@numa-tech/numa 1.20.0 → 1.20.1

package/dist/platform-profile.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { z } from "zod";
-import { appConfigDirectory, loadAppConfig } from "./app-config.js";
+import { appConfigDirectory, appConfigPath, loadAppConfig, saveAppConfig } from "./app-config.js";
 import { PACKAGE_VERSION } from "./branding.js";
 import { SkillBootstrapSchema } from "./ai-registry/bootstrap-settings.js";
 const AuthoritySchema = z.object({
@@ -44,6 +44,13 @@ const ProfileSchema = z.object({
     tenant: z.object({ id: z.string().min(1), headerName: z.string().min(1) }),
     authorities: z.record(z.string(), AuthoritySchema),
     services: z.record(z.string(), z.union([ServiceSchema, EmptyServiceSchema])),
+    authentication: z.object({
+        platformAuthority: z.string().min(1),
+        businessDefaultAuthority: z.string().min(1),
+        businessIssuers: z.record(z.string(), z.string().min(1)),
+        businessServices: z.array(z.literal("oss")).min(1),
+        settingsVersion: z.number().int().positive()
+    }).optional(),
     cache: z.object({ maxAgeSeconds: z.number().int().positive().max(86_400) }).default({ maxAgeSeconds: 300 }),
     minimumClientVersions: z.record(z.string(), z.string()).optional()
 });
@@ -63,7 +70,22 @@ export function currentPlatformProfile() {
 export function setPlatformProfileForTests(profile) {
     activeProfile = profile;
 }
+export class ProfileMismatchError extends Error {
+    replacement;
+    code = "profile_id_mismatch";
+    recoveryCommand;
+    constructor(replacement) {
+        const quote = (value) => "'" + value.replaceAll("'", "'\\''") + "'";
+        const recovery = `numa config --set ${quote(`profileUrl=${replacement.candidate.sourceUrl}`)} ${quote(`profileId=${replacement.candidate.profileId}`)}`;
+        super(`profileId 不匹配：期望 ${JSON.stringify(replacement.expectedId)}，收到 ${JSON.stringify(replacement.candidate.profileId)}。` +
+            `未切换当前配置。确认目标后运行 ${recovery}，或在交互式终端重新运行以确认替换 Profile。`);
+        this.replacement = replacement;
+        this.name = "ProfileMismatchError";
+        this.recoveryCommand = recovery;
+    }
+}
 export async function initializePlatformProfile(options = {}) {
+    activeProfile = undefined;
     const appConfig = await loadAppConfig();
     const sourceUrl = process.env.NUMA_PROFILE_URL?.trim() || appConfig.profileUrl.trim();
     if (!sourceUrl) {
@@ -72,7 +94,15 @@ export async function initializePlatformProfile(options = {}) {
     }
     const candidate = await resolvePlatformProfile(sourceUrl, options);
     if (appConfig.profileId && candidate.profileId !== appConfig.profileId) {
-        throw new Error(`profileId 不匹配：期望 ${appConfig.profileId}，收到 ${candidate.profileId}`);
+        const replacement = { expectedId: appConfig.profileId, previousUrl: appConfig.profileUrl, candidate, configFile: appConfigPath() };
+        if (!options.confirmReplacement || !await options.confirmReplacement(replacement)) {
+            throw new ProfileMismatchError(replacement);
+        }
+        const latest = await loadAppConfig();
+        if (latest.profileId !== appConfig.profileId || latest.profileUrl !== appConfig.profileUrl) {
+            throw new Error("确认期间 Profile 配置已被其他操作修改，请重新运行后确认。");
+        }
+        await saveAppConfig({ ...latest, profileId: candidate.profileId, profileUrl: sourceUrl });
     }
     activeProfile = candidate;
     return activeProfile;
@@ -130,6 +160,23 @@ function validateProfile(raw) {
         if (!profile.authorities[parsedService.data.authority])
             throw new Error(`服务 ${key} 引用了未知 authority`);
     }
+    const auth = profile.authentication;
+    if (auth) {
+        const platform = ServiceSchema.parse(profile.services.platform);
+        if (platform.authority !== auth.platformAuthority || !profile.authorities[auth.platformAuthority])
+            throw new Error("Profile platform authority does not match fixed platform authentication");
+        if (!Object.values(auth.businessIssuers).includes(auth.businessDefaultAuthority))
+            throw new Error("Profile business default issuer is not available");
+        for (const key of Object.values(auth.businessIssuers)) {
+            if (!profile.authorities[key])
+                throw new Error("Profile business issuer references unknown authority");
+        }
+        for (const key of auth.businessServices) {
+            const service = ServiceSchema.parse(profile.services[key]);
+            if (service.authority !== auth.businessDefaultAuthority)
