// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.universalledger.v1;

import "google/api/field_behavior.proto";
import "google/cloud/universalledger/v1/accounts.proto";
import "google/cloud/universalledger/v1/common.proto";

option csharp_namespace = "Google.Cloud.UniversalLedger.V1";
option go_package = "cloud.google.com/go/universalledger/apiv1/universalledgerpb;universalledgerpb";
option java_multiple_files = true;
option java_outer_classname = "TransactionsProto";
option java_package = "com.google.cloud.universalledger.v1";
option php_namespace = "Google\\Cloud\\UniversalLedger\\V1";
option ruby_package = "Google::Cloud::UniversalLedger::V1";

// Specifies the format a public key is provided in.
enum KeyFormat {
  // The key format is unspecified. This value is invalid and should not be
  // used.
  KEY_FORMAT_UNSPECIFIED = 0;

  // A binary serialized keyset in [Tink wire
  // format](https://developers.google.com/tink/wire-format#keyset_serialization).
  KEY_FORMAT_TINK_WIRE_FORMAT = 1;

  // A PEM-encoded elliptic curve signing key using the P-256 curve with
  // SHA256 digest. Signatures must be provided in DER format.
  KEY_FORMAT_PEM_EC_P256_SHA256 = 2;
}

// The settlement mode for a clearinghouse.
enum SettlementMode {
  // The settlement mode is unspecified. This value is invalid and should not
  // be used.
  SETTLEMENT_MODE_UNSPECIFIED = 0;

  // The clearinghouse is responsible for tracking the ownership of the
  // off-ledger funds, and periodically issuing
  // [SettlementRequest][google.cloud.universalledger.v1.SettlementRequest]
  // transactions to maintain the corresponding balances on the ledger in sync.
  SETTLEMENT_MODE_DEFERRED = 1;

  // The clearinghouse maintains a single pool of funds and the ledger acts as
  // the golden source for the allocation of those funds between the token
  // managers. This settlement mode can also be described as "instant gross
  // settlement."
  SETTLEMENT_MODE_INSTANT = 2;
}

// Initiates a settlement operation between two token managers.
// The sender must be a clearinghouse account.
//
// In the deferred
// [SettlementMode][google.cloud.universalledger.v1.SettlementMode] where the
// clearinghouse has custody of the token manager funds, this is the only
// transaction that needs to be sent to execute a settlement between the two
// token managers.
message SettlementRequest {
  // Optional. Immutable. Deprecated: Use
  // [payer_id][google.cloud.universalledger.v1.SettlementRequest.payer_id]
  // instead. The account ID of the party that needs to make the fund transfer.
  Entity payer = 1 [
    deprecated = true,
    (google.api.field_behavior) = IMMUTABLE,
    (google.api.field_behavior) = OPTIONAL
  ];

  // Optional. Immutable. The account ID of the party that needs to make the
  // fund transfer. One of `payer` or `payer_id` must be specified.
  string payer_id = 6 [
    (google.api.field_behavior) = IMMUTABLE,
    (google.api.field_behavior) = OPTIONAL
  ];

  // Optional. Immutable. Deprecated: Use
  // [beneficiary_id][google.cloud.universalledger.v1.SettlementRequest.beneficiary_id]
  // instead. The account ID of the party that needs to be paid.
  Entity beneficiary = 2 [
    deprecated = true,
    (google.api.field_behavior) = IMMUTABLE,
    (google.api.field_behavior) = OPTIONAL
  ];

  // Optional. Immutable. The account ID of the party that will receive the
  // funds. One of `beneficiary` or `beneficiary_id` must be specified.
  string beneficiary_id = 7 [
    (google.api.field_behavior) = IMMUTABLE,
    (google.api.field_behavior) = OPTIONAL
  ];

  // Required. Immutable. The balance of issued tokens that need to be
  // transferred by the `payer` account to the `beneficiary` account on the
  // ledger.
  CurrencyValue balance = 3 [
    (google.api.field_behavior) = IMMUTABLE,
    (google.api.field_behavior) = REQUIRED
  ];

