@opensoha/contracts 0.1.25 → 0.1.27

package/fixtures/openapi/ManagedContentUploadInput/valid/boundary.json

@@ -0,0 +1,6 @@
+{
+  "requestId": "11111111-1111-4111-8111-111111111111",
+  "destinationId": "22222222-2222-4222-8222-222222222222",
+  "fileName": "example.txt",
+  "contentBase64": "ZXhhbXBsZQ=="
+}

package/fixtures/openapi/ManifestExecutionTaskPayload/invalid/initialization.json

@@ -0,0 +1,7 @@
+{
+  "action": "preflight",
+  "packageId": "pkg",
+  "generation": 1,
+  "idempotencyKey": "initialization:plan:target",
+  "initializationPlanId": ""
+}

package/fixtures/openapi/ManifestExecutionTaskPayload/valid/initialization.json

@@ -0,0 +1,7 @@
+{
+  "action": "preflight",
+  "packageId": "pkg",
+  "generation": 1,
+  "idempotencyKey": "initialization:plan:target",
+  "initializationPlanId": "plan"
+}

package/fixtures/openapi/ManifestRootResource/invalid/root.json

@@ -0,0 +1 @@
+{"apiVersion":"unknown.example/v1","kind":"Database","namespace":"team","name":"db","uid":"","generation":0,"crdName":"databases.unknown.example"}

package/fixtures/openapi/ManifestRootResource/valid/root.json

@@ -0,0 +1 @@
+{"apiVersion": "unknown.example/v1", "kind": "Database", "namespace": "team", "name": "db", "uid": "uid-1", "generation": 2, "crdName": "databases.unknown.example", "targetId": "target", "deliveryPlanId": "plan"}

package/fixtures/openapi/NetworkAccessPolicyInput/invalid/unknown-management-state.json

@@ -0,0 +1,35 @@
+{
+  "accessProfile": "full",
+  "deviceStatuses": [
+    "active"
+  ],
+  "effect": "allow",
+  "enabled": true,
+  "modes": [
+    "internal_ztna",
+    "external_vpn_ztna"
+  ],
+  "name": "Engineering protected access",
+  "postureStatuses": [
+    "compliant"
+  ],
+  "priority": 100,
+  "resourceIds": [
+    "resource-git"
+  ],
+  "siteIds": [
+    "site-hq"
+  ],
+  "subjects": {
+    "tags": [
+      "employee"
+    ],
+    "teams": [
+      "team-engineering"
+    ],
+    "users": []
+  },
+  "deviceManagementStates": [
+    "self_attested"
+  ]
+}

package/fixtures/openapi/NetworkAccessPolicyInput/valid/managed-device.json

@@ -0,0 +1,35 @@
+{
+  "accessProfile": "full",
+  "deviceStatuses": [
+    "active"
+  ],
+  "effect": "allow",
+  "enabled": true,
+  "modes": [
+    "internal_ztna",
+    "external_vpn_ztna"
+  ],
+  "name": "Engineering protected access",
+  "postureStatuses": [
+    "compliant"
+  ],
+  "priority": 100,
+  "resourceIds": [
+    "resource-git"
+  ],
+  "siteIds": [
+    "site-hq"
+  ],
+  "subjects": {
+    "tags": [
+      "employee"
+    ],
+    "teams": [
+      "team-engineering"
+    ],
+    "users": []
+  },
+  "deviceManagementStates": [
+    "managed"
+  ]
+}

package/fixtures/openapi/NetworkAdmissionPreviewRequest/invalid/deviceId-characters.json

@@ -0,0 +1,4 @@
+{
+  "deviceId": "invalid id",
+  "nasBindingId": "nas-1"
+}

package/fixtures/openapi/NetworkAdmissionPreviewRequest/invalid/nasBindingId-characters.json

@@ -0,0 +1,4 @@
+{
+  "deviceId": "device-1",
+  "nasBindingId": "invalid id"
+}

package/fixtures/openapi/NetworkAdmissionPreviewRequest/invalid/subject-override.json

@@ -0,0 +1 @@
+{"deviceId":"device-1","nasBindingId":"nas-binding-1","subjectUserId":"other-user"}

package/fixtures/openapi/NetworkAdmissionPreviewRequest/valid/device-nas.json

@@ -0,0 +1 @@
+{"deviceId":"device-1","nasBindingId":"nas-binding-1"}

package/fixtures/openapi/NetworkAdmissionPreviewResult/invalid/missing-attributeVersion.json