+                throw new Error("Business service authority must match the business default");
+        }
+    }
     return profile;
 }
 function compareVersions(left, right) {
@@ -145,14 +192,28 @@ function compareVersions(left, right) {
 function resolved(profile, sourceUrl, stale) {
     return { ...profile, sourceUrl, stale };
 }
-export function requireProfileService(key) {
-    if (!activeProfile)
+export function requireProfileService(key, issuer) {
+    if (issuer && key !== "oss")
+        throw new Error("--issuer 仅适用于业务服务；平台管理 issuer 固定。");
+    if (!activeProfile) {
+        if (issuer)
+            throw new Error("--issuer 需要包含业务身份源配置的 Profile。");
         return undefined;
-    const candidate = activeProfile.services[key];
+    }
+    const auth = activeProfile.authentication;
+    if (issuer && !auth)
+        throw new Error(`当前 Profile ${activeProfile.profileId}（revision ${activeProfile.revision}，来源 ${activeProfile.sourceUrl}）未下发可选业务 issuer。` +
+            "请确认 Profile 来源；本地构建仍默认读取全局配置。本地 MVP 请使用 scripts/mvp-cli.sh，其他环境需发布包含业务身份源的新 Profile。");
+    const candidate = activeProfile.services[key] ?? (key === "oss" && !auth ? activeProfile.services.platform : undefined);
     const service = ServiceSchema.safeParse(candidate);
     if (!service.success)
         throw new ModuleUnavailableError(key);
-    const authority = activeProfile.authorities[service.data.authority];
+    const selectedKey = key === "oss" && auth
+        ? issuer ? Object.hasOwn(auth.businessIssuers, issuer) ? auth.businessIssuers[issuer] : undefined : auth.businessDefaultAuthority
+        : service.data.authority;
+    if (!selectedKey)
+        throw new Error("指定的业务 issuer 不在当前 Profile 可选列表中。");
+    const authority = activeProfile.authorities[selectedKey];
     if (!authority)
         throw new Error(`服务 ${key} 引用了未知 authority`);
     return { profile: activeProfile, service: service.data, authority };

package/dist/platform-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-profile.js","sourceRoot":"","sources":["../src/platform-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAE3E,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjD,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;QAC/C,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC/C,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC;YAC/B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC5C,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC1C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACrD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC7C,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC,WAAW,EAAE,CAAC;AACjB,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACjE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAC1C,6DAA6D,CAC9D,CAAC;AACF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;IAC3G,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAiBH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE1B,UAAU;IADtB,IAAI,GAAG,oBAAoB,CAAC;IACrC,YAAqB,UAAkB;QACrC,KAAK,CAAC,kBAAkB,UAAU,MAAM,CAAC,CAAC;0BADvB,UAAU;QAE7B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,IAAI,aAAkD,CAAC;AAEvD,MAAM,UAAU,sBAAsB;IACpC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAA4C;IACrF,aAAa,GAAG,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAO,GAInD,EAAE;IACJ,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACtF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,aAAa,GAAG,SAAS,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,CAAC,SAAS,OAAO,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,aAAa,GAAG,SAAS,CAAC;IAC1B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB,EAAE,OAAO,GAKnE,EAAE;IACJ,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,kBAAkB,EAAE,EAC9D,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,IAAI,MAAM,IAAI,aAAa,EAAE,OAAO;WAC/B,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,KAAK,EAAE,CAAC;QAC7E,OAAO,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,SAAS,EAAE;YACzD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAClG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,GAAY,CAAC;QACjB,IAAI,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;QACxB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM;YAAE,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;aACvD,CAAC;YACJ,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7D,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QACnD,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,aAAa,EAAE,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,aAAa,CAAC,IAAI,CAAC,SAAS;eAC1E,