  // Required. Immutable. The round ID at which this settlement amount was
  // computed.
  int64 round_id = 5 [
    (google.api.field_behavior) = IMMUTABLE,
    (google.api.field_behavior) = REQUIRED
  ];
}

// Creates a new user account. The sender must be an account manager.
//
// If the transaction is successful, the ID of the newly created account is
// returned as an event in the
// [TransactionCertificate][google.cloud.universalledger.v1.TransactionCertificate]
// of the finalized transaction.
message CreateAccount {
  // Required. The public key of the account owner. Note that this is *not* the
  // public key of the sender. This is the public key of the *new* account owner
  // and it will be stored on the ledger. It will be used to validate the
  // signature of the transactions emanating from the created account.
  //
  // The format of the public key is defined by the `key_format` field.
  // Considered public information.
  bytes public_key = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Immutable. The key format of the public key. If not
  // specified, defaults to a binary serialized keyset in [Tink wire
  // format](https://developers.google.com/tink/wire-format#keyset_serialization).
  // Considered public information.
  KeyFormat key_format = 6 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. The list of roles to grant to this account.
  repeated Role roles = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The status of the account to be created. By default, the account
  // status of a newly created account will be `ACCOUNT_STATUS_ACTIVE`.
  AccountStatus account_status = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Immutable. An opaque comment field that is not interpreted by the
  // system but stored on the ledger in the account. Considered public
  // information. Maximum length is 128 characters. May be left empty. Once
  // created, the field is immutable.
  string account_comment = 4 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Deprecated: Use
  // [token_manager_id][google.cloud.universalledger.v1.CreateAccount.token_manager_id]
  // instead. The token manager for this account. This field is optional and if
  // not supplied, the default token manager associated to the account manager
  // (that is, the sender of this transaction) will be used.
  Entity token_manager = 5
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the token manager for this account. This field is
  // optional and if not supplied, the default token manager associated to the
  // account manager (that is, the sender of this transaction) will be used. The
  // value is limited to 60 characters.
  string token_manager_id = 7 [(google.api.field_behavior) = OPTIONAL];
}

// Marks an account as `ACCOUNT_STATUS_INACTIVE`. The sender must be the account
// manager of the account to deactivate.
//
// This implies that the account owner will not be able to make any transactions
// on the account regardless of the roles.
message DeactivateAccount {
  // Optional. Deprecated: Use
  // [account_id][google.cloud.universalledger.v1.DeactivateAccount.account_id]
  // instead. The ID of the account to be deactivated.
  Entity account = 1
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the account to be deactivated. One of `account` or
  // `account_id` must be specified. The value is limited to 60 characters.
  string account_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

// Marks an account as `ACCOUNT_STATUS_ACTIVE`. The sender must be the account
// manager of the account to activate.
//
// The account owner can resume normal operations permitted by the roles on the
// account.
message ActivateAccount {
  // Optional. Deprecated: Use
  // [account_id][google.cloud.universalledger.v1.ActivateAccount.account_id]
  // instead. The ID of the account to be activated.
  Entity account = 1
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the account to be activated. One of `account` or
  // `account_id` must be specified. The value is limited to 60 characters.
  string account_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

// Adds the specified roles to the account. The sender must be the account
// manager of the account to modify.
message AddRoles {
  // Optional. Deprecated: Use
  // [account_id][google.cloud.universalledger.v1.AddRoles.account_id] instead.
  // The ID of the account to be modified.
  Entity account = 1
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the account to be modified. One of `account` or
  // `account_id` must be specified. The value is limited to 60 characters.
  string account_id = 3 [(google.api.field_behavior) = OPTIONAL];

  // Required. The roles to be added.
  repeated Role roles = 2 [(google.api.field_behavior) = REQUIRED];
}

