@opensoha/contracts 0.1.26 → 0.1.29

package/COMPATIBILITY.md

@@ -22,6 +22,16 @@ Current stream: `0.1.x`.
 - `1.0.0` starts the stable contract line. After `1.0.0`, breaking changes
   require a major version bump, a migration note, and consumer coordination.
 
+## Proxy Configuration Inputs
+
+The proxy configuration endpoint accepts partial updates through
+`NetworkProxyConfigurationPatchInput`. Its optional `content` distinguishes omission
+from an explicit empty value. Existing Go consumers retain
+`NetworkProxyConfigurationInput.Content` as a string and the full-input
+`UpdateNetworkProxyConfigurationJSONRequestBody` alias. New Go consumers that omit
+encrypted content must explicitly use the Patch input. TypeScript operation types
+follow the partial HTTP schema. Both full and partial requests use the same endpoint.
+
 ## Version Synchronization
 
 Each release must keep these values aligned:
@@ -52,9 +62,10 @@ Release order for `0.1.x`:
 3. Run `npm test`, `npm pack --dry-run`, `npm run release:artifacts`, and
    the consumer matrix.
 4. Create tag `v<version>`.
-5. Let the release workflow publish npm when `NPM_TOKEN` is configured and
-   create the GitHub release with the npm tarball, `.sha256` checksum, and
-   release manifest attached.
+5. Let the release workflow stage the npm package with `NPM_TOKEN`. After a
+   maintainer approves the stage with 2FA, dispatch recovery for the same tag.
+   The workflow verifies the public npm package and Go tag before attaching
+   the tarball, checksums, and release manifest to the GitHub release.
 
 ## Compatibility Baseline
 

package/README.md

@@ -232,17 +232,16 @@ the tarball checksum, manifest metadata, packed `package.json`, every exported
 package entrypoint, both OpenAPI artifact hashes, the SBOM identity and
 checksum, the provenance policy and checksum, and the consumer matrix summary.
 
-The tag workflow runs `npm test`, `npm pack --dry-run`, the strict consumer
-matrix, requires `NPM_TOKEN`, publishes npm with provenance, verifies the npm
-package and Go module tag after publish, and attaches the tarball, checksum,
-SBOM, SBOM checksum, provenance policy, provenance policy checksum, manifest,
-and consumer matrix to the GitHub release. It then downloads the published
-release assets and runs `release:verify` against the downloaded tarball.
+The tag workflow runs `npm test`, `npm pack --dry-run`, and the strict consumer
+matrix, then uses `NPM_TOKEN` to stage the npm tarball with provenance. A
+maintainer approves the stage on npmjs.com with 2FA. Dispatch the release
+workflow with the same tag and `publish_mode=recover` after approval. Recovery
+verifies the public npm package and Go module tag, attaches the release
+artifacts to GitHub, and verifies the downloaded tarball.
 
 The local release manifest records the provenance policy expected from the tag
-workflow. It does not prove a remote npm registry attestation by itself; that
-evidence is produced and checked only after the tag workflow publishes with
-`npm publish --provenance`.
+workflow. Verify the registry attestation's artifact digest and source revision
+after approval makes the package public.
 
 During private staging, consumers intentionally use sibling repository
 checkouts, `go.work` / `replace` entries, and `file:../soha-contracts` package

package/auth/catalog_generated.go

@@ -6,8 +6,8 @@ import _ "embed"
 
 const (
 	PermissionCatalogVersion = "2.0.0"
-	PermissionCatalogContentSHA256 = "2d98b53189afa67c09a2917325e3b1b1b70aafe00d370bdabaef7d6b11ef493c"
-	PermissionCatalogSHA256 = "ae344007ad96fa0b24a0bf74121e1db762a1b904e58b8c8b53a8ac9168abea80"
+	PermissionCatalogContentSHA256 = "bd4a7240d34750d3fcf38b4649f6dbe67b17fb0f6ebeb96a32f8d874685e5150"
+	PermissionCatalogSHA256 = "835ccdfccfa955ae3ee9377fffb4c523b53d2eb647d01840f79cce5524d72c36"
 )
 
 //go:embed permission-catalog.json

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:2d98b53189afa67c09a2917325e3b1b1b70aafe00d370bdabaef7d6b11ef493c",
+  "contentHash": "sha256:bd4a7240d34750d3fcf38b4649f6dbe67b17fb0f6ebeb96a32f8d874685e5150",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -3624,6 +3624,86 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "docker.dlp-appeals.review",
+      "domain": "docker",
+      "resource": "dlp-appeals",
+      "action": "approve",
+      "displayName": "审查卷文件 DLP 申诉",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "docker.dlp-events.view",
+      "domain": "docker",
+      "resource": "dlp-events",
+      "action": "view",
+      "displayName": "查看卷文件 DLP 事件",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "docker.dlp-policy.publish",
+      "domain": "docker",
+      "resource": "dlp-policy",
+      "action": "trigger",
+      "displayName": "发布卷文件 DLP 策略",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "docker.dlp-policy.update",
+      "domain": "docker",
+      "resource": "dlp-policy",
+      "action": "update",
+      "displayName": "编辑卷文件 DLP 草稿",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "docker.dlp-policy.view",
+      "domain": "docker",
+      "resource": "dlp-policy",
+      "action": "view",
+      "displayName": "查看卷文件 DLP 策略",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "docker.hosts.create",
       "domain": "docker",
@@ -4742,6 +4822,214 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "network_access.content_destinations.publish",
+      "domain": "network_access",
+      "resource": "content_destinations",
+      "action": "publish",
+      "displayName": "发布受管内容目的连接",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_destinations.update",
+      "domain": "network_access",
+      "resource": "content_destinations",
+      "action": "update",
+      "displayName": "编辑受管内容目的连接",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_destinations.view",
+      "domain": "network_access",
+      "resource": "content_destinations",
+      "action": "view",
+      "displayName": "查看受管内容目的连接",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfer_appeals.review",
+      "domain": "network_access",
+      "resource": "content_transfer_appeals",
+      "action": "review",
+      "displayName": "审查受管内容申诉",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfer_events.view",
+      "domain": "network_access",
+      "resource": "content_transfer_events",
+      "action": "view",
+      "displayName": "查看受管内容安全事件",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfers.create",
+      "domain": "network_access",
+      "resource": "content_transfers",
+      "action": "create",
+      "displayName": "提交受管内容传输",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfers.delete",
+      "domain": "network_access",
+      "resource": "content_transfers",
+      "action": "delete",
+      "displayName": "删除自己的受管文件",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfers.download",
+      "domain": "network_access",
+      "resource": "content_transfers",
+      "action": "download",
+      "displayName": "下载自己的受管文件",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfers.view",
+      "domain": "network_access",
+      "resource": "content_transfers",
+      "action": "view",
+      "displayName": "查看自己的受管内容记录",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.dlp_linkage.manage",
+      "domain": "network_access",
+      "resource": "dlp_linkage",
+      "action": "update",
+      "displayName": "管理全主体 DLP 网络联动",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_controls.publish",
+      "domain": "network_access",
+      "resource": "endpoint_controls",
+      "action": "publish",
+      "displayName": "发布端点通道控制",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_controls.update",
+      "domain": "network_access",
+      "resource": "endpoint_controls",
+      "action": "update",
+      "displayName": "编辑端点通道策略",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_controls.view",
+      "domain": "network_access",
+      "resource": "endpoint_controls",
+      "action": "view",
+      "displayName": "查看端点通道策略与回执",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "network_access.endpoint_devices.update",
       "domain": "network_access",
@@ -4774,6 +5062,150 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "network_access.endpoint_response_events.maintenance",
+      "domain": "network_access",
+      "resource": "endpoint_response_events",
+      "action": "maintenance",
+      "displayName": "管理终端维护例外",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_events.restore",
+      "domain": "network_access",
+      "resource": "endpoint_response_events",
+      "action": "restore",
+      "displayName": "解除终端联动限制",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_events.view",
+      "domain": "network_access",
+      "resource": "endpoint_response_events",
+      "action": "view",
+      "displayName": "查看终端联动事件",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.create",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "create",
+      "displayName": "创建终端联动策略",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.delete",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "delete",
+      "displayName": "停用终端联动策略",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.preview",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "preview",
+      "displayName": "预览终端联动策略",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.publish",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "publish",
+      "displayName": "发布终端联动策略",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.update",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "update",
+      "displayName": "修改终端联动策略",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.view",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "view",
+      "displayName": "查看终端联动策略",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "network_access.enrollments.create",
       "domain": "network_access",
@@ -5478,6 +5910,54 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "network_access.vpn_sessions.release",
+      "domain": "network_access",
+      "resource": "vpn_sessions",
+      "action": "release",
+      "displayName": "解除 VPN 重连限制",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.vpn_sessions.revoke",
+      "domain": "network_access",
+      "resource": "vpn_sessions",
+      "action": "revoke",
+      "displayName": "撤销 VPN 会话与重连",
+      "riskLevel": "execute",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.vpn_sessions.view",
+      "domain": "network_access",
+      "resource": "vpn_sessions",
+      "action": "view",
+      "displayName": "查看 VPN 会话限制",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "observe.ai.chat",
       "domain": "observe",

package/compat/consumer-revisions.json

@@ -1,5 +1,5 @@
 {
-  "soha": "57bfa94873ff2825bccc6312842859011c1ec23a",
+  "soha": "59e929046927eecf1977bc50a446fd5d823d1d31",
   "soha-web": "447cbe5358802ef40d86ac67b7b59c5afe9c846a",
   "soha-app": "0c3c76c373246f7d2218b48f68b89bf3097f777b",
   "soha-cli": "1c9b760c986a9c1a5148db55b72ab99d23edd7a3",

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.26",
+  "version": "0.1.29",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.26",
+  "version": "0.1.29",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {

package/endpointcontrol/decode.go

@@ -0,0 +1,64 @@
+package endpointcontrol
+
+import (
+	"errors"
+	"time"
+)
+
+// Required booleans must be present, including explicit false. Missing input
+// must never become a newer all-off policy through Go zero values.
+func (c *Controls) UnmarshalJSON(raw []byte) error {
+	var w struct {
+		USB       *bool `json:"usb"`
+		Print     *bool `json:"print"`
+		Clipboard *bool `json:"clipboard"`
+	}
+	if err := Decode(raw, &w); err != nil {
+		return err
+	}
+	if w.USB == nil || w.Print == nil || w.Clipboard == nil {
+		return errors.New("all native channel decisions are required")
+	}
+	*c = Controls{USB: *w.USB, Print: *w.Print, Clipboard: *w.Clipboard}
+	return nil
+}
+func (d *Desired) UnmarshalJSON(raw []byte) error {
+	var w struct {
+		Configured    *bool      `json:"configured"`
+		SchemaVersion string     `json:"schemaVersion"`
+		DeviceID      string     `json:"deviceId"`
+		RuntimeID     string     `json:"runtimeId"`
+		CredentialID  string     `json:"credentialId"`
+		PolicyVersion *int64     `json:"policyVersion"`
+		Controls      *Controls  `json:"controls"`
+		Challenge     string     `json:"challenge"`
+		IssuedAt      *time.Time `json:"issuedAt"`
+		ValidUntil    *time.Time `json:"validUntil"`
+	}
+	if err := Decode(raw, &w); err != nil {
+		return err
+	}
+	if w.Configured == nil || w.PolicyVersion == nil || w.Controls == nil || w.IssuedAt == nil || w.ValidUntil == nil {
+		return errors.New("native channel envelope has missing required fields")
+	}
+	*d = Desired{Configured: *w.Configured, SchemaVersion: w.SchemaVersion, DeviceID: w.DeviceID, RuntimeID: w.RuntimeID, CredentialID: w.CredentialID, PolicyVersion: *w.PolicyVersion, Controls: *w.Controls, Challenge: w.Challenge, IssuedAt: *w.IssuedAt, ValidUntil: *w.ValidUntil}
+	return nil
+}
+func (c *Channel) UnmarshalJSON(raw []byte) error {
+	var w struct {
+		Name       string `json:"name"`
+		Scope      string `json:"scope"`
+		State      string `json:"state"`
+		Targets    *int   `json:"targets"`
+		Controlled *int   `json:"controlled"`
+		ReasonCode string `json:"reasonCode"`
+	}
+	if err := Decode(raw, &w); err != nil {
+		return err
+	}
+	if w.Targets == nil || w.Controlled == nil {
+		return errors.New("native channel counts are required")
+	}
+	*c = Channel{Name: w.Name, Scope: w.Scope, State: w.State, Targets: *w.Targets, Controlled: *w.Controlled, ReasonCode: w.ReasonCode}
+	return nil
+}