@numa-tech/numa 1.22.1 → 1.23.1

package/dist/interactive/registry.js

@@ -1,36 +1,34 @@
 import { AiRegistryError } from "../ai-registry/errors.js";
-import { resolveRegistryNamespace } from "../ai-registry/namespace.js";
+import { chooseRegistryNamespace, initialRegistryNamespace } from "./registry-namespace.js";
 import { resolveVersion } from "../ai-registry/sync.js";
 import { requireInput } from "./prompts.js";
 export async function completeRegistryInstall(kind, name, input, client, ui) {
     const options = { ...input };
-    if (!options.namespace) {
-        const capabilities = await client.getCapabilities();
-        const allowed = capabilities.namespaces.filter((n) => n.actions.includes("install") &&
-            (!options.instance || n.instanceCode === options.instance));
-        requireInput(allowed.length, "当前身份没有可安装的 namespace");
-        const selected = await ui.choose("选择已授权的来源空间", allowed.map((n, i) => ({
-            value: String(i),
-            label: `${n.displayName} (${n.namespaceKey})`,
-            hint: `${n.instanceCode ?? "默认实例"} · ${n.environment}`,
-        })));
-        const n = allowed[Number(selected)];
-        requireInput(n, "请选择有效 namespace");
-        options.namespace = n.namespaceKey;
-        options.instance ??= n.instanceCode;
+    const selection = { ...input, requiredAction: "install" };
+    let context = await initialRegistryNamespace(client, selection, ui);
+    if (name && !input.namespace && context.source !== "cli") {
+        const choice = await ui.choose("来源 namespace", [
+            { value: "@continue", label: `使用 ${context.namespace.namespaceKey}`, hint: context.namespace.instanceCode },
+            { value: "@namespace", label: "更换 namespace" },
+        ], "@continue");
+        if (choice === "@namespace")
+            context = await chooseRegistryNamespace(client, selection, ui);
     }
-    const context = await resolveRegistryNamespace(client, {
-        ...options,
-        requiredAction: "install",
-    });
-    if (context.namespace.status !== "ACTIVE" ||
-        context.namespace.instanceStatus !== "ACTIVE")
-        throw new AiRegistryError("所选来源未启用。", "ai_registry_namespace_unavailable");
-    options.namespace = context.namespace.namespaceKey;
-    options.instance = context.namespace.instanceCode;
     if (!name) {
         let page = 1;
+        let sourceMenu = false;
         while (!name) {
+            if (sourceMenu) {
+                const action = await ui.choose(`当前 namespace：${context.namespace.instanceCode} / ${context.namespace.namespaceKey}`, [
+                    { value: "@browse", label: `浏览 ${kind === "skill" ? "Skills" : "MCP"}` },
+                    { value: "@namespace", label: "更换 namespace" },
+                ], "@browse");
+                if (action === "@namespace") {
+                    context = await chooseRegistryNamespace(client, selection, ui);
+                    page = 1;
+                }
+                sourceMenu = false;
+            }
             const result = kind === "skill"
                 ? await client.listSkills(context.namespace.id, {
                     pageNo: page,
@@ -65,8 +63,17 @@ export async function completeRegistryInstall(kind, name, input, client, ui) {
                 label: "输入精确名称",
                 hint: "已知资源名时直接查看",
             });
-            const choice = await ui.choose(`选择 ${kind === "skill" ? "Skill" : "MCP"}（输入文字检索当前页 ${page}）`, choices);
-            if (choice === "@previous")
+            const message = `${context.namespace.instanceCode} / ${context.namespace.namespaceKey} · 选择 ${kind === "skill" ? "Skill" : "MCP"}（当前页 ${page}）`;
+            choices.push({ value: "@back", label: "返回上一级", hint: "" });
+            const choice = await ui.choose(message, choices, undefined, { value: "@namespace", label: "更换 namespace" });
+            if (choice === "@namespace") {
+                context = await chooseRegistryNamespace(client, selection, ui);
+                page = 1;
+            }
+            else if (choice === "@back") {
+                sourceMenu = true;
+            }
+            else if (choice === "@previous")
                 page--;
             else if (choice === "@next")
                 page++;
@@ -74,6 +81,8 @@ export async function completeRegistryInstall(kind, name, input, client, ui) {
                 name = choice === "@exact" ? await ui.text("资源精确名称") : choice;
         }
     }
+    options.namespace = context.namespace.namespaceKey;
+    options.instance = context.namespace.instanceCode;
     requireInput(name, "请指定资源名称");
     const detail = kind === "skill"
         ? await client.getSkill(context.namespace.id, name)

