@opensoha/contracts 0.1.16 → 0.1.17

package/fixtures/json-schema/network-runtime-protocol/valid/direct-ztna-result.json

@@ -0,0 +1,33 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-direct-ztna-result-0001",
+  "messageType": "vpn.connect.result",
+  "producerId": "network-control",
+  "runtimeId": "endpoint-alice",
+  "runtimeKind": "endpoint",
+  "occurredAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T08:05:00Z",
+  "payload": {
+    "requestId": "direct-ztna-request-0001",
+    "decision": "allow",
+    "reasonCode": "policy_allowed",
+    "sessionId": "session-direct-ztna-0001",
+    "gatewayId": "gateway-site-a",
+    "configurationVersion": 14,
+    "policyVersion": 7,
+    "validUntil": "2026-09-02T08:05:00Z",
+    "networkLeases": [],
+    "resourceLeases": [
+      {
+        "id": "resource-lease-0001",
+        "sessionId": "session-direct-ztna-0001",
+        "subjectId": "user-alice",
+        "deviceId": "device-alice-laptop",
+        "resourceIds": ["resource-payroll"],
+        "policyVersion": 7,
+        "issuedAt": "2026-09-02T08:00:00Z",
+        "expiresAt": "2026-09-02T08:05:00Z"
+      }
+    ]
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/valid/internal-ztna-connect.json

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-internal-ztna-connect",
+  "messageType": "vpn.connect.request",
+  "producerId": "endpoint-1",
+  "runtimeId": "endpoint-1",
+  "runtimeKind": "endpoint",
+  "occurredAt": "2026-09-03T08:00:00Z",
+  "expiresAt": "2026-09-03T08:01:00Z",
+  "payload": {
+    "requestId": "request-internal-ztna",
+    "siteId": "site-hq",
+    "networkSpaceId": "space-corp",
+    "mode": "internal_ztna",
+    "resourceIds": ["resource-payroll"],
+    "accessGrantId": "grant-payroll",
+    "accessGrantToken": "YIaq5kG3s-x3KpzJc7E3u2lDscGxdxyup08ngBRWm2Y"
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/valid/mihomo-app-subscription-configuration.json

@@ -0,0 +1,32 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-config-mihomo-app-0001",
+  "messageType": "configuration.desired",
+  "producerId": "network-control",
+  "runtimeId": "endpoint-bob",
+  "runtimeKind": "endpoint",
+  "occurredAt": "2026-09-03T08:00:00Z",
+  "expiresAt": "2026-09-03T08:05:00Z",
+  "payload": {
+    "configurationVersion": 3,
+    "policyVersion": 7,
+    "validUntil": "2026-09-03T08:05:00Z",
+    "accessProfile": "full",
+    "protectedResourceIds": [],
+    "networkLeases": [],
+    "resourceLeases": [],
+    "mihomo": {
+      "mode": "app_subscription",
+      "profileId": "profile-personal",
+      "profileRevision": 1,
+      "mixedPort": 7890,
+      "controllerPort": 9090,
+      "dnsMode": "fake_ip",
+      "fakeIpRange": "198.18.0.0/15",
+      "selectorGroup": "SOHA",
+      "bypassCidrs": [],
+      "bypassHosts": ["network-control.example.com"],
+      "failClosed": false
+    }
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/valid/mihomo-manual-node-configuration.json

@@ -0,0 +1,32 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-config-mihomo-manual-0001",
+  "messageType": "configuration.desired",
+  "producerId": "network-control",
+  "runtimeId": "endpoint-alice",
+  "runtimeKind": "endpoint",
+  "occurredAt": "2026-09-03T08:00:00Z",
+  "expiresAt": "2026-09-03T08:05:00Z",
+  "payload": {
+    "configurationVersion": 14,
+    "policyVersion": 7,
+    "validUntil": "2026-09-03T08:05:00Z",
+    "accessProfile": "full",
+    "protectedResourceIds": [],
+    "networkLeases": [],
+    "resourceLeases": [],
+    "mihomo": {
+      "mode": "managed_follow",
+      "sourceType": "manual_node",
+      "profileId": "profile-branch-egress",
+      "profileRevision": 1,
+      "mixedPort": 7890,
+      "controllerPort": 9090,
+      "dnsMode": "disabled",
+      "selectorGroup": "SOHA",
+      "bypassCidrs": [],
+      "bypassHosts": ["network-control.example.com"],
+      "failClosed": true
+    }
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/valid/mihomo-wireguard-configuration.json

