syntax = "proto3";

package nexuscrm.runtime.v1;

option go_package = "github.com/pingcap-inc/nexuscrm-contract/wire-go/gen/runtime/v1;runtimev1";

// IdentityContext is the single Runtime-owned user-to-workload delegation
// exchange. Workload authentication and the raw user bearer are transport
// credentials and are deliberately absent from these messages.
service IdentityContextService {
  rpc Exchange(ExchangeRequest) returns (ExchangeResponse);
}

// These are the only authority selectors an authenticated workload may ask
// Runtime Identity to intersect with its authoritative state.
message ExchangeRequest {
  string app_installation_id = 1;
  repeated string requested_runtime_capabilities = 2;
}

// The compact delegation remains opaque to L1. No decoded claim, permission,
// profile, security-row, key, Org, principal, workload, audience or epoch fact
// is exposed by the exchange response.
message ExchangeResponse {
  string opaque_delegation = 1;
  int64 expires_at_unix_second = 2;
}