@opensoha/contracts 0.1.15 → 0.1.17

package/network/network-runtime-protocol.schema.json

@@ -0,0 +1,752 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.opensoha.dev/network/network-runtime-protocol.schema.json",
+  "title": "OpenSoha Network Runtime Protocol Message",
+  "description": "Strict, versioned control messages exchanged by network-control, endpoint services and network gateways. Private keys and raw authentication credentials are intentionally excluded.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "messageId",
+    "messageType",
+    "producerId",
+    "runtimeId",
+    "runtimeKind",
+    "occurredAt",
+    "expiresAt",
+    "payload"
+  ],
+  "properties": {
+    "schemaVersion": { "const": "network-runtime/v1alpha1" },
+    "messageId": { "$ref": "#/$defs/Identifier" },
+    "messageType": {
+      "enum": [
+        "runtime.enroll.request",
+        "runtime.enroll.result",
+        "configuration.desired",
+        "configuration.applied",
+        "lease.renew.request",
+        "lease.renew.result",
+        "lease.revoke",
+        "vpn.connect.request",
+        "vpn.connect.result",
+        "nas.authorization.request",
+        "nas.authorization.result",
+        "nas.session.command",
+        "nas.session.command.result"
+      ]
+    },
+    "producerId": { "$ref": "#/$defs/Identifier" },
+    "runtimeId": { "$ref": "#/$defs/Identifier" },
+    "runtimeKind": { "enum": ["endpoint", "gateway", "nas"] },
+    "occurredAt": { "type": "string", "format": "date-time" },
+    "expiresAt": { "type": "string", "format": "date-time" },
+    "payload": {
+      "oneOf": [
+        { "$ref": "#/$defs/EnrollmentRequest" },
+        { "$ref": "#/$defs/EnrollmentResult" },
+        { "$ref": "#/$defs/ConfigurationDesired" },
+        { "$ref": "#/$defs/ConfigurationApplied" },
+        { "$ref": "#/$defs/LeaseRenewRequest" },
+        { "$ref": "#/$defs/LeaseRenewResult" },
+        { "$ref": "#/$defs/LeaseRevoke" },
+        { "$ref": "#/$defs/VPNConnectRequest" },
+        { "$ref": "#/$defs/VPNConnectResult" },
+        { "$ref": "#/$defs/NASAuthorizationRequest" },
+        { "$ref": "#/$defs/NASAuthorizationResult" },
+        { "$ref": "#/$defs/NASSessionCommand" },
+        { "$ref": "#/$defs/NASSessionCommandResult" }
+      ]
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "messageType": { "const": "runtime.enroll.request" } }, "required": ["messageType"] },
+      "then": { "properties": { "payload": { "$ref": "#/$defs/EnrollmentRequest" } } }
+    },
+    {
+      "if": { "properties": { "messageType": { "const": "runtime.enroll.result" } }, "required": ["messageType"] },
+      "then": { "properties": { "payload": { "$ref": "#/$defs/EnrollmentResult" } } }
+    },
+    {
+      "if": { "properties": { "messageType": { "const": "configuration.desired" } }, "required": ["messageType"] },
+      "then": { "properties": { "payload": { "$ref": "#/$defs/ConfigurationDesired" } } }
+    },
+    {
+      "if": { "properties": { "messageType": { "const": "configuration.applied" } }, "required": ["messageType"] },
+      "then": { "properties": { "payload": { "$ref": "#/$defs/ConfigurationApplied" } } }
+    },
+    {
+      "if": { "properties": { "messageType": { "const": "lease.renew.request" } }, "required": ["messageType"] },
+      "then": { "properties": { "payload": { "$ref": "#/$defs/LeaseRenewRequest" } } }
+    },
+    {
+      "if": { "properties": { "messageType": { "const": "lease.renew.result" } }, "required": ["messageType"] },
+      "then": { "properties": { "payload": { "$ref": "#/$defs/LeaseRenewResult" } } }
+    },
+    {
+      "if": { "properties": { "messageType": { "const": "lease.revoke" } }, "required": ["messageType"] },
+      "then": { "properties": { "payload": { "$ref": "#/$defs/LeaseRevoke" } } }
+    },
+    {
+      "if": { "properties": { "messageType": { "const": "vpn.connect.request" } }, "required": ["messageType"] },
+      "then": {
+        "properties": {
+          "runtimeKind": { "const": "endpoint" },
+          "payload": { "$ref": "#/$defs/VPNConnectRequest" }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "messageType": { "const": "vpn.connect.result" } }, "required": ["messageType"] },
+      "then": {
+        "properties": {
+          "runtimeKind": { "const": "endpoint" },
+          "payload": { "$ref": "#/$defs/VPNConnectResult" }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "messageType": { "const": "nas.authorization.request" } }, "required": ["messageType"] },
+      "then": {
+        "properties": {
+          "runtimeKind": { "const": "nas" },
+          "payload": { "$ref": "#/$defs/NASAuthorizationRequest" }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "messageType": { "const": "nas.authorization.result" } }, "required": ["messageType"] },
+      "then": {
+        "properties": {
+          "runtimeKind": { "const": "nas" },
+          "payload": { "$ref": "#/$defs/NASAuthorizationResult" }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "messageType": { "const": "nas.session.command" } }, "required": ["messageType"] },
+      "then": {
+        "properties": {
