@numa-tech/numa 1.14.7 → 1.14.9

package/dist/teams/schemas.d.ts

@@ -0,0 +1,171 @@
+import { z } from "zod";
+export declare const TeamRoleSchema: z.ZodEnum<{
+    ADMIN: "ADMIN";
+    MAINTAINER: "MAINTAINER";
+    MEMBER: "MEMBER";
+    OWNER: "OWNER";
+    VIEWER: "VIEWER";
+}>;
+export declare const TeamStatusSchema: z.ZodEnum<{
+    ACTIVE: "ACTIVE";
+    ARCHIVED: "ARCHIVED";
+}>;
+export declare const UserStatusSchema: z.ZodEnum<{
+    ACTIVE: "ACTIVE";
+    ARCHIVED: "ARCHIVED";
+    DISABLED: "DISABLED";
+    INACTIVE: "INACTIVE";
+}>;
+export declare const TeamViewSchema: z.ZodObject<{
+    id: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<string, string | number>>;
+    code: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    ownerUsername: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    status: z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        ARCHIVED: "ARCHIVED";
+    }>;
+    version: z.ZodNumber;
+    activeMemberCount: z.ZodNumber;
+    createdDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    lastModifiedDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const PlatformUserViewSchema: z.ZodObject<{
+    id: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<string, string | number>>;
+    username: z.ZodString;
+    displayName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    status: z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        ARCHIVED: "ARCHIVED";
+        DISABLED: "DISABLED";
+        INACTIVE: "INACTIVE";
+    }>;
+    createdDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    lastModifiedDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const TeamMemberViewSchema: z.ZodObject<{
+    membershipId: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<string, string | number>>;
+    teamId: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<string, string | number>>;
+    userId: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<string, string | number>>;
+    username: z.ZodString;
+    displayName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    keycloakSubject: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    role: z.ZodEnum<{
+        ADMIN: "ADMIN";
+        MAINTAINER: "MAINTAINER";
+        MEMBER: "MEMBER";
+        OWNER: "OWNER";
+        VIEWER: "VIEWER";
+    }>;
+    status: z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        INACTIVE: "INACTIVE";
+    }>;
+    addedBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    createdDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    lastModifiedDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const TeamPageSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<string, string | number>>;
+        code: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        ownerUsername: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        status: z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            ARCHIVED: "ARCHIVED";
+        }>;
+        version: z.ZodNumber;
+        activeMemberCount: z.ZodNumber;
+        createdDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        lastModifiedDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+    total: z.ZodNumber;
+    page: z.ZodNumber;
+    size: z.ZodNumber;
+}, z.core.$strip>;
+export declare const PlatformUserPageSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<string, string | number>>;
+        username: z.ZodString;
+        displayName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        status: z.ZodEnum<{
+            ACTIVE: "ACTIVE";
+            ARCHIVED: "ARCHIVED";
+            DISABLED: "DISABLED";
+            INACTIVE: "INACTIVE";
+        }>;
+        createdDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        lastModifiedDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+    total: z.ZodNumber;
+    page: z.ZodNumber;
+    size: z.ZodNumber;
+}, z.core.$strip>;
+export declare const TeamMemberListSchema: z.ZodArray<z.ZodObject<{
+    membershipId: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<string, string | number>>;
+    teamId: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<string, string | number>>;
+    userId: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<string, string | number>>;
+    username: z.ZodString;
+    displayName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    keycloakSubject: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    role: z.ZodEnum<{
+        ADMIN: "ADMIN";
+        MAINTAINER: "MAINTAINER";
+        MEMBER: "MEMBER";
+        OWNER: "OWNER";
+        VIEWER: "VIEWER";
+    }>;
+    status: z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        INACTIVE: "INACTIVE";
+    }>;
+    addedBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    createdDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    lastModifiedDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>>;
+export declare const CreateTeamRequestSchema: z.ZodObject<{
+    code: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    ownerUserId: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const UpdateTeamRequestSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        ARCHIVED: "ARCHIVED";
+    }>;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export declare const SaveTeamMemberRequestSchema: z.ZodObject<{
+    userId: z.ZodNumber;
+    role: z.ZodEnum<{
+        ADMIN: "ADMIN";
+        MAINTAINER: "MAINTAINER";
+        MEMBER: "MEMBER";
+        OWNER: "OWNER";
+        VIEWER: "VIEWER";
+    }>;
+}, z.core.$strict>;
+export declare const TeamApiErrorSchema: z.ZodObject<{
+    code: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodString>;
+    detail: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    details: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$loose>;
+export type TeamRole = z.infer<typeof TeamRoleSchema>;
+export type TeamView = z.infer<typeof TeamViewSchema>;
+export type PlatformUserView = z.infer<typeof PlatformUserViewSchema>;
+export type TeamMemberView = z.infer<typeof TeamMemberViewSchema>;
+export type CreateTeamRequest = z.infer<typeof CreateTeamRequestSchema>;
+export type UpdateTeamRequest = z.infer<typeof UpdateTeamRequestSchema>;
+export type SaveTeamMemberRequest = z.infer<typeof SaveTeamMemberRequestSchema>;

