@opensoha/contracts 0.1.4 → 0.1.5

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.4",
+  "version": "0.1.5",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.4",
+  "version": "0.1.5",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {

package/fixtures/openapi/SecretCreateRequest/invalid/both-sources.json

@@ -0,0 +1,12 @@
+{
+  "name": "registry-token",
+  "value": "opaque-token",
+  "vaultKv2": {
+    "mount": "secret",
+    "path": "demo/registry",
+    "key": "token",
+    "version": 3
+  },
+  "scopeType": "project",
+  "scopeId": "demo"
+}

package/fixtures/openapi/SecretCreateRequest/invalid/missing-vault-version.json

@@ -0,0 +1,10 @@
+{
+  "name": "registry-token",
+  "scopeType": "project",
+  "scopeId": "demo",
+  "vaultKv2": {
+    "mount": "team/kv",
+    "path": "demo/app",
+    "key": "token"
+  }
+}

package/fixtures/openapi/SecretCreateRequest/invalid/vault-key-newline.json

@@ -0,0 +1,11 @@
+{
+  "name": "registry-token",
+  "scopeType": "project",
+  "scopeId": "demo",
+  "vaultKv2": {
+    "mount": "team/kv",
+    "path": "demo/app",
+    "key": "token\nvalue",
+    "version": 7
+  }
+}

package/fixtures/openapi/SecretCreateRequest/invalid/vault-key-whitespace.json

@@ -0,0 +1,11 @@
+{
+  "name": "registry-token",
+  "scopeType": "project",
+  "scopeId": "demo",
+  "vaultKv2": {
+    "mount": "team/kv",
+    "path": "demo/app",
+    "key": " \t ",
+    "version": 7
+  }
+}

package/fixtures/openapi/SecretCreateRequest/valid/vault-kv2.json

@@ -0,0 +1,11 @@
+{
+  "name": "registry-token",
+  "scopeType": "project",
+  "scopeId": "demo",
+  "vaultKv2": {
+    "mount": "team/kv",
+    "path": "demo/app",
+    "key": "token",
+    "version": 7
+  }
+}

package/fixtures/openapi/SecretRotateRequest/invalid/both-sources.json

@@ -0,0 +1,9 @@
+{
+  "value": "next-opaque-secret-value",
+  "vaultKv2": {
+    "mount": "team/kv",
+    "path": "demo/app",
+    "key": "token",
+    "version": 8
+  }
+}

package/fixtures/openapi/SecretRotateRequest/invalid/missing-source.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/SecretRotateRequest/valid/vault-kv2.json

@@ -0,0 +1,8 @@
+{
+  "vaultKv2": {
+    "mount": "team/kv",
+    "path": "demo/app",
+    "key": "token",
+    "version": 8
+  }
+}

package/gen/go/sohaapi/client.go

@@ -14,7 +14,7 @@ import (
 	"time"
 )
 
-const defaultUserAgent = "opensoha-contracts/0.1.4"
+const defaultUserAgent = "opensoha-contracts/0.1.5"
 
 type Client struct {
 	BaseURL    string

package/gen/go/sohaapi/types.go

@@ -13058,14 +13058,15 @@ type SecretBinding struct {
 // SecretBindingTargetType defines model for SecretBinding.TargetType.
 type SecretBindingTargetType string
 
-// SecretCreateRequest defines model for SecretCreateRequest.
+// SecretCreateRequest Exactly one of value or vaultKv2 must be provided.
 type SecretCreateRequest struct {
-	Bindings    []SecretBinding `json:"bindings,omitempty"`
-	Description string          `json:"description,omitempty"`
-	Name        string          `json:"name"`
-	ScopeID     string          `json:"scopeId"`
-	ScopeType   SecretScopeType `json:"scopeType"`
-	Value       string          `json:"value,omitempty"`
+	Bindings    []SecretBinding          `json:"bindings,omitempty"`
+	Description string                   `json:"description,omitempty"`
+	Name        string                   `json:"name"`
+	ScopeID     string                   `json:"scopeId"`
+	ScopeType   SecretScopeType          `json:"scopeType"`
+	Value       string                   `json:"value,omitempty"`
+	VaultKv2    *SecretVaultKV2Reference `json:"vaultKv2,omitempty"`
 }
 
 // SecretLeaseGrant defines model for SecretLeaseGrant.
@@ -13117,9 +13118,10 @@ type SecretMetadataListEnvelope struct {
 // SecretReferenceMap defines model for SecretReferenceMap.
 type SecretReferenceMap map[string]string
 
-// SecretRotateRequest defines model for SecretRotateRequest.
+// SecretRotateRequest Exactly one of value or vaultKv2 must be provided.
 type SecretRotateRequest struct {
-	Value string `json:"value,omitempty"`
+	Value    string                   `json:"value,omitempty"`
+	VaultKv2 *SecretVaultKV2Reference `json:"vaultKv2,omitempty"`
 }
 