+          "runtimeKind": { "const": "nas" },
+          "payload": { "$ref": "#/$defs/NASSessionCommand" }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "messageType": { "const": "nas.session.command.result" } }, "required": ["messageType"] },
+      "then": {
+        "properties": {
+          "runtimeKind": { "const": "nas" },
+          "payload": { "$ref": "#/$defs/NASSessionCommandResult" }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "Identifier": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$"
+    },
+    "AccessProfile": {
+      "enum": ["onboarding", "full", "restricted", "quarantine", "deny"]
+    },
+    "IPv4Address": {
+      "type": "string",
+      "maxLength": 15,
+      "pattern": "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])$"
+    },
+    "IPv4CIDR": {
+      "type": "string",
+      "maxLength": 18,
+      "pattern": "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])/(?:[0-9]|[12][0-9]|3[0-2])$",
+      "description": "Canonical IPv4 CIDR. IPv6 is intentionally deferred beyond network-runtime/v1alpha1."
+    },
+    "SplitRoute": {
+      "allOf": [
+        { "$ref": "#/$defs/IPv4CIDR" },
+        { "not": { "const": "0.0.0.0/0" } }
+      ]
+    },
+    "WireGuardPublicKey": {
+      "type": "string",
+      "minLength": 44,
+      "maxLength": 44,
+      "pattern": "^[A-Za-z0-9+/]{43}=$"
+    },
+    "RadiusAttributes": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sessionTimeoutSeconds"],
+      "properties": {
+        "vlanId": { "type": "integer", "minimum": 1, "maximum": 4094 },
+        "filterId": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "sessionTimeoutSeconds": { "type": "integer", "minimum": 1, "maximum": 86400 }
+      }
+    },
+    "NetworkLease": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "sessionId",
+        "subjectId",
+        "deviceId",
+        "networkSpaceId",
+        "cidrs",
+        "policyVersion",
+        "issuedAt",
+        "expiresAt"
+      ],
+      "properties": {
+        "id": { "$ref": "#/$defs/Identifier" },
+        "sessionId": { "$ref": "#/$defs/Identifier" },
+        "subjectId": { "$ref": "#/$defs/Identifier" },
+        "deviceId": { "$ref": "#/$defs/Identifier" },
+        "networkSpaceId": { "$ref": "#/$defs/Identifier" },
+        "cidrs": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/IPv4CIDR" }
+        },
+        "policyVersion": { "type": "integer", "minimum": 1 },
+        "issuedAt": { "type": "string", "format": "date-time" },
+        "expiresAt": { "type": "string", "format": "date-time" }
+      }
+    },
+    "ResourceLease": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "sessionId",
+        "subjectId",
+        "deviceId",
+        "resourceIds",
+        "policyVersion",
+        "issuedAt",
+        "expiresAt"
+      ],
+      "properties": {
+        "id": { "$ref": "#/$defs/Identifier" },
+        "sessionId": { "$ref": "#/$defs/Identifier" },
+        "subjectId": { "$ref": "#/$defs/Identifier" },
+        "deviceId": { "$ref": "#/$defs/Identifier" },
+        "resourceIds": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 256,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/Identifier" }
+        },
+        "policyVersion": { "type": "integer", "minimum": 1 },
+        "issuedAt": { "type": "string", "format": "date-time" },
+        "expiresAt": { "type": "string", "format": "date-time" }
+      }
+    },
+    "EnrollmentRequest": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["enrollmentId", "challengeId", "deviceId", "devicePublicKey", "platform", "clientVersion", "capabilities"],
+      "properties": {
+        "enrollmentId": { "$ref": "#/$defs/Identifier" },
+        "challengeId": { "$ref": "#/$defs/Identifier" },
+        "deviceId": { "$ref": "#/$defs/Identifier" },
+        "devicePublicKey": { "type": "string", "minLength": 32, "maxLength": 4096 },
+        "wireguardPublicKey": { "$ref": "#/$defs/WireGuardPublicKey" },
+        "platform": { "enum": ["windows", "linux", "macos"] },
+        "clientVersion": { "type": "string", "minLength": 1, "maxLength": 64 },
+        "capabilities": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 32,
+          "uniqueItems": true,
+          "items": { "enum": ["wireguard", "mihomo", "route-coordinator", "dns-coordinator"] }
+        }
+      },
+      "allOf": [{
+        "if": {
+          "properties": {
+            "capabilities": { "contains": { "const": "wireguard" } }
+          },
+          "required": ["capabilities"]
+        },
+        "then": { "required": ["wireguardPublicKey"] }
+      }]
+    },
+    "EnrollmentResult": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["accepted", "reasonCode"],
+      "properties": {
+        "accepted": { "type": "boolean" },
+        "reasonCode": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "credentialReference": {
+          "type": "string",
+          "maxLength": 266,
+          "pattern": "^secretref:[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$",
+          "description": "Opaque reference to runtime-local protected storage, never raw credential material."
