From 9fea05df763d10ff973c015b50d4e79871802147 Mon Sep 17 00:00:00 2001
From: flemming-it <stefan.a.flemming@googlemail.com>
Date: Fri, 19 Jun 2026 02:54:48 +0200
Subject: [PATCH] feat(sdk): addStore() accepts pinnedPubkeyPem

Regenerate Dart bindings for AddStoreRequest.pinned_pubkey_pem and
thread it through HubClient.addStore so clients can pin a per-store
publisher key.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
---
 lib/src/generated/chain/v1/hub.pb.dart     | 16 ++++++++++++++++
 lib/src/generated/chain/v1/hub.pbjson.dart |  4 +++-
 lib/src/hub_client.dart                    |  2 ++
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/lib/src/generated/chain/v1/hub.pb.dart b/lib/src/generated/chain/v1/hub.pb.dart
index b1e7228..ce3afcb 100644
--- a/lib/src/generated/chain/v1/hub.pb.dart
+++ b/lib/src/generated/chain/v1/hub.pb.dart
@@ -7419,6 +7419,7 @@ class AddStoreRequest extends $pb.GeneratedMessage {
     $core.String? bearerEnv,
     $core.String? basicUser,
     $core.String? basicPasswordEnv,
+    $core.String? pinnedPubkeyPem,
   }) {
     final result = create();
     if (name != null) result.name = name;
@@ -7426,6 +7427,7 @@ class AddStoreRequest extends $pb.GeneratedMessage {
     if (bearerEnv != null) result.bearerEnv = bearerEnv;
     if (basicUser != null) result.basicUser = basicUser;
     if (basicPasswordEnv != null) result.basicPasswordEnv = basicPasswordEnv;
+    if (pinnedPubkeyPem != null) result.pinnedPubkeyPem = pinnedPubkeyPem;
     return result;
   }
 
@@ -7447,6 +7449,7 @@ class AddStoreRequest extends $pb.GeneratedMessage {
     ..aOS(3, _omitFieldNames ? '' : 'bearerEnv')
     ..aOS(4, _omitFieldNames ? '' : 'basicUser')
     ..aOS(5, _omitFieldNames ? '' : 'basicPasswordEnv')
+    ..aOS(6, _omitFieldNames ? '' : 'pinnedPubkeyPem')
     ..hasRequiredFields = false;
 
   @$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@@ -7517,6 +7520,19 @@ class AddStoreRequest extends $pb.GeneratedMessage {
   $core.bool hasBasicPasswordEnv() => $_has(4);
   @$pb.TagNumber(5)
   void clearBasicPasswordEnv() => $_clearField(5);
+
+  /// Optional PEM PUBLIC key to pin for this store (cosign key-pinning).
+  /// When set, signed modules from this store verify against THIS
+  /// publisher key instead of the global/built-in vendor anchor, so a
+  /// domain publisher signs with its own key without the vendor master.
+  @$pb.TagNumber(6)
+  $core.String get pinnedPubkeyPem => $_getSZ(5);
+  @$pb.TagNumber(6)
+  set pinnedPubkeyPem($core.String value) => $_setString(5, value);
+  @$pb.TagNumber(6)
+  $core.bool hasPinnedPubkeyPem() => $_has(5);
+  @$pb.TagNumber(6)
+  void clearPinnedPubkeyPem() => $_clearField(6);
 }
 
 class AddStoreResponse extends $pb.GeneratedMessage {
diff --git a/lib/src/generated/chain/v1/hub.pbjson.dart b/lib/src/generated/chain/v1/hub.pbjson.dart
index 36a9d71..5e2fd83 100644
--- a/lib/src/generated/chain/v1/hub.pbjson.dart
+++ b/lib/src/generated/chain/v1/hub.pbjson.dart
@@ -1782,6 +1782,7 @@ const AddStoreRequest$json = {
       '5': 9,
       '10': 'basicPasswordEnv'
     },
+    {'1': 'pinned_pubkey_pem', '3': 6, '4': 1, '5': 9, '10': 'pinnedPubkeyPem'},
   ],
 };
 
@@ -1789,7 +1790,8 @@ const AddStoreRequest$json = {
 final $typed_data.Uint8List addStoreRequestDescriptor = $convert.base64Decode(
     'Cg9BZGRTdG9yZVJlcXVlc3QSEgoEbmFtZRgBIAEoCVIEbmFtZRIQCgN1cmwYAiABKAlSA3VybB'
     'IdCgpiZWFyZXJfZW52GAMgASgJUgliZWFyZXJFbnYSHQoKYmFzaWNfdXNlchgEIAEoCVIJYmFz'
-    'aWNVc2VyEiwKEmJhc2ljX3Bhc3N3b3JkX2VudhgFIAEoCVIQYmFzaWNQYXNzd29yZEVudg==');
+    'aWNVc2VyEiwKEmJhc2ljX3Bhc3N3b3JkX2VudhgFIAEoCVIQYmFzaWNQYXNzd29yZEVudhIqCh'
+    'FwaW5uZWRfcHVia2V5X3BlbRgGIAEoCVIPcGlubmVkUHVia2V5UGVt');
 
 @$core.Deprecated('Use addStoreResponseDescriptor instead')
 const AddStoreResponse$json = {
diff --git a/lib/src/hub_client.dart b/lib/src/hub_client.dart
index 3760d3c..ce02381 100644
--- a/lib/src/hub_client.dart
+++ b/lib/src/hub_client.dart
@@ -669,6 +669,7 @@ class HubClient {
     String bearerEnv = '',
     String basicUser = '',
     String basicPasswordEnv = '',
+    String pinnedPubkeyPem = '',
   }) {
     return _admin.addStore(pb.AddStoreRequest(
       name: name,
@@ -676,6 +677,7 @@ class HubClient {
       bearerEnv: bearerEnv,
       basicUser: basicUser,
       basicPasswordEnv: basicPasswordEnv,
+      pinnedPubkeyPem: pinnedPubkeyPem,
     ));
   }