 // SecretScopeType defines model for SecretScopeType.
@@ -13136,6 +13138,14 @@ type SecretUpdateRequest struct {
 	Status      SecretStatus    `json:"status,omitempty"`
 }
 
+// SecretVaultKV2Reference defines model for SecretVaultKV2Reference.
+type SecretVaultKV2Reference struct {
+	Key     string `json:"key"`
+	Mount   string `json:"mount"`
+	Path    string `json:"path"`
+	Version int    `json:"version"`
+}
+
 // SecretVersionMetadata defines model for SecretVersionMetadata.
 type SecretVersionMetadata struct {
 	CreatedAt time.Time           `json:"createdAt"`

package/gen/ts/sohaapi/index.ts

@@ -10071,6 +10071,12 @@ export interface components {
         SecretReferenceMap: {
             [key: string]: string;
         };
+        SecretVaultKV2Reference: {
+            mount: string;
+            path: string;
+            key: string;
+            version: number;
+        };
         SecretMetadata: {
             id: string;
             name: string;
@@ -10086,9 +10092,11 @@ export interface components {
             /** Format: date-time */
             updatedAt: string;
         };
+        /** @description Exactly one of value or vaultKv2 must be provided. */
         SecretCreateRequest: {
             name: string;
-            value: string;
+            value?: string;
+            vaultKv2?: components["schemas"]["SecretVaultKV2Reference"];
             description?: string;
             scopeType: components["schemas"]["SecretScopeType"];
             scopeId: string;
@@ -10100,8 +10108,10 @@ export interface components {
             status?: components["schemas"]["SecretStatus"];
             bindings?: components["schemas"]["SecretBinding"][];
         };
+        /** @description Exactly one of value or vaultKv2 must be provided. */
         SecretRotateRequest: {
-            value: string;
+            value?: string;
+            vaultKv2?: components["schemas"]["SecretVaultKV2Reference"];
         };
         SecretVersionMetadata: {
             secretId: string;
@@ -12537,6 +12547,7 @@ export type SecretStatus = components['schemas']['SecretStatus'];
 export type SecretVersionStatus = components['schemas']['SecretVersionStatus'];
 export type SecretBinding = components['schemas']['SecretBinding'];
 export type SecretReferenceMap = components['schemas']['SecretReferenceMap'];
+export type SecretVaultKV2Reference = components['schemas']['SecretVaultKV2Reference'];
 export type SecretMetadata = components['schemas']['SecretMetadata'];
 export type SecretCreateRequest = components['schemas']['SecretCreateRequest'];
 export type SecretUpdateRequest = components['schemas']['SecretUpdateRequest'];

package/openapi/soha-api.json

@@ -24166,6 +24166,17 @@
       },
       "SecretCreateRequest": {
         "additionalProperties": false,
+        "description": "Exactly one of value or vaultKv2 must be provided.",
+        "else": {
+          "required": [
+            "vaultKv2"
+          ]
+        },
+        "if": {
+          "required": [
+            "value"
+          ]
+        },
         "properties": {
           "bindings": {
             "items": {
@@ -24196,14 +24207,23 @@
             "minLength": 1,
             "type": "string",
             "writeOnly": true
+          },
+          "vaultKv2": {
+            "$ref": "#/components/schemas/SecretVaultKV2Reference"
           }
         },
         "required": [
           "name",
-          "value",
           "scopeType",
           "scopeId"
         ],
+        "then": {
+          "not": {
+            "required": [
+              "vaultKv2"
+            ]
+          }
+        },
         "type": "object"
       },
       "SecretLeaseGrant": {
@@ -24365,17 +24385,35 @@
       },
       "SecretRotateRequest": {
         "additionalProperties": false,
+        "description": "Exactly one of value or vaultKv2 must be provided.",
+        "else": {
+          "required": [
+            "vaultKv2"
+          ]
+        },
+        "if": {
+          "required": [
+            "value"
+          ]
+        },
         "properties": {
           "value": {
             "maxLength": 1048576,
             "minLength": 1,
             "type": "string",
             "writeOnly": true
+          },
+          "vaultKv2": {
+            "$ref": "#/components/schemas/SecretVaultKV2Reference"
+          }
+        },
+        "then": {
+          "not": {
+            "required": [
+              "vaultKv2"
+            ]
           }
         },
-        "required": [
-          "value"
-        ],
         "type": "object"
       },
       "SecretScopeType": {
@@ -24428,6 +24466,40 @@
         },
         "type": "object"
       },
+      "SecretVaultKV2Reference": {
+        "additionalProperties": false,
+        "properties": {
+          "key": {
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[^\\u0000\\r\\n]*\\S[^\\u0000\\r\\n]*$",
+            "type": "string"
+          },
+          "mount": {
+            "maxLength": 256,
+            "minLength": 1,
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*(?:/[A-Za-z0-9][A-Za-z0-9._-]*)*$",
+            "type": "string"
+          },
+          "path": {
+            "maxLength": 1024,
+            "minLength": 1,
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*(?:/[A-Za-z0-9][A-Za-z0-9._-]*)*$",
+            "type": "string"
+          },
+          "version": {
+            "minimum": 1,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "mount",
+          "path",
+          "key",
+          "version"
+        ],
+        "type": "object"
+      },
       "SecretVersionMetadata": {
         "additionalProperties": false,
         "properties": {
@@ -26984,7 +27056,7 @@
   "info": {
     "description": "Public OpenSoha core API contract. This first contract focuses on stable cross-repository boundaries: auth, health, runner-facing control-plane callbacks, AI Gateway, and MCP capability discovery.\n",
     "title": "Soha API",
-    "version": "0.1.4"
+    "version": "0.1.5"
   },
   "openapi": "3.1.0",
   "paths": {

