@opensoha/contracts 0.1.18 → 0.1.20

package/COMPATIBILITY.md

@@ -364,6 +364,31 @@ role migration and consumer conformance prove no active dependency.
 
 ## Consumer Adoption
 
+Connection tests and Compute provider health checks return HTTP 200 with
+`ConnectionCheckResultEnvelope` after each fresh probe. Consumers read `healthy`
+and the diagnostic fields directly; no task or task log is created. The Compute
+endpoint still accepts `Idempotency-Key` for request compatibility, but it no
+longer replays stored checks. Operation/audit logs and existing task history are
+preserved. HTTP 202 task envelopes remain documented for older servers. Core,
+Web and CLI must adopt the new HTTP 200 result together. Discovery and asset
+synchronization remain asynchronous. The Go SDK
+`CheckComputeProviderInstanceHealth` method now returns `ConnectionCheckResult`
+instead of `ComputeTaskView`; callers consuming its fields must update with Core
+to preserve the immediate health result and diagnostic details. Upgrade Core
+before these clients. The SDK rejects legacy task responses with a server-upgrade
+error instead of reporting an empty health result; the 202 schema documents older
+server wire behavior and does not promise task polling in the new check method.
+
+Docker port mapping creation reserves control-plane metadata synchronously; it
+does not enqueue `port_reserve` or bind a host port. Existing operation kinds and
+historical records remain compatible. Service log readers use the existing
+project runtime logs API. The service-action API accepts start, stop and restart;
+`logs` returns an invalid-argument error directing callers to the direct project
+log query instead of creating a task. Compute resource actions expose only these
+mutations. Historical `connection_test`, `port_reserve`, and `service_action`
+with action `logs` remain readable, but their operation state is not retryable
+and retry requests are rejected without requeueing or appending task logs.
+
 Recommended adoption flow:
 
 1. Change contracts and fixtures here first.
@@ -402,9 +427,11 @@ behavior.
 
 ## Contracts-first consumer revisions
 
-`compat/consumer-revisions.json` pins a reviewed consumer commit when a contracts
-release introduces APIs implemented by that consumer's pending change. Both CI
-and release use the same commit and run the complete existing consumer checks.
-Unlisted consumers use `main`. Replace the pin with `main` (or remove it) once the
-matching consumer changes reach its default branch; do not skip failed checks to
-resolve a release-order dependency.
+`compat/consumer-revisions.json` pins a reviewed full commit SHA for every consumer
+in the executable matrix. CI and release use `scripts/select-consumer-revision.mjs`;
+missing or invalid revisions fail instead of falling back to `main`. Update a pin
+only with an explicit compatibility reason and successful matrix evidence.
+
+Manual CI may select `consumer_mode=latest` for separate integration evidence.
+This does not rewrite the fixed manifest or replace fixed-combination acceptance.
+Record the actual contracts and consumer commits, not only the selected mode.

package/README.md

@@ -169,6 +169,7 @@ npm run check:consumers -- --consumer soha --require-all
 npm run check:consumers -- --consumer soha-web --require-all
 npm run check:consumers -- --consumer soha-cli --require-all
 npm run check:consumers -- --consumer soha-agent --require-all