package/dist/interactive/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/interactive/registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAqB5C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAqB,EACrB,IAAwB,EACxB,KAA2B,EAC3B,MAAuB,EACvB,EAAa;IAEb,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC7B,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,CAC7D,CAAC;QACF,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,CAC9B,YAAY,EACZ,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAChB,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,YAAY,GAAG;YAC7C,IAAI,EAAE,GAAG,CAAC,CAAC,YAAY,IAAI,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE;SACvD,CAAC,CAAC,CACJ,CAAC;QACF,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpC,YAAY,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACnC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;QACnC,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,YAAY,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE;QACrD,GAAG,OAAO;QACV,cAAc,EAAE,SAAS;KAC1B,CAAC,CAAC;IACH,IACE,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ;QACrC,OAAO,CAAC,SAAS,CAAC,cAAc,KAAK,QAAQ;QAE7C,MAAM,IAAI,eAAe,CACvB,UAAU,EACV,mCAAmC,CACpC,CAAC;IACJ,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;IACnD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;IAClD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,MAAM,GACV,IAAI,KAAK,OAAO;gBACd,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;oBAC5C,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,EAAE;iBACb,CAAC;gBACJ,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;oBAChD,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,EAAE;iBACb,CAAC,CAAC;YACT,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;gBACrB,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,8BAA8B,CAC/B,CAAC;YACJ,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CACtB,CAAC,CAAC,EAAgC,EAAE,CAClC,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,KAAK,QAAQ;gBACrB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAC1B,CAAC,CAAC,MAAM,KAAK,KAAK,CACrB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,KAAK;gBACnB,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;aAClC,CAAC,CAAC,CAAC;YACJ,IAAI,IAAI,GAAG,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/D,IAAI,IAAI,IAAI,IAAI,GAAG,GAAG;gBACpB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAC5B,MAAM,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,IAAI,GAAG,EAC7D,OAAO,CACR,CAAC;YACF,IAAI,MAAM,KAAK,WAAW;gBAAE,IAAI,EAAE,CAAC;iBAC9B,IAAI,MAAM,KAAK,OAAO;gBAAE,IAAI,EAAE,CAAC;;gBAC/B,IAAI,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACrE,CAAC;IACH,CAAC;IACD,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,MAAM,GACV,IAAI,KAAK,OAAO;QACd,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC;QACnD,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CACvB,OAAO,CAAC,SAAS,CAAC,EAAE,EACpB,IAAI,EACJ,OAAO,CAAC,OAAO;YACb,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;YAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,CACzC,CAAC;IACR,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK;QACjD,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,8BAA8B,CAC/B,CAAC;IACJ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CACpB,CAAC,CAAC,EAAgC,EAAE,CAClC,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,KAAK,QAAQ;gBACrB,CAAC,CAAC,MAAM,KAAK,QAAQ;gBACrB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAChC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,CACV,QAAQ,CAAC,MAAM,EACf,6BAA6B,CAC9B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK;YACpC,OAAO,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAC/B,YAAY,EACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBACxB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;aAChC,CAAC,CAAC,CACJ,CAAC;;YAEF,OAAO,CAAC,OAAO,GAAG,cAAc,CAC9B,MAAM,EACN,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,KAAK,EACb,IAAI,CACL,CAAC;QACJ,YAAY,CACV,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,EACnD,iBAAiB,CAClB,CAAC;IACJ,CAAC;;QACC,OAAO,CAAC,OAAO,GAAG,cAAc,CAC9B,MAAM,EACN,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,KAAK,IAAI,QAAQ,EACzB,IAAI,CACL,CAAC;IACJ,OAAO,OAAO,CAAC,KAAK,CAAC;IACrB,MAAM,MAAM,GACV,IAAI,KAAK,OAAO;QACd,CAAC,CAAC;YACE,WAAW;YACX,QAAQ;YACR,OAAO;YACP,QAAQ;YACR,SAAS;YACT,UAAU;YACV,QAAQ;YACR,QAAQ;SACT;QACH,CAAC,CAAC;YACE,WAAW;YACX,QAAQ;YACR,OAAO;YACP,QAAQ;YACR,SAAS;YACT,UAAU;YACV,QAAQ;SACT,CAAC;IACR,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC,MAAM,CAC/B,cAAc,EACd,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,EAChD,WAAW,CACZ,CAAC;IACF,OAAO,CAAC,KAAK;QACX,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YACxE,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACb,MAAM,EACN;gBACE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;gBAChC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;aACpC,EACD,MAAM,CACP,CAAC;IACR,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAC7B,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;;YACpE,OAAO,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC;IACD,EAAE,CAAC,IAAI,CACL,GAAG,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,SAAS,CAAC,YAAY,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,KAAK,MAAM,CAC1G,MAAM,CAAC,WAAW,IAAI,EAAE,CACzB;SACE,OAAO,CAAC,gCAAgC,EAAE,GAAG,CAAC;SAC9C,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EACnB,OAAO,CACR,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/interactive/registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAqB5C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAqB,EACrB,IAAwB,EACxB,KAA2B,EAC3B,MAAuB,EACvB,EAAa;IAEb,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;IAC1D,IAAI,OAAO,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACpE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE;YAC7C,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE;YAC3G,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE;SAC/C,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,MAAM,KAAK,YAAY;YAAE,OAAO,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,OAAO,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAC5B,gBAAgB,OAAO,CAAC,SAAS,CAAC,YAAY,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,EACpF;oBACE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE;oBACxE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE;iBAC/C,EACD,SAAS,CACV,CAAC;gBACF,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;oBAC5B,OAAO,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;oBAC/D,IAAI,GAAG,CAAC,CAAC;gBACX,CAAC;gBACD,UAAU,GAAG,KAAK,CAAC;YACrB,CAAC;YACD,MAAM,MAAM,GACV,IAAI,KAAK,OAAO;gBACd,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;oBAC5C,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,EAAE;iBACb,CAAC;gBACJ,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;oBAChD,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,EAAE;iBACb,CAAC,CAAC;YACT,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;gBACrB,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,8BAA8B,CAC/B,CAAC;YACJ,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CACtB,CAAC,CAAC,EAAgC,EAAE,CAClC,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,KAAK,QAAQ;gBACrB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAC1B,CAAC,CAAC,MAAM,KAAK,KAAK,CACrB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,KAAK;gBACnB,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;aAClC,CAAC,CAAC,CAAC;YACJ,IAAI,IAAI,GAAG,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/D,IAAI,IAAI,IAAI,IAAI,GAAG,GAAG;gBACpB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,SAAS,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC;YAChJ,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC5G,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,OAAO,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC/D,IAAI,GAAG,CAAC,CAAC;YACX,CAAC;iBAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC9B,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;iBAAM,IAAI,MAAM,KAAK,WAAW;gBAAE,IAAI,EAAE,CAAC;iBACrC,IAAI,MAAM,KAAK,OAAO;gBAAE,IAAI,EAAE,CAAC;;gBAC/B,IAAI,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;IACnD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;IAClD,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,MAAM,GACV,IAAI,KAAK,OAAO;QACd,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC;QACnD,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CACvB,OAAO,CAAC,SAAS,CAAC,EAAE,EACpB,IAAI,EACJ,OAAO,CAAC,OAAO;YACb,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;YAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,CACzC,CAAC;IACR,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK;QACjD,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,8BAA8B,CAC/B,CAAC;IACJ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CACpB,CAAC,CAAC,EAAgC,EAAE,CAClC,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,KAAK,QAAQ;gBACrB,CAAC,CAAC,MAAM,KAAK,QAAQ;gBACrB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAChC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,CACV,QAAQ,CAAC,MAAM,EACf,6BAA6B,CAC9B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK;YACpC,OAAO,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAC/B,YAAY,EACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;gBACxB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;aAChC,CAAC,CAAC,CACJ,CAAC;;YAEF,OAAO,CAAC,OAAO,GAAG,cAAc,CAC9B,MAAM,EACN,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,KAAK,EACb,IAAI,CACL,CAAC;QACJ,YAAY,CACV,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,EACnD,iBAAiB,CAClB,CAAC;IACJ,CAAC;;QACC,OAAO,CAAC,OAAO,GAAG,cAAc,CAC9B,MAAM,EACN,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,KAAK,IAAI,QAAQ,EACzB,IAAI,CACL,CAAC;IACJ,OAAO,OAAO,CAAC,KAAK,CAAC;IACrB,MAAM,MAAM,GACV,IAAI,KAAK,OAAO;QACd,CAAC,CAAC;YACE,WAAW;YACX,QAAQ;YACR,OAAO;YACP,QAAQ;YACR,SAAS;YACT,UAAU;YACV,QAAQ;YACR,QAAQ;SACT;QACH,CAAC,CAAC;YACE,WAAW;YACX,QAAQ;YACR,OAAO;YACP,QAAQ;YACR,SAAS;YACT,UAAU;YACV,QAAQ;SACT,CAAC;IACR,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC,MAAM,CAC/B,cAAc,EACd,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,EAChD,WAAW,CACZ,CAAC;IACF,OAAO,CAAC,KAAK;QACX,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YACxE,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACb,MAAM,EACN;gBACE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;gBAChC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;aACpC,EACD,MAAM,CACP,CAAC;IACR,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAC7B,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;;YACpE,OAAO,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC;IACD,EAAE,CAAC,IAAI,CACL,GAAG,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,SAAS,CAAC,YAAY,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,KAAK,MAAM,CAC1G,MAAM,CAAC,WAAW,IAAI,EAAE,CACzB;SACE,OAAO,CAAC,gCAAgC,EAAE,GAAG,CAAC;SAC9C,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EACnB,OAAO,CACR,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/docs/authorization-configuration-publication.md

@@ -39,7 +39,10 @@ Client, group or environment.