package/dist/teams/schemas.js

@@ -0,0 +1,81 @@
+import { z } from "zod";
+const NonEmptyString = z.string().trim().min(1);
+const OptionalString = z.string().nullable().optional();
+const PositiveId = z.union([
+    z.string().trim().regex(/^[1-9]\d*$/u),
+    z.number().int().positive()
+]).transform(String);
+const DateValue = z.string().nullable().optional();
+export const TeamRoleSchema = z.enum(["OWNER", "ADMIN", "MAINTAINER", "MEMBER", "VIEWER"]);
+export const TeamStatusSchema = z.enum(["ACTIVE", "ARCHIVED"]);
+export const UserStatusSchema = z.enum(["ACTIVE", "ARCHIVED", "INACTIVE", "DISABLED"]);
+export const TeamViewSchema = z.object({
+    id: PositiveId,
+    code: NonEmptyString,
+    name: NonEmptyString,
+    description: OptionalString,
+    ownerUsername: OptionalString,
+    status: TeamStatusSchema,
+    version: z.number().int().nonnegative(),
+    activeMemberCount: z.number().int().nonnegative(),
+    createdDate: DateValue,
+    lastModifiedDate: DateValue
+});
+export const PlatformUserViewSchema = z.object({
+    id: PositiveId,
+    username: NonEmptyString,
+    displayName: OptionalString,
+    email: OptionalString,
+    status: UserStatusSchema,
+    createdDate: DateValue,
+    lastModifiedDate: DateValue
+});
+export const TeamMemberViewSchema = z.object({
+    membershipId: PositiveId,
+    teamId: PositiveId,
+    userId: PositiveId,
+    username: NonEmptyString,
+    displayName: OptionalString,
+    email: OptionalString,
+    keycloakSubject: OptionalString,
+    role: TeamRoleSchema,
+    status: z.enum(["ACTIVE", "INACTIVE"]),
+    addedBy: OptionalString,
+    createdDate: DateValue,
+    lastModifiedDate: DateValue
+});
+function pageSchema(item) {
+    return z.object({
+        items: z.array(item),
+        total: z.number().int().nonnegative(),
+        page: z.number().int().positive(),
+        size: z.number().int().positive()
+    });
+}
+export const TeamPageSchema = pageSchema(TeamViewSchema);
+export const PlatformUserPageSchema = pageSchema(PlatformUserViewSchema);
+export const TeamMemberListSchema = z.array(TeamMemberViewSchema);
+export const CreateTeamRequestSchema = z.object({
+    code: z.string().trim().regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u).max(80),
+    name: z.string().trim().min(1).max(120),
+    description: z.string().trim().max(2000).nullable().optional(),
+    ownerUserId: z.number().int().positive().safe().optional()
+}).strict();
+export const UpdateTeamRequestSchema = z.object({
+    name: z.string().trim().min(1).max(120),
+    description: z.string().trim().max(2000).nullable(),
+    status: TeamStatusSchema,
+    expectedVersion: z.number().int().nonnegative()
+}).strict();
+export const SaveTeamMemberRequestSchema = z.object({
+    userId: z.number().int().positive().safe(),
+    role: TeamRoleSchema
+}).strict();
+export const TeamApiErrorSchema = z.object({
+    code: z.string().optional(),
+    message: z.string().optional(),
+    detail: z.string().optional(),
+    requestId: z.string().optional(),
+    details: z.unknown().optional()
+}).passthrough();
+//# sourceMappingURL=schemas.js.map

