@spine-event-engine/proto 2.0.0-snapshot.26 → 2.0.0-snapshot.28

package/generated/spine/auth/oidc_flow_pb.ts

@@ -0,0 +1,171 @@
+/*
+ * Generated by Spine TypeScript. Do not edit manually.
+ * Source Proto: spine/auth/oidc_flow.proto
+ */
+
+
+
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated from file spine/auth/oidc_flow.proto (package spine.auth, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { AuthenticatedPrincipal } from "./authenticated_principal_pb.js";
+import { file_spine_auth_authenticated_principal } from "./authenticated_principal_pb.js";
+import { file_spine_options } from "../options_pb.js";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file spine/auth/oidc_flow.proto.
+ * Generated from Proto: spine/auth/oidc_flow.proto.
+ */
+export const file_spine_auth_oidc_flow: GenFile = /*@__PURE__*/
+  fileDesc("ChpzcGluZS9hdXRoL29pZGNfZmxvdy5wcm90bxIKc3BpbmUuYXV0aCKeAgoUT2lkY0xvZ2luVHJhbnNhY3Rpb24SFQoNbG9va3VwX2RpZ2VzdBgBIAEoCRIPCgdmbG93X2lkGAIgASgJEhcKD3Byb3ZpZGVyX2lzc3VlchgDIAEoCRIRCgljbGllbnRfaWQYBCABKAkSFAoMY2FsbGJhY2tfdXJpGAUgASgJEg0KBW5vbmNlGAYgASgJEh4KFnByb3ZpZGVyX2NvZGVfdmVyaWZpZXIYByABKAkSHgoWYnJvd3Nlcl9jb2RlX2NoYWxsZW5nZRgIIAEoCRIbChNwb3N0X2xvZ2luX3JlZGlyZWN0GAkgASgJEjAKDHdoZW5fZXhwaXJlcxgKIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAi3gEKDk9pZGNMb2dpbkdyYW50EhUKDWxvb2t1cF9kaWdlc3QYASABKAkSDwoHZmxvd19pZBgCIAEoCRI1CglwcmluY2lwYWwYAyABKAsyIi5zcGluZS5hdXRoLkF1dGhlbnRpY2F0ZWRQcmluY2lwYWwSHgoWYnJvd3Nlcl9jb2RlX2NoYWxsZW5nZRgEIAEoCRIbChNwb3N0X2xvZ2luX3JlZGlyZWN0GAUgASgJEjAKDHdoZW5fZXhwaXJlcxgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCE1ABqo0kDXR5cGUuc3BpbmUuaW9iBnByb3RvMw", [file_google_protobuf_timestamp, file_spine_auth_authenticated_principal, file_spine_options]);
+
+/**
+ * One flow-qualified authorization-code transaction, consumed before provider exchange.
+ *
+ * @generated from message spine.auth.OidcLoginTransaction
+ * Generated from Proto: spine/auth/oidc_flow.proto.
+ */
+export type OidcLoginTransaction = Message<"spine.auth.OidcLoginTransaction"> & {
+  /**
+   * SHA-256 lookup digest bound to the flow and browser state.
+   *
+   * @generated from field: string lookup_digest = 1;
+   */
+  lookupDigest: string;
+
+  /**
+   * Application-selected identity of the login flow.
+   *
+   * @generated from field: string flow_id = 2;
+   */
+  flowId: string;
+
+  /**
+   * Trusted issuer selected when the flow was started.
+   *
+   * @generated from field: string provider_issuer = 3;
+   */
+  providerIssuer: string;
+
+  /**
+   * OAuth client configured for the provider exchange.
+   *
+   * @generated from field: string client_id = 4;
+   */
+  clientId: string;
+
+  /**
+   * Exact registered callback URI, including static query parameters.
+   *
+   * @generated from field: string callback_uri = 5;
+   */
+  callbackUri: string;
+
+  /**