// Removes the specified roles from the account. The sender must be the account
// manager of the account to modify.
message RemoveRoles {
  // Optional. Deprecated: Use
  // [account_id][google.cloud.universalledger.v1.RemoveRoles.account_id]
  // instead. The ID of the account to be modified.
  Entity account = 1
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the account to be modified. One of `account` or
  // `account_id` must be specified. The value is limited to 60 characters.
  string account_id = 3 [(google.api.field_behavior) = OPTIONAL];

  // Required. The roles to be removed.
  repeated Role roles = 2 [(google.api.field_behavior) = REQUIRED];
}

// Transfers the responsibility of managing a particular account to another
// manager. The sender must be the current account manager of the account and,
// to provide consent, the new manager must also sign this transaction.
message ChangeAccountManager {
  // Optional. Deprecated: Use
  // [account_id][google.cloud.universalledger.v1.ChangeAccountManager.account_id]
  // instead. The ID of the account whose manager is to be changed.
  Entity account = 1
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the account whose manager is to be changed. One of
  // `account` or `account_id` must be specified. The value is limited to 60
  // characters.
  string account_id = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Deprecated: Use
  // [next_manager_id][google.cloud.universalledger.v1.ChangeAccountManager.next_manager_id]
  // instead. The ID of the new proposed account manager. Validation requires
  // that the new manager has also signed this transaction.
  Entity next_manager = 2
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the new proposed account manager. Validation requires
  // that the new manager has also signed this transaction. One of
  // `next_manager` or `next_manager_id` must be specified. The value is limited
  // to 60 characters.
  string next_manager_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Transactions for token issuance and minting.
// Notifies the network that the target account has deposited reserve funds and
// increases its token issuance limit. The sender must be a clearinghouse
// account.
message IncreaseTokenIssuanceLimit {
  // Optional. Deprecated: Use
  // [token_manager_id][google.cloud.universalledger.v1.IncreaseTokenIssuanceLimit.token_manager_id]
  // instead. The ID of the institutional account whose mint limit is to be
  // raised. This account must be a token manager for the transaction to be
  // valid.
  Entity token_manager = 1
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the institutional account whose mint limit is to be
  // raised. This account must be a token manager for the transaction to be
  // valid. One of `token_manager` or `token_manager_id` must be specified.
  string token_manager_id = 3 [(google.api.field_behavior) = OPTIONAL];

  // Required. The amount by which to raise the limit. The amount must be
  // positive.
  CurrencyValue amount = 2 [(google.api.field_behavior) = REQUIRED];
}

// Notifies the network that the target account wishes to withdraw reserve funds
// and decreases its token issuance limit. The sender must be a clearinghouse
// account.
//
// Note that this transaction must be successfully finalized *before* the
// reserve funds can be withdrawn. This is necessary because it is possible for
// the transaction to fail (for example, if the minted amount is already above
// the requested reduced limit).
message DecreaseTokenIssuanceLimit {
  // Optional. Deprecated: Use
  // [token_manager_id][google.cloud.universalledger.v1.DecreaseTokenIssuanceLimit.token_manager_id]
  // instead. The ID of the institutional account whose mint limit is to be
  // lowered. This account must be a token manager for the transaction to be
  // valid.
  Entity token_manager = 1
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the institutional account whose mint limit is to be
  // lowered. This account must be a token manager for the transaction to be
  // valid. One of `token_manager_id` (preferred) or `token_manager`
  // (deprecated) must be specified.
  string token_manager_id = 3 [(google.api.field_behavior) = OPTIONAL];

  // Required. The amount by which to lower the limit. The amount must be
  // positive. The transaction will fail if the reduced limit will fall below
  // the currently issued tokens.
  CurrencyValue amount = 2 [(google.api.field_behavior) = REQUIRED];
}