package/dist/teams/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/teams/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;AACxD,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC;IACzB,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IACtC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACrB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;AAEnD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAEvF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,cAAc;IAC3B,aAAa,EAAE,cAAc;IAC7B,MAAM,EAAE,gBAAgB;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACjD,WAAW,EAAE,SAAS;IACtB,gBAAgB,EAAE,SAAS;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,UAAU;IACd,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,cAAc;IAC3B,KAAK,EAAE,cAAc;IACrB,MAAM,EAAE,gBAAgB;IACxB,WAAW,EAAE,SAAS;IACtB,gBAAgB,EAAE,SAAS;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,YAAY,EAAE,UAAU;IACxB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,cAAc;IAC3B,KAAK,EAAE,cAAc;IACrB,eAAe,EAAE,cAAc;IAC/B,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtC,OAAO,EAAE,cAAc;IACvB,WAAW,EAAE,SAAS;IACtB,gBAAgB,EAAE,SAAS;CAC5B,CAAC,CAAC;AAEH,SAAS,UAAU,CAAyB,IAAO;IACjD,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC,sBAAsB,CAAC,CAAC;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACzE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACnD,MAAM,EAAE,gBAAgB;IACxB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAChD,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;IAC1C,IAAI,EAAE,cAAc;CACrB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC,WAAW,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@numa-tech/numa",
-  "version": "1.14.7",
+  "version": "1.14.9",
   "description": "Cross-platform CLI for the Numa internal developer platform with Keycloak authentication and MCP support.",
   "author": "numa-tech",
   "keywords": [
@@ -32,7 +32,7 @@
     "typecheck": "turbo run typecheck root:typecheck",
     "root:typecheck": "tsc --noEmit",
     "test": "turbo run test root:test",
-    "root:test": "node --import tsx --test src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/identity.test.ts src/backend.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/ai-registry/client.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/platform-builds/client.test.ts src/platform-builds/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/jenkins-gitops-rollouts/client.test.ts src/jenkins-gitops-rollouts/commands.test.ts src/platform-build-rollouts/client.test.ts src/platform-build-rollouts/commands.test.ts src/platform-build-job-replans/client.test.ts src/platform-build-job-replans/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/authorization/client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/integration-bootstrap/client.test.ts src/integration-bootstrap/commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs",
+    "root:test": "node --import tsx --test src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/identity.test.ts src/backend.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/ai-registry/client.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/platform-builds/client.test.ts src/platform-builds/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/jenkins-gitops-rollouts/client.test.ts src/jenkins-gitops-rollouts/commands.test.ts src/platform-build-rollouts/client.test.ts src/platform-build-rollouts/commands.test.ts src/platform-build-job-replans/client.test.ts src/platform-build-job-replans/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/integration-bootstrap/client.test.ts src/integration-bootstrap/commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs",
     "pack:check": "turbo run pack:check root:pack:check",
     "root:pack:check": "node scripts/check-root-package.mjs",
     "boundaries": "node scripts/check-workspace-boundaries.mjs",
@@ -55,8 +55,8 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@numa-tech/cli-auth": "1.14.7",
-    "@tokensrc/codex": "1.14.7",
+    "@numa-tech/cli-auth": "1.14.9",
+    "@tokensrc/codex": "1.14.9",
     "commander": "^14.0.3",
     "ink": "^6.8.0",
     "open": "^10.2.0",

package/skills/numa-cli/SKILL.md

@@ -26,7 +26,8 @@ Never read or print token caches, inject a raw Bearer token, request Jenkins/Nac
 