 Create a JSON file containing the exact request ID, frozen definition version and
 environment UUIDs returned by the platform. Optional `clientModes` is keyed by
 Client instance UUID with CREATE/ADOPT/UPDATE/REPAIR values. The new `preview`
-command sends `protocolVersion: 2` and rejects an explicit protocol 1 value.
+command defaults to `protocolVersion: 2`, accepts explicit protocol 3 with
+`environmentDistributions`, and rejects protocol 1. See
+[environment configuration publication](environment-configuration-publication.md) for the
+protocol 3 resource binding and destination workflow. Protocol 4 withdrawal is not supported.
 Preview persists a reviewable job but makes no remote configuration changes, so
 it requires `--yes` to confirm creation of that exact job.
 

package/docs/environment-configuration-publication.md

@@ -0,0 +1,95 @@
+# 环境配置治理、protocol 3 发布、protocol 4 撤销与 protocol 5 网关分发
+
+本地源码提供下列能力；安装版是否具备，以精确子命令帮助为准。所有命令沿用当前平台 Profile、管理 API 和认证身份，需要 `mci-devops-platform-ops-admin`。身份配置中的 `issuerId` 引用普通注册身份源，不改变 CLI 自身登录配置。
+
+## 读取、预览与乐观修订
+
+```sh
+numa authorization identity-configuration list --json
+numa authorization identity-configuration show CONFIGURATION_UUID --json
+numa authorization identity-configuration client-options --issuer-id ISSUER_UUID --app APP_ID --json
+numa authorization identity-configuration environments CONFIGURATION_UUID --json
+numa authorization environment-resource show ENVIRONMENT_NUMBER --json
+numa authorization environment-resource resolved ENVIRONMENT_NUMBER --app APP_ID --slot RESOURCE --view current --json
+numa authorization environment-resource migration-issues --json
+```
+
+大写参数需要替换为已核实的目录对象。`environment-resource` 使用环境目录的数字 ID；`application environment` 和发布输入的 `environmentIds` 仍使用应用授权环境绑定 UUID。两者不可互换。`--view applied` 读取已激活快照；`current` 是当前草稿组成，不代表已经发布或被运行环境加载。
+
+身份配置完整保存 JSON 示例：
+
+```json
+{
+  "expectedVersion": 3,
+  "code": "team-staging",
+  "name": "Team staging identity",
+  "issuerId": "11111111-1111-4111-8111-111111111111",
+  "status": "ACTIVE",
+  "clients": [{
+    "applicationId": 42,
+    "slot": "RESOURCE",
+    "referenceId": "22222222-2222-4222-8222-222222222222",
+    "instanceId": "33333333-3333-4333-8333-333333333333"
+  }]
+}
+```
+
+`clients` 是完整替换，不是追加；保留其他应用或用途时必须保留对应条目。用途支持 `RESOURCE`、`BROWSER_LOGIN`、`CLI_LOGIN`、`MACHINE:<用途>`，同一配置的应用与用途组合唯一。已存在配置不能借更新切换 issuer；服务端继续核对引用归属和 Client 能力。
+
+```sh
+numa authorization identity-configuration preview --id CONFIGURATION_UUID --file identity.json --json
+numa authorization identity-configuration save --id CONFIGURATION_UUID --file identity.json --yes --json
+```
+
+创建时省略 `--id`，`expectedVersion` 必须是 `0`。`preview` 只读并展示规范化的完整输入；`save --yes` 再次核对当前版本后发送一次 POST/PUT，由后端事务执行 CAS。预览不产生租约或锁。冲突后读取最新配置、重新编辑和审阅；CLI 不自动重试、不自动合并。
+
+环境资源绑定 JSON 的三个可空指针都必须显式提供，避免遗漏字段导致清空：
+
+```json
+{
+  "expectedVersion": 2,
+  "identityConfigurationId": "11111111-1111-4111-8111-111111111111",
+  "registryNamespaceId": 7,
+  "defaultGatewayId": null
+}
+```
+
+```sh
+numa authorization environment-resource preview ENVIRONMENT_NUMBER --file binding.json --json
+numa authorization environment-resource save ENVIRONMENT_NUMBER --file binding.json --yes --json
+```
+
+这些保存只修改平台配置，不写 Keycloak、Nacos 或网关。应用授权环境绑定 JSON 另外支持 `platformEnvironmentId`、`purpose` 和 `expectedProjectionVersion`；前者是数字目录关联，投影版本与环境自身的 `version` 分别校验。protocol 3 当前发布用途为 `default`。
