openxiangda-devkit-core 2.0.0-alpha.100

package/dist/control-plane-client.js

@@ -0,0 +1,860 @@
+import { CONFIGURATION_COMPATIBILITY_CAPABILITY, CURRENT_APPLICATION_CONTRACT, OPENXIANGDA_CONTRACT_VERSION, } from "openxiangda-contracts/browser";
+export class ControlPlaneError extends Error {
+    status;
+    code;
+    data;
+    remote;
+    constructor(status, code, message, data, remote) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.data = data;
+        this.remote = remote;
+        this.name = "ControlPlaneError";
+    }
+}
+export class OpenXiangdaControlPlaneClient {
+    options;
+    baseUrl;
+    fetch;
+    constructor(options) {
+        this.options = options;
+        this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+        this.fetch = options.fetch || globalThis.fetch.bind(globalThis);
+    }
+    async capabilities() {
+        const capabilities = await this.json("/openxiangda-api/v2/capabilities");
+        if (capabilities.contractVersion !== OPENXIANGDA_CONTRACT_VERSION) {
+            const compatibility = capabilities.configurationCompatibility;
+            throw new ControlPlaneError(409, "OPENXIANGDA_CONTRACT_VERSION_MISMATCH", `平台 contract ${capabilities.contractVersion} 与工具 ${OPENXIANGDA_CONTRACT_VERSION} 不兼容`, {
+                pointer: "/contractVersion",
+                clientContractVersion: OPENXIANGDA_CONTRACT_VERSION,
+                clientSchemaVersions: {
+                    appPackage: CURRENT_APPLICATION_CONTRACT.appPackageSchemaVersion,
+                    configuration: CURRENT_APPLICATION_CONTRACT.configurationBundleSchemaVersion,
+                    contract: CURRENT_APPLICATION_CONTRACT.contractBundleSchemaVersion,
+                    compiler: CURRENT_APPLICATION_CONTRACT.compilerContractVersion,
+                },
+                platformVersion: String(capabilities.platformVersion || "unknown"),
+                platformCapability: compatibility?.capability || {
+                    code: CONFIGURATION_COMPATIBILITY_CAPABILITY,
+                    version: "unknown",
+                    status: "unavailable",
+                },
+                required: { ...CURRENT_APPLICATION_CONTRACT },
+                supported: (compatibility?.supportedApplicationContracts || []).slice(0, 8),
+                requiredContractVersion: OPENXIANGDA_CONTRACT_VERSION,
+                supportedContractVersion: capabilities.contractVersion,
+            });
+        }
+        return capabilities;
+    }
+    async validateConfigurationCompatibility(appCode, capabilities, input) {
+        const compatibility = capabilities.configurationCompatibility;
+        const expectedTemplate = "/openxiangda-api/v2/applications/{appCode}/configuration-compatibility";
+        if (compatibility.endpointTemplate !== expectedTemplate) {
+            throw new ControlPlaneError(409, "OPENXIANGDA_CONFIGURATION_COMPATIBILITY_ENDPOINT_INVALID", "平台配置兼容性端点不符合当前公开契约", {
+                pointer: "/configurationCompatibility/endpointTemplate",
+                clientContractVersion: OPENXIANGDA_CONTRACT_VERSION,
+                clientSchemaVersions: {
+                    appPackage: input.required.appPackageSchemaVersion,
+                    configuration: input.required.configurationBundleSchemaVersion,
+                    contract: input.required.contractBundleSchemaVersion,
+                    compiler: input.required.compilerContractVersion,
+                },
+                platformVersion: capabilities.platformVersion,
+                platformCapability: compatibility.capability,
+                required: { ...input.required },
+                supported: compatibility.supportedApplicationContracts.slice(0, 8),
+                requiredEndpointTemplate: expectedTemplate,
+                supportedEndpointTemplate: compatibility.endpointTemplate,
+            });
+        }
+        const body = JSON.stringify(input);
+        const requestBytes = new TextEncoder().encode(body).byteLength;
+        if (requestBytes > compatibility.limits.requestBytes) {
+            throw new ControlPlaneError(409, "OPENXIANGDA_CONFIGURATION_VALIDATION_REQUEST_TOO_LARGE", "配置兼容性请求超过目标平台公开上限", {
+                pointer: "/",
+                clientContractVersion: OPENXIANGDA_CONTRACT_VERSION,
+                clientSchemaVersions: {
+                    appPackage: input.required.appPackageSchemaVersion,
+                    configuration: input.required.configurationBundleSchemaVersion,
+                    contract: input.required.contractBundleSchemaVersion,
+                    compiler: input.required.compilerContractVersion,
+                },
+                platformVersion: capabilities.platformVersion,
+                platformCapability: compatibility.capability,
+                required: { ...input.required },
+                supported: compatibility.supportedApplicationContracts.slice(0, 8),
+                requiredRequestBytes: requestBytes,
+                supportedRequestBytes: compatibility.limits.requestBytes,
+            });
+        }
+        return await this.json(compatibility.endpointTemplate.replace("{appCode}", encodeURIComponent(appCode)), { method: "POST", body });
+    }
+    async provisionApplication(input) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(input.appCode)}/provision`, {
+            method: "POST",
+            body: JSON.stringify({
+                name: input.name,
+                description: input.description,
+            }),
+        });
+    }
+    async createConnectedDevelopmentSession(appCode, input) {
+        return await this.json(this.connectedDevelopmentSessionsPath(appCode), { method: "POST", body: JSON.stringify(input) });
+    }
+    async preparePreproductionAcceptanceIdentities(appCode, input) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/acceptance/identities/prepare`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async connectedDevelopmentSession(appCode, sessionToken) {
+        return await this.json(`${this.connectedDevelopmentSessionsPath(appCode)}/current`, { headers: this.connectedDevelopmentSessionHeaders(sessionToken) });
+    }
+    async refreshConnectedDevelopmentSession(appCode, sessionToken) {
+        return await this.json(`${this.connectedDevelopmentSessionsPath(appCode)}/current/refresh`, {
+            method: "POST",
+            body: "{}",
+            headers: this.connectedDevelopmentSessionHeaders(sessionToken),
+        });
+    }
+    async revokeConnectedDevelopmentSession(appCode, sessionToken) {
+        await this.json(`${this.connectedDevelopmentSessionsPath(appCode)}