@spine-event-engine/proto 2.0.0-snapshot.25 → 2.0.0-snapshot.28

package/proto/spine/auth/authenticated_principal.proto

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+syntax = "proto3";
+
+package spine.auth;
+
+import "spine/options.proto";
+
+option java_multiple_files = true;
+option (type_url_prefix) = "type.spine.io";
+
+// A complete authenticated identity used by application session and grant records.
+message AuthenticatedPrincipal {
+  // The application principal identifier.
+  string id = 1;
+
+  // Optional claims; an empty present message differs from absent claims.
+  PrincipalAttributes attributes = 2;
+}
+
+// Application-defined string claims with explicit message presence.
+message PrincipalAttributes {
+  // Claim names and their values.
+  map<string, string> values = 1;
+}

package/proto/spine/auth/authenticated_subscription.proto

@@ -17,20 +17,29 @@ package spine.auth;
 
 import "google/protobuf/timestamp.proto";
 import "spine/client/subscription.proto";
+import "spine/client/subscription_record.proto";
 import "spine/options.proto";
 
-option (type_url_prefix) = "type.spine.io";
 option java_multiple_files = true;
+option (type_url_prefix) = "type.spine.io";
 
 // A subscription accepted through an authenticated Gateway request.
 message GatewayAuthenticatedSubscription {
+  // The identifier used to store this record.
+  spine.client.SubscriptionId id = 1 [
+    (required) = true,
+    (validate) = true
+  ];
 
-    // The identifier used to store this record.
-    spine.client.SubscriptionId id = 1 [(required) = true, (validate) = true];
+  // The authenticated subscription, including its Actor and Tenant context.
+  spine.client.Subscription subscription = 2 [
+    (required) = true,
+    (validate) = true
+  ];
 
-    // The authenticated subscription, including its Actor and Tenant context.
-    spine.client.Subscription subscription = 2 [(required) = true, (validate) = true];
+  // The time after which the authenticated subscription is no longer valid.
+  google.protobuf.Timestamp when_expires = 3 [(required) = true];
 
-    // The time after which the authenticated subscription is no longer valid.
-    google.protobuf.Timestamp when_expires = 3 [(required) = true];
+  // Verified reader identity required to reuse this subscription.
+  spine.client.SubscriptionReaderBinding reader = 4;
 }

package/proto/spine/auth/oidc_flow.proto

@@ -0,0 +1,77 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+syntax = "proto3";
+
+package spine.auth;
+
+import "google/protobuf/timestamp.proto";
+import "spine/auth/authenticated_principal.proto";
+import "spine/options.proto";
+
+option java_multiple_files = true;
+option (type_url_prefix) = "type.spine.io";
+
+// One flow-qualified authorization-code transaction, consumed before provider exchange.
+message OidcLoginTransaction {
+  // SHA-256 lookup digest bound to the flow and browser state.
+  string lookup_digest = 1;
+
+  // Application-selected identity of the login flow.
+  string flow_id = 2;
+
+  // Trusted issuer selected when the flow was started.
+  string provider_issuer = 3;
+
+  // OAuth client configured for the provider exchange.
+  string client_id = 4;
+
+  // Exact registered callback URI, including static query parameters.
+  string callback_uri = 5;
+
+  // Random nonce expected in the verified ID token.
+  string nonce = 6;
+
+  // Provider PKCE verifier retained only until callback consumption.
+  string provider_code_verifier = 7;
+
+  // Browser PKCE challenge required before application-session issuance.
+  string browser_code_challenge = 8;
+
+  // Application redirect selected from the flow allowlist.
+  string post_login_redirect = 9;
+
+  // Exact deadline for accepting the callback.
+  google.protobuf.Timestamp when_expires = 10;
+}
+
+// One flow-qualified application grant, consumed before session issuance.
+message OidcLoginGrant {
+  // SHA-256 lookup digest bound to the flow and random grant.
+  string lookup_digest = 1;
+
+  // Application-selected identity of the login flow.
+  string flow_id = 2;
+
+  // Complete mapped principal with optional attributes presence.
+  AuthenticatedPrincipal principal = 3;
+
+  // Browser PKCE challenge copied from the consumed transaction.
+  string browser_code_challenge = 4;
+
+  // Allowlisted application redirect from the consumed transaction.
+  string post_login_redirect = 5;
+
+  // Exact deadline for exchanging the application grant.
+  google.protobuf.Timestamp when_expires = 6;
+}