// Mints currency tokens and transfers them to a specified account. The sender
// must be a token manager.
message Mint {
  // Required. The amount to mint. The amount must be such that the total tokens
  // minted by the token manager do not exceed the mint limit. If the amount is
  // higher than that, the transaction must be rejected
  CurrencyValue mint_amount = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Deprecated: Use
  // [beneficiary_id][google.cloud.universalledger.v1.Mint.beneficiary_id]
  // instead. The account to which the minted amount should be transferred. The
  // beneficiary account must have the `ROLE_RECEIVER` enabled on it.
  Entity beneficiary = 2
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the account to which the minted amount should be
  // transferred. The receiving account must have the `ROLE_RECEIVER` enabled on
  // it. One of `beneficiary` or `beneficiary_id` must be specified.
  string beneficiary_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Burns currency tokens. The sender must be a token manager and the account
// supplying the tokens to burn must additionally sign the transaction.
//
// The expected flow is that the token manager will have its designated burn
// account which customers would transfer the tokens to before they are burnt.
// Alternatively, the customers could directly sign the transaction in which
// case it would act as an atomic "transfer-and-burn" transaction.
message Burn {
  // Required. The amount to burn.
  CurrencyValue burn_amount = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Deprecated: Use
  // [payer_id][google.cloud.universalledger.v1.Burn.payer_id] instead. The
  // account supplying the tokens to burn. The account must have the
  // `ROLE_PAYER` enabled on it.
  Entity payer = 2 [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the account supplying the tokens to burn. The payer
  // account must have the `ROLE_PAYER` enabled on it. One of `payer` or
  // `payer_id` must be specified.
  string payer_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Transfers tokens from one user account to another. The sender must be a
// regular user account, as opposed to a privileged account like a token manager
// or an account manager.
//
// Additionally, the transaction sender must have the `ROLE_PAYER` enabled on
// it, while the receiver must have the `ROLE_RECEIVER` enabled on it.
message Transfer {
  // Optional. Deprecated: Use
  // [beneficiary_id][google.cloud.universalledger.v1.Transfer.beneficiary_id]
  // instead. The account that receives the tokens.
  Entity beneficiary = 1
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the account that receives the tokens. One of
  // `beneficiary` or `beneficiary_id` must be specified.
  string beneficiary_id = 4 [(google.api.field_behavior) = OPTIONAL];

  // Required. The amount to transfer. The amount must be positive.
  CurrencyValue amount = 2 [(google.api.field_behavior) = REQUIRED];
}

// Creates a new token manager associated to the currency of the operator
// sending the request. The sender must be a currency operator.
//
// If the transaction is successful, the ID of the newly created account is
// returned as an event in the
// [TransactionCertificate][google.cloud.universalledger.v1.TransactionCertificate]
// of the finalized transaction.
message CreateTokenManager {
  // Required. The public key of the new token manager. Note that this is *not*
  // the public key of the operator. This public key will be associated with the
  // token manager and stored on the ledger. It will be used to validate the
  // signature of the transactions emanating from the token manager's account.
  //
  // The format of the public key is defined by the `key_format` field.
  // Considered public information.
  bytes public_key = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Immutable. The key format of the public key. If not
  // specified, defaults to a binary serialized keyset in [Tink wire
  // format](https://developers.google.com/tink/wire-format#keyset_serialization).
  // Considered public information.
  KeyFormat key_format = 5 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Immutable. An opaque comment field that is not interpreted by the
  // system but stored on the ledger in the account. Considered public
  // information. Maximum length is 128 characters. May be left empty. Once
  // created, the field is immutable.
  string account_comment = 4 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];
}