+   * Random nonce expected in the verified ID token.
+   *
+   * @generated from field: string nonce = 6;
+   */
+  nonce: string;
+
+  /**
+   * Provider PKCE verifier retained only until callback consumption.
+   *
+   * @generated from field: string provider_code_verifier = 7;
+   */
+  providerCodeVerifier: string;
+
+  /**
+   * Browser PKCE challenge required before application-session issuance.
+   *
+   * @generated from field: string browser_code_challenge = 8;
+   */
+  browserCodeChallenge: string;
+
+  /**
+   * Application redirect selected from the flow allowlist.
+   *
+   * @generated from field: string post_login_redirect = 9;
+   */
+  postLoginRedirect: string;
+
+  /**
+   * Exact deadline for accepting the callback.
+   *
+   * @generated from field: google.protobuf.Timestamp when_expires = 10;
+   */
+  whenExpires?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message spine.auth.OidcLoginTransaction.
+ * Use `create(OidcLoginTransactionSchema)` to create a new message.
+ * Generated from Proto: spine/auth/oidc_flow.proto.
+ */
+export const OidcLoginTransactionSchema: GenMessage<OidcLoginTransaction> = /*@__PURE__*/
+  messageDesc(file_spine_auth_oidc_flow, 0);
+
+/**
+ * One flow-qualified application grant, consumed before session issuance.
+ *
+ * @generated from message spine.auth.OidcLoginGrant
+ * Generated from Proto: spine/auth/oidc_flow.proto.
+ */
+export type OidcLoginGrant = Message<"spine.auth.OidcLoginGrant"> & {
+  /**
+   * SHA-256 lookup digest bound to the flow and random grant.
+   *
+   * @generated from field: string lookup_digest = 1;
+   */
+  lookupDigest: string;
+
+  /**
+   * Application-selected identity of the login flow.
+   *
+   * @generated from field: string flow_id = 2;
+   */
+  flowId: string;
+
+  /**
+   * Complete mapped principal with optional attributes presence.
+   *
+   * @generated from field: spine.auth.AuthenticatedPrincipal principal = 3;
+   */
+  principal?: AuthenticatedPrincipal | undefined;
+
+  /**
+   * Browser PKCE challenge copied from the consumed transaction.
+   *
+   * @generated from field: string browser_code_challenge = 4;
+   */
+  browserCodeChallenge: string;
+
+  /**
+   * Allowlisted application redirect from the consumed transaction.
+   *
+   * @generated from field: string post_login_redirect = 5;
+   */
+  postLoginRedirect: string;
+
+  /**
+   * Exact deadline for exchanging the application grant.
+   *
+   * @generated from field: google.protobuf.Timestamp when_expires = 6;
+   */
+  whenExpires?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message spine.auth.OidcLoginGrant.
+ * Use `create(OidcLoginGrantSchema)` to create a new message.
+ * Generated from Proto: spine/auth/oidc_flow.proto.
+ */
+export const OidcLoginGrantSchema: GenMessage<OidcLoginGrant> = /*@__PURE__*/
+  messageDesc(file_spine_auth_oidc_flow, 1);
+

package/generated/spine/auth/opaque_session_pb.ts

@@ -0,0 +1,71 @@
+/*
+ * Generated by Spine TypeScript. Do not edit manually.
+ * Source Proto: spine/auth/opaque_session.proto
+ */
+
+
+
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated from file spine/auth/opaque_session.proto (package spine.auth, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { AuthenticatedPrincipal } from "./authenticated_principal_pb.js";
+import { file_spine_auth_authenticated_principal } from "./authenticated_principal_pb.js";
+import { file_spine_options } from "../options_pb.js";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file spine/auth/opaque_session.proto.
+ * Generated from Proto: spine/auth/opaque_session.proto.
+ */
+export const file_spine_auth_opaque_session: GenFile = /*@__PURE__*/
+  fileDesc("Ch9zcGluZS9hdXRoL29wYXF1ZV9zZXNzaW9uLnByb3RvEgpzcGluZS5hdXRoIp4BChNPcGFxdWVTZXNzaW9uUmVjb3JkEgoKAmlkGAEgASgJEhIKCmdlbmVyYXRpb24YAiABKAkSNQoJcHJpbmNpcGFsGAMgASgLMiIuc3BpbmUuYXV0aC5BdXRoZW50aWNhdGVkUHJpbmNpcGFsEjAKDHdoZW5fZXhwaXJlcxgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCE1ABqo0kDXR5cGUuc3BpbmUuaW9iBnByb3RvMw", [file_google_protobuf_timestamp, file_spine_auth_authenticated_principal, file_spine_options]);
+
+/**
+ * Durable state behind one stable opaque-session reference.
+ *
+ * @generated from message spine.auth.OpaqueSessionRecord
+ * Generated from Proto: spine/auth/opaque_session.proto.
+ */
+export type OpaqueSessionRecord = Message<"spine.auth.OpaqueSessionRecord"> & {
+  /**
+   * Stable random session reference used as the storage slot identifier.
+   *
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * Random credential generation changed by each successful rotation.
+   *
+   * @generated from field: string generation = 2;
+   */
+  generation: string;
+
+  /**
+   * Complete authenticated principal, including optional claims presence.
+   *
+   * @generated from field: spine.auth.AuthenticatedPrincipal principal = 3;
+   */
+  principal?: AuthenticatedPrincipal | undefined;
+
+  /**
+   * Exact authoritative application deadline.
+   *
+   * @generated from field: google.protobuf.Timestamp when_expires = 4;
+   */
+  whenExpires?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message spine.auth.OpaqueSessionRecord.
+ * Use `create(OpaqueSessionRecordSchema)` to create a new message.
+ * Generated from Proto: spine/auth/opaque_session.proto.
+ */
+export const OpaqueSessionRecordSchema: GenMessage<OpaqueSessionRecord> = /*@__PURE__*/
+  messageDesc(file_spine_auth_opaque_session, 0);
+

package/generated/spine/auth/token_revocation_pb.ts

@@ -0,0 +1,76 @@
+/*
+ * Generated by Spine TypeScript. Do not edit manually.
+ * Source Proto: spine/auth/token_revocation.proto
+ */
+
+
+
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated from file spine/auth/token_revocation.proto (package spine.auth, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_spine_options } from "../options_pb.js";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file spine/auth/token_revocation.proto.
+ * Generated from Proto: spine/auth/token_revocation.proto.
+ */
+export const file_spine_auth_token_revocation: GenFile = /*@__PURE__*/
+  fileDesc("CiFzcGluZS9hdXRoL3Rva2VuX3Jldm9jYXRpb24ucHJvdG8SCnNwaW5lLmF1dGgigwEKD1Rva2VuUmV2b2NhdGlvbhIKCgJpZBgBIAEoCRIOCgZpc3N1ZXIYAiABKAkSEAoIYXVkaWVuY2UYAyABKAkSEAoIdG9rZW5faWQYBCABKAkSMAoMd2hlbl9leHBpcmVzGAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEITUAGqjSQNdHlwZS5zcGluZS5pb2IGcHJvdG8z", [file_google_protobuf_timestamp, file_spine_options]);
+
+/**
+ * One scoped signed-token revocation retained through its last acceptance instant.
+ *
+ * @generated from message spine.auth.TokenRevocation
+ * Generated from Proto: spine/auth/token_revocation.proto.
+ */
+export type TokenRevocation = Message<"spine.auth.TokenRevocation"> & {
+  /**
+   * SHA-256 storage identity of the issuer, audience and token ID tuple.
+   *
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * Exact issuing service identity used to scope the token ID.
+   *
+   * @generated from field: string issuer = 2;
+   */
+  issuer: string;
+
+  /**
+   * Exact intended recipient identity used to scope the token ID.
+   *
+   * @generated from field: string audience = 3;
+   */
+  audience: string;
+
+  /**
+   * Token identifier retained for immediate revocation.
+   *
+   * @generated from field: string token_id = 4;
+   */
+  tokenId: string;
+
+  /**
+   * Inclusive last instant at which the token may still be accepted.
+   *
+   * @generated from field: google.protobuf.Timestamp when_expires = 5;
+   */
+  whenExpires?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message spine.auth.TokenRevocation.
+ * Use `create(TokenRevocationSchema)` to create a new message.
+ * Generated from Proto: spine/auth/token_revocation.proto.
+ */
+export const TokenRevocationSchema: GenMessage<TokenRevocation> = /*@__PURE__*/
+  messageDesc(file_spine_auth_token_revocation, 0);
+