+
+## 发布编译后的环境配置
+
+发布仍沿用完整预览、确认、执行、回读流程。显式选择 protocol 3；只有需要独立 Nacos 业务配置分发时才提供每个环境与用途的目标。CLI 不接受任意 Nacos content、上游地址或 Secret。
+
+```json
+{
+  "requestId": "44444444-4444-4444-8444-444444444444",
+  "protocolVersion": 3,
+  "definitionVersion": 7,
+  "environmentIds": ["55555555-5555-4555-8555-555555555555"],
+  "environmentDistributions": [{
+    "environmentId": 21,
+    "slot": "RESOURCE",
+    "group": "APP_CONFIG",
+    "dataId": "application.json"
+  }]
+}
+```
+
+`environmentDistributions.environmentId` 是数字环境目录 ID。省略 `environmentDistributions` 或提供空数组时，仅发布授权与固定环境配置，不写 Nacos。选择分发时，为该应用所有被选环境的已映射用途分别填写目标，不使用重复用途或未选择的环境。Nacos 实例和 namespace 从已绑定资源解析；服务端编译内容、核对目标归属和全部依赖。只设置 `destinations` 字段不会被接受。
+
+```sh
+numa authorization application --app APP_ID publication preview --file publication.json --yes --json
+numa authorization application --app APP_ID publication show JOB_UUID --json
+numa authorization application --app APP_ID publication execute JOB_UUID \
+  --expected-version JOB_VERSION --expected-digest PLAN_DIGEST \
+  --expected-bundle-digest BUNDLE_DIGEST --yes --json
+```
+
+审阅 `configurationBundle`、`environmentConfigurations`、`distributionPreview` 和共享授权影响。三项确认值必须来自同一次任务响应。CLI 拒绝服务端把 protocol 3 静默降级成 protocol 2，或返回缺少冻结环境/分发证据的结果。后端确认并回读后才激活快照；`loadingState: UNVERIFIED` 仍不代表消费者已加载。
+
+未知结果时读取原 `JOB_UUID`，不要重复创建任务。`resume` 使用原计划和 bundle 摘要；`repreview` 输入保留原任务确认字段，并显式提供新的 requestId、protocol 3；需要分发时提供完整 environmentDistributions，不从旧计划猜分发目标。`abandon` 终止未来同步并保留已发生效果。协议 4/5 的自动撤销和完整网关分发命令已移除；不向此输入增加 `protocolVersion: 4/5`。历史作业可通过 `publication show` 查看，不能视为普通授权发布执行。

package/docs/gitops-configuration.md

@@ -0,0 +1,122 @@
+# 独立 Flux 配置管理
+
+版本：独立 GitOps 命令自 `@numa-tech/numa@1.23.0` 提供，需要配套 DevOps deployment-units/workloads API；1.22.1 不包含这些独立命令。可用固定入口 `npx -y @numa-tech/numa@1.23.0` 运行下面的示例，沿用正常登录和 API 配置，无需更新全局安装。
+
+GitOps 单元以**登记仓库 + 分支 + 目录**定义。标准应用、平台环境和 Jenkins 均不是独立服务编辑的前提。`STANDALONE` 表示仓库 `standalone` 等目录下的独立应用，不会创建或安装新的 Flux 实例。服务命名空间来自实际 HelmRelease；相同名字、不同 namespace 的服务是不同身份。
+
+## 单元登记及可选关联
+
+```sh
+numa gitops unit list --json
+numa gitops unit register --file standalone-unit.json --yes --json
+numa gitops unit show 7 --json
+```
+
+`standalone-unit.json` 示例（repository ID 应从平台实际登记中选择）：
+
+```json
+{
+  "unitKey": "monitoring-standalone",
+  "name": "Monitoring standalone",
+  "gitopsRepositoryId": 4,
+  "branch": "develop",
+  "path": "standalone/monitoring",
+  "scope": "STANDALONE",
+  "tier": "UNKNOWN",
+  "status": "ACTIVE"
+}
+```
+
+`scope` 为 `ENVIRONMENT`、`CLUSTER` 或 `STANDALONE`；`tier` 为 `DEVELOP`、`STAGING`、`PRODUCTION` 或 `UNKNOWN`。根目录使用 `.`。`environmentId`、`clusterId`、`fluxInstallationId`、`targetId` 可省略或为 null，后续可关联。登记/更新需要 ops-admin，由后端验证真实仓库和关联对象。
+
+更新是完整元信息替换：在 JSON 中保留要继续关联的字段，移除/设 null 表示解除可选关联；`--version` 使用最新 show 结果。`unitKey`、仓库、分支、目录创建后不可变；新地址需要登记新单元，不能悄悄重定位已有服务。
+
+```sh
+numa gitops unit update 7 --file standalone-unit.json --version 0 --yes --json
+```
+
+## 发现和登记服务
+
+```sh
+numa gitops workload discover --unit 7 --page 1 --page-size 20 --json
+numa gitops workload adopt --unit 7 --service metrics --namespace monitoring \
+  --owner-team 2 --revision REVISION_FROM_DISCOVER --yes --json
+numa gitops workload list --unit 7 --json
+# 可选：读取与某个标准应用关联的服务
+numa gitops workload list --application 4 --json
+numa gitops workload show 12 --json
+```
+