@@ -0,0 +1,70 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-config-mihomo-0001",
+  "messageType": "configuration.desired",
+  "producerId": "network-control",
+  "runtimeId": "endpoint-alice",
+  "runtimeKind": "endpoint",
+  "occurredAt": "2026-09-03T08:00:00Z",
+  "expiresAt": "2026-09-03T08:05:00Z",
+  "payload": {
+    "configurationVersion": 13,
+    "policyVersion": 7,
+    "validUntil": "2026-09-03T08:05:00Z",
+    "accessProfile": "full",
+    "protectedResourceIds": ["resource-payroll"],
+    "networkLeases": [{
+      "id": "network-lease-0001",
+      "sessionId": "session-0001",
+      "subjectId": "user-alice",
+      "deviceId": "device-alice-laptop",
+      "networkSpaceId": "space-site-a",
+      "cidrs": ["10.20.0.0/16"],
+      "policyVersion": 7,
+      "issuedAt": "2026-09-03T08:00:00Z",
+      "expiresAt": "2026-09-03T08:05:00Z"
+    }],
+    "resourceLeases": [],
+    "wireguard": {
+      "role": "endpoint",
+      "interfaceName": "soha0",
+      "publicKey": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
+      "addresses": ["100.96.10.2/32"],
+      "mtu": 1380,
+      "routingMode": "routed",
+      "firewallDefault": "deny",
+      "peers": [{
+        "runtimeId": "gateway-site-a",
+        "publicKey": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=",
+        "endpointHost": "vpn.example.com",
+        "endpointPort": 51820,
+        "allowedIPs": ["10.20.0.0/16"],
+        "persistentKeepaliveSeconds": 25
+      }],
+      "routes": ["10.20.0.0/16"],
+      "dnsServers": ["10.20.0.53"],
+      "firewallRules": [{
+        "id": "allow-network-lease-0001",
+        "effect": "allow",
+        "leaseId": "network-lease-0001",
+        "sourceCidr": "100.96.10.2/32",
+        "destinationCidr": "10.20.0.0/16",
+        "protocol": "any",
+        "expiresAt": "2026-09-03T08:05:00Z"
+      }]
+    },
+    "mihomo": {
+      "mode": "managed_follow",
+      "profileId": "profile-corporate-egress",
+      "profileRevision": 4,
+      "mixedPort": 7890,
+      "controllerPort": 9090,
+      "dnsMode": "disabled",
+      "selectorGroup": "SOHA",
+      "selectedProxy": "corporate-hk",
+      "bypassCidrs": ["10.20.0.0/16"],
+      "bypassHosts": ["network-control.example.com", "vpn.example.com"],
+      "failClosed": true
+    }
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/valid/nas-authorization-request.json

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-nas-authorize-0001",
+  "messageType": "nas.authorization.request",
+  "producerId": "freeradius-site-a",
+  "runtimeId": "freeradius-site-a",
+  "runtimeKind": "nas",
+  "occurredAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T08:00:05Z",
+  "payload": {
+    "requestId": "radius-request-0001",
+    "nasId": "nas-site-a-wifi",
+    "subjectId": "user-alice",
+    "stationId": "AA-BB-CC-DD-EE-FF",
+    "authenticationMethod": "eap-tls",
+    "clientCertificateSerial": "753484ff6e444ae9d86814989e85cb2fdd462193",
+    "clientCertificateAuthorityKeyId": "E9:00:0C:AE:78:0F:99:45:07:FF:4D:B0:49:E4:20:84:C7:5A:7A:BA"
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/valid/nas-authorization-result.json

