@numa-tech/numa 1.23.1 → 1.25.0

package/dist/mcp-gateway/runtime.js

@@ -8,6 +8,8 @@ import { AiRegistryError } from "../ai-registry/errors.js";
 import { gatewayError } from "./profile.js";
 const MAX_BYTES = 4 * 1024 * 1024;
 export function serviceEndpoint(binding, service) {
+    if (service === "@catalog" && binding.metadata.catalogMode === "NATIVE")
+        throw gatewayError("Native MCP has no directory bridge; select a published service.");
     if (service === "@catalog")
         return binding.baseUrl + "/catalog/mcp" + (binding.metadata.publishedEndpoints !== undefined ? `?gatewayId=${encodeURIComponent(binding.metadata.gatewayId)}` : "");
     if (!/^[a-z0-9][a-z0-9-]{0,62}$/u.test(service))
@@ -27,6 +29,8 @@ export function gatewayFetch(binding, auth, dependencies = {}, exactEndpoint) {
         const catalogPath = base.pathname + "/api/v1/catalog";
         const catalogRequest = url.pathname === catalogPath || /^\/[a-z0-9][a-z0-9-]{0,62}$/u.test(url.pathname.slice(catalogPath.length)) && url.pathname.startsWith(catalogPath + "/");
         const validQuery = !url.search || (catalogRequest || url.pathname === base.pathname + "/catalog/mcp") && [...url.searchParams.keys()].every(k => k === "gatewayId") && url.searchParams.getAll("gatewayId").length === 1 && url.searchParams.get("gatewayId") === binding.metadata.gatewayId;
+        if (binding.metadata.catalogMode === "NATIVE" && !binding.metadata.publishedEndpoints?.some(e => e.url === url.toString()))
+            throw gatewayError("MCP request escaped the published native endpoints.");
         const allowedPath = exactEndpoint ? url.origin + url.pathname === new URL(exactEndpoint).origin + new URL(exactEndpoint).pathname && url.search === new URL(exactEndpoint).search : catalogRequest || url.pathname.startsWith(base.pathname + "/");
         if (url.origin !== base.origin || !allowedPath || url.username || url.password || !validQuery || url.hash) {
             throw gatewayError("MCP request escaped the selected gateway application.");
@@ -117,6 +121,16 @@ export async function callGatewayTool(binding, auth, service, tool, argumentsVal
 export async function gatewayCatalog(binding, auth, service, dependencies = {}) {
     if (service)
         serviceEndpoint(binding, service);
+    if (binding.metadata.catalogMode === "NATIVE") {
+        // Listing published metadata is not a claim of runtime access. Inspection checks
+        // the selected server directly; a refusal never falls back to a Router.
+        const rows = (binding.metadata.publishedEndpoints ?? []).map(endpoint => ({ ...endpoint,
+            gatewayId: binding.metadata.gatewayId, source: "PROFILE" }));
+        if (!service)
+            return { services: rows, source: "PROFILE" };
+        return { ...rows.find(row => row.serviceId === service),
+            ...(await listGatewayTools(binding, auth, service, dependencies)) };
+    }
     try {
         const response = await gatewayFetch(binding, auth, dependencies)(binding.baseUrl + "/api/v1/catalog" + (service ? `/${service}` : "") + (binding.metadata.publishedEndpoints !== undefined ? `?gatewayId=${encodeURIComponent(binding.metadata.gatewayId)}` : ""));
         if (!response.ok)