 ## Route by capability
 
-- For application publishing, production deployment, Jenkins Pipeline build/status/log/stop/retry, idempotency, rollout order, or release recovery, read [pipeline-release.md](references/pipeline-release.md) completely before acting.
+- When the user explicitly requires a local image build and direct Flux release because the governed pipeline is unavailable, use the dedicated `$numa-local-flux-deploy` Skill instead of this Skill's pipeline path. Do not infer that fallback merely from a pipeline error.
+- For other application publishing, production deployment, Jenkins Pipeline build/status/log/stop/retry, idempotency, rollout order, or release recovery, read [pipeline-release.md](references/pipeline-release.md) completely before acting.
 - For `numa registry`, Nacos Skills/MCP, namespace routing, Registry approval, or enterprise Router work, use the dedicated `$numa-ai-registry` Skill when it is available. Otherwise inspect `numa registry capabilities --json` and command help before every write.
 - For application onboarding and SCM, inspect `numa app --help`, `numa app scm --help`, and the corresponding entries in `numa commands --json`; preserve server-owned session state and optimistic-lock revisions.
 - For Codex, media, configuration, identity, or admin modules, use the command catalog plus exact subcommand help. Do not invent missing behavior. Add a focused reference module to this Skill when that workflow becomes repetitive or safety-critical.

package/skills/numa-cli/references/pipeline-release.md

@@ -2,6 +2,8 @@
 
 Read this file completely before planning or executing an application release with `numa pipeline`.
 
+This is the normal governed release path. If the user explicitly authorizes a local image build and direct Flux release because the pipeline is unavailable, stop using this specification and use `$numa-local-flux-deploy`. A pipeline failure alone does not authorize that fallback.
+
 ## Source of truth
 
 Use direct Numa CLI commands. Do not create or invoke a repository-specific deployment wrapper. Resolve release policy in this order:

package/skills/numa-local-flux-deploy/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: numa-local-flux-deploy
+description: Build and deploy an existing Numa application locally through its image registry and Flux Git repository when the governed Jenkins/Numa pipeline is unavailable and the user explicitly authorizes the fallback. Use for local production image builds, direct Flux image-tag releases, rollout recovery, or an accompanying Numa CLI npm release; do not use as the default path while the normal pipeline is usable.
+---
+
+# Numa Local Flux Deploy
+
+Use this as a controlled fallback, not as a silent replacement for the governed pipeline. The user must explicitly authorize the resolved application and environment and state that the pipeline is unavailable or that local deployment is required.
+
+Read [local-flux-release.md](references/local-flux-release.md) completely before inspecting credentials, building an image, changing Flux, reconciling a cluster, or publishing npm packages.
+
+## Preserve the deployment boundary
+
+- Resolve the exact source repository, remote commit, application, environment, namespace, workload, image repository, Flux values file, cluster context, and health endpoint from version-controlled or live read-only evidence. Do not guess any of them.
+- Use an isolated clean Git worktree for both source and Flux changes. The preferred Flux repository is `~/mci/mci-flux`; never overwrite, stash, clean, or build from unrelated changes in its primary worktree.
+- Never read registry auth files, kubeconfig contents, application secrets, token caches, or `secrets/**`. Check only whether the required authenticated tools can operate.
+- Do not modify Keycloak, database data, unrelated Flux resources, or a live Deployment unless the user separately placed that target in scope.
+- A local interruption or registry/network error creates an unknown result. Inspect the existing image tag, Git ref, Flux revision, and workload before any retry. Reuse the exact operation identity; never create a second release to escape uncertainty.
+
+## Finish with evidence
+
+Do not call the release successful until GitOps has applied the exact Flux commit, the controller and workload are healthy on the exact image tag, the application readiness check passes, and any optional npm release has passed candidate smoke testing before promotion to `latest`.
+
+Report the source commit, image tag and digest, Flux commit/revision, cluster context, controller/workload status, health results, npm version/tags when applicable, and whether Jenkins or Keycloak were touched.

