service NodeClusterService {
  // Existing RPCs (worker membership, attestation, heartbeat) — see grpc-api reference.

  // Edge-mode extensions:
  rpc ConnectEdge(stream EdgeEvent) returns (stream EdgeCommand);
  rpc RotateEdgeKey(RotateEdgeKeyRequest) returns (RotateEdgeKeyResponse);
}

message EdgeEvent {
  oneof event {
    Hello             hello = 1;
    Heartbeat         heartbeat = 2;
    CommandResult     command_result = 3;
    CommandProgress   command_progress = 4;
    CapabilityUpdate  capability_update = 5;
  }
}

message Hello {
  SealNodeEnvelope envelope = 1;          // outer envelope, signed by the daemon's node key
  EdgeCapabilities capabilities = 2;
  string stream_id = 3;                    // UUID minted by the daemon
}

message Heartbeat {
  SealNodeEnvelope envelope = 1;
  google.protobuf.Timestamp sent_at = 2;
}

message CommandResult {
  SealNodeEnvelope envelope = 1;
  string command_id = 2;                   // matches the InvokeTool that produced it
  EdgeResult result = 3;
}

message EdgeResult {
  oneof outcome {
    Ok       ok = 1;
    Err      err = 2;
    TimedOut timed_out = 3;
    Cancelled cancelled = 4;
  }

  message Ok {
    int32 exit_code = 1;
    google.protobuf.Any payload = 2;       // tool-specific
    google.protobuf.Duration duration = 3;
  }

  message Err {
    string code = 1;                        // structured error code
    string message = 2;
    int32 exit_code = 3;
  }

  message TimedOut {
    google.protobuf.Duration deadline = 1;
  }

  message Cancelled {
    string reason = 1;
  }
}

message CommandProgress {
  SealNodeEnvelope envelope = 1;
  string command_id = 2;
  Chunk chunk = 3;
}

message Chunk {
  oneof kind {
    bytes stdout = 1;
    bytes stderr = 2;
    StatusUpdate status = 3;
  }
}

message CapabilityUpdate {
  SealNodeEnvelope envelope = 1;
  EdgeCapabilities capabilities = 2;
}

message EdgeCommand {
  oneof command {
    InvokeTool   invoke_tool = 1;
    Cancel       cancel = 2;
    PushConfig   push_config = 3;
    Drain        drain = 4;
    Shutdown     shutdown = 5;
  }
}

message InvokeTool {
  string command_id = 1;                   // UUID minted by the dispatcher
  string security_context_name = 2;        // resolved against local merged config
  SealEnvelope seal_envelope = 3;          // inner envelope: user_security_token, tenant_id, ...
  string tool_name = 4;
  google.protobuf.Struct args = 5;
  google.protobuf.Duration deadline = 6;
}

message Cancel {
  string command_id = 1;                   // the in-flight command to cancel
  string reason = 2;
}

message PushConfig {
  bytes config_delta = 1;                  // merged-config delta (yaml or canonical-json)
  string version = 2;
}

message Drain {}

message Shutdown {
  google.protobuf.Duration grace = 1;
}

message RotateEdgeKeyRequest {
  SealNodeEnvelope current_envelope = 1;   // signed by the OLD key (proof of authority)
  bytes new_public_key = 2;                // raw Ed25519 pubkey
  bytes signature_with_new_key = 3;        // signature over (node_id || new_public_key) by NEW key
}

message RotateEdgeKeyResponse {
  string node_security_token = 1;          // newly-issued token bound to the new key
  google.protobuf.Timestamp issued_at = 2;
  google.protobuf.Timestamp expires_at = 3;
  google.protobuf.Duration overlap_window = 4;   // duration the server records both pubkeys
}

message EdgeCapabilities {
  string os = 1;
  string arch = 2;
  repeated string local_tools = 3;
  repeated string mount_points = 4;
  map<string, string> custom_labels = 5;
  // Note: `tags` are NOT carried on this message — they are server-managed and
  // never overwritten by the daemon. They live on the EdgeDaemon row only.
}

message ChallengeNodeRequest {
  // ... existing fields ...

  oneof bootstrap_proof {
    string enrollment_token = 4;
  }
}

grpcurl -insecure relay.example.com:443 grpc.health.v1.Health/Check

{
  "status": "SERVING"
}