// Creates a new account manager. The sender must be a currency operator.
//
// If the transaction is successful, the ID of the newly created account is
// returned as an event in the
// [TransactionCertificate][google.cloud.universalledger.v1.TransactionCertificate]
// of the finalized transaction.
message CreateAccountManager {
  // Required. The public key of the new account manager. Note that this is
  // *not* the public key of the operator. This public key will be associated
  // with the account manager and stored on the ledger. It will be used to
  // validate the signature of the transactions emanating from the account
  // manager's account.
  //
  // The format of the public key is defined by the `key_format` field.
  // Considered public information.
  bytes public_key = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Immutable. The key format of the public key. If not
  // specified, defaults to a binary serialized keyset in [Tink wire
  // format](https://developers.google.com/tink/wire-format#keyset_serialization).
  // Considered public information.
  KeyFormat key_format = 5 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Deprecated: Use
  // [default_token_manager_id][google.cloud.universalledger.v1.CreateAccountManager.default_token_manager_id]
  // instead. The default token manager for the accounts that will be created by
  // this manager.
  Entity default_token_manager = 2
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the default token manager for the accounts that will be
  // created by this manager. The value is limited to 60 characters.
  string default_token_manager_id = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Immutable. An opaque comment field that is not interpreted by the
  // system but stored on the ledger in the account. Considered public
  // information. Maximum length is 128 characters. May be left empty. Once
  // created, the field is immutable.
  string account_comment = 4 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];
}

// Creates a new clearinghouse. The sender must be a currency operator.
//
// If the transaction is successful, the ID of the newly created account is
// returned as an event in the
// [TransactionCertificate][google.cloud.universalledger.v1.TransactionCertificate]
// of the finalized transaction.
message CreateClearinghouse {
  // Required. The public key of the new clearinghouse. Note that this is *not*
  // the public key of the operator. This public key will be associated with the
  // clearinghouse and stored on the ledger. It will be used to validate
  // signature of the transactions emanating from the clearinghouse's account.
  //
  // The format of the public key is defined by the `key_format` field.
  // Considered public information.
  bytes public_key = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Immutable. The key format of the public key. If not
  // specified, defaults to a binary serialized keyset in [Tink wire
  // format](https://developers.google.com/tink/wire-format#keyset_serialization).
  // Considered public information.
  KeyFormat key_format = 6 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Immutable. An opaque comment field that is not interpreted by the
  // system but stored on the ledger in the account. Considered public
  // information. Maximum length is 128 characters. May be left empty. Once
  // created, the field is immutable.
  string account_comment = 4 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Required. The settlement mode for this clearinghouse. Required.
  // Considered public information.
  SettlementMode settlement_mode = 5 [(google.api.field_behavior) = REQUIRED];
}

// Transfers the ownership of the platform operator to a new account. The sender
// must be the current platform operator.
//
// If the transaction is successful, deactivates the current platform operator,
// and the ID of the newly created account is returned as an event in the
// [TransactionCertificate][google.cloud.universalledger.v1.TransactionCertificate]
// of the finalized transaction.
message TransferPlatformOperator {
  // Required. The public key of the new platform operator. This public key will
  // be associated with the platform operator and stored on the ledger. It will
  // be used to validate the signature of the transactions emanating from the
  // platform operator's account.
  //
  // The format of the public key is defined by the `key_format` field.
  // Considered public information.
  bytes public_key = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Immutable. The key format of the public key. If not
  // specified, defaults to a binary serialized keyset in [Tink wire
  // format](https://developers.google.com/tink/wire-format#keyset_serialization).
  // Considered public information.
  KeyFormat key_format = 3 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Immutable. An opaque comment field that is not interpreted by the
  // system but stored on the ledger in the account. Considered public
  // information. Maximum length is 128 characters. May be left empty. Once
  // created, the field is immutable.
  string account_comment = 2 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];
}