+npm run check:consumers -- --consumer soha-skills --require-all
 ```
 
 Go consumers run in a temporary `go.work` that replaces the contracts module

package/compat/consumer-revisions.json

@@ -1,3 +1,7 @@
 {
-  "soha": "d675a708806072a2fee42e3c2c00309091a8cfb9"
+  "soha": "d675a708806072a2fee42e3c2c00309091a8cfb9",
+  "soha-web": "816ec0fb82e6e804f0f66d47d3446a7b5baeabc1",
+  "soha-cli": "1c9b760c986a9c1a5148db55b72ab99d23edd7a3",
+  "soha-agent": "af1efc0b0cd6bb544153429fa28244dd6cc81ac7",
+  "soha-skills": "0345171ee1c9f23ab5d4350767395d0919dfb21c"
 }

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.18",
+  "version": "0.1.20",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.18",
+  "version": "0.1.20",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {

package/fixtures/openapi/AgentPrometheusQueryRequest/invalid/basic.json

@@ -0,0 +1,5 @@
+{
+  "endpoint": "http://prometheus:9090",
+  "query": "",
+  "kind": "proxy"
+}

package/fixtures/openapi/AgentPrometheusQueryRequest/invalid/missing-range-fields.json

@@ -0,0 +1,5 @@
+{
+  "endpoint": "http://prometheus.monitoring.svc:9090",
+  "query": "up",
+  "kind": "range"
+}

package/fixtures/openapi/AgentPrometheusQueryRequest/invalid/zero-start.json

@@ -0,0 +1,8 @@
+{
+  "endpoint": "http://prometheus.monitoring.svc:9090",
+  "query": "up",
+  "kind": "range",
+  "start": 0,
+  "end": 100,
+  "step": 1
+}

package/fixtures/openapi/AgentPrometheusQueryRequest/valid/basic.json

@@ -0,0 +1,8 @@
+{
+  "endpoint": "http://prometheus.monitoring:9090",
+  "query": "up",
+  "kind": "range",
+  "start": 1,
+  "end": 60,
+  "step": 10
+}

package/fixtures/openapi/AgentPrometheusQueryRequest/valid/instant.json

@@ -0,0 +1,5 @@
+{
+  "endpoint": "http://prometheus.monitoring.svc:9090",
+  "query": "up",
+  "kind": "instant"
+}

package/fixtures/openapi/ClusterAgentUpgradeInput/invalid/image.json

@@ -0,0 +1 @@
+{"version":"other.example/agent:latest"}

package/fixtures/openapi/ClusterAgentUpgradeInput/invalid/missing.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/ClusterAgentUpgradeInput/invalid/mutable-tag.json

@@ -0,0 +1 @@
+{"version":"latest"}

package/fixtures/openapi/ClusterAgentUpgradeInput/valid/stable.json

@@ -0,0 +1 @@
+{"version":"v0.1.7"}

package/fixtures/openapi/ClusterAgentUpgradeInput/valid/unprefixed.json

@@ -0,0 +1 @@
+{"version":"0.1.7"}

package/fixtures/openapi/ConnectionCheckResult/invalid/missing-health.json

@@ -0,0 +1 @@
+{"status":"healthy","checkedAt":"2026-09-22T00:00:00Z"}

package/fixtures/openapi/ConnectionCheckResult/invalid/task-id.json

@@ -0,0 +1 @@
+{"healthy":true,"status":"healthy","checkedAt":"2026-09-22T00:00:00Z","id":"task-1"}

package/fixtures/openapi/ConnectionCheckResult/valid/failure.json

@@ -0,0 +1 @@
+{"healthy":false,"status":"unavailable","message":"Connection refused","reason":"network","checkedAt":"2026-09-22T00:00:00Z"}

package/fixtures/openapi/ConnectionCheckResult/valid/healthy.json

@@ -0,0 +1 @@
+{"healthy":true,"status":"healthy","checkedAt":"2026-09-22T00:00:00Z"}

package/fixtures/openapi/KubernetesAgentCustomResourceRule/invalid/basic.json

@@ -0,0 +1,9 @@
+{
+  "apiGroup": "*",
+  "resources": [
+    "*"
+  ],
+  "verbs": [
+    "*"
+  ]
+}

package/fixtures/openapi/KubernetesAgentCustomResourceRule/valid/basic.json

@@ -0,0 +1,14 @@
+{
+  "apiGroup": "example.io",
+  "resources": [
+    "widgets"
+  ],
+  "verbs": [
+    "get",
+    "list",
+    "update"
+  ],