+发现只读 SCM，不创建应用或服务。登记使用发现结果的 namespace（未声明时省略）和 Git HEAD；所有权归 `ownerTeamId`。登记不提交 Git，也不触发 Jenkins。之后用稳定 workload ID 操作服务。列表和发现均有 `total/page/page_size`，不会只显示固定截断的候选集合。
+
+## 查看来源、编辑配置和镜像
+
+```sh
+numa gitops workload configuration show 12 --json
+numa gitops workload configuration plan 12 --version 0 --revision REVISION_FROM_SHOW \
+  --reason 'Adjust workload resources' --replicas 2 --resources resources.json --json
+numa gitops workload configuration plan 12 --version 0 --revision REVISION_FROM_SHOW \
+  --reason 'Update pinned image release' --image-repository hub.example/team/metrics --image-tag sha-123 --json
+```
+
+show 返回锁定 revision、workload version、有序配置层、valuesFrom 引用、字段来源及可编辑性。读取的是**声明的 Helm values**，不是 chart 默认值和 postRenderer 之后的最终工作负载。无法可靠解析的布局以只读状态和诊断呈现。每个字段可能来自 base、环境 overlay 或 valuesFrom；计划由后端选择正确写入点，CLI 不接收任意 Flux 文件路径。
+
+支持 `--replicas`、`--image-repository`、`--image-tag`，以及 JSON 文件选项 `--resources`、`--env`、`--envs`、`--env-from`、`--service`、`--ingress`、`--liveness-probe`、`--readiness-probe`、`--startup-probe`。也可用 `--changes changes.json` 在一次计划中提交多项修改；重复/重叠 pointer 会被拒绝，不会静默覆盖。
+
+```json
+[
+  {"pointer": "/replicaCount", "value": 2},
+  {"pointer": "/resources", "value": {"requests": {"cpu": "100m", "memory": "128Mi"}}},
+  {"pointer": "/env", "value": [
+    {"name": "SERVER_NAME", "value": "dev1"},
+    {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "database", "key": "password"}}}
+  ]}
+]
+```
+
+JSON 文件最大 1 MiB，每次最多 40 项，副本数范围为 0–10000。`--envs` 对应公司 chart 的同名字段；`--env` 对应标准 env 字段。明文敏感环境变量和 Kubernetes Secret data 被拒绝；使用已有 Secret 引用。CLI 不读取 Secret 内容，也不把输出中的敏感值或凭据写入聊天/日志。JSON 外层 DTO 采用 snake_case；配置值内的环境变量、chart 字段及 Secret 引用保留原始大小写。
+
+## 审阅及执行
+
+plan 只保存不可变计划，不写 Git。审阅 `changes` 的 before/after、`files`、`base_revision`、`plan_hash` 后执行：
+
+```sh
+numa gitops workload configuration apply 12 PLAN_FROM_PREVIEW \
+  --plan-hash HASH_FROM_PREVIEW --idempotency-key metrics-config-1 --yes --json
+numa gitops workload configuration status 12 PLAN_FROM_PREVIEW --json
+```
+
+apply 先 GET 原计划校验身份/hash；`SUCCEEDED`、`WAITING_REVIEW`、`STALE`、`FAILED` 只返回状态，不再次提交。`PLANNED` 执行首次提交；`APPLYING` 可由用户再次显式执行 apply，携带原 plan/hash/幂等键及 `--yes` 续跑，服务端会拒绝不同幂等键。若原幂等键遗失，应停止写入并查询状态，不能生成新键替代。Git HEAD 或服务元信息版本改变时旧计划失效，必须重新 show/plan；Jenkins 并发提交镜像同样受 Git CAS 保护。`DIRECT_BRANCH` 返回提交结果，`REVIEWED_CHANGE` 返回 `WAITING_REVIEW` 和审查链接。本流程不会启动 Jenkins。
+
+幂等键由服务端持久化。网络响应丢失时 CLI **只读回原计划，不自动重放写请求**。仍无法确定结果则返回 `GITOPS_WORKLOAD_RESULT_UNKNOWN`，先使用 status 查询；后续人工重试必须保持同一 plan/hash/key。计划创建当前没有 resolve-by-key API；响应未知时返回 `GITOPS_WORKLOAD_PLAN_RESULT_UNKNOWN`，不能假装计划未创建而自动重放。
+
+## 标准应用关联
+
+```sh
+numa gitops workload bind 12 --application 4 --version 0 --yes --json
+numa gitops workload unbind 12 --version 1 --yes --json
+```
+
+关联和解除关联只改平台元数据，不改 Git、所有权或镜像。后端同时校验独立服务的治理团队权限和目标标准应用权限；绑定不会绕过原有权限。
+
+## API 对应关系
+
+- `/api/v1/gitops/deployment-units`：GET 列表、POST 登记；`/{id}`：GET/PUT。
+- `/api/v1/gitops/workloads?unitId=...`：GET 分页；`/discover?unitId=...`：GET 发现；根 POST：登记服务。
+- `/workloads/{id}/configuration`：GET 配置；`/{id}/plans`：POST 预览。
+- `/workloads/{id}/plans/{planNumber}`：GET 状态；`/apply`：POST，必须携带 `Idempotency-Key`。
+- `/workloads/{id}/application`：PUT `{applicationId: number|null, expectedVersion}`。
+
+命令目录 `numa commands --json` 以及各级 `--help` 可发现这些独立 GitOps 命令。权限由网关和后端执行；CLI 不根据本地身份或自行猜测的环境替代服务端授权。
+
+## 原有 service 命令兼容
+
+此前基于标准应用绑定的接口仍保留：
+
+```sh