package/skills/numa-local-flux-deploy/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Numa Local Flux Deploy"
+  short_description: "Fallback local image builds and Flux releases"
+  default_prompt: "Use $numa-local-flux-deploy to perform a controlled local image and Flux deployment when the normal pipeline is unavailable."

package/skills/numa-local-flux-deploy/evals/evals.json

@@ -0,0 +1,35 @@
+{
+  "skill_name": "numa-local-flux-deploy",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "Jenkins 还不能用，已授权把 code-index 当前 master 本地构建后发布到 prd；Flux 仓库在 ~/mci/mci-flux。",
+      "expected_output": "The agent resolves the exact source commit and production workload, uses isolated source and Flux worktrees, pushes one immutable image, changes only the Flux image tag, reconciles the exact Git revision, and verifies workload and application health.",
+      "expectations": [
+        "Uses ~/mci/mci-flux through an isolated worktree and preserves any dirty primary worktree.",
+        "Does not update Flux until the registry push has a confirmed remote result.",
+        "Does not mutate Keycloak, secrets, or the live Deployment directly."
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "本地 push 镜像时返回 EOF，不管了，换一个 tag 直接改 Flux 继续上线。",
+      "expected_output": "The agent treats the push as unknown, resolves the existing remote manifest, and retries only the identical image/tag/digest through an approved hostname or stops without changing Flux.",
+      "expectations": [
+        "Does not create a new tag to escape the unknown result.",
+        "Does not change the Flux environment branch before remote image evidence is confirmed.",
+        "Reports IMAGE_PUSH_UNKNOWN when the registry cannot establish the result."
+      ]
+    },
+    {
+      "id": 3,
+      "prompt": "后端已经通过本地 Flux 发布，把同批 Numa CLI 也立刻发到 npm latest。",
+      "expected_output": "The agent uses the repository lockstep release flow, publishes candidate first, tests the registry artifact against the healthy backend, and only then promotes all three packages to latest.",
+      "expectations": [
+        "Runs the release dry-run and candidate workflow from a clean upstream-equal worktree.",
+        "Tests @numa-tech/numa@candidate rather than relying on local output.",
+        "Promotes cli-auth, codex, and numa lockstep and verifies their dist-tags."
+      ]
+    }
+  ]
+}