+  "namespaces": [
+    "apps"
+  ]
+}

package/fixtures/openapi/KubernetesAgentCustomResourceRule/valid/dns-names.json

@@ -0,0 +1 @@
+{"apiGroup":"apps--demo.example.io","resources":["widget-sets"],"verbs":["get","list"],"namespaces":["apps"]}

package/fixtures/openapi/KubernetesClusterRegistrationRequest/invalid/basic.json

@@ -0,0 +1,4 @@
+{
+  "name": "private",
+  "prometheusTransport": "fallback"
+}

package/fixtures/openapi/KubernetesClusterRegistrationRequest/valid/basic.json

@@ -0,0 +1,6 @@
+{
+  "name": "private",
+  "connectionMode": "agent",
+  "prometheusTransport": "agent",
+  "agentCustomResourceRules": []
+}

package/fixtures/openapi/KubernetesConfigMapDataInput/invalid/basic.json

@@ -0,0 +1,5 @@
+{
+  "data": {
+    "key": 1
+  }
+}

package/fixtures/openapi/KubernetesConfigMapDataInput/valid/basic.json

@@ -0,0 +1,8 @@
+{
+  "data": {
+    "key": "text"
+  },
+  "binaryData": {
+    "payload": "AAEC"
+  }
+}

package/fixtures/openapi/KubernetesCronJobSuspendInput/invalid/basic.json

@@ -0,0 +1,3 @@
+{
+  "suspend": "yes"
+}

package/fixtures/openapi/KubernetesCronJobSuspendInput/valid/basic.json

@@ -0,0 +1,3 @@
+{
+  "suspend": true
+}

package/fixtures/openapi/KubernetesCustomResourceAccess/invalid/basic.json

@@ -0,0 +1,5 @@
+{
+  "allowedActions": [
+    "*"
+  ]
+}

package/fixtures/openapi/KubernetesCustomResourceAccess/valid/basic.json

@@ -0,0 +1,6 @@
+{
+  "allowedActions": [
+    "list",
+    "view"
+  ]
+}

package/fixtures/openapi/KubernetesNamespaceCreateInput/invalid/basic.json

@@ -0,0 +1 @@
+{"name":"  "}

package/fixtures/openapi/KubernetesNamespaceCreateInput/valid/basic.json

@@ -0,0 +1 @@
+{"name":"team-a","labels":{"environment":"test"}}

package/fixtures/openapi/KubernetesNodeDrainInput/invalid/basic.json

@@ -0,0 +1,3 @@
+{
+  "timeoutSeconds": 29
+}

package/fixtures/openapi/KubernetesNodeDrainInput/valid/basic.json

@@ -0,0 +1,3 @@
+{
+  "timeoutSeconds": 30
+}

package/fixtures/openapi/KubernetesNodeSchedulabilityInput/invalid/basic.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/KubernetesNodeSchedulabilityInput/valid/basic.json

@@ -0,0 +1,3 @@
+{
+  "unschedulable": false
+}

package/fixtures/openapi/KubernetesSecretDataInput/invalid/basic.json

@@ -0,0 +1,5 @@
+{
+  "data": {
+    "example": true
+  }
+}

package/fixtures/openapi/KubernetesSecretDataInput/valid/basic.json

@@ -0,0 +1,5 @@
+{
+  "data": {
+    "example": "example-value"
+  }
+}

package/fixtures/openapi/UpdateBrandingSettingsRequest/invalid/dark-logo-type.json

@@ -0,0 +1,9 @@
+{
+  "appTitle": "Soha",
+  "sidebarTitle": "Soha",
+  "loginLogoUrl": "/logo.svg",
+  "expandedLogoUrl": "/logo.svg",
+  "collapsedLogoUrl": "/logo.svg",
+  "faviconUrl": "/logo.svg",
+  "darkExpandedLogoUrl": true
+}

package/fixtures/openapi/UpdateBrandingSettingsRequest/valid/dark-logos.json

@@ -0,0 +1,10 @@
+{
+  "appTitle": "Soha",
+  "sidebarTitle": "Soha",
+  "loginLogoUrl": "/logo.svg",
+  "expandedLogoUrl": "/logo.svg",
+  "collapsedLogoUrl": "/logo.svg",
+  "faviconUrl": "/logo.svg",
+  "darkExpandedLogoUrl": "/brand-dark.svg",
+  "darkCollapsedLogoUrl": "/mark-dark.svg"
+}

package/gen/go/sohaapi/client.go

@@ -16,7 +16,7 @@ import (
 	"time"
 )
 
-const defaultUserAgent = "opensoha-contracts/0.1.18"
+const defaultUserAgent = "opensoha-contracts/0.1.20"
 
 type Client struct {
 	BaseURL    string
@@ -594,8 +594,16 @@ func (c *Client) GetComputeProviderInstance(ctx context.Context, domain ComputeP