MAAM,CAAC,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACvH,OAAO,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,OAAO,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM;YAAE,MAAM,KAAK,CAAC;QACjG,OAAO,CAAC,IAAI,EAAE,CAAC,4CAA4C,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC;IAC3D,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,eAAe,CAAC,eAAe,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,qBAAqB,cAAc,QAAQ,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,OAAO;YAAE,SAAS;QACrC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,KAAK,CAAE,KAAK,CAAC,CAAC,KAAK,CAAE;YAAE,OAAO,CAAC,CAAC,KAAK,CAAE,GAAG,CAAC,CAAC,KAAK,CAAE,CAAC;IAC5D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,OAAoB,EAAE,SAAiB,EAAE,KAAc;IACvE,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAuB;IAK3D,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,SAAiB;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAwB,CAAC;QAC9E,OAAO,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACtG,CAAC,CAAC,KAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAc;IAC1D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC/C,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}
+{"version":3,"file":"platform-profile.js","sourceRoot":"","sources":["../src/platform-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAE3E,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjD,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;QAC/C,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC/C,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC;YAC/B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC5C,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC1C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACrD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC7C,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC,WAAW,EAAE,CAAC;AACjB,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACjE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAC1C,6DAA6D,CAC9D,CAAC;AACF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5E,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC7C,CAAC,CAAC,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;IAC3G,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAiBH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE1B,UAAU;IADtB,IAAI,GAAG,oBAAoB,CAAC;IACrC,YAAqB,UAAkB;QACrC,KAAK,CAAC,kBAAkB,UAAU,MAAM,CAAC,CAAC;0BADvB,UAAU;QAE7B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,IAAI,aAAkD,CAAC;AAEvD,MAAM,UAAU,sBAAsB;IACpC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAA4C;IACrF,aAAa,GAAG,OAAO,CAAC;AAC1B,CAAC;AASD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAGxB,WAAW;IAFvB,IAAI,GAAG,qBAAqB,CAAC;IAC7B,eAAe,CAAS;IACjC,YAAqB,WAA+B;QAClD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;QAC5E,MAAM,QAAQ,GAAG,qBAAqB,KAAK,CAAC,cAAc,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,KAAK,CAAC,aAAa,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QACxJ,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG;YACvH,mBAAmB,QAAQ,4BAA4B,CAAC,CAAC;2BAJxC,WAAW;QAK9B,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;IAClC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAO,GAKnD,EAAE;IACJ,aAAa,GAAG,SAAS,CAAC;IAC1B,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACtF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,aAAa,GAAG,SAAS,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;QACvE,MAAM,WAAW,GAAG,EAAC,UAAU,EAAE,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,EAAC,CAAC;QACjI,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,MAAM,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,aAAa,CAAC,EAAC,GAAG,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAC,CAAC,CAAC;IAC1F,CAAC;IACD,aAAa,GAAG,SAAS,CAAC;IAC1B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB,EAAE,OAAO,GAKnE,EAAE;IACJ,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,kBAAkB,EAAE,EAC9D,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,IAAI,MAAM,IAAI,aAAa,EAAE,OAAO;WAC/B,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,KAAK,EAAE,CAAC;QAC7E,OAAO,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,SAAS,EAAE;YACzD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAClG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,GAAY,CAAC;QACjB,IAAI,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;QACxB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM;YAAE,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;aACvD,CAAC;YACJ,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7D,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