@nexusclawhq/cli 0.2.1

package/dist/nexus-cli/src/services/api-client.js

@@ -0,0 +1,1352 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiClient = exports.GraphQLApiError = void 0;
+exports.createApiClient = createApiClient;
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const node_crypto_1 = require("node:crypto");
+const url_1 = require("url");
+const config_1 = require("./config");
+const auth_store_1 = require("./auth-store");
+const WORKFORCE_BUNDLE_LOCK_SELECTION = `
+  schemaVersion bundleName bundleVersion portableBundleDigest
+  releaseItemSetDigest sourceLockDigest previousReleaseSetId
+  target { orgAlias workspaceId workspaceContractHash }
+  employee { employeePackageName agentApiName digest }
+  codePackages {
+    packageName packageVersion packageDigest
+    exports {
+      exportId toolName sourceHash compiledHash inputSchemaHash
+      outputSchemaHash descriptorHash publishedChecksum runtimeApiVersion
+      runtimeProviderId compilerVersion compilerOptionsHash sdkDeclarationHash
+      actionContractVersion
+    }
+  }
+  flows { flowApiName flowRevisionKey definitionHash }
+  runtimeBindings {
+    bindingKey kind connectorInstanceId connectorApiName connectorType
+    connectorConfigHash namedCredentialId namedCredentialApiName credentialType
+    bindingRevisionKey
+  }
+  aiPolicies {
+    policyKey policyRevisionKey promptTemplateVersion policyHash
+  }
+  approvalPolicies { policyApiName purpose revisionKey checksum }
+`;
+const GATE_RECEIPT_FIELDS = `
+  schemaVersion approvalId candidateReleaseSetId evidenceRunIds
+  expectedSourceLockDigest expectedReleaseItemSetDigest
+  expectedMaterializedItemRefsDigest governanceContextDigest
+  decision decisionVersion expiresAt consumedAt receiptDigest
+`;
+function graphqlAiAuthoringContextInput(input) {
+    return {
+        ...input,
+        surface: input.surface.toUpperCase(),
+        selector: {
+            ...input.selector,
+            kind: input.selector.kind.toUpperCase(),
+        },
+    };
+}
+class GraphQLApiError extends Error {
+    constructor(errors) {
+        super(errors.map((error) => error.message).filter(Boolean).join('; ') || 'GraphQL 请求失败');
+        this.name = 'GraphQLApiError';
+        this.errors = errors;
+    }
+}
+exports.GraphQLApiError = GraphQLApiError;
+function normalizeGraphQLError(error) {
+    const extensions = error.extensions;
+    const extensionPath = extensions?.path;
+    const path = Array.isArray(error.path)
+        ? [...error.path]
+        : typeof extensionPath === 'string'
+            ? extensionPath
+            : Array.isArray(extensionPath) && extensionPath.every((entry) => typeof entry === 'string' || typeof entry === 'number')
+                ? [...extensionPath]
+                : undefined;
+    return {
+        message: typeof error.message === 'string' && error.message ? error.message : 'GraphQL 请求失败',
+        ...(typeof extensions?.code === 'string' ? { code: extensions.code } : {}),
+        ...(path !== undefined ? { path } : {}),
+        ...(typeof extensions?.ruleId === 'string' ? { ruleId: extensions.ruleId } : {}),
+        ...(typeof extensions?.retryable === 'boolean' ? { retryable: extensions.retryable } : {}),
+    };
+}
+const DEFAULT_API_REQUEST_TIMEOUT_MS = 120000;
+function normalizeRequestTimeoutMs(timeoutMs) {
+    const explicitTimeout = Number(timeoutMs);
+    if (Number.isFinite(explicitTimeout) && explicitTimeout > 0) {
+        return Math.max(1000, Math.trunc(explicitTimeout));
+    }
+    const envTimeout = Number(process.env.NEXUS_API_TIMEOUT_MS);
+    if (Number.isFinite(envTimeout) && envTimeout > 0) {
+        return Math.max(1000, Math.trunc(envTimeout));
+    }
+    return DEFAULT_API_REQUEST_TIMEOUT_MS;
+}
+function extractMessage(value) {
+    if (typeof value === 'string') {
+        return value;
+    }
+    if (value && typeof value === 'object') {
+        const message = value.message;
+        if (typeof message === 'string' && message.trim()) {
+            return message;
+        }
+    }
+    return JSON.stringify(value);
+}
+class ApiClient {
+    constructor(baseUrl, token, orgAlias, requestTimeoutMs) {
+        this.baseUrl = baseUrl || (0, config_1.getBaseUrl)();
+        this.token = token || (0, config_1.getAuthToken)();
+        this.orgAlias = orgAlias;
+        this.requestTimeoutMs = normalizeRequestTimeoutMs(requestTimeoutMs);
+        this.tokenFromEnvironment = !token && Boolean(process.env.NEXUS_AUTH_TOKEN);
+    }
+    async ensureValidToken() {
+        if (this.tokenFromEnvironment)
+            return;
+        const cred = this.orgAlias
+            ? (0, auth_store_1.loadCredential)(this.orgAlias)
+            : (0, auth_store_1.getDefaultCredential)();
+        if (!cred || !cred.refreshToken || !cred.expiresAt)
+            return;
+        const fiveMinutes = 5 * 60 * 1000;
+        if (Date.now() + fiveMinutes < cred.expiresAt)
+            return;
+        const pair = await this.refreshOAuthTokenPair({
+            instanceUrl: cred.instanceUrl,
+            refreshToken: cred.refreshToken,
+            clientId: cred.clientId,
+            scope: cred.scope,
+        });
+        cred.accessToken = pair.accessToken;
+        cred.refreshToken = pair.refreshToken;
+        cred.expiresAt = Date.now() + pair.expiresIn * 1000;
+        if (pair.scope) {
+            cred.scope = pair.scope;
+        }
+        (0, auth_store_1.saveCredential)(cred);
+        this.token = cred.accessToken;
+    }
+    async refreshOAuthTokenPair(cred) {
+        const clientId = cred.clientId || 'nexusclaw-cli';
+        const params = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: cred.refreshToken,
+            client_id: clientId,
+        });
+        if (cred.scope) {
+            params.set('scope', cred.scope);
+        }
+        const tokenUrl = new url_1.URL('/oauth/token', cred.instanceUrl);
+        const transport = tokenUrl.protocol === 'https:' ? https : http;
+        const body = params.toString();
+        return new Promise((resolve, reject) => {
+            const req = transport.request({
+                method: 'POST',
+                hostname: tokenUrl.hostname,
+                port: tokenUrl.port,
+                path: tokenUrl.pathname + tokenUrl.search,
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'Accept': 'application/json',
+                    'User-Agent': '@nexusclawhq/cli',
+                    'Content-Length': Buffer.byteLength(body),
+                },
+            }, (res) => {
+                let data = '';
+                res.on('data', (chunk) => (data += chunk));
+                res.on('end', () => {
+                    let parsed = {};
+                    try {
+                        parsed = data ? JSON.parse(data) : {};
+                    }
+                    catch {
+                    }
+                    if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300) {
+                        if (!parsed.access_token || !parsed.refresh_token) {
+                            reject(new Error('OAuth refresh returned an incomplete token response. Run `nexus org login-web` to re-authenticate.'));
+                            return;
+                        }
+                        resolve({
+                            accessToken: parsed.access_token,
+                            refreshToken: parsed.refresh_token,
+                            expiresIn: Number(parsed.expires_in) || 3600,
+                            scope: typeof parsed.scope === 'string' ? parsed.scope : undefined,
+                        });
+                        return;
+                    }
+                    reject(new Error(`OAuth session expired (token endpoint returned ${res.statusCode ?? 'unknown'}). Run \`nexus org login-web\` to re-authenticate.`));
+                });
+            });
+            req.on('error', (err) => {
+                reject(new Error(`OAuth refresh request failed: ${err.message}`));
+            });
+            req.setTimeout(this.requestTimeoutMs, () => {
+                req.destroy();
+                reject(new Error('OAuth refresh request timed out.'));
+            });
+            req.write(body);
+            req.end();
+        });
+    }
+    getHeaders() {
+        const headers = {
+            'Content-Type': 'application/json',
+            'User-Agent': '@nexusclawhq/cli',
+        };
+        if (this.token) {
+            headers['Authorization'] = `Bearer ${this.token}`;
+        }
+        const credential = this.orgAlias
+            ? (0, auth_store_1.loadCredential)(this.orgAlias)
+            : undefined;
+        if (credential?.orgId) {
+            headers['X-Workspace-Id'] = credential.orgId;
+        }
+        return headers;
+    }
+    request(method, endpoint, body, extraHeaders) {
+        return new Promise((resolve, reject) => {
+            const url = new url_1.URL(endpoint, this.baseUrl);
+            const isHttps = url.protocol === 'https:';
+            const transport = isHttps ? https : http;
+            const options = {
+                method,
+                hostname: url.hostname,
+                port: url.port,
+                path: url.pathname + url.search,
+                headers: { ...this.getHeaders(), ...extraHeaders },
+            };
+            const req = transport.request(options, (res) => {
+                let data = '';
+                res.on('data', (chunk) => (data += chunk));
+                res.on('end', () => {
+                    try {
+                        if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300) {
+                            const parsed = data ? JSON.parse(data) : {};
+                            resolve({ success: true, data: parsed });
+                        }
+                        else if (res.statusCode === 401) {
+                            resolve({ success: false, error: '认证失败，请检查 token 是否有效' });
+                        }
+                        else if (res.statusCode === 403) {
+                            resolve({ success: false, error: '权限不足' });
+                        }
+                        else {
+                            const parsed = data ? JSON.parse(data) : {};
+                            resolve({
+                                success: false,
+                                error: parsed.message || `请求失败 (${res.statusCode})`,
+                                errors: parsed.errors,
+                            });
+                        }
+                    }
+                    catch {
+                        resolve({ success: false, error: `响应解析失败: ${data.slice(0, 200)}` });
+                    }
+                });
+            });
+            req.on('error', (err) => {
+                reject(new Error(`网络请求失败: ${err.message}`));
+            });
+            req.setTimeout(this.requestTimeoutMs, () => {
+                req.destroy();
+                reject(new Error('请求超时'));
+            });
+            if (body) {
+                req.write(JSON.stringify(body));
+            }
+            req.end();
+        });
+    }
+    putRawBytes(endpoint, bytes, headers) {
+        return new Promise((resolve, reject) => {
+            const url = new url_1.URL(endpoint, this.baseUrl);
+            const transport = url.protocol === 'https:' ? https : http;
+            const req = transport.request({
+                method: 'PUT',
+                hostname: url.hostname,
+                port: url.port,
+                path: url.pathname + url.search,
+                headers: {
+                    ...this.getHeaders(),
+                    ...headers,
+                    'Content-Length': String(bytes.byteLength),
+                },
+            }, (res) => {
+                let data = '';
+                res.on('data', (chunk) => { data += String(chunk); });
+                res.on('end', () => {
+                    if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
+                        reject(new Error(`Executable package upload failed (${res.statusCode ?? 'unknown'})`));
+                        return;
+                    }
+                    try {
+                        const parsed = JSON.parse(data);
+                        resolve(parsed !== null &&
+                            typeof parsed === 'object' &&
+                            !Array.isArray(parsed) &&
+                            'data' in parsed
+                            ? parsed.data
+                            : parsed);
+                    }
+                    catch {
+                        reject(new Error('Executable package upload returned invalid JSON'));
+                    }
+                });
+            });
+            req.on('error', reject);
+            req.setTimeout(this.requestTimeoutMs, () => {
+                req.destroy();
+                reject(new Error('Executable package upload timed out'));
+            });
+            req.end(Buffer.from(bytes));
+        });
+    }
+    get(endpoint) {
+        return this.request('GET', endpoint);
+    }
+    post(endpoint, body) {
+        return this.request('POST', endpoint, body);
+    }
+    put(endpoint, body) {
+        return this.request('PUT', endpoint, body);
+    }
+    delete(endpoint) {
+        return this.request('DELETE', endpoint);
+    }
+    async graphql(query, variables) {
+        const res = await this.post('/graphql', { query, variables });
+        if (res.errors?.length) {
+            throw new GraphQLApiError(res.errors
+                .map(normalizeGraphQLError));
+        }
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'GraphQL 请求失败');
+        }
+        if (res.data.errors?.length) {
+            throw new GraphQLApiError(res.data.errors.map(normalizeGraphQLError));
+        }
+        if (res.data.data === undefined) {
+            throw new Error('GraphQL 响应缺少 data 字段');
+        }
+        return res.data.data;
+    }
+    async getAiContextSigningKeys() {
+        await this.ensureValidToken();
+        const response = await this.get('/api/v1/ai-authoring-context/signing-keys');
+        if (!response.success || !response.data) {
+            throw new Error(response.error || 'AI context signing-key discovery failed');
+        }
+        return 'data' in response.data
+            ? response.data.data
+            : response.data;
+    }
+    async createExecutablePackageUploadSession(input, idempotencyKey) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`mutation CreateExecutablePackageUploadSession(
+        $input: CreateExecutablePackageUploadSessionInput!
+        $idempotencyKey: String!
+      ) {
+        createExecutablePackageUploadSession(
+          input: $input
+          idempotencyKey: $idempotencyKey
+        ) {
+          uploadSessionId uploadUrl method requiredHeaderNames expiresAt
+        }
+      }`, { input, idempotencyKey });
+        return result.createExecutablePackageUploadSession;
+    }
+    async uploadExecutablePackageArtifact(input) {
+        await this.ensureValidToken();
+        if (!/^\/api\/v1\/deployment\/executable-package-uploads\/[A-Za-z0-9-]+$/.test(input.uploadUrl)) {
+            throw new Error('PACKAGE_UPLOAD_URL_INVALID');
+        }
+        const computedArchiveDigest = `sha256:${(0, node_crypto_1.createHash)('sha256')
+            .update(input.bytes)
+            .digest('hex')}`;
+        if (computedArchiveDigest !== input.archiveDigest) {
+            throw new Error('PACKAGE_ARCHIVE_DIGEST_MISMATCH');
+        }
+        return this.putRawBytes(input.uploadUrl, input.bytes, {
+            'Content-Type': 'application/zip',
+            Digest: `sha-256=${Buffer.from(input.archiveDigest.slice(7), 'hex').toString('base64')}`,
+            'Idempotency-Key': input.idempotencyKey,
+        });
+    }
+    async resolveWorkforceBundleLock(input) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`query ResolveWorkforceBundleLock($input: WorkforceBundleArtifactOperationInput!) {
+        resolveWorkforceBundleLock(input: $input) {
+          ${WORKFORCE_BUNDLE_LOCK_SELECTION}
+        }
+      }`, { input });
+        return result.resolveWorkforceBundleLock;
+    }
+    async planExecutableWorkforceBundle(input) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`query PlanExecutableWorkforceBundle($input: PlanExecutableWorkforceBundleInput!) {
+        planExecutableWorkforceBundle(input: $input) {
+          schemaVersion planDigest releaseItemSetDigest sourceLockDigest
+          plannedItems { itemKind canonicalKey checksum descriptorHash }
+          headAtPlan { activeReleaseSetId generation }
+          lock { ${WORKFORCE_BUNDLE_LOCK_SELECTION} }
+        }
+      }`, { input });
+        return result.planExecutableWorkforceBundle;
+    }
+    async stageExecutableWorkforceBundle(input, idempotencyKey) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`mutation StageExecutableWorkforceBundle(
+        $input: StageExecutableWorkforceBundleInput!
+        $idempotencyKey: String!
+      ) {
+        stageExecutableWorkforceBundle(input: $input, idempotencyKey: $idempotencyKey) {
+          schemaVersion candidateReleaseSetId agentApiName eligibilityStatus
+          sourceLockDigest releaseItemSetDigest materializedItemRefsDigest
+          releaseEnvelopeDigest previousReleaseSetId
+          headAtStage { activeReleaseSetId generation } planDigest
+        }
+      }`, {
+            input: {
+                ...input,
+                authoringContext: graphqlAiAuthoringContextInput(input.authoringContext),
+            },
+            idempotencyKey,
+        });
+        return result.stageExecutableWorkforceBundle;
+    }
+    async runWorkforceCandidateTests(input, idempotencyKey) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`mutation RunWorkforceCandidateTests($input: RunWorkforceCandidateTestsInput!, $idempotencyKey: String!) {
+        runWorkforceCandidateTests(input: $input, idempotencyKey: $idempotencyKey) {
+          evidenceRunId evidenceRunDigest passed isolationBindingId
+          isolationSnapshotHash resetReceiptId resetReceiptDigest
+          newAuthorizationGeneration
+          refs { kind evidenceId digest producer createdAt }
+        }
+      }`, { input, idempotencyKey });
+        return result.runWorkforceCandidateTests;
+    }
+    async getWorkforceCandidateReleaseItems(input) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`query GetWorkforceCandidateReleaseItems($input: WorkforceCandidateReleaseItemsInput!) {
+        getWorkforceCandidateReleaseItems(input: $input) {
+          itemKind selectorKey
+        }
+      }`, { input });
+        return result.getWorkforceCandidateReleaseItems;
+    }
+    async requestWorkforceReleaseApproval(input, idempotencyKey) {
+        return this.workforceGateReceiptMutation('RequestWorkforceReleaseApproval', 'requestWorkforceReleaseApproval', input, idempotencyKey);
+    }
+    async getWorkforceReleaseApprovalStatus(input) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`query GetWorkforceReleaseApprovalStatus($input: WorkforceReleaseApprovalStatusInput!) {
+        getWorkforceReleaseApprovalStatus(input: $input) {
+          ${GATE_RECEIPT_FIELDS}
+        }
+      }`, { input });
+        return result.getWorkforceReleaseApprovalStatus;
+    }
+    async evaluateAndSealWorkforceCandidateRelease(input, idempotencyKey) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`mutation EvaluateAndSealWorkforceCandidateRelease($input: EvaluateWorkforceCandidateReleaseInput!, $idempotencyKey: String!) {
+        evaluateAndSealWorkforceCandidateRelease(input: $input, idempotencyKey: $idempotencyKey) {
+          releaseSetId evidenceId eligibilityStatus releaseEnvelopeDigest alreadySealed
+        }
+      }`, { input, idempotencyKey });
+        return result.evaluateAndSealWorkforceCandidateRelease;
+    }
+    async promoteWorkforceRelease(input, idempotencyKey) {
+        return this.workforceTransitionMutation('PromoteWorkforceRelease', 'promoteWorkforceRelease', 'PromoteWorkforceReleaseInput', input, idempotencyKey);
+    }
+    async rollbackWorkforceRelease(input, idempotencyKey) {
+        return this.workforceTransitionMutation('RollbackWorkforceRelease', 'rollbackWorkforceRelease', 'RollbackWorkforceReleaseInput', input, idempotencyKey);
+    }
+    async revokeExecutableToolExport(input, idempotencyKey) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`mutation RevokeExecutableToolExport($input: RevokeExecutableToolExportInput!, $idempotencyKey: String!) {
+        revokeExecutableToolExport(input: $input, idempotencyKey: $idempotencyKey) {
+          schemaVersion eventType workspaceId assertedReleaseSetId exportId
+          toolName publishedChecksum reason revokedBy revokedAt requestFingerprint
+        }
+      }`, { input, idempotencyKey });
+        return result.revokeExecutableToolExport;
+    }
+    async workforceGateReceiptMutation(operationName, fieldName, input, idempotencyKey) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`mutation ${operationName}($input: WorkforceReleaseApprovalRequestInput!, $idempotencyKey: String!) {
+        ${fieldName}(input: $input, idempotencyKey: $idempotencyKey) {
+          ${GATE_RECEIPT_FIELDS}
+        }
+      }`, { input, idempotencyKey });
+        return result[fieldName];
+    }
+    async workforceTransitionMutation(operationName, fieldName, inputType, input, idempotencyKey) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`mutation ${operationName}($input: ${inputType}!, $idempotencyKey: String!) {
+        ${fieldName}(input: $input, idempotencyKey: $idempotencyKey) {
+          schemaVersion operation beforeReleaseSetId afterReleaseSetId
+          beforeGeneration afterGeneration receiptId outboxId alreadyApplied
+        }
+      }`, { input, idempotencyKey });
+        return result[fieldName];
+    }
+    async validateExecutablePackageArtifact(input) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`query ValidateExecutablePackageArtifact($input: ValidateExecutablePackageArtifactInput!) {
+        validateExecutablePackageArtifact(input: $input) {
+          schemaVersion valid stagedArtifactId archiveDigest packageDigest
+          contextManifestContentDigest
+          diagnostics {
+            code severity phase artifactId file line column jsonPath ruleId
+            message fixHint retryable docsRef
+          }
+        }
+      }`, { input });
+        return result.validateExecutablePackageArtifact;
+    }
+    async describeAiAuthoringContext(input) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`query DescribeAiAuthoringContext($input: DescribeAiAuthoringContextInput!) {
+        describeAiAuthoringContext(input: $input) {
+          schemaVersion coreVersion coreCommitSha cliVersion runtimeApiVersion
+          surface targetWorkspaceId principalKind principalId agentApiName
+          releaseSetId contractDigest workspaceContractHash principalScopeDigest
+          generatedAt expiresAt
+          releaseStamp {
+            candidateReleaseSetId agentApiName eligibilityStatus
+            sourceLockDigest releaseItemSetDigest materializedItemRefsDigest
+            releaseEnvelopeDigest previousReleaseSetId
+            headAtStage { activeReleaseSetId generation }
+          }
+          objectCatalog { schemaVersion digest canonicalJson }
+          invokableCatalog { schemaVersion digest canonicalJson }
+          connectorCatalog { schemaVersion digest canonicalJson }
+          aiPolicyCatalog { schemaVersion digest canonicalJson }
+          approvalPolicyCatalog { schemaVersion digest canonicalJson }
+        }
+      }`, { input: graphqlAiAuthoringContextInput(input) });
+        return result.describeAiAuthoringContext;
+    }
+    async verifyAiAuthoringContextFreshness(input) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`query VerifyAiAuthoringContextFreshness($input: VerifyAiAuthoringContextFreshnessInput!) {
+        verifyAiAuthoringContextFreshness(input: $input) {
+          valid stale reasons
+          currentHashes {
+            contractDigest workspaceContractHash principalScopeDigest
+          }
+        }
+      }`, { input: graphqlAiAuthoringContextInput(input) });
+        return result.verifyAiAuthoringContextFreshness;
+    }
+    async signAiAuthoringContextLock(input) {
+        await this.ensureValidToken();
+        const result = await this.graphql(`query SignAiAuthoringContextLock($input: SignAiAuthoringContextLockInput!) {
+        signAiAuthoringContextLock(input: $input) {
+          schemaVersion contentDigest manifestContentDigest
+          manifestEnvelopeDigest lockDigest signatureAlgorithm keyId signature
+        }
+      }`, { input: graphqlAiAuthoringContextInput(input) });
+        return result.signAiAuthoringContextLock;
+    }
+    async validate(changeSetId) {
+        const res = await this.post('/api/metadata/validate', {
+            changeSetId,
+        });
+        if (!res.success) {
+            return { success: false, errors: [res.error || '验证失败'], warnings: [] };
+        }
+        return {
+            success: Boolean(res.data?.success),
+            errors: (res.data?.errors ?? []).map((entry) => extractMessage(entry)),
+            warnings: (res.data?.warnings ?? []).map((entry) => extractMessage(entry)),
+        };
+    }
+    async validateDeploymentSource(input) {
+        const res = await this.post('/api/deployment/validate/source', input);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'source validation failed');
+        }
+        return res.data;
+    }
+    async validateDeploymentPackage(input) {
+        const endpoint = input.operation === 'upgrade'
+            ? '/api/deployment/validate/package/upgrade'
+            : '/api/deployment/validate/package/install';
+        const res = await this.post(endpoint, input);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'package validation failed');
+        }
+        return res.data;
+    }
+    async createManagedChangeSet(input) {
+        const res = await this.post('/api/changesets', input);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'change set creation failed');
+        }
+        return res.data;
+    }
+    async listManagedChangeSets(filters) {
+        const query = new URLSearchParams();
+        Object.entries(filters ?? {}).forEach(([key, value]) => {
+            if (value !== undefined && value !== null && value !== '') {
+                query.set(key, String(value));
+            }
+        });
+        const suffix = query.toString() ? `?${query.toString()}` : '';
+        const res = await this.get(`/api/changesets${suffix}`);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'change set list failed');
+        }
+        return res.data;
+    }
+    async getManagedChangeSet(id) {
+        const res = await this.get(`/api/changesets/${id}`);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'change set lookup failed');
+        }
+        return res.data;
+    }
+    async validateManagedChangeSet(id) {
+        const res = await this.post(`/api/changesets/${id}/validate`, {});
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'change set validation failed');
+        }
+        return res.data;
+    }
+    async deployManagedChangeSet(id) {
+        const res = await this.post(`/api/changesets/${id}/deploy`, {});
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'change set deployment failed');
+        }
+        return res.data;
+    }
+    async rollbackManagedChangeSet(id) {
+        const res = await this.post(`/api/changesets/${id}/rollback`, {});
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'change set rollback failed');
+        }
+        return res.data;
+    }
+    async getManagedChangeSetDependencies(id) {
+        const res = await this.get(`/api/changesets/${id}/dependencies`);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'change set dependency lookup failed');
+        }
+        return res.data;
+    }
+    async getManagedChangeSetConflicts(id) {
+        const res = await this.get(`/api/changesets/${id}/conflicts`);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'change set conflict lookup failed');
+        }
+        return res.data;
+    }
+    async approveManagedChangeSet(id, reason) {
+        const res = await this.post(`/api/changesets/${id}/approve`, {
+            reason,
+        });
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'change set approval failed');
+        }
+        return res.data;
+    }
+    async rejectManagedChangeSet(id, reason) {
+        const res = await this.post(`/api/changesets/${id}/reject`, {
+            reason,
+        });
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'change set rejection failed');
+        }
+        return res.data;
+    }
+    async listDeploymentHistory(filters) {
+        const query = new URLSearchParams();
+        Object.entries(filters ?? {}).forEach(([key, value]) => {
+            if (value !== undefined && value !== null && value !== '') {
+                query.set(key, String(value));
+            }
+        });
+        const suffix = query.toString() ? `?${query.toString()}` : '';
+        const res = await this.get(`/api/deployment/history${suffix}`);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'deployment history query failed');
+        }
+        return res.data;
+    }
+    async compareDeployments(leftId, rightId) {
+        const res = await this.get(`/api/deployment/compare?leftId=${encodeURIComponent(leftId)}&rightId=${encodeURIComponent(rightId)}`);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || 'deployment comparison failed');
+        }
+        return res.data;
+    }
+    async deploy(changeSetId) {
+        const res = await this.post('/api/metadata/deploy', {
+            changeSetId,
+        });
+        if (!res.success) {
+            throw new Error(res.error || '部署请求失败');
+        }
+        return {
+            jobId: res.data?.jobId ?? changeSetId,
+            status: 'queued',
+            message: res.data?.message,
+        };
+    }
+    async getDeployStatus(jobId) {
+        const res = await this.get(`/api/metadata/status/${jobId}`);
+        if (!res.success) {
+            throw new Error(res.error || '查询部署状态失败');
+        }
+        const result = res.data?.result;
+        const normalizedStatus = result === 'success'
+            ? 'success'
+            : result === 'failed' || result === 'rolled_back'
+                ? 'failed'
+                : 'running';
+        return {
+            jobId,
+            status: normalizedStatus,
+            progress: normalizedStatus === 'running' ? 50 : 100,
+            message: res.data?.errorMessage ?? result,
+            errors: res.data?.errorMessage ? [res.data.errorMessage] : [],
+        };
+    }
+    async retrieve(changeSetId) {
+        const res = await this.post('/api/metadata/retrieve', {
+            changeSetId,
+        });
+        if (!res.success) {
+            throw new Error(res.error || '元数据导出失败');
+        }
+        return res.data;
+    }
+    async exportRuntimeMetadata() {
+        const res = await this.get('/api/metadata/runtime/export');
+        if (!res.success) {
+            throw new Error(res.error || 'metadata runtime 导出失败');
+        }
+        return res.data;
+    }
+    async validateRuntimeMetadata(files) {
+        const res = await this.post('/api/metadata/runtime/validate', {
+            files,
+        });
+        if (!res.success) {
+            throw new Error(res.error || 'metadata runtime 校验失败');
+        }
+        return res.data;
+    }
+    async diffRuntimeMetadata(files) {
+        const res = await this.post('/api/metadata/runtime/diff', {
+            files,
+        });
+        if (!res.success) {
+            throw new Error(res.error || 'metadata runtime diff 失败');
+        }
+        return res.data;
+    }
+    async getSourceStatus() {
+        const response = await this.graphql(`query SourceStatus {
+        sourceStatus {
+          remoteRevision
+          remoteHash
+          baselineRevision
+          baselineHash
+          baselineSource
+          baselineAvailable
+          changedComponentCount
+          files {
+            path
+            hash
+            componentKey
+            baselineHash
+          }
+          baselineFiles {
+            path
+            hash
+            componentKey
+            baselineHash
+          }
+          drift
+          tracking
+        }
+      }`);
+        return response.sourceStatus;
+    }
+    async getRemoteChanges(workspaceId) {
+        const response = await this.graphql(`query RemoteChanges($workspaceId: ID) {
+        remoteChanges(workspaceId: $workspaceId) {
+          id
+          componentType
+          componentId
+          componentName
+          changeType
+          changeSource
+          changedAt
+        }
+      }`, workspaceId ? { workspaceId } : undefined);
+        return response.remoteChanges;
+    }
+    async getLocalChanges(workspaceId) {
+        const response = await this.graphql(`query LocalChanges($workspaceId: ID) {
+        localChanges(workspaceId: $workspaceId) {
+          id
+          componentType
+          componentId
+          componentName
+          changeType
+          changeSource
+          changedAt
+        }
+      }`, workspaceId ? { workspaceId } : undefined);
+        return response.localChanges;
+    }
+    async getSourceFiles(input) {
+        const response = await this.graphql(`query SourceFiles($paths: [String!], $recordAccess: Boolean) {
+        sourceFiles(paths: $paths, recordAccess: $recordAccess) {
+          remoteRevision
+          files {
+            path
+            hash
+            content
+            componentKey
+            baselineHash
+          }
+        }
+      }`, input);
+        return response.sourceFiles;
+    }
+    async pushSource(input) {
+        const response = await this.graphql(`mutation PushSource($files: [SourceFileInput!]!, $dryRun: Boolean) {
+        pushSource(files: $files, dryRun: $dryRun) {
+          success
+          count
+          dryRun
+          beforeRevision
+          afterRevision
+          plan
+        }
+      }`, input);
+        return response.pushSource;
+    }
+    async rebuildSourceBaseline(reason) {
+        const response = await this.graphql(`mutation RebuildSourceBaseline($reason: String) {
+        rebuildSourceBaseline(reason: $reason) {
+          success
+          baselineAvailable
+          baselineRevision
+          baselineSource
+          filesCount
+          warnings
+        }
+      }`, reason ? { reason } : undefined);
+        return response.rebuildSourceBaseline;
+    }
+    async importRuntimeMetadata(files, options) {
+        const res = await this.post('/api/metadata/runtime/import', {
+            files,
+            dryRun: options?.dryRun,
+            destructiveSync: options?.destructiveSync,
+        });
+        if (!res.success) {
+            throw new Error(res.error || 'metadata runtime 导入失败');
+        }
+        return res.data;
+    }
+    async getMetadataPackageInstallPlan(input) {
+        const response = await this.graphql(`query MetadataPackageInstallPlan(
+        $workspaceId: String!,
+        $manifests: JSON!,
+        $dryRun: Boolean,
+        $packageDirectory: String,
+        $coreVersion: String
+      ) {
+        metadataPackageInstallPlan(
+          workspaceId: $workspaceId,
+          manifests: $manifests,
+          dryRun: $dryRun,
+          packageDirectory: $packageDirectory,
+          coreVersion: $coreVersion
+        )
+      }`, input);
+        return response.metadataPackageInstallPlan;
+    }
+    async installMetadataPackage(input) {
+        const response = await this.graphql(`mutation InstallMetadataPackage(
+        $workspaceId: String!,
+        $manifest: JSON!,
+        $dryRun: Boolean,
+        $packageDirectory: String,
+        $archivePath: String,
+        $serializerChangeSetId: String,
+        $sourceUri: String,
+        $coreVersion: String
+      ) {
+        installMetadataPackage(
+          workspaceId: $workspaceId,
+          manifest: $manifest,
+          dryRun: $dryRun,
+          packageDirectory: $packageDirectory,
+          archivePath: $archivePath,
+          serializerChangeSetId: $serializerChangeSetId,
+          sourceUri: $sourceUri,
+          coreVersion: $coreVersion
+        )
+      }`, input);
+        return response.installMetadataPackage;
+    }
+    async deployEmployeePackage(input) {
+        const response = await this.graphql(`mutation DeployEmployeePackage(
+        $workspaceId: String!,
+        $manifest: JSON!,
+        $dryRun: Boolean,
+        $allowMutatingEvals: Boolean,
+        $skipEmbeddings: Boolean,
+        $forceAdopt: Boolean
+      ) {
+        deployEmployeePackage(
+          workspaceId: $workspaceId,
+          manifest: $manifest,
+          dryRun: $dryRun,
+          allowMutatingEvals: $allowMutatingEvals,
+          skipEmbeddings: $skipEmbeddings,
+          forceAdopt: $forceAdopt
+        )
+      }`, input);
+        return response.deployEmployeePackage;
+    }
+    async getEmployeeDeploymentReport(input) {
+        const response = await this.graphql(`query EmployeeDeploymentReport($workspaceId: String!, $deploymentReportId: String!) {
+        employeeDeploymentReport(workspaceId: $workspaceId, deploymentReportId: $deploymentReportId) {
+          id workspaceId agentId gateReportId auditId packageName packageVersion
+          status activationStatus activated gatePassed gateFailureReason
+          coreVersion cliVersion errors createdAt updatedAt
+        }
+      }`, input);
+        return response.employeeDeploymentReport;
+    }
+    async listEmployeeDeploymentReports(workspaceId) {
+        const response = await this.graphql(`query EmployeeDeploymentReports($workspaceId: String!) {
+        employeeDeploymentReports(workspaceId: $workspaceId) {
+          id workspaceId agentId gateReportId auditId packageName packageVersion
+          status activationStatus activated gatePassed gateFailureReason
+          coreVersion cliVersion errors createdAt updatedAt
+        }
+      }`, { workspaceId });
+        return response.employeeDeploymentReports ?? [];
+    }
+    async runRuntimeDemoPreflight(input) {
+        const response = await this.graphql(`mutation RunRuntimeDemoPreflight(
+        $workspaceId: String!,
+        $expectedCoreSha: String,
+        $imageEvidence: JSON
+      ) {
+        runRuntimeDemoPreflight(
+          workspaceId: $workspaceId,
+          expectedCoreSha: $expectedCoreSha,
+          imageEvidence: $imageEvidence
+        ) {
+          id workspaceId actor overallStatus
+          coreVersion cliVersion
+          frontendImageSha mobileImageSha backendImageSha cliImageSha
+          metadataInstallIds businessDataInstallIds
+          deploymentReportId gateReportId auditId agentId
+          checks blockers createdAt
+        }
+      }`, input);
+        return response.runRuntimeDemoPreflight;
+    }
+    async getRuntimeDemoPreflightReport(input) {
+        const response = await this.graphql(`query RuntimeDemoPreflightReport($workspaceId: String!, $preflightReportId: String!) {
+        runtimeDemoPreflightReport(workspaceId: $workspaceId, preflightReportId: $preflightReportId) {
+          id workspaceId actor overallStatus
+          coreVersion cliVersion
+          frontendImageSha mobileImageSha backendImageSha cliImageSha
+          metadataInstallIds businessDataInstallIds
+          deploymentReportId gateReportId auditId agentId
+          checks blockers createdAt
+        }
+      }`, input);
+        return response.runtimeDemoPreflightReport;
+    }
+    async registerMetadataInstall(input) {
+        const response = await this.graphql(`mutation RegisterMetadataInstall(
+        $workspaceId: String!,
+        $packageName: String!,
+        $version: String!,
+        $installedStateId: String!,
+        $compatibleCoreSha: String!,
+        $auditId: String,
+        $sourceUri: String
+      ) {
+        registerMetadataInstall(
+          workspaceId: $workspaceId,
+          packageName: $packageName,
+          version: $version,
+          installedStateId: $installedStateId,
+          compatibleCoreSha: $compatibleCoreSha,
+          auditId: $auditId,
+          sourceUri: $sourceUri
+        )
+      }`, input);
+        return response.registerMetadataInstall;
+    }
+    async registerBusinessDataInstall(input) {
+        const response = await this.graphql(`mutation RegisterBusinessDataInstall(
+        $workspaceId: String!,
+        $contractName: String!,
+        $contractVersion: String!,
+        $compatibleCoreSha: String!,
+        $sourceUri: String,
+        $auditId: String,
+        $summary: JSON
+      ) {
+        registerBusinessDataInstall(
+          workspaceId: $workspaceId,
+          contractName: $contractName,
+          contractVersion: $contractVersion,
+          compatibleCoreSha: $compatibleCoreSha,
+          sourceUri: $sourceUri,
+          auditId: $auditId,
+          summary: $summary
+        )
+      }`, input);
+        return response.registerBusinessDataInstall;
+    }
+    async listMetadataInstallations(workspaceId) {
+        const response = await this.graphql(`query MetadataInstallationRecords($workspaceId: String!) {
+        metadataInstallationRecords(workspaceId: $workspaceId)
+      }`, { workspaceId });
+        return response.metadataInstallationRecords ?? [];
+    }
+    async listBusinessDataInstallations(workspaceId) {
+        const response = await this.graphql(`query BusinessDataInstallationRecords($workspaceId: String!) {
+        businessDataInstallationRecords(workspaceId: $workspaceId)
+      }`, { workspaceId });
+        return response.businessDataInstallationRecords ?? [];
+    }
+    async upgradeMetadataPackage(input) {
+        const response = await this.graphql(`mutation UpgradeMetadataPackage(
+        $workspaceId: String!,
+        $manifest: JSON!,
+        $allowDestructiveChanges: Boolean,
+        $packageDirectory: String,
+        $archivePath: String,
+        $serializerChangeSetId: String,
+        $coreVersion: String
+      ) {
+        upgradeMetadataPackage(
+          workspaceId: $workspaceId,
+          manifest: $manifest,
+          allowDestructiveChanges: $allowDestructiveChanges,
+          packageDirectory: $packageDirectory,
+          archivePath: $archivePath,
+          serializerChangeSetId: $serializerChangeSetId,
+          coreVersion: $coreVersion
+        )
+      }`, input);
+        return response.upgradeMetadataPackage;
+    }
+    async uninstallMetadataPackage(input) {
+        const response = await this.graphql(`mutation UninstallMetadataPackage(
+        $workspaceId: String!,
+        $packageName: String!,
+        $force: Boolean,
+        $purgeMetadata: Boolean
+      ) {
+        uninstallMetadataPackage(
+          workspaceId: $workspaceId,
+          packageName: $packageName,
+          force: $force,
+          purgeMetadata: $purgeMetadata
+        )
+      }`, input);
+        return response.uninstallMetadataPackage;
+    }
+    async rollbackMetadataPackageInstall(input) {
+        const response = await this.graphql(`mutation RollbackMetadataPackageInstall(
+        $workspaceId: String!,
+        $manifest: JSON!,
+        $deploymentHistoryId: String,
+        $targetStateId: String,
+        $cascade: Boolean,
+        $dryRun: Boolean
+      ) {
+        rollbackMetadataPackageInstall(
+          workspaceId: $workspaceId,
+          manifest: $manifest,
+          deploymentHistoryId: $deploymentHistoryId,
+          targetStateId: $targetStateId,
+          cascade: $cascade,
+          dryRun: $dryRun
+        )
+      }`, input);
+        return response.rollbackMetadataPackageInstall;
+    }
+    async runtimeComposerPreview(input) {
+        const response = await this.graphql(`query RuntimeComposerPreview($input: JSON!, $registryRootDirectories: [String!]) {
+        runtimeComposerPreview(
+          input: $input,
+          registryRootDirectories: $registryRootDirectories
+        )
+      }`, input);
+        return response.runtimeComposerPreview;
+    }
+    async rollbackDeployment(input) {
+        const response = await this.graphql(`mutation RollbackDeployment($historyId: ID!, $componentIds: [String!]) {
+        rollbackDeployment(historyId: $historyId, componentIds: $componentIds) {
+          id
+          result
+          errorMessage
+        }
+      }`, input);
+        return response.rollbackDeployment;
+    }
+    async promoteSandbox(input) {
+        const response = await this.graphql(`mutation PromoteSandbox($input: PromoteSandboxInput!) {
+        promoteSandbox(input: $input)
+      }`, { input });
+        return response.promoteSandbox;
+    }
+    async getSandboxPromotionPrecheck(input) {
+        const response = await this.graphql(`query PromotionPrecheck($input: PromotionPrecheckInput!) {
+        promotionPrecheck(input: $input) {
+          canPromote
+          warnings
+          errors
+          frontendDiff {
+            from
+            to
+            changes
+          }
+          backendDiff {
+            from
+            to
+            changes
+          }
+        }
+      }`, { input });
+        return response.promotionPrecheck;
+    }
+    async codeEnvironmentPromotionPlan(input) {
+        const response = await this.graphql(`query CodeEnvironmentPromotionPlan($input: JSON!) {
+        codeEnvironmentPromotionPlan(input: $input)
+      }`, { input });
+        return response.codeEnvironmentPromotionPlan;
+    }
+    async promoteCodeEnvironment(input) {
+        const response = await this.graphql(`mutation PromoteCodeEnvironment($input: JSON!) {
+        promoteCodeEnvironment(input: $input)
+      }`, { input });
+        return response.promoteCodeEnvironment;
+    }
+    async listInstalledMetadataPackages(input) {
+        const response = await this.graphql(`query InstalledMetadataPackages($workspaceId: String!, $includeUninstalled: Boolean) {
+        installedMetadataPackages(
+          workspaceId: $workspaceId,
+          includeUninstalled: $includeUninstalled
+        ) {
+          id
+          workspaceId
+          packageName
+          version
+          packageDigest
+          installSource
+          status
+          installedAt
+          updatedAt
+          manifest
+        }
+      }`, input);
+        return response.installedMetadataPackages;
+    }
+    async listMetadataPackageInstallHistory(input) {
+        const response = await this.graphql(`query MetadataPackageInstallHistory($workspaceId: String!, $packageName: String) {
+        metadataPackageInstallHistory(
+          workspaceId: $workspaceId,
+          packageName: $packageName
+        ) {
+          id
+          workspaceId
+          packageName
+          version
+          action
+          status
+          installSource
+          sourceUri
+          manifest
+          details
+          sourceStateId
+          targetStateId
+          rollbackDetails
+          createdAt
+        }
+      }`, input);
+        return response.metadataPackageInstallHistory;
+    }
+    async verifyMetadataPackageSnapshots(input) {
+        const response = await this.graphql(`query VerifyMetadataPackageSnapshots($workspaceId: String!, $packageName: String!) {
+        verifyMetadataPackageSnapshots(
+          workspaceId: $workspaceId,
+          packageName: $packageName
+        )
+      }`, input);
+        return response.verifyMetadataPackageSnapshots;
+    }
+    async promotePackage(input) {
+        const res = await this.post('/api/registry/promotions', input);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || '创建 promotion 失败');
+        }
+        return res.data.promotion;
+    }
+    async getPromotionHistory(input) {
+        const params = new URLSearchParams();
+        for (const [key, value] of Object.entries(input)) {
+            if (value) {
+                params.set(key, value);
+            }
+        }
+        const res = await this.get(`/api/registry/promotions?${params.toString()}`);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || '查询 promotion 历史失败');
+        }
+        return res.data.promotions;
+    }
+    async getPromotion(id) {
+        const res = await this.get(`/api/registry/promotions/${encodeURIComponent(id)}`);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || '查询 promotion 失败');
+        }
+        return res.data.promotion;
+    }
+    async getRolloutStatus(input) {
+        const params = new URLSearchParams({ channel: input.channel });
+        const res = await this.get(`/api/registry/rollouts/${encodeURIComponent(input.packageName)}/${encodeURIComponent(input.version)}?${params.toString()}`);
+        if (!res.success) {
+            throw new Error(res.error || '查询 rollout 状态失败');
+        }
+        return res.data ?? null;
+    }
+    async updateRolloutPercentage(input) {
+        const res = await this.put(`/api/registry/rollouts/${encodeURIComponent(input.packageName)}/${encodeURIComponent(input.version)}`, input);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || '更新 rollout 失败');
+        }
+        return res.data.rollout;
+    }
+    async getRolloutWorkspaces(input) {
+        const params = new URLSearchParams({ channel: input.channel });
+        if (typeof input.limit === 'number') {
+            params.set('limit', String(input.limit));
+        }
+        const res = await this.get(`/api/registry/rollouts/${encodeURIComponent(input.packageName)}/${encodeURIComponent(input.version)}/workspaces?${params.toString()}`);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || '查询 rollout workspaces 失败');
+        }
+        return res.data.workspaces;
+    }
+    async deprecatePackageVersion(input) {
+        const res = await this.post('/api/registry/deprecations', input);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || '标记 package deprecated 失败');
+        }
+        return res.data.deprecation;
+    }
+    async getChannelPolicy() {
+        const res = await this.get('/api/registry/channel-policy');
+        if (!res.success || !res.data) {
+            throw new Error(res.error || '查询 channel policy 失败');
+        }
+        return res.data;
+    }
+    async grantChannelAccess(input) {
+        const res = await this.post('/api/registry/entitlements', input);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || '授予 channel entitlement 失败');
+        }
+        return res.data.entitlement;
+    }
+    async revokeChannelAccess(input) {
+        const res = await this.post(`/api/registry/entitlements/${encodeURIComponent(input.entitlementId)}/revoke`, { reason: input.reason });
+        if (!res.success || !res.data) {
+            throw new Error(res.error || '撤销 channel entitlement 失败');
+        }
+        return res.data.entitlement;
+    }
+    async listChannelEntitlements(input) {
+        const params = new URLSearchParams();
+        if (input.status) {
+            params.set('status', input.status);
+        }
+        const res = await this.get(`/api/registry/entitlements/workspace/${encodeURIComponent(input.workspaceId)}?${params.toString()}`);
+        if (!res.success || !res.data) {
+            throw new Error(res.error || '查询 channel entitlements 失败');
+        }
+        return res.data.entitlements;
+    }
+}
+exports.ApiClient = ApiClient;
+function createApiClient(targetOrg, requestTimeoutMs) {
+    const timeoutMs = normalizeRequestTimeoutMs(requestTimeoutMs);
+    if (targetOrg) {
+        const credential = (0, auth_store_1.loadCredential)(targetOrg);
+        if (!credential) {
+            throw new Error(`未找到 org 凭据: ${targetOrg}`);
+        }
+        return new ApiClient(credential.instanceUrl, credential.accessToken, targetOrg, timeoutMs);
+    }
+    if (process.env.NEXUS_BASE_URL || process.env.NEXUS_AUTH_TOKEN) {
+        return new ApiClient(undefined, undefined, undefined, timeoutMs);
+    }
+    const credential = (0, auth_store_1.getDefaultCredential)();
+    if (credential) {
+        return new ApiClient(credential.instanceUrl, credential.accessToken, credential.alias, timeoutMs);
+    }
+    return new ApiClient(undefined, undefined, undefined, timeoutMs);
+}
+//# sourceMappingURL=api-client.js.map