client/src/main/java/info/frostfs/sdk/FrostFSClient.java

@@ -1,6 +1,7 @@
 package info.frostfs.sdk;
 
-import frostfs.session.Types;
+import info.frostfs.sdk.dto.chain.Chain;
+import info.frostfs.sdk.dto.chain.ChainTarget;
 import info.frostfs.sdk.dto.container.Container;
 import info.frostfs.sdk.dto.container.ContainerId;
 import info.frostfs.sdk.dto.netmap.NetmapSnapshot;
@@ -30,10 +31,12 @@ import static info.frostfs.sdk.constants.ErrorConst.VERSION_UNSUPPORTED_TEMPLATE
 import static info.frostfs.sdk.tools.GrpcClient.initGrpcChannel;
 import static java.util.Objects.nonNull;
 
-public class FrostFSClient implements ContainerClient, ObjectClient, NetmapClient, SessionClient, ToolsClient {
+public class FrostFSClient
+        implements ContainerClient, ObjectClient, ApeManagerClient, NetmapClient, SessionClient, ToolsClient {
     private final ContainerClientImpl containerClientImpl;
-    private final NetmapClientImpl netmapClientImpl;
     private final ObjectClientImpl objectClientImpl;
+    private final ApeManagerClientImpl apeManagerClient;
+    private final NetmapClientImpl netmapClientImpl;
     private final SessionClientImpl sessionClientImpl;
     private final ObjectToolsImpl objectToolsImpl;
 
@@ -52,9 +55,10 @@ public class FrostFSClient implements ContainerClient, ObjectClient, NetmapClien
         Validator.validate(clientEnvironment);
 
         this.containerClientImpl = new ContainerClientImpl(clientEnvironment);
+        this.objectClientImpl = new ObjectClientImpl(clientEnvironment);
+        this.apeManagerClient = new ApeManagerClientImpl(clientEnvironment);
         this.netmapClientImpl = new NetmapClientImpl(clientEnvironment);
         this.sessionClientImpl = new SessionClientImpl(clientEnvironment);
-        this.objectClientImpl = new ObjectClientImpl(clientEnvironment);
         this.objectToolsImpl = new ObjectToolsImpl(clientEnvironment);
         checkFrostFsVersionSupport(clientEnvironment.getVersion());
     }
@@ -118,6 +122,21 @@ public class FrostFSClient implements ContainerClient, ObjectClient, NetmapClien
         return objectClientImpl.searchObjects(cid, filters);
     }
 
+    @Override
+    public byte[] addChain(Chain chain, ChainTarget chainTarget) {
+        return apeManagerClient.addChain(chain, chainTarget);
+    }
+
+    @Override
+    public void removeChain(Chain chain, ChainTarget chainTarget) {
+        apeManagerClient.removeChain(chain, chainTarget);
+    }
+
+    @Override
+    public List<Chain> listChains(ChainTarget chainTarget) {
+        return apeManagerClient.listChains(chainTarget);
+    }
+
     @Override
     public NetmapSnapshot getNetmapSnapshot() {
         return netmapClientImpl.getNetmapSnapshot();
@@ -138,7 +157,7 @@ public class FrostFSClient implements ContainerClient, ObjectClient, NetmapClien
         return sessionClientImpl.createSession(expiration);
     }
 
-    public Types.SessionToken createSessionInternal(long expiration) {
+    public frostfs.session.Types.SessionToken createSessionInternal(long expiration) {
         return sessionClientImpl.createSessionInternal(expiration);
     }
 

client/src/main/java/info/frostfs/sdk/services/ApeManagerClient.java

@@ -0,0 +1,14 @@
+package info.frostfs.sdk.services;
+
+import info.frostfs.sdk.dto.chain.Chain;
+import info.frostfs.sdk.dto.chain.ChainTarget;
+
+import java.util.List;
+
+public interface ApeManagerClient {
+    byte[] addChain(Chain chain, ChainTarget chainTarget);
+
+    void removeChain(Chain chain, ChainTarget chainTarget);
+
+    List<Chain> listChains(ChainTarget chainTarget);
+}

client/src/main/java/info/frostfs/sdk/services/impl/ApeManagerClientImpl.java

@@ -0,0 +1,134 @@
+package info.frostfs.sdk.services.impl;
+
+import com.google.protobuf.ByteString;
+import frostfs.ape.Types;
+import frostfs.apemanager.APEManagerServiceGrpc;
+import frostfs.apemanager.Service;
+import info.frostfs.sdk.dto.chain.Chain;
+import info.frostfs.sdk.dto.chain.ChainTarget;
+import info.frostfs.sdk.exceptions.ValidationFrostFSException;
+import info.frostfs.sdk.jdo.ClientEnvironment;
+import info.frostfs.sdk.mappers.chain.ChainMapper;
+import info.frostfs.sdk.mappers.chain.ChainTargetMapper;
+import info.frostfs.sdk.services.ApeManagerClient;
+import info.frostfs.sdk.services.ContextAccessor;
+import info.frostfs.sdk.tools.RequestConstructor;
+import info.frostfs.sdk.tools.RequestSigner;
+import info.frostfs.sdk.tools.Verifier;
+
+import java.util.List;
+import java.util.Map;
+
+import static info.frostfs.sdk.constants.ErrorConst.*;
+import static java.util.Objects.isNull;
+
+public class ApeManagerClientImpl extends ContextAccessor implements ApeManagerClient {
+    private final APEManagerServiceGrpc.APEManagerServiceBlockingStub apeManagerServiceClient;
+
+    public ApeManagerClientImpl(ClientEnvironment clientEnvironment) {
+        super(clientEnvironment);
+        this.apeManagerServiceClient = APEManagerServiceGrpc.newBlockingStub(getContext().getChannel());
+    }
+
+    @Override
+    public byte[] addChain(Chain chain, ChainTarget chainTarget) {
+        if (isNull(chain) || isNull(chainTarget)) {
+            throw new ValidationFrostFSException(
+                    String.format(
+                            PARAMS_ARE_MISSING_TEMPLATE,
+                            String.join(FIELDS_DELIMITER_COMMA, Chain.class.getName(), ChainTarget.class.getName())
+                    )
+            );
+        }
+
+        var request = createAddChainRequest(chain, chainTarget, null);
+
+        var response = apeManagerServiceClient.addChain(request);
+
+        Verifier.checkResponse(response);
+
+        return response.getBody().getChainId().toByteArray();
+    }
+
+    @Override
+    public void removeChain(Chain chain, ChainTarget chainTarget) {
+        if (isNull(chain) || isNull(chainTarget)) {
+            throw new ValidationFrostFSException(
+                    String.format(
+                            PARAMS_ARE_MISSING_TEMPLATE,
+                            String.join(FIELDS_DELIMITER_COMMA, Chain.class.getName(), ChainTarget.class.getName())
+                    )
+            );
+        }
+
+        var request = createRemoveChainRequest(chain, chainTarget, null);
+
+        var response = apeManagerServiceClient.removeChain(request);
+
+        Verifier.checkResponse(response);
+    }
+
+    @Override
+    public List<Chain> listChains(ChainTarget chainTarget) {
+        if (isNull(chainTarget)) {
+            throw new ValidationFrostFSException(String.format(PARAM_IS_MISSING_TEMPLATE, ChainTarget.class.getName()));
+        }
+
+        var request = createListChainsRequest(chainTarget, null);
+
+        var response = apeManagerServiceClient.listChains(request);
+
+        Verifier.checkResponse(response);
+
+        return ChainMapper.toModels(response.getBody().getChainsList());
+    }
+
+    private Service.AddChainRequest createAddChainRequest(Chain chain,
+                                                          ChainTarget chainTarget,
+                                                          Map<String, String> xHeaders) {
+        var chainGrpc = Types.Chain.newBuilder()
+                .setRaw(ByteString.copyFrom(chain.getRaw()))
+                .build();
+        var body = Service.AddChainRequest.Body.newBuilder()
+                .setChain(chainGrpc)
+                .setTarget(ChainTargetMapper.toGrpcMessage(chainTarget))
+                .build();
+        var request = Service.AddChainRequest.newBuilder()
+                .setBody(body);
+
+        RequestConstructor.addMetaHeader(request, xHeaders);
+        RequestSigner.sign(request, getContext().getKey());
+
+        return request.build();
+    }
+
+    private Service.RemoveChainRequest createRemoveChainRequest(Chain chain,
+                                                                ChainTarget chainTarget,
+                                                                Map<String, String> xHeaders) {
+        var body = Service.RemoveChainRequest.Body.newBuilder()
+                .setChainId(ByteString.copyFrom(chain.getRaw()))
+                .setTarget(ChainTargetMapper.toGrpcMessage(chainTarget))
+                .build();
+        var request = Service.RemoveChainRequest.newBuilder()
+                .setBody(body);
+
+        RequestConstructor.addMetaHeader(request, xHeaders);
+        RequestSigner.sign(request, getContext().getKey());
+
+        return request.build();
+    }
+
+    private Service.ListChainsRequest createListChainsRequest(ChainTarget chainTarget,
+                                                              Map<String, String> xHeaders) {
+        var body = Service.ListChainsRequest.Body.newBuilder()
+                .setTarget(ChainTargetMapper.toGrpcMessage(chainTarget))
+                .build();
+        var request = Service.ListChainsRequest.newBuilder()
+                .setBody(body);
+
+        RequestConstructor.addMetaHeader(request, xHeaders);
+        RequestSigner.sign(request, getContext().getKey());
+
+        return request.build();
+    }
+}

client/src/test/java/info/frostfs/sdk/FileUtils.java

@@ -0,0 +1,31 @@
+package info.frostfs.sdk;
+
+import com.google.common.io.ByteStreams;
+import lombok.SneakyThrows;
+import org.apache.commons.lang3.StringUtils;
+
+import java.io.InputStream;
+
+import static java.util.Objects.isNull;
+
+public class FileUtils {
+
+    @SneakyThrows
+    public static byte[] resourceToBytes(String resourcePath) {
+        if (StringUtils.isBlank(resourcePath)) {
+            throw new IllegalArgumentException("Blank filename!");
+        }
+
+        ClassLoader loader = FileUtils.class.getClassLoader();
+        if (isNull(loader)) {
+            throw new RuntimeException("Class loader is null!");
+        }
+
+        InputStream certStream = loader.getResourceAsStream(resourcePath);
+        if (isNull(certStream)) {
+            throw new RuntimeException("Resource could not be found!");
+        }
+
+        return ByteStreams.toByteArray(certStream);
+    }
+}

