@opensoha/contracts 0.1.16 → 0.1.18

package/fixtures/json-schema/gateway-manifest/valid/versioned-task.json

@@ -0,0 +1,73 @@
+{
+  "name": "soha-ai-gateway",
+  "version": "0.1.0",
+  "generatedAt": "2026-06-09T12:00:00Z",
+  "principal": {
+    "userId": "u-1",
+    "userName": "admin",
+    "email": "admin@example.com",
+    "roles": [
+      "platform-admin"
+    ],
+    "teams": [],
+    "projects": [],
+    "tags": [],
+    "permissionKeys": [
+      "ai.gateway.view"
+    ]
+  },
+  "caller": {
+    "identityMode": "user",
+    "source": "cli"
+  },
+  "permissionKeys": [
+    "ai.gateway.view"
+  ],
+  "tools": [
+    {
+      "name": "docker.projects.deploy.trigger",
+      "title": "Deploy Docker project",
+      "description": "Start a durable Compose deployment.",
+      "domain": "docker",
+      "action": "execute",
+      "riskLevel": "execute",
+      "permissionKeys": [
+        "platform.pods.view"
+      ],
+      "requiresApproval": true,
+      "inputSchema": {
+        "type": "object",
+        "required": [
+          "projectId",
+          "idempotencyKey"
+        ],
+        "properties": {
+          "projectId": {
+            "type": "string"
+          },
+          "idempotencyKey": {
+            "type": "string"
+          }
+        }
+      },
+      "version": "1",
+      "execution": {
+        "mode": "async",
+        "idempotent": true,
+        "idempotencyKeyField": "idempotencyKey",
+        "taskKind": "docker.operation",
+        "statusTool": "docker.operations.get"
+      }
+    }
+  ],
+  "resources": [],
+  "prompts": [],
+  "skills": [],
+  "summary": {
+    "toolCount": 1,
+    "resourceCount": 0,
+    "promptCount": 0,
+    "skillCount": 0,
+    "deniedCount": 0
+  }
+}

package/fixtures/json-schema/network-ingest-event/invalid/duplicate-event.json

@@ -0,0 +1,33 @@
+{
+  "schemaVersion": "network-ingest/v1alpha1",
+  "batchId": "batch-duplicate-0001",
+  "producerId": "gateway-site-a",
+  "producerKind": "gateway",
+  "sentAt": "2026-09-02T08:01:00Z",
+  "events": [
+    {
+      "id": "event-duplicate-0001",
+      "type": "runtime.heartbeat",
+      "sequence": 101,
+      "occurredAt": "2026-09-02T08:00:59Z",
+      "payload": {
+        "status": "healthy",
+        "configurationVersion": 12,
+        "policyVersion": 7,
+        "uptimeSeconds": 3600
+      }
+    },
+    {
+      "id": "event-duplicate-0001",
+      "type": "runtime.heartbeat",
+      "sequence": 101,
+      "occurredAt": "2026-09-02T08:00:59Z",
+      "payload": {
+        "status": "healthy",
+        "configurationVersion": 12,
+        "policyVersion": 7,
+        "uptimeSeconds": 3600
+      }
+    }
+  ]
+}

package/fixtures/json-schema/network-ingest-event/invalid/message-payload-mismatch.json

@@ -0,0 +1,23 @@
+{
+  "schemaVersion": "network-ingest/v1alpha1",
+  "batchId": "batch-mismatch-0001",
+  "producerId": "gateway-site-a",
+  "producerKind": "gateway",
+  "sentAt": "2026-09-02T08:01:00Z",
+  "events": [
+    {
+      "id": "event-mismatch-0001",
+      "type": "runtime.heartbeat",
+      "sequence": 104,
+      "occurredAt": "2026-09-02T08:01:00Z",
+      "payload": {
+        "sessionId": "session-0001",
+        "resourceId": "resource-payroll",
+        "protocol": "tcp",
+        "destinationPort": 443,
+        "state": "denied",
+        "reasonCode": "missing_resource_lease"
+      }
+    }
+  ]
+}

package/fixtures/json-schema/network-ingest-event/invalid/password.json

@@ -0,0 +1,22 @@
+{
+  "schemaVersion": "network-ingest/v1alpha1",
+  "batchId": "batch-radius-secret",
+  "producerId": "freeradius-site-a",
+  "producerKind": "freeradius",
+  "sentAt": "2026-09-02T08:01:00Z",
+  "events": [
+    {
+      "id": "event-accounting-secret",
+      "type": "radius.accounting",
+      "sequence": 32,
+      "occurredAt": "2026-09-02T08:00:58Z",
+      "payload": {
+        "statusType": "start",
+        "accountingSessionId": "radius-session-0001",
+        "nasId": "nas-site-a-wifi",
+        "sessionTimeSeconds": 0,
+        "userPassword": "must-never-enter-ingest"
+      }
+    }
+  ]
+}

package/fixtures/json-schema/network-ingest-event/invalid/proxy-flow-destination.json