package/proto/spine/auth/opaque_session.proto

@@ -0,0 +1,38 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+syntax = "proto3";
+
+package spine.auth;
+
+import "google/protobuf/timestamp.proto";
+import "spine/auth/authenticated_principal.proto";
+import "spine/options.proto";
+
+option java_multiple_files = true;
+option (type_url_prefix) = "type.spine.io";
+
+// Durable state behind one stable opaque-session reference.
+message OpaqueSessionRecord {
+  // Stable random session reference used as the storage slot identifier.
+  string id = 1;
+
+  // Random credential generation changed by each successful rotation.
+  string generation = 2;
+
+  // Complete authenticated principal, including optional claims presence.
+  AuthenticatedPrincipal principal = 3;
+
+  // Exact authoritative application deadline.
+  google.protobuf.Timestamp when_expires = 4;
+}

package/proto/spine/auth/token_revocation.proto

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+syntax = "proto3";
+
+package spine.auth;
+
+import "google/protobuf/timestamp.proto";
+import "spine/options.proto";
+
+option java_multiple_files = true;
+option (type_url_prefix) = "type.spine.io";
+
+// One scoped signed-token revocation retained through its last acceptance instant.
+message TokenRevocation {
+  // SHA-256 storage identity of the issuer, audience and token ID tuple.
+  string id = 1;
+
+  // Exact issuing service identity used to scope the token ID.
+  string issuer = 2;
+
+  // Exact intended recipient identity used to scope the token ID.
+  string audience = 3;
+
+  // Token identifier retained for immediate revocation.
+  string token_id = 4;
+
+  // Inclusive last instant at which the token may still be accepted.
+  google.protobuf.Timestamp when_expires = 5;
+}

package/proto/spine/client/app_query.proto

@@ -0,0 +1,55 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+syntax = "proto3";
+
+package spine.client;
+
+import "google/protobuf/any.proto";
+import "spine/client/query.proto";
+import "spine/core/actor_context.proto";
+import "spine/core/response.proto";
+import "spine/options.proto";
+
+option java_multiple_files = true;
+option java_outer_classname = "AppQueryProto";
+option java_package = "io.spine.client";
+option (type_url_prefix) = "type.spine.io";
+
+// One application-defined read request.
+message AppQuery {
+  // Identifies this read request for response correlation.
+  QueryId id = 1 [
+    (required) = true,
+    (validate) = true
+  ];
+
+  // Carries the application-defined Query message.
+  google.protobuf.Any message = 2 [(required) = true];
+
+  // Records the actor and time admitted for this request.
+  spine.core.ActorContext context = 3 [
+    (required) = true,
+    (validate) = true
+  ];
+}
+
+// The transport response for an application-defined read.
+message AppQueryResponse {
+  // Reports whether the application read completed or failed.
+  spine.core.Response response = 1 [(required) = true];
+
+  // Contains the paired application Response after a successful read.
+  repeated google.protobuf.Any message = 2;
+}

package/proto/spine/client/filters.proto

@@ -72,7 +72,7 @@ message Target {
 
 // The set of filters to narrow down the query results/subscription updates.
 message TargetFilters {
-    option (required_field) = "id_filter|filter";
+    option (require).fields = "id_filter|filter";
 
     // Match objects by their IDs.
     IdFilter id_filter = 1 [(validate) = true];

package/proto/spine/client/query_service.proto

@@ -36,6 +36,7 @@ option java_multiple_files = true;
 option java_outer_classname = "QueryServiceProto";
 
 import "spine/client/query.proto";
+import "spine/client/app_query.proto";
 import "google/protobuf/type.proto";
 
 // A service for querying the read-side from clients.
@@ -43,4 +44,7 @@ service QueryService {
 
     // Reads certain data from the read-side by setting the criteria via Query.
     rpc Read(Query) returns (QueryResponse);
+
+    // Executes an application-defined Query and returns its paired Response.
+    rpc Execute(AppQuery) returns (AppQueryResponse);
 }

package/proto/spine/client/subscription_record.proto

@@ -15,41 +15,61 @@ syntax = "proto3";
 
 package spine.client;
 