client/src/test/java/info/frostfs/sdk/services/ApeManagerClientTest.java

@@ -0,0 +1,216 @@
+package info.frostfs.sdk.services;
+
+import frostfs.apemanager.APEManagerServiceGrpc;
+import frostfs.apemanager.Service;
+import info.frostfs.sdk.FileUtils;
+import info.frostfs.sdk.dto.chain.Chain;
+import info.frostfs.sdk.dto.chain.ChainTarget;
+import info.frostfs.sdk.enums.TargetType;
+import info.frostfs.sdk.exceptions.ValidationFrostFSException;
+import info.frostfs.sdk.jdo.ClientEnvironment;
+import info.frostfs.sdk.services.impl.ApeManagerClientImpl;
+import info.frostfs.sdk.testgenerator.ApeManagerGenerator;
+import info.frostfs.sdk.tools.RequestConstructor;
+import info.frostfs.sdk.tools.RequestSigner;
+import info.frostfs.sdk.tools.Verifier;
+import io.grpc.Channel;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.platform.commons.util.ReflectionUtils;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.lang.reflect.Field;
+import java.util.stream.Collectors;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.*;
+
+@ExtendWith(MockitoExtension.class)
+class ApeManagerClientTest {
+    private ApeManagerClientImpl apeManagerClient;
+
+    @Mock
+    private APEManagerServiceGrpc.APEManagerServiceBlockingStub apeManagerServiceClient;
+    @Mock
+    private ClientEnvironment clientEnvironment;
+    @Mock
+    private Channel channel;
+
+    private MockedStatic<Verifier> verifierMock;
+    private MockedStatic<RequestConstructor> requestConstructorMock;
+    private MockedStatic<RequestSigner> requestSignerMock;
+
+    @BeforeEach
+    void setUp() throws IllegalAccessException {
+        when(clientEnvironment.getChannel()).thenReturn(channel);
+        apeManagerClient = new ApeManagerClientImpl(clientEnvironment);
+
+        Field field = ReflectionUtils.findFields(ApeManagerClientImpl.class,
+                        f -> f.getName().equals("apeManagerServiceClient"),
+                        ReflectionUtils.HierarchyTraversalMode.TOP_DOWN)
+                .get(0);
+
+        field.setAccessible(true);
+        field.set(apeManagerClient, apeManagerServiceClient);
+
+        verifierMock = Mockito.mockStatic(Verifier.class);
+        requestConstructorMock = Mockito.mockStatic(RequestConstructor.class);
+        requestSignerMock = Mockito.mockStatic(RequestSigner.class);
+    }
+
+    @AfterEach
+    void cleanUp() {
+        verifierMock.close();
+        requestConstructorMock.close();
+        requestSignerMock.close();
+    }
+
+    @Test
+    void addChain_success() {
+        //Given
+        Chain chain = generateChain();
+        ChainTarget chainTarget = generateChainTarget();
+
+        var response = ApeManagerGenerator.generateAddChainResponse();
+
+        var captor = ArgumentCaptor.forClass(Service.AddChainRequest.class);
+
+        when(apeManagerServiceClient.addChain(captor.capture())).thenReturn(response);
+
+        //When
+        var result = apeManagerClient.addChain(chain, chainTarget);
+
+        //Then
+        requestConstructorMock.verify(
+                () -> RequestConstructor.addMetaHeader(any(Service.AddChainRequest.Builder.class), eq(null)),
+                times(1)
+        );
+        requestSignerMock.verify(
+                () -> RequestSigner.sign(any(Service.AddChainRequest.Builder.class), eq(null)),
+                times(1)
+        );
+        verifierMock.verify(() -> Verifier.checkResponse(response), times(1));
+
+        assertThat(result).containsOnly(response.getBody().getChainId().toByteArray());
+
+        var request = captor.getValue();
+        assertThat(request.getBody().getChain().getRaw().toByteArray()).containsOnly(chain.getRaw());
+        assertEquals(chainTarget.getName(), request.getBody().getTarget().getName());
+        assertEquals(chainTarget.getType().value, request.getBody().getTarget().getType().getNumber());
+    }
+
+    @Test
+    void addChain_wrongParams() {
+        //Given
+        Chain chain = generateChain();
+        ChainTarget chainTarget = generateChainTarget();
+
+        //When + Then
+        assertThrows(ValidationFrostFSException.class, () -> apeManagerClient.addChain(null, chainTarget));
+        assertThrows(ValidationFrostFSException.class, () -> apeManagerClient.addChain(chain, null));
+        assertThrows(ValidationFrostFSException.class, () -> apeManagerClient.addChain(null, null));
+    }
+
+    @Test
+    void removeChain_success() {
+        //Given
+        Chain chain = generateChain();
+        ChainTarget chainTarget = generateChainTarget();
+
+        var response = ApeManagerGenerator.generateRemoveChainResponse();
+
+        var captor = ArgumentCaptor.forClass(Service.RemoveChainRequest.class);
+
+        when(apeManagerServiceClient.removeChain(captor.capture())).thenReturn(response);
+
+        //When
+        apeManagerClient.removeChain(chain, chainTarget);
+
+        //Then
+        requestConstructorMock.verify(
+                () -> RequestConstructor.addMetaHeader(any(Service.RemoveChainRequest.Builder.class), eq(null)),
+                times(1)
+        );
+        requestSignerMock.verify(
+                () -> RequestSigner.sign(any(Service.RemoveChainRequest.Builder.class), eq(null)),
+                times(1)
+        );
+        verifierMock.verify(() -> Verifier.checkResponse(response), times(1));
+
+        var request = captor.getValue();
+        assertThat(request.getBody().getChainId().toByteArray()).containsOnly(chain.getRaw());
+        assertEquals(chainTarget.getName(), request.getBody().getTarget().getName());
+        assertEquals(chainTarget.getType().value, request.getBody().getTarget().getType().getNumber());
+    }
+
+    @Test
+    void removeChain_wrongParams() {
+        //Given
+        Chain chain = generateChain();
+        ChainTarget chainTarget = generateChainTarget();
+
+        //When + Then
+        assertThrows(ValidationFrostFSException.class, () -> apeManagerClient.removeChain(null, chainTarget));
+        assertThrows(ValidationFrostFSException.class, () -> apeManagerClient.removeChain(chain, null));
+        assertThrows(ValidationFrostFSException.class, () -> apeManagerClient.removeChain(null, null));
+    }
+
+    @Test
+    void listChain_success() {
+        //Given
+        ChainTarget chainTarget = generateChainTarget();
+
+        var response = ApeManagerGenerator.generateListChainsResponse();
+
+        var captor = ArgumentCaptor.forClass(Service.ListChainsRequest.class);
+
+        when(apeManagerServiceClient.listChains(captor.capture())).thenReturn(response);
+
+        //When
+        var result = apeManagerClient.listChains(chainTarget);
+
+        //Then
+        requestConstructorMock.verify(
+                () -> RequestConstructor.addMetaHeader(any(Service.ListChainsRequest.Builder.class), eq(null)),
+                times(1)
+        );
+        requestSignerMock.verify(
+                () -> RequestSigner.sign(any(Service.ListChainsRequest.Builder.class), eq(null)),
+                times(1)
+        );
+        verifierMock.verify(() -> Verifier.checkResponse(response), times(1));
+
+        var actual = result.stream().map(Chain::getRaw).collect(Collectors.toList());
+        var expected = response.getBody().getChainsList().stream()
+                .map(chain -> chain.getRaw().toByteArray())
+                .collect(Collectors.toList());
+        assertThat(actual).hasSize(10).containsAll(expected);
+
+        var request = captor.getValue();
+        assertEquals(chainTarget.getName(), request.getBody().getTarget().getName());
+        assertEquals(chainTarget.getType().value, request.getBody().getTarget().getType().getNumber());
+    }
+
+    @Test
+    void listChain_wrongParams() {
+        //When + Then
+        assertThrows(ValidationFrostFSException.class, () -> apeManagerClient.listChains(null));
+    }
+
+    private Chain generateChain() {
+        byte[] chainRaw = FileUtils.resourceToBytes("test_chain_raw.json");
+        return new Chain(chainRaw);
+    }
+
+    private ChainTarget generateChainTarget() {
+        return new ChainTarget("BzQw5HH3feoxFDD5tCT87Y1726qzgLfxEE7wgtoRzB3R", TargetType.NAMESPACE);
+    }
+}

client/src/test/java/info/frostfs/sdk/testgenerator/ApeManagerGenerator.java

@@ -0,0 +1,124 @@
+package info.frostfs.sdk.testgenerator;
+
+import com.google.protobuf.ByteString;
+import frostfs.ape.Types;
+import frostfs.apemanager.Service;
+import info.frostfs.sdk.FileUtils;
+import info.frostfs.sdk.Helper;
+
+import java.util.ArrayList;
+
+public class ApeManagerGenerator {
+
+    private static ByteString generateChainID() {
+        return ByteString.copyFrom(Helper.getByteArrayFromHex("616c6c6f774f626a476574436e72"));
+    }
+
+    private static Types.Chain generateRawChain() {
+        byte[] chainRaw = FileUtils.resourceToBytes("test_chain_raw.json");
+
+        return Types.Chain.newBuilder()
+                .setRaw(ByteString.copyFrom(chainRaw))
+                .build();
+    }
+
+    private static Iterable<Types.Chain> generateRawChains(int size) {
+        var list = new ArrayList<Types.Chain>(size);
+        for (int i = 0; i < size; i++) {
+            list.add(generateRawChain());
+        }
+
+        return list;
+    }
+
+    private static Types.ChainTarget generateChainTarget() {
+        return Types.ChainTarget.newBuilder()
+                .setType(Types.TargetType.CONTAINER)
+                .setName("BzQw5HH3feoxFDD5tCT87Y1726qzgLfxEE7wgtoRzB3R")
+                .build();
+    }
+
+    public static Service.AddChainRequest.Body generateAddChainRequestBody() {
+        return Service.AddChainRequest.Body.newBuilder()
+                .setTarget(generateChainTarget())
+                .setChain(generateRawChain())
+                .build();
+    }
+
+    public static Service.AddChainRequest generateAddChainRequest() {
+        return Service.AddChainRequest.newBuilder()
+                .setBody(generateAddChainRequestBody())
+                .setMetaHeader(SessionGenerator.generateRequestMetaHeader())
+                .setVerifyHeader(SessionGenerator.generateRequestVerificationHeader())
+                .build();
+    }
+
+    public static Service.AddChainResponse.Body generateAddChainResponseBody() {
+        return Service.AddChainResponse.Body.newBuilder()
+                .setChainId(generateChainID())
+                .build();
+    }
+
+    public static Service.AddChainResponse generateAddChainResponse() {
+        return Service.AddChainResponse.newBuilder()
+                .setBody(generateAddChainResponseBody())
+                .setMetaHeader(SessionGenerator.generateResponseMetaHeader())
+                .setVerifyHeader(SessionGenerator.generateResponseVerificationHeader())
+                .build();
+    }
+
+    public static Service.RemoveChainRequest.Body generateRemoveChainRequestBody() {
+        return Service.RemoveChainRequest.Body.newBuilder()
+                .setChainId(generateChainID())
+                .setTarget(generateChainTarget())
+                .build();
+    }
+
+    public static Service.RemoveChainRequest generateRemoveChainRequest() {
+        return Service.RemoveChainRequest.newBuilder()
+                .setBody(generateRemoveChainRequestBody())
+                .setMetaHeader(SessionGenerator.generateRequestMetaHeader())
+                .setVerifyHeader(SessionGenerator.generateRequestVerificationHeader())
+                .build();
+    }
+
+    public static Service.RemoveChainResponse.Body generateRemoveChainResponseBody() {
+        return Service.RemoveChainResponse.Body.getDefaultInstance();
+    }
+
+    public static Service.RemoveChainResponse generateRemoveChainResponse() {
+        return Service.RemoveChainResponse.newBuilder()
+                .setBody(generateRemoveChainResponseBody())
+                .setMetaHeader(SessionGenerator.generateResponseMetaHeader())
+                .setVerifyHeader(SessionGenerator.generateResponseVerificationHeader())
+                .build();
+    }
+
+    public static Service.ListChainsRequest.Body generateListChainsRequestBody() {
+        return Service.ListChainsRequest.Body.newBuilder()
+                .setTarget(generateChainTarget())
+                .build();
+    }
+
+    public static Service.ListChainsRequest generateListChainsRequest() {
+        return Service.ListChainsRequest.newBuilder()
+                .setBody(generateListChainsRequestBody())
+                .setMetaHeader(SessionGenerator.generateRequestMetaHeader())
+                .setVerifyHeader(SessionGenerator.generateRequestVerificationHeader())
+                .build();
+    }
+
+    public static Service.ListChainsResponse.Body generateListChainsResponseBody() {
+        return Service.ListChainsResponse.Body.newBuilder()
+                .addAllChains(generateRawChains(10))
+                .build();
+    }
+
+    public static Service.ListChainsResponse generateListChainsResponse() {
+        return Service.ListChainsResponse.newBuilder()
+                .setBody(generateListChainsResponseBody())
+                .setMetaHeader(SessionGenerator.generateResponseMetaHeader())
+                .setVerifyHeader(SessionGenerator.generateResponseVerificationHeader())
+                .build();
+    }
+}