QACnD,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,aAAa,EAAE,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,aAAa,CAAC,IAAI,CAAC,SAAS;eAC1E,MAAM,CAAC,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACvH,OAAO,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,OAAO,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM;YAAE,MAAM,KAAK,CAAC;QACjG,OAAO,CAAC,IAAI,EAAE,CAAC,4CAA4C,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC;IAC3D,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,eAAe,CAAC,eAAe,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,qBAAqB,cAAc,QAAQ,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,OAAO;YAAE,SAAS;QACrC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC;IACpC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACzG,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3D,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,wBAAwB;gBACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,KAAK,CAAE,KAAK,CAAC,CAAC,KAAK,CAAE;YAAE,OAAO,CAAC,CAAC,KAAK,CAAE,GAAG,CAAC,CAAC,KAAK,CAAE,CAAC;IAC5D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,OAAoB,EAAE,SAAiB,EAAE,KAAc;IACvE,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAuB,EAAE,MAAe;IAK5E,IAAI,MAAM,IAAI,GAAG,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,cAAc,CAAC;IAC1C,IAAI,MAAM,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAClC,cAAc,aAAa,CAAC,SAAS,aAAa,aAAa,CAAC,QAAQ,OAAO,aAAa,CAAC,SAAS,kBAAkB;YACxH,sFAAsF,CACvF,CAAC;IACF,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxH,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,GAAG,KAAK,KAAK,IAAI,IAAI;QACvC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB;QACjI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;IAC3B,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,SAAiB;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAwB,CAAC;QAC9E,OAAO,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACtG,CAAC,CAAC,KAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAc;IAC1D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC/C,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/docs/application-default-groups.md

@@ -0,0 +1,73 @@
+# 应用默认组与 CLI
+
+这些命令需要部署支持应用受管组 API 的 DevOps 后端；安装旧 CLI 或旧后端不会自动具备该能力。不会修改 Keycloak realm 的 Default roles / Default groups。
+
+## 普通用户
+
+```sh
+numa login --no-console --no-config
+numa authorization enrollment status --json
+```
+
+用户完成 `numa login`、本地网页控制台登录或 MCP `numa_auth_complete_login` 并保存本机会话后，会显式调用 `POST /api/v1/me/enrollment`。服务端根据可信登录 Client 的默认组策略同步成员。机器身份不参加人员自动入组；组黑名单以及历史 SUSPENDED / REVOKED 限制不会因登录被重新激活。登录过程固定使用发起时的配置，核对回调和当前会话 subject，不把其他登录 Client 或服务的缓存当作本次身份。
+
+`numa auth status`、profile、命令列表和 `authorization enrollment status` 不触发入组。已有会话可显式初始化，不必人工查询 subject：
+
+```sh
+numa authorization enrollment initialize --json
+```
+
+登录成功和默认组同步是不同结果。同步失败/未知/待处理不会伪报已授权；黑名单显示 BLOCKED，策略未启用显示 DISABLED。组同步完成后，按服务端 `tokenRefreshRequired` 最多强制刷新本会话一次，再通过 GET enrollment 只读回读。只在 Client、组、策略版本一致，且服务端确认当前令牌已满足角色要求时返回 READY。新后端提供 `expectedClientRoles` 时还按精确 Client 校验动态角色；兼容旧后端回读契约，不依赖三个固定角色。
+
+默认组角色由平台管理，不预设为 Notion、Skills、OSS 三个名称。READY 只证明入组及当前会话核验完成，不证明每项业务均有权限；仍需要有效 API 角色功能授权、Notion 内容 Grant、OSS Grant 和 Skills namespace 策略。CLI 不自动恢复停用角色、给组增加角色或修改空间策略。
+
+## 管理员：应用草稿与统一发布
+
+管理命令统一为 `numa authorization application --app <positive-id>`，要求平台 Client Role `mci-devops-platform-ops-admin`。只读目录不创建用户；没有用户密码或账户管理命令。所有 JSON 输出为 `{ok:true,data:...}`，保留服务端字段和分页事实；分页使用 `--page`、`--size`（1–100）及可用时的 `--query`，不自动抓取全部数据。
+
+生产操作前用 `numa auth status --json` 和 `numa config --show` 确认 PRD。固定生产前端 `https://mci-devops-platform.mcisaas.com`，issuer `https://kc.mcisaas.com/auth/realms/numa-realm`，浏览器 Client `web-client`，CLI Client `mcp-client`，角色 Client `mci-devops-platform`，API `https://apps-gw-prd.mcisaas.com/mci-devops-platform`。应用的 `--env` 选择已登记的精确身份源；不能传任意 issuer URL，也不能借用浏览器会话。
+
+```sh
+numa authorization application --app 42 identity sources --json
+numa authorization application --app 42 definition show --json
+numa authorization application --app 42 definition save --file definition.json --yes --json
+numa authorization application --app 42 definition freeze --expected-draft-version 3 --yes --json
+numa authorization application --app 42 environment list --page 1 --size 20 --json
+numa authorization application --app 42 identity directory users --env <env-uuid> --query name@example.com --json
+numa authorization application --app 42 identity client show <reference-uuid> --env <env-uuid> --json