package/generated/spine/server/tenant/tenant_pb.ts

@@ -0,0 +1,57 @@
+/*
+ * Generated by Spine TypeScript. Do not edit manually.
+ * Source Proto: spine/server/tenant/tenant.proto
+ */
+
+
+
+// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated from file spine/server/tenant/tenant.proto (package spine.server.tenant, syntax proto3)
+/* eslint-disable */
+
+import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { TenantId } from "../../core/tenant_id_pb.js";
+import { file_spine_core_tenant_id } from "../../core/tenant_id_pb.js";
+import { file_spine_options } from "../../options_pb.js";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file spine/server/tenant/tenant.proto.
+ * Generated from Proto: spine/server/tenant/tenant.proto.
+ */
+export const file_spine_server_tenant_tenant: GenFile = /*@__PURE__*/
+  fileDesc("CiBzcGluZS9zZXJ2ZXIvdGVuYW50L3RlbmFudC5wcm90bxITc3BpbmUuc2VydmVyLnRlbmFudCJoCgZUZW5hbnQSJgoCaWQYASABKAsyFC5zcGluZS5jb3JlLlRlbmFudElkQgSghSQBEjYKDHdoZW5fY3JlYXRlZBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBCBKCFJAFCEaqNJA10eXBlLnNwaW5lLmlvYgZwcm90bzM", [file_google_protobuf_timestamp, file_spine_core_tenant_id, file_spine_options]);
+
+/**
+ * A tenant registered in the application directory.
+ *
+ * @generated from message spine.server.tenant.Tenant
+ * Generated from Proto: spine/server/tenant/tenant.proto.
+ */
+export type Tenant = Message<"spine.server.tenant.Tenant"> & {
+  /**
+   * Complete application tenant identity.
+   *
+   * @generated from field: spine.core.TenantId id = 1;
+   */
+  id?: TenantId | undefined;
+
+  /**
+   * The time of the first successful registration.
+   *
+   * @generated from field: google.protobuf.Timestamp when_created = 2;
+   */
+  whenCreated?: Timestamp | undefined;
+};
+
+/**
+ * Describes the message spine.server.tenant.Tenant.
+ * Use `create(TenantSchema)` to create a new message.
+ * Generated from Proto: spine/server/tenant/tenant.proto.
+ */
+export const TenantSchema: GenMessage<Tenant> = /*@__PURE__*/
+  messageDesc(file_spine_server_tenant_tenant, 0);
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spine-event-engine/proto",
-  "version": "2.0.0-snapshot.26",
+  "version": "2.0.0-snapshot.28",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {

package/proto/spine/auth/authenticated_principal.proto

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+syntax = "proto3";
+
+package spine.auth;
+
+import "spine/options.proto";
+
+option java_multiple_files = true;
+option (type_url_prefix) = "type.spine.io";
+
+// A complete authenticated identity used by application session and grant records.
+message AuthenticatedPrincipal {
+  // The application principal identifier.
+  string id = 1;
+
+  // Optional claims; an empty present message differs from absent claims.
+  PrincipalAttributes attributes = 2;
+}
+
+// Application-defined string claims with explicit message presence.
+message PrincipalAttributes {
+  // Claim names and their values.
+  map<string, string> values = 1;
+}