@@ -0,0 +1,28 @@
+{
+  "schemaVersion": "network-ingest/v1alpha1",
+  "batchId": "batch-endpoint-proxy-invalid",
+  "producerId": "endpoint-0001",
+  "producerKind": "endpoint",
+  "sentAt": "2026-09-02T08:01:00Z",
+  "events": [
+    {
+      "id": "event-proxy-flow-invalid",
+      "type": "proxy.flow.aggregate",
+      "sequence": 103,
+      "occurredAt": "2026-09-02T08:01:00Z",
+      "payload": {
+        "windowStartedAt": "2026-09-02T08:00:00Z",
+        "windowEndedAt": "2026-09-02T08:01:00Z",
+		"engine": "mihomo",
+        "profileId": "mihomo-default",
+        "profileRevision": 3,
+        "mode": "app_subscription",
+        "selectedProxy": "edge-a",
+        "uploadBytes": 1024,
+        "downloadBytes": 4096,
+        "activeConnections": 2,
+        "destinationHost": "private.example.test"
+      }
+    }
+  ]
+}

package/fixtures/json-schema/network-ingest-event/invalid/vpn-probe-negative-rtt.json

@@ -0,0 +1,34 @@
+{
+  "schemaVersion": "network-ingest/v1alpha1",
+  "batchId": "probe-batch-1",
+  "producerId": "endpoint-1",
+  "producerKind": "endpoint",
+  "sentAt": "2026-09-09T10:00:05Z",
+  "events": [
+    {
+      "id": "probe-event-1",
+      "sequence": 1,
+      "type": "vpn.probe.batch",
+      "occurredAt": "2026-09-09T10:00:04Z",
+      "payload": {
+        "intentId": "intent-1",
+        "profileId": "profile-1",
+        "profileRevision": 1,
+        "selectionPolicyRevision": 1,
+        "batchId": "probe-batch-1",
+        "networkEpoch": "net-1",
+        "windowStartedAt": "2026-09-09T10:00:00Z",
+        "windowEndedAt": "2026-09-09T10:00:04Z",
+        "results": [
+          {
+            "gatewayId": "gateway-a",
+            "sentCount": 3,
+            "rttSamplesMs": [
+              -1
+            ]
+          }
+        ]
+      }
+    }
+  ]
+}

package/fixtures/json-schema/network-ingest-event/invalid/vpn-stats-secret.json

@@ -0,0 +1,27 @@
+{
+  "schemaVersion": "network-ingest/v1alpha1",
+  "batchId": "probe-batch-1",
+  "producerId": "gateway-runtime-1",
+  "producerKind": "gateway",
+  "sentAt": "2026-09-09T10:00:05Z",
+  "events": [
+    {
+      "id": "tunnel-stats-1",
+      "sequence": 1,
+      "type": "vpn.tunnel.stats",
+      "occurredAt": "2026-09-09T10:00:04Z",
+      "payload": {
+        "sessionId": "session-1",
+        "profileId": "profile-1",
+        "gatewayId": "gateway-a",
+        "endpointRuntimeId": "endpoint-1",
+        "epoch": "epoch-1",
+        "windowStartedAt": "2026-09-09T10:00:00Z",
+        "windowEndedAt": "2026-09-09T10:00:04Z",
+        "uploadBytes": 128,
+        "downloadBytes": 256,
+        "privateKey": "never-allowed"
+      }
+    }
+  ]
+}

package/fixtures/json-schema/network-ingest-event/valid/endpoint-proxy-flow.json

@@ -0,0 +1,27 @@
+{
+  "schemaVersion": "network-ingest/v1alpha1",
+  "batchId": "batch-endpoint-proxy-0001",
+  "producerId": "endpoint-0001",
+  "producerKind": "endpoint",
+  "sentAt": "2026-09-02T08:01:00Z",
+  "events": [
+    {
+      "id": "event-proxy-flow-0001",
+      "type": "proxy.flow.aggregate",
+      "sequence": 102,
+      "occurredAt": "2026-09-02T08:01:00Z",
+      "payload": {
+        "windowStartedAt": "2026-09-02T08:00:00Z",
+        "windowEndedAt": "2026-09-02T08:01:00Z",
+		"engine": "mihomo",
+        "profileId": "mihomo-default",
+        "profileRevision": 3,
+        "mode": "app_subscription",
+        "selectedProxy": "edge-a",
+        "uploadBytes": 1024,
+        "downloadBytes": 4096,
+        "activeConnections": 2
+      }
+    }
+  ]
+}

package/fixtures/json-schema/network-ingest-event/valid/freeradius-accounting.json