 	return out.Data, nil
 }
 
-func (c *Client) CheckComputeProviderInstanceHealth(ctx context.Context, domain ComputeProviderDomain, providerKey, instanceRef, idempotencyKey string, req ComputeProviderReadRequest) (ComputeTaskView, error) {
-	return c.mutateComputeProviderInstance(ctx, domain, providerKey, instanceRef, "health-checks", idempotencyKey, req)
+func (c *Client) CheckComputeProviderInstanceHealth(ctx context.Context, domain ComputeProviderDomain, providerKey, instanceRef, idempotencyKey string, req ComputeProviderReadRequest) (ConnectionCheckResult, error) {
+	var out ConnectionCheckResultEnvelope
+	path := computeProviderInstancePath(domain, providerKey, instanceRef) + "/health-checks"
+	if err := c.doJSONWithHeaders(ctx, http.MethodPost, path, true, req, &out, idempotencyHeader(idempotencyKey)); err != nil {
+		return ConnectionCheckResult{}, err
+	}
+	if out.Data.CheckedAt.IsZero() || strings.TrimSpace(out.Data.Status) == "" {
+		return ConnectionCheckResult{}, fmt.Errorf("connection health check returned no synchronous result; upgrade the server before using this client")
+	}
+	return out.Data, nil
 }
 
 func (c *Client) DiscoverComputeProviderInstance(ctx context.Context, domain ComputeProviderDomain, providerKey, instanceRef, idempotencyKey string, req ComputeProviderDiscoverRequest) (ComputeTaskView, error) {

package/gen/go/sohaapi/client_test.go

@@ -414,7 +414,7 @@ func TestComputeInventoryClientSurface(t *testing.T) {
 			if key := r.Header.Get("Idempotency-Key"); key != "health-key-1" {
 				t.Fatalf("health Idempotency-Key = %q", key)
 			}
-			writeJSON(t, w, computeTaskEnvelopeFixture("health-task"))
+			writeJSON(t, w, map[string]any{"data": map[string]any{"healthy": true, "status": "healthy", "checkedAt": "2026-09-22T00:00:00Z"}})
 		case 8:
 			assertCommonRequest(t, r, http.MethodPost, "/api/v1/compute/provider-instances/virtualization/pve/connection%2Fone/discoveries")
 			if key := r.Header.Get("Idempotency-Key"); key != "discover-key-1" {
@@ -458,8 +458,8 @@ func TestComputeInventoryClientSurface(t *testing.T) {
 	if _, err := client.GetComputeProviderInstance(ctx, ComputeProviderDomainVirtualization, "pve", "connection/one"); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := client.CheckComputeProviderInstanceHealth(ctx, ComputeProviderDomainVirtualization, "pve", "connection/one", "health-key-1", ComputeProviderReadRequest{ExpectedGeneration: 1}); err != nil {
-		t.Fatal(err)
+	if result, err := client.CheckComputeProviderInstanceHealth(ctx, ComputeProviderDomainVirtualization, "pve", "connection/one", "health-key-1", ComputeProviderReadRequest{ExpectedGeneration: 1}); err != nil || !result.Healthy || result.Status != "healthy" || result.CheckedAt.IsZero() {
+		t.Fatalf("CheckComputeProviderInstanceHealth = %#v, %v", result, err)
 	}
 	if _, err := client.DiscoverComputeProviderInstance(ctx, ComputeProviderDomainVirtualization, "pve", "connection/one", "discover-key-1", ComputeProviderDiscoverRequest{ExpectedGeneration: 1}); err != nil {
 		t.Fatal(err)
@@ -475,6 +475,29 @@ func TestComputeInventoryClientSurface(t *testing.T) {
 	}
 }
 
+func TestComputeProviderHealthPreservesDiagnostics(t *testing.T) {
+	client := newTestClient(t, func(w http.ResponseWriter, r *http.Request) {
+		writeJSON(t, w, map[string]any{"data": map[string]any{
+			"healthy": false, "status": "degraded", "checkedAt": "2026-09-22T00:00:00Z",