+import "google/protobuf/empty.proto";
 import "google/protobuf/timestamp.proto";
 import "spine/client/subscription.proto";
 import "spine/options.proto";
 
-option (type_url_prefix) = "type.spine.io";
 option java_multiple_files = true;
+option (type_url_prefix) = "type.spine.io";
 
 // A lifecycle status of a stored subscription.
 enum SubscriptionStatus {
+  // An unspecified status.
+  SS_UNSPECIFIED = 0;
 
-    // An unspecified status.
-    SS_UNSPECIFIED = 0;
+  // A subscription that is waiting for activation.
+  PENDING = 1;
+
+  // A subscription that delivers matching updates.
+  ACTIVE = 2;
+}
 
-    // A subscription that is waiting for activation.
-    PENDING = 1;
+// Stable verified reader identity retained with a subscription definition.
+message SubscriptionReaderBinding {
+  // Exactly one admitted reader identity; absence cannot establish reader access.
+  oneof identity {
+    // Application-authenticated principal ID, never ActorContext or provider credentials.
+    string principal_id = 1;
 
-    // A subscription that delivers matching updates.
-    ACTIVE = 2;
+    // Explicit admission without a principal or provider authority facts.
+    google.protobuf.Empty anonymous = 2;
+  }
 }
 
 // A stored definition of one subscription.
 message SubscriptionRecord {
+  // The identifier used to store this record.
+  SubscriptionId id = 1 [
+    (required) = true,
+    (validate) = true
+  ];
 
-    // The identifier used to store this record.
-    SubscriptionId id = 1 [(required) = true, (validate) = true];
+  // The subscription represented by this record.
+  Subscription subscription = 2 [
+    (required) = true,
+    (validate) = true
+  ];
 
-    // The subscription represented by this record.
-    Subscription subscription = 2 [(required) = true, (validate) = true];
+  // The current lifecycle status.
+  SubscriptionStatus status = 3 [(required) = true];
 
-    // The current lifecycle status.
-    SubscriptionStatus status = 3 [(required) = true];
+  // The time when the subscription was created.
+  google.protobuf.Timestamp when_created = 4 [(required) = true];
 
-    // The time when the subscription was created.
-    google.protobuf.Timestamp when_created = 4 [(required) = true];
+  // The deadline for activating a pending subscription.
+  google.protobuf.Timestamp when_activation_expires = 5;
 
-    // The deadline for activating a pending subscription.
-    google.protobuf.Timestamp when_activation_expires = 5;
+  // Stable reader identity admitted when this definition was created.
+  SubscriptionReaderBinding reader = 6;
 }

package/proto/spine/server/tenant/tenant.proto

@@ -0,0 +1,31 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+syntax = "proto3";
+
+package spine.server.tenant;
+
+import "google/protobuf/timestamp.proto";
+import "spine/core/tenant_id.proto";
+import "spine/options.proto";
+
+option (type_url_prefix) = "type.spine.io";
+
+// A tenant registered in the application directory.
+message Tenant {
+  // Complete application tenant identity.
+  spine.core.TenantId id = 1 [(required) = true];
+
+  // The time of the first successful registration.
+  google.protobuf.Timestamp when_created = 2 [(required) = true];
+}