client/src/test/java/info/frostfs/sdk/testgenerator/RefsGenerator.java

@@ -0,0 +1,65 @@
+package info.frostfs.sdk.testgenerator;
+
+import com.google.protobuf.ByteString;
+import frostfs.refs.Types;
+
+import java.util.Arrays;
+import java.util.Random;
+
+public class RefsGenerator {
+
+    public static Types.Version generateVersion() {
+        return Types.Version.newBuilder()
+                .setMajor(2)
+                .setMinor(1)
+                .build();
+    }
+
+    public static Types.OwnerID generateOwnerID() {
+        return Types.OwnerID.newBuilder()
+                .setValue(ByteString.copyFrom(new byte[]{1, 2, 3}))
+                .build();
+    }
+
+    public static Types.Address generateAddress() {
+        return Types.Address.newBuilder()
+                .setObjectId(generateObjectID())
+                .setContainerId(generateContainerID())
+                .build();
+    }
+
+    public static Types.ObjectID generateObjectID() {
+        return Types.ObjectID.newBuilder()
+                .setValue(ByteString.copyFrom(new byte[]{1, 2, 3}))
+                .build();
+    }
+
+    public static Iterable<Types.ObjectID> generateObjectIDs() {
+        return Arrays.asList(generateObjectID(), generateObjectID());
+    }
+
+    public static Types.ContainerID generateContainerID() {
+        return Types.ContainerID.newBuilder()
+                .setValue(ByteString.copyFrom(new byte[]{1, 2, 3}))
+                .build();
+    }
+
+    public static Iterable<Types.ContainerID> generateContainerIDs() {
+        return Arrays.asList(generateContainerID(), generateContainerID());
+    }
+
+    public static Types.Signature generateSignature() {
+        return Types.Signature.newBuilder()
+                .setKey(ByteString.copyFrom(new byte[]{1}))
+                .setSign(ByteString.copyFrom(new byte[]{2}))
+                .setScheme(Types.SignatureScheme.forNumber(new Random().nextInt(3)))
+                .build();
+    }
+
+    public static Types.Checksum generateChecksum() {
+        return Types.Checksum.newBuilder()
+                .setType(Types.ChecksumType.SHA256)
+                .setSum(ByteString.copyFrom(new byte[]{1, 2, 3}))
+                .build();
+    }
+}

client/src/test/java/info/frostfs/sdk/testgenerator/SessionGenerator.java

@@ -0,0 +1,178 @@
+package info.frostfs.sdk.testgenerator;
+
+import com.google.protobuf.ByteString;
+import frostfs.session.Service;
+import frostfs.session.Types;
+
+import java.util.Arrays;
+import java.util.Random;
+
+public class SessionGenerator {
+
+    public static Service.CreateRequest.Body generateCreateRequestBody() {
+        return Service.CreateRequest.Body.newBuilder()
+                .setExpiration(555)
+                .setOwnerId(RefsGenerator.generateOwnerID())
+                .build();
+    }
+
+    public static Service.CreateRequest generateCreateRequest() {
+        return Service.CreateRequest.newBuilder()
+                .setBody(generateCreateRequestBody())
+                .setMetaHeader(generateRequestMetaHeader())
+                .setVerifyHeader(generateRequestVerificationHeader())
+                .build();
+    }
+
+    public static Service.CreateResponse.Body generateCreateResponseBody() {
+        return Service.CreateResponse.Body.newBuilder()
+                .setId(ByteString.copyFrom(new byte[]{1, 2, 3}))
+                .setSessionKey(ByteString.copyFrom(new byte[]{4, 5, 6}))
+                .build();
+    }
+
+    public static Service.CreateResponse generateCreateResponse() {
+        return Service.CreateResponse.newBuilder()
+                .setBody(generateCreateResponseBody())
+                .setMetaHeader(generateResponseMetaHeader())
+                .setVerifyHeader(generateResponseVerificationHeader())
+                .build();
+    }
+
+    public static Types.ResponseVerificationHeader generateResponseVerificationHeader() {
+        return generateResponseVerificationHeader(true);
+    }
+
+    public static Types.ResponseVerificationHeader generateResponseVerificationHeader(boolean withOrigin) {
+        var builder = Types.ResponseVerificationHeader.newBuilder()
+                .setBodySignature(RefsGenerator.generateSignature())
+                .setMetaSignature(RefsGenerator.generateSignature())
+                .setOriginSignature(RefsGenerator.generateSignature());
+
+        if (withOrigin) {
+            builder.setOrigin(generateResponseVerificationHeader(false));
+        }
+
+        return builder.build();
+    }
+
+    public static Types.ResponseMetaHeader generateResponseMetaHeader() {
+        return generateResponseMetaHeader(true);
+    }
+
+    public static Types.ResponseMetaHeader generateResponseMetaHeader(boolean withOrigin) {
+        var builder = Types.ResponseMetaHeader.newBuilder()
+                .setEpoch(13)
+                .setTtl(100)
+                .addAllXHeaders(generateXHeaders())
+                .setVersion(RefsGenerator.generateVersion())
+                .setStatus(StatusGenerator.generateStatus());
+
+        if (withOrigin) {
+            builder.setOrigin(generateResponseMetaHeader(false));
+        }
+
+        return builder.build();
+    }
+
+    public static Types.RequestVerificationHeader generateRequestVerificationHeader() {
+        return generateRequestVerificationHeader(true);
+    }
+
+    public static Types.RequestVerificationHeader generateRequestVerificationHeader(boolean withOrigin) {
+        var builder = Types.RequestVerificationHeader.newBuilder()
+                .setBodySignature(RefsGenerator.generateSignature())
+                .setMetaSignature(RefsGenerator.generateSignature())
+                .setOriginSignature(RefsGenerator.generateSignature());
+
+        if (withOrigin) {
+            builder.setOrigin(generateRequestVerificationHeader(false));
+        }
+
+        return builder.build();
+    }
+
+    public static Types.RequestMetaHeader generateRequestMetaHeader() {
+        return generateRequestMetaHeader(true);
+    }
+
+    public static Types.RequestMetaHeader generateRequestMetaHeader(boolean withOrigin) {
+        var builder = Types.RequestMetaHeader.newBuilder()
+                .setEpoch(13)
+                .setTtl(100)
+                .setMagicNumber(1337)
+                .addAllXHeaders(generateXHeaders())
+                .setVersion(RefsGenerator.generateVersion())
+                .setSessionToken(generateSessionToken());
+
+        if (withOrigin) {
+            builder.setOrigin(generateRequestMetaHeader(false));
+        }
+
+        return builder.build();
+    }
+
+    public static Types.SessionToken.Body.TokenLifetime generateTokenLifeTime() {
+        return Types.SessionToken.Body.TokenLifetime.newBuilder()
+                .setExp(1)
+                .setIat(2)
+                .setNbf(3)
+                .build();
+    }
+
+    public static Types.SessionToken.Body generateSessionTokenBody() {
+        var builder = Types.SessionToken.Body.newBuilder()
+                .setId(ByteString.copyFrom(new byte[]{1}))
+                .setSessionKey(ByteString.copyFrom(new byte[]{2}))
+                .setOwnerId(RefsGenerator.generateOwnerID())
+                .setLifetime(generateTokenLifeTime());
+
+        if (new Random().nextBoolean()) {
+            builder.setContainer(generateContainerSessionContext());
+        } else {
+            builder.setObject(generateObjectSessionContext());
+        }
+
+        return builder.build();
+    }
+
+    public static Types.SessionToken generateSessionToken() {
+        return Types.SessionToken.newBuilder()
+                .setBody(generateSessionTokenBody())
+                .setSignature(RefsGenerator.generateSignature())
+                .build();
+    }
+
+    public static Types.ObjectSessionContext.Target generateObjectSessionContextTarget() {
+        return Types.ObjectSessionContext.Target.newBuilder()
+                .setContainer(RefsGenerator.generateContainerID())
+                .addObjects(RefsGenerator.generateObjectID())
+                .build();
+    }
+
+    public static Types.ObjectSessionContext generateObjectSessionContext() {
+        return Types.ObjectSessionContext.newBuilder()
+                .setVerb(Types.ObjectSessionContext.Verb.HEAD)
+                .setTarget(generateObjectSessionContextTarget())
+                .build();
+    }
+
+    public static Types.ContainerSessionContext generateContainerSessionContext() {
+        return Types.ContainerSessionContext.newBuilder()
+                .setVerb(Types.ContainerSessionContext.Verb.DELETE)
+                .setWildcard(true)
+                .setContainerId(RefsGenerator.generateContainerID())
+                .build();
+    }
+
+    public static Types.XHeader generateXHeader() {
+        return Types.XHeader.newBuilder()
+                .setKey("key")
+                .setValue("val")
+                .build();
+    }
+
+    public static Iterable<Types.XHeader> generateXHeaders() {
+        return Arrays.asList(generateXHeader(), generateXHeader());
+    }
+}

client/src/test/java/info/frostfs/sdk/testgenerator/StatusGenerator.java

@@ -0,0 +1,29 @@
+package info.frostfs.sdk.testgenerator;
+
+import com.google.protobuf.ByteString;
+import frostfs.status.Types;
+
+import java.util.Arrays;
+
+public class StatusGenerator {
+
+    public static Types.Status.Detail generateDetail() {
+        return Types.Status.Detail.newBuilder()
+                .setId(345)
+                .setValue(ByteString.copyFrom("value".getBytes()))
+                .build();
+    }
+
+    public static Iterable<Types.Status.Detail> generateDetails() {
+        return Arrays.asList(generateDetail(), generateDetail());
+    }
+
+    public static Types.Status generateStatus() {
+        return Types.Status.newBuilder()
+                .setCode(2)
+                .setMessage("some string")
+                .addAllDetails(generateDetails())
+                .build();
+    }
+
+}

client/src/test/resources/test_chain_raw.json

@@ -0,0 +1,30 @@
+{
+  "ID": "",
+  "Rules": [
+    {
+      "Status": "Allow",
+      "Actions": {
+        "Inverted": false,
+        "Names": [
+          "GetObject"
+        ]
+      },
+      "Resources": {
+        "Inverted": false,
+        "Names": [
+          "native:object/*"
+        ]
+      },
+      "Any": false,
+      "Condition": [
+        {
+          "Op": "StringEquals",
+          "Object": "Resource",
+          "Key": "Department",
+          "Value": "HR"
+        }
+      ]
+    }
+  ],
+  "MatchType": "DenyPriority"
+}

cryptography/src/main/java/info/frostfs/sdk/Helper.java

@@ -3,6 +3,7 @@ package info.frostfs.sdk;
 import com.google.protobuf.ByteString;
 import com.google.protobuf.Message;
 import info.frostfs.sdk.exceptions.ValidationFrostFSException;
+import org.apache.commons.lang3.StringUtils;
 import org.bouncycastle.crypto.digests.RIPEMD160Digest;
 