@@ -0,0 +1,25 @@
+{
+  "schemaVersion": "network-ingest/v1alpha1",
+  "batchId": "batch-radius-0001",
+  "producerId": "freeradius-site-a",
+  "producerKind": "freeradius",
+  "sentAt": "2026-09-02T08:01:00Z",
+  "events": [
+    {
+      "id": "event-accounting-0001",
+      "type": "radius.accounting",
+      "sequence": 31,
+      "occurredAt": "2026-09-02T08:00:58Z",
+      "payload": {
+        "statusType": "start",
+        "accountingSessionId": "radius-session-0001",
+        "nasId": "nas-site-a-wifi",
+        "userId": "user-alice",
+        "deviceId": "device-alice-laptop",
+        "sessionTimeSeconds": 0,
+        "inputOctets": 0,
+        "outputOctets": 0
+      }
+    }
+  ]
+}

package/fixtures/json-schema/network-ingest-event/valid/gateway.json

@@ -0,0 +1,53 @@
+{
+  "schemaVersion": "network-ingest/v1alpha1",
+  "batchId": "batch-gateway-0001",
+  "producerId": "gateway-site-a",
+  "producerKind": "gateway",
+  "sentAt": "2026-09-02T08:01:00Z",
+  "events": [
+    {
+      "id": "event-heartbeat-0001",
+      "type": "runtime.heartbeat",
+      "sequence": 101,
+      "occurredAt": "2026-09-02T08:00:59Z",
+      "payload": {
+        "status": "healthy",
+        "configurationVersion": 12,
+        "policyVersion": 7,
+        "uptimeSeconds": 3600
+      }
+    },
+    {
+      "id": "event-flow-0001",
+      "type": "network.flow.aggregate",
+      "sequence": 102,
+      "occurredAt": "2026-09-02T08:01:00Z",
+      "payload": {
+        "windowStartedAt": "2026-09-02T08:00:00Z",
+        "windowEndedAt": "2026-09-02T08:01:00Z",
+        "sessionId": "session-0001",
+        "resourceId": "resource-payroll",
+        "direction": "egress",
+        "protocol": "tcp",
+        "bytes": 4096,
+        "packets": 24,
+        "connections": 2,
+        "deniedConnections": 0
+      }
+    },
+    {
+      "id": "event-connection-0001",
+      "type": "network.connection.summary",
+      "sequence": 103,
+      "occurredAt": "2026-09-02T08:01:00Z",
+      "payload": {
+        "sessionId": "session-0001",
+        "resourceId": "resource-payroll",
+        "protocol": "tcp",
+        "destinationPort": 443,
+        "state": "closed",
+        "reasonCode": "client_closed"
+      }
+    }
+  ]
+}

package/fixtures/json-schema/network-ingest-event/valid/vpn-probe-batch.json

@@ -0,0 +1,45 @@
+{
+  "schemaVersion": "network-ingest/v1alpha1",
+  "batchId": "probe-batch-1",
+  "producerId": "endpoint-1",
+  "producerKind": "endpoint",
+  "sentAt": "2026-09-09T10:00:05Z",
+  "events": [
+    {
+      "id": "probe-event-1",
+      "sequence": 1,
+      "type": "vpn.probe.batch",
+      "occurredAt": "2026-09-09T10:00:04Z",
+      "payload": {
+        "intentId": "intent-1",
+        "profileId": "profile-1",
+        "profileRevision": 1,
+        "selectionPolicyRevision": 1,
+        "batchId": "probe-batch-1",
+        "networkEpoch": "net-1",
+        "windowStartedAt": "2026-09-09T10:00:00Z",
+        "windowEndedAt": "2026-09-09T10:00:04Z",
+        "results": [
+          {
+            "gatewayId": "gateway-a",
+            "sentCount": 3,
+            "rttSamplesMs": [
+              70,
+              71,
+              69
+            ]
+          },
+          {
+            "gatewayId": "gateway-b",
+            "sentCount": 3,
+            "rttSamplesMs": [
+              20,
+              21,
+              20
+            ]
+          }
+        ]
+      }
+    }
+  ]
+}