package/proto/spine/auth/oidc_flow.proto

@@ -0,0 +1,77 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+syntax = "proto3";
+
+package spine.auth;
+
+import "google/protobuf/timestamp.proto";
+import "spine/auth/authenticated_principal.proto";
+import "spine/options.proto";
+
+option java_multiple_files = true;
+option (type_url_prefix) = "type.spine.io";
+
+// One flow-qualified authorization-code transaction, consumed before provider exchange.
+message OidcLoginTransaction {
+  // SHA-256 lookup digest bound to the flow and browser state.
+  string lookup_digest = 1;
+
+  // Application-selected identity of the login flow.
+  string flow_id = 2;
+
+  // Trusted issuer selected when the flow was started.
+  string provider_issuer = 3;
+
+  // OAuth client configured for the provider exchange.
+  string client_id = 4;
+
+  // Exact registered callback URI, including static query parameters.
+  string callback_uri = 5;
+
+  // Random nonce expected in the verified ID token.
+  string nonce = 6;
+
+  // Provider PKCE verifier retained only until callback consumption.
+  string provider_code_verifier = 7;
+
+  // Browser PKCE challenge required before application-session issuance.
+  string browser_code_challenge = 8;
+
+  // Application redirect selected from the flow allowlist.
+  string post_login_redirect = 9;
+
+  // Exact deadline for accepting the callback.
+  google.protobuf.Timestamp when_expires = 10;
+}
+
+// One flow-qualified application grant, consumed before session issuance.
+message OidcLoginGrant {
+  // SHA-256 lookup digest bound to the flow and random grant.
+  string lookup_digest = 1;
+
+  // Application-selected identity of the login flow.
+  string flow_id = 2;
+
+  // Complete mapped principal with optional attributes presence.
+  AuthenticatedPrincipal principal = 3;
+
+  // Browser PKCE challenge copied from the consumed transaction.
+  string browser_code_challenge = 4;
+
+  // Allowlisted application redirect from the consumed transaction.
+  string post_login_redirect = 5;
+
+  // Exact deadline for exchanging the application grant.
+  google.protobuf.Timestamp when_expires = 6;
+}

package/proto/spine/auth/opaque_session.proto

@@ -0,0 +1,38 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+syntax = "proto3";
+
+package spine.auth;
+
+import "google/protobuf/timestamp.proto";
+import "spine/auth/authenticated_principal.proto";
+import "spine/options.proto";
+
+option java_multiple_files = true;
+option (type_url_prefix) = "type.spine.io";
+
+// Durable state behind one stable opaque-session reference.
+message OpaqueSessionRecord {
+  // Stable random session reference used as the storage slot identifier.
+  string id = 1;
+
+  // Random credential generation changed by each successful rotation.
+  string generation = 2;
+
+  // Complete authenticated principal, including optional claims presence.
+  AuthenticatedPrincipal principal = 3;
+
+  // Exact authoritative application deadline.
+  google.protobuf.Timestamp when_expires = 4;
+}

package/proto/spine/auth/token_revocation.proto

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+syntax = "proto3";
+
+package spine.auth;
+
+import "google/protobuf/timestamp.proto";
+import "spine/options.proto";
+
+option java_multiple_files = true;
+option (type_url_prefix) = "type.spine.io";
+
+// One scoped signed-token revocation retained through its last acceptance instant.
+message TokenRevocation {
+  // SHA-256 storage identity of the issuer, audience and token ID tuple.
+  string id = 1;
+
+  // Exact issuing service identity used to scope the token ID.
+  string issuer = 2;
+
+  // Exact intended recipient identity used to scope the token ID.
+  string audience = 3;
+
+  // Token identifier retained for immediate revocation.
+  string token_id = 4;
+
+  // Inclusive last instant at which the token may still be accepted.
+  google.protobuf.Timestamp when_expires = 5;
+}

package/proto/spine/server/tenant/tenant.proto

@@ -0,0 +1,31 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+syntax = "proto3";
+
+package spine.server.tenant;
+
+import "google/protobuf/timestamp.proto";
+import "spine/core/tenant_id.proto";
+import "spine/options.proto";
+
+option (type_url_prefix) = "type.spine.io";
+
+// A tenant registered in the application directory.
+message Tenant {
+  // Complete application tenant identity.
+  spine.core.TenantId id = 1 [(required) = true];
+
+  // The time of the first successful registration.
+  google.protobuf.Timestamp when_created = 2 [(required) = true];
+}