 import java.math.BigInteger;
@@ -15,6 +16,7 @@ import static java.util.Objects.isNull;
 public class Helper {
     private static final String SHA256 = "SHA-256";
     private static final int RIPEMD_160_HASH_BYTE_LENGTH = 20;
+    private static final int HEX_RADIX = 16;
 
     private Helper() {
     }
@@ -62,4 +64,12 @@ public class Helper {
 
         return String.format("%0" + (value.length << 1) + "x", new BigInteger(1, value));
     }
+
+    public static byte[] getByteArrayFromHex(String hex) {
+        if (StringUtils.isBlank(hex)) {
+            throw new ValidationFrostFSException(INPUT_PARAM_IS_MISSING);
+        }
+
+        return new BigInteger(hex, HEX_RADIX).toByteArray();
+    }
 }

cryptography/src/test/java/info/frostfs/sdk/HelperTest.java

@@ -108,4 +108,23 @@ public class HelperTest {
         assertThrows(ValidationFrostFSException.class, () -> Helper.getHexString(null));
         assertThrows(ValidationFrostFSException.class, () -> Helper.getHexString(new byte[]{}));
     }
+
+    @Test
+    void getByteArrayFromHex_success() {
+        //Given
+        var value = "0102030405";
+
+        //When
+        var result = Helper.getByteArrayFromHex(value);
+
+        //Then
+        assertThat(result).containsOnly(new byte[]{1, 2, 3, 4, 5});
+    }
+
+    @Test
+    void getByteArrayFromHex_wrong() {
+        //When + Then
+        assertThrows(ValidationFrostFSException.class, () -> Helper.getByteArrayFromHex(null));
+        assertThrows(ValidationFrostFSException.class, () -> Helper.getByteArrayFromHex(""));
+    }
 }

models/src/main/java/info/frostfs/sdk/dto/chain/Chain.java

@@ -0,0 +1,10 @@
+package info.frostfs.sdk.dto.chain;
+
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+
+@Getter
+@AllArgsConstructor
+public class Chain {
+    private final byte[] raw;
+}

models/src/main/java/info/frostfs/sdk/dto/chain/ChainTarget.java

@@ -0,0 +1,17 @@
+package info.frostfs.sdk.dto.chain;
+
+import info.frostfs.sdk.enums.TargetType;
+import lombok.EqualsAndHashCode;
+import lombok.Getter;
+
+@Getter
+@EqualsAndHashCode
+public class ChainTarget {
+    private final TargetType type;
+    private final String name;
+
+    public ChainTarget(String name, TargetType type) {
+        this.name = name;
+        this.type = type;
+    }
+}

models/src/main/java/info/frostfs/sdk/enums/TargetType.java

@@ -0,0 +1,34 @@
+package info.frostfs.sdk.enums;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+
+public enum TargetType {
+    UNDEFINED(0),
+    NAMESPACE(1),
+    CONTAINER(2),
+    USER(3),
+    GROUP(4),
+    ;
+
+    private static final Map<Integer, TargetType> ENUM_MAP_BY_VALUE;
+
+    static {
+        Map<Integer, TargetType> map = new HashMap<>();
+        for (TargetType targetType : TargetType.values()) {
+            map.put(targetType.value, targetType);
+        }
+        ENUM_MAP_BY_VALUE = Collections.unmodifiableMap(map);
+    }
+
+    public final int value;
+
+    TargetType(int value) {
+        this.value = value;
+    }
+
+    public static TargetType get(int value) {
+        return ENUM_MAP_BY_VALUE.get(value);
+    }
+}

models/src/main/java/info/frostfs/sdk/mappers/chain/ChainMapper.java

@@ -0,0 +1,31 @@
+package info.frostfs.sdk.mappers.chain;
+
+import frostfs.ape.Types;
+import info.frostfs.sdk.dto.chain.Chain;
+import org.apache.commons.collections4.CollectionUtils;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import static java.util.Objects.isNull;
+
+public class ChainMapper {
+    private ChainMapper() {
+    }
+
+    public static List<Chain> toModels(List<Types.Chain> chains) {
+        if (CollectionUtils.isEmpty(chains)) {
+            return null;
+        }
+
+        return chains.stream().map(ChainMapper::toModel).collect(Collectors.toList());
+    }
+
+    public static Chain toModel(Types.Chain chain) {
+        if (isNull(chain) || chain.getSerializedSize() == 0) {
+            return null;
+        }
+
+        return new Chain(chain.getRaw().toByteArray());
+    }
+}

models/src/main/java/info/frostfs/sdk/mappers/chain/ChainTargetMapper.java

@@ -0,0 +1,33 @@
+package info.frostfs.sdk.mappers.chain;
+
+import frostfs.ape.Types;
+import info.frostfs.sdk.dto.chain.ChainTarget;
+import info.frostfs.sdk.exceptions.ProcessFrostFSException;
+
+import static info.frostfs.sdk.constants.ErrorConst.UNKNOWN_ENUM_VALUE_TEMPLATE;
+import static java.util.Objects.isNull;
+
+public class ChainTargetMapper {
+    private ChainTargetMapper() {
+    }
+
+    public static Types.ChainTarget toGrpcMessage(ChainTarget chainTarget) {
+        if (isNull(chainTarget)) {
+            return null;
+        }
+
+        var targetType = Types.TargetType.forNumber(chainTarget.getType().value);
+        if (isNull(targetType)) {
+            throw new ProcessFrostFSException(String.format(
+                    UNKNOWN_ENUM_VALUE_TEMPLATE,
+                    Types.ChainTarget.class.getName(),
+                    chainTarget.getType().name()
+            ));
+        }
+
+        return Types.ChainTarget.newBuilder()
+                .setType(targetType)
+                .setName(chainTarget.getName())
+                .build();
+    }
+}

models/src/test/java/info/frostfs/sdk/mappers/chain/ChainMapperTest.java

@@ -0,0 +1,64 @@
+package info.frostfs.sdk.mappers.chain;
+
+import com.google.protobuf.ByteString;
+import frostfs.ape.Types;
+import org.junit.jupiter.api.Test;
+
+import java.util.Collections;
+import java.util.List;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+public class ChainMapperTest {
+
+    @Test
+    void toModels_success() {
+        //Given
+        var chain1 = Types.Chain.newBuilder()
+                .setRaw(ByteString.copyFrom(new byte[]{1, 2, 3, 4, 5}))
+                .build();
+        var chain2 = Types.Chain.newBuilder()
+                .setRaw(ByteString.copyFrom(new byte[]{6, 7, 8, 9, 10}))
+                .build();
+
+        //When
+        var result = ChainMapper.toModels(List.of(chain1, chain2));
+
+        //Then
+        assertNotNull(result);
+        assertThat(result).hasSize(2);
+        assertThat(result.get(0).getRaw()).containsOnly(chain1.getRaw().toByteArray());
+        assertThat(result.get(1).getRaw()).containsOnly(chain2.getRaw().toByteArray());
+    }
+
+    @Test
+    void toModels_null() {
+        //When + Then
+        assertNull(ChainMapper.toModels(null));
+        assertNull(ChainMapper.toModels(Collections.emptyList()));
+    }
+
+    @Test
+    void toModel_success() {
+        //Given
+        var chain = Types.Chain.newBuilder()
+                .setRaw(ByteString.copyFrom(new byte[]{1, 2, 3, 4, 5}))
+                .build();
+
+        //When
+        var result = ChainMapper.toModel(chain);
+
+        //Then
+        assertNotNull(result);
+        assertThat(result.getRaw()).containsOnly(chain.getRaw().toByteArray());
+    }
+
+    @Test
+    void toModel_null() {
+        //When + Then
+        assertNull(ChainMapper.toModel(null));
+        assertNull(ChainMapper.toModel(Types.Chain.getDefaultInstance()));
+    }
+}

models/src/test/java/info/frostfs/sdk/mappers/chain/ChainTargetMapperTest.java

@@ -0,0 +1,52 @@
+package info.frostfs.sdk.mappers.chain;
+
+import frostfs.ape.Types;
+import info.frostfs.sdk.dto.chain.ChainTarget;
+import info.frostfs.sdk.enums.TargetType;
+import info.frostfs.sdk.exceptions.ProcessFrostFSException;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.EnumSource;
+import org.mockito.MockedStatic;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.mockStatic;
+
+public class ChainTargetMapperTest {
+
+    @ParameterizedTest
+    @EnumSource(value = TargetType.class)
+    void toGrpcMessage_success(TargetType targetType) {
+        //Given
+        var target = new ChainTarget("BzQw5HH3feoxFDD5tCT87Y1726qzgLfxEE7wgtoRzB3R", targetType);
+
+
+        //When
+        var result = ChainTargetMapper.toGrpcMessage(target);
+
+        //Then
+        assertNotNull(result);
+        assertEquals(target.getName(), result.getName());
+        assertEquals(target.getType().value, result.getTypeValue());
+    }
+
+    @Test
+    void toGrpcMessage_null() {
+        //When + Then
+        assertNull(ChainTargetMapper.toGrpcMessage(null));
+    }
+
+    @Test
+    void toGrpcMessage_notValidScheme() {
+        //Given
+        var target = new ChainTarget("BzQw5HH3feoxFDD5tCT87Y1726qzgLfxEE7wgtoRzB3R", TargetType.UNDEFINED);
+
+        //When + Then
+        try (MockedStatic<Types.TargetType> mockStatic = mockStatic(Types.TargetType.class)) {
+            mockStatic.when(() -> Types.TargetType.forNumber(target.getType().value))
+                    .thenReturn(null);
+
+            assertThrows(ProcessFrostFSException.class, () -> ChainTargetMapper.toGrpcMessage(target));
+        }
+    }
+}

models/src/test/java/info/frostfs/sdk/mappers/object/ObjectFilterMapperTest.java

@@ -39,7 +39,7 @@ public class ObjectFilterMapperTest {
     }
 
     @Test
-    void toGrpcMessage_notValidScheme() {
+    void toGrpcMessage_notValidType() {
         //Given
         var objectFilter = new ObjectFilter.FilterByAttribute(UNSPECIFIED, "key", "value");
 

pom.xml

@@ -21,7 +21,7 @@
         <maven.compiler.target>11</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <checkstyle.config.location>checkstyle.xml</checkstyle.config.location>
-        <mockito.version>5.12.0</mockito.version>
+        <mockito.version>5.14.2</mockito.version>
         <junit.version>5.10.3</junit.version>
         <assertj.version>3.26.3</assertj.version>
         <lombok.version>1.18.34</lombok.version>
@@ -64,6 +64,12 @@
             <version>${mockito.version}</version>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.mockito</groupId>
+            <artifactId>mockito-junit-jupiter</artifactId>
+            <version>${mockito.version}</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>

protos/src/main/proto/accounting/service.proto

@@ -2,20 +2,19 @@ syntax = "proto3";
 
 package neo.fs.v2.accounting;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/accounting/grpc;accounting";
 option java_package = "frostfs.accounting";
 
 import "accounting/types.proto";
 import "refs/types.proto";
 import "session/types.proto";
 