@@ -0,0 +1,13 @@
+{
+  "decision": "allow",
+  "path": "site_direct",
+  "policyVersion": 2,
+  "evaluatedAt": "2026-10-15T05:00:00Z",
+  "protected": false,
+  "networkLeaseRequired": false,
+  "resourceLeaseRequired": false,
+  "networkProfile": "restricted",
+  "reasons": [
+    "policy_allow:office"
+  ]
+}

package/fixtures/openapi/NetworkAdmissionPreviewResult/invalid/missing-evaluatedAt.json

@@ -0,0 +1,13 @@
+{
+  "decision": "allow",
+  "path": "site_direct",
+  "policyVersion": 2,
+  "attributeVersion": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "protected": false,
+  "networkLeaseRequired": false,
+  "resourceLeaseRequired": false,
+  "networkProfile": "restricted",
+  "reasons": [
+    "policy_allow:office"
+  ]
+}

package/fixtures/openapi/NetworkAdmissionPreviewResult/valid/versioned.json

@@ -0,0 +1,14 @@
+{
+  "decision": "allow",
+  "path": "site_direct",
+  "policyVersion": 2,
+  "attributeVersion": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "evaluatedAt": "2026-10-15T05:00:00Z",
+  "protected": false,
+  "networkLeaseRequired": false,
+  "resourceLeaseRequired": false,
+  "networkProfile": "restricted",
+  "reasons": [
+    "policy_allow:office"
+  ]
+}

package/fixtures/openapi/NetworkConflictAnalysisRequest/invalid/missing-runtime-ranges.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/NetworkConflictAnalysisRequest/invalid/unknown-source-type.json

@@ -0,0 +1,9 @@
+{
+  "runtimeRanges": [
+    {
+      "name": "Unknown source type",
+      "cidr": "192.0.2.0/24",
+      "sourceType": "unknown"
+    }
+  ]
+}

package/fixtures/openapi/NetworkConflictAnalysisRequest/valid/empty-runtime-ranges.json

@@ -0,0 +1,3 @@
+{
+  "runtimeRanges": []
+}

package/fixtures/openapi/NetworkConflictAnalysisRequest/{invalid → valid}/ipv6-range.json

@@ -2,7 +2,7 @@
   "runtimeRanges": [
     {
       "cidr": "fd00::/64",
-      "name": "Unsupported IPv6 overlay",
+      "name": "IPv6 overlay",
       "sourceType": "wireguard_overlay"
     }
   ]

package/fixtures/openapi/NetworkEAPServerTrust/invalid/no-server-validation.json

@@ -0,0 +1,5 @@
+{
+  "serverNames": [],
+  "caCertificates": [],
+  "wifiSecurity": "wpa2-enterprise"
+}

package/fixtures/openapi/NetworkEAPServerTrust/valid/named-server.json

@@ -0,0 +1,9 @@
+{
+  "serverNames": [
+    "radius.lab.example"
+  ],
+  "caCertificates": [
+    "-----BEGIN CERTIFICATE-----\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n-----END CERTIFICATE-----"
+  ],
+  "wifiSecurity": "wpa2-enterprise"
+}

package/fixtures/openapi/NetworkEndpointResponsePolicyInput/invalid/all-sites-implicit.json

@@ -0,0 +1,45 @@
+{
+  "expectedRevision": 0,
+  "configuration": {
+    "name": "Office service protection",
+    "enabled": true,
+    "siteIds": [],
+    "nasBindingIds": [
+      "nas-lab"
+    ],
+    "deviceIds": [
+      "endpoint-lab"
+    ],
+    "subjects": {
+      "users": [],
+      "teams": [],
+      "tags": []
+    },
+    "signal": "service_unavailable",
+    "requireHealthyForAdmission": true,
+    "heartbeatIntervalSeconds": 30,
+    "missedHeartbeats": 3,
+    "gracePeriodSeconds": 30,
+    "accountingFreshnessSeconds": 120,
+    "restoreHeartbeats": 3,
+    "restoreObservationSeconds": 60,
+    "autoRestore": false,
+    "steps": [
+      {
+        "afterSeconds": 0,
+        "action": "notify"
+      },
+      {
+        "afterSeconds": 60,
+        "action": "restrict",
+        "targetAccessProfile": "restricted"
+      },
+      {
+        "afterSeconds": 180,
+        "action": "disconnect"
+      }
+    ],
+    "failureAction": "disconnect",
+    "notificationPolicyId": "notifications-lab"
+  }
+}

package/fixtures/openapi/NetworkEndpointResponsePolicyInput/invalid/unbounded-stages.json

@@ -0,0 +1,54 @@
+{
+  "expectedRevision": 0,
+  "configuration": {
+    "name": "Office service protection",
+    "enabled": true,
+    "siteIds": [
+      "site-lab"
+    ],
+    "nasBindingIds": [
+      "nas-lab"
+    ],
+    "deviceIds": [
+      "endpoint-lab"
+    ],
+    "subjects": {
+      "users": [],
+      "teams": [],
+      "tags": []
+    },
+    "signal": "service_unavailable",
+    "requireHealthyForAdmission": true,
+    "heartbeatIntervalSeconds": 30,
+    "missedHeartbeats": 3,
+    "gracePeriodSeconds": 30,
+    "accountingFreshnessSeconds": 120,
+    "restoreHeartbeats": 3,
+    "restoreObservationSeconds": 60,
+    "autoRestore": false,
+    "steps": [
+      {
+        "afterSeconds": 0,
+        "action": "disconnect"
+      },
+      {
+        "afterSeconds": 0,
+        "action": "disconnect"
+      },
+      {
+        "afterSeconds": 0,
+        "action": "disconnect"
+      },
+      {
+        "afterSeconds": 0,
+        "action": "disconnect"
+      },
+      {
+        "afterSeconds": 0,
+        "action": "disconnect"
+      }
+    ],
+    "failureAction": "disconnect",
+    "notificationPolicyId": "notifications-lab"
+  }
+}

package/fixtures/openapi/NetworkEndpointResponsePolicyInput/invalid/zero-heartbeat.json

@@ -0,0 +1,47 @@
+{
+  "expectedRevision": 0,
+  "configuration": {
+    "name": "Office service protection",
+    "enabled": true,
+    "siteIds": [
+      "site-lab"
+    ],
+    "nasBindingIds": [
+      "nas-lab"
+    ],
+    "deviceIds": [
+      "endpoint-lab"
+    ],
+    "subjects": {
+      "users": [],
+      "teams": [],
+      "tags": []
+    },
+    "signal": "service_unavailable",
+    "requireHealthyForAdmission": true,
+    "heartbeatIntervalSeconds": 0,
+    "missedHeartbeats": 3,
+    "gracePeriodSeconds": 30,
+    "accountingFreshnessSeconds": 120,
+    "restoreHeartbeats": 3,
+    "restoreObservationSeconds": 60,
+    "autoRestore": false,
+    "steps": [
+      {
+        "afterSeconds": 0,
+        "action": "notify"
+      },
+      {
+        "afterSeconds": 60,
+        "action": "restrict",
+        "targetAccessProfile": "restricted"
+      },
+      {
+        "afterSeconds": 180,
+        "action": "disconnect"
+      }
+    ],
+    "failureAction": "disconnect",
+    "notificationPolicyId": "notifications-lab"
+  }
+}

package/fixtures/openapi/NetworkEndpointResponsePolicyInput/valid/staged-protection.json

@@ -0,0 +1,47 @@
+{
+  "expectedRevision": 0,
+  "configuration": {
+    "name": "Office service protection",
+    "enabled": true,
+    "siteIds": [
+      "site-lab"
+    ],
+    "nasBindingIds": [
+      "nas-lab"
+    ],
+    "deviceIds": [
+      "endpoint-lab"
+    ],
+    "subjects": {
+      "users": [],
+      "teams": [],
+      "tags": []
+    },
+    "signal": "service_unavailable",
+    "requireHealthyForAdmission": true,
+    "heartbeatIntervalSeconds": 30,
+    "missedHeartbeats": 3,
+    "gracePeriodSeconds": 30,
+    "accountingFreshnessSeconds": 120,
+    "restoreHeartbeats": 3,
+    "restoreObservationSeconds": 60,
+    "autoRestore": false,
+    "steps": [
+      {
+        "afterSeconds": 0,
+        "action": "notify"
+      },
+      {
+        "afterSeconds": 60,
+        "action": "restrict",
+        "targetAccessProfile": "restricted"
+      },
+      {
+        "afterSeconds": 180,
+        "action": "disconnect"
+      }
+    ],
+    "failureAction": "disconnect",
+    "notificationPolicyId": "notifications-lab"
+  }
+}

package/fixtures/openapi/NetworkEndpointResponseRestoreInput/invalid/missing-reason.json

@@ -0,0 +1,3 @@
+{
+  "expectedRevision": 4
+}

package/fixtures/openapi/NetworkEndpointResponseRestoreInput/valid/expected-current.json

@@ -0,0 +1,4 @@
+{
+  "expectedRevision": 4,
+  "reason": "Service health verified in the isolated lab."
+}

package/fixtures/openapi/NetworkPolicyPreviewResult/invalid/attribute-version.json

@@ -0,0 +1 @@
+{"decision":"allow","path":"site_direct","policyVersion":2,"attributeVersion":"unversioned","protected":false,"networkLeaseRequired":false,"resourceLeaseRequired":false,"reasons":["policy_allow:office"]}

package/fixtures/openapi/NetworkPolicyPreviewResult/valid/admission-version.json

@@ -0,0 +1 @@
+{"decision":"allow","path":"site_direct","policyVersion":2,"attributeVersion":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","evaluatedAt":"2026-10-15T05:00:00Z","protected":false,"networkLeaseRequired":false,"resourceLeaseRequired":false,"networkProfile":"restricted","reasons":["policy_allow:office"]}

package/fixtures/openapi/NetworkPolicySubjects/invalid/duplicate-role.json

@@ -0,0 +1 @@
+{"users":[],"teams":[],"tags":[],"roles":["network-staff","network-staff"]}

package/fixtures/openapi/NetworkPolicySubjects/invalid/role-characters.json

@@ -0,0 +1,5 @@
+{
+  "roles": [
+    "invalid role"
+  ]
+}

package/fixtures/openapi/NetworkPolicySubjects/valid/role-bound.json

@@ -0,0 +1 @@
+{"users":[],"teams":[],"tags":[],"roles":["network-staff"]}

package/fixtures/openapi/NetworkProxyConfigurationInput/invalid/missing-content.json

@@ -0,0 +1 @@
+{"expectedRevision":0,"enabled":true}

package/fixtures/openapi/NetworkProxyConfigurationPatchInput/invalid/bad-binding-id.json

@@ -0,0 +1,9 @@
+{
+  "expectedRevision": 4,
+  "enabled": true,
+  "binding": {
+    "siteId": "invalid id",
+    "deviceId": "device-host",
+    "resourceIds": []
+  }
+}

package/fixtures/openapi/NetworkProxyConfigurationPatchInput/invalid/empty-content.json

@@ -0,0 +1 @@
+{"expectedRevision":0,"enabled":true,"content":""}

package/fixtures/openapi/NetworkProxyConfigurationPatchInput/valid/binding-only.json

@@ -0,0 +1,11 @@
+{
+  "expectedRevision": 4,
+  "enabled": true,
+  "binding": {
+    "siteId": "site-a",
+    "deviceId": "device-host",
+    "resourceIds": [
+      "resource-payroll"
+    ]
+  }
+}

package/fixtures/openapi/NetworkProxyConfigurationPatchInput/valid/clear-binding-disabled.json

@@ -0,0 +1,5 @@
+{
+  "expectedRevision": 4,
+  "enabled": false,
+  "clearBinding": true
+}

package/fixtures/openapi/NetworkProxyConfigurationPatchInput/valid/enabled.json

@@ -0,0 +1 @@
+{"expectedRevision":0,"enabled":true,"content":"mixed-port: 7890\nsecret: example-test-secret\n"}

package/fixtures/openapi/NetworkSiteInput/invalid/unknown-governance.json

@@ -0,0 +1,6 @@
+{
+  "name": "Shanghai Office",
+  "status": "active",
+  "location": "Shanghai",
+  "deviceGovernance": "trust_everyone"
+}

package/fixtures/openapi/NetworkSiteInput/valid/restricted-unmanaged.json

@@ -0,0 +1,6 @@
+{
+  "name": "Shanghai Office",
+  "status": "active",
+  "location": "Shanghai",
+  "deviceGovernance": "restricted_unmanaged"
+}

package/fixtures/openapi/ResourceRelationConfig/invalid/executable-rule.json

@@ -0,0 +1,17 @@
+{
+  "version": "v1",
+  "rootUid": "root",
+  "sources": [],
+  "rules": [
+    {
+      "id": "bad",
+      "type": "script",
+      "target": {
+        "apiVersion": "v1",
+        "resource": "pods",
+        "kind": "Pod",
+        "namespace": "team"
+      }
+    }
+  ]
+}

package/fixtures/openapi/ResourceRelationConfig/valid/unknown-kind.json

@@ -0,0 +1,13 @@
+{
+  "version": "v1",
+  "rootUid": "root",
+  "sources": [
+    {
+      "apiVersion": "widgets.test/v1",
+      "resource": "widgets",
+      "kind": "Widget",
+      "namespace": "team"
+    }
+  ],
+  "rules": []
+}

package/fixtures/openapi/ServiceDeploymentTemplateInput/invalid/migration-missing-guide-valid-yaml.json

@@ -0,0 +1,38 @@
+{
+  "key": "http",
+  "name": "HTTP service",
+  "source": {
+    "renderer": "raw_yaml",
+    "files": [
+      {
+        "path": "deployment.yaml",
+        "content": "kind: Deployment\napiVersion: apps/v1\n"
+      }
+    ]
+  },
+  "parameterSchema": {
+    "type": "object",
+    "properties": {
+      "port": {
+        "type": "integer",
+        "minimum": 1,
+        "maximum": 65535
+      }
+    },
+    "required": [
+      "port"
+    ]
+  },
+  "defaults": {
+    "port": 8080
+  },
+  "health": {
+    "mode": "workload_ready",
+    "timeoutSeconds": 300
+  },
+  "enabled": true,
+  "migrationPolicy": {
+    "sequential": true,
+    "irreversible": false
+  }
+}

package/fixtures/openapi/ServiceDeploymentTemplateInput/valid/migration-valid-yaml.json

@@ -0,0 +1,39 @@
+{
+  "key": "http",
+  "name": "HTTP service",
+  "source": {
+    "renderer": "raw_yaml",
+    "files": [
+      {
+        "path": "deployment.yaml",
+        "content": "kind: Deployment\napiVersion: apps/v1\n"
+      }
+    ]
+  },
+  "parameterSchema": {
+    "type": "object",
+    "properties": {
+      "port": {
+        "type": "integer",
+        "minimum": 1,
+        "maximum": 65535
+      }
+    },
+    "required": [
+      "port"
+    ]
+  },
+  "defaults": {
+    "port": 8080
+  },
+  "health": {
+    "mode": "workload_ready",
+    "timeoutSeconds": 300
+  },
+  "enabled": true,
+  "migrationPolicy": {
+    "sequential": true,
+    "irreversible": true,
+    "guide": "Backup, migrate in order, verify; forward repair only."
+  }
+}

package/fixtures/openapi/TemplateMigrationAssessment/invalid/initialization.json

@@ -0,0 +1,9 @@
+{
+  "fromVersion": 0,
+  "toVersion": 3,
+  "blocked": false,
+  "requiresApproval": true,
+  "reason": "首次发布须先证明不存在并审批",
+  "steps": [],
+  "initialization": "force"
+}

package/fixtures/openapi/TemplateMigrationAssessment/valid/initialization.json

@@ -0,0 +1,9 @@
+{
+  "fromVersion": 0,
+  "toVersion": 3,
+  "blocked": false,
+  "requiresApproval": true,
+  "reason": "首次发布须先证明不存在并审批",
+  "steps": [],
+  "initialization": true
+}

package/fixtures/openapi/TemplateMigrationPolicy/invalid/blank-guide.json

@@ -0,0 +1,5 @@
+{
+  "sequential": false,
+  "irreversible": true,
+  "guide": "  \n"
+}

package/fixtures/openapi/TemplateMigrationPolicy/invalid/missing-guide.json

@@ -0,0 +1,4 @@
+{
+  "sequential": true,
+  "irreversible": false
+}

package/fixtures/openapi/TemplateMigrationPolicy/invalid/unknown-escape-hatch.json

@@ -0,0 +1,6 @@
+{
+  "sequential": true,
+  "irreversible": true,
+  "guide": "manual",
+  "force": true
+}