// Creates a new currency operator. The sender must be the platform operator.
//
// If the transaction is successful, the ID of the newly created account is
// returned as an event in the
// [TransactionCertificate][google.cloud.universalledger.v1.TransactionCertificate]
// of the finalized transaction.
//
// This transaction must introduce a new currency into the system. If the
// specified currency already exists, this transaction will fail.
// If the currency operator has to be replaced, the TransferCurrencyOperator
// transaction should be sent instead.
message CreateCurrencyOperator {
  // Required. The public key of the new currency operator. This public key will
  // be associated with the currency operator and stored on the ledger. It will
  // be used to validate the signature of the transactions emanating from the
  // operator's account.
  //
  // The format of the public key is defined by the `key_format` field.
  // Considered public information.
  bytes public_key = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Immutable. The key format of the public key. If not
  // specified, defaults to a binary serialized keyset in [Tink wire
  // format](https://developers.google.com/tink/wire-format#keyset_serialization).
  // Considered public information.
  KeyFormat key_format = 4 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Immutable. An opaque comment field that is not interpreted by the
  // system but stored on the ledger in the account. Considered public
  // information. Maximum length is 128 characters. May be left empty. Once
  // created, the field is immutable.
  string account_comment = 2 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Deprecated: Use
  // [currency_code][google.cloud.universalledger.v1.CreateCurrencyOperator.currency_code]
  // instead.
  // The fiat currency associated with this operator, represented as a
  // 3-capital-letter ISO 4217 code.
  // Considered public information.
  string currency = 3
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The fiat currency associated with this operator, represented as a
  // 3-capital-letter ISO 4217 code.
  // Considered public information.
  string currency_code = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Transfers the ownership of the given currency operator to a new account. The
// sender must be the platform operator.
//
// If the transaction is successful, deactivates the given currency operator,
// and the ID of the newly created account is returned as an event in the
// [TransactionCertificate][google.cloud.universalledger.v1.TransactionCertificate]
// of the finalized transaction.
message TransferCurrencyOperator {
  // Required. The public key of the new currency operator. This public key will
  // be associated with the currency operator and stored on the ledger. It will
  // be used to validate the signature of the transactions emanating from the
  // currency operator's account.
  //
  // The format of the public key is defined by the `key_format` field.
  // Considered public information.
  bytes public_key = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Immutable. The key format of the public key. If not
  // specified, defaults to a binary serialized keyset in [Tink wire
  // format](https://developers.google.com/tink/wire-format#keyset_serialization).
  // Considered public information.
  KeyFormat key_format = 5 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Immutable. An opaque comment field that is not interpreted by the
  // system but stored on the ledger in the account. Considered public
  // information. Maximum length is 128 characters. May be left empty. Once
  // created, the field is immutable.
  string account_comment = 2 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Deprecated: Use
  // [currency_operator_id][google.cloud.universalledger.v1.TransferCurrencyOperator.currency_operator_id]
  // instead. The currency operator to be replaced. Must be active.
  Entity currency_operator = 4
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the currency operator to be replaced. Must be active.
  // One of `currency_operator` or `currency_operator_id` must be specified. The
  // value is limited to 60 characters.
  string currency_operator_id = 6 [(google.api.field_behavior) = OPTIONAL];
}

// Triggers the creation of a snapshot of the network. The sender must be
// the platform operator.
message CreateSnapshot {}

// Stores a contract on the ledger.
message CreateContract {
  // Serialised contract bytes.
  bytes contract_bytes = 1;

  // Optional. Immutable. Deprecated: Use
  // [init_arguments][google.cloud.universalledger.v1.CreateContract.init_arguments]
  // instead. Arguments for the `__init__` method.
  map<string, Value> arguments = 2 [
    deprecated = true,
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Immutable. Contains arguments for the `__init__` method.
  map<string, Value> init_arguments = 4 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Immutable. An opaque comment field that is not interpreted by the
  // system but stored on the ledger in the contract. Considered public
  // information. Maximum length is 128 characters. May be left empty. Once
  // created, the field is immutable.
  string contract_comment = 3 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];
}

// Grants permissions to the contract by the transaction sender.
//
// Note that, at the moment, there is no support for revoking permissions.
message GrantContractPermissions {
  // Optional. Deprecated: Use
  // [contract_id][google.cloud.universalledger.v1.GrantContractPermissions.contract_id]
  // instead. ID of the contract to which permissions are being granted.
  Entity contract = 1
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the contract to which permissions are being granted.
  // One of `contract` or `contract_id` must be specified.
  string contract_id = 3 [(google.api.field_behavior) = OPTIONAL];