-// Accounting service provides methods for interaction with NeoFS sidechain via
+// Accounting service provides methods for interaction with FrostFS sidechain
-// other NeoFS nodes to get information about the account balance. Deposit and
+// via other FrostFS nodes to get information about the account balance. Deposit
-// Withdraw operations can't be implemented here, as they require Mainnet NeoFS
+// and Withdraw operations can't be implemented here, as they require Mainnet
-// smart contract invocation. Transfer operations between internal NeoFS
+// FrostFS smart contract invocation. Transfer operations between internal
-// accounts are possible if both use the same token type.
+// FrostFS accounts are possible if both use the same token type.
 service AccountingService {
-  // Returns the amount of funds in GAS token for the requested NeoFS account.
+  // Returns the amount of funds in GAS token for the requested FrostFS account.
   //
   // Statuses:
   // - **OK** (0, SECTION_SUCCESS):
@@ -27,9 +26,9 @@ service AccountingService {
 // BalanceRequest message
 message BalanceRequest {
   // To indicate the account for which the balance is requested, its identifier
-  // is used. It can be any existing account in NeoFS sidechain `Balance` smart
+  // is used. It can be any existing account in FrostFS sidechain `Balance`
-  // contract. If omitted, client implementation MUST set it to the request's
+  // smart contract. If omitted, client implementation MUST set it to the
-  // signer `OwnerID`.
+  // request's signer `OwnerID`.
   message Body {
     // Valid user identifier in `OwnerID` format for which the balance is
     // requested. Required field.

protos/src/main/proto/accounting/types.proto

@@ -2,10 +2,9 @@ syntax = "proto3";
 
 package neo.fs.v2.accounting;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/accounting/grpc;accounting";
 option java_package = "frostfs.accounting";
 
-// Standard floating point data type can't be used in NeoFS due to inexactness
+// Standard floating point data type can't be used in FrostFS due to inexactness
 // of the result when doing lots of small number operations. To solve the lost
 // precision issue, special `Decimal` format is used for monetary computations.
 //

protos/src/main/proto/acl/types.proto

@@ -2,10 +2,10 @@ syntax = "proto3";
 
 package neo.fs.v2.acl;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/acl/grpc;acl";
 option java_package = "frostfs.acl";
 
 import "refs/types.proto";
+import "ape/types.proto";
 
 // Target role of the access control rule in access control list.
 enum Role {
@@ -88,14 +88,14 @@ enum HeaderType {
   // Filter object headers
   OBJECT = 2;
 
-  // Filter service headers. These are not processed by NeoFS nodes and
+  // Filter service headers. These are not processed by FrostFS nodes and
   // exist for service use only.
   SERVICE = 3;
 }
 
 // Describes a single eACL rule.
 message EACLRecord {
-  // NeoFS request Verb to match
+  // FrostFS request Verb to match
   Operation operation = 1 [ json_name = "operation" ];
 
   // Rule execution result. Either allows or denies access if filters match.
@@ -164,7 +164,7 @@ message EACLRecord {
 // Extended ACL rules table. A list of ACL rules defined additionally to Basic
 // ACL. Extended ACL rules can be attached to a container and can be updated
 // or may be defined in `BearerToken` structure. Please see the corresponding
-// NeoFS Technical Specification section for detailed description.
+// FrostFS Technical Specification section for detailed description.
 message EACLTable {
   // eACL format version. Effectively, the version of API library used to create
   // eACL Table.
@@ -194,6 +194,9 @@ message BearerToken {
     // container. If it contains `container_id` field, bearer token is only
     // valid for this specific container. Otherwise, any container of the same
     // owner is allowed.
+    //
+    // Deprecated: eACL tables are no longer relevant - `APEOverrides` should be
+    // used instead.
     EACLTable eacl_table = 1 [ json_name = "eaclTable" ];
 
     // `OwnerID` defines to whom the token was issued. It must match the request
@@ -218,6 +221,24 @@ message BearerToken {
     // AllowImpersonate flag to consider token signer as request owner.
     // If this field is true extended ACL table in token body isn't processed.
     bool allow_impersonate = 4 [ json_name = "allowImpersonate" ];
+
+    // APEOverride is the list of APE chains defined for a target.
+    // These chains are meant to serve as overrides to the already defined (or
+    // even undefined) APE chains for the target (see contract `Policy`).
+    //
+    // The server-side processing of the bearer token with set APE overrides
+    // must verify if a client is permitted to override chains for the target,
+    // preventing unauthorized access through the APE mechanism.
+    message APEOverride {
+      // Target for which chains are applied.
+      frostfs.v2.ape.ChainTarget target = 1 [ json_name = "target" ];
+
+      // The list of APE chains.
+      repeated frostfs.v2.ape.Chain chains = 2 [ json_name = "chains" ];
+    }
+
+    // APE override for the target.
+    APEOverride ape_override = 5 [ json_name = "apeOverride" ];
   }
   // Bearer Token body
   Body body = 1 [ json_name = "body" ];

protos/src/main/proto/ape/types.proto

@@ -1,9 +1,8 @@
 syntax = "proto3";
 
-package frostfs.v2.apemanager;
+package frostfs.v2.ape;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/apemanager/grpc;apemanager";
+option java_package = "frostfs.ape";
-option java_package = "frostfs.apemanager";
 
 // TargetType is a type target to which a rule chain is defined.
 enum TargetType {

protos/src/main/proto/apemanager/service.proto

@@ -2,12 +2,11 @@ syntax = "proto3";
 
 package frostfs.v2.apemanager;
 
-import "apemanager/types.proto";
-import "session/types.proto";
-
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/apemanager/grpc;apemanager";
 option java_package = "frostfs.apemanager";
 
+import "ape/types.proto";
+import "session/types.proto";
+
 // `APEManagerService` provides API to manage rule chains within sidechain's
 // `Policy` smart contract.
 service APEManagerService {
@@ -53,10 +52,10 @@ service APEManagerService {
 message AddChainRequest {
   message Body {
     // A target for which a rule chain is added.
-    ChainTarget target = 1;
+    frostfs.v2.ape.ChainTarget target = 1;
 
     // The chain to set for the target.
-    Chain chain = 2;
+    frostfs.v2.ape.Chain chain = 2;
   }
 
   // The request's body.
@@ -96,7 +95,7 @@ message AddChainResponse {
 message RemoveChainRequest {
   message Body {
     // Target for which a rule chain is removed.
-    ChainTarget target = 1;
+    frostfs.v2.ape.ChainTarget target = 1;
 
     // Chain ID assigned for the rule chain.
     bytes chain_id = 2;
@@ -136,7 +135,7 @@ message RemoveChainResponse {
 message ListChainsRequest {
   message Body {
     // Target for which rule chains are listed.
-    ChainTarget target = 1;
+    frostfs.v2.ape.ChainTarget target = 1;
   }
 
   // The request's body.
@@ -155,7 +154,7 @@ message ListChainsRequest {
 message ListChainsResponse {
   message Body {
     // The list of chains defined for the reqeusted target.
-    repeated Chain chains = 1;
+    repeated frostfs.v2.ape.Chain chains = 1;
   }
 
   // The response's body.
@@ -169,4 +168,4 @@ message ListChainsResponse {
   // authenticate the nodes of the message route and check the correctness of
   // transmission.
   neo.fs.v2.session.ResponseVerificationHeader verify_header = 3;
-}
+}

protos/src/main/proto/container/service.proto

@@ -2,17 +2,15 @@ syntax = "proto3";
 
 package neo.fs.v2.container;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/container/grpc;container";
 option java_package = "frostfs.container";
 
-import "acl/types.proto";
 import "container/types.proto";
 import "refs/types.proto";
 import "session/types.proto";
 
 // `ContainerService` provides API to interact with `Container` smart contract
-// in NeoFS sidechain via other NeoFS nodes. All of those actions can be done
+// in FrostFS sidechain via other FrostFS nodes. All of those actions can be
-// equivalently by directly issuing transactions and RPC calls to sidechain
+// done equivalently by directly issuing transactions and RPC calls to sidechain
 // nodes.
 service ContainerService {
   // `Put` invokes `Container` smart contract's `Put` method and returns
@@ -25,7 +23,7 @@ service ContainerService {
   //   request to save the container has been sent to the sidechain;
   // - Common failures (SECTION_FAILURE_COMMON);
   // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   container create access denied. 
+  //   container create access denied.
   rpc Put(PutRequest) returns (PutResponse);
 
   // `Delete` invokes `Container` smart contract's `Delete` method and returns
@@ -38,7 +36,7 @@ service ContainerService {
   //   request to remove the container has been sent to the sidechain;
   // - Common failures (SECTION_FAILURE_COMMON);
   // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   container delete access denied. 
+  //   container delete access denied.
   rpc Delete(DeleteRequest) returns (DeleteResponse);
 
   // Returns container structure from `Container` smart contract storage.
@@ -50,7 +48,7 @@ service ContainerService {
   // - **CONTAINER_NOT_FOUND** (3072, SECTION_CONTAINER): \
   //   requested container not found;
   // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   access to container is denied. 
+  //   access to container is denied.
   rpc Get(GetRequest) returns (GetResponse);
 
   // Returns all owner's containers from 'Container` smart contract' storage.
@@ -60,47 +58,11 @@ service ContainerService {
   //   container list has been successfully read;
   // - Common failures (SECTION_FAILURE_COMMON);
   // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   container list access denied.  
+  //   container list access denied.
   rpc List(ListRequest) returns (ListResponse);
-
-  // Invokes 'SetEACL' method of 'Container` smart contract and returns response
-  // immediately. After one more block in sidechain, changes in an Extended ACL
-  // are added into smart contract storage.
-  //
-  // Statuses:
-  // - **OK** (0, SECTION_SUCCESS): \
-  //   request to save container eACL has been sent to the sidechain;
-  // - Common failures (SECTION_FAILURE_COMMON);
-  // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   set container eACL access denied.  
-  rpc SetExtendedACL(SetExtendedACLRequest) returns (SetExtendedACLResponse);
-
-  // Returns Extended ACL table and signature from `Container` smart contract
-  // storage.
-  //
-  // Statuses:
-  // - **OK** (0, SECTION_SUCCESS): \
-  //   container eACL has been successfully read;
-  // - Common failures (SECTION_FAILURE_COMMON);
-  // - **CONTAINER_NOT_FOUND** (3072, SECTION_CONTAINER): \
-  //   container not found;
-  // - **EACL_NOT_FOUND** (3073, SECTION_CONTAINER): \
-  //   eACL table not found;
-  // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   access to container eACL is denied.  
-  rpc GetExtendedACL(GetExtendedACLRequest) returns (GetExtendedACLResponse);
-
-  // Announces the space values used by the container for P2P synchronization.
-  //
-  // Statuses:
-  // - **OK** (0, SECTION_SUCCESS): \
-  //   estimation of used space has been successfully announced;
-  // - Common failures (SECTION_FAILURE_COMMON).
-  rpc AnnounceUsedSpace(AnnounceUsedSpaceRequest)
-      returns (AnnounceUsedSpaceResponse);
 }
 
-// New NeoFS Container creation request
+// New FrostFS Container creation request
 message PutRequest {
   // Container creation request has container structure's signature as a
   // separate field. It's not stored in sidechain, just verified on container
@@ -108,7 +70,7 @@ message PutRequest {
   // the stable-marshalled container strucutre, hence there is no need for
   // additional signature checks.
   message Body {
-    // Container structure to register in NeoFS
+    // Container structure to register in FrostFS
     container.Container container = 1;
 
     // Signature of a stable-marshalled container according to RFC-6979.
@@ -127,7 +89,7 @@ message PutRequest {
   neo.fs.v2.session.RequestVerificationHeader verify_header = 3;
 }
 
-// New NeoFS Container creation response
+// New FrostFS Container creation response
 message PutResponse {
   // Container put response body contains information about the newly registered
   // container as seen by `Container` smart contract. `ContainerID` can be
@@ -156,7 +118,7 @@ message DeleteRequest {
   // the container owner's intent. The signature will be verified by `Container`
   // smart contract, so signing algorithm must be supported by NeoVM.
   message Body {
-    // Identifier of the container to delete from NeoFS
+    // Identifier of the container to delete from FrostFS
     neo.fs.v2.refs.ContainerID container_id = 1;
 