package/dist/mcp-gateway/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/mcp-gateway/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,yBAAyB,EAAkC,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAuB,MAAM,cAAc,CAAC;AAEjE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAGlC,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,OAAe;IACtE,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC,OAAO,GAAG,cAAc,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChM,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,YAAY,CAAC,2BAA2B,CAAC,CAAC;IACjG,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC;QACxF,IAAI,CAAC,QAAQ;YAAE,MAAM,YAAY,CAAC,gEAAgE,CAAC,CAAC;QACpG,OAAO,QAAQ,CAAC,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,OAAO,aAAa,OAAO,MAAM,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAuB,EAAE,IAAgB,EAAE,YAAY,GAAwB,EAAE,EAAE,aAAsB;IACpI,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,GAAG,iBAAiB,CAAC;QACtD,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC;QACjL,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC7R,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;QACnP,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC1G,MAAM,YAAY,CAAC,uDAAuD,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;YAC1J,GAAG,YAAY,EAAE,iBAAiB,EAAE,KAAK;SAC1C,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,YAAY,CAAC,oCAAoC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,SAAS,EAAE,CAAC;YAC/D,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,YAAY,CAAC,8CAA8C,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC;QACpC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,eAAe,CAAyB;YACpF,SAAS,CAAC,KAAK,EAAE,UAAU;gBACzB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;gBACzB,IAAI,IAAI,GAAG,SAAS;oBAAE,MAAM,YAAY,CAAC,8CAA8C,CAAC,CAAC;gBACzF,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;SACF,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACxH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAe,EAAE,YAAY,GAAwB,EAAE;IACjI,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,SAAS,KAAK,KAAK;QAAE,MAAM,YAAY,CAAC,mGAAmG,CAAC,CAAC;IAC1N,OAAO,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;AAChL,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,eAAe;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAC;IACjD,MAAM,MAAM,GAAI,KAA8C,EAAE,MAAM,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtJ,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,eAAe,CAAC,mCAAmC,MAAM,IAAI,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACjJ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,mHAAmH,EAAE,4BAA4B,CAAC,CAAC;IACxO,OAAO,YAAY,CAAC,uFAAuF,EAAE,4BAA4B,CAAC,CAAC;AAC7I,CAAC;AAED,KAAK,UAAU,UAAU,CAAI,OAAuB,EAAE,IAAgB,EAAE,OAAe,EAAE,YAAiC,EAAE,SAAyC;IACnK,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IAClF,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC3H,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC,EAAE,YAAY,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;SACnL,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;YACnC,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAe,EAAE,YAAY,GAAwB,EAAE;IACvI,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;QACrE,MAAM,KAAK,GAAsD,EAAE,CAAC;QACpE,IAAI,MAA0B,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;gBAAE,MAAM,YAAY,CAAC,qBAAqB,CAAC,CAAC;YACnE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,YAAY,CAAC,yCAAyC,CAAC,CAAC;YACpF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAe,EAAE,IAAY,EAAE,cAAuC,EAAE,YAAY,GAAwB,EAAE;IAC7L,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;AAC1L,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAgB,EAAE,YAAY,GAAwB,EAAE;IACtI,IAAI,OAAO;QAAE,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,iBAAiB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnQ,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,sCAAsC,QAAQ,CAAC,MAAM,IAAI,EAAE,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtJ,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,YAAY,CAAC,iCAAiC,CAAC,CAAC;QACrG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,CAAC,EAAE,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,MAAM,YAAY,CAAC,0EAA0E,CAAC,CAAC;QAClb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO;YAAE,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAC;QAC3G,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAe;IAC/F,IAAI,CAAC;QAAC,MAAM,mBAAmB,CAAC,IAAI,oBAAoB,EAAE,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,CAAC;IACxG,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/mcp-gateway/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,yBAAyB,EAAkC,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAuB,MAAM,cAAc,CAAC;AAEjE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAGlC,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,OAAe;IACtE,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,iEAAiE,CAAC,CAAC;IAC/J,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC,OAAO,GAAG,cAAc,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChM,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,YAAY,CAAC,2BAA2B,CAAC,CAAC;IACjG,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC;QACxF,IAAI,CAAC,QAAQ;YAAE,MAAM,YAAY,CAAC,gEAAgE,CAAC,CAAC;QACpG,OAAO,QAAQ,CAAC,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,OAAO,aAAa,OAAO,MAAM,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAuB,EAAE,IAAgB,EAAE,YAAY,GAAwB,EAAE,EAAE,aAAsB;IACpI,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,GAAG,iBAAiB,CAAC;QACtD,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC;QACjL,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC7R,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAAE,MAAM,YAAY,CAAC,qDAAqD,CAAC,CAAC;QACtM,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;QACnP,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC1G,MAAM,YAAY,CAAC,uDAAuD,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;YAC1J,GAAG,YAAY,EAAE,iBAAiB,EAAE,KAAK;SAC1C,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,YAAY,CAAC,oCAAoC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,SAAS,EAAE,CAAC;YAC/D,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,YAAY,CAAC,8CAA8C,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC;QACpC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,eAAe,CAAyB;YACpF,SAAS,CAAC,KAAK,EAAE,UAAU;gBACzB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;gBACzB,IAAI,IAAI,GAAG,SAAS;oBAAE,MAAM,YAAY,CAAC,8CAA8C,CAAC,CAAC;gBACzF,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;SACF,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACxH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAe,EAAE,YAAY,GAAwB,EAAE;IACjI,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,SAAS,KAAK,KAAK;QAAE,MAAM,YAAY,CAAC,mGAAmG,CAAC,CAAC;IAC1N,OAAO,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;AAChL,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,eAAe;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAC;IACjD,MAAM,MAAM,GAAI,KAA8C,EAAE,MAAM,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtJ,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,eAAe,CAAC,mCAAmC,MAAM,IAAI,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACjJ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,mHAAmH,EAAE,4BAA4B,CAAC,CAAC;IACxO,OAAO,YAAY,CAAC,uFAAuF,EAAE,4BAA4B,CAAC,CAAC;AAC7I,CAAC;AAED,KAAK,UAAU,UAAU,CAAI,OAAuB,EAAE,IAAgB,EAAE,OAAe,EAAE,YAAiC,EAAE,SAAyC;IACnK,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IAClF,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC3H,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC,EAAE,YAAY,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;SACnL,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;YACnC,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAe,EAAE,YAAY,GAAwB,EAAE;IACvI,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;QACrE,MAAM,KAAK,GAAsD,EAAE,CAAC;QACpE,IAAI,MAA0B,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;gBAAE,MAAM,YAAY,CAAC,qBAAqB,CAAC,CAAC;YACnE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,YAAY,CAAC,yCAAyC,CAAC,CAAC;YACpF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAe,EAAE,IAAY,EAAE,cAAuC,EAAE,YAAY,GAAwB,EAAE;IAC7L,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;AAC1L,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAgB,EAAE,YAAY,GAAwB,EAAE;IACtI,IAAI,OAAO;QAAE,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC9C,iFAAiF;QACjF,wEAAwE;QACxE,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ;YACrF,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC3D,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO,CAAC;YACrD,GAAG,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,iBAAiB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnQ,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,sCAAsC,QAAQ,CAAC,MAAM,IAAI,EAAE,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtJ,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,YAAY,CAAC,iCAAiC,CAAC,CAAC;QACrG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,CAAC,EAAE,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,MAAM,YAAY,CAAC,0EAA0E,CAAC,CAAC;QAClb,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO;YAAE,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAC;QAC3G,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE,IAAgB,EAAE,OAAe;IAC/F,IAAI,CAAC;QAAC,MAAM,mBAAmB,CAAC,IAAI,oBAAoB,EAAE,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,CAAC;IACxG,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AAC3C,CAAC"}

package/docs/design/kb-cli.md

@@ -27,11 +27,11 @@
 
 ## 认证与地址
 
-平台 profile 可声明 `services.kb`，由服务自己的 authority/audience 选择 Numa 已有 Keycloak 凭据。无 profile 时显式使用 `NUMA_KB_BASE_URL`；不把平台管理 API 地址推断为 KB 地址。有 profile 时不允许 env 把 KB 请求换到其他服务。API Key 由 `NUMA_KB_API_KEY` 或 `NUMA_KB_API_KEY_FILE` 提供（二者互斥）；不进入命令参数、检查点、日志。
+平台 profile 可声明 `services.kb`，由服务自己的 authority/audience 选择 Numa 已有 Keycloak 凭据。无 profile 时显式使用 `NUMA_KB_BASE_URL`；不把平台管理 API 地址推断为 KB 地址。有 profile 时不允许 env 把 KB 请求换到其他服务。显式旧 Key 模式才读取 `NUMA_KB_API_KEY` 或 `NUMA_KB_API_KEY_FILE`（二者互斥）；默认 JWT 模式忽略旧 Key 配置。凭据不进入 Skill、命令参数、检查点、日志。
 