@@ -0,0 +1,24 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-nas-authorize-result-0001",
+  "messageType": "nas.authorization.result",
+  "producerId": "network-control",
+  "runtimeId": "freeradius-site-a",
+  "runtimeKind": "nas",
+  "occurredAt": "2026-09-02T08:00:01Z",
+  "expiresAt": "2026-09-02T08:00:06Z",
+  "payload": {
+    "requestId": "radius-request-0001",
+    "sessionId": "session-0001",
+    "decision": "allow",
+    "accessProfile": "full",
+    "policyVersion": 7,
+    "validUntil": "2026-09-02T09:00:00Z",
+    "reasonCode": "policy_allowed",
+    "radiusAttributes": {
+      "vlanId": 20,
+      "filterId": "soha-full",
+      "sessionTimeoutSeconds": 3600
+    }
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/valid/nas-session-command-result.json

@@ -0,0 +1,17 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-nas-command-result-0001",
+  "messageType": "nas.session.command.result",
+  "producerId": "freeradius-site-a",
+  "runtimeId": "freeradius-site-a",
+  "runtimeKind": "nas",
+  "occurredAt": "2026-09-02T08:10:02Z",
+  "expiresAt": "2026-09-02T08:10:07Z",
+  "payload": {
+    "commandId": "coa-command-0001",
+    "sessionId": "session-0001",
+    "status": "applied",
+    "reasonCode": "coa_ack",
+    "completedAt": "2026-09-02T08:10:02Z"
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/valid/nas-session-command.json

@@ -0,0 +1,27 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-nas-command-0001",
+  "messageType": "nas.session.command",
+  "producerId": "network-control",
+  "runtimeId": "freeradius-site-a",
+  "runtimeKind": "nas",
+  "occurredAt": "2026-09-02T08:10:00Z",
+  "expiresAt": "2026-09-02T08:10:30Z",
+  "payload": {
+    "commandId": "coa-command-0001",
+    "sessionId": "session-0001",
+    "nasId": "nas-site-a-wifi",
+    "subjectId": "user-0001",
+    "deviceId": "device-0001",
+    "action": "coa",
+    "targetAccessProfile": "quarantine",
+    "policyVersion": 8,
+    "effectiveAt": "2026-09-02T08:10:00Z",
+    "reasonCode": "device_non_compliant",
+    "radiusAttributes": {
+      "vlanId": 90,
+      "filterId": "soha-quarantine",
+      "sessionTimeoutSeconds": 300
+    }
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/valid/vpn-connect-request.json

@@ -0,0 +1,17 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-vpn-connect-0001",
+  "messageType": "vpn.connect.request",
+  "producerId": "endpoint-alice",
+  "runtimeId": "endpoint-alice",
+  "runtimeKind": "endpoint",
+  "occurredAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T08:05:00Z",
+  "payload": {
+    "requestId": "vpn-request-0001",
+    "siteId": "site-shanghai",
+    "networkSpaceId": "space-site-a",
+    "gatewayId": "gateway-site-b",
+    "mode": "external_vpn"
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/valid/vpn-connect-result.json

@@ -0,0 +1,34 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-vpn-connect-result-0001",
+  "messageType": "vpn.connect.result",
+  "producerId": "network-control",
+  "runtimeId": "endpoint-alice",
+  "runtimeKind": "endpoint",
+  "occurredAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T08:05:00Z",
+  "payload": {
+    "requestId": "vpn-request-0001",
+    "decision": "allow",
+    "reasonCode": "policy_allowed",
+    "sessionId": "session-vpn-0001",
+    "gatewayId": "gateway-site-a",
+    "configurationVersion": 13,
+    "policyVersion": 7,
+    "validUntil": "2026-09-02T08:05:00Z",
+    "networkLeases": [
+      {
+        "id": "network-lease-0001",
+        "sessionId": "session-vpn-0001",
+        "subjectId": "user-alice",
+        "deviceId": "device-alice-laptop",
+        "networkSpaceId": "space-site-a",
+        "cidrs": ["10.20.0.0/16"],
+        "policyVersion": 7,
+        "issuedAt": "2026-09-02T08:00:00Z",
+        "expiresAt": "2026-09-02T08:05:00Z"
+      }
+    ],
+    "resourceLeases": []
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/valid/wireguard-enrollment.json