+			"httpStatus": 401, "reason": "authentication_failed", "message": "Credentials rejected", "nextAction": "Update credentials",
+		}})
+	})
+	result, err := client.CheckComputeProviderInstanceHealth(context.Background(), ComputeProviderDomainVirtualization, "pve", "connection-1", "", ComputeProviderReadRequest{})
+	if err != nil || result.Healthy || result.Status != "degraded" || result.HTTPStatus != 401 || result.Reason != "authentication_failed" || result.Message != "Credentials rejected" || result.NextAction != "Update credentials" || result.CheckedAt.IsZero() {
+		t.Fatalf("CheckComputeProviderInstanceHealth = %#v, %v", result, err)
+	}
+}
+
+func TestComputeProviderHealthRejectsLegacyTask(t *testing.T) {
+	client := newTestClient(t, func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusAccepted)
+		writeJSON(t, w, computeTaskEnvelopeFixture("health-task"))
+	})
+	if _, err := client.CheckComputeProviderInstanceHealth(context.Background(), ComputeProviderDomainVirtualization, "pve", "connection-1", "", ComputeProviderReadRequest{}); err == nil || !strings.Contains(err.Error(), "upgrade the server") {
+		t.Fatalf("legacy task response should require a server upgrade, got %v", err)
+	}
+}
+
 func TestStreamComputeTask(t *testing.T) {
 	client := newTestClient(t, func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodGet || r.URL.EscapedPath() != "/api/v1/compute/tasks/virtualization/task%2Fone/stream" {

package/gen/go/sohaapi/types.go

@@ -4340,6 +4340,39 @@ func (e KubernetesAccessReviewSubjectKind) Valid() bool {
 	}
 }
 
+// Defines values for KubernetesAgentCustomResourceRuleVerbs.
+const (
+	KubernetesAgentCustomResourceRuleVerbsCreate KubernetesAgentCustomResourceRuleVerbs = "create"
+	KubernetesAgentCustomResourceRuleVerbsDelete KubernetesAgentCustomResourceRuleVerbs = "delete"
+	KubernetesAgentCustomResourceRuleVerbsGet    KubernetesAgentCustomResourceRuleVerbs = "get"
+	KubernetesAgentCustomResourceRuleVerbsList   KubernetesAgentCustomResourceRuleVerbs = "list"
+	KubernetesAgentCustomResourceRuleVerbsPatch  KubernetesAgentCustomResourceRuleVerbs = "patch"
+	KubernetesAgentCustomResourceRuleVerbsUpdate KubernetesAgentCustomResourceRuleVerbs = "update"
+	KubernetesAgentCustomResourceRuleVerbsWatch  KubernetesAgentCustomResourceRuleVerbs = "watch"
+)
+
+// Valid indicates whether the value is a known member of the KubernetesAgentCustomResourceRuleVerbs enum.
+func (e KubernetesAgentCustomResourceRuleVerbs) Valid() bool {
+	switch e {
+	case KubernetesAgentCustomResourceRuleVerbsCreate:
+		return true
+	case KubernetesAgentCustomResourceRuleVerbsDelete:
+		return true
+	case KubernetesAgentCustomResourceRuleVerbsGet:
+		return true
+	case KubernetesAgentCustomResourceRuleVerbsList:
+		return true
+	case KubernetesAgentCustomResourceRuleVerbsPatch:
+		return true
+	case KubernetesAgentCustomResourceRuleVerbsUpdate:
+		return true
+	case KubernetesAgentCustomResourceRuleVerbsWatch:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for KubernetesConnectionMode.
 const (
 	KubernetesConnectionModeAgent            KubernetesConnectionMode = "agent"
@@ -4421,6 +4454,24 @@ func (e KubernetesImportedTargetWorkloadKind) Valid() bool {
 	}
 }
 
+// Defines values for KubernetesPrometheusTransport.
+const (
+	Agent  KubernetesPrometheusTransport = "agent"
+	Direct KubernetesPrometheusTransport = "direct"
+)
+
+// Valid indicates whether the value is a known member of the KubernetesPrometheusTransport enum.