-独立服务登录使用 `numa login --service kb --no-console --no-config`；同一选项也用于 auth status/logout、profile，确保登录与请求使用同一 authority/audience 缓存。
+独立服务登录使用 `numa login --service kb --no-console --no-config`；同一选项也用于 auth status/logout、profile，确保登录与请求使用同一 authority/audience 缓存。默认采用 `services.kb.authority`；显式 `--issuer` 复用已有 `services.kb.issuerAuthorities` 白名单和解析器，KB 请求、登录及会话管理使用同一选项。未知别名拒绝；失败后的登录恢复命令保留所选别名，不新增身份路由或缓存机制。
 
-默认 `NUMA_KB_AUTH_MODE=keycloak`：KB 控制请求携带当前 Numa Keycloak Bearer 与 X-Api-Key。明确配置 `api-key` 模式时只用 KB API Key，适合不要求 Keycloak 的部署；不得在鉴权失败后自动降级。HTTP 仅允许 loopback 测试地址，其他地址 HTTPS，禁止 URL 内嵌凭据、查询或 fragment。代理下载必须落在同一 KB 服务路径内才可附带身份；OSS 签名 URL 不带 KB/Keycloak 凭据，不跟随重定向。
+默认 `NUMA_KB_AUTH_MODE=keycloak`：KB 控制请求及同源代理上传/下载仅携带所选服务的 Numa Keycloak Bearer，不发送 X-Api-Key。明确配置 `api-key` 模式时只用旧 KB API Key，适合仍支持该协议的部署；不得发送双头或在鉴权失败后自动降级。Skill 直接调用 CLI，不增加 MCP 注册、独立登录体系或另一套服务选择逻辑。HTTP 仅允许 loopback 测试地址，其他地址 HTTPS，禁止 URL 内嵌凭据、查询或 fragment。代理下载必须落在同一 KB 服务路径内才可附带身份；OSS 签名 URL 不带 KB/Keycloak 凭据，不跟随重定向。
 
 ## API client 与契约
 
@@ -45,7 +45,7 @@
 
 扫描/计算 SHA256 与 Base64 MD5 → 保存私有 manifest → 创建/恢复会话 → 读取待传文件签名 → 并发 PUT → complete → submitted → 可选轮询解析。
 
-manifest 版本化，包含目标绑定、collectionId、本地绝对路径和内容摘要、按批固定 requestId、sessionId/batchId；不含 Token、API Key、签名 URL。文件 0600、父目录 0700、原子更新；持有互斥锁防止两个进程使用同一状态文件。恢复时重新验证文件内容和目标绑定，源变化拒绝；创建响应丢失时复用原 requestId。异常保留 state 路径；Ctrl-C 中止活动传输并保留恢复记录。已经 submitted 的会话不重新上传或创建任务。
+manifest 版本化，包含目标绑定、collectionId、本地绝对路径和内容摘要、按批固定 requestId、sessionId/batchId；不含 Token、API Key、签名 URL。文件 0600、父目录 0700、原子更新；持有互斥锁防止两个进程使用同一状态文件。恢复时重新验证文件内容和目标绑定，源变化拒绝；创建响应丢失时复用原 requestId。JWT 绑定摘要不包含旧 Key，保留地址、认证模式、租户和 Issuer/Client/Audience；旧双头绑定不自动迁移。摘要不含登录用户 subject，KB 必须继续校验上传会话所有者，不能以本地摘要充当用户授权。异常保留 state 路径；Ctrl-C 中止活动传输并保留恢复记录。已经 submitted 的会话不重新上传或创建任务。
 
 PUT 过期/结果未知后先向 KB 查询并续签，已存在对象按服务端状态处理。本地读取期间检测变化；遵守票据 method/headers/size，校验错误不继续 complete。检查点表示传输进度，不替代服务端的 SHA256 验证。代理模式使用外部 `/api/v1/external/documents/batch-upload`，显式传 `conflict_policy=reject`，按批同 request_id 和原内容恢复，任务 ID 保存在相同 manifest。后端保留旧 detect/force_upload 默认和行为；reject 在有候选冲突时返回 409，不自动切换版本。旧后端不支持 reject 时明确失败，不降级 detect。
 

package/docs/kb-access.md

@@ -6,9 +6,7 @@
 
 平台 Profile 提供 `services.kb` 时，CLI 使用其服务地址、身份源与 audience。没有 Profile 时需显式配置 `NUMA_KB_BASE_URL`，其值是包含网关服务前缀的根地址，例如 `https://gateway.example.com/kb-management`，不追加 `/api/v1`。有 Profile 时不能用环境变量改到其他服务。
 
-KB API Key 使用 `NUMA_KB_API_KEY_FILE` 指向已有的私有凭据文件，或使用 `NUMA_KB_API_KEY` 环境变量，二者不能同时配置。Key 应由知识库授权主体签发，范围覆盖目标知识库和所需操作。不要将 Key 写入命令参数或检查点。
-
-默认同时使用 Keycloak 和 API Key。独立 KB 服务使用对应的登录缓存：
+默认 `NUMA_KB_AUTH_MODE=keycloak`，仅使用所选服务的 Keycloak Bearer JWT，不要求或发送 KB API Key。Skill 可直接执行 `numa kb`，无需注册 MCP；CLI 复用现有服务 Profile、登录缓存及 Token 刷新能力。独立 KB 服务使用对应的登录缓存：
 
 ```bash
 numa login --service kb --no-console --no-config
@@ -16,9 +14,18 @@ numa auth status --service kb --json
 numa profile --service kb --json
 ```
 