+        },
+        "credentialExpiresAt": { "type": "string", "format": "date-time" }
+      }
+    },
+    "RuntimeIntervals": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["heartbeatIntervalSeconds", "configurationPollIntervalSeconds"],
+      "properties": {
+        "heartbeatIntervalSeconds": { "type": "integer", "minimum": 30, "maximum": 300 },
+        "configurationPollIntervalSeconds": { "type": "integer", "minimum": 30, "maximum": 300 }
+      }
+    },
+    "ConfigurationDesired": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "configurationVersion",
+        "policyVersion",
+        "validUntil",
+        "accessProfile",
+        "protectedResourceIds",
+        "networkLeases",
+        "resourceLeases"
+      ],
+      "properties": {
+        "configurationVersion": { "type": "integer", "minimum": 1 },
+        "policyVersion": { "type": "integer", "minimum": 1 },
+        "validUntil": { "type": "string", "format": "date-time" },
+        "accessProfile": { "$ref": "#/$defs/AccessProfile" },
+        "protectedResourceIds": {
+          "type": "array",
+          "maxItems": 2048,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/Identifier" }
+        },
+        "networkLeases": {
+          "type": "array",
+          "maxItems": 256,
+          "items": { "$ref": "#/$defs/NetworkLease" }
+        },
+        "resourceLeases": {
+          "type": "array",
+          "maxItems": 512,
+          "items": { "$ref": "#/$defs/ResourceLease" }
+        },
+        "runtimeIntervals": { "$ref": "#/$defs/RuntimeIntervals" },
+        "wireguard": { "$ref": "#/$defs/WireGuardConfiguration" },
+        "mihomo": { "$ref": "#/$defs/MihomoConfiguration" }
+      }
+    },
+    "MihomoBypassHost": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 253,
+      "pattern": "^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|[A-Za-z0-9])$"
+    },
+    "MihomoConfiguration": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "mode",
+        "profileId",
+        "profileRevision",
+        "mixedPort",
+        "controllerPort",
+        "dnsMode",
+        "selectorGroup",
+        "bypassCidrs",
+        "bypassHosts",
+        "failClosed"
+      ],
+      "properties": {
+        "mode": { "enum": ["managed_follow", "app_subscription"] },
+        "sourceType": { "enum": ["managed_subscription", "manual_node"] },
+        "profileId": { "$ref": "#/$defs/Identifier" },
+        "profileRevision": { "type": "integer", "minimum": 1 },
+        "mixedPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
+        "controllerPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
+        "dnsMode": { "enum": ["disabled", "fake_ip"] },
+        "fakeIpRange": { "$ref": "#/$defs/SplitRoute" },
+        "selectorGroup": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "selectedProxy": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "bypassCidrs": {
+          "type": "array",
+          "maxItems": 256,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/SplitRoute" }
+        },
+        "bypassHosts": {
+          "type": "array",
+          "maxItems": 128,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/MihomoBypassHost" }
+        },
+        "failClosed": { "type": "boolean" }
+      },
+      "allOf": [
+        {
+          "if": { "properties": { "mode": { "const": "managed_follow" } }, "required": ["mode"] },
+          "then": { "properties": { "failClosed": { "const": true } } },
+          "else": { "not": { "anyOf": [{ "required": ["sourceType"] }, { "required": ["selectedProxy"] }] } }
+        },
+        {
+          "if": {
+            "allOf": [
+              { "properties": { "mode": { "const": "managed_follow" } }, "required": ["mode"] },
+              { "not": { "properties": { "sourceType": { "const": "manual_node" } }, "required": ["sourceType"] } }
+            ]
+          },
+          "then": { "required": ["selectedProxy"] }
+        },
+        {
+          "if": { "properties": { "sourceType": { "const": "manual_node" } }, "required": ["sourceType"] },
+          "then": { "not": { "required": ["selectedProxy"] } }
+        },
+        {
+          "if": { "properties": { "dnsMode": { "const": "fake_ip" } }, "required": ["dnsMode"] },
+          "then": { "required": ["fakeIpRange"] },
+          "else": { "not": { "required": ["fakeIpRange"] } }