  // The permissions to be granted.
  repeated ContractPermission permissions = 2;
}

// Invokes the execution of a contract method.
message InvokeContractMethod {
  // Optional. Deprecated: Use
  // [contract_id][google.cloud.universalledger.v1.InvokeContractMethod.contract_id]
  // instead. ID of the contract to run.
  Entity contract = 1
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Optional. The ID of the contract to run. One of `contract` or `contract_id`
  // must be specified.
  string contract_id = 5 [(google.api.field_behavior) = OPTIONAL];

  // Name of the method to run.
  string method_name = 2;

  // Optional. Immutable. Deprecated: Use
  // [method_arguments][google.cloud.universalledger.v1.InvokeContractMethod.method_arguments]
  // instead. Arguments for the method.
  map<string, Value> arguments = 3 [
    deprecated = true,
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Immutable. Contains arguments to pass to the method.
  map<string, Value> method_arguments = 6 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // The amount to be paid.
  // Must be greater than zero when invoking payable methods; and zero for
  // non-payable ones.
  CurrencyValue payment = 4;
}

// Creates a new contract token manager associated with the currency of the
// operator sending the request. The sender must be a currency operator.
// The newly created contract token manager is active by default. If the
// contract token manager has to be replaced, the TransferContractTokenManager
// transaction should be sent instead. If another contract token manager
// associated with the same currency exists, this transaction will fail.
//
// Unlike regular token managers, contract token managers are not allowed to
// execute transactions such as mint or burn. They can, however, participate in
// settlement operations.
//
// If the transaction is successful, the ID of the newly created account is
// returned as an event in the
// [TransactionCertificate][google.cloud.universalledger.v1.TransactionCertificate]
// of the finalized transaction.
message CreateContractTokenManager {
  // Required. The public key of the new contract token manager. Note that this
  // is *not* the public key of the operator. This public key will be associated
  // with the contract token manager and stored on the ledger. It will be used
  // to validate the signature of the transactions emanating from the contract
  // token manager's account.
  //
  // The format of the public key is defined by the `key_format` field.
  // Considered public information.
  bytes public_key = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Immutable. An opaque comment field that is not interpreted by the
  // system but stored on the ledger in the account. Considered public
  // information. Maximum length is 128 characters. May be left empty. Once
  // created, the field is immutable.
  string account_comment = 2 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Immutable. The key format of the public key. If not
  // specified, defaults to a binary serialized keyset in [Tink wire
  // format](https://developers.google.com/tink/wire-format#keyset_serialization).
  // Considered public information.
  KeyFormat key_format = 3 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];
}

// Transfers the ownership of the contract token manager to a new account. The
// sender must be the current currency operator for the currency.
//
// If the transaction is successful, deactivates the current contract token
// manager for the currency, and the ID of the newly created account is returned
// as an event in the
// [TransactionCertificate][google.cloud.universalledger.v1.TransactionCertificate]
// of the finalized transaction.
message TransferContractTokenManager {
  // Required. The public key of the new contract token manager. Note that this
  // is *not* the public key of the operator. This is the public key of the
  // *new* contract token manager and it will be stored on the ledger. It will
  // be used to validate the signature of the transactions emanating from the
  // contract token manager's account.
  //
  // The format of the public key is defined by the `key_format` field.
  // Considered public information.
  bytes public_key = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Immutable. An opaque comment field that is not interpreted by the
  // system but stored on the ledger in the account. Considered public
  // information. Maximum length is 128 characters. May be left empty. Once
  // created, the field is immutable.
  string account_comment = 2 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Optional. Immutable. The key format of the public key. If not
  // specified, defaults to a binary serialized keyset in [Tink wire
  // format](https://developers.google.com/tink/wire-format#keyset_serialization).
  // Considered public information.
  KeyFormat key_format = 3 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];
}