-机器身份沿用 Numa 的 `NUMA_KEYCLOAK_AUTH_MODE=client_credentials` 和专用 client 配置，无需浏览器登录。对只要求 KB API Key 的部署，可显式设置 `NUMA_KB_AUTH_MODE=api-key`。CLI 不会在认证失败时自动降级或更换身份。
+机器身份沿用 Numa 的 `NUMA_KEYCLOAK_AUTH_MODE=client_credentials` 和专用 client 配置，无需浏览器登录。仅对仍支持旧 KB API Key 的部署，可显式设置 `NUMA_KB_AUTH_MODE=api-key`，再用 `NUMA_KB_API_KEY_FILE` 指向私有凭据文件，或设置 `NUMA_KB_API_KEY`（二者互斥）。该模式仅发送 Key，不发送 Bearer。默认 JWT 模式忽略这两个旧 Key 配置，即使环境中仍残留，也不会读取 Key 文件或发送双头。CLI 不会在认证失败时自动降级或更换身份。不要将凭据写入 Skill、命令参数或检查点。
+
+Profile 的 `services.kb.authority` 是默认身份源；如平台同时下发了 `services.kb.issuerAuthorities`，可使用已有的 `--issuer` 选择其中的别名。登录、状态、请求和退出必须选择相同别名：
+
+```bash
+numa login --service kb --issuer BUSINESS_ALIAS --no-console --no-config
+numa auth status --service kb --issuer BUSINESS_ALIAS --json
+numa --issuer BUSINESS_ALIAS kb collections list --json
+numa auth logout --service kb --issuer BUSINESS_ALIAS
+```
 
-退出 KB 登录使用 `numa auth logout --service kb`。这不会删除其他服务的缓存。
+不传 `--issuer` 时使用平台默认配置；未知别名和未下发的身份源会被拒绝，不接受任意 Issuer URL。该选项只选择服务允许的身份源，不改变 KB 服务地址。退出只删除对应 Issuer/Client/租户/Audience 的会话缓存。
 
 ## 基本操作
 
@@ -55,7 +62,7 @@ numa kb tasks status TASK --wait --timeout 600 --json
 numa kb tasks retry TASK --json
 ```
 
-首次上传在传输前保存检查点；不指定 `--state-file` 时自动生成，并在回执中返回路径。检查点只保存目标绑定、文件摘要、固定请求 ID、会话和任务 ID，不保存 API Key、Token 或签名 URL。上传中断后保留该文件，使用相同文件源和凭据配置运行 `--resume`；本地文件变化或目标身份变化时拒绝恢复。
+首次上传在传输前保存检查点；不指定 `--state-file` 时自动生成，并在回执中返回路径。检查点只保存目标绑定、文件摘要、固定请求 ID、会话和任务 ID，不保存 API Key、Token 或签名 URL。上传中断后保留该文件，使用相同文件源和凭据配置运行 `--resume`；本地文件变化或目标绑定变化时拒绝恢复。绑定包含服务地址、认证模式、配置的租户、Issuer、Client 和 Audience；它不是当前登录用户的标识，不能代替 KB 对会话所有者的校验。旧的 JWT + Key 检查点因认证绑定变化会被拒绝复用；先查询原任务/会话结果，再决定是否发起新上传，勿直接重复提交。
 
 恢复是文件级：向 KB 查询哪些对象已上传，跳过已上传项，只重新传输缺失项。单次 PUT 中断后从该文件起点重新开始。CLI 不会为已提交的会话重复创建解析任务。Ctrl-C 中止当前工作并保留恢复记录。
 
@@ -82,4 +89,4 @@ npm run test:kb
 npm run root:typecheck
 ```
 
-去掉 `--check` 可在审查服务端变化后更新快照。导出不连接部署环境，不加载真实业务数据。受控本地 HTTP 测试覆盖协议和文件行为，不能代替目标环境的真实网关、Keycloak、API Key 和 OSS 联调。
+去掉 `--check` 可在审查服务端变化后更新快照。导出不连接部署环境，不加载真实业务数据。受控本地 HTTP 测试覆盖协议和文件行为，不能代替目标环境的真实网关、Keycloak 和 OSS 联调（旧 Key 模式另行验证）。

package/docs/keycloak-managed-import.md

@@ -0,0 +1,41 @@
+# Keycloak 受管配置导入导出
+
+CLI 使用当前 Numa 平台登录身份调用 DevOps API；管理凭据由平台保存。使用前运行 `numa doctor`，确认平台 API 与登录目标。
+
+受管声明包使用 `kind: KEYCLOAK_API_KEY_CONFIGURATION`、`schemaVersion: "1"`。它引用平台登记的 Issuer、应用、环境和 Client，不接受任意 Realm dump、脚本、用户、密码、Secret 或 API Key 数据。Web 和 CLI 使用同一套保存、预览、发布及回读流程。
+
+```sh
+numa authorization keycloak-config capabilities <issuer-id>
+numa authorization keycloak-config show --issuer-id <issuer-id> --app <application-id> --platform-environment-id <environment-id>
+numa authorization keycloak-config export --issuer-id <issuer-id> --app <application-id> --platform-environment-id <environment-id> --view current --output declaration.json
+```
+
+编辑声明后，将 `show` 返回的 `version`、`issuerVersion`、`intentVersion` 分别放入保存请求的 `expectedVersion`、`expectedIssuerVersion`、`expectedIntentVersion`，声明放入 `configuration`。保存发生版本冲突时重新读取并编辑，CLI 不自动覆盖。
+
+```sh
+numa authorization keycloak-config save <issuer-id> --file save-request.json --yes
+numa authorization keycloak-config preview --file declaration.json --request-id <new-request-uuid>
+```
+
+保存只修改平台当前配置。预览返回既有发布作业；审核具体差异后，使用 `authorization application publication` 的执行、查询和重新核验命令继续。创建预览不会向 Keycloak 写配置。网络中断后先查询原作业，不能通过重新生成请求 ID 猜测原操作结果。
+
+首次纳管缺少字段基线时，先核对观察结果；确认后可在保存命令中使用 `--adopt-current-fields`。它仅采纳受控字段，不采纳整个 Client，也不执行远端修改。
+
+`export --view observed` 导出只读观察快照，类型为 `KEYCLOAK_MANAGED_OBSERVATION`，不能作为保存或预览输入。`--view current` 导出可编辑声明。导出文件以仅当前用户可读写权限创建，拒绝覆盖已有文件；输入文件最大 2 MiB，拒绝符号链接。
+
+Realm/Profile 变更需要页面引导的短期管理员 bootstrap。CLI 不接收管理员密码，也不把高权限 Token 保存到作业。发布会保留其他应用的授权贡献及受控字段以外的配置；出现归属、基线或回读冲突时，先处理该作业的具体阻断项。
+
+对已结束或已终止的受管导入作业，可生成恢复预览：
+
+```sh
+numa authorization keycloak-config restore-preview <source-job-id> --app <application-id> --file recovery-request.json
+```
+
+请求文件只含新的 `requestId`、原作业的 `expectedVersion` 和 `expectedDigest`。平台从原任务记录生成反向差异，不接受自带反向字段或任意 JSON Patch。预览仍需审核并通过现有发布命令执行；远端已被其他操作修改、对象依赖或归属无法确认时会阻断，保留保护规则等事项会明确列出。停止原任务不等于撤销已生效配置。
+
+
+### Client 配置唯一来源与保存版本
+
+交换 Client 开关保存到应用 Client 的 `definition.configuration.apiKeyEnabled`：省略保留远端，false 停用，true 启用。v1 声明包仍使用 `exchangeClient.enabled` 导入导出，服务端转换到同一份 Client 定义。
+
+`save` 输入必须额外携带 `expectedExchangeClientVersion`。已有声明从 `show` 返回的 `exchangeClientVersion` 获取；首次选择或更换 Client，用 `show --exchange-client-instance-id <uuid>` 读取指定目标修订，返回的 `exchangeClientInstanceId` 必须与声明一致。先读取再编辑；冲突后核对重新编辑，不自动读取最新版并重试写入。