+        }
+      ]
+    },
+    "WireGuardPeer": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["runtimeId", "publicKey", "allowedIPs", "persistentKeepaliveSeconds"],
+      "properties": {
+        "runtimeId": { "$ref": "#/$defs/Identifier" },
+        "deviceId": { "$ref": "#/$defs/Identifier" },
+        "publicKey": { "$ref": "#/$defs/WireGuardPublicKey" },
+        "endpointHost": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 253,
+          "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?$"
+        },
+        "endpointPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
+        "allowedIPs": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/SplitRoute" }
+        },
+        "persistentKeepaliveSeconds": { "type": "integer", "minimum": 0, "maximum": 300 }
+      },
+      "dependentRequired": {
+        "endpointHost": ["endpointPort"],
+        "endpointPort": ["endpointHost"]
+      }
+    },
+    "WireGuardFirewallRule": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "effect", "sourceCidr", "destinationCidr", "protocol"],
+      "properties": {
+        "id": { "$ref": "#/$defs/Identifier" },
+        "effect": { "enum": ["allow", "deny"] },
+        "leaseId": { "$ref": "#/$defs/Identifier" },
+        "siteLinkRuntimeId": { "$ref": "#/$defs/Identifier" },
+        "direction": { "enum": ["from_wireguard", "to_wireguard"] },
+        "sourceCidr": { "$ref": "#/$defs/SplitRoute" },
+        "destinationCidr": { "$ref": "#/$defs/SplitRoute" },
+        "protocol": { "enum": ["any", "tcp", "udp", "icmp"] },
+        "ports": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "uniqueItems": true,
+          "items": { "type": "integer", "minimum": 1, "maximum": 65535 }
+        },
+        "expiresAt": { "type": "string", "format": "date-time" }
+      },
+      "allOf": [
+        {
+          "if": { "properties": { "effect": { "const": "allow" } }, "required": ["effect"] },
+          "then": {
+            "required": ["expiresAt"],
+            "oneOf": [
+              { "required": ["leaseId"], "not": { "required": ["siteLinkRuntimeId"] } },
+              { "required": ["siteLinkRuntimeId", "direction"], "not": { "required": ["leaseId"] } }
+            ]
+          }
+        },
+        {
+          "if": { "properties": { "protocol": { "enum": ["any", "icmp"] } }, "required": ["protocol"] },
+          "then": { "not": { "required": ["ports"] } }
+        },
+        { "not": { "required": ["leaseId", "siteLinkRuntimeId"] } }
+      ],
+      "dependentRequired": {
+        "siteLinkRuntimeId": ["direction", "expiresAt"],
+        "direction": ["siteLinkRuntimeId"]
+      }
+    },
+    "WireGuardConfiguration": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["role", "interfaceName", "publicKey", "addresses", "mtu", "routingMode", "firewallDefault", "peers", "routes", "firewallRules"],
+      "properties": {
+        "role": { "enum": ["endpoint", "gateway"] },
+        "interfaceName": { "type": "string", "minLength": 1, "maxLength": 15, "pattern": "^[A-Za-z][A-Za-z0-9_.-]*$" },
+        "publicKey": { "$ref": "#/$defs/WireGuardPublicKey" },
+        "addresses": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 8,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/SplitRoute" }
+        },
+        "listenPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
+        "mtu": { "type": "integer", "minimum": 1280, "maximum": 1500 },
+        "routingMode": { "enum": ["routed", "snat"] },
+        "firewallDefault": { "const": "deny" },
+        "peers": {
+          "type": "array",
+          "maxItems": 1024,
+          "items": { "$ref": "#/$defs/WireGuardPeer" }
+        },
+        "routes": {
+          "type": "array",
+          "maxItems": 256,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/SplitRoute" }
+        },
+        "dnsServers": {
+          "type": "array",
+          "maxItems": 8,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/IPv4Address" }
+        },
+        "firewallRules": {
+          "type": "array",
+          "maxItems": 4096,
+          "items": { "$ref": "#/$defs/WireGuardFirewallRule" }
+        }
+      },
+      "allOf": [{
+        "if": { "properties": { "role": { "const": "gateway" } }, "required": ["role"] },
+        "then": { "required": ["listenPort"] }
+      }]
