@nexusclawhq/cli 0.2.3 → 0.3.0

package/dist/nexus-cli/src/services/step-up-helper.test.js

@@ -0,0 +1,176 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_http_1 = __importDefault(require("node:http"));
+const node_test_1 = __importDefault(require("node:test"));
+const api_client_1 = require("./api-client");
+const step_up_helper_1 = require("./step-up-helper");
+async function createStepUpMockServer() {
+    const requests = [];
+    let firstAttempt = true;
+    const server = node_http_1.default.createServer((req, res) => {
+        let body = '';
+        req.on('data', (chunk) => {
+            body += chunk.toString();
+        });
+        req.on('end', () => {
+            const request = {
+                method: req.method ?? 'GET',
+                path: req.url ?? '/',
+                headers: req.headers,
+                body,
+            };
+            requests.push(request);
+            res.setHeader('Content-Type', 'application/json');
+            if (request.method === 'GET' && request.path === '/mfa/factors') {
+                res.end(JSON.stringify([
+                    { id: 'factor-1', type: 'totp', label: 'Authenticator', isVerified: true, isPrimary: true },
+                ]));
+                return;
+            }
+            if (request.method === 'POST' && request.path === '/mfa/step-up/verify') {
+                const parsed = JSON.parse(body);
+                res.end(JSON.stringify({
+                    challengeId: parsed.challengeId,
+                    stepUpToken: 'step-up-token-minted',
+                    expiresAt: '2026-12-31T00:00:00.000Z',
+                }));
+                return;
+            }
+            if (request.method === 'POST' && request.path === '/graphql') {
+                if (firstAttempt) {
+                    firstAttempt = false;
+                    res.end(JSON.stringify({
+                        errors: [
+                            {
+                                message: 'Step-up verification required for action provider_config_admin',
+                                extensions: {
+                                    code: 'STEP_UP_REQUIRED',
+                                    challengeId: 'challenge-abc-123',
+                                    action: 'provider_config_admin',
+                                },
+                            },
+                        ],
+                    }));
+                    return;
+                }
+                const hasStepUpHeader = request.headers['x-step-up-token'] === 'step-up-token-minted';
+                res.end(JSON.stringify({
+                    data: {
+                        createProviderConfig: {
+                            id: 'provider-1',
+                            providerName: 'openai',
+                            defaultModel: 'gpt-4',
+                            success: hasStepUpHeader,
+                        },
+                    },
+                }));
+                return;
+            }
+            res.statusCode = 404;
+            res.end('{}');
+        });
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        throw new Error('Unable to determine server address');
+    }
+    return {
+        baseUrl: `http://127.0.0.1:${address.port}`,
+        requests,
+        close: () => new Promise((resolve, reject) => {
+            server.close((error) => (error ? reject(error) : resolve()));
+        }),
+    };
+}
+(0, node_test_1.default)('extractStepUpRequirement pulls challengeId + action from a STEP_UP_REQUIRED GraphQL error', () => {
+    const error = new api_client_1.GraphQLApiError([
+        {
+            message: 'Step-up verification required for action provider_config_admin',
+            code: 'STEP_UP_REQUIRED',
+            challengeId: 'ch-123',
+            stepUpAction: 'provider_config_admin',
+        },
+    ]);
+    const requirement = (0, api_client_1.extractStepUpRequirement)(error);
+    strict_1.default.deepEqual(requirement, { challengeId: 'ch-123', action: 'provider_config_admin' });
+});