package/examples/jev/README.md

@@ -0,0 +1,65 @@
+# Jev 三场景接入样例
+
+本目录和 [numa-jev Skill](../../skills/numa-jev/SKILL.md) 是源码交付；未发布到企业仓库，未部署到目标环境。OpenRouter 仅由 DevOps 平台经指定代理调用。测试完全离线，不使用真实 Key 或推理额度。
+
+## 终端 Agent / WorkBuddy
+
+分别安装经过核验的 Skill 与 MCP 资源。安装步骤沿用 [Numa Skills/MCP 工作流](../../skills/numa-cli/references/skills-workflows.md)，不要将资源名、namespace、instance、版本猜成文档中的示例值。
+
+工具发现后调用 `numa_jev_capabilities({})`。将 [合成请求](../../skills/numa-jev/assets/decision.json) 放入 `numa_jev_decide` 参数的 `body` 中。成功取 `structuredContent.data.answers`；HTTP API 不使用这个封装。连接、Jev 权限、上游能力分别核验。
+
+## ChatGPT
+
+目标为正式远程 HTTPS MCP + 用户 OAuth，使用同样的工具合同。现有源码的本地 stdio 服务或安装 Skill 不能证明该链路可用。上线必须补齐远程 OAuth 兼容、实际 Router 导出和客户端连接验证；工具说明承担本地 Skill 中必要的用法指导。
+
+验收时用真实授权测试用户检查：连接 OAuth 完成、工具可见、capabilities 可读、一次合成请求成功；无 Jev 权限的身份不能执行推理。这里只列验收步骤，不执行外部调用或创建连接。
+
+## K8s 自研 Agent
+
+[platform-client.ts](platform-client.ts) 展示固定平台地址、服务令牌注入、无自动重放的 HTTP 调用。它是供复制调整的薄示例，不是已发布 SDK；业务应按自己的 schema 检查答案类型/概率并应用经过验证的阈值。网关前缀保留在 base URL 中，例如 `https://platform.example.invalid/devops`。
+
+Node 应用可复用已核实版本的 `@numa-tech/cli-auth`，而非自己保存/解析用户 token 缓存：
+
+```ts
+import { ensureAccessToken, type AuthConfig } from "@numa-tech/cli-auth";
+import { createJevClient } from "./platform-client.js";
+
+// All values come from the workload's reviewed environment configuration.
+// JEV_OIDC_CLIENT_SECRET is injected by a K8s Secret, never committed.
+const auth: AuthConfig = {
+  authenticationMode: "client_credentials",
+  discoveryUrl: process.env.JEV_OIDC_DISCOVERY_URL!,
+  issuerUrl: process.env.JEV_OIDC_ISSUER!,
+  clientId: process.env.JEV_OIDC_CLIENT_ID!,
+  clientSecret: process.env.JEV_OIDC_CLIENT_SECRET!,
+  scope: process.env.JEV_OIDC_SCOPE ?? "",
+  // Required by the shared config type; machine mode never writes user caches.
+  tokenFile: "/unused-in-client-credentials-mode",
+  redirectHost: "127.0.0.1",
+  redirectPort: 8765,
+  redirectPath: "/callback",
+  openBrowser: false
+};
+const client = createJevClient({
+  platformBaseUrl: process.env.JEV_PLATFORM_BASE_URL!,
+  getAccessToken: () => ensureAccessToken(auth)
+});
+// Call client.decide(request) inside the application's authorized workflow.
+// Validate required environment variables at service startup. Do not log auth.
+```
+
+部署配置应包含平台/issuer 地址、独立服务 client、Secret 注入、相应 Jev 功能授权及到这些企业服务的网络权限。`OPENROUTER_API_KEY`、代理配置及代理认证仅归平台。若应用自身使用出网代理访问企业服务，按现有客户端网络配置处理；不能以此替代平台的 OpenRouter 代理绑定。
+
+## 离线验证与待验收项
+
+从 Numa 仓库根目录运行：
+
+```sh
+node --import tsx --test examples/jev/platform-client.test.ts
+```
+
+测试验证路径前缀、HTTP/MCP 请求分层、每次操作令牌获取、鉴权失败不调用平台、401/403/429/5xx/断连无重放、缺少答案失败及禁止凭据 URL。合成答案只用于 transport 测试，不表示模型质量。
+
+示例仅保留白名单平台错误码和 HTTP 状态，有界读取错误响应；身份 SDK 的原始异常转换为 `IDENTITY_UNAVAILABLE`，且不会派发推理请求。遇到新增未知错误码仍保留状态，按平台维护后的白名单更新示例，不输出上游原文。
+
+目标环境上线后另外验证：用户与服务身份授权；OpenRouter 必须有代理；代理停用后无直连回退；ChatGPT OAuth 的真实往返；用量与审计归属正确。真实端到端验收会调用收费上游，须使用新配置的有效密钥与明确授权的环境。本目录离线验证不宣称这些上线项完成。