package/proto/spine-sources.json

@@ -427,12 +427,8 @@
   ],
   "ownedSources": [
     {
-      "localPath": "packages/proto/proto/spine/client/app_query.proto",
-      "sha256": "b5b334232dc724f7de606e6655aefde7856a8be1e9742311aa3c23a3ae206140"
-    },
-    {
-      "localPath": "packages/proto/proto/spine/server/agent/acceptance_receipt.proto",
-      "sha256": "daa0f8e724849523cb539b9b6a7503aa8eab0de3f23d926d1aa9d117bd44f007"
+      "localPath": "packages/proto/proto/spine/auth/authenticated_principal.proto",
+      "sha256": "09a4c8d755293fd522e1ff4c8305d49ef6bdb681e0de6a4e1bf311db1c9412db"
     },
     {
       "localPath": "packages/proto/proto/spine/auth/authenticated_subscription.proto",
@@ -442,6 +438,22 @@
       "localPath": "packages/proto/proto/spine/auth/authentication_service.proto",
       "sha256": "dcd178e057a13d4d044ac9fb1ba487b5a27203b0686191d5955ee928852822d7"
     },
+    {
+      "localPath": "packages/proto/proto/spine/auth/oidc_flow.proto",
+      "sha256": "30f35a0b3cc4f3e84b91af49b632ad71067e54ac34b618cfdaca0c6ab509c07a"
+    },
+    {
+      "localPath": "packages/proto/proto/spine/auth/opaque_session.proto",
+      "sha256": "04aa832423e9595cdaa73e0689276803ff749e56d4a8d963f30729fa8780dfe6"
+    },
+    {
+      "localPath": "packages/proto/proto/spine/auth/token_revocation.proto",
+      "sha256": "a13278fd19469a5e3cd542edf29ba7015570d4dc03e176ab2a365485b4e9982c"
+    },
+    {
+      "localPath": "packages/proto/proto/spine/client/app_query.proto",
+      "sha256": "b5b334232dc724f7de606e6655aefde7856a8be1e9742311aa3c23a3ae206140"
+    },
     {
       "localPath": "packages/proto/proto/spine/client/subscription_record.proto",
       "sha256": "614caf2608bf3fc36a419f887305ae6b7b1cfad657800b5bc3a5d886d396bd86"
@@ -450,6 +462,10 @@
       "localPath": "packages/proto/proto/spine/deployment/node_discovery.proto",
       "sha256": "7c300d215a1757c17b7bd1a89cebb4825df28a58fcc119f2aa6d5535d7520073"
     },
+    {
+      "localPath": "packages/proto/proto/spine/server/agent/acceptance_receipt.proto",
+      "sha256": "daa0f8e724849523cb539b9b6a7503aa8eab0de3f23d926d1aa9d117bd44f007"
+    },
     {
       "localPath": "packages/proto/proto/spine/server/agent/history_record.proto",
       "sha256": "24ed282bc0cd901a3b38748ea7b516e972a87b2a7f69db99a2b094458d48e38a"
@@ -458,6 +474,10 @@
       "localPath": "packages/proto/proto/spine/server/agent/model_preferences_record.proto",
       "sha256": "33b7f805be70c5435b6d2f7ef558e0fab5dfed34a699ce87734f3c9b2b6f00d5"
     },
+    {
+      "localPath": "packages/proto/proto/spine/server/tenant/tenant.proto",
+      "sha256": "f6d2785fd6dbeed03d40fcef4aec294e82df3557bac3d7e63c75d6344847462a"
+    },
     {
       "localPath": "packages/proto/proto/spine/ts/agent/content.proto",
       "sha256": "f4242677c02f546724dbffe9dabb93bdf8d5a63f8d3357e91fab3765e41e058a"