+(0, node_test_1.default)('extractStepUpRequirement returns null for non-step-up errors', () => {
+    const error = new api_client_1.GraphQLApiError([
+        { message: 'permission denied', code: 'FORBIDDEN' },
+    ]);
+    strict_1.default.equal((0, api_client_1.extractStepUpRequirement)(error), null);
+});
+(0, node_test_1.default)('extractStepUpRequirement returns null for non-GraphQLApiError inputs', () => {
+    strict_1.default.equal((0, api_client_1.extractStepUpRequirement)(new Error('boom')), null);
+    strict_1.default.equal((0, api_client_1.extractStepUpRequirement)(null), null);
+    strict_1.default.equal((0, api_client_1.extractStepUpRequirement)(undefined), null);
+});
+(0, node_test_1.default)('runWithStepUp rethrows non-step-up errors untouched', async () => {
+    let threw = false;
+    try {
+        await (0, step_up_helper_1.runWithStepUp)({
+            targetOrg: 'does-not-exist',
+            query: 'mutation { noop }',
+            variables: {},
+            resolveCredential: async () => ({ factorId: 'x', credential: 'x' }),
+        });
+    }
+    catch (error) {
+        threw = true;
+        strict_1.default.match(error.message, /TARGET_ORG_CREDENTIAL_REQUIRED|未找到 org 凭据/);
+    }
+    strict_1.default.ok(threw, 'runWithStepUp must rethrow non-step-up errors');
+});
+(0, node_test_1.default)('runWithStepUp via direct ApiClient: rejects → verify → retries with header', async () => {
+    const server = await createStepUpMockServer();
+    try {
+        const client = new api_client_1.ApiClient(server.baseUrl, 'session-token', 'org-alias');
+        const query = 'mutation { createProviderConfig(input: {providerName:"openai"}) { id success } }';
+        let retryData = null;
+        try {
+            await client.graphql(query, {});
+            strict_1.default.fail('expected STEP_UP_REQUIRED rejection');
+        }
+        catch (error) {
+            const requirement = (0, api_client_1.extractStepUpRequirement)(error);
+            strict_1.default.ok(requirement, 'challengeId should be extractable');
+            strict_1.default.equal(requirement.action, 'provider_config_admin');
+            const factors = await client.listMfaFactors();
+            strict_1.default.equal(factors.length, 1);
+            strict_1.default.equal(factors[0].id, 'factor-1');
+            const proof = await client.stepUpVerify({
+                challengeId: requirement.challengeId,
+                factorId: 'factor-1',
+                factorType: 'totp',
+                credential: '123456',
+            });
+            strict_1.default.equal(proof.stepUpToken, 'step-up-token-minted');
+            retryData = await client.graphqlWithStepUp(query, {}, proof.stepUpToken);
+        }
+        strict_1.default.ok(retryData, 'retry should succeed');
+        strict_1.default.equal(retryData.createProviderConfig.id, 'provider-1');
+        strict_1.default.equal(retryData.createProviderConfig.success, true);
+        const graphqlRequests = server.requests.filter((r) => r.method === 'POST' && r.path === '/graphql');
+        strict_1.default.ok(graphqlRequests.length >= 2, 'two graphql attempts (reject + retry)');
+        const retryRequest = graphqlRequests[graphqlRequests.length - 1];
+        strict_1.default.equal(retryRequest.headers['x-step-up-token'], 'step-up-token-minted', 'retry must attach the step-up token as a header');
+        const verifyRequest = server.requests.find((r) => r.path === '/mfa/step-up/verify');
+        strict_1.default.ok(verifyRequest);
+        strict_1.default.deepEqual(JSON.parse(verifyRequest.body).sessionType, 'step_up');
+    }
+    finally {
+        await server.close();
+    }
+});
+(0, node_test_1.default)('StepUpBootstrapError carries a stable code for exit-code mapping', () => {
+    const error = new step_up_helper_1.StepUpBootstrapError('STEP_UP_NO_VERIFIED_FACTOR', 'no factors');
+    strict_1.default.equal(error.code, 'STEP_UP_NO_VERIFIED_FACTOR');
+    strict_1.default.equal(error.name, 'StepUpBootstrapError');
+    strict_1.default.equal(error.message, 'no factors');
+});
+//# sourceMappingURL=step-up-helper.test.js.map