@@ -0,0 +1,20 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-enroll-wireguard-0001",
+  "messageType": "runtime.enroll.request",
+  "producerId": "endpoint-alice",
+  "runtimeId": "endpoint-alice",
+  "runtimeKind": "endpoint",
+  "occurredAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T08:05:00Z",
+  "payload": {
+    "enrollmentId": "enrollment-alice",
+    "challengeId": "challenge-alice",
+    "deviceId": "device-alice-laptop",
+    "devicePublicKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA7qY8R9gAwRQmJau0p7uB8mVJwA6m3i3zYvRrV7lIl1E=\n-----END PUBLIC KEY-----",
+    "wireguardPublicKey": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=",
+    "platform": "windows",
+    "clientVersion": "0.2.0",
+    "capabilities": ["wireguard", "route-coordinator", "dns-coordinator"]
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/valid/wireguard-site-link.json

@@ -0,0 +1,48 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-config-site-link-0001",
+  "messageType": "configuration.desired",
+  "producerId": "network-control-default",
+  "runtimeId": "gateway-site-b",
+  "runtimeKind": "gateway",
+  "occurredAt": "2026-09-03T08:00:00Z",
+  "expiresAt": "2026-09-03T08:05:00Z",
+  "payload": {
+    "configurationVersion": 13,
+    "policyVersion": 7,
+    "validUntil": "2026-09-03T08:05:00Z",
+    "accessProfile": "full",
+    "protectedResourceIds": [],
+    "networkLeases": [],
+    "resourceLeases": [],
+    "wireguard": {
+      "role": "gateway",
+      "interfaceName": "soha0",
+      "publicKey": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=",
+      "addresses": ["100.97.0.1/32"],
+      "listenPort": 51821,
+      "mtu": 1380,
+      "routingMode": "routed",
+      "firewallDefault": "deny",
+      "peers": [{
+        "runtimeId": "gateway-site-a",
+        "publicKey": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
+        "endpointHost": "vpn-a.example.com",
+        "endpointPort": 51820,
+        "allowedIPs": ["100.96.0.0/24", "10.20.0.0/16", "10.30.0.0/16"],
+        "persistentKeepaliveSeconds": 25
+      }],
+      "routes": ["100.96.0.0/24", "10.20.0.0/16", "10.30.0.0/16"],
+      "firewallRules": [{
+        "id": "site-a-to-b",
+        "effect": "allow",
+        "siteLinkRuntimeId": "gateway-site-a",
+        "direction": "from_wireguard",
+        "sourceCidr": "10.20.0.0/16",
+        "destinationCidr": "10.40.0.0/16",
+        "protocol": "any",
+        "expiresAt": "2026-09-03T08:05:00Z"
+      }]
+    }
+  }
+}

package/fixtures/openapi/AnnouncementReceiptPageEnvelope/invalid/missing-read-count.json

@@ -0,0 +1,9 @@
+{
+  "data": {
+    "items": [],
+    "total": 0,
+    "page": 1,
+    "pageSize": 15,
+    "unreadCount": 0
+  }
+}

package/fixtures/openapi/AnnouncementReceiptPageEnvelope/valid/read-and-unread.json