package/examples/jev/platform-client.test.ts

@@ -0,0 +1,136 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+import { createJevClient, JevCallError, type JevRequest } from "./platform-client.js";
+
+const body: JevRequest = JSON.parse(await readFile(new URL("../../skills/numa-jev/assets/decision.json", import.meta.url), "utf8"));
+const responseBody = {
+  model: "synthetic-offline-fixture",
+  answers: {
+    urgent: { type: "noul", noul: 0.9 },
+    department: { type: "choice", choice: "billing", probabilities: { billing: 0.85, technical: 0.05, sales: 0.05, other: 0.05 }, confidence: 0.6 },
+    frustration: { type: "score", score: 1.1, legend: { "0": "calm", "1": "frustrated", "2": "angry" }, probabilities: { "0": 0.1, "1": 0.7, "2": 0.2 }, confidence: 0.3 }
+  },
+  usage: { input_tokens: 0, output_tokens: 0 },
+  id: "offline-fixture"
+};
+
+test("K8s HTTP transport preserves the gateway prefix and sends only the platform contract", async () => {
+  let calls = 0;
+  const client = createJevClient({
+    platformBaseUrl: "https://platform.example.invalid/devops/",
+    getAccessToken: async () => "fake-platform-token",
+    fetch: async (input, init) => {
+      calls++;
+      assert.equal(String(input), "https://platform.example.invalid/devops/api/v1/jev/decisions");
+      assert.equal(init?.redirect, "error");
+      assert.equal(new Headers(init?.headers).get("authorization"), "Bearer fake-platform-token");
+      assert.deepEqual(JSON.parse(String(init?.body)), body);
+      assert.equal(init?.method, "POST");
+      return Response.json(responseBody);
+    }
+  });
+  assert.deepEqual(await client.decide(body), responseBody);
+  assert.equal(calls, 1);
+});
+
+for (const status of [401, 403, 429, 502, 503]) {
+  test(`HTTP ${status} never triggers a second possibly billable POST`, async () => {
+    let calls = 0;
+    const client = createJevClient({
+      platformBaseUrl: "https://platform.example.invalid",
+      getAccessToken: async () => "fake-platform-token",
+      fetch: async () => {
+        calls++;
+        return Response.json({ message: "private-upstream-detail" }, { status });
+      }
+    });
+    await assert.rejects(client.decide(body), (error: unknown) => {
+      assert.ok(error instanceof JevCallError);
+      assert.equal(error.status, status);
+      assert.equal(error.message.includes("private-upstream-detail"), false);
+      return true;
+    });
+    assert.equal(calls, 1);
+  });
+}
+
+test("network interruption is unknown result, not a new request or direct fallback", async () => {
+  let calls = 0;
+  const client = createJevClient({
+    platformBaseUrl: "https://platform.example.invalid",
+    getAccessToken: async () => "fake-platform-token",
+    fetch: async () => { calls++; throw new Error("transport detail containing credentials"); }
+  });
+  await assert.rejects(client.decide(body), { code: "RESULT_UNKNOWN" });
+  assert.equal(calls, 1);
+});
+
+test("missing answers cannot be consumed as a successful empty decision", async () => {
+  const client = createJevClient({
+    platformBaseUrl: "https://platform.example.invalid",
+    getAccessToken: async () => "fake-platform-token",
+    fetch: async () => Response.json({ model: "fixture", answers: {} })
+  });
+  await assert.rejects(client.decide(body), { code: "MISSING_ANSWER" });
+});
+
+test("identity failure prevents dispatch and token is acquired per logical operation", async () => {
+  let tokenRequests = 0;
+  let calls = 0;
+  const client = createJevClient({
+    platformBaseUrl: "https://platform.example.invalid",
+    getAccessToken: async () => {
+      if (++tokenRequests === 2) throw new Error("issuer raw error containing fixture-secret");
+      return "fake-platform-token";
+    },
+    fetch: async () => { calls++; return Response.json(responseBody); }
+  });
+  await client.decide(body);
+  await assert.rejects(client.decide(body), (error: unknown) => {
+    assert.ok(error instanceof JevCallError);
+    assert.equal(error.code, "IDENTITY_UNAVAILABLE");
+    assert.equal(error.message.includes("fixture-secret"), false);
+    assert.equal(error.cause, undefined);
+    return true;
+  });
+  assert.equal(tokenRequests, 2);
+  assert.equal(calls, 1);
+});
+
+test("known platform codes survive while provider details and unknown codes stay private", async () => {
+  for (const code of ["OUTBOUND_PROXY_REQUIRED", "JEV_AUDIT_UNAVAILABLE", "fixture-secret"]) {
+    const client = createJevClient({
+      platformBaseUrl: "https://platform.example.invalid",
+      getAccessToken: async () => "fake-platform-token",
+      fetch: async () => Response.json({ code, message: "fixture-secret" }, { status: 503 })
+    });
+    await assert.rejects(client.decide(body), (error: unknown) => {
+      assert.ok(error instanceof JevCallError);
+      assert.equal(error.code, code === "fixture-secret" ? "PLATFORM_HTTP_ERROR" : code);
+      assert.equal(error.status, 503);
+      assert.equal(error.message.includes("fixture-secret"), false);
+      return true;
+    });
+  }
+});
+
+test("oversized error streams are cancelled before interpreting untrusted error content", async () => {
+  let cancelled = false;
+  const client = createJevClient({
+    platformBaseUrl: "https://platform.example.invalid",
+    getAccessToken: async () => "fake-platform-token",
+    fetch: async () => new Response(new ReadableStream<Uint8Array>({
+      start(controller) { controller.enqueue(new Uint8Array(16 * 1024 + 1)); },
+      cancel() { cancelled = true; }
+    }), { status: 502 })
+  });
+  await assert.rejects(client.decide(body), { status: 502, code: "PLATFORM_HTTP_ERROR" });
+  assert.equal(cancelled, true);
+});
+
+test("caller credentials cannot be placed in a URL and HTTPS is required", () => {
+  for (const platformBaseUrl of ["http://platform.example.invalid", "https://user:secret@platform.example.invalid", "https://platform.example.invalid?token=secret"]) {
+    assert.throws(() => createJevClient({ platformBaseUrl, getAccessToken: async () => "unused" }), /trusted HTTPS/u);
+  }
+});