package/skills/numa-local-flux-deploy/references/local-flux-release.md

@@ -0,0 +1,172 @@
+# Local image and Flux release runbook
+
+Use this runbook only after the user authorizes the exact deployment and the normal Jenkins/Numa pipeline is unavailable or explicitly excluded. Keep the pipeline failure evidence in the handoff, but do not repeatedly probe or trigger it once the fallback is selected.
+
+## 1. Resolve and freeze the release identity
+
+Collect these values from repository and live read-only evidence:
+
+- source repository and clean remote commit;
+- application code and immutable image tag convention;
+- environment branch, Kubernetes context, namespace, Deployment/HelmRelease, and health endpoints;
+- registry repository used by Flux and the authenticated external registry hostname used by the local builder;
+- exact Flux overlay and values file that owns the image tag.
+
+The default Flux repository is `~/mci/mci-flux`. If it is absent, stop unless the user or repository documentation supplies another path. A cluster may pull through an internal/VPC CNAME while the builder pushes through an external CNAME; accept that only when existing configuration or the user confirms both names address the same registry repository. Do not change the Flux repository hostname just to match a local login.
+
+Before mutation:
+
+1. Verify the source `HEAD` equals its intended remote ref and the worktree is clean. If the user's primary worktree is dirty, create an isolated worktree at the exact remote commit; do not stash or discard anything.
+2. Fetch the Flux environment branch and create an isolated worktree from `origin/<environment>`. Never edit the primary Flux worktree in place.
+3. Inspect only the relevant non-secret base/overlay files. Do not print or open `secrets/**`.
+4. Run `kubectl config current-context` and read the current workload image/readiness. Stop if the context, namespace, or workload differs from the resolved plan.
+5. Confirm registry access with a command such as `podman login --get-login <host>`. Never read or print the container auth file.
+
+Recommended isolated Flux setup, with task-specific variable names:
+
+```bash
+DEPLOY_FLUX_REPO=~/mci/mci-flux
+DEPLOY_ENV=prd
+DEPLOY_AUDIT_BRANCH=codex/APPLICATION-SHORTSHA-deploy
+DEPLOY_FLUX_WORKTREE=$(mktemp -d /private/tmp/mci-flux-deploy.XXXXXX)
+
+git -C "$DEPLOY_FLUX_REPO" fetch origin "$DEPLOY_ENV"
+git -C "$DEPLOY_FLUX_REPO" worktree add \
+  -b "$DEPLOY_AUDIT_BRANCH" \
+  "$DEPLOY_FLUX_WORKTREE/repo" \
+  "origin/$DEPLOY_ENV"
+```
+
+If the audit branch already exists, resolve its state rather than deleting or overwriting it.
+
+## 2. Build and publish one immutable image
+
+Derive the target platform from the current production workload or deployment policy. Do not assume `linux/amd64` for every application; it is the common code-index production platform and must still be verified.
+
+Use an immutable tag containing at least the source short SHA and environment. Follow the repository's existing convention, for example:
+
+```text
+YYYYMMDD-<short-sha>-amd64-prd
+```
+
+Never reuse an existing tag for different content. Build from the clean isolated source worktree:
+
+```bash
+DEPLOY_PLATFORM=linux/amd64 # replace only with the platform proven above
+DEPLOY_IMAGE="APPROVED_EXTERNAL_REGISTRY/REPOSITORY:IMMUTABLE_TAG"
+
+podman build --platform "$DEPLOY_PLATFORM" --pull=always \
+  -t "$DEPLOY_IMAGE" .
+```
+
+Inspect the local image architecture and ID, then push with bounded transport retries:
+
+```bash
+podman image inspect "$DEPLOY_IMAGE" --format '{{.Architecture}} {{.Os}} {{.Id}}'
+podman push --retry=5 --retry-delay=5s "$DEPLOY_IMAGE"
+```
+
+Record a registry-confirmed RepoDigest or equivalent remote-manifest evidence. Do not update Flux when the push is failed or unknown. A transport error such as `EOF` permits only an idempotent retry of the same local image/tag/digest through an already-approved hostname for the same registry. If remote evidence cannot distinguish success from failure, stop and report `IMAGE_PUSH_UNKNOWN`.
+
+## 3. Change only the Flux-owned image version
+
+Update only the image tag field in the exact application values file. Preserve the repository hostname, environment, secrets, and all unrelated manifests. Use `apply_patch`, then require:
+
+```bash
+DEPLOY_VALUES_FILE=apps/overlays/prd/values-APPLICATION.yaml
+
+git diff --check
+git diff -- "$DEPLOY_VALUES_FILE"
+kubectl kustomize "apps/overlays/$DEPLOY_ENV" >/dev/null
+git status --short
+```
+
+The diff must contain only the intended application image version unless the user separately approved more changes.
+
+Fetch `origin/<environment>` again immediately before committing. If it advanced, rebase or recreate the isolated change and re-run validation; never force-push. Commit a traceable deployment message, then atomically push an audit branch and the environment branch when the remote supports it:
+
+```bash
+git push --atomic origin \