package/proto/spine-sources.json

@@ -54,7 +54,11 @@
       "upstreamPath": "client/src/main/proto/spine/client/filters.proto",
       "sourceUrl": "https://github.com/SpineEventEngine/core-java/blob/a408b0d70dafd603efc55b89c8b4b6f3e8c19d3b/client/src/main/proto/spine/client/filters.proto",
       "rawUrl": "https://raw.githubusercontent.com/SpineEventEngine/core-java/a408b0d70dafd603efc55b89c8b4b6f3e8c19d3b/client/src/main/proto/spine/client/filters.proto",
-      "sha256": "e2b4eef3d4e873cb5f0bc80896c19e538442182cddb54fa796d0ec640dcca6a5"
+      "sha256": "e2b4eef3d4e873cb5f0bc80896c19e538442182cddb54fa796d0ec640dcca6a5",
+      "localAdaptation": {
+        "kind": "target-filters-require",
+        "sha256": "6655d6d56b5e42d4e38bd630970aa2b43e52a1589dbbaed1c0d6ea4304adcc9e"
+      }
     },
     {
       "localPath": "packages/proto/proto/spine/client/query_service.proto",
@@ -63,7 +67,11 @@
       "upstreamPath": "client/src/main/proto/spine/client/query_service.proto",
       "sourceUrl": "https://github.com/SpineEventEngine/core-java/blob/a408b0d70dafd603efc55b89c8b4b6f3e8c19d3b/client/src/main/proto/spine/client/query_service.proto",
       "rawUrl": "https://raw.githubusercontent.com/SpineEventEngine/core-java/a408b0d70dafd603efc55b89c8b4b6f3e8c19d3b/client/src/main/proto/spine/client/query_service.proto",
-      "sha256": "8ad31ac9e18d17c38ed3419f80210f60e7d1b4b1bfc94f0949ba993e19934f41"
+      "sha256": "8ad31ac9e18d17c38ed3419f80210f60e7d1b4b1bfc94f0949ba993e19934f41",
+      "localAdaptation": {
+        "kind": "query-service-execute",
+        "sha256": "af2ad517cb1db9b415390e56573d553a040f3ce62a0fe12c13f535d363ad8636"
+      }
     },
     {
       "localPath": "packages/proto/proto/spine/client/query.proto",
@@ -419,25 +427,45 @@
   ],
   "ownedSources": [
     {
-      "localPath": "packages/proto/proto/spine/server/agent/acceptance_receipt.proto",
-      "sha256": "daa0f8e724849523cb539b9b6a7503aa8eab0de3f23d926d1aa9d117bd44f007"
+      "localPath": "packages/proto/proto/spine/auth/authenticated_principal.proto",
+      "sha256": "09a4c8d755293fd522e1ff4c8305d49ef6bdb681e0de6a4e1bf311db1c9412db"
     },
     {
       "localPath": "packages/proto/proto/spine/auth/authenticated_subscription.proto",
-      "sha256": "b6436714f754e6d7c1a6bbd177c5a4f0b606d3c7c1adc4b86fa3c299210ffc76"
+      "sha256": "da3f4c1ff9a0b968bfed0193c8b43deb0bfd71d126b375ab8832532625d15553"
     },
     {
       "localPath": "packages/proto/proto/spine/auth/authentication_service.proto",
       "sha256": "dcd178e057a13d4d044ac9fb1ba487b5a27203b0686191d5955ee928852822d7"
     },
+    {
+      "localPath": "packages/proto/proto/spine/auth/oidc_flow.proto",
+      "sha256": "30f35a0b3cc4f3e84b91af49b632ad71067e54ac34b618cfdaca0c6ab509c07a"
+    },
+    {
+      "localPath": "packages/proto/proto/spine/auth/opaque_session.proto",
+      "sha256": "04aa832423e9595cdaa73e0689276803ff749e56d4a8d963f30729fa8780dfe6"
+    },
+    {
+      "localPath": "packages/proto/proto/spine/auth/token_revocation.proto",
+      "sha256": "a13278fd19469a5e3cd542edf29ba7015570d4dc03e176ab2a365485b4e9982c"
+    },
+    {
+      "localPath": "packages/proto/proto/spine/client/app_query.proto",
+      "sha256": "b5b334232dc724f7de606e6655aefde7856a8be1e9742311aa3c23a3ae206140"
+    },
     {
       "localPath": "packages/proto/proto/spine/client/subscription_record.proto",
-      "sha256": "4e760681afba8d531b00ae08f09e52fb298c969e24aeb830fc72d7292afedaf5"
+      "sha256": "614caf2608bf3fc36a419f887305ae6b7b1cfad657800b5bc3a5d886d396bd86"
     },
     {
       "localPath": "packages/proto/proto/spine/deployment/node_discovery.proto",
       "sha256": "7c300d215a1757c17b7bd1a89cebb4825df28a58fcc119f2aa6d5535d7520073"
     },
+    {
+      "localPath": "packages/proto/proto/spine/server/agent/acceptance_receipt.proto",
+      "sha256": "daa0f8e724849523cb539b9b6a7503aa8eab0de3f23d926d1aa9d117bd44f007"
+    },
     {
       "localPath": "packages/proto/proto/spine/server/agent/history_record.proto",
       "sha256": "24ed282bc0cd901a3b38748ea7b516e972a87b2a7f69db99a2b094458d48e38a"
@@ -446,6 +474,10 @@
       "localPath": "packages/proto/proto/spine/server/agent/model_preferences_record.proto",
       "sha256": "33b7f805be70c5435b6d2f7ef558e0fab5dfed34a699ce87734f3c9b2b6f00d5"
     },
+    {
+      "localPath": "packages/proto/proto/spine/server/tenant/tenant.proto",
+      "sha256": "f6d2785fd6dbeed03d40fcef4aec294e82df3557bac3d7e63c75d6344847462a"
+    },
     {
       "localPath": "packages/proto/proto/spine/ts/agent/content.proto",
       "sha256": "f4242677c02f546724dbffe9dabb93bdf8d5a63f8d3357e91fab3765e41e058a"