     // `ContainerID` signed with the container owner's key according to
@@ -282,150 +244,3 @@ message ListResponse {
   // transmission.
   neo.fs.v2.session.ResponseVerificationHeader verify_header = 3;
 }
-
-// Set Extended ACL
-message SetExtendedACLRequest {
-  // Set Extended ACL request body does not have separate `ContainerID`
-  // reference. It will be taken from `EACLTable.container_id` field.
-  message Body {
-    // Extended ACL table to set for the container
-    neo.fs.v2.acl.EACLTable eacl = 1;
-
-    // Signature of stable-marshalled Extended ACL table according to RFC-6979.
-    neo.fs.v2.refs.SignatureRFC6979 signature = 2;
-  }
-  // Body of set extended acl request message.
-  Body body = 1;
-
-  // Carries request meta information. Header data is used only to regulate
-  // message transport and does not affect request execution.
-  neo.fs.v2.session.RequestMetaHeader meta_header = 2;
-
-  // Carries request verification information. This header is used to
-  // authenticate the nodes of the message route and check the correctness of
-  // transmission.
-  neo.fs.v2.session.RequestVerificationHeader verify_header = 3;
-}
-
-// Set Extended ACL
-message SetExtendedACLResponse {
-  // `SetExtendedACLResponse` has an empty body because the operation is
-  // asynchronous and the update should be reflected in `Container` smart
-  // contract's storage after next block is issued in sidechain.
-  message Body {}
-
-  // Body of set extended acl response message.
-  Body body = 1;
-
-  // Carries response meta information. Header data is used only to regulate
-  // message transport and does not affect request execution.
-  neo.fs.v2.session.ResponseMetaHeader meta_header = 2;
-
-  // Carries response verification information. This header is used to
-  // authenticate the nodes of the message route and check the correctness of
-  // transmission.
-  neo.fs.v2.session.ResponseVerificationHeader verify_header = 3;
-}
-
-// Get Extended ACL
-message GetExtendedACLRequest {
-  // Get Extended ACL request body
-  message Body {
-    // Identifier of the container having Extended ACL
-    neo.fs.v2.refs.ContainerID container_id = 1;
-  }
-
-  // Body of get extended acl request message.
-  Body body = 1;
-
-  // Carries request meta information. Header data is used only to regulate
-  // message transport and does not affect request execution.
-  neo.fs.v2.session.RequestMetaHeader meta_header = 2;
-
-  // Carries request verification information. This header is used to
-  // authenticate the nodes of the message route and check the correctness of
-  // transmission.
-  neo.fs.v2.session.RequestVerificationHeader verify_header = 3;
-}
-
-// Get Extended ACL
-message GetExtendedACLResponse {
-  // Get Extended ACL Response body can be empty if the requested container does
-  // not have Extended ACL Table attached or Extended ACL has not been allowed
-  // at the time of container creation.
-  message Body {
-    // Extended ACL requested, if available
-    neo.fs.v2.acl.EACLTable eacl = 1;
-
-    // Signature of stable-marshalled Extended ACL according to RFC-6979.
-    neo.fs.v2.refs.SignatureRFC6979 signature = 2;
-
-    // Session token if Extended ACL was set within a session
-    neo.fs.v2.session.SessionToken session_token = 3;
-  }
-  // Body of get extended acl response message.
-  Body body = 1;
-
-  // Carries response meta information. Header data is used only to regulate
-  // message transport and does not affect request execution.
-  neo.fs.v2.session.ResponseMetaHeader meta_header = 2;
-
-  // Carries response verification information. This header is used to
-  // authenticate the nodes of the message route and check the correctness of
-  // transmission.
-  neo.fs.v2.session.ResponseVerificationHeader verify_header = 3;
-}
-
-// Announce container used space
-message AnnounceUsedSpaceRequest {
-  // Container used space announcement body.
-  message Body {
-    // Announcement contains used space information for a single container.
-    message Announcement {
-      // Epoch number for which the container size estimation was produced.
-      uint64 epoch = 1;
-
-      // Identifier of the container.
-      neo.fs.v2.refs.ContainerID container_id = 2;
-
-      // Used space is a sum of object payload sizes of a specified
-      // container, stored in the node. It must not include inhumed objects.
-      uint64 used_space = 3;
-    }
-
-    // List of announcements. If nodes share several containers,
-    // announcements are transferred in a batch.
-    repeated Announcement announcements = 1;
-  }
-
-  // Body of announce used space request message.
-  Body body = 1;
-
-  // Carries request meta information. Header data is used only to regulate
-  // message transport and does not affect request execution.
-  neo.fs.v2.session.RequestMetaHeader meta_header = 2;
-
-  // Carries request verification information. This header is used to
-  // authenticate the nodes of the message route and check the correctness of
-  // transmission.
-  neo.fs.v2.session.RequestVerificationHeader verify_header = 3;
-}
-
-// Announce container used space
-message AnnounceUsedSpaceResponse {
-  // `AnnounceUsedSpaceResponse` has an empty body because announcements are
-  // one way communication.
-  message Body {}
-
-  // Body of announce used space response message.
-  Body body = 1;
-
-  // Carries response meta information. Header data is used only to regulate
-  // message transport and does not affect request execution.
-  neo.fs.v2.session.ResponseMetaHeader meta_header = 2;
-
-  // Carries response verification information. This header is used to
-  // authenticate the nodes of the message route and check the correctness of
-  // transmission.
-  neo.fs.v2.session.ResponseVerificationHeader verify_header = 3;
-}

protos/src/main/proto/container/types.proto

@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package neo.fs.v2.container;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/container/grpc;container";
 option java_package = "frostfs.container";
 
 import "netmap/types.proto";
@@ -50,7 +49,7 @@ message Container {
   //   (`__NEOFS__DISABLE_HOMOMORPHIC_HASHING` is deprecated) \
   //   Disables homomorphic hashing for the container if the value equals "true"
   //   string. Any other values are interpreted as missing attribute. Container
-  //   could be accepted in a NeoFS network only if the global network hashing
+  //   could be accepted in a FrostFS network only if the global network hashing
   //   configuration value corresponds with that attribute's value. After
   //   container inclusion, network setting is ignored.
   //

protos/src/main/proto/lock/types.proto

@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package neo.fs.v2.lock;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/lock/grpc;lock";
 option java_package = "frostfs.lock";
 
 import "refs/types.proto";

protos/src/main/proto/netmap/service.proto

@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package neo.fs.v2.netmap;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/netmap/grpc;netmap";
 option java_package = "frostfs.netmap";
 
 import "netmap/types.proto";
@@ -12,7 +11,7 @@ import "session/types.proto";
 // `NetmapService` provides methods to work with `Network Map` and the
 // information required to build it. The resulting `Network Map` is stored in
 // sidechain `Netmap` smart contract, while related information can be obtained
-// from other NeoFS nodes.
+// from other FrostFS nodes.
 service NetmapService {
   // Get NodeInfo structure from the particular node directly.
   // Node information can be taken from `Netmap` smart contract. In some cases,
@@ -27,7 +26,7 @@ service NetmapService {
   // - Common failures (SECTION_FAILURE_COMMON).
   rpc LocalNodeInfo(LocalNodeInfoRequest) returns (LocalNodeInfoResponse);
 
-  // Read recent information about the NeoFS network.
+  // Read recent information about the FrostFS network.
   //
   // Statuses:
   // - **OK** (0, SECTION_SUCCESS):
@@ -35,7 +34,7 @@ service NetmapService {
   // - Common failures (SECTION_FAILURE_COMMON).
   rpc NetworkInfo(NetworkInfoRequest) returns (NetworkInfoResponse);
 
-  // Returns network map snapshot of the current NeoFS epoch.
+  // Returns network map snapshot of the current FrostFS epoch.
   //
   // Statuses:
   // - **OK** (0, SECTION_SUCCESS):
@@ -65,7 +64,7 @@ message LocalNodeInfoRequest {
 message LocalNodeInfoResponse {
   // Local Node Info, including API Version in use.
   message Body {
-    // Latest NeoFS API version in use
+    // Latest FrostFS API version in use
     neo.fs.v2.refs.Version version = 1;
 
     // NodeInfo structure with recent information from node itself

protos/src/main/proto/netmap/types.proto

@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package neo.fs.v2.netmap;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/netmap/grpc;netmap";
 option java_package = "frostfs.netmap";
 
 // Operations on filters
@@ -36,6 +35,9 @@ enum Operation {
 
   // Logical negation
   NOT = 9;
+
+  // Matches pattern
+  LIKE = 10;
 }
 
 // Selector modifier shows how the node set will be formed. By default selector
@@ -119,7 +121,7 @@ message PlacementPolicy {
   // bucket
   repeated Replica replicas = 1 [ json_name = "replicas" ];
 
-  // Container backup factor controls how deep NeoFS will search for nodes
+  // Container backup factor controls how deep FrostFS will search for nodes
   // alternatives to include into container's nodes subset
   uint32 container_backup_factor = 2 [ json_name = "containerBackupFactor" ];
 
@@ -133,25 +135,25 @@ message PlacementPolicy {
   bool unique = 5 [ json_name = "unique" ];
 }
 
-// NeoFS node description
+// FrostFS node description
 message NodeInfo {
-  // Public key of the NeoFS node in a binary format
+  // Public key of the FrostFS node in a binary format
   bytes public_key = 1 [ json_name = "publicKey" ];
 
   // Ways to connect to a node
   repeated string addresses = 2 [ json_name = "addresses" ];
 
-  // Administrator-defined Attributes of the NeoFS Storage Node.
+  // Administrator-defined Attributes of the FrostFS Storage Node.
   //
   // `Attribute` is a Key-Value metadata pair. Key name must be a valid UTF-8
   // string. Value can't be empty.
   //
   // Attributes can be constructed into a chain of attributes: any attribute can
   // have a parent attribute and a child attribute (except the first and the
-  // last one). A string representation of the chain of attributes in NeoFS
+  // last one). A string representation of the chain of attributes in FrostFS
   // Storage Node configuration uses ":" and "/" symbols, e.g.:
   //
-  //        `NEOFS_NODE_ATTRIBUTE_1=key1:val1/key2:val2`
+  //        `FrostFS_NODE_ATTRIBUTE_1=key1:val1/key2:val2`
   //
   // Therefore the string attribute representation in the Node configuration
   // must use "\:", "\/" and "\\" escaped symbols if any of them appears in an
@@ -198,8 +200,8 @@ message NodeInfo {
   //   [ISO 3166-2](https://en.wikipedia.org/wiki/ISO_3166-2). Calculated
   //   automatically from `UN-LOCODE` attribute.
   // * Continent \
-  //   Node's continent name according to the [Seven-Continent model]
+  //   Node's continent name according to the [Seven-Continent
-  //   (https://en.wikipedia.org/wiki/Continent#Number). Calculated
+  //   model](https://en.wikipedia.org/wiki/Continent#Number). Calculated
   //   automatically from `UN-LOCODE` attribute.
   // * ExternalAddr
   //   Node's preferred way for communications with external clients.
@@ -207,7 +209,7 @@ message NodeInfo {
   //   Must contain a comma-separated list of multi-addresses.
   //
   // For detailed description of each well-known attribute please see the
-  // corresponding section in NeoFS Technical Specification.
+  // corresponding section in FrostFS Technical Specification.
   message Attribute {
     // Key of the node attribute
     string key = 1 [ json_name = "key" ];
@@ -219,13 +221,13 @@ message NodeInfo {
     // `Country`.
     repeated string parents = 3 [ json_name = "parents" ];
   }
-  // Carries list of the NeoFS node attributes in a key-value form. Key name
+  // Carries list of the FrostFS node attributes in a key-value form. Key name
   // must be a node-unique valid UTF-8 string. Value can't be empty. NodeInfo
   // structures with duplicated attribute names or attributes with empty values
   // will be considered invalid.
   repeated Attribute attributes = 3 [ json_name = "attributes" ];
 