package/dist/nexus-cli/src/services/step-up-helper.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-helper.test.js","sourceRoot":"","sources":["../../../../src/services/step-up-helper.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,0DAA6B;AAC7B,0DAA6B;AAE7B,6CAAoF;AACpF,qDAAuE;AAuBvE,KAAK,UAAU,sBAAsB;IACnC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,mBAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACvB,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,MAAM,OAAO,GAAG;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;gBAC3B,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG;gBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI;aACL,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEvB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAGlD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAChE,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;iBAC5F,CAAC,CACH,CAAC;gBACF,OAAO;YACT,CAAC;YAGD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,WAAW,EAAE,sBAAsB;oBACnC,SAAS,EAAE,0BAA0B;iBACtC,CAAC,CACH,CAAC;gBACF,OAAO;YACT,CAAC;YAGD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC7D,IAAI,YAAY,EAAE,CAAC;oBACjB,YAAY,GAAG,KAAK,CAAC;oBAErB,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;wBACb,MAAM,EAAE;4BACN;gCACE,OAAO,EAAE,gEAAgE;gCACzE,UAAU,EAAE;oCACV,IAAI,EAAE,kBAAkB;oCACxB,WAAW,EAAE,mBAAmB;oCAChC,MAAM,EAAE,uBAAuB;iCAChC;6BACF;yBACF;qBACF,CAAC,CACH,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,sBAAsB,CAAC;gBACtF,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE;wBACJ,oBAAoB,EAAE;4BACpB,EAAE,EAAE,YAAY;4BAChB,YAAY,EAAE,QAAQ;4BACtB,YAAY,EAAE,OAAO;4BACrB,OAAO,EAAE,eAAe;yBACzB;qBACF;iBACF,CAAC,CACH,CAAC;gBACF,OAAO;YACT,CAAC;YAED,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,oBAAoB,OAAO,CAAC,IAAI,EAAE;QAC3C,QAAQ;QACR,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AAED,IAAA,mBAAI,EAAC,2FAA2F,EAAE,GAAG,EAAE;IACrG,MAAM,KAAK,GAAG,IAAI,4BAAe,CAAC;QAChC;YACE,OAAO,EAAE,gEAAgE;YACzE,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,uBAAuB;SACtC;KACF,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAA,qCAAwB,EAAC,KAAK,CAAC,CAAC;IACpD,gBAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAC5F,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,MAAM,KAAK,GAAG,IAAI,4BAAe,CAAC;QAChC,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE;KACpD,CAAC,CAAC;IACH,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAwB,EAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAwB,EAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAChE,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAwB,EAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACnD,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAwB,EAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;IAGrE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAA,8BAAa,EAAC;YAClB,SAAS,EAAE,gBAAgB;YAC3B,KAAK,EAAE,mBAAmB;YAC1B,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,GAAG,IAAI,CAAC;QAEb,gBAAM,CAAC,KAAK,CAAE,KAAe,CAAC,OAAO,EAAE,2CAA2C,CAAC,CAAC;IACtF,CAAC;IACD,gBAAM,CAAC,EAAE,CAAC,KAAK,EAAE,+CAA+C,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC;AAGH,IAAA,mBAAI,EAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;IAI5F,MAAM,MAAM,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,kFAAkF,CAAC;QAGjG,IAAI,SAAS,GAAsE,IAAI,CAAC;QACxF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChC,gBAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,IAAA,qCAAwB,EAAC,KAAK,CAAC,CAAC;YACpD,gBAAM,CAAC,EAAE,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;YAC5D,gBAAM,CAAC,KAAK,CAAC,WAAY,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;YAG3D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;YAC9C,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAChC,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YAEzC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;gBACtC,WAAW,EAAE,WAAY,CAAC,WAAW;gBACrC,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;YACH,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;YAGxD,SAAS,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3E,CAAC;QAED,gBAAM,CAAC,EAAE,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;QAC7C,gBAAM,CAAC,KAAK,CAAC,SAAU,CAAC,oBAAoB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/D,gBAAM,CAAC,KAAK,CAAC,SAAU,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAG5D,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACpG,gBAAM,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,EAAE,uCAAuC,CAAC,CAAC;QAChF,MAAM,YAAY,GAAG,eAAe,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAClE,gBAAM,CAAC,KAAK,CACV,YAAY,CAAC,OAAO,CAAC,iBAAiB,CAAC,EACvC,sBAAsB,EACtB,iDAAiD,CAClD,CAAC;QAGF,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;QACpF,gBAAM,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;QACzB,gBAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,aAAc,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC3E,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,KAAK,GAAG,IAAI,qCAAoB,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC;IACnF,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACvD,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IACjD,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC"}