+    },
+    "ConfigurationApplied": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["configurationVersion", "policyVersion", "status", "readbackHash"],
+      "properties": {
+        "configurationVersion": { "type": "integer", "minimum": 1 },
+        "policyVersion": { "type": "integer", "minimum": 1 },
+        "status": { "enum": ["applied", "rejected", "rolled-back"] },
+        "readbackHash": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "reasonCode": { "type": "string", "minLength": 1, "maxLength": 128 }
+      }
+    },
+    "LeaseRenewRequest": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sessionId", "leaseIds", "observedConfigurationVersion"],
+      "properties": {
+        "sessionId": { "$ref": "#/$defs/Identifier" },
+        "leaseIds": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 512,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/Identifier" }
+        },
+        "observedConfigurationVersion": { "type": "integer", "minimum": 1 },
+        "postureVersion": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "LeaseRenewResult": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["policyVersion", "validUntil", "networkLeases", "resourceLeases", "revokedLeaseIds"],
+      "properties": {
+        "policyVersion": { "type": "integer", "minimum": 1 },
+        "validUntil": { "type": "string", "format": "date-time" },
+        "networkLeases": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/NetworkLease" } },
+        "resourceLeases": { "type": "array", "maxItems": 512, "items": { "$ref": "#/$defs/ResourceLease" } },
+        "revokedLeaseIds": {
+          "type": "array",
+          "maxItems": 512,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/Identifier" }
+        }
+      }
+    },
+    "LeaseRevoke": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sessionId", "leaseIds", "reasonCode", "effectiveAt"],
+      "properties": {
+        "sessionId": { "$ref": "#/$defs/Identifier" },
+        "leaseIds": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 512,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/Identifier" }
+        },
+        "reasonCode": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "effectiveAt": { "type": "string", "format": "date-time" }
+      }
+    },
+    "VPNConnectRequest": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["requestId", "siteId", "networkSpaceId", "mode"],
+      "properties": {
+        "requestId": { "$ref": "#/$defs/Identifier" },
+        "siteId": { "$ref": "#/$defs/Identifier" },
+        "networkSpaceId": { "$ref": "#/$defs/Identifier" },
+        "gatewayId": { "$ref": "#/$defs/Identifier" },
+        "mode": { "enum": ["internal_ztna", "external_vpn", "external_vpn_ztna", "external_direct_ztna"] },
+        "resourceIds": {
+          "type": "array",
+          "maxItems": 256,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/Identifier" }
+        },
+        "accessGrantId": { "$ref": "#/$defs/Identifier" },
+        "accessGrantToken": {
+          "type": "string",
+          "minLength": 32,
+          "maxLength": 512
+        }
+      },
+      "allOf": [{
+        "if": { "properties": { "mode": { "const": "external_vpn" } }, "required": ["mode"] },
+        "then": {
+          "properties": { "resourceIds": { "maxItems": 0 } },
+          "not": { "anyOf": [{ "required": ["accessGrantId"] }, { "required": ["accessGrantToken"] }] }
+        },
+        "else": {
+          "required": ["resourceIds", "accessGrantId", "accessGrantToken"],
+          "properties": { "resourceIds": { "minItems": 1 } }
+        }
+      }]
+    },
+    "VPNConnectResult": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["requestId", "decision", "reasonCode", "policyVersion", "validUntil", "networkLeases", "resourceLeases"],
+      "properties": {
+        "requestId": { "$ref": "#/$defs/Identifier" },
+        "decision": { "enum": ["allow", "deny"] },
+        "reasonCode": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "sessionId": { "$ref": "#/$defs/Identifier" },
+        "gatewayId": { "$ref": "#/$defs/Identifier" },
+        "configurationVersion": { "type": "integer", "minimum": 1 },
+        "policyVersion": { "type": "integer", "minimum": 1 },
+        "validUntil": { "type": "string", "format": "date-time" },
+        "networkLeases": {
+          "type": "array",