package/fixtures/json-schema/network-ingest-event/valid/vpn-tunnel-stats.json

@@ -0,0 +1,26 @@
+{
+  "schemaVersion": "network-ingest/v1alpha1",
+  "batchId": "probe-batch-1",
+  "producerId": "gateway-runtime-1",
+  "producerKind": "gateway",
+  "sentAt": "2026-09-09T10:00:05Z",
+  "events": [
+    {
+      "id": "tunnel-stats-1",
+      "sequence": 1,
+      "type": "vpn.tunnel.stats",
+      "occurredAt": "2026-09-09T10:00:04Z",
+      "payload": {
+        "sessionId": "session-1",
+        "profileId": "profile-1",
+        "gatewayId": "gateway-a",
+        "endpointRuntimeId": "endpoint-1",
+        "epoch": "epoch-1",
+        "windowStartedAt": "2026-09-09T10:00:00Z",
+        "windowEndedAt": "2026-09-09T10:00:04Z",
+        "uploadBytes": 128,
+        "downloadBytes": 256
+      }
+    }
+  ]
+}

package/fixtures/json-schema/network-radius-accounting/invalid/password.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": "network-radius-accounting/v1alpha1",
+  "eventTimestamp": 1788336000,
+  "statusType": "start",
+  "accountingSessionId": "session-1",
+  "nasId": "nas-hq",
+  "sessionTimeSeconds": 0,
+  "userPassword": "must-not-cross-boundary"
+}

package/fixtures/json-schema/network-radius-accounting/valid/accounting.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "network-radius-accounting/v1alpha1",
+  "eventTimestamp": 1788336000,
+  "statusType": "interim-update",
+  "accountingSessionId": "session-1",
+  "sessionId": "soha-session-1",
+  "nasId": "nas-hq",
+  "nasPortId": "wlan-1",
+  "userId": "user-1",
+  "deviceId": "device-1",
+  "sessionTimeSeconds": 300,
+  "inputOctets": 1024,
+  "outputOctets": 2048,
+  "inputPackets": 10,
+  "outputPackets": 20
+}

package/fixtures/json-schema/network-runtime-protocol/invalid/invalid-cidr.json

@@ -0,0 +1,31 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-invalid-cidr",
+  "messageType": "configuration.desired",
+  "producerId": "network-control-default",
+  "runtimeId": "gateway-site-a",
+  "runtimeKind": "gateway",
+  "occurredAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T08:05:00Z",
+  "payload": {
+    "configurationVersion": 12,
+    "policyVersion": 7,
+    "validUntil": "2026-09-02T08:05:00Z",
+    "accessProfile": "full",
+    "protectedResourceIds": [],
+    "networkLeases": [
+      {
+        "id": "network-lease-invalid",
+        "sessionId": "session-0001",
+        "subjectId": "user-alice",
+        "deviceId": "device-alice-laptop",
+        "networkSpaceId": "space-site-a",
+        "cidrs": ["999.999.999.999/999"],
+        "policyVersion": 7,
+        "issuedAt": "2026-09-02T08:00:00Z",
+        "expiresAt": "2026-09-02T08:05:00Z"
+      }
+    ],
+    "resourceLeases": []
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/invalid/message-payload-mismatch.json

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-mismatch-0001",
+  "messageType": "lease.revoke",
+  "producerId": "network-control-default",
+  "runtimeId": "gateway-site-a",
+  "runtimeKind": "gateway",
+  "occurredAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T08:05:00Z",
+  "payload": {
+    "configurationVersion": 12,
+    "policyVersion": 7,
+    "validUntil": "2026-09-02T08:05:00Z",
+    "accessProfile": "full",
+    "protectedResourceIds": [],
+    "networkLeases": [],
+    "resourceLeases": []
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/invalid/mihomo-raw-subscription.json