+  "HEAD:refs/heads/$DEPLOY_AUDIT_BRANCH" \
+  "HEAD:refs/heads/$DEPLOY_ENV"
+```
+
+If push output is interrupted or unknown, inspect remote refs before retrying. Do not generate a second commit or tag until the first result is resolved.
+
+## 4. Reconcile through Flux and observe the rollout
+
+After the Git push is confirmed, verify the Flux GitRepository has fetched the exact environment commit. Request reconciliation by annotating the owning Flux Kustomization; do not use `kubectl set image`, edit the Deployment, or apply rendered manifests directly.
+
+```bash
+DEPLOY_FLUX_KUSTOMIZATION="RESOLVED_ENVIRONMENT_KUSTOMIZATION"
+DEPLOY_RECONCILE_REQUEST="YYYY-MM-DDTHH:MM:SSZ"
+
+kubectl -n flux-system annotate kustomization "$DEPLOY_FLUX_KUSTOMIZATION" \
+  reconcile.fluxcd.io/requestedAt="$DEPLOY_RECONCILE_REQUEST" --overwrite
+kubectl -n flux-system wait "kustomization/$DEPLOY_FLUX_KUSTOMIZATION" \
+  --for=condition=ready --timeout=120s
+```
+
+Then verify all of the following:
+
+- Kustomization `lastAppliedRevision` equals the pushed Flux commit and both Ready/Healthy conditions are true;
+- the application HelmRelease or equivalent controller reports successful reconciliation;
+- the Deployment template references the exact new tag and the observed generation matches;
+- the new Pod is ready with zero unexpected restarts and its image ID is recorded;
+- `kubectl rollout status` succeeds within a bounded timeout;
+- public or internal readiness and liveness endpoints return the expected success status.
+
+A `Recreate` strategy may temporarily show zero ready Pods; treat that as an expected transition only inside the approved timeout. If the rollout fails, inspect controller conditions, Pod events, and sanitized logs. Do not automatically roll back. A rollback is a separately authorized revert of the Flux commit followed by the same validation and reconciliation process.
+
+## 5. Recover ambiguous stages without duplicating work
+
+Use the original identity at every stage:
+
+| Unknown stage | Read-only authority | Safe continuation |
+| --- | --- | --- |
+| image push | registry manifest/tag/digest | retry only the identical image/tag/digest after proving no conflicting manifest |
+| Flux Git push | remote environment and audit refs | retry the identical ref update only when the first update is absent |
+| Flux reconciliation | GitRepository/Kustomization revision and conditions | continue observing or request reconciliation for the same commit |
+| workload rollout | controller revision, Deployment generation, Pod image ID | continue observing the same rollout; do not create a new release |
+| health check | workload readiness plus bounded endpoint checks | diagnose the deployed revision; do not infer rollback or success from one timeout |
+
+Never hide an unknown result by choosing a new image tag, commit, or audit branch.
+
+## 6. Optionally publish the Numa CLI after the backend is healthy
+
+Run this section only when the same release contains a Numa CLI change and the user authorized public npm publication. Backend and migrations must already be healthy so the candidate can exercise the real server contract.
+
+Use a clean Numa worktree whose `HEAD` equals its upstream. Confirm public npm identity without reading npm credentials, then follow the repository's lockstep release script:
+
+```bash
+npm whoami --registry=https://registry.npmjs.org/
+npm run release -- patch --dry-run
+npm run release -- patch --tag=candidate
+```
+
+The release script must run typecheck, tests, build, pack checks, publish the three lockstep packages in dependency order, and push the release commit/tag. Test the registry artifact rather than the local build:
+
+```bash
+npx -y --prefer-online --registry=https://registry.npmjs.org/ \
+  @numa-tech/numa@candidate --version
+```
+
+Run one authorized production smoke command suitable for the feature. For a Codex passive access-observation change, `codex list` is appropriate because it checks local AT timing and reports safe metadata without calling OpenAI or using an RT. Promote only after the candidate succeeds:
+
+```bash
+DEPLOY_NUMA_VERSION="X.Y.Z"
+npm run release:promote -- "$DEPLOY_NUMA_VERSION" --from-tag=candidate
+```
+
+Verify `latest` for `@numa-tech/cli-auth`, `@tokensrc/codex`, and `@numa-tech/numa`, install `@numa-tech/numa@latest`, and confirm the Git release commit, annotated tag, upstream equality, and clean worktree.
+
+## 7. Handoff evidence
+
+Report, without credentials or secret values:
+
+- pipeline fallback reason and confirmation that no Jenkins build was created or left running;
+- source commit, image tag, registry digest, Flux commit, environment revision, and cluster context;
+- controller, Deployment, Pod restart, readiness/liveness, and migration results;
+- npm release commit/tag, package version, and all dist-tags when applicable;
+- any unknown stage still unresolved;
+- confirmation that Keycloak and unrelated resources were not modified.