@nexusclawhq/cli 0.2.1

package/dist/nexus-cli/src/services/api-client.test.js

@@ -0,0 +1,669 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_http_1 = __importDefault(require("node:http"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_test_1 = __importDefault(require("node:test"));
+const api_client_1 = require("./api-client");
+async function createJsonServer(responder) {
+    const requests = [];
+    const server = node_http_1.default.createServer((req, res) => {
+        let body = '';
+        req.on('data', (chunk) => {
+            body += chunk.toString();
+        });
+        req.on('end', () => {
+            const request = {
+                method: req.method ?? 'GET',
+                path: req.url ?? '/',
+                headers: req.headers,
+                body,
+            };
+            requests.push(request);
+            responder(request, res);
+        });
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        throw new Error('Unable to determine server address');
+    }
+    return {
+        baseUrl: `http://127.0.0.1:${address.port}`,
+        requests,
+        close: () => new Promise((resolve, reject) => {
+            server.close((error) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve();
+            });
+        }),
+    };
+}
+async function withTempHome(callback) {
+    const originalHome = process.env.HOME;
+    const originalUserProfile = process.env.USERPROFILE;
+    const tempHome = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'nexus-api-client-'));
+    process.env.HOME = tempHome;
+    process.env.USERPROFILE = tempHome;
+    try {
+        return await callback(tempHome);
+    }
+    finally {
+        if (originalHome === undefined) {
+            delete process.env.HOME;
+        }
+        else {
+            process.env.HOME = originalHome;
+        }
+        if (originalUserProfile === undefined) {
+            delete process.env.USERPROFILE;
+        }
+        else {
+            process.env.USERPROFILE = originalUserProfile;
+        }
+        delete process.env.NEXUS_BASE_URL;
+        delete process.env.NEXUS_AUTH_TOKEN;
+        node_fs_1.default.rmSync(tempHome, { recursive: true, force: true });
+    }
+}
+function loadFreshModules() {
+    const apiClientPath = require.resolve('./api-client');
+    const authStorePath = require.resolve('./auth-store');
+    delete require.cache[apiClientPath];
+    delete require.cache[authStorePath];
+    return {
+        apiClient: require(apiClientPath),
+        authStore: require(authStorePath),
+    };
+}
+(0, node_test_1.default)('validate posts changeSetId and normalizes validation errors/warnings', async () => {
+    const server = await createJsonServer((_request, response) => {
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({
+            success: true,
+            errors: [],
+            warnings: [{ message: 'missing optional metadata' }],
+        }));
+    });
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'secret-token');
+        const result = await client.validate('changeset-123');
+        strict_1.default.deepEqual(result, {
+            success: true,
+            errors: [],
+            warnings: ['missing optional metadata'],
+        });
+        strict_1.default.equal(server.requests[0]?.method, 'POST');
+        strict_1.default.equal(server.requests[0]?.path, '/api/metadata/validate');
+        strict_1.default.equal(server.requests[0]?.headers.authorization, 'Bearer secret-token');
+        strict_1.default.deepEqual(JSON.parse(server.requests[0]?.body ?? '{}'), {
+            changeSetId: 'changeset-123',
+        });
+    }
+    finally {
+        await server.close();
+    }
+});
+(0, node_test_1.default)('getAiContextSigningKeys unwraps the backend REST response envelope', async () => {
+    const keySet = {
+        schemaVersion: 'nexusclaw.ai-context-signing-key-set/v1',
+        issuer: 'https://core.example.test',
+        generatedAt: '2026-07-19T00:00:00.000Z',
+        cacheUntil: '2026-07-19T01:00:00.000Z',
+        keys: [],
+    };
+    const server = await createJsonServer((_request, response) => {
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({
+            data: keySet,
+            meta: { traceId: 'trace-1', timestamp: keySet.generatedAt },
+        }));
+    });
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'secret-token');
+        strict_1.default.deepEqual(await client.getAiContextSigningKeys(), keySet);
+        strict_1.default.equal(server.requests[0]?.path, '/api/v1/ai-authoring-context/signing-keys');
+    }
+    finally {
+        await server.close();
+    }
+});
+(0, node_test_1.default)('validateDeploymentSource posts files to the deployment validation endpoint', async () => {
+    const server = await createJsonServer((_request, response) => {
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({
+            report: {
+                schemaVersion: 'deployment-validation-report/v1',
+                operation: 'source-push',
+                success: true,
+                generatedAt: new Date().toISOString(),
+                errors: [],
+                warnings: [],
+                suggestions: [],
+                affectedComponents: [],
+                summary: {
+                    errorCount: 0,
+                    warningCount: 0,
+                    suggestionCount: 0,
+                    affectedComponentCount: 0,
+                },
+            },
+            rendered: '{}',
+        }));
+    });
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'secret-token');
+        const result = await client.validateDeploymentSource({
+            files: [{ path: 'objects/account.yaml', content: 'kind: object' }],
+            format: 'json',
+        });
+        strict_1.default.equal(server.requests[0]?.path, '/api/deployment/validate/source');
+        strict_1.default.equal(result.report.operation, 'source-push');
+    }
+    finally {
+        await server.close();
+    }
+});
+(0, node_test_1.default)('deploy throws a descriptive error when the backend rejects the request', async () => {
+    const server = await createJsonServer((_request, response) => {
+        response.writeHead(500, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({
+            message: '部署失败：测试环境不可用',
+        }));
+    });
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'secret-token');
+        await strict_1.default.rejects(() => client.deploy('changeset-123'), /部署失败：测试环境不可用/);
+    }
+    finally {
+        await server.close();
+    }
+});
+(0, node_test_1.default)('retrieve posts changeSetId and returns the download payload contract', async () => {
+    const server = await createJsonServer((_request, response) => {
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({
+            downloadUrl: 'data:application/zip;base64,ZmFrZS16aXA=',
+            filename: 'account-package.zip',
+            size: 8,
+        }));
+    });
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'secret-token');
+        const result = await client.retrieve('changeset-456');
+        strict_1.default.deepEqual(result, {
+            downloadUrl: 'data:application/zip;base64,ZmFrZS16aXA=',
+            filename: 'account-package.zip',
+            size: 8,
+        });
+        strict_1.default.deepEqual(JSON.parse(server.requests[0]?.body ?? '{}'), {
+            changeSetId: 'changeset-456',
+        });
+    }
+    finally {
+        await server.close();
+    }
+});
+(0, node_test_1.default)('getDeployStatus reads the metadata status endpoint and normalizes the result', async () => {
+    const server = await createJsonServer((_request, response) => {
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({
+            id: 'job-1',
+            result: 'success',
+            errorMessage: null,
+        }));
+    });
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'secret-token');
+        const result = await client.getDeployStatus('job-1');
+        strict_1.default.equal(server.requests[0]?.method, 'GET');
+        strict_1.default.equal(server.requests[0]?.path, '/api/metadata/status/job-1');
+        strict_1.default.deepEqual(result, {
+            jobId: 'job-1',
+            status: 'success',
+            progress: 100,
+            message: 'success',
+            errors: [],
+        });
+    }
+    finally {
+        await server.close();
+    }
+});
+(0, node_test_1.default)('exportRuntimeMetadata fetches rendered declarative files from the runtime endpoint', async () => {
+    const server = await createJsonServer((_request, response) => {
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({
+            snapshot: { schemaVersion: 'metadata-runtime/v1', objects: [] },
+            files: [
+                {
+                    path: 'objects/Account/object.json',
+                    hash: 'hash-1',
+                    content: '{"kind":"object"}',
+                },
+            ],
+        }));
+    });
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'secret-token');
+        const result = await client.exportRuntimeMetadata();
+        strict_1.default.equal(server.requests[0]?.method, 'GET');
+        strict_1.default.equal(server.requests[0]?.path, '/api/metadata/runtime/export');
+        strict_1.default.equal(result.files[0]?.path, 'objects/Account/object.json');
+    }
+    finally {
+        await server.close();
+    }
+});
+(0, node_test_1.default)('createApiClient resolves an explicit org alias from auth-store credentials', async () => {
+    await withTempHome(async () => {
+        const server = await createJsonServer((_request, response) => {
+            response.writeHead(200, { 'Content-Type': 'application/json' });
+            response.end(JSON.stringify({
+                sandboxes: [],
+            }));
+        });
+        try {
+            const { apiClient, authStore } = loadFreshModules();
+            authStore.saveCredential({
+                alias: 'sandbox',
+                instanceUrl: server.baseUrl,
+                accessToken: 'alias-token',
+                username: 'bill@nexusclaw.com',
+                orgId: 'org-1',
+                isDefault: true,
+            });
+            const client = apiClient.createApiClient('sandbox');
+            const result = await client.get('/api/sandboxes');
+            strict_1.default.equal(server.requests[0]?.headers.authorization, 'Bearer alias-token');
+            strict_1.default.equal(server.requests[0]?.headers['x-workspace-id'], 'org-1');
+            strict_1.default.equal(result.success, true);
+        }
+        finally {
+            await server.close();
+        }
+    });
+});
+(0, node_test_1.default)('graphql preserves governance extensions without retaining arbitrary provider fields', async () => {
+    const server = await createJsonServer((_request, response) => {
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({
+            errors: [{
+                    message: 'candidate digest mismatch',
+                    path: ['stageExecutableWorkforceBundle'],
+                    extensions: {
+                        code: 'BUNDLE_SOURCE_LOCK_MISMATCH',
+                        path: '/sourceLockDigest',
+                        ruleId: 'release.source-lock.exact',
+                        retryable: false,
+                        providerResponse: { authorization: 'Bearer leaked' },
+                    },
+                }],
+        }));
+    });
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'secret-token');
+        await strict_1.default.rejects(() => client.graphql('mutation Test { test }'), (error) => {
+            strict_1.default.ok(error instanceof api_client_1.GraphQLApiError);
+            strict_1.default.deepEqual(error.errors, [{
+                    message: 'candidate digest mismatch',
+                    code: 'BUNDLE_SOURCE_LOCK_MISMATCH',
+                    path: ['stageExecutableWorkforceBundle'],
+                    ruleId: 'release.source-lock.exact',
+                    retryable: false,
+                }]);
+            strict_1.default.ok(!JSON.stringify(error).includes('providerResponse'));
+            strict_1.default.ok(!JSON.stringify(error).includes('leaked'));
+            return true;
+        });
+    }
+    finally {
+        await server.close();
+    }
+});
+(0, node_test_1.default)('ensureValidToken refreshes an expired token via POST /oauth/token and rotates the pair', async () => {
+    await withTempHome(async () => {
+        const { apiClient, authStore } = loadFreshModules();
+        const server = await createJsonServer((request, response) => {
+            strict_1.default.equal(request.method, 'POST');
+            strict_1.default.equal(request.path, '/oauth/token');
+            strict_1.default.equal(request.headers['content-type'], 'application/x-www-form-urlencoded');
+            const params = new URLSearchParams(request.body);
+            strict_1.default.equal(params.get('grant_type'), 'refresh_token');
+            strict_1.default.equal(params.get('refresh_token'), 'old-refresh');
+            strict_1.default.equal(params.get('client_id'), 'nexusclaw-cli');
+            response.writeHead(200, { 'Content-Type': 'application/json' });
+            response.end(JSON.stringify({
+                access_token: 'rotated-access',
+                refresh_token: 'rotated-refresh',
+                token_type: 'Bearer',
+                expires_in: 3600,
+                scope: 'read:accounts',
+            }));
+        });
+        try {
+            authStore.saveCredential({
+                alias: 'medtech-demo',
+                instanceUrl: server.baseUrl,
+                accessToken: 'stale-access',
+                refreshToken: 'old-refresh',
+                username: 'bill@nexusclaw.com',
+                orgId: 'ws-1',
+                clientId: 'nexusclaw-cli',
+                scope: 'read:accounts',
+                loginType: 'oauth-web',
+                expiresAt: Date.now() - 60 * 60 * 1000,
+                isDefault: true,
+            });
+            const client = new apiClient.ApiClient(server.baseUrl, 'stale-access', 'medtech-demo');
+            await client.ensureValidToken();
+            const rotated = authStore.loadCredential('medtech-demo');
+            strict_1.default.ok(rotated, 'credential should still exist after refresh');
+            strict_1.default.equal(rotated.accessToken, 'rotated-access');
+            strict_1.default.equal(rotated.refreshToken, 'rotated-refresh');
+            strict_1.default.ok(rotated.expiresAt > Date.now(), 'expiresAt should be in the future');
+        }
+        finally {
+            await server.close();
+        }
+    });
+});
+(0, node_test_1.default)('ensureValidToken does not refresh local OAuth credentials when NEXUS_AUTH_TOKEN is explicit', async () => {
+    const previousToken = process.env.NEXUS_AUTH_TOKEN;
+    await withTempHome(async () => {
+        const { apiClient, authStore } = loadFreshModules();
+        const server = await createJsonServer((_request, response) => {
+            response.writeHead(500, { 'Content-Type': 'application/json' });
+            response.end(JSON.stringify({ error: 'refresh should not be called' }));
+        });
+        try {
+            process.env.NEXUS_AUTH_TOKEN = 'explicit-test-token';
+            authStore.saveCredential({
+                alias: 'medtech-demo',
+                instanceUrl: server.baseUrl,
+                accessToken: 'stale-access',
+                refreshToken: 'old-refresh',
+                username: 'bill@nexusclaw.com',
+                orgId: 'ws-1',
+                clientId: 'nexusclaw-cli',
+                scope: 'read:accounts',
+                loginType: 'oauth-web',
+                expiresAt: Date.now() - 60 * 60 * 1000,
+                isDefault: true,
+            });
+            const client = new apiClient.ApiClient(server.baseUrl);
+            await client.ensureValidToken();
+            strict_1.default.equal(server.requests.length, 0);
+            strict_1.default.equal(authStore.loadCredential('medtech-demo')?.accessToken, 'stale-access');
+        }
+        finally {
+            if (previousToken === undefined) {
+                delete process.env.NEXUS_AUTH_TOKEN;
+            }
+            else {
+                process.env.NEXUS_AUTH_TOKEN = previousToken;
+            }
+            await server.close();
+        }
+    });
+});
+(0, node_test_1.default)('ensureValidToken surfaces a non-sensitive error when the refresh endpoint fails', async () => {
+    await withTempHome(async () => {
+        const { apiClient, authStore } = loadFreshModules();
+        const server = await createJsonServer((_request, response) => {
+            response.writeHead(400, { 'Content-Type': 'application/json' });
+            response.end(JSON.stringify({ error: 'invalid_grant' }));
+        });
+        try {
+            authStore.saveCredential({
+                alias: 'medtech-demo',
+                instanceUrl: server.baseUrl,
+                accessToken: 'stale-access',
+                refreshToken: 'bad-refresh',
+                username: 'bill@nexusclaw.com',
+                orgId: 'ws-1',
+                clientId: 'nexusclaw-cli',
+                loginType: 'oauth-web',
+                expiresAt: Date.now() - 60 * 60 * 1000,
+                isDefault: true,
+            });
+            const client = new apiClient.ApiClient(server.baseUrl, 'stale-access', 'medtech-demo');
+            await strict_1.default.rejects(client.ensureValidToken(), (error) => {
+                strict_1.default.match(error.message, /OAuth session expired/i);
+                strict_1.default.doesNotMatch(error.message, /bad-refresh/);
+                return true;
+            });
+        }
+        finally {
+            await server.close();
+        }
+    });
+});
+(0, node_test_1.default)('executable package client reserves, uploads exact bytes, and calls typed validation only', async () => {
+    const archiveDigest = 'sha256:4a70fe9aa6436e02c2dea340fbd1e352e4ef2d8ce6ca52ad25d4b95471fc8bf2';
+    const packageDigest = 'sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb';
+    const contextDigest = 'sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc';
+    const server = await createJsonServer((request, response) => {
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        if (request.method === 'POST' &&
+            request.path === '/graphql' &&
+            /CreateExecutablePackageUploadSession/.test(request.body)) {
+            response.end(JSON.stringify({ data: {
+                    createExecutablePackageUploadSession: {
+                        uploadSessionId: 'session-1',
+                        expiresAt: '2026-07-18T01:00:00.000Z',
+                        uploadUrl: '/api/v1/deployment/executable-package-uploads/session-1',
+                        method: 'PUT',
+                        requiredHeaderNames: ['Content-Length', 'Digest', 'Idempotency-Key'],
+                    },
+                } }));
+            return;
+        }
+        if (request.method === 'PUT') {
+            response.end(JSON.stringify({
+                stagedArtifactId: 'artifact-1',
+                status: 'sealed',
+                archiveDigest,
+                packageDigest,
+                sizeBytes: 3,
+                fileCount: 1,
+                declaredSurfaces: ['code'],
+                sealedAt: '2026-07-18T00:00:00.000Z',
+                expiresAt: '2026-07-18T01:00:00.000Z',
+            }));
+            return;
+        }
+        response.end(JSON.stringify({
+            data: {
+                validateExecutablePackageArtifact: {
+                    schemaVersion: 'nexusclaw.validate-executable-package-artifact-result/v1',
+                    valid: true,
+                    stagedArtifactId: 'artifact-1',
+                    archiveDigest,
+                    packageDigest,
+                    contextManifestContentDigest: contextDigest,
+                    diagnostics: [],
+                },
+            },
+        }));
+    });
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'token', 'nonexistent-test-org');
+        const session = await client.createExecutablePackageUploadSession({
+            schemaVersion: 'nexusclaw.create-executable-package-upload-session-input/v1',
+            targetWorkspaceId: 'workspace-1',
+            archiveFormat: 'zip-store-v1',
+            archiveDigest,
+            packageDigest,
+            archiveSizeBytes: 3,
+            fileCount: 1,
+            declaredSurfaces: ['code'],
+        }, 'idem-1');
+        const artifact = await client.uploadExecutablePackageArtifact({
+            uploadUrl: session.uploadUrl,
+            bytes: Buffer.from('zip'),
+            archiveDigest,
+            packageDigest,
+            idempotencyKey: 'idem-1',
+        });
+        const validation = await client.validateExecutablePackageArtifact({
+            schemaVersion: 'nexusclaw.validate-executable-package-artifact-input/v1',
+            targetWorkspaceId: 'workspace-1',
+            stagedArtifactId: artifact.stagedArtifactId,
+            expectedArchiveDigest: archiveDigest,
+            expectedPackageDigest: packageDigest,
+            contextManifestContentDigest: contextDigest,
+        });
+        strict_1.default.equal(validation.valid, true);
+        strict_1.default.equal(JSON.parse(server.requests[0].body).variables.idempotencyKey, 'idem-1');
+        strict_1.default.equal(server.requests[1]?.body, 'zip');
+        strict_1.default.equal(server.requests[1]?.headers.digest, `sha-256=${Buffer.from(archiveDigest.slice(7), 'hex').toString('base64')}`);
+        strict_1.default.match(JSON.parse(server.requests[2].body).query, /validateExecutablePackageArtifact/);
+    }
+    finally {
+        await server.close();
+    }
+});
+(0, node_test_1.default)('workforce release clients use typed operations and never send an execution workspace selector', async () => {
+    const digest = 'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
+    const server = await createJsonServer((request, response) => {
+        const body = JSON.parse(request.body);
+        const query = String(body.query);
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        if (/RunWorkforceCandidateTests/.test(query)) {
+            response.end(JSON.stringify({ data: { runWorkforceCandidateTests: {
+                        evidenceRunId: 'run-1', evidenceRunDigest: digest, passed: true,
+                        refs: [], isolationBindingId: 'binding-1',
+                        isolationSnapshotHash: digest, resetReceiptId: 'reset-1',
+                        resetReceiptDigest: digest, newAuthorizationGeneration: 2,
+                    } } }));
+            return;
+        }
+        if (/RequestWorkforceReleaseApproval/.test(query)) {
+            response.end(JSON.stringify({ data: { requestWorkforceReleaseApproval: {
+                        schemaVersion: 'nexusclaw.workforce-release-gate-receipt/v1',
+                        approvalId: 'approval-1', candidateReleaseSetId: 'release-1',
+                        evidenceRunIds: ['run-1'], expectedSourceLockDigest: digest,
+                        expectedReleaseItemSetDigest: digest,
+                        expectedMaterializedItemRefsDigest: digest,
+                        governanceContextDigest: digest, decision: 'pending',
+                        decisionVersion: 0, expiresAt: '2026-07-19T00:00:00.000Z',
+                        consumedAt: null, receiptDigest: digest,
+                    } } }));
+            return;
+        }
+        response.end(JSON.stringify({ data: { promoteWorkforceRelease: {
+                    schemaVersion: 'nexusclaw.workforce-release-transition-result/v1',
+                    operation: 'promote', beforeReleaseSetId: null,
+                    afterReleaseSetId: 'release-1', beforeGeneration: 0,
+                    afterGeneration: 1, receiptId: 'receipt-1', outboxId: 'outbox-1',
+                    alreadyApplied: false,
+                } } }));
+    });
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'token', 'org');
+        const identity = {
+            targetWorkspaceId: 'workspace-1',
+            candidateReleaseSetId: 'release-1',
+            expectedSourceLockDigest: digest,
+            expectedReleaseItemSetDigest: digest,
+            expectedMaterializedItemRefsDigest: digest,
+        };
+        await client.runWorkforceCandidateTests({
+            ...identity,
+            selectors: [{ kind: 'employee', suites: ['routing', 'knowledge', 'permission', 'eval'] }],
+        }, 'idem-test');
+        await client.requestWorkforceReleaseApproval({
+            ...identity,
+            evidenceRunIds: ['run-1'],
+        }, 'idem-approval');
+        await client.promoteWorkforceRelease({
+            targetWorkspaceId: 'workspace-1',
+            candidateReleaseSetId: 'release-1',
+            expectedActiveReleaseSetId: 'none',
+            expectedGeneration: 0,
+            expectedReleaseEnvelopeDigest: digest,
+            approvalId: 'approval-1',
+            stepUpChallengeId: 'challenge-1',
+        }, 'idem-promote');
+        for (const request of server.requests) {
+            strict_1.default.doesNotMatch(request.body, /executionWorkspace/i);
+        }
+        strict_1.default.equal(JSON.parse(server.requests[0].body).variables.idempotencyKey, 'idem-test');
+        strict_1.default.match(server.requests[2].body, /promoteWorkforceRelease/);
+    }
+    finally {
+        await server.close();
+    }
+});
+(0, node_test_1.default)('candidate release item query is typed, tenant-bound and read-only', async () => {
+    const server = await createJsonServer((request, response) => {
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({
+            data: {
+                getWorkforceCandidateReleaseItems: [
+                    { itemKind: 'code_action', selectorKey: 'catalog.lookup' },
+                    { itemKind: 'flow', selectorKey: 'account_followup' },
+                ],
+            },
+        }));
+    });
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'token', 'org');
+        strict_1.default.deepEqual(await client.getWorkforceCandidateReleaseItems({
+            targetWorkspaceId: 'workspace-1',
+            candidateReleaseSetId: 'release-1',
+        }), [
+            { itemKind: 'code_action', selectorKey: 'catalog.lookup' },
+            { itemKind: 'flow', selectorKey: 'account_followup' },
+        ]);
+        const request = JSON.parse(server.requests[0].body);
+        strict_1.default.match(request.query, /^query GetWorkforceCandidateReleaseItems/);
+        strict_1.default.deepEqual(request.variables.input, {
+            targetWorkspaceId: 'workspace-1',
+            candidateReleaseSetId: 'release-1',
+        });
+        strict_1.default.doesNotMatch(server.requests[0].body, /executionWorkspace/i);
+    }
+    finally {
+        await server.close();
+    }
+});
+(0, node_test_1.default)('AI authoring context client translates frozen lowercase ABI values to GraphQL enum names', async () => {
+    const server = await createJsonServer((request, response) => {
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({
+            data: {
+                describeAiAuthoringContext: {
+                    schemaVersion: 'nexusclaw.ai-authoring-context/v2',
+                    surface: 'all',
+                    targetWorkspaceId: 'workspace-1',
+                },
+            },
+        }));
+    });
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'token', 'org');
+        await client.describeAiAuthoringContext({
+            schemaVersion: 'nexusclaw.ai-authoring-context/v2',
+            surface: 'all',
+            targetWorkspaceId: 'workspace-1',
+            selector: { kind: 'caller_preview' },
+        });
+        const request = JSON.parse(server.requests[0].body);
+        strict_1.default.equal(request.variables.input.surface, 'ALL');
+        strict_1.default.equal(request.variables.input.selector.kind, 'CALLER_PREVIEW');
+    }
+    finally {
+        await server.close();
+    }
+});
+//# sourceMappingURL=api-client.test.js.map