-  // Represents the enumeration of various states of the NeoFS node.
+  // Represents the enumeration of various states of the FrostFS node.
   enum State {
     // Unknown state
     UNSPECIFIED = 0;
@@ -240,7 +242,7 @@ message NodeInfo {
     MAINTENANCE = 3;
   }
 
-  // Carries state of the NeoFS node
+  // Carries state of the FrostFS node
   State state = 4 [ json_name = "state" ];
 }
 
@@ -253,7 +255,7 @@ message Netmap {
   repeated NodeInfo nodes = 2 [ json_name = "nodes" ];
 }
 
-// NeoFS network configuration
+// FrostFS network configuration
 message NetworkConfig {
   // Single configuration parameter. Key MUST be network-unique.
   //
@@ -272,7 +274,7 @@ message NetworkConfig {
   //   Fee paid for container creation by the container owner.
   //   Value: little-endian integer. Default: 0.
   // - **EpochDuration** \
-  //   NeoFS epoch duration measured in Sidechain blocks.
+  //   FrostFS epoch duration measured in Sidechain blocks.
   //   Value: little-endian integer. Default: 0.
   // - **HomomorphicHashingDisabled** \
   //   Flag of disabling the homomorphic hashing of objects' payload.
@@ -284,8 +286,39 @@ message NetworkConfig {
   //   Flag allowing setting the MAINTENANCE state to storage nodes.
   //   Value: true if any byte != 0. Default: false.
   // - **MaxObjectSize** \
-  //   Maximum size of physically stored NeoFS object measured in bytes.
+  //   Maximum size of physically stored FrostFS object measured in bytes.
   //   Value: little-endian integer. Default: 0.
+  //
+  //   This value refers to the maximum size of a **physically** stored object
+  //   in FrostFS. However, from a user's perspective, the **logical** size of a
+  //   stored object can be significantly larger. The relationship between the
+  //   physical and logical object sizes is governed by the following formula
+  //
+  //   ```math
+  //   \mathrm{Stored\ Object\ Size} \le
+  //   \frac{
+  //     \left(\mathrm{Max\ Object\ Size}\right)^2
+  //   }{
+  //     \mathrm{Object\ ID\ Size}
+  //   }
+  //   ```
+  //
+  //   This arises from the fact that a tombstone, also being an object, stores
+  //   the IDs of inhumed objects and cannot be divided into smaller objects,
+  //   thus having an upper limit for its size.
+  //
+  //   For example, if:
+  //   * Max Object Size Size = 64 MiB;
+  //   * Object ID Size = 32 B;
+  //
+  //   then:
+  //   ```math
+  //     \mathrm{Stored\ Object\ Size} \le
+  //     \frac{\left(64\ \mathrm{MiB}\right)^2}{32\ \mathrm{B}} =
+  //     \frac{2^{52}}{2^5}\ \mathrm{B} =
+  //     2^{47}\ \mathrm{B} =
+  //     128\ \mathrm{TiB}
+  //   ```
   // - **WithdrawFee** \
   //   Fee paid for withdrawal of funds paid by the account owner.
   //   Value: little-endian integer. Default: 0.
@@ -306,18 +339,18 @@ message NetworkConfig {
   repeated Parameter parameters = 1 [ json_name = "parameters" ];
 }
 
-// Information about NeoFS network
+// Information about FrostFS network
 message NetworkInfo {
-  // Number of the current epoch in the NeoFS network
+  // Number of the current epoch in the FrostFS network
   uint64 current_epoch = 1 [ json_name = "currentEpoch" ];
 
-  // Magic number of the sidechain of the NeoFS network
+  // Magic number of the sidechain of the FrostFS network
   uint64 magic_number = 2 [ json_name = "magicNumber" ];
 
-  // MillisecondsPerBlock network parameter of the sidechain of the NeoFS
+  // MillisecondsPerBlock network parameter of the sidechain of the FrostFS
   // network
   int64 ms_per_block = 3 [ json_name = "msPerBlock" ];
 
-  // NeoFS network configuration
+  // FrostFS network configuration
   NetworkConfig network_config = 4 [ json_name = "networkConfig" ];
 }

protos/src/main/proto/object/service.proto

@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package neo.fs.v2.object;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/object/grpc;object";
 option java_package = "frostfs.object";
 
 import "object/types.proto";
@@ -46,7 +45,7 @@ service ObjectService {
   // - **CONTAINER_NOT_FOUND** (3072, SECTION_CONTAINER): \
   //   object container not found;
   // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   access to container is denied; 
+  //   access to container is denied;
   // - **TOKEN_EXPIRED** (4097, SECTION_SESSION): \
   //   provided session token has expired.
   rpc Get(GetRequest) returns (stream GetResponse);
@@ -115,7 +114,7 @@ service ObjectService {
   // - **CONTAINER_NOT_FOUND** (3072, SECTION_CONTAINER): \
   //   object container not found;
   // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   access to container is denied; 
+  //   access to container is denied;
   // - **TOKEN_EXPIRED** (4097, SECTION_SESSION): \
   //   provided session token has expired.
   rpc Delete(DeleteRequest) returns (DeleteResponse);
@@ -145,13 +144,13 @@ service ObjectService {
   // - **CONTAINER_NOT_FOUND** (3072, SECTION_CONTAINER): \
   //   object container not found;
   // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   access to container is denied; 
+  //   access to container is denied;
   // - **TOKEN_EXPIRED** (4097, SECTION_SESSION): \
   //   provided session token has expired.
   rpc Head(HeadRequest) returns (HeadResponse);
 
   // Search objects in container. Search query allows to match by Object
-  // Header's filed values. Please see the corresponding NeoFS Technical
+  // Header's filed values. Please see the corresponding FrostFS Technical
   // Specification section for more details.
   //
   // Extended headers can change `Search` behaviour:
@@ -171,7 +170,7 @@ service ObjectService {
   // - **CONTAINER_NOT_FOUND** (3072, SECTION_CONTAINER): \
   //   search container not found;
   // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   access to container is denied; 
+  //   access to container is denied;
   // - **TOKEN_EXPIRED** (4097, SECTION_SESSION): \
   //   provided session token has expired.
   rpc Search(SearchRequest) returns (stream SearchResponse);
@@ -208,7 +207,7 @@ service ObjectService {
   // - **CONTAINER_NOT_FOUND** (3072, SECTION_CONTAINER): \
   //   object container not found;
   // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   access to container is denied; 
+  //   access to container is denied;
   // - **TOKEN_EXPIRED** (4097, SECTION_SESSION): \
   //   provided session token has expired.
   rpc GetRange(GetRangeRequest) returns (stream GetRangeResponse);
@@ -243,7 +242,7 @@ service ObjectService {
   // - **CONTAINER_NOT_FOUND** (3072, SECTION_CONTAINER): \
   //   object container not found;
   // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   access to container is denied; 
+  //   access to container is denied;
   // - **TOKEN_EXPIRED** (4097, SECTION_SESSION): \
   //   provided session token has expired.
   rpc GetRangeHash(GetRangeHashRequest) returns (GetRangeHashResponse);
@@ -275,7 +274,7 @@ service ObjectService {
   // - **CONTAINER_NOT_FOUND** (3072, SECTION_CONTAINER): \
   //   object storage container not found;
   // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
-  //   access to container is denied; 
+  //   access to container is denied;
   // - **TOKEN_NOT_FOUND** (4096, SECTION_SESSION): \
   //   (for trusted object preparation) session private key does not exist or
   //   has
@@ -283,6 +282,55 @@ service ObjectService {
   // - **TOKEN_EXPIRED** (4097, SECTION_SESSION): \
   //   provided session token has expired.
   rpc PutSingle(PutSingleRequest) returns (PutSingleResponse);
+
+  // Patch the object. Request uses gRPC stream. First message must set
+  // the address of the object that is going to get patched. If the object's
+  // attributes are patched, then these attrubutes must be set only within the
+  // first stream message.
+  //
+  // If the patch request is performed by NOT the object's owner but if the
+  // actor has the permission to perform the patch, then `OwnerID` of the object
+  // is changed. In this case the object's owner loses the object's ownership
+  // after the patch request is successfully done.
+  //
+  // As objects are content-addressable the patching causes new object ID
+  // generation for the patched object. This object id is set witihn
+  // `PatchResponse`. But the object id may remain unchanged in such cases:
+  // 1. The chunk of the applying patch contains the same value as the object's
+  // payload within the same range;
+  // 2. The patch that reverts the changes applied by preceding patch;
+  // 3. The application of the same patches for the object a few times.
+  //
+  // Extended headers can change `Patch` behaviour:
+  // * [ __SYSTEM__NETMAP_EPOCH \
+  //   (`__NEOFS__NETMAP_EPOCH` is deprecated) \
+  //   Will use the requsted version of Network Map for object placement
+  //   calculation.
+  //
+  // Please refer to detailed `XHeader` description.
+  //
+  // Statuses:
+  // - **OK** (0, SECTION_SUCCESS): \
+  //   object has been successfully patched and saved in the container;
+  // - Common failures (SECTION_FAILURE_COMMON);
+  // - **ACCESS_DENIED** (2048, SECTION_OBJECT): \
+  //   write access to the container is denied;
+  // - **OBJECT_NOT_FOUND** (2049, SECTION_OBJECT): \
+  //   object not found in container;
+  // - **OBJECT_ALREADY_REMOVED** (2052, SECTION_OBJECT): \
+  //   the requested object has been marked as deleted.
+  // - **OUT_OF_RANGE** (2053, SECTION_OBJECT): \
+  //   the requested range is out of bounds;
+  // - **CONTAINER_NOT_FOUND** (3072, SECTION_CONTAINER): \
+  //   object storage container not found;
+  // - **CONTAINER_ACCESS_DENIED** (3074, SECTION_CONTAINER): \
+  //   access to container is denied;
+  // - **TOKEN_NOT_FOUND** (4096, SECTION_SESSION): \
+  //   (for trusted object preparation) session private key does not exist or
+  //   has been deleted;
+  // - **TOKEN_EXPIRED** (4097, SECTION_SESSION): \
+  //   provided session token has expired.
+  rpc Patch(stream PatchRequest) returns (PatchResponse);
 }
 