@@ -0,0 +1,28 @@
+{
+  "data": {
+    "items": [
+      {
+        "userId": "3f4b8782-566f-4b55-9b86-791bf24ca5e8",
+        "username": "ada",
+        "displayName": "Ada",
+        "email": "ada@example.test",
+        "teamNames": ["研发中心"],
+        "isRead": true,
+        "readAt": "2026-09-04T08:00:00Z"
+      },
+      {
+        "userId": "5b550b5a-f8c8-47a7-ab42-57c030d30c3e",
+        "username": "lin",
+        "displayName": "Lin",
+        "email": "lin@example.test",
+        "teamNames": [],
+        "isRead": false
+      }
+    ],
+    "total": 2,
+    "page": 1,
+    "pageSize": 15,
+    "readCount": 1,
+    "unreadCount": 1
+  }
+}

package/fixtures/openapi/EndpointDevice/invalid/missing-owner.json

@@ -0,0 +1,8 @@
+{
+  "id": "device-01",
+  "name": "Alice Windows",
+  "status": "active",
+  "platform": "windows",
+  "createdAt": "2026-09-02T08:00:00Z",
+  "updatedAt": "2026-09-02T08:00:00Z"
+}

package/fixtures/openapi/EndpointDevice/valid/active.json

@@ -0,0 +1,35 @@
+{
+  "id": "device-01",
+  "name": "Alice Windows",
+  "ownerUserId": "user-01",
+  "status": "active",
+  "platform": "windows",
+  "deviceType": "laptop",
+  "ownershipType": "company",
+  "postureStatus": "compliant",
+  "postureVersion": 3,
+  "credentialGeneration": 1,
+  "reportedFacts": {
+    "osName": "Windows",
+    "osVersion": "11 Pro",
+    "osBuild": "26100",
+    "architecture": "amd64",
+    "manufacturer": "Lenovo",
+    "model": "ThinkPad T14",
+    "serialNumber": "PF000001",
+    "agentVersion": "0.2.0",
+    "collectedAt": "2026-09-02T07:59:00Z",
+    "networkInterfaces": [
+      {
+        "name": "Ethernet",
+        "kind": "physical",
+        "status": "up",
+        "macAddress": "00:11:22:33:44:55",
+        "ipv4Addresses": ["10.0.12.44"],
+        "ipv6Addresses": ["fe80::1"]
+      }
+    ]
+  },
+  "createdAt": "2026-09-02T08:00:00Z",
+  "updatedAt": "2026-09-02T08:00:00Z"
+}

package/fixtures/openapi/EndpointDeviceRegistrationInput/invalid/client-owned-status.json

@@ -0,0 +1,5 @@
+{
+  "name": "Shanchui's Mac",
+  "platform": "darwin",
+  "status": "active"
+}

package/fixtures/openapi/EndpointDeviceRegistrationInput/invalid/oversized-network-inventory.json

@@ -0,0 +1,18 @@
+{
+  "name": "Mac",
+  "platform": "darwin",
+  "reportedFacts": {
+    "architecture": "arm64",
+    "agentVersion": "0.2.0",
+    "collectedAt": "2026-09-03T09:00:00Z",
+    "networkInterfaces": [
+      {
+        "name": "en0",
+        "kind": "physical",
+        "status": "up",
+        "ipv4Addresses": ["not-an-ip"],
+        "ipv6Addresses": []
+      }
+    ]
+  }
+}

package/fixtures/openapi/EndpointDeviceRegistrationInput/valid/macos.json

@@ -0,0 +1,28 @@
+{
+  "name": "Shanchui's Mac",
+  "hostname": "shanchui-mac.local",
+  "platform": "darwin",
+  "deviceType": "laptop",
+  "reportedFacts": {
+    "osName": "macOS",
+    "osVersion": "15.6.1",
+    "osBuild": "24G90",
+    "architecture": "arm64",
+    "manufacturer": "Apple",
+    "model": "MacBookAir15,2",
+    "serialNumber": "C02TEST00001",
+    "agentVersion": "0.2.0",
+    "collectedAt": "2026-09-03T09:00:00Z",
+    "networkInterfaces": [
+      {
+        "name": "en0",
+        "displayName": "Wi-Fi",
+        "kind": "physical",
+        "status": "up",
+        "macAddress": "00:11:22:33:44:55",
+        "ipv4Addresses": ["192.168.1.10"],
+        "ipv6Addresses": ["fe80::1"]
+      }
+    ]
+  }
+}

package/fixtures/openapi/LLMUpstreamTestResultEnvelope/invalid/models-not-array.json