package/examples/jev/platform-client.ts

@@ -0,0 +1,122 @@
+/** Example transport for K8s services. No upstream key, proxy, or retry logic. */
+export interface JevRequest {
+  state: string | Record<string, unknown> | unknown[];
+  questions: Record<string, unknown>;
+  model?: string;
+}
+
+export interface JevResult {
+  model: string;
+  answers: Record<string, unknown>;
+  usage?: Record<string, unknown>;
+  id?: string;
+  provider?: string;
+  [key: string]: unknown;
+}
+
+export class JevCallError extends Error {
+  constructor(public readonly status: number | undefined, public readonly code: string) {
+    // Do not include request data, bearer tokens, or the upstream error body.
+    super(`Jev call failed (${status ?? "transport"}, ${code}); not retried.`);
+    this.name = "JevCallError";
+  }
+}
+
+const SAFE_PLATFORM_CODES = new Set([
+  "JEV_ACCESS_DENIED", "JEV_AUTHENTICATION_REQUIRED", "JEV_PERMISSION_UNAVAILABLE",
+  "JEV_INVALID_REQUEST", "JEV_REQUEST_TOO_LARGE", "JEV_INVALID_RESPONSE", "JEV_NOT_CONFIGURED",
+  "JEV_BUSY", "JEV_AUDIT_UNAVAILABLE", "JEV_BALANCE_INSUFFICIENT", "JEV_RATE_LIMITED",
+  "JEV_PROXY_AUTH_REQUIRED", "JEV_UPSTREAM_FORBIDDEN", "JEV_UPSTREAM_REJECTED",
+  "JEV_UPSTREAM_TIMEOUT", "JEV_UPSTREAM_UNAUTHORIZED", "JEV_UPSTREAM_UNAVAILABLE",
+  "OUTBOUND_PROXY_REQUIRED", "OUTBOUND_PROXY_UNAVAILABLE", "OUTBOUND_PROXY_AUTH_REQUIRED",
+  "OUTBOUND_CONNECT_FAILED", "OUTBOUND_CREDENTIAL_UNAVAILABLE", "OUTBOUND_INVALID_CONFIGURATION"
+]);
+
+async function safeErrorCode(response: Response): Promise<string> {
+  const fallback = "PLATFORM_HTTP_ERROR";
+  const reader = response.body?.getReader();
+  if (!reader) return fallback;
+  try {
+    let bytes = 0;
+    let text = "";
+    const decoder = new TextDecoder();
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      bytes += chunk.value.byteLength;
+      if (bytes > 16 * 1024) return fallback;
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+    const value: unknown = JSON.parse(text + decoder.decode());
+    if (value && typeof value === "object" && "code" in value
+        && typeof value.code === "string" && SAFE_PLATFORM_CODES.has(value.code)) return value.code;
+    return fallback;
+  } catch {
+    return fallback;
+  } finally {
+    await reader.cancel().catch(() => undefined);
+    reader.releaseLock();
+  }
+}
+
+export function createJevClient(options: {
+  platformBaseUrl: string;
+  getAccessToken: () => Promise<string>;
+  fetch?: typeof fetch;
+  timeoutMs?: number;
+}) {
+  const base = new URL(options.platformBaseUrl);
+  if (base.protocol !== "https:" || base.username || base.password || base.search || base.hash) {
+    throw new Error("Configure a trusted HTTPS platform base URL without credentials, query, or fragment.");
+  }
+  base.pathname = `${base.pathname.replace(/\/+$/u, "")}/api/v1/jev/decisions`;
+  const timeoutMs = options.timeoutMs ?? 45_000;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new Error("timeoutMs must be positive.");
+
+  return {
+    async decide(body: JevRequest): Promise<JevResult> {
+      // Fetch a current service token for each operation; the identity provider
+      // wrapper owns expiry-aware in-memory caching, not this transport.
+      let token: string;
+      try {
+        token = await options.getAccessToken();
+        if (!token || /\s/u.test(token)) throw new Error();
+      } catch {
+        // Identity SDKs may include raw issuer responses in exceptions. No
+        // inference was sent, and neither the error nor its cause is propagated.
+        throw new JevCallError(undefined, "IDENTITY_UNAVAILABLE");
+      }
+      try {
+        const response = await (options.fetch ?? fetch)(base, {
+          method: "POST",
+          headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+          body: JSON.stringify(body),
+          redirect: "error",
+          signal: AbortSignal.timeout(timeoutMs)
+        });
+        if (!response.ok) {
+          // Avoid trusting arbitrary upstream messages or echoing request state.
+          throw new JevCallError(response.status, await safeErrorCode(response));
+        }
+        const value: unknown = await response.json();
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+          throw new JevCallError(response.status, "INVALID_RESPONSE");
+        }
+        const result = value as JevResult;
+        if (typeof result.model !== "string" || !result.answers || typeof result.answers !== "object" || Array.isArray(result.answers)) {
+          throw new JevCallError(response.status, "INVALID_RESPONSE");
+        }
+        for (const name of Object.keys(body.questions)) {
+          if (!Object.hasOwn(result.answers, name)) {
+            throw new JevCallError(response.status, "MISSING_ANSWER");
+          }
+        }
+        return result;
+      } catch (error) {
+        if (error instanceof JevCallError) throw error;
+        // A transport/parse failure can happen after inference was billed.
+        throw new JevCallError(undefined, "RESULT_UNKNOWN");
+      }
+    }
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@numa-tech/numa",
-  "version": "1.23.1",
+  "version": "1.25.0",
   "description": "Cross-platform CLI for the Numa internal developer platform with Keycloak authentication and MCP support.",
   "author": "numa-tech",
   "keywords": [
@@ -36,7 +36,8 @@
     "src/kb/openapi-contract.json",
     "docs/authorization-configuration-publication.md",
     "docs/oss-policy-client-governance.md",
-    "docs/environment-configuration-publication.md"
+    "docs/environment-configuration-publication.md",
+    "docs/keycloak-managed-import.md"
   ],
   "scripts": {
     "clean": "node scripts/clean.mjs",
@@ -48,7 +49,7 @@
     "dev:oss-web": "tsx src/cli.ts oss web",
     "test:oss-web": "node --import tsx --test src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts src/oss/download-links.test.ts",
     "test:oss-auth-code": "node scripts/test-oss-auth-code.mjs",