package/dist/nexus-cli/src/services/step-up-interactive.d.ts

@@ -0,0 +1,2 @@
+import { type StepUpCredentialResolver } from './step-up-helper';
+export declare function buildInteractiveResolver(): StepUpCredentialResolver;

package/dist/nexus-cli/src/services/step-up-interactive.js

@@ -0,0 +1,69 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildInteractiveResolver = buildInteractiveResolver;
+const readline = __importStar(require("node:readline/promises"));
+const node_process_1 = require("node:process");
+const logger_1 = require("../utils/logger");
+const step_up_helper_1 = require("./step-up-helper");
+function buildInteractiveResolver() {
+    return async ({ factors, action }) => {
+        const rl = readline.createInterface({ input: node_process_1.stdin, output: node_process_1.stdout });
+        try {
+            logger_1.logger.info(`step-up 动作: ${action}`);
+            logger_1.logger.info('已验证因素:');
+            factors.forEach((factor, index) => {
+                logger_1.logger.info(`  [${index}] ${factor.type}  ${factor.label}  (${factor.id})`);
+            });
+            const choiceRaw = await rl.question('选择因素序号: ');
+            const choice = Number(choiceRaw);
+            const factor = Number.isInteger(choice)
+                ? factors[choice]
+                : factors.find((row) => row.id === choiceRaw.trim());
+            if (!factor) {
+                throw new step_up_helper_1.StepUpBootstrapError('STEP_UP_FACTOR_NOT_FOUND', `无效的因素选择: ${choiceRaw}`);
+            }
+            const credential = (await rl.question('输入凭据(TOTP 码 / 恢复码 / OTP): ')).trim();
+            if (!credential) {
+                throw new step_up_helper_1.StepUpBootstrapError('STEP_UP_CREDENTIAL_REQUIRED', '凭据不能为空。');
+            }
+            return { factorId: factor.id, credential };
+        }
+        finally {
+            rl.close();
+        }
+    };
+}
+//# sourceMappingURL=step-up-interactive.js.map

package/dist/nexus-cli/src/services/step-up-interactive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-interactive.js","sourceRoot":"","sources":["../../../../src/services/step-up-interactive.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,4DAgCC;AA/CD,iEAAmD;AACnD,+CAAgE;AAEhE,4CAAyC;AAEzC,qDAAuF;AAUvF,SAAgB,wBAAwB;IACtC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAL,oBAAK,EAAE,MAAM,EAAN,qBAAM,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,eAAM,CAAC,IAAI,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC;YACrC,eAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBAChC,eAAM,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,MAAM,MAAM,GAA8B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;gBAChE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;gBACjB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,qCAAoB,CAC5B,0BAA0B,EAC1B,YAAY,SAAS,EAAE,CACxB,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,qCAAoB,CAC5B,6BAA6B,EAC7B,SAAS,CACV,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/nexus-cli/src/services/workforce-cognition-remote.d.ts

@@ -0,0 +1,27 @@
+export interface OpportunityResult {
+    status: string;
+    executionId?: string | null;
+}
+export declare function confirmOpportunityRemote(options: {
+    targetOrg: string;
+    proposalId: string;
+    proposalDigest: string;
+    stateFingerprint: string;
+}): Promise<OpportunityResult>;
+export declare function rejectOpportunityRemote(options: {
+    targetOrg: string;
+    proposalId: string;
+    proposalDigest: string;
+    reasonCode: string;
+}): Promise<OpportunityResult>;
+export declare function transitionMemoryRemote(options: {
+    targetOrg: string;
+    memoryItemId: string;
+    expectedGeneration: number;
+    toStatus: 'active' | 'archived' | 'revoked';
+    reasonCode: string;
+    idempotencyKey: string;
+}): Promise<{
+    status: string;
+    revision: number;
+}>;