+numa authorization application --app 42 identity group registered <definition-uuid> --env <env-uuid> --json
+numa authorization application --app 42 identity group blacklist <reference-uuid> --env <env-uuid> --instance <instance-uuid> --json
+numa authorization application --app 42 identity relations save --env <env-uuid> --file relations.json --yes --json
+numa authorization application --app 42 publication plan --file plan.json --yes --json
+numa authorization application --app 42 publication prepare <job-uuid> --expected-version 0 --expected-digest <reviewed-plan-digest> --expected-step-digest <reviewed-step-digest> --yes --json
+numa authorization application --app 42 publication apply <job-uuid> --expected-version 1 --expected-digest <reviewed-plan-digest> --expected-step-digest <reviewed-step-digest> --yes --json
+```
+
+文件只能包含对应 API 字段，不能把 app/env/file/yes 等控制参数塞入 body。定义保存 `{expectedDraftVersion,defaultRoleClientId,definition}`，完整保留 functions、业务授权、PAGE/API 等文档字段。Client/Group create/save 文件要求 mode、environmentId、全部四个 expected*Version 和对应的配置/需求字段；版本 0 表示实体不存在，不能用作忽略冲突。环境 create/update 保存平台配置，create 的 version 必须是 0。
+
+relations 文件为 `{expectedRevision,changes}`。支持 ROLE_GRANT、GROUP_MEMBER、GROUP_BLOCK、BLOCK_SOURCE_RELEASE；USER 使用目录返回的稳定 subjectId，SERVICE_ACCOUNT 使用 clientInstanceId。GROUP_BLOCK ABSENT 仅撤销本应用的阻断贡献。释放历史来源必须独立提交 BLOCK_SOURCE_RELEASE、USER、ABSENT、subjectId、groupInstanceId、releaseSource（ADMIN_BLOCK 或 LEGACY_REMOVE）、expectedBlockVersion 及 scoped blacklist 返回的 expectedBlockGeneration；不会移除其他来源阻断。
+
+LOGIN Client 的 enrollmentTrusted 和 expectedEnrollmentTrustVersion 必须同时填写；这是待发布意图，实际 admission 要等统一发布的激活与验证，不能把草稿当作已生效。共享定义的 configurationReadOnly 与精确 registered hydration 必须遵守，不把目录远端配置自动写回共享定义。
+
+plan 文件为 `{requestId,definitionVersion,environmentIds,clientModes?}`，requestId 是新 UUID，clientModes 按 instance UUID 映射 CREATE/ADOPT/UPDATE/REPAIR。每次 prepare/apply 都只执行一个阶段，确认必须来自同一 reviewed response，不自动拉取新版本接受冲突。UNKNOWN 时显式 recheck，保留协作问题、receipt、历史、allowedActions 和 finalization；需要继续时另行确认 apply。terminate/cancel 不是回滚，repreview 需要新的 requestId，没有 resume/force 命令。
+
+完整命令可通过 `numa authorization application --app 42 --help` 和 `numa commands --json` 查看。registered、versions、history、members、blacklist、catalog、subject-access 均为当前应用/来源限定的只读视图；不使用旧 registry HTTP 路径。网关绑定历史使用 `gateway-binding history <binding-uuid>`，环境历史使用 `environment runs <env-uuid>`。
+
+## 凭证只写入文件
+
+```sh
+numa authorization application --app 42 credential target --env <env-uuid> --reference <ref-uuid> --instance <instance-uuid> --json
+numa authorization application --app 42 credential download --env <env-uuid> --reference <ref-uuid> --instance <instance-uuid> --request-id <new-uuid> --expected-instance-version 3 --expected-context-digest <reviewed-digest> --output ./credential.json --yes --json
+```
+
+rotate 还需完整 `--confirm-client-id` 与 `--acknowledge-impact`。必须显式提供新的 `--output` 文件，拒绝 stdout 和覆盖已有文件；先排他创建 0600 文件，再发送一次请求，只在附件完整落盘后输出 requestId/outputPath。Secret 不进入 JSON、日志或异常。全部写请求包括 recheck 和附件都禁止 401 刷新重放、重定向及自动重试；本地写盘失败也不能重领同一个请求。
+
+轮换 A UNKNOWN 后，使用新请求下载 B 恢复当前凭证，再以新请求进行明确轮换 C；不需要等待 A 父作业 ACK。operation/recheck 仅查事实，不重新领取附件。operationRecovered 仅表示历史恢复证据，不代表当前目标凭证 READY。CREDENTIAL_ROTATION 是单阶段窄作业，与完整 IDENTITY_PUBLICATION 图分别解码。
+
+## 破坏性升级与发布
+
+旧 `authorization role list/create/provision/provisioning-run` 和 `authorization group list/members/users/directory/plan/status/items/impact/apply` 已删除，没有兼容 alias 或旧 HTTP fallback。enrollment、access-request、bootstrap 和独立业务 API 保留。使用既有 lockstep release 流程同时发布工作区包；不能只单独升级一个包。发布前执行 `npm run build` 和 `npm run check`，包括打包边界与编译后 enrollment 烟测。本文不表示已经发布或完成运行时验收。
+
+Skills/MCP 业务新路径为 `/api/v1/skills`；实例管理和 namespace 写操作为 `/api/v1/admin/nacos/registry`。CLI 不在 401/403 或写超时后退回旧路径重发。发布顺序为：后端兼容 alias 和新路径 → 网关方法映射及权限发布 → CLI 包发布。旧 CLI 继续使用后端保留的 `/api/v1/ai-registry` alias；服务 profile 中的显式 capabilityUrl 仍予以兼容。
+
+Codex 模块自己的登录使用独立服务 audience 与 token cache，不把该服务令牌转发给 DevOps enrollment；其应用入组应在该服务的可信登录回调完成。这里的自动入组只使用当前明确的 DevOps API 配置。

package/examples/cloud-bootstrap/README.md

@@ -3,7 +3,7 @@
 发布包入口为 `npx -y @numa-tech/numa@latest`，下文用 `numa` 简写。
 
 ```sh
-numa login --no-console
+numa login --platform --no-console
 numa cloud bootstrap run --account-uid 1960540977999327
 ```
 

package/examples/mcp/README.md

@@ -0,0 +1,108 @@
+# Numa MCP：管理、测试调用与本地代理
+
+使用本仓库构建产物，无需安装或发布 npm：
+
+```sh
+npm run root:build
+node dist/cli.js registry capabilities --json
+node dist/cli.js mcp --help
+```
+
+MCP 注册管理与 Skills 共用 `aiRegistry` profile 服务、Keycloak 登录缓存、namespace 选择和平台 API `/api/v1/skills`。namespace 优先级仍为命令参数、项目 `.numa/registry.json`、用户默认值、profile 默认值。同名 namespace 使用 `--instance` 消歧。Nacos 管理凭据始终保留在平台。