package/openapi/soha-api.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: Soha API
-  version: 0.1.4
+  version: 0.1.5
   description: >
     Public OpenSoha core API contract. This first contract focuses on stable
     cross-repository boundaries: auth, health, runner-facing control-plane
@@ -18359,6 +18359,29 @@ components:
       additionalProperties:
         type: string
         pattern: "^soha://secrets/[A-Za-z0-9._-]+(?:/versions/[1-9][0-9]*)?$"
+    SecretVaultKV2Reference:
+      type: object
+      required: [mount, path, key, version]
+      properties:
+        mount:
+          type: string
+          minLength: 1
+          maxLength: 256
+          pattern: "^[A-Za-z0-9][A-Za-z0-9._-]*(?:/[A-Za-z0-9][A-Za-z0-9._-]*)*$"
+        path:
+          type: string
+          minLength: 1
+          maxLength: 1024
+          pattern: "^[A-Za-z0-9][A-Za-z0-9._-]*(?:/[A-Za-z0-9][A-Za-z0-9._-]*)*$"
+        key:
+          type: string
+          minLength: 1
+          maxLength: 256
+          pattern: "^[^\\u0000\\r\\n]*\\S[^\\u0000\\r\\n]*$"
+        version:
+          type: integer
+          minimum: 1
+      additionalProperties: false
     SecretMetadata:
       type: object
       required: [id, name, scopeType, scopeId, status, currentVersion, bindings, createdBy, createdAt, updatedAt]
@@ -18393,7 +18416,15 @@ components:
       additionalProperties: false
     SecretCreateRequest:
       type: object
-      required: [name, value, scopeType, scopeId]
+      description: Exactly one of value or vaultKv2 must be provided.
+      required: [name, scopeType, scopeId]
+      if:
+        required: [value]
+      then:
+        not:
+          required: [vaultKv2]
+      else:
+        required: [vaultKv2]
       properties:
         name:
           type: string
@@ -18404,6 +18435,8 @@ components:
           minLength: 1
           maxLength: 1048576
           writeOnly: true
+        vaultKv2:
+          $ref: "#/components/schemas/SecretVaultKV2Reference"
         description:
           type: string
           maxLength: 1024
@@ -18440,13 +18473,22 @@ components:
       additionalProperties: false
     SecretRotateRequest:
       type: object
-      required: [value]
+      description: Exactly one of value or vaultKv2 must be provided.
+      if:
+        required: [value]
+      then:
+        not:
+          required: [vaultKv2]
+      else:
+        required: [vaultKv2]
       properties:
         value:
           type: string
           minLength: 1
           maxLength: 1048576
           writeOnly: true
+        vaultKv2:
+          $ref: "#/components/schemas/SecretVaultKV2Reference"
       additionalProperties: false
     SecretVersionMetadata:
       type: object

package/openapi/spec_generated.go

@@ -5,9 +5,9 @@ package openapi
 import _ "embed"
 
 const (
-	Version    = "0.1.4"
-	YAMLSHA256 = "09e3b9d0e56d0fa64dec6ca3a631a15cea6c8837fdcd1efe6866d9f2b7163e1a"
-	JSONSHA256 = "677e1cf4de13bb9888f4af32c773ff47c8937312bcf04da764477b7b3c711aab"
+	Version    = "0.1.5"
+	YAMLSHA256 = "d841f66bab9b28db25f34f8c4b7d7047fba018e82c95acc17b93ff2e76e6d1f3"
+	JSONSHA256 = "56df00cdf416382845496bd48cb4ab979accc666fde6481366bc9685a7f70f18"
 )
 
 //go:embed soha-api.yaml

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensoha/contracts",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "private": false,
   "description": "Shared OpenSoha API, agent, MCP, skill, event, and auth contracts.",
   "license": "Apache-2.0",