package/dist/nexus-cli/src/services/workforce-cognition-remote.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confirmOpportunityRemote = confirmOpportunityRemote;
+exports.rejectOpportunityRemote = rejectOpportunityRemote;
+exports.transitionMemoryRemote = transitionMemoryRemote;
+const api_client_1 = require("./api-client");
+const CONFIRM_OPPORTUNITY = `
+mutation ConfirmAiWorkforceOpportunity($proposalId: ID!, $proposalDigest: String!, $stateFingerprint: String!) {
+  confirmAiWorkforceOpportunity(proposalId: $proposalId, proposalDigest: $proposalDigest, stateFingerprint: $stateFingerprint) { status executionId }
+}`;
+const REJECT_OPPORTUNITY = `
+mutation RejectAiWorkforceOpportunity($proposalId: ID!, $proposalDigest: String!, $reasonCode: String!) {
+  rejectAiWorkforceOpportunity(proposalId: $proposalId, proposalDigest: $proposalDigest, reasonCode: $reasonCode) { status executionId }
+}`;
+const TRANSITION_MEMORY = `
+mutation TransitionAiWorkforceMemory($memoryItemId: ID!, $expectedGeneration: Int!, $toStatus: String!, $reasonCode: String!, $idempotencyKey: String!) {
+  transitionAiWorkforceMemory(memoryItemId: $memoryItemId, expectedGeneration: $expectedGeneration, toStatus: $toStatus, reasonCode: $reasonCode, idempotencyKey: $idempotencyKey) { status revision }
+}`;
+async function confirmOpportunityRemote(options) {
+    const client = (0, api_client_1.createApiClient)(options.targetOrg);
+    const data = await client.graphql(CONFIRM_OPPORTUNITY, {
+        proposalId: options.proposalId,
+        proposalDigest: options.proposalDigest,
+        stateFingerprint: options.stateFingerprint,
+    });
+    return data.confirmAiWorkforceOpportunity;
+}
+async function rejectOpportunityRemote(options) {
+    const client = (0, api_client_1.createApiClient)(options.targetOrg);
+    const data = await client.graphql(REJECT_OPPORTUNITY, {
+        proposalId: options.proposalId,
+        proposalDigest: options.proposalDigest,
+        reasonCode: options.reasonCode,
+    });
+    return data.rejectAiWorkforceOpportunity;
+}
+async function transitionMemoryRemote(options) {
+    const client = (0, api_client_1.createApiClient)(options.targetOrg);
+    const data = await client.graphql(TRANSITION_MEMORY, {
+        memoryItemId: options.memoryItemId,
+        expectedGeneration: options.expectedGeneration,
+        toStatus: options.toStatus,
+        reasonCode: options.reasonCode,
+        idempotencyKey: options.idempotencyKey,
+    });
+    return data.transitionAiWorkforceMemory;
+}
+//# sourceMappingURL=workforce-cognition-remote.js.map

package/dist/nexus-cli/src/services/workforce-cognition-remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workforce-cognition-remote.js","sourceRoot":"","sources":["../../../../src/services/workforce-cognition-remote.ts"],"names":[],"mappings":";;AA+CA,4DAgBC;AAMD,0DAgBC;AASD,wDAmBC;AAjHD,6CAA+C;AAoB/C,MAAM,mBAAmB,GAAG;;;EAG1B,CAAC;AAEH,MAAM,kBAAkB,GAAG;;;EAGzB,CAAC;AAEH,MAAM,iBAAiB,GAAG;;;EAGxB,CAAC;AAcI,KAAK,UAAU,wBAAwB,CAAC,OAK9C;IACC,MAAM,MAAM,GAAG,IAAA,4BAAe,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,mBAAmB,EACnB;QACE,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CACF,CAAC;IACF,OAAO,IAAI,CAAC,6BAA6B,CAAC;AAC5C,CAAC;AAMM,KAAK,UAAU,uBAAuB,CAAC,OAK7C;IACC,MAAM,MAAM,GAAG,IAAA,4BAAe,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,kBAAkB,EAClB;QACE,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CACF,CAAC;IACF,OAAO,IAAI,CAAC,4BAA4B,CAAC;AAC3C,CAAC;AASM,KAAK,UAAU,sBAAsB,CAAC,OAO5C;IACC,MAAM,MAAM,GAAG,IAAA,4BAAe,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAE9B,iBAAiB,EAAE;QACpB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,2BAA2B,CAAC;AAC1C,CAAC"}

package/dist/nexus-cli/src/services/workforce-common.d.ts

@@ -0,0 +1,2 @@
+export declare function resolveWorkspaceId(targetOrg: string): string;
+export declare function requireNonBlank(value: string | undefined, code: string): string;

package/dist/nexus-cli/src/services/workforce-common.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveWorkspaceId = resolveWorkspaceId;
+exports.requireNonBlank = requireNonBlank;
+const auth_store_1 = require("./auth-store");
+function resolveWorkspaceId(targetOrg) {
+    const credential = (0, auth_store_1.loadCredential)(targetOrg);
+    if (!credential?.orgId) {
+        throw new Error(`TARGET_ORG_CREDENTIAL_REQUIRED: ${targetOrg} 缺少 orgId`);
+    }
+    return credential.orgId;
+}
+function requireNonBlank(value, code) {
+    const trimmed = value?.trim();
+    if (!trimmed) {
+        throw new Error(code);
+    }
+    return trimmed;
+}
+//# sourceMappingURL=workforce-common.js.map

package/dist/nexus-cli/src/services/workforce-common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workforce-common.js","sourceRoot":"","sources":["../../../../src/services/workforce-common.ts"],"names":[],"mappings":";;AAWA,gDAMC;AAGD,0CAMC;AA1BD,6CAA8C;AAW9C,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,MAAM,UAAU,GAAG,IAAA,2BAAc,EAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,WAAW,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC1B,CAAC;AAGD,SAAgB,eAAe,CAAC,KAAyB,EAAE,IAAY;IACrE,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/nexus-cli/src/services/workforce-config-remote.d.ts