@@ -0,0 +1,33 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-config-mihomo-secret",
+  "messageType": "configuration.desired",
+  "producerId": "network-control",
+  "runtimeId": "endpoint-alice",
+  "runtimeKind": "endpoint",
+  "occurredAt": "2026-09-03T08:00:00Z",
+  "expiresAt": "2026-09-03T08:05:00Z",
+  "payload": {
+    "configurationVersion": 13,
+    "policyVersion": 7,
+    "validUntil": "2026-09-03T08:05:00Z",
+    "accessProfile": "full",
+    "protectedResourceIds": [],
+    "networkLeases": [],
+    "resourceLeases": [],
+    "mihomo": {
+      "mode": "managed_follow",
+      "profileId": "profile-corporate-egress",
+      "profileRevision": 4,
+      "mixedPort": 7890,
+      "controllerPort": 9090,
+      "dnsMode": "disabled",
+      "selectorGroup": "SOHA",
+      "selectedProxy": "corporate-hk",
+      "bypassCidrs": [],
+      "bypassHosts": [],
+      "failClosed": true,
+      "subscriptionUrl": "https://secret.example.com/subscription?token=must-not-cross-runtime-contract"
+    }
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/invalid/nas-authorization-password.json

@@ -0,0 +1,18 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-nas-secret",
+  "messageType": "nas.authorization.request",
+  "producerId": "freeradius-site-a",
+  "runtimeId": "freeradius-site-a",
+  "runtimeKind": "nas",
+  "occurredAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T08:00:05Z",
+  "payload": {
+    "requestId": "radius-request-secret",
+    "nasId": "nas-site-a-wifi",
+    "subjectId": "user-alice",
+    "deviceId": "device-alice-laptop",
+    "authenticationMethod": "password-compatible",
+    "userPassword": "must-never-cross-the-contract"
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/invalid/nas-eap-without-certificate.json

@@ -0,0 +1,17 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-nas-eap-without-certificate",
+  "messageType": "nas.authorization.request",
+  "producerId": "freeradius-site-a",
+  "runtimeId": "freeradius-site-a",
+  "runtimeKind": "nas",
+  "occurredAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T08:00:05Z",
+  "payload": {
+    "requestId": "radius-request-eap-without-certificate",
+    "nasId": "nas-site-a-wifi",
+    "subjectId": "user-alice",
+    "stationId": "AA-BB-CC-DD-EE-FF",
+    "authenticationMethod": "eap-tls"
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/invalid/private-key.json

@@ -0,0 +1,20 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-config-secret",
+  "messageType": "configuration.desired",
+  "producerId": "network-control-default",
+  "runtimeId": "gateway-site-a",
+  "runtimeKind": "gateway",
+  "occurredAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T08:05:00Z",
+  "payload": {
+    "configurationVersion": 12,
+    "policyVersion": 7,
+    "validUntil": "2026-09-02T08:05:00Z",
+    "accessProfile": "full",
+    "protectedResourceIds": [],
+    "networkLeases": [],
+    "resourceLeases": [],
+    "wireguardPrivateKey": "must-never-cross-the-contract"
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/invalid/raw-credential-reference.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-raw-credential",
+  "messageType": "runtime.enroll.result",
+  "producerId": "network-control-default",
+  "runtimeId": "endpoint-alice-laptop",
+  "runtimeKind": "endpoint",
+  "occurredAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T08:05:00Z",
+  "payload": {
+    "accepted": true,
+    "reasonCode": "enrolled",
+    "credentialReference": "raw-private-credential-material",
+    "credentialExpiresAt": "2026-09-03T08:00:00Z"
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/invalid/runtime-interval-too-short.json

@@ -0,0 +1,23 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-config-invalid-interval",
+  "messageType": "configuration.desired",
+  "producerId": "network-control-default",
+  "runtimeId": "endpoint-alice",
+  "runtimeKind": "endpoint",
+  "occurredAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T08:05:00Z",
+  "payload": {
+    "configurationVersion": 12,
+    "policyVersion": 7,
+    "validUntil": "2026-09-02T08:05:00Z",
+    "accessProfile": "full",
+    "protectedResourceIds": [],
+    "networkLeases": [],
+    "resourceLeases": [],
+    "runtimeIntervals": {
+      "heartbeatIntervalSeconds": 29,
+      "configurationPollIntervalSeconds": 60
+    }
+  }
+}

package/fixtures/json-schema/network-runtime-protocol/invalid/vpn-managed-bad-token.json

@@ -0,0 +1,15 @@
+{
+  "schemaVersion": "network-runtime/v1alpha1",
+  "messageId": "msg-managed-1",
+  "messageType": "vpn.managed.connect.request",
+  "producerId": "endpoint-1",
+  "runtimeId": "endpoint-1",
+  "runtimeKind": "endpoint",
+  "occurredAt": "2026-09-09T10:00:00Z",
+  "expiresAt": "2026-09-09T10:01:00Z",
+  "payload": {
+    "requestId": "request-1",
+    "intentId": "intent-1",
+    "intentToken": "secret"
+  }
+}