 // GET object request
@@ -583,6 +631,9 @@ message SearchRequest {
     //   object_id of parent
     // * $Object:split.splitID \
     //   16 byte UUIDv4 used to identify the split object hierarchy parts
+    // * $Object:ec.parent \
+    //   If the object is stored according to EC policy, then ec_parent
+    //   attribute is set to return an id list of all related EC chunks.
     //
     // There are some well-known filter aliases to match objects by certain
     // properties:
@@ -813,4 +864,75 @@ message PutSingleResponse {
   // authenticate the nodes of the message route and check the correctness of
   // transmission.
   neo.fs.v2.session.ResponseVerificationHeader verify_header = 3;
-}
+}
+
+// Object PATCH request
+message PatchRequest {
+  // PATCH request body
+  message Body {
+    // The address of the object that is requested to get patched.
+    neo.fs.v2.refs.Address address = 1;
+
+    // New attributes for the object. See `replace_attributes` flag usage to
+    // define how new attributes should be set.
+    repeated neo.fs.v2.object.Header.Attribute new_attributes = 2;
+
+    // If this flag is set, then the object's attributes will be entirely
+    // replaced by `new_attributes` list. The empty `new_attributes` list with
+    // `replace_attributes = true` just resets attributes list for the object.
+    //
+    // Default `false` value for this flag means the attributes will be just
+    // merged. If the incoming `new_attributes` list contains already existing
+    // key, then it just replaces it while merging the lists.
+    bool replace_attributes = 3;
+
+    // The patch for the object's payload.
+    message Patch {
+      // The range of the source object for which the payload is replaced by the
+      // patch's chunk. If the range's `length = 0`, then the patch's chunk is
+      // just appended to the original payload starting from the `offest`
+      // without any replace.
+      Range source_range = 1;
+
+      // The chunk that is being appended to or that replaces the original
+      // payload on the given range.
+      bytes chunk = 2;
+    }
+
+    // The patch that is applied for the object.
+    Patch patch = 4;
+  }
+
+  // Body for patch request message.
+  Body body = 1;
+
+  // Carries request meta information. Header data is used only to regulate
+  // message transport and does not affect request execution.
+  neo.fs.v2.session.RequestMetaHeader meta_header = 2;
+
+  // Carries request verification information. This header is used to
+  // authenticate the nodes of the message route and check the correctness of
+  // transmission.
+  neo.fs.v2.session.RequestVerificationHeader verify_header = 3;
+}
+
+// Object PATCH response
+message PatchResponse {
+  // PATCH response body
+  message Body {
+    // The object ID of the saved patched object.
+    neo.fs.v2.refs.ObjectID object_id = 1;
+  }
+
+  // Body for patch response message.
+  Body body = 1;
+
+  // Carries response meta information. Header data is used only to regulate
+  // message transport and does not affect request execution.
+  neo.fs.v2.session.ResponseMetaHeader meta_header = 2;
+
+  // Carries response verification information. This header is used to
+  // authenticate the nodes of the message route and check the correctness of
+  // transmission.
+  neo.fs.v2.session.ResponseVerificationHeader verify_header = 3;
+}

protos/src/main/proto/object/types.proto

@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package neo.fs.v2.object;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/object/grpc;object";
 option java_package = "frostfs.object";
 
 import "refs/types.proto";
@@ -155,7 +154,7 @@ message Header {
   //   MIME Content Type of object's payload
   //
   // For detailed description of each well-known attribute please see the
-  // corresponding section in NeoFS Technical Specification.
+  // corresponding section in FrostFS Technical Specification.
   message Attribute {
     // string key to the object attribute
     string key = 1 [ json_name = "key" ];
@@ -208,6 +207,18 @@ message Header {
     uint32 header_length = 4 [ json_name = "headerLength" ];
     // Chunk of a parent header.
     bytes header = 5 [ json_name = "header" ];
+    // As the origin object is EC-splitted its identifier is known to all
+    // chunks as parent. But parent itself can be a part of Split (does not
+    // relate to EC-split). In this case parent_split_id should be set.
+    bytes parent_split_id = 6 [ json_name = "parentSplitID" ];
+    // EC-parent's parent ID. parent_split_parent_id is set if EC-parent,
+    // itself, is a part of Split and if an object ID of its parent is
+    // presented. The field allows to determine how EC-chunk is placed in Split
+    // hierarchy.
+    neo.fs.v2.refs.ObjectID parent_split_parent_id = 7
+        [ json_name = "parentSplitParentID" ];
+    // EC parent's attributes.
+    repeated Attribute parent_attributes = 8 [ json_name = "parentAttributes" ];
   }
   // Erasure code chunk information.
   EC ec = 12 [ json_name = "ec" ];
@@ -263,4 +274,4 @@ message ECInfo {
   }
   // Chunk stored on the node.
   repeated Chunk chunks = 1;
-}
+}

protos/src/main/proto/refs/types.proto

@@ -2,10 +2,9 @@ syntax = "proto3";
 
 package neo.fs.v2.refs;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/refs/grpc;refs";
 option java_package = "frostfs.refs";
 
-// Objects in NeoFS are addressed by their ContainerID and ObjectID.
+// Objects in FrostFS are addressed by their ContainerID and ObjectID.
 //
 // String presentation of `Address` is a concatenation of string encoded
 // `ContainerID` and `ObjectID` delimited by '/' character.
@@ -16,8 +15,9 @@ message Address {
   ObjectID object_id = 2 [ json_name = "objectID" ];
 }
 
-// NeoFS Object unique identifier. Objects are immutable and content-addressed.
+// FrostFS Object unique identifier. Objects are immutable and
-// It means `ObjectID` will change if the `header` or the `payload` changes.
+// content-addressed. It means `ObjectID` will change if the `header` or the
+// `payload` changes.
 //
 // `ObjectID` is a 32 byte long
 // [SHA256](https://csrc.nist.gov/publications/detail/fips/180/4/final) hash of
@@ -37,7 +37,7 @@ message ObjectID {
   bytes value = 1 [ json_name = "value" ];
 }
 
-// NeoFS container identifier. Container structures are immutable and
+// FrostFS container identifier. Container structures are immutable and
 // content-addressed.
 //
 // `ContainerID` is a 32 byte long
@@ -90,7 +90,7 @@ message Version {
   uint32 minor = 2 [ json_name = "minor" ];
 }
 
-// Signature of something in NeoFS.
+// Signature of something in FrostFS.
 message Signature {
   // Public key used for signing
   bytes key = 1 [ json_name = "key" ];

protos/src/main/proto/session/service.proto

@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package neo.fs.v2.session;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/session/grpc;session";
 option java_package = "frostfs.session";
 
 import "refs/types.proto";
@@ -11,7 +10,7 @@ import "session/types.proto";
 // `SessionService` allows to establish a temporary trust relationship between
 // two peer nodes and generate a `SessionToken` as the proof of trust to be
 // attached in requests for further verification. Please see corresponding
-// section of NeoFS Technical Specification for details.
+// section of FrostFS Technical Specification for details.
 service SessionService {
   // Open a new session between two peers.
   //

protos/src/main/proto/session/types.proto

@@ -2,7 +2,6 @@ syntax = "proto3";
 
 package neo.fs.v2.session;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/session/grpc;session";
 option java_package = "frostfs.session";
 
 import "refs/types.proto";
@@ -36,6 +35,9 @@ message ObjectSessionContext {
 
     // Refers to object.GetRangeHash RPC call
     RANGEHASH = 7;
+
+    // Refers to object.Patch RPC call
+    PATCH = 8;
   }
   // Type of request for which the token is issued
   Verb verb = 1 [ json_name = "verb" ];
@@ -47,7 +49,7 @@ message ObjectSessionContext {
     refs.ContainerID container = 1 [ json_name = "container" ];
 
     // Indicates which objects the session is spread to. Objects are expected
-    // to be stored in the NeoFS container referenced by `container` field.
+    // to be stored in the FrostFS container referenced by `container` field.
     // Each element MUST have correct format.
     repeated refs.ObjectID objects = 2 [ json_name = "objects" ];
   }
@@ -85,7 +87,7 @@ message ContainerSessionContext {
   refs.ContainerID container_id = 3 [ json_name = "containerID" ];
 }
 
-// NeoFS Session Token.
+// FrostFS Session Token.
 message SessionToken {
   // Session Token body
   message Body {
@@ -123,7 +125,7 @@ message SessionToken {
   }
   // Session Token contains the proof of trust between peers to be attached in
   // requests for further verification. Please see corresponding section of
-  // NeoFS Technical Specification for details.
+  // FrostFS Technical Specification for details.
   Body body = 1 [ json_name = "body" ];
 
   // Signature of `SessionToken` information
@@ -183,7 +185,7 @@ message RequestMetaHeader {
   // `RequestMetaHeader` of the origin request
   RequestMetaHeader origin = 7 [ json_name = "origin" ];
 
-  // NeoFS network magic. Must match the value for the network
+  // FrostFS network magic. Must match the value for the network
   // that the server belongs to.
   uint64 magic_number = 8 [ json_name = "magicNumber" ];
 }

protos/src/main/proto/status/types.proto

@@ -2,15 +2,14 @@ syntax = "proto3";
 
 package neo.fs.v2.status;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/status/grpc;status";
 option java_package = "frostfs.status";
 
-// Declares the general format of the status returns of the NeoFS RPC protocol.
+// Declares the general format of the status returns of the FrostFS RPC
-// Status is present in all response messages. Each RPC of NeoFS protocol
+// protocol. Status is present in all response messages. Each RPC of FrostFS
-// describes the possible outcomes and details of the operation.
+// protocol describes the possible outcomes and details of the operation.
 //
 // Each status is assigned a one-to-one numeric code. Any unique result of an
-// operation in NeoFS is unambiguously associated with the code value.
+// operation in FrostFS is unambiguously associated with the code value.
 //
 // Numerical set of codes is split into 1024-element sections. An enumeration
 // is defined for each section. Values can be referred to in the following ways:
@@ -78,7 +77,7 @@ enum Section {
   SECTION_APE_MANAGER = 5;
 }
 
-// Section of NeoFS successful return codes.
+// Section of FrostFS successful return codes.
 enum Success {
   // [**0**] Default success. Not detailed.
   // If the server cannot match successful outcome to the code, it should
@@ -93,9 +92,9 @@ enum CommonFail {
   // use this code.
   INTERNAL = 0;
 
-  // [**1025**] Wrong magic of the NeoFS network.
+  // [**1025**] Wrong magic of the FrostFS network.
   // Details:
-  //  - [**0**] Magic number of the served NeoFS network (big-endian 64-bit
+  //  - [**0**] Magic number of the served FrostFS network (big-endian 64-bit
   //  unsigned integer).
   WRONG_MAGIC_NUMBER = 1;
 
@@ -104,6 +103,11 @@ enum CommonFail {
 
   // [**1027**] Node is under maintenance.
   NODE_UNDER_MAINTENANCE = 3;
+
+  // [**1028**] Invalid argument error. If the server fails on validation of a
+  // request parameter as the client sent it incorrectly, then this code should
+  // be used.
+  INVALID_ARGUMENT = 4;
 }
 
 // Section of statuses for object-related operations.
@@ -154,4 +158,4 @@ enum Session {
 enum APEManager {
   // [**5120**] The operation is denied by APE manager.
   APE_MANAGER_ACCESS_DENIED = 0;
-}
+}

protos/src/main/proto/tombstone/types.proto

@@ -2,16 +2,15 @@ syntax = "proto3";
 
 package neo.fs.v2.tombstone;
 
-option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/tombstone/grpc;tombstone";
 option java_package = "frostfs.tombstone";
 
 import "refs/types.proto";
 
 // Tombstone keeps record of deleted objects for a few epochs until they are
-// purged from the NeoFS network.
+// purged from the FrostFS network.
 message Tombstone {
-  // Last NeoFS epoch number of the tombstone lifetime. It's set by the
+  // Last FrostFS epoch number of the tombstone lifetime. It's set by the
-  // tombstone creator depending on the current NeoFS network settings. A
+  // tombstone creator depending on the current FrostFS network settings. A
   // tombstone object must have the same expiration epoch value in
   // `__SYSTEM__EXPIRATION_EPOCH` (`__NEOFS__EXPIRATION_EPOCH` is deprecated)
   // attribute. Otherwise, the tombstone will be rejected by a storage node.