package/spine-proto-manifest.json

@@ -1,13 +1,18 @@
 {
   "formatVersion": 2,
   "packageName": "@spine-event-engine/proto",
-  "packageVersion": "2.0.0-snapshot.25",
+  "packageVersion": "2.0.0-snapshot.28",
   "protoFiles": [
     "grpc/health/v1/health.proto",
+    "spine/auth/authenticated_principal.proto",
     "spine/auth/authenticated_subscription.proto",
     "spine/auth/authentication_service.proto",
+    "spine/auth/oidc_flow.proto",
+    "spine/auth/opaque_session.proto",
+    "spine/auth/token_revocation.proto",
     "spine/base/error.proto",
     "spine/base/field_path.proto",
+    "spine/client/app_query.proto",
     "spine/client/command_service.proto",
     "spine/client/entities.proto",
     "spine/client/filters.proto",
@@ -48,6 +53,7 @@
     "spine/server/entity/state_key.proto",
     "spine/server/integration/broker.proto",
     "spine/server/server_environment.proto",
+    "spine/server/tenant/tenant.proto",
     "spine/server/transport/transport.proto",
     "spine/string/template_string.proto",
     "spine/system/server/entity_log_events.proto",
@@ -63,10 +69,15 @@
   ],
   "generatedExports": {
     "grpc/health/v1/health.proto": "generated/grpc/health/v1/health_pb.js",
+    "spine/auth/authenticated_principal.proto": "generated/spine/auth/authenticated_principal_pb.js",
     "spine/auth/authenticated_subscription.proto": "generated/spine/auth/authenticated_subscription_pb.js",
     "spine/auth/authentication_service.proto": "generated/spine/auth/authentication_service_pb.js",
+    "spine/auth/oidc_flow.proto": "generated/spine/auth/oidc_flow_pb.js",
+    "spine/auth/opaque_session.proto": "generated/spine/auth/opaque_session_pb.js",
+    "spine/auth/token_revocation.proto": "generated/spine/auth/token_revocation_pb.js",
     "spine/base/error.proto": "generated/spine/base/error_pb.js",
     "spine/base/field_path.proto": "generated/spine/base/field_path_pb.js",
+    "spine/client/app_query.proto": "generated/spine/client/app_query_pb.js",
     "spine/client/command_service.proto": "generated/spine/client/command_service_pb.js",
     "spine/client/entities.proto": "generated/spine/client/entities_pb.js",
     "spine/client/filters.proto": "generated/spine/client/filters_pb.js",
@@ -107,6 +118,7 @@
     "spine/server/entity/state_key.proto": "generated/spine/server/entity/state_key_pb.js",
     "spine/server/integration/broker.proto": "generated/spine/server/integration/broker_pb.js",
     "spine/server/server_environment.proto": "generated/spine/server/server_environment_pb.js",
+    "spine/server/tenant/tenant.proto": "generated/spine/server/tenant/tenant_pb.js",
     "spine/server/transport/transport.proto": "generated/spine/server/transport/transport_pb.js",
     "spine/string/template_string.proto": "generated/spine/string/template_string_pb.js",
     "spine/system/server/entity_log_events.proto": "generated/spine/system/server/entity_log_events_pb.js",
@@ -122,5 +134,5 @@
   },
   "dependencies": [],
   "moduleExport": "spineProtoModule",
-  "generationId": "cb452a495b14cc11b88343ee1f89421cbfda09d126a9450b87b25ee71cd99cad"
+  "generationId": "4a7c4a6383575365917391a88d8f9174fd0f240a404967a4a779bbfeb7648123"
 }