@@ -0,0 +1,9 @@
+{
+  "data": {
+    "status": "success",
+    "providerKind": "openai",
+    "durationMs": 42,
+    "modelCount": 1,
+    "models": "gpt-5.6-luna"
+  }
+}

package/fixtures/openapi/LLMUpstreamTestResultEnvelope/valid/discovered-models.json

@@ -0,0 +1,11 @@
+{
+  "data": {
+    "status": "success",
+    "providerKind": "openai",
+    "httpStatus": 200,
+    "durationMs": 42,
+    "modelCount": 2,
+    "models": ["gpt-5.6-luna", "gpt-5.6-sol"],
+    "checkedAt": "2026-09-02T03:04:05Z"
+  }
+}

package/fixtures/openapi/NetworkAccessGrant/invalid/token-digest.json

@@ -0,0 +1,15 @@
+{
+  "id": "grant-payroll-01",
+  "subjectId": "f7f87a34-077d-4601-af8d-c142a34755f2",
+  "deviceId": "device-shanghai-001",
+  "siteId": "site-shanghai",
+  "networkSpaceId": "space-corp",
+  "mode": "external_direct_ztna",
+  "resourceIds": ["resource-payroll"],
+  "policyVersion": 12,
+  "status": "issued",
+  "createdBy": "f7f87a34-077d-4601-af8d-c142a34755f2",
+  "createdAt": "2026-09-03T08:00:00Z",
+  "expiresAt": "2026-09-03T08:05:00Z",
+  "tokenHash": "sha256:secret"
+}

package/fixtures/openapi/NetworkAccessGrant/valid/issued.json

@@ -0,0 +1,14 @@
+{
+  "id": "grant-payroll-01",
+  "subjectId": "f7f87a34-077d-4601-af8d-c142a34755f2",
+  "deviceId": "device-shanghai-001",
+  "siteId": "site-shanghai",
+  "networkSpaceId": "space-corp",
+  "mode": "external_direct_ztna",
+  "resourceIds": ["resource-payroll"],
+  "policyVersion": 12,
+  "status": "issued",
+  "createdBy": "f7f87a34-077d-4601-af8d-c142a34755f2",
+  "createdAt": "2026-09-03T08:00:00Z",
+  "expiresAt": "2026-09-03T08:05:00Z"
+}

package/fixtures/openapi/NetworkAccessGrantInput/invalid/no-resources.json

@@ -0,0 +1,7 @@
+{
+  "deviceId": "device-shanghai-001",
+  "siteId": "site-shanghai",
+  "networkSpaceId": "space-corp",
+  "mode": "external_direct_ztna",
+  "resourceIds": []
+}

package/fixtures/openapi/NetworkAccessGrantInput/valid/direct-ztna.json

@@ -0,0 +1,8 @@
+{
+  "deviceId": "device-shanghai-001",
+  "siteId": "site-shanghai",
+  "networkSpaceId": "space-corp",
+  "mode": "external_direct_ztna",
+  "resourceIds": ["resource-payroll"],
+  "ttlSeconds": 300
+}

package/fixtures/openapi/NetworkAccessGrantSecret/invalid/short-token.json

@@ -0,0 +1,17 @@
+{
+  "grant": {
+    "id": "grant-payroll-01",
+    "subjectId": "f7f87a34-077d-4601-af8d-c142a34755f2",
+    "deviceId": "device-shanghai-001",
+    "siteId": "site-shanghai",
+    "networkSpaceId": "space-corp",
+    "mode": "external_direct_ztna",
+    "resourceIds": ["resource-payroll"],
+    "policyVersion": 12,
+    "status": "issued",
+    "createdBy": "f7f87a34-077d-4601-af8d-c142a34755f2",
+    "createdAt": "2026-09-03T08:00:00Z",
+    "expiresAt": "2026-09-03T08:05:00Z"
+  },
+  "token": "too-short"
+}