+func (e KubernetesPrometheusTransport) Valid() bool {
+	switch e {
+	case Agent:
+		return true
+	case Direct:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for KubernetesRelatedResourceKind.
 const (
 	KubernetesRelatedResourceKindHorizontalPodAutoscaler KubernetesRelatedResourceKind = "HorizontalPodAutoscaler"
@@ -12775,11 +12826,17 @@ type BrandingAssetUploadEnvelope struct {
 type BrandingSettings struct {
 	AppTitle         string `json:"appTitle"`
 	CollapsedLogoURL string `json:"collapsedLogoUrl"`
-	ExpandedLogoURL  string `json:"expandedLogoUrl"`
-	FaviconURL       string `json:"faviconUrl"`
-	LoginLogoURL     string `json:"loginLogoUrl"`
-	SidebarTitle     string `json:"sidebarTitle"`
-	Slogan           string `json:"slogan,omitempty"`
+
+	// DarkCollapsedLogoURL Optional dark-theme compact logo. Empty or absent uses collapsedLogoUrl.
+	DarkCollapsedLogoURL string `json:"darkCollapsedLogoUrl,omitempty"`
+
+	// DarkExpandedLogoURL Optional dark-theme expanded logo. Empty or absent uses expandedLogoUrl.
+	DarkExpandedLogoURL string `json:"darkExpandedLogoUrl,omitempty"`
+	ExpandedLogoURL     string `json:"expandedLogoUrl"`
+	FaviconURL          string `json:"faviconUrl"`
+	LoginLogoURL        string `json:"loginLogoUrl"`
+	SidebarTitle        string `json:"sidebarTitle"`
+	Slogan              string `json:"slogan,omitempty"`
 }
 
 // BrandingSettingsEnvelope defines model for BrandingSettingsEnvelope.
@@ -14026,6 +14083,23 @@ type ComputeWarning struct {
 	Message string `json:"message,omitempty"`
 }
 
+// ConnectionCheckResult Current connection health from a synchronous probe. This result is not a task and has no task identifier or lifecycle actions.
+type ConnectionCheckResult struct {
+	CheckedAt  time.Time `json:"checkedAt"`
+	Healthy    bool      `json:"healthy"`
+	HTTPStatus int       `json:"httpStatus,omitempty"`
+	Message    string    `json:"message,omitempty"`
+	NextAction string    `json:"nextAction,omitempty"`
+	Reason     string    `json:"reason,omitempty"`
+	Status     string    `json:"status"`
+}
+
+// ConnectionCheckResultEnvelope defines model for ConnectionCheckResultEnvelope.
+type ConnectionCheckResultEnvelope struct {
+	// Data Current connection health from a synchronous probe. This result is not a task and has no task identifier or lifecycle actions.
+	Data ConnectionCheckResult `json:"data"`
+}
+
 // CreatedPersonalAccessToken defines model for CreatedPersonalAccessToken.
 type CreatedPersonalAccessToken struct {
 	Token PersonalAccessToken `json:"token"`
@@ -17922,6 +17996,19 @@ type KubernetesAdmissionWebhookRule struct {
 	Scope       string   `json:"scope,omitempty"`
 }
 
+// KubernetesAgentCustomResourceRule defines model for KubernetesAgentCustomResourceRule.
+type KubernetesAgentCustomResourceRule struct {
+	APIGroup string `json:"apiGroup"`
+
+	// Namespaces Explicit namespaces; omitted or empty grants cluster-wide access to the named resources only.
+	Namespaces []string                                 `json:"namespaces,omitempty"`
+	Resources  []string                                 `json:"resources"`
+	Verbs      []KubernetesAgentCustomResourceRuleVerbs `json:"verbs"`
+}
+
+// KubernetesAgentCustomResourceRuleVerbs defines model for KubernetesAgentCustomResourceRule.Verbs.