+
+## 管理注册记录
+
+下面的 `team-ai` 是占位 namespace，需要替换成 capabilities 中当前身份可见的 namespace。`server.json` 为本地、禁用的示例定义；提交前修改名称与实际服务地址。文件使用平台请求 envelope，`serverSpecification` 等字段为 JSON 对象；最多 1 MiB。凭据只允许 `${MCP_TOKEN}` 这样的占位符。
+
+```sh
+node dist/cli.js mcp list --namespace team-ai --name cli-local-example --json
+node dist/cli.js mcp create examples/mcp/server.json --namespace team-ai --json
+node dist/cli.js mcp inspect cli-local-example --namespace team-ai --version 1.0.0 --json
+# 修改 JSON 文件后更新同名服务
+node dist/cli.js mcp update cli-local-example examples/mcp/server.json --namespace team-ai --json
+node dist/cli.js mcp tool disable cli-local-example echo --namespace team-ai --version 1.0.0 --json
+node dist/cli.js mcp delete cli-local-example --namespace team-ai --yes --json
+```
+
+工具开关的 `--version` 是 inspect 返回的 Nacos 服务版本（例如 `1.0.0`），不是整数修订号。更新和删除会先查询当前目标；服务端仍执行授权与版本校验。
+
+| 操作 | capability 预检 | 服务端要求 |
+|---|---|---|
+| list、inspect | `read` | namespace 可读 |
+| create、update、tags、tool enable/disable | `mcp:maintain` | namespace 维护权限 |
+| online、offline | `release:publish` | 审核权限且版本已发布 |
+| delete | `namespace:admin` | 平台 ops-admin |
+
+`online`、`offline` 要求精确版本和已发布的审批记录，通过官方 Nacos MCP 更新接口修改 `enabled`，保留工具定义、endpoint 引用和 latest 指针，并读回验证。当前 Nacos 3.2 MCP Admin API 与服务 schema 不支持业务标签；`tags` 兼容入口明确返回 `AI_REGISTRY_MCP_TAGS_UNSUPPORTED`，不会假装保存成功。未发布版本不能通过 `online` 绕过发布流程。现有发布状态机将下线记录置为 `OFFLINE`；下线后恢复需要创建新版本并重新审核发布，不能直接再次上线原版本。注册记录本身也不会自动创建网关绑定、授予工具权限或保存后端密钥。
+
+## 测试工具调用
+
+针对已经完成网关绑定及统一授权的服务：
+
+```sh
+node dist/cli.js mcp tools catalog-mcp --registry --namespace team-ai --json
+node dist/cli.js mcp call catalog-mcp search_products --registry --namespace team-ai --args '{"query":"demo"}' --json
+# 敏感参数优先使用权限受限的本地 JSON 文件
+node dist/cli.js mcp call catalog-mcp search_products --registry --namespace team-ai --args-file ./arguments.json --json
+```
+
+`--registry` 使用平台 Registry 的受治理入口；不指定时优先使用 Profile 网关。`--timeout` 统一以秒为单位（1–600，默认 60）。
+
+`tools` 若返回 `nextCursor`，用 `--cursor` 查询下一页。`call` 的 `--args` 与 `--args-file` 互斥，参数必须是 JSON 对象，最多 1 MiB。工具返回 `isError` 时 CLI 以非零状态退出。
+
+调用使用平台下发的 `/mcp-connections` 与当前身份访问受治理网关。CLI 不直连注册定义中的 `backendEndpoints`，不获取 Nacos 管理凭据或后端服务密钥；具体工具权限由网关和 Keycloak 判定。调用跟随网关绑定的在线版本，因此 `tools`、`call`、`proxy` 没有 `--version` 参数。
+
+## 本地 stdio MCP
+
+将单个远端服务转换成宿主可启动的本地 MCP 进程：
+
+```sh
+node dist/cli.js mcp proxy catalog-mcp --namespace team-ai
+```
+
+宿主 MCP 配置示例（替换绝对路径和 namespace）：
+
+```json
+{
+  "mcpServers": {
+    "catalog": {
+      "command": "node",
+      "args": ["/absolute/path/to/numa/dist/cli.js", "mcp", "proxy", "catalog-mcp", "--namespace", "team-ai"]
+    }
+  }
+}
+```
+
+先在该环境完成 `node dist/cli.js login`。代理复用缓存并按需刷新凭据；stdout 仅传输协议帧，错误写到 stderr。能力协商、通知、resources、prompts 等协议消息透传；EOF 或终止信号会关闭远端 session。原有 `mcp bridge` 仍是 namespace Router 聚合入口，`mcp install` 保留现有客户端安装流程。
+
+## 本地管理烟测
+
+`management-smoke.py` 创建随机名称的禁用服务，验证查询、版本详情、更新读回、工具开关、删除读回、未发布上线拒绝、不支持标签的明确错误及只读身份越权拒绝，并清理自己创建的记录。默认不会上线服务或创建网关授权。传入 `--submitter-env-file` 时增加真实的两人发布流程：Registry 维护身份提交，admin 审核和发布，核查线上与下线状态；始终不创建网关授权，最后删除自建注册记录，平台审计与发布历史保留。
+
+统一 MVP runner 将两套独立的私有 CLI 环境写成 JSON 文件（键和值为环境变量字符串），包括各自缓存/profile 和明确的 loopback `NUMA_BACKEND_BASE_URL`。文件不可提交，脚本不输出其内容：
+
+```sh
+python3 examples/mcp/management-smoke.py \
+  --namespace team-ai --instance local-mvp \
+  --admin-env-file /private/path/admin-env.json \
+  --reader-env-file /private/path/reader-env.json \
+  --submitter-env-file /private/path/maintainer-env.json
+```
+
+正式环境不要运行该烟测；脚本要求两套环境的 API 地址都显式指向 loopback。权限拒绝测试与 CRUD 都通过 CLI 调用平台，不直接访问 Nacos Admin API。
+
+协议依据：[Nacos MCP 管理 API](https://nacos.io/docs/latest/manual/admin/admin-api/#4-mcp-%E7%AE%A1%E7%90%86)、[Nacos 运维 SDK](https://nacos.io/docs/latest/manual/admin/maintainer-sdk/)。
+
+运行态端到端脚本使用普通 reader 身份，校验真实网关工具调用、越权拒绝和本地 stdio：
+
+```sh
+node examples/mcp/runtime-smoke.mjs --extended \
+  --namespace mcp-lab-a --instance mcp-keycloak-lab \
+  --reader-env-file /private/path/reader-env.json \
+  --writer-env-file /private/path/writer-env.json \
+  --denied-env-file /private/path/denied-env.json
+```
+
+该脚本也要求显式 loopback `NUMA_BACKEND_BASE_URL`，默认使用本地 `catalog-mcp` fixture；不要使用 admin 身份执行拒绝验收。
+
+管理烟测的 `--submitter-env-file`（兼容别名 `--writer-env-file`） 必须对应 capabilities 具有 `release:submit` 的 Registry 维护身份。它和运行态烟测中仅能调用写工具的业务 writer 身份不同；不要为通过测试给普通业务调用者追加管理权限。

package/examples/mcp/management-smoke.py

@@ -0,0 +1,154 @@
+#!/usr/bin/env python3
+"""Exercise MCP management through local Numa CLI; fixture supplies private environments.