+          "maxItems": 256,
+          "items": { "$ref": "#/$defs/NetworkLease" }
+        },
+        "resourceLeases": {
+          "type": "array",
+          "maxItems": 512,
+          "items": { "$ref": "#/$defs/ResourceLease" }
+        }
+      },
+      "allOf": [{
+        "if": { "properties": { "decision": { "const": "allow" } }, "required": ["decision"] },
+        "then": {
+          "required": ["sessionId", "gatewayId", "configurationVersion"],
+          "anyOf": [
+            { "properties": { "networkLeases": { "minItems": 1 } } },
+            { "properties": { "resourceLeases": { "minItems": 1 } } }
+          ]
+        },
+        "else": {
+          "properties": {
+            "networkLeases": { "maxItems": 0 },
+            "resourceLeases": { "maxItems": 0 }
+          }
+        }
+      }]
+    },
+    "NASAuthorizationRequest": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["requestId", "nasId", "subjectId", "authenticationMethod"],
+      "properties": {
+        "requestId": { "$ref": "#/$defs/Identifier" },
+        "nasId": { "$ref": "#/$defs/Identifier" },
+        "subjectId": { "$ref": "#/$defs/Identifier" },
+        "deviceId": { "$ref": "#/$defs/Identifier" },
+        "stationId": { "$ref": "#/$defs/Identifier" },
+        "authenticationMethod": { "enum": ["eap-tls", "password-compatible"] },
+        "clientCertificateSerial": { "type": "string", "pattern": "^[A-Fa-f0-9]{1,40}$" },
+        "clientCertificateAuthorityKeyId": { "type": "string", "minLength": 16, "maxLength": 191, "pattern": "^[A-Fa-f0-9:]+$" }
+      },
+      "allOf": [{
+        "if": { "properties": { "authenticationMethod": { "const": "eap-tls" } }, "required": ["authenticationMethod"] },
+        "then": {
+          "required": ["stationId", "clientCertificateSerial", "clientCertificateAuthorityKeyId"],
+          "not": { "required": ["deviceId"] }
+        },
+        "else": {
+          "required": ["deviceId"],
+          "not": {
+            "anyOf": [
+              { "required": ["clientCertificateSerial"] },
+              { "required": ["clientCertificateAuthorityKeyId"] }
+            ]
+          }
+        }
+      }]
+    },
+    "NASAuthorizationResult": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["requestId", "sessionId", "decision", "accessProfile", "policyVersion", "validUntil", "reasonCode"],
+      "properties": {
+        "requestId": { "$ref": "#/$defs/Identifier" },
+        "sessionId": { "$ref": "#/$defs/Identifier" },
+        "decision": { "enum": ["allow", "deny"] },
+        "accessProfile": { "$ref": "#/$defs/AccessProfile" },
+        "policyVersion": { "type": "integer", "minimum": 1 },
+        "validUntil": { "type": "string", "format": "date-time" },
+        "reasonCode": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "radiusAttributes": { "$ref": "#/$defs/RadiusAttributes" }
+      }
+    },
+    "NASSessionCommand": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["commandId", "sessionId", "nasId", "subjectId", "deviceId", "action", "targetAccessProfile", "policyVersion", "effectiveAt", "reasonCode"],
+      "properties": {
+        "commandId": { "$ref": "#/$defs/Identifier" },
+        "sessionId": { "$ref": "#/$defs/Identifier" },
+        "nasId": { "$ref": "#/$defs/Identifier" },
+        "subjectId": { "$ref": "#/$defs/Identifier" },
+        "deviceId": { "$ref": "#/$defs/Identifier" },
+        "action": { "enum": ["coa", "disconnect"] },
+        "targetAccessProfile": { "$ref": "#/$defs/AccessProfile" },
+        "policyVersion": { "type": "integer", "minimum": 1 },
+        "effectiveAt": { "type": "string", "format": "date-time" },
+        "reasonCode": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "radiusAttributes": { "$ref": "#/$defs/RadiusAttributes" }
+      }
+    },
+    "NASSessionCommandResult": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["commandId", "sessionId", "status", "reasonCode", "completedAt"],
+      "properties": {
+        "commandId": { "$ref": "#/$defs/Identifier" },
+        "sessionId": { "$ref": "#/$defs/Identifier" },
+        "status": { "enum": ["applied", "rejected", "unsupported", "timed-out"] },
+        "reasonCode": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "completedAt": { "type": "string", "format": "date-time" }
+      }
+    }
+  }
+}