+type KubernetesAgentCustomResourceRuleVerbs string
+
 // KubernetesBackendTLSPolicy defines model for KubernetesBackendTLSPolicy.
 type KubernetesBackendTLSPolicy struct {
 	AgeSeconds              int64    `json:"ageSeconds"`
@@ -17970,15 +18057,16 @@ type KubernetesCacheResourceDiagnostic struct {
 
 // KubernetesClusterConnectionDetail defines model for KubernetesClusterConnectionDetail.
 type KubernetesClusterConnectionDetail struct {
-	Context             string                   `json:"context,omitempty"`
-	CredentialType      string                   `json:"credentialType"`
-	Endpoint            string                   `json:"endpoint,omitempty"`
-	HasInlineKubeconfig bool                     `json:"hasInlineKubeconfig"`
-	HasToken            bool                     `json:"hasToken"`
-	Mode                KubernetesConnectionMode `json:"mode"`
-	SourceRef           string                   `json:"sourceRef,omitempty"`
-	SourceType          string                   `json:"sourceType"`
-	UsesInformerCache   bool                     `json:"usesInformerCache"`
+	Context             string                              `json:"context,omitempty"`
+	CredentialType      string                              `json:"credentialType"`
+	CustomResourceRules []KubernetesAgentCustomResourceRule `json:"customResourceRules,omitempty"`
+	Endpoint            string                              `json:"endpoint,omitempty"`
+	HasInlineKubeconfig bool                                `json:"hasInlineKubeconfig"`
+	HasToken            bool                                `json:"hasToken"`
+	Mode                KubernetesConnectionMode            `json:"mode"`
+	SourceRef           string                              `json:"sourceRef,omitempty"`
+	SourceType          string                              `json:"sourceType"`
+	UsesInformerCache   bool                                `json:"usesInformerCache"`
 }
 
 // KubernetesClusterDetail defines model for KubernetesClusterDetail.
@@ -19619,12 +19707,16 @@ type KubernetesPriorityClassListEnvelope struct {
 
 // KubernetesPrometheusDetail defines model for KubernetesPrometheusDetail.
 type KubernetesPrometheusDetail struct {
-	BaseURL        string `json:"baseUrl,omitempty"`
-	ClusterLabel   string `json:"clusterLabel,omitempty"`
-	GrafanaBaseURL string `json:"grafanaBaseUrl,omitempty"`
-	HasBearerToken bool   `json:"hasBearerToken"`
+	BaseURL        string                        `json:"baseUrl,omitempty"`
+	ClusterLabel   string                        `json:"clusterLabel,omitempty"`
+	GrafanaBaseURL string                        `json:"grafanaBaseUrl,omitempty"`
+	HasBearerToken bool                          `json:"hasBearerToken"`
+	Transport      KubernetesPrometheusTransport `json:"transport,omitempty"`
 }
 
+// KubernetesPrometheusTransport defines model for KubernetesPrometheusTransport.
+type KubernetesPrometheusTransport string
+
 // KubernetesReferenceGrant defines model for KubernetesReferenceGrant.
 type KubernetesReferenceGrant struct {
 	AgeSeconds     int64    `json:"ageSeconds"`
@@ -26761,11 +26853,17 @@ type UpdateAIWorkbenchModelRequest struct {
 type UpdateBrandingSettingsRequest struct {
 	AppTitle         string `json:"appTitle"`
 	CollapsedLogoURL string `json:"collapsedLogoUrl"`
-	ExpandedLogoURL  string `json:"expandedLogoUrl"`
-	FaviconURL       string `json:"faviconUrl"`
-	LoginLogoURL     string `json:"loginLogoUrl"`
-	SidebarTitle     string `json:"sidebarTitle"`
-	Slogan           string `json:"slogan,omitempty"`
+
+	// DarkCollapsedLogoURL Optional dark-theme compact logo. Empty or absent clears the override.
+	DarkCollapsedLogoURL string `json:"darkCollapsedLogoUrl,omitempty"`
+
+	// DarkExpandedLogoURL Optional dark-theme expanded logo. Empty or absent clears the override.
+	DarkExpandedLogoURL string `json:"darkExpandedLogoUrl,omitempty"`
+	ExpandedLogoURL     string `json:"expandedLogoUrl"`
+	FaviconURL          string `json:"faviconUrl"`
+	LoginLogoURL        string `json:"loginLogoUrl"`
+	SidebarTitle        string `json:"sidebarTitle"`
+	Slogan              string `json:"slogan,omitempty"`
 }
 
 // UpdateLoginProvidersSettingsRequest defines model for UpdateLoginProvidersSettingsRequest.