@opensoha/contracts 0.1.11 → 0.1.13

package/openapi/soha-api.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: Soha API
-  version: 0.1.11
+  version: 0.1.13
   description: >
     Public OpenSoha core API contract. This first contract focuses on stable
     cross-repository boundaries: auth, health, runner-facing control-plane
@@ -3295,6 +3295,38 @@ paths:
           $ref: "#/components/responses/Error"
         "410":
           $ref: "#/components/responses/Error"
+  /docker/agent-installations/{operationID}/enroll:
+    post:
+      tags: [Runner]
+      operationId: exchangeDockerHostAgentEnrollment
+      security: []
+      parameters:
+        - $ref: "#/components/parameters/OperationID"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DockerHostAgentEnrollmentRequest"
+      responses:
+        "201":
+          description: One-time host-bound Agent and control-plane credentials. The enrollment token is atomically consumed by a successful response.
+          headers:
+            Cache-Control:
+              description: Prevents credential responses from being cached.
+              schema: { type: string, const: no-store }
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DockerHostAgentCredentialsEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+        "409":
+          $ref: "#/components/responses/Error"
+        "410":
+          $ref: "#/components/responses/Error"
   /docker/hosts/quick-create/plan:
     post:
       tags: [Docker]
@@ -6272,6 +6304,35 @@ paths:
           $ref: "#/components/responses/Error"
         "404":
           $ref: "#/components/responses/Error"
+  /clusters/{clusterID}/resource-creation/workload-snapshot:
+    post:
+      tags: [Platform]
+      operationId: generateKubernetesWorkloadSnapshot
+      x-soha-capability:
+        name: k8s.workloads.snapshot.generate
+        riskLevel: analyze
+        requiresApproval: false
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KubernetesWorkloadSnapshotRequest"
+      responses:
+        "200":
+          description: A native Job or CronJob manifest, or a workloads.soha.io/v1alpha1 WorkloadCronJob manifest, generated from a same-namespace workload Pod template. This operation does not create resources.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesWorkloadSnapshotEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
   /clusters/{clusterID}/resource-creation/preflight:
     post:
       tags: [Platform]
@@ -11944,7 +12005,7 @@ components:
     runtimeBearerAuth:
       type: http
       scheme: bearer
-      description: Runtime execution runner token.
+      description: Runtime execution runner token, including host-bound Docker Agent credentials.
     agentBearerAuth:
       type: http
       scheme: bearer
@@ -25915,6 +25976,58 @@ components:
         data:
           $ref: "#/components/schemas/DockerHostAgentInstallation"
       additionalProperties: false
+    DockerHostAgentEnrollmentRequest:
+      type: object
+      required: [agentId, enrollmentToken]
+      properties:
+        agentId:
+          type: string
+          minLength: 1
+          maxLength: 200
+        enrollmentToken:
+          type: string
+          minLength: 32
+          maxLength: 512
+          format: password
+          description: Short-lived one-time secret delivered only inside the installer.
+      additionalProperties: false
+    DockerHostAgentCredentials:
+      type: object
+      required: [hostId, operationId, agentId, agentBearerToken, runtimeBearerToken, issuedAt]
+      properties:
+        hostId:
+          type: string
+          minLength: 1
+        operationId:
+          type: string
+          minLength: 1
+        agentId:
+          type: string
+          minLength: 1
+          maxLength: 200
+        agentBearerToken:
+          type: string
+          minLength: 32
+          maxLength: 512
+          format: password
+          description: Credential for the Agent's local HTTP API, returned only by the successful enrollment response.
+        runtimeBearerToken:
+          type: string
+          minLength: 32
+          maxLength: 512
+          format: password
+          description: Revocable credential restricted to Docker operations for this host.
+        issuedAt:
+          type: string
+          format: date-time
+      additionalProperties: false
+    DockerHostAgentCredentialsEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/DockerHostAgentCredentials"
+      additionalProperties: false
     ObservabilityProviderSignal:
       type: string
       enum: [logs, metrics, traces, profiles]
@@ -27643,6 +27756,136 @@ components:
             required: [type]
           then:
             required: [status]
+    KubernetesWorkloadSnapshotSourceKind:
+      type: string
+      enum: [Deployment, StatefulSet, DaemonSet]
+      x-enum-varnames:
+        - KubernetesWorkloadSnapshotSourceKindDeployment
+        - KubernetesWorkloadSnapshotSourceKindStatefulSet
+        - KubernetesWorkloadSnapshotSourceKindDaemonSet
+    KubernetesWorkloadSnapshotTargetKind:
+      type: string
+      enum: [Job, CronJob, WorkloadCronJob]
+      x-enum-varnames:
+        - KubernetesWorkloadSnapshotTargetKindJob
+        - KubernetesWorkloadSnapshotTargetKindCronJob
+        - KubernetesWorkloadSnapshotTargetKindWorkloadCronJob
+    KubernetesWorkloadSnapshotRestartPolicy:
+      type: string
+      enum: [Never, OnFailure]
+      x-enum-varnames:
+        - KubernetesWorkloadSnapshotRestartPolicyNever
+        - KubernetesWorkloadSnapshotRestartPolicyOnFailure
+    KubernetesWorkloadSnapshotRequest:
+      type: object
+      required: [namespace, sourceKind, sourceName, targetKind, targetName, restartPolicy]
+      properties:
+        namespace:
+          type: string
+          minLength: 1
+          description: Namespace shared by the source workload and generated target because referenced Secrets, ConfigMaps, ServiceAccounts, and PVCs are namespace-scoped.
+        sourceKind:
+          $ref: "#/components/schemas/KubernetesWorkloadSnapshotSourceKind"
+        sourceName:
+          type: string
+          minLength: 1
+        sourceContainer:
+          type: string
+          minLength: 1
+          description: Regular container to retain. When omitted, the first regular container is selected.
+        targetKind:
+          $ref: "#/components/schemas/KubernetesWorkloadSnapshotTargetKind"
+        targetName:
+          type: string
+          minLength: 1
+        description:
+          type: string
+          maxLength: 512
+        labels:
+          type: object
+          maxProperties: 64
+          additionalProperties: { type: string }
+        annotations:
+          type: object
+          maxProperties: 64
+          additionalProperties: { type: string }
+        command:
+          type: array
+          maxItems: 128
+          items: { type: string, maxLength: 4096 }
+        args:
+          type: array
+          maxItems: 128
+          items: { type: string, maxLength: 4096 }
+        restartPolicy:
+          $ref: "#/components/schemas/KubernetesWorkloadSnapshotRestartPolicy"
+        parallelism:
+          type: integer
+          minimum: 0
+          description: Zero leaves the Kubernetes default unchanged.
+        completions:
+          type: integer
+          minimum: 0
+          description: Zero leaves the Kubernetes default unchanged.
+        backoffLimit:
+          type: integer
+          minimum: 0
+        activeDeadlineSeconds:
+          type: integer
+          minimum: 0
+          description: Zero leaves the Kubernetes default unchanged.
+        schedule:
+          type: string
+          minLength: 1
+          description: Required when targetKind is CronJob or WorkloadCronJob.
+        suspend:
+          type: boolean
+      additionalProperties: false
+      if:
+        properties:
+          targetKind:
+            enum: [CronJob, WorkloadCronJob]
+        required: [targetKind]
+      then:
+        required: [schedule]
+    KubernetesWorkloadSnapshotContainer:
+      type: object
+      required: [name, image]
+      properties:
+        name: { type: string, minLength: 1 }
+        image: { type: string }
+      additionalProperties: false
+    KubernetesWorkloadSnapshot:
+      type: object
+      required: [content, sourceUid, selectedContainer, containers, warnings]
+      properties:
+        content:
+          type: string
+          minLength: 1
+          maxLength: 1048576
+          description: Generated native batch/v1 Job or CronJob YAML, or workloads.soha.io/v1alpha1 WorkloadCronJob YAML whose selected container image follows the source workload, ready for the existing resource-creation preflight.
+        sourceUid:
+          type: string
+          minLength: 1
+        selectedContainer:
+          type: string
+          minLength: 1
+        containers:
+          type: array
+          minItems: 1
+          items:
+            $ref: "#/components/schemas/KubernetesWorkloadSnapshotContainer"
+        warnings:
+          type: array
+          items: { type: string }
+      additionalProperties: false
+    KubernetesWorkloadSnapshotEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/KubernetesWorkloadSnapshot"
+      additionalProperties: false
     KubernetesResourceCreateSource:
       type: string
       enum: [list, global_yaml, form]

package/openapi/spec_generated.go

@@ -5,9 +5,9 @@ package openapi
 import _ "embed"
 
 const (
-	Version    = "0.1.11"
-	YAMLSHA256 = "84fc6e95a10bbbf20bc8b2adbda86d824bf664d1ca16c879c37cf1005ed47557"
-	JSONSHA256 = "551abf1b2ab9a56f0b59de7d43d1d59c0145d88cf8a017e1c0a937441947fdff"
+	Version    = "0.1.13"
+	YAMLSHA256 = "480571290460492a4f422ecf2c2098720989c31a4413c1bf29fc45b1ecaa5c7b"
+	JSONSHA256 = "8327233124b473bdfe2a57582eb66ed9c844630bedd0c947eefb707b71f7d3cf"
 )
 
 //go:embed soha-api.yaml

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensoha/contracts",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "private": false,
   "description": "Shared OpenSoha API, agent, MCP, skill, event, and auth contracts.",
   "license": "Apache-2.0",