-    "root:test": "node --import tsx --test --test-concurrency=4 src/mcp-gateway/profile.test.ts src/mcp-gateway/runtime.test.ts src/mcp-gateway/install.test.ts src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/profile-migration.test.ts src/identity.test.ts src/backend.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/mail/client.test.ts src/wecom/client.test.ts src/wecom/commands.test.ts src/wecom/tools.test.ts src/ai-registry/client.test.ts src/ai-registry/bootstrap.test.ts src/ai-registry/install-defaults.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/compatibility/registry-instance.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/skill-uninstaller.test.ts src/ai-registry/skill-dependencies.test.ts src/ai-registry/updates.test.ts src/maintenance/scheduler.test.ts src/maintenance/codex.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/oss/client.test.ts src/oss/governance.test.ts src/oss/commands.test.ts src/oss/auth-code.test.ts src/oss/clipboard.test.ts src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts src/oss/download-links.test.ts src/oss/bootstrap.test.ts src/oss/transfers.test.ts src/oss/search.test.ts src/oss/tools.test.ts src/mcp/install.test.ts src/mcp/catalog.test.ts src/tasks/runtime.test.ts src/tasks/stdio.test.ts src/tasks/wecom-notify.test.ts src/tasks/oss-query.test.ts src/interactive/wizard.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/gitops/workload-input.test.ts src/gitops/workload-client.test.ts src/gitops/workload-commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/bootstrap-client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs src/authorization/enrollment.test.ts src/authorization/application-commands.test.ts src/authorization/application-client.test.ts src/authorization/application-schemas.test.ts src/authorization/enrollment-client.test.ts src/notion/client.test.ts src/notion/commands.test.ts src/notion/tools.test.ts src/notion/machine-cli.test.ts src/cloud/accounts.test.ts src/cloud/bootstrap.test.ts src/cloud/business-bootstrap.test.ts src/cloud/maintenance.test.ts src/cloud/wizard.test.ts src/cloud/oss-bootstrap.test.ts src/business-issuer.test.ts src/login-configuration.test.ts src/login-recovery.test.ts src/ai-registry/mcp-management.test.ts src/ai-registry/mcp-runtime.test.ts src/ai-registry/mcp-stdio.test.ts src/kb/client.test.ts src/kb/config.test.ts src/kb/commands.test.ts src/kb/login.test.ts src/kb/transfers.test.ts src/kb/contract.test.ts src/authorization/environment-governance-client.test.ts src/authorization/environment-governance-commands.test.ts src/authorization/environment-publication.test.ts",
+    "root:test": "node --import tsx --test --test-concurrency=4 src/mcp-gateway/profile.test.ts src/mcp-gateway/runtime.test.ts src/mcp-gateway/install.test.ts src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/profile-migration.test.ts src/identity.test.ts src/backend.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/mail/client.test.ts src/wecom/client.test.ts src/wecom/commands.test.ts src/wecom/tools.test.ts src/ai-registry/client.test.ts src/ai-registry/bootstrap.test.ts src/ai-registry/install-defaults.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/compatibility/registry-instance.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/skill-uninstaller.test.ts src/ai-registry/skill-dependencies.test.ts src/ai-registry/updates.test.ts src/maintenance/scheduler.test.ts src/maintenance/codex.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/oss/client.test.ts src/oss/governance.test.ts src/oss/commands.test.ts src/oss/auth-code.test.ts src/oss/clipboard.test.ts src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts src/oss/download-links.test.ts src/oss/bootstrap.test.ts src/oss/transfers.test.ts src/oss/search.test.ts src/oss/tools.test.ts src/mcp/install.test.ts src/mcp/catalog.test.ts src/tasks/runtime.test.ts src/tasks/stdio.test.ts src/tasks/wecom-notify.test.ts src/tasks/oss-query.test.ts src/interactive/wizard.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/gitops/workload-input.test.ts src/gitops/workload-client.test.ts src/gitops/workload-commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/bootstrap-client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs src/authorization/enrollment.test.ts src/authorization/application-commands.test.ts src/authorization/application-client.test.ts src/authorization/application-schemas.test.ts src/authorization/enrollment-client.test.ts src/notion/client.test.ts src/notion/commands.test.ts src/notion/tools.test.ts src/notion/machine-cli.test.ts src/cloud/accounts.test.ts src/cloud/bootstrap.test.ts src/cloud/business-bootstrap.test.ts src/cloud/maintenance.test.ts src/cloud/wizard.test.ts src/cloud/oss-bootstrap.test.ts src/business-issuer.test.ts src/login-configuration.test.ts src/login-recovery.test.ts src/ai-registry/mcp-management.test.ts src/ai-registry/mcp-runtime.test.ts src/ai-registry/mcp-stdio.test.ts src/kb/client.test.ts src/kb/config.test.ts src/kb/commands.test.ts src/kb/login.test.ts src/kb/transfers.test.ts src/kb/contract.test.ts src/authorization/environment-governance-client.test.ts src/authorization/environment-governance-commands.test.ts src/authorization/environment-publication.test.ts src/authorization/managed-keycloak.test.ts src/authorization/managed-keycloak-producer.test.ts",
     "pack:check": "turbo run pack:check root:pack:check",
     "root:pack:check": "node scripts/check-root-package.mjs",
     "boundaries": "node scripts/check-workspace-boundaries.mjs",
@@ -74,8 +75,8 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@numa-tech/cli-auth": "1.23.1",
-    "@tokensrc/codex": "1.23.1",
+    "@numa-tech/cli-auth": "1.25.0",
+    "@tokensrc/codex": "1.25.0",
     "ali-oss": "^6.23.0",
     "commander": "^14.0.3",
     "ink": "^6.8.0",

package/skills/numa-jev/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 TypeSafe AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.