+numa gitops service configuration show --application kb-management --target TARGET_KEY --json
+numa gitops service configuration plan --application kb-management --target TARGET_KEY \
+  --revision REVISION_FROM_SHOW --replicas 2 --json
+```
+
+这条旧路径仍只编辑已存在的副本数字段，并保持 Jenkins 管理镜像语义；使用既有 `gitops service apply` 执行。新的独立配置与镜像编辑使用 `workload` 路径，无需走旧 import、legacy-image-migration 或平台构建快照机制。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@numa-tech/numa",
-  "version": "1.22.1",
+  "version": "1.23.1",
   "description": "Cross-platform CLI for the Numa internal developer platform with Keycloak authentication and MCP support.",
   "author": "numa-tech",
   "keywords": [
@@ -30,11 +30,13 @@
     "skills",
     "THIRD_PARTY_NOTICES.md",
     "docs/kb-access.md",
+    "docs/gitops-configuration.md",
     "docs/design/kb-cli.md",
     "scripts/export-kb-contract.py",
     "src/kb/openapi-contract.json",
     "docs/authorization-configuration-publication.md",
-    "docs/oss-policy-client-governance.md"
+    "docs/oss-policy-client-governance.md",
+    "docs/environment-configuration-publication.md"
   ],
   "scripts": {
     "clean": "node scripts/clean.mjs",
@@ -46,7 +48,7 @@
     "dev:oss-web": "tsx src/cli.ts oss web",
     "test:oss-web": "node --import tsx --test src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts src/oss/download-links.test.ts",
     "test:oss-auth-code": "node scripts/test-oss-auth-code.mjs",
-    "root:test": "node --import tsx --test --test-concurrency=4 src/mcp-gateway/profile.test.ts src/mcp-gateway/runtime.test.ts src/mcp-gateway/install.test.ts src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/profile-migration.test.ts src/identity.test.ts src/backend.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/mail/client.test.ts src/wecom/client.test.ts src/wecom/commands.test.ts src/wecom/tools.test.ts src/ai-registry/client.test.ts src/ai-registry/bootstrap.test.ts src/ai-registry/install-defaults.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/skill-uninstaller.test.ts src/ai-registry/skill-dependencies.test.ts src/ai-registry/updates.test.ts src/maintenance/scheduler.test.ts src/maintenance/codex.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/oss/client.test.ts src/oss/governance.test.ts src/oss/commands.test.ts src/oss/auth-code.test.ts src/oss/clipboard.test.ts src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts src/oss/download-links.test.ts src/oss/bootstrap.test.ts src/oss/transfers.test.ts src/oss/search.test.ts src/oss/tools.test.ts src/mcp/install.test.ts src/mcp/catalog.test.ts src/tasks/runtime.test.ts src/tasks/stdio.test.ts src/tasks/wecom-notify.test.ts src/tasks/oss-query.test.ts src/interactive/wizard.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/bootstrap-client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs src/authorization/enrollment.test.ts src/authorization/application-commands.test.ts src/authorization/application-client.test.ts src/authorization/application-schemas.test.ts src/authorization/enrollment-client.test.ts src/notion/client.test.ts src/notion/commands.test.ts src/notion/tools.test.ts src/notion/machine-cli.test.ts src/cloud/accounts.test.ts src/cloud/bootstrap.test.ts src/cloud/business-bootstrap.test.ts src/cloud/maintenance.test.ts src/cloud/wizard.test.ts src/cloud/oss-bootstrap.test.ts src/business-issuer.test.ts src/login-configuration.test.ts src/login-recovery.test.ts src/ai-registry/mcp-management.test.ts src/ai-registry/mcp-runtime.test.ts src/ai-registry/mcp-stdio.test.ts src/kb/client.test.ts src/kb/config.test.ts src/kb/commands.test.ts src/kb/login.test.ts src/kb/transfers.test.ts src/kb/contract.test.ts",