+
+No Nacos administrator credentials or direct upstream API calls. The script creates
+one random disabled MCP record and deletes it. It does not grant gateway access.
+"""
+import argparse
+import json
+import os
+import re
+from pathlib import Path
+import subprocess
+import tempfile
+import uuid
+from urllib.parse import urlparse
+
+
+def read_environment(path):
+    value = json.loads(Path(path).read_text())
+    if not isinstance(value, dict) or not all(isinstance(k, str) and isinstance(v, str) for k, v in value.items()):
+        raise ValueError("Fixture environment must be a JSON object of string values")
+    # The fixture owns the private file; never print its values.
+    return {**os.environ, **value}
+
+
+def smoke(cli, namespace, instance, admin_env, reader_env, submitter_env=None):
+    for environment in [admin_env, reader_env] + ([submitter_env] if submitter_env else []):
+        target = urlparse(environment.get("NUMA_BACKEND_BASE_URL", ""))
+        if target.scheme not in ("http", "https") or target.hostname not in ("localhost", "127.0.0.1", "::1"):
+            raise RuntimeError("Smoke requires an explicit loopback NUMA_BACKEND_BASE_URL in both fixture environments")
+    passed = []
+    name = "numa-cli-smoke-" + uuid.uuid4().hex[:12]
+    common = ["--namespace", namespace, "--json"] + (["--instance", instance] if instance else [])
+    created = False
+
+    def command(args, env=admin_env, denied=False, expected_code=None, group="mcp", scoped=True):
+        result = subprocess.run(["node", str(cli), group, *args, *(common if scoped else ["--json"])], env=env,
+                                text=True, capture_output=True, timeout=90)
+        try:
+            payload = json.loads(result.stdout or result.stderr)
+        except (ValueError, TypeError):
+            raise RuntimeError("CLI did not return structured JSON for " + args[0]) from None
+        if expected_code is not None:
+            code = (payload.get("error") or {}).get("code", "")
+            if result.returncode == 0 or code != expected_code:
+                raise RuntimeError("Expected " + expected_code + " for " + args[0] + ", got " + str(code))
+        elif denied:
+            code = (payload.get("error") or {}).get("code", "")
+            if result.returncode == 0 or not any(word in str(code).lower() for word in ("forbidden", "denied", "permission")):
+                raise RuntimeError("Expected authorization denial for " + args[0])
+        elif result.returncode != 0 or payload.get("ok") is not True:
+            code = (payload.get("error") or {}).get("code", "unknown")
+            status = re.search(r"HTTP (\d{3})", str((payload.get("error") or {}).get("message", "")))
+            raise RuntimeError("CLI " + " ".join(args[:2]) + " failed: " + str(code) + (" HTTP " + status[1] if status else ""))
+        return payload
+
+    with tempfile.TemporaryDirectory(prefix="numa-mcp-smoke-") as directory:
+        path = Path(directory) / "server.json"
+        spec = json.loads(Path(__file__).with_name("server.json").read_text())
+        spec["serverSpecification"]["name"] = name
+        path.write_text(json.dumps(spec))
+        try:
+            command(["create", str(path)], reader_env, denied=True)
+            passed.append("reader-create-denied")
+            command(["create", str(path)])
+            created = True
+            passed.append("create-disabled")
+            listing = command(["list", "--name", name])["mcpServers"]
+            if not any(item.get("name") == name for item in listing.get("pageItems", [])):
+                raise RuntimeError("Created MCP record absent from Nacos list")
+            passed.append("list")
+            detail = command(["inspect", name, "--version", "1.0.0"])["mcpServer"]
+            if detail.get("name") != name or detail.get("versionDetail", {}).get("version") != "1.0.0":
+                raise RuntimeError("Nacos detail did not preserve name and selected version")
+            passed.append("inspect-version")
+            if detail.get("enabled") is not False:
+                raise RuntimeError("Smoke record was unexpectedly enabled")
+            spec["serverSpecification"]["description"] = "Updated CLI smoke record"
+            path.write_text(json.dumps(spec))
+            command(["update", name, str(path)])
+            detail = command(["inspect", name, "--version", "1.0.0"])["mcpServer"]
+            if detail.get("description") != "Updated CLI smoke record":
+                raise RuntimeError("Nacos update was not visible")
+            passed.append("update-readback")
+            for operation, expected in (("disable", False), ("enable", True)):
+                command(["tool", operation, name, "echo", "--version", "1.0.0"])
+                detail = command(["inspect", name, "--version", "1.0.0"])["mcpServer"]
+                if detail.get("toolSpec", {}).get("toolsMeta", {}).get("echo", {}).get("enabled") is not expected:
+                    raise RuntimeError("Nacos tool state was not persisted")
+                passed.append("tool-" + operation)
+            command(["tags", name, "smoke"], expected_code="AI_REGISTRY_MCP_TAGS_UNSUPPORTED")
+            passed.append("tags-unsupported-explicit")
+            command(["online", name, "--version", "1.0.0"], expected_code="AI_REGISTRY_RELEASE_REQUEST_REQUIRED")
+            passed.append("unpublished-online-denied")
+            if submitter_env:
+                release = command(["approvals", "submit", "mcp", name, "--resource-version", "1.0.0",
+                                   "--reason", "Local MVP lifecycle verification"], submitter_env, group="registry")["result"]
+                passed.append("maintainer-release-submitted")
+                reviewed = command(["approvals", "review", release["requestId"], "--decision", "APPROVED",
+                                    "--reason", "Local disabled fixture reviewed", "--version", str(release["version"])],
+                                   group="registry", scoped=False)["result"]
+                passed.append("admin-release-reviewed")
+                published = command(["approvals", "publish", release["requestId"], "--version", str(reviewed["version"])],
+                                    group="registry", scoped=False)["result"]
+                if published.get("state") != "PUBLISHED":
+                    raise RuntimeError("Release did not reach PUBLISHED")
+                detail = command(["inspect", name, "--version", "1.0.0"])["mcpServer"]
+                if detail.get("enabled") is not True:
+                    raise RuntimeError("Publishing did not enable selected MCP version")
+                passed.append("admin-publish-enabled-readback")
+                command(["online", name, "--version", "1.0.0"])
+                detail = command(["inspect", name, "--version", "1.0.0"])["mcpServer"]
+                if detail.get("enabled") is not True:
+                    raise RuntimeError("Online state did not persist")
+                passed.append("published-online-readback")
+                command(["offline", name, "--version", "1.0.0"])
+                detail = command(["inspect", name, "--version", "1.0.0"])["mcpServer"]
+                if detail.get("enabled") is not False:
+                    raise RuntimeError("Offline state did not persist")
+                passed.append("offline-disabled-readback")
+            command(["delete", name, "--yes"], reader_env, denied=True)
+            passed.append("reader-delete-denied")
+            command(["delete", name, "--yes"])
+            created = False
+            listing = command(["list", "--name", name])["mcpServers"]
+            if any(item.get("name") == name for item in listing.get("pageItems", [])):
+                raise RuntimeError("Deleted MCP record still appears in Nacos list")
+            passed.append("delete-readback")
+        finally:
+            if created:
+                command(["delete", name, "--yes"])
+    return {"ok": True, "checks": passed, "count": len(passed)}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--cli", type=Path, default=Path(__file__).resolve().parents[2] / "dist/cli.js")
+    parser.add_argument("--namespace", required=True)
+    parser.add_argument("--instance")
+    parser.add_argument("--admin-env-file", required=True, help="Private JSON environment for local MVP administrator")
+    parser.add_argument("--reader-env-file", required=True, help="Private JSON environment for read-only identity")
+    parser.add_argument("--submitter-env-file", "--writer-env-file", dest="submitter_env_file", help="Separate Registry maintainer identity for two-person publication lifecycle")
+    args = parser.parse_args()
+    try:
+        print(json.dumps(smoke(args.cli.resolve(), args.namespace, args.instance,
+                               read_environment(args.admin_env_file), read_environment(args.reader_env_file),
+                               read_environment(args.submitter_env_file) if args.submitter_env_file else None), indent=2))
+    except (OSError, ValueError, RuntimeError, subprocess.TimeoutExpired) as error:
+        # Exception messages are deliberately constructed without process output or secrets.
+        parser.exit(1, "MCP management smoke failed: " + (str(error) if isinstance(error, RuntimeError) else type(error).__name__) + "\n")
+
+
+if __name__ == "__main__":
+    main()