@numa-tech/numa 1.26.15 → 1.26.16

package/docs/data-resources.md

@@ -0,0 +1,72 @@
+# Data resource CLI
+
+`numa data-resource` uses the current platform identity and `/api/v1/data-resources`.
+Instance, policy, scope and settings reads require the platform ops-admin role;
+application reads and mutations retain server-side VIEWER/MAINTAINER checks.
+
+```sh
+numa data-resource instances --kind RDS --json
+numa data-resource instances --kind REDIS --json
+numa data-resource policy 2 --json
+numa data-resource scopes 1 --kind REDIS --json
+numa data-resource candidates --app 8 --environment 2 --kind RDS --purpose main --json
+numa data-resource bindings --app 8 --environment 2 --json
+```
+
+Names and IDs must come from the target platform. A catalog instance alone does
+not prove cloud identity, application access or usable credentials. An empty
+candidate list is not permission to select another environment's instance.
+
+Administrators can use `cloud-bind`, `set-scopes`, `set-settings`, `set-connection`, and `set-policy`
+with `--file` and `--yes`. Each takes the backend's complete, credential-free
+configuration DTO including its current `version`. Instance commands also require
+`--kind RDS|REDIS`; policy targets an environment ID. These PUT requests are sent
+once. Review cloud identity, environment scope, TLS and Redis instance-wide access
+before applying; existing bindings do not follow changed defaults automatically.
+
+`set-connection` additionally requires `instanceVersion`, `endpoint` (hostname/IP,
+not a URL), and `port`. It requires the backend connection-correction upgrade and
+rejects instances with existing resources or unresolved operations.
+
+Allocation uses a credential-free JSON PlanInput matching the platform contract:
+
+```json
+{
+  "appId": 8,
+  "environmentId": 2,
+  "kind": "RDS",
+  "purpose": "main",
+  "mode": "CREATE",
+  "instanceId": 4,
+  "isolationMode": "DATABASE"
+}
+```
+
+These IDs are illustrative, not existing-resource evidence. Save the input to a
+file and call `numa data-resource plan --file plan.json --yes --json`. Review the
+returned immutable target, account profile, operations and warnings before
+`apply <plan-id> --idempotency-key <original-key> --yes`. Production requires the
+server's accepted `--production-reason`. Redis `INSTANCE_ACCOUNT` grants access
+to the whole instance; DB 0 is not dataset isolation.
+
+`run <run-id>` reads the saved request. `reconcile <run-id> --yes` observes cloud
+state and updates its ledger; it does not repeat a cloud mutation. Transport
+loss, uncertain HTTP 5xx, and malformed successful write responses return
+`DATA_RESOURCE_RESULT_UNKNOWN`. Writes, including 401 responses, are never
+automatically replayed. Never replace a key to recover an unknown operation.
+Plan creation has no resolve-by-key API: an unknown preview must be inspected
+through existing bindings/platform records before considering a new plan.
+
+Secret delivery is separate: `delivery <binding-id>` reads its CAS version and
+`deliver <binding-id> --version <version> --idempotency-key <key> --yes` submits
+the versioned delivery/reconciliation request. A valid receipt does not prove
+application connectivity, migration success or restarted Pods. Credentials,
+reveal, rotations, arbitrary cloud calls and inventory creation are deliberately
+outside this initial command family.
+
+The CLI preserves backend field names under `data`. Unknown response fields are dropped using explicit DTO schemas. Sensitive fields,
+credential assignments and URL userinfo are redacted; provider error bodies and headers are not printed.
+
+If an onboarding application is PROVISIONING and data-resource reads return
+NOT_FOUND, check the platform's ACTIVE-only application gate. Do not silently
+mark onboarding complete just to obtain database access.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@numa-tech/numa",
-  "version": "1.26.15",
+  "version": "1.26.16",
   "description": "Cross-platform CLI for the Numa internal developer platform with Keycloak authentication and MCP support.",
   "author": "numa-tech",
   "keywords": [
@@ -39,7 +39,8 @@
     "docs/oss-policy-client-governance.md",
     "docs/environment-configuration-publication.md",
     "docs/keycloak-managed-import.md",
-    "docs/design/kb-capability-upgrade.md"
+    "docs/design/kb-capability-upgrade.md",
+    "docs/data-resources.md"
   ],
   "scripts": {
     "clean": "node scripts/clean.mjs",
@@ -51,7 +52,7 @@
     "dev:oss-web": "tsx src/cli.ts oss web",
     "test:oss-web": "node --import tsx --test src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts src/oss/download-links.test.ts src/local-web/context-menu.test.ts",
     "test:oss-auth-code": "node scripts/test-oss-auth-code.mjs",
-    "root:test": "node --import tsx --test --test-concurrency=4 src/mcp-gateway/profile.test.ts src/mcp-gateway/runtime.test.ts src/mcp-gateway/install.test.ts src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/profile-migration.test.ts src/identity.test.ts src/backend.test.ts src/cert/client.test.ts src/cert/commands.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/mail/client.test.ts src/wecom/client.test.ts src/wecom/commands.test.ts src/wecom/tools.test.ts src/ai-registry/client.test.ts src/ai-registry/bootstrap.test.ts src/ai-registry/install-defaults.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/compatibility/registry-instance.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/skill-uninstaller.test.ts src/ai-registry/skill-dependencies.test.ts src/ai-registry/updates.test.ts src/maintenance/scheduler.test.ts src/maintenance/codex.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/oss/client.test.ts src/oss/governance.test.ts src/oss/commands.test.ts src/oss/auth-code.test.ts src/oss/clipboard.test.ts src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts src/oss/download-links.test.ts src/oss/bootstrap.test.ts src/oss/transfers.test.ts src/oss/search.test.ts src/oss/tools.test.ts src/mcp/install.test.ts src/mcp/catalog.test.ts src/tasks/runtime.test.ts src/tasks/stdio.test.ts src/tasks/wecom-notify.test.ts src/tasks/oss-query.test.ts src/interactive/wizard.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/gitops/workload-input.test.ts src/gitops/workload-client.test.ts src/gitops/workload-commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/bootstrap-client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs src/authorization/application-commands.test.ts src/authorization/application-client.test.ts src/authorization/application-schemas.test.ts src/notion/client.test.ts src/notion/commands.test.ts src/notion/tools.test.ts src/notion/machine-cli.test.ts src/cloud/accounts.test.ts src/cloud/bootstrap.test.ts src/cloud/business-bootstrap.test.ts src/cloud/maintenance.test.ts src/cloud/wizard.test.ts src/cloud/oss-bootstrap.test.ts src/business-issuer.test.ts src/login-configuration.test.ts src/login-recovery.test.ts src/ai-registry/mcp-management.test.ts src/ai-registry/mcp-runtime.test.ts src/ai-registry/mcp-stdio.test.ts src/kb/client.test.ts src/kb/config.test.ts src/kb/commands.test.ts src/kb/login.test.ts src/kb/transfers.test.ts src/kb/contract.test.ts src/authorization/environment-governance-client.test.ts src/authorization/environment-governance-commands.test.ts src/authorization/environment-publication.test.ts src/authorization/managed-keycloak.test.ts src/authorization/managed-keycloak-producer.test.ts src/kb/web.test.ts src/kb/web-queue.test.ts src/local-web/context-menu.test.ts src/kb/web-login.test.ts src/kb/capabilities.test.ts src/jev/input.test.ts src/jev/profile.test.ts src/jev/client.test.ts src/jev/commands.test.ts scripts/check-default-profile.test.mjs",
+    "root:test": "node --import tsx --test --test-concurrency=4 src/mcp-gateway/profile.test.ts src/mcp-gateway/runtime.test.ts src/mcp-gateway/install.test.ts src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/profile-migration.test.ts src/identity.test.ts src/backend.test.ts src/cert/client.test.ts src/cert/commands.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/mail/client.test.ts src/wecom/client.test.ts src/wecom/commands.test.ts src/wecom/tools.test.ts src/ai-registry/client.test.ts src/ai-registry/bootstrap.test.ts src/ai-registry/install-defaults.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/compatibility/registry-instance.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/skill-uninstaller.test.ts src/ai-registry/skill-dependencies.test.ts src/ai-registry/updates.test.ts src/maintenance/scheduler.test.ts src/maintenance/codex.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/oss/client.test.ts src/oss/governance.test.ts src/oss/commands.test.ts src/oss/auth-code.test.ts src/oss/clipboard.test.ts src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts src/oss/download-links.test.ts src/oss/bootstrap.test.ts src/oss/transfers.test.ts src/oss/search.test.ts src/oss/tools.test.ts src/mcp/install.test.ts src/mcp/catalog.test.ts src/tasks/runtime.test.ts src/tasks/stdio.test.ts src/tasks/wecom-notify.test.ts src/tasks/oss-query.test.ts src/interactive/wizard.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/gitops/workload-input.test.ts src/gitops/workload-client.test.ts src/gitops/workload-commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/bootstrap-client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs src/authorization/application-commands.test.ts src/authorization/application-client.test.ts src/authorization/application-schemas.test.ts src/notion/client.test.ts src/notion/commands.test.ts src/notion/tools.test.ts src/notion/machine-cli.test.ts src/cloud/accounts.test.ts src/cloud/bootstrap.test.ts src/cloud/business-bootstrap.test.ts src/cloud/maintenance.test.ts src/cloud/wizard.test.ts src/cloud/oss-bootstrap.test.ts src/business-issuer.test.ts src/login-configuration.test.ts src/login-recovery.test.ts src/ai-registry/mcp-management.test.ts src/ai-registry/mcp-runtime.test.ts src/ai-registry/mcp-stdio.test.ts src/kb/client.test.ts src/kb/config.test.ts src/kb/commands.test.ts src/kb/login.test.ts src/kb/transfers.test.ts src/kb/contract.test.ts src/authorization/environment-governance-client.test.ts src/authorization/environment-governance-commands.test.ts src/authorization/environment-publication.test.ts src/authorization/managed-keycloak.test.ts src/authorization/managed-keycloak-producer.test.ts src/kb/web.test.ts src/kb/web-queue.test.ts src/local-web/context-menu.test.ts src/kb/web-login.test.ts src/kb/capabilities.test.ts src/jev/input.test.ts src/jev/profile.test.ts src/jev/client.test.ts src/jev/commands.test.ts scripts/check-default-profile.test.mjs src/data-resources/client.test.ts src/data-resources/commands.test.ts",
     "pack:check": "turbo run pack:check root:pack:check",
     "root:pack:check": "node scripts/check-root-package.mjs",
     "boundaries": "node scripts/check-workspace-boundaries.mjs",
@@ -78,8 +79,8 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@numa-tech/cli-auth": "1.26.15",
-    "@tokensrc/codex": "1.26.15",
+    "@numa-tech/cli-auth": "1.26.16",
+    "@tokensrc/codex": "1.26.16",
     "ali-oss": "^6.23.0",
     "commander": "^14.0.3",
     "ink": "^6.8.0",