+    "root:test": "node --import tsx --test --test-concurrency=4 src/mcp-gateway/profile.test.ts src/mcp-gateway/runtime.test.ts src/mcp-gateway/install.test.ts src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/profile-migration.test.ts src/identity.test.ts src/backend.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/mail/client.test.ts src/wecom/client.test.ts src/wecom/commands.test.ts src/wecom/tools.test.ts src/ai-registry/client.test.ts src/ai-registry/bootstrap.test.ts src/ai-registry/install-defaults.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/compatibility/registry-instance.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/skill-uninstaller.test.ts src/ai-registry/skill-dependencies.test.ts src/ai-registry/updates.test.ts src/maintenance/scheduler.test.ts src/maintenance/codex.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/oss/client.test.ts src/oss/governance.test.ts src/oss/commands.test.ts src/oss/auth-code.test.ts src/oss/clipboard.test.ts src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts src/oss/download-links.test.ts src/oss/bootstrap.test.ts src/oss/transfers.test.ts src/oss/search.test.ts src/oss/tools.test.ts src/mcp/install.test.ts src/mcp/catalog.test.ts src/tasks/runtime.test.ts src/tasks/stdio.test.ts src/tasks/wecom-notify.test.ts src/tasks/oss-query.test.ts src/interactive/wizard.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/gitops/workload-input.test.ts src/gitops/workload-client.test.ts src/gitops/workload-commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/bootstrap-client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs src/authorization/enrollment.test.ts src/authorization/application-commands.test.ts src/authorization/application-client.test.ts src/authorization/application-schemas.test.ts src/authorization/enrollment-client.test.ts src/notion/client.test.ts src/notion/commands.test.ts src/notion/tools.test.ts src/notion/machine-cli.test.ts src/cloud/accounts.test.ts src/cloud/bootstrap.test.ts src/cloud/business-bootstrap.test.ts src/cloud/maintenance.test.ts src/cloud/wizard.test.ts src/cloud/oss-bootstrap.test.ts src/business-issuer.test.ts src/login-configuration.test.ts src/login-recovery.test.ts src/ai-registry/mcp-management.test.ts src/ai-registry/mcp-runtime.test.ts src/ai-registry/mcp-stdio.test.ts src/kb/client.test.ts src/kb/config.test.ts src/kb/commands.test.ts src/kb/login.test.ts src/kb/transfers.test.ts src/kb/contract.test.ts src/authorization/environment-governance-client.test.ts src/authorization/environment-governance-commands.test.ts src/authorization/environment-publication.test.ts",
     "pack:check": "turbo run pack:check root:pack:check",
     "root:pack:check": "node scripts/check-root-package.mjs",
     "boundaries": "node scripts/check-workspace-boundaries.mjs",
@@ -72,8 +74,8 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@numa-tech/cli-auth": "1.22.1",
-    "@tokensrc/codex": "1.22.1",
+    "@numa-tech/cli-auth": "1.23.1",
+    "@tokensrc/codex": "1.23.1",
     "ali-oss": "^6.23.0",
     "commander": "^14.0.3",
     "ink": "^6.8.0",