+     * Explicit admission without a principal or provider authority facts.
+     *
+     * @generated from field: google.protobuf.Empty anonymous = 2;
+     */
+    value: Empty;
+    case: "anonymous";
+  } | { case: undefined; value?: undefined };
+};
+
+/**
+ * Describes the message spine.client.SubscriptionReaderBinding.
+ * Use `create(SubscriptionReaderBindingSchema)` to create a new message.
+ * Generated from Proto: spine/client/subscription_record.proto.
+ */
+export const SubscriptionReaderBindingSchema: GenMessage<SubscriptionReaderBinding> = /*@__PURE__*/
+  messageDesc(file_spine_client_subscription_record, 0);
 
 /**
  * A stored definition of one subscription.
@@ -66,6 +105,13 @@ export type SubscriptionRecord = Message<"spine.client.SubscriptionRecord"> & {
    * @generated from field: google.protobuf.Timestamp when_activation_expires = 5;
    */
   whenActivationExpires?: Timestamp | undefined;
+
+  /**
+   * Stable reader identity admitted when this definition was created.
+   *
+   * @generated from field: spine.client.SubscriptionReaderBinding reader = 6;
+   */
+  reader?: SubscriptionReaderBinding | undefined;
 };
 
 /**
@@ -74,7 +120,7 @@ export type SubscriptionRecord = Message<"spine.client.SubscriptionRecord"> & {
  * Generated from Proto: spine/client/subscription_record.proto.
  */
 export const SubscriptionRecordSchema: GenMessage<SubscriptionRecord> = /*@__PURE__*/
-  messageDesc(file_spine_client_subscription_record, 0);
+  messageDesc(file_spine_client_subscription_record, 1);
 
 /**
  * A lifecycle status of a stored subscription.

package/generated/spine/server/tenant/tenant_pb.ts

@@ -0,0 +1,57 @@
+/*
+ * Generated by Spine TypeScript. Do not edit manually.
+ * Source Proto: spine/server/tenant/tenant.proto
+ */
+
+
+
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated from file spine/server/tenant/tenant.proto (package spine.server.tenant, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { TenantId } from "../../core/tenant_id_pb.js";
+import { file_spine_core_tenant_id } from "../../core/tenant_id_pb.js";
+import { file_spine_options } from "../../options_pb.js";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file spine/server/tenant/tenant.proto.
+ * Generated from Proto: spine/server/tenant/tenant.proto.
+ */
+export const file_spine_server_tenant_tenant: GenFile = /*@__PURE__*/
+  fileDesc("CiBzcGluZS9zZXJ2ZXIvdGVuYW50L3RlbmFudC5wcm90bxITc3BpbmUuc2VydmVyLnRlbmFudCJoCgZUZW5hbnQSJgoCaWQYASABKAsyFC5zcGluZS5jb3JlLlRlbmFudElkQgSghSQBEjYKDHdoZW5fY3JlYXRlZBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCBKCFJAFCEaqNJA10eXBlLnNwaW5lLmlvYgZwcm90bzM", [file_google_protobuf_timestamp, file_spine_core_tenant_id, file_spine_options]);
+
+/**
+ * A tenant registered in the application directory.
+ *
+ * @generated from message spine.server.tenant.Tenant
+ * Generated from Proto: spine/server/tenant/tenant.proto.
+ */
+export type Tenant = Message<"spine.server.tenant.Tenant"> & {
+  /**
+   * Complete application tenant identity.
+   *
+   * @generated from field: spine.core.TenantId id = 1;
+   */
+  id?: TenantId | undefined;
+
+  /**
+   * The time of the first successful registration.
+   *
+   * @generated from field: google.protobuf.Timestamp when_created = 2;
+   */
+  whenCreated?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message spine.server.tenant.Tenant.
+ * Use `create(TenantSchema)` to create a new message.
+ * Generated from Proto: spine/server/tenant/tenant.proto.
+ */
+export const TenantSchema: GenMessage<Tenant> = /*@__PURE__*/
+  messageDesc(file_spine_server_tenant_tenant, 0);
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spine-event-engine/proto",
-  "version": "2.0.0-snapshot.25",
+  "version": "2.0.0-snapshot.28",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {