@opensoha/contracts 0.1.26 → 0.1.29

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (213) hide show
  1. package/COMPATIBILITY.md +14 -3
  2. package/README.md +8 -9
  3. package/auth/catalog_generated.go +2 -2
  4. package/auth/permission-catalog.json +481 -1
  5. package/compat/consumer-revisions.json +1 -1
  6. package/compat/json-schema-ecosystem-0.1.0.json +1 -1
  7. package/compat/openapi-loose-boundaries-0.1.0.json +1 -1
  8. package/endpointcontrol/decode.go +64 -0
  9. package/endpointcontrol/models.go +138 -0
  10. package/endpointcontrol/models_test.go +51 -0
  11. package/endpointcontrol/protocol.schema.json +397 -0
  12. package/fixtures/json-schema/endpoint-controls/invalid/controls.json +16 -0
  13. package/fixtures/json-schema/endpoint-controls/invalid/missing-channel-decision.json +15 -0
  14. package/fixtures/json-schema/endpoint-controls/invalid/receipt-content.json +36 -0
  15. package/fixtures/json-schema/endpoint-controls/valid/controls.json +16 -0
  16. package/fixtures/json-schema/endpoint-controls/valid/receipt.json +35 -0
  17. package/fixtures/json-schema/network-runtime-protocol/invalid/eap-activate-bad-fingerprint.json +14 -0
  18. package/fixtures/json-schema/network-runtime-protocol/invalid/eap-gateway-request.json +14 -0
  19. package/fixtures/json-schema/network-runtime-protocol/invalid/eap-private-key-request.json +15 -0
  20. package/fixtures/json-schema/network-runtime-protocol/invalid/eap-profile-without-eap-credential.json +22 -0
  21. package/fixtures/json-schema/network-runtime-protocol/invalid/endpoint-dns-observation.json +25 -0
  22. package/fixtures/json-schema/network-runtime-protocol/invalid/gateway-presence.json +22 -0
  23. package/fixtures/json-schema/network-runtime-protocol/invalid/mihomo-protection-zero-version.json +45 -0
  24. package/fixtures/json-schema/network-runtime-protocol/invalid/presence-raw-key.json +23 -0
  25. package/fixtures/json-schema/network-runtime-protocol/invalid/presence-zero-sequence.json +22 -0
  26. package/fixtures/json-schema/network-runtime-protocol/invalid/workload-wide-vpn.json +17 -0
  27. package/fixtures/json-schema/network-runtime-protocol/valid/eap-certificate-activate.json +14 -0
  28. package/fixtures/json-schema/network-runtime-protocol/valid/eap-certificate-request.json +14 -0
  29. package/fixtures/json-schema/network-runtime-protocol/valid/eap-profile-enrollment.json +24 -0
  30. package/fixtures/json-schema/network-runtime-protocol/valid/endpoint-presence.json +22 -0
  31. package/fixtures/json-schema/network-runtime-protocol/valid/ipv6-configuration.json +102 -0
  32. package/fixtures/json-schema/network-runtime-protocol/valid/mihomo-protected-policy.json +45 -0
  33. package/fixtures/json-schema/network-runtime-protocol/valid/site-dns-ipv6.json +25 -0
  34. package/fixtures/json-schema/network-runtime-protocol/valid/workload-direct-ztna.json +20 -0
  35. package/fixtures/openapi/DLPShadowDecision/invalid/step-up-type.json +14 -0
  36. package/fixtures/openapi/DLPShadowDecision/valid/archive-v2.json +14 -0
  37. package/fixtures/openapi/DLPShadowDecision/valid/step-up.json +14 -0
  38. package/fixtures/openapi/DLPShadowInput/invalid/self-reported-result.json +7 -0
  39. package/fixtures/openapi/DLPShadowInput/invalid/too-many-samples.json +14 -0
  40. package/fixtures/openapi/DLPShadowInput/valid/bounded.json +7 -0
  41. package/fixtures/openapi/DockerVolumeDLPAppealInput/invalid/p4-response.json +3 -0
  42. package/fixtures/openapi/DockerVolumeDLPAppealInput/valid/p4-response.json +3 -0
  43. package/fixtures/openapi/DockerVolumeDLPAppealReviewInput/invalid/p4-response.json +5 -0
  44. package/fixtures/openapi/DockerVolumeDLPAppealReviewInput/valid/p4-response.json +5 -0
  45. package/fixtures/openapi/DockerVolumeDLPAuthorizationInput/invalid/p4-response.json +3 -0
  46. package/fixtures/openapi/DockerVolumeDLPAuthorizationInput/valid/p4-response.json +3 -0
  47. package/fixtures/openapi/DockerVolumeDLPContent/invalid/archive-unsupported-channel.json +9 -0
  48. package/fixtures/openapi/DockerVolumeDLPContent/invalid/p4.json +6 -0
  49. package/fixtures/openapi/DockerVolumeDLPContent/invalid/step-up-audit.json +9 -0
  50. package/fixtures/openapi/DockerVolumeDLPContent/invalid/unavailable-engine.json +9 -0
  51. package/fixtures/openapi/DockerVolumeDLPContent/invalid/unknown-data-level.json +12 -0
  52. package/fixtures/openapi/DockerVolumeDLPContent/valid/classified-rule.json +16 -0
  53. package/fixtures/openapi/DockerVolumeDLPContent/valid/p4.json +8 -0
  54. package/fixtures/openapi/DockerVolumeDLPContent/valid/step-up.json +9 -0
  55. package/fixtures/openapi/DockerVolumeDLPDecision/invalid/p4.json +9 -0
  56. package/fixtures/openapi/DockerVolumeDLPDecision/invalid/step-up-type.json +12 -0
  57. package/fixtures/openapi/DockerVolumeDLPDecision/valid/archive-v2.json +12 -0
  58. package/fixtures/openapi/DockerVolumeDLPDecision/valid/p4.json +11 -0
  59. package/fixtures/openapi/DockerVolumeDLPDecision/valid/step-up.json +12 -0
  60. package/fixtures/openapi/DockerVolumeDLPSaveInput/invalid/p4.json +11 -0
  61. package/fixtures/openapi/DockerVolumeDLPSaveInput/valid/p4.json +11 -0
  62. package/fixtures/openapi/DockerVolumeFileReadInput/invalid/p4-response.json +5 -0
  63. package/fixtures/openapi/DockerVolumeFileReadInput/valid/p4-response.json +4 -0
  64. package/fixtures/openapi/EndpointDeviceInput/invalid/reported-management.json +5 -0
  65. package/fixtures/openapi/EndpointDeviceInput/valid/management-state.json +5 -0
  66. package/fixtures/openapi/EndpointDeviceRegistrationInput/invalid/self-promote-management.json +5 -0
  67. package/fixtures/openapi/KubernetesClusterRegistrationRequest/invalid/metric-cluster-value-length.json +3 -0
  68. package/fixtures/openapi/KubernetesClusterRegistrationRequest/invalid/metric-cluster-value-type.json +3 -0
  69. package/fixtures/openapi/KubernetesClusterRegistrationRequest/valid/metric-cluster-alias.json +5 -0
  70. package/fixtures/openapi/KubernetesClusterRegistrationRequest/valid/metric-cluster-reset.json +3 -0
  71. package/fixtures/openapi/KubernetesHelmReleaseValuesUpdateInput/invalid/revision-overflow.json +4 -0
  72. package/fixtures/openapi/KubernetesHelmReleaseValuesUpdateInput/valid/legacy.json +3 -0
  73. package/fixtures/openapi/KubernetesHelmReleaseValuesUpdateInput/valid/observed-revision.json +4 -0
  74. package/fixtures/openapi/KubernetesJobDetail/invalid/execution-observation.json +23 -0
  75. package/fixtures/openapi/KubernetesJobDetail/valid/execution-observation.json +23 -0
  76. package/fixtures/openapi/KubernetesNode/invalid/labels.json +10 -0
  77. package/fixtures/openapi/KubernetesNode/valid/labels.json +11 -0
  78. package/fixtures/openapi/KubernetesPodListEnvelope/invalid/empty-uid.json +13 -0
  79. package/fixtures/openapi/KubernetesPodListEnvelope/invalid/invalid-container-state.json +20 -0
  80. package/fixtures/openapi/KubernetesPodListEnvelope/invalid/missing-container-ready.json +19 -0
  81. package/fixtures/openapi/KubernetesPodListEnvelope/valid/container-statuses.json +67 -0
  82. package/fixtures/openapi/KubernetesPodListEnvelope/valid/running-pod.json +1 -0
  83. package/fixtures/openapi/KubernetesPrometheusDetail/invalid/metric-cluster-value-type.json +4 -0
  84. package/fixtures/openapi/KubernetesPrometheusDetail/valid/metric-cluster-alias.json +5 -0
  85. package/fixtures/openapi/KubernetesResourceGraphEnvelope/invalid/network-edge-source-payload.json +73 -0
  86. package/fixtures/openapi/KubernetesResourceGraphEnvelope/valid/network-edge-facts.json +67 -0
  87. package/fixtures/openapi/KubernetesSecretCertificate/invalid/secret-data.json +1 -0
  88. package/fixtures/openapi/KubernetesSecretCertificate/invalid/status.json +1 -0
  89. package/fixtures/openapi/KubernetesSecretCertificate/valid/available.json +1 -0
  90. package/fixtures/openapi/KubernetesSecretCertificate/valid/missing.json +1 -0
  91. package/fixtures/openapi/ManagedContentPasteInput/invalid/boundary.json +5 -0
  92. package/fixtures/openapi/ManagedContentPasteInput/valid/boundary.json +6 -0
  93. package/fixtures/openapi/ManagedContentPolicy/invalid/self-reported-allow.json +8 -0
  94. package/fixtures/openapi/ManagedContentPolicy/invalid/step-up-audit.json +8 -0
  95. package/fixtures/openapi/ManagedContentPolicy/invalid/unknown-extractor.json +8 -0
  96. package/fixtures/openapi/ManagedContentPolicy/valid/archive-v2.json +8 -0
  97. package/fixtures/openapi/ManagedContentPolicy/valid/network-and-level.json +10 -0
  98. package/fixtures/openapi/ManagedContentPolicy/valid/step-up.json +8 -0
  99. package/fixtures/openapi/ManagedContentReviewInput/invalid/boundary.json +5 -0
  100. package/fixtures/openapi/ManagedContentReviewInput/valid/boundary.json +5 -0
  101. package/fixtures/openapi/ManagedContentSaveInput/invalid/boundary.json +14 -0
  102. package/fixtures/openapi/ManagedContentSaveInput/valid/boundary.json +16 -0
  103. package/fixtures/openapi/ManagedContentUploadInput/invalid/boundary.json +7 -0
  104. package/fixtures/openapi/ManagedContentUploadInput/valid/boundary.json +6 -0
  105. package/fixtures/openapi/NetworkAccessPolicyInput/invalid/unknown-management-state.json +35 -0
  106. package/fixtures/openapi/NetworkAccessPolicyInput/valid/managed-device.json +35 -0
  107. package/fixtures/openapi/NetworkAdmissionPreviewRequest/invalid/deviceId-characters.json +4 -0
  108. package/fixtures/openapi/NetworkAdmissionPreviewRequest/invalid/nasBindingId-characters.json +4 -0
  109. package/fixtures/openapi/NetworkAdmissionPreviewRequest/invalid/subject-override.json +1 -0
  110. package/fixtures/openapi/NetworkAdmissionPreviewRequest/valid/device-nas.json +1 -0
  111. package/fixtures/openapi/NetworkAdmissionPreviewResult/invalid/missing-attributeVersion.json +13 -0
  112. package/fixtures/openapi/NetworkAdmissionPreviewResult/invalid/missing-evaluatedAt.json +13 -0
  113. package/fixtures/openapi/NetworkAdmissionPreviewResult/valid/versioned.json +14 -0
  114. package/fixtures/openapi/NetworkConflictAnalysisRequest/invalid/missing-runtime-ranges.json +1 -0
  115. package/fixtures/openapi/NetworkConflictAnalysisRequest/invalid/unknown-source-type.json +9 -0
  116. package/fixtures/openapi/NetworkConflictAnalysisRequest/valid/empty-runtime-ranges.json +3 -0
  117. package/fixtures/openapi/NetworkConflictAnalysisRequest/{invalid → valid}/ipv6-range.json +1 -1
  118. package/fixtures/openapi/NetworkEAPServerTrust/invalid/no-server-validation.json +5 -0
  119. package/fixtures/openapi/NetworkEAPServerTrust/valid/named-server.json +9 -0
  120. package/fixtures/openapi/NetworkEndpointResponsePolicyInput/invalid/all-sites-implicit.json +45 -0
  121. package/fixtures/openapi/NetworkEndpointResponsePolicyInput/invalid/unbounded-stages.json +54 -0
  122. package/fixtures/openapi/NetworkEndpointResponsePolicyInput/invalid/zero-heartbeat.json +47 -0
  123. package/fixtures/openapi/NetworkEndpointResponsePolicyInput/valid/staged-protection.json +47 -0
  124. package/fixtures/openapi/NetworkEndpointResponseRestoreInput/invalid/missing-reason.json +3 -0
  125. package/fixtures/openapi/NetworkEndpointResponseRestoreInput/valid/expected-current.json +4 -0
  126. package/fixtures/openapi/NetworkPolicyPreviewResult/invalid/attribute-version.json +1 -0
  127. package/fixtures/openapi/NetworkPolicyPreviewResult/valid/admission-version.json +1 -0
  128. package/fixtures/openapi/NetworkPolicySubjects/invalid/duplicate-role.json +1 -0
  129. package/fixtures/openapi/NetworkPolicySubjects/invalid/role-characters.json +5 -0
  130. package/fixtures/openapi/NetworkPolicySubjects/valid/role-bound.json +1 -0
  131. package/fixtures/openapi/NetworkProxyConfigurationInput/invalid/missing-content.json +1 -0
  132. package/fixtures/openapi/NetworkProxyConfigurationPatchInput/invalid/bad-binding-id.json +9 -0
  133. package/fixtures/openapi/NetworkProxyConfigurationPatchInput/invalid/empty-content.json +1 -0
  134. package/fixtures/openapi/NetworkProxyConfigurationPatchInput/valid/binding-only.json +11 -0
  135. package/fixtures/openapi/NetworkProxyConfigurationPatchInput/valid/clear-binding-disabled.json +5 -0
  136. package/fixtures/openapi/NetworkProxyConfigurationPatchInput/valid/enabled.json +1 -0
  137. package/fixtures/openapi/NetworkSiteInput/invalid/unknown-governance.json +6 -0
  138. package/fixtures/openapi/NetworkSiteInput/valid/restricted-unmanaged.json +6 -0
  139. package/gen/go/sohaapi/client.go +1 -1
  140. package/gen/go/sohaapi/client_test.go +13 -0
  141. package/gen/go/sohaapi/kubernetes_workload_optional_test.go +40 -0
  142. package/gen/go/sohaapi/pod_status_compat_test.go +36 -0
  143. package/gen/go/sohaapi/proxy_configuration_test.go +38 -0
  144. package/gen/go/sohaapi/types.go +3222 -260
  145. package/gen/ts/sohaapi/index.ts +15506 -10104
  146. package/helmrelease/runtime/values_upgrade.go +78 -0
  147. package/helmrelease/runtime/values_upgrade_test.go +123 -0
  148. package/helmrelease/values_update.go +31 -0
  149. package/network/README.md +34 -0
  150. package/network/network-radius-accounting.schema.json +4 -1
  151. package/network/network-runtime-protocol.schema.json +2166 -317
  152. package/network/proxy-runtime.schema.json +482 -67
  153. package/openapi/network_control_test.go +64 -0
  154. package/openapi/soha-api.json +50412 -41310
  155. package/openapi/soha-api.yaml +16859 -10699
  156. package/openapi/spec_generated.go +3 -3
  157. package/package.json +6 -3
  158. package/proxytransport/handler.go +271 -0
  159. package/proxytransport/probe.go +30 -0
  160. package/proxytransport/scope.go +89 -0
  161. package/proxytransport/transport_test.go +60 -0
  162. package/resource/agent_profiles.go +9 -15
  163. package/resource/agent_profiles_test.go +9 -3
  164. package/resource/custom_graph_page.go +18 -0
  165. package/resource/models.go +102 -57
  166. package/resource/network_topology.go +22 -0
  167. package/resource/network_topology_projection.go +36 -22
  168. package/resource/network_topology_projection_test.go +4 -0
  169. package/resource/network_topology_test.go +20 -0
  170. package/resource/network_topology_validation.go +5 -0
  171. package/resource/observed_workload.go +18 -0
  172. package/resource/pod_status_test.go +22 -0
  173. package/resource/rbac_graph.go +4 -0
  174. package/resource/rollout_optional_test.go +33 -0
  175. package/resource/runtime/network_relationship_primitives.go +66 -0
  176. package/resource/runtime/network_relationship_primitives_test.go +147 -0
  177. package/resource/runtime/network_topology.go +17 -5
  178. package/resource/runtime/network_topology_builder.go +405 -0
  179. package/resource/runtime/network_topology_builder_backends.go +195 -0
  180. package/resource/runtime/network_topology_builder_gateway_l4_test.go +86 -0
  181. package/resource/runtime/network_topology_builder_ingress.go +302 -0
  182. package/resource/runtime/network_topology_builder_legacy.go +66 -0
  183. package/resource/runtime/network_topology_builder_providers.go +242 -0
  184. package/resource/runtime/network_topology_builder_test.go +186 -0
  185. package/resource/runtime/network_topology_declarations.go +329 -0
  186. package/resource/runtime/resource_edit.go +22 -0
  187. package/resource/runtime/resource_edit_test.go +32 -0
  188. package/resource/runtime/resource_graph_collect.go +325 -0
  189. package/resource/runtime/resource_graph_configuration.go +59 -0
  190. package/resource/runtime/resource_graph_configuration_collect.go +198 -0
  191. package/resource/runtime/resource_graph_configuration_test.go +470 -0
  192. package/resource/runtime/resource_graph_custom_page.go +159 -0
  193. package/resource/runtime/resource_graph_custom_root.go +132 -0
  194. package/resource/runtime/resource_graph_custom_root_test.go +197 -0
  195. package/resource/runtime/resource_graph_enrichment.go +417 -0
  196. package/resource/runtime/resource_graph_enrichment_hpa_test.go +117 -0
  197. package/resource/runtime/resource_graph_enrichment_test.go +201 -0
  198. package/resource/runtime/resource_graph_metadata.go +125 -0
  199. package/resource/runtime/resource_graph_metadata_test.go +204 -0
  200. package/resource/runtime/resource_graph_network.go +224 -0
  201. package/resource/runtime/resource_graph_network_collect.go +174 -0
  202. package/resource/runtime/resource_graph_network_collect_test.go +147 -0
  203. package/resource/runtime/resource_graph_network_test.go +342 -0
  204. package/resource/runtime/resource_graph_rbac.go +278 -0
  205. package/resource/runtime/resource_graph_rbac_test.go +372 -0
  206. package/resource/runtime/resource_graph_rules.go +834 -0
  207. package/resource/runtime/resource_graph_storage.go +144 -0
  208. package/resource/runtime/resource_graph_storage_collect.go +163 -0
  209. package/resource/runtime/resource_graph_storage_test.go +397 -0
  210. package/resource/runtime/resource_graph_test.go +627 -0
  211. package/resource/runtime/secret_certificate.go +44 -0
  212. package/resource/runtime/secret_certificate_test.go +87 -0
  213. package/resource/storage_graph.go +4 -0
@@ -0,0 +1,35 @@
1
+ {
2
+ "schemaVersion": "endpoint-controls/v1alpha1",
3
+ "deviceId": "device",
4
+ "runtimeId": "endpoint",
5
+ "credentialId": "credential",
6
+ "policyVersion": 1,
7
+ "challenge": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
8
+ "observedAt": "2026-10-28T00:00:00Z",
9
+ "channels": [
10
+ {
11
+ "name": "usb",
12
+ "scope": "current_usb_volumes",
13
+ "state": "controlled",
14
+ "targets": 1,
15
+ "controlled": 1,
16
+ "reasonCode": "native_scope_only"
17
+ },
18
+ {
19
+ "name": "print",
20
+ "scope": "local_new_print_jobs",
21
+ "state": "controlled",
22
+ "targets": 1,
23
+ "controlled": 1,
24
+ "reasonCode": "native_scope_only"
25
+ },
26
+ {
27
+ "name": "clipboard",
28
+ "scope": "enrolled_console_win32",
29
+ "state": "controlled",
30
+ "targets": 1,
31
+ "controlled": 1,
32
+ "reasonCode": "native_scope_only"
33
+ }
34
+ ]
35
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "presence-1",
4
+ "messageType": "eap.certificate.activate.request",
5
+ "producerId": "endpoint-lab",
6
+ "runtimeId": "endpoint-lab",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-10-14T00:00:00Z",
9
+ "expiresAt": "2026-10-14T00:00:30Z",
10
+ "payload": {
11
+ "credentialId": "eap-credential-1",
12
+ "fingerprint": "sha256:bad"
13
+ }
14
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "presence-1",
4
+ "messageType": "eap.certificate.request",
5
+ "producerId": "endpoint-lab",
6
+ "runtimeId": "endpoint-lab",
7
+ "runtimeKind": "gateway",
8
+ "occurredAt": "2026-10-14T00:00:00Z",
9
+ "expiresAt": "2026-10-14T00:00:30Z",
10
+ "payload": {
11
+ "requestId": "eap-rotation-1",
12
+ "csrPem": "-----BEGIN CERTIFICATE REQUEST-----\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n-----END CERTIFICATE REQUEST-----\n"
13
+ }
14
+ }
@@ -0,0 +1,15 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "presence-1",
4
+ "messageType": "eap.certificate.request",
5
+ "producerId": "endpoint-lab",
6
+ "runtimeId": "endpoint-lab",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-10-14T00:00:00Z",
9
+ "expiresAt": "2026-10-14T00:00:30Z",
10
+ "payload": {
11
+ "requestId": "eap-rotation-1",
12
+ "csrPem": "-----BEGIN CERTIFICATE REQUEST-----\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n-----END CERTIFICATE REQUEST-----\n",
13
+ "privateKey": "never-transmit"
14
+ }
15
+ }
@@ -0,0 +1,22 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "msg-enroll-wireguard-0001",
4
+ "messageType": "runtime.enroll.request",
5
+ "producerId": "endpoint-alice",
6
+ "runtimeId": "endpoint-alice",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-09-02T08:00:00Z",
9
+ "expiresAt": "2026-09-02T08:05:00Z",
10
+ "payload": {
11
+ "enrollmentId": "enrollment-alice",
12
+ "challengeId": "challenge-alice",
13
+ "deviceId": "device-alice-laptop",
14
+ "devicePublicKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA7qY8R9gAwRQmJau0p7uB8mVJwA6m3i3zYvRrV7lIl1E=\n-----END PUBLIC KEY-----",
15
+ "wireguardPublicKey": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=",
16
+ "platform": "macos",
17
+ "clientVersion": "0.2.0",
18
+ "capabilities": [
19
+ "eap-profile-v1"
20
+ ]
21
+ }
22
+ }
@@ -0,0 +1,25 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "msg-dns-1",
4
+ "messageType": "dns.observations",
5
+ "producerId": "gateway-site-a",
6
+ "runtimeId": "gateway-site-a",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-09-02T08:00:00Z",
9
+ "expiresAt": "2026-09-02T08:05:00Z",
10
+ "payload": {
11
+ "configurationVersion": 12,
12
+ "policyVersion": 7,
13
+ "observations": [
14
+ {
15
+ "resourceId": "resource-payroll",
16
+ "hostname": "payroll.example.internal",
17
+ "addresses": [
18
+ "fd20::10"
19
+ ],
20
+ "observedAt": "2026-09-02T08:00:00Z",
21
+ "ttlSeconds": 60
22
+ }
23
+ ]
24
+ }
25
+ }
@@ -0,0 +1,22 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "presence-1",
4
+ "messageType": "endpoint.presence.request",
5
+ "producerId": "endpoint-lab",
6
+ "runtimeId": "endpoint-lab",
7
+ "runtimeKind": "gateway",
8
+ "occurredAt": "2026-10-14T00:00:00Z",
9
+ "expiresAt": "2026-10-14T00:00:30Z",
10
+ "payload": {
11
+ "deviceId": "device-lab",
12
+ "bootId": "boot-1",
13
+ "sequence": 1,
14
+ "status": "healthy",
15
+ "configurationVersion": 1,
16
+ "policyVersion": 1,
17
+ "uiState": "unknown",
18
+ "capabilities": [
19
+ "endpoint-presence-v1"
20
+ ]
21
+ }
22
+ }
@@ -0,0 +1,45 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "msg-config-mihomo-protection-0001",
4
+ "messageType": "configuration.desired",
5
+ "producerId": "network-control",
6
+ "runtimeId": "endpoint-bob",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-09-03T08:00:00Z",
9
+ "expiresAt": "2026-09-03T08:05:00Z",
10
+ "payload": {
11
+ "configurationVersion": 3,
12
+ "policyVersion": 7,
13
+ "validUntil": "2026-09-03T08:05:00Z",
14
+ "accessProfile": "full",
15
+ "protectedResourceIds": [
16
+ "resource-payroll"
17
+ ],
18
+ "networkLeases": [],
19
+ "resourceLeases": [],
20
+ "mihomo": {
21
+ "mode": "app_subscription",
22
+ "profileId": "profile-personal",
23
+ "profileRevision": 1,
24
+ "mixedPort": 7890,
25
+ "controllerPort": 9090,
26
+ "dnsMode": "fake_ip",
27
+ "fakeIpRange": "198.18.0.0/15",
28
+ "selectorGroup": "SOHA",
29
+ "bypassCidrs": [],
30
+ "bypassHosts": [
31
+ "network-control.example.com"
32
+ ],
33
+ "failClosed": false,
34
+ "protection": {
35
+ "policyVersion": 0,
36
+ "cidrs": [
37
+ "10.40.0.0/16"
38
+ ],
39
+ "hosts": [
40
+ "payroll.example.com"
41
+ ]
42
+ }
43
+ }
44
+ }
45
+ }
@@ -0,0 +1,23 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "presence-1",
4
+ "messageType": "endpoint.presence.request",
5
+ "producerId": "endpoint-lab",
6
+ "runtimeId": "endpoint-lab",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-10-14T00:00:00Z",
9
+ "expiresAt": "2026-10-14T00:00:30Z",
10
+ "payload": {
11
+ "deviceId": "device-lab",
12
+ "bootId": "boot-1",
13
+ "sequence": 1,
14
+ "status": "healthy",
15
+ "configurationVersion": 1,
16
+ "policyVersion": 1,
17
+ "uiState": "unknown",
18
+ "capabilities": [
19
+ "endpoint-presence-v1"
20
+ ],
21
+ "privateKey": "not-a-real-secret"
22
+ }
23
+ }
@@ -0,0 +1,22 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "presence-1",
4
+ "messageType": "endpoint.presence.request",
5
+ "producerId": "endpoint-lab",
6
+ "runtimeId": "endpoint-lab",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-10-14T00:00:00Z",
9
+ "expiresAt": "2026-10-14T00:00:30Z",
10
+ "payload": {
11
+ "deviceId": "device-lab",
12
+ "bootId": "boot-1",
13
+ "sequence": 0,
14
+ "status": "healthy",
15
+ "configurationVersion": 1,
16
+ "policyVersion": 1,
17
+ "uiState": "unknown",
18
+ "capabilities": [
19
+ "endpoint-presence-v1"
20
+ ]
21
+ }
22
+ }
@@ -0,0 +1,17 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "msg-direct-ztna-connect-0001",
4
+ "messageType": "vpn.connect.request",
5
+ "producerId": "endpoint-alice",
6
+ "runtimeId": "endpoint-alice",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-09-02T08:00:00Z",
9
+ "expiresAt": "2026-09-02T08:05:00Z",
10
+ "payload": {
11
+ "requestId": "direct-ztna-request-0001",
12
+ "siteId": "site-a",
13
+ "networkSpaceId": "space-site-a",
14
+ "mode": "external_vpn",
15
+ "workloadId": "billing-worker"
16
+ }
17
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "presence-1",
4
+ "messageType": "eap.certificate.activate.request",
5
+ "producerId": "endpoint-lab",
6
+ "runtimeId": "endpoint-lab",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-10-14T00:00:00Z",
9
+ "expiresAt": "2026-10-14T00:00:30Z",
10
+ "payload": {
11
+ "credentialId": "eap-credential-1",
12
+ "fingerprint": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
13
+ }
14
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "presence-1",
4
+ "messageType": "eap.certificate.request",
5
+ "producerId": "endpoint-lab",
6
+ "runtimeId": "endpoint-lab",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-10-14T00:00:00Z",
9
+ "expiresAt": "2026-10-14T00:00:30Z",
10
+ "payload": {
11
+ "requestId": "eap-rotation-1",
12
+ "csrPem": "-----BEGIN CERTIFICATE REQUEST-----\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n-----END CERTIFICATE REQUEST-----\n"
13
+ }
14
+ }
@@ -0,0 +1,24 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "msg-enroll-wireguard-0001",
4
+ "messageType": "runtime.enroll.request",
5
+ "producerId": "endpoint-alice",
6
+ "runtimeId": "endpoint-alice",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-09-02T08:00:00Z",
9
+ "expiresAt": "2026-09-02T08:05:00Z",
10
+ "payload": {
11
+ "enrollmentId": "enrollment-alice",
12
+ "challengeId": "challenge-alice",
13
+ "deviceId": "device-alice-laptop",
14
+ "devicePublicKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA7qY8R9gAwRQmJau0p7uB8mVJwA6m3i3zYvRrV7lIl1E=\n-----END PUBLIC KEY-----",
15
+ "wireguardPublicKey": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=",
16
+ "platform": "macos",
17
+ "clientVersion": "0.2.0",
18
+ "capabilities": [
19
+ "radius-eap-tls-v1",
20
+ "eap-profile-v1",
21
+ "endpoint-presence-v1"
22
+ ]
23
+ }
24
+ }
@@ -0,0 +1,22 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "presence-1",
4
+ "messageType": "endpoint.presence.request",
5
+ "producerId": "endpoint-lab",
6
+ "runtimeId": "endpoint-lab",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-10-14T00:00:00Z",
9
+ "expiresAt": "2026-10-14T00:00:30Z",
10
+ "payload": {
11
+ "deviceId": "device-lab",
12
+ "bootId": "boot-1",
13
+ "sequence": 1,
14
+ "status": "healthy",
15
+ "configurationVersion": 1,
16
+ "policyVersion": 1,
17
+ "uiState": "unknown",
18
+ "capabilities": [
19
+ "endpoint-presence-v1"
20
+ ]
21
+ }
22
+ }
@@ -0,0 +1,102 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "msg-config-0001",
4
+ "messageType": "configuration.desired",
5
+ "producerId": "network-control-default",
6
+ "runtimeId": "gateway-site-a",
7
+ "runtimeKind": "gateway",
8
+ "occurredAt": "2026-09-02T08:00:00Z",
9
+ "expiresAt": "2026-09-02T08:05:00Z",
10
+ "payload": {
11
+ "configurationVersion": 12,
12
+ "policyVersion": 7,
13
+ "validUntil": "2026-09-02T08:05:00Z",
14
+ "accessProfile": "full",
15
+ "protectedResourceIds": [
16
+ "resource-payroll"
17
+ ],
18
+ "networkLeases": [
19
+ {
20
+ "id": "network-lease-0001",
21
+ "sessionId": "session-0001",
22
+ "subjectId": "user-alice",
23
+ "deviceId": "device-alice-laptop",
24
+ "networkSpaceId": "space-site-a",
25
+ "cidrs": [
26
+ "fd20::/64"
27
+ ],
28
+ "policyVersion": 7,
29
+ "issuedAt": "2026-09-02T08:00:00Z",
30
+ "expiresAt": "2026-09-02T08:05:00Z"
31
+ }
32
+ ],
33
+ "resourceLeases": [
34
+ {
35
+ "id": "resource-lease-0001",
36
+ "sessionId": "session-0001",
37
+ "subjectId": "user-alice",
38
+ "deviceId": "device-alice-laptop",
39
+ "resourceIds": [
40
+ "resource-payroll"
41
+ ],
42
+ "policyVersion": 7,
43
+ "issuedAt": "2026-09-02T08:00:00Z",
44
+ "expiresAt": "2026-09-02T08:02:00Z"
45
+ }
46
+ ],
47
+ "runtimeIntervals": {
48
+ "heartbeatIntervalSeconds": 60,
49
+ "configurationPollIntervalSeconds": 60
50
+ },
51
+ "wireguard": {
52
+ "role": "gateway",
53
+ "interfaceName": "soha0",
54
+ "publicKey": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
55
+ "addresses": [
56
+ "fd96::1/128"
57
+ ],
58
+ "listenPort": 51820,
59
+ "mtu": 1380,
60
+ "routingMode": "routed",
61
+ "firewallDefault": "deny",
62
+ "peers": [
63
+ {
64
+ "runtimeId": "endpoint-alice",
65
+ "deviceId": "device-alice-laptop",
66
+ "publicKey": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=",
67
+ "allowedIPs": [
68
+ "fd96::2/128"
69
+ ],
70
+ "persistentKeepaliveSeconds": 25
71
+ }
72
+ ],
73
+ "routes": [
74
+ "fd20::/64"
75
+ ],
76
+ "dnsServers": [
77
+ "fd20::53"
78
+ ],
79
+ "firewallRules": [
80
+ {
81
+ "id": "deny-payroll",
82
+ "effect": "deny",
83
+ "sourceCidr": "fd96::2/128",
84
+ "destinationCidr": "fd20::10/128",
85
+ "protocol": "tcp",
86
+ "ports": [
87
+ 443
88
+ ]
89
+ },
90
+ {
91
+ "id": "allow-network-lease-0001",
92
+ "effect": "allow",
93
+ "leaseId": "network-lease-0001",
94
+ "sourceCidr": "fd96::2/128",
95
+ "destinationCidr": "fd20::/64",
96
+ "protocol": "any",
97
+ "expiresAt": "2026-09-02T08:05:00Z"
98
+ }
99
+ ]
100
+ }
101
+ }
102
+ }
@@ -0,0 +1,45 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "msg-config-mihomo-protection-0001",
4
+ "messageType": "configuration.desired",
5
+ "producerId": "network-control",
6
+ "runtimeId": "endpoint-bob",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-09-03T08:00:00Z",
9
+ "expiresAt": "2026-09-03T08:05:00Z",
10
+ "payload": {
11
+ "configurationVersion": 3,
12
+ "policyVersion": 7,
13
+ "validUntil": "2026-09-03T08:05:00Z",
14
+ "accessProfile": "full",
15
+ "protectedResourceIds": [
16
+ "resource-payroll"
17
+ ],
18
+ "networkLeases": [],
19
+ "resourceLeases": [],
20
+ "mihomo": {
21
+ "mode": "app_subscription",
22
+ "profileId": "profile-personal",
23
+ "profileRevision": 1,
24
+ "mixedPort": 7890,
25
+ "controllerPort": 9090,
26
+ "dnsMode": "fake_ip",
27
+ "fakeIpRange": "198.18.0.0/15",
28
+ "selectorGroup": "SOHA",
29
+ "bypassCidrs": [],
30
+ "bypassHosts": [
31
+ "network-control.example.com"
32
+ ],
33
+ "failClosed": false,
34
+ "protection": {
35
+ "policyVersion": 7,
36
+ "cidrs": [
37
+ "10.40.0.0/16"
38
+ ],
39
+ "hosts": [
40
+ "payroll.example.com"
41
+ ]
42
+ }
43
+ }
44
+ }
45
+ }
@@ -0,0 +1,25 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "msg-dns-1",
4
+ "messageType": "dns.observations",
5
+ "producerId": "gateway-site-a",
6
+ "runtimeId": "gateway-site-a",
7
+ "runtimeKind": "gateway",
8
+ "occurredAt": "2026-09-02T08:00:00Z",
9
+ "expiresAt": "2026-09-02T08:05:00Z",
10
+ "payload": {
11
+ "configurationVersion": 12,
12
+ "policyVersion": 7,
13
+ "observations": [
14
+ {
15
+ "resourceId": "resource-payroll",
16
+ "hostname": "payroll.example.internal",
17
+ "addresses": [
18
+ "fd20::10"
19
+ ],
20
+ "observedAt": "2026-09-02T08:00:00Z",
21
+ "ttlSeconds": 60
22
+ }
23
+ ]
24
+ }
25
+ }
@@ -0,0 +1,20 @@
1
+ {
2
+ "schemaVersion": "network-runtime/v1alpha1",
3
+ "messageId": "msg-direct-ztna-connect-0001",
4
+ "messageType": "vpn.connect.request",
5
+ "producerId": "endpoint-alice",
6
+ "runtimeId": "endpoint-alice",
7
+ "runtimeKind": "endpoint",
8
+ "occurredAt": "2026-09-02T08:00:00Z",
9
+ "expiresAt": "2026-09-02T08:05:00Z",
10
+ "payload": {
11
+ "requestId": "direct-ztna-request-0001",
12
+ "siteId": "site-a",
13
+ "networkSpaceId": "space-site-a",
14
+ "mode": "external_direct_ztna",
15
+ "resourceIds": [
16
+ "resource-payroll"
17
+ ],
18
+ "workloadId": "billing-worker"
19
+ }
20
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "enabled": true,
3
+ "mode": "warn",
4
+ "status": "matched",
5
+ "allowed": false,
6
+ "detectorVersion": "content-dlp-text-v1",
7
+ "matchedRuleIds": [
8
+ "private_key"
9
+ ],
10
+ "dataLevel": "restricted",
11
+ "minimumDataLevel": "public",
12
+ "ruleSetVersion": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
13
+ "stepUpRequired": "true"
14
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "enabled": true,
3
+ "mode": "warn",
4
+ "status": "matched",
5
+ "allowed": false,
6
+ "detectorVersion": "content-dlp-archive-v2",
7
+ "matchedRuleIds": [
8
+ "private_key"
9
+ ],
10
+ "dataLevel": "restricted",
11
+ "minimumDataLevel": "public",
12
+ "ruleSetVersion": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
13
+ "stepUpRequired": true
14
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "enabled": true,
3
+ "mode": "warn",
4
+ "status": "matched",
5
+ "allowed": false,
6
+ "detectorVersion": "content-dlp-text-v1",
7
+ "matchedRuleIds": [
8
+ "private_key"
9
+ ],
10
+ "dataLevel": "restricted",
11
+ "minimumDataLevel": "public",
12
+ "ruleSetVersion": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
13
+ "stepUpRequired": true
14
+ }
@@ -0,0 +1,7 @@
1
+ {
2
+ "expectedRevision": 3,
3
+ "samples": [
4
+ "b2s="
5
+ ],
6
+ "allowed": true
7
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "expectedRevision": 3,
3
+ "samples": [
4
+ "",
5
+ "",
6
+ "",
7
+ "",
8
+ "",
9
+ "",
10
+ "",
11
+ "",
12
+ ""
13
+ ]
14
+ }
@@ -0,0 +1,7 @@
1
+ {
2
+ "expectedRevision": 3,
3
+ "samples": [
4
+ "b3JkaW5hcnkgdGV4dA==",
5
+ ""
6
+ ]
7
+ }
@@ -0,0 +1,3 @@
1
+ {
2
+ "reasonCode": "secret-body"
3
+ }
@@ -0,0 +1,3 @@
1
+ {
2
+ "reasonCode": "false_positive"
3
+ }
@@ -0,0 +1,5 @@
1
+ {
2
+ "expectedRevision": 0,
3
+ "resolution": "approved",
4
+ "reasonCode": "ignore"
5
+ }
@@ -0,0 +1,5 @@
1
+ {
2
+ "expectedRevision": 1,
3
+ "resolution": "approved",
4
+ "reasonCode": "confirmed_false_positive"
5
+ }
@@ -0,0 +1,3 @@
1
+ {
2
+ "action": "force_allow"
3
+ }
@@ -0,0 +1,3 @@
1
+ {
2
+ "action": "acknowledge"
3
+ }