@@ -0,0 +1,127 @@
+export interface ConstitutionView {
+    id: string;
+    workspaceId: string;
+    content: string;
+    versionNumber: number;
+    isActive?: boolean;
+    publishedAt?: string;
+    publishedBy?: string;
+}
+export declare function publishConstitutionRemote(options: {
+    targetOrg: string;
+    content: string;
+}): Promise<ConstitutionView>;
+export declare function rollbackConstitutionRemote(options: {
+    targetOrg: string;
+    targetVersionNumber: number;
+}): Promise<ConstitutionView>;
+export declare function getConstitutionRemote(options: {
+    targetOrg: string;
+}): Promise<ConstitutionView | null>;
+export declare function listConstitutionVersionsRemote(options: {
+    targetOrg: string;
+}): Promise<Array<Pick<ConstitutionView, 'id' | 'versionNumber' | 'content' | 'isActive' | 'publishedAt' | 'publishedBy'>>>;
+export interface PromptStrategyView {
+    id: string;
+    workspaceId?: string;
+    name: string;
+    description?: string;
+    industry?: string;
+    templateOverrides?: unknown;
+    isActive?: boolean;
+    createdAt?: string;
+}
+export declare function createPromptStrategyRemote(options: {
+    targetOrg: string;
+    name: string;
+    description?: string;
+    industry?: string;
+    templateOverrides?: unknown;
+}): Promise<PromptStrategyView>;
+export declare function updatePromptStrategyRemote(options: {
+    targetOrg: string;
+    id: string;
+    name?: string;
+    description?: string;
+    industry?: string;
+    templateOverrides?: unknown;
+}): Promise<PromptStrategyView>;
+export declare function activatePromptStrategyRemote(options: {
+    targetOrg: string;
+    id: string;
+}): Promise<{
+    id: string;
+    isActive: boolean;
+}>;
+export declare function deactivatePromptStrategyRemote(options: {
+    targetOrg: string;
+    id: string;
+}): Promise<{
+    id: string;
+    isActive: boolean;
+}>;
+export declare function deletePromptStrategyRemote(options: {
+    targetOrg: string;
+    id: string;
+}): Promise<boolean>;
+export interface PromptTemplateView {
+    id: string;
+    workspaceId?: string;
+    scene?: string;
+    name: string;
+    template: string;
+    variables?: unknown;
+    modelId?: string;
+    modelProvider?: string;
+    createdAt?: string;
+    versionNumber?: number;
+}
+export declare function createPromptTemplateRemote(options: {
+    targetOrg: string;
+    scene: string;
+    name: string;
+    template: string;
+    variables?: unknown;
+    modelId?: string;
+    modelProvider?: string;
+}): Promise<PromptTemplateView>;
+export declare function updatePromptTemplateRemote(options: {
+    targetOrg: string;
+    id: string;
+    name?: string;
+    template?: string;
+    variables?: unknown;
+    modelId?: string;
+    modelProvider?: string;
+}): Promise<PromptTemplateView>;
+export declare function rollbackPromptTemplateRemote(options: {
+    targetOrg: string;
+    id: string;
+    versionNumber: number;
+}): Promise<PromptTemplateView>;
+export declare function deletePromptTemplateRemote(options: {
+    targetOrg: string;
+    id: string;
+}): Promise<boolean>;
+export declare function draftPromptTemplateRemote(options: {
+    targetOrg: string;
+    intention: string;
+    modelId?: string;
+    modelProvider?: string;
+}): Promise<{
+    template: string;
+    variables: unknown;
+    model: unknown;
+}>;
+export declare function testPromptRemote(options: {
+    targetOrg: string;
+    prompt: string;
+    temperature?: number;
+    modelId?: string;
+    modelProvider?: string;
+}): Promise<{
+    output: string;
+    model: string;
+    tokensUsed: number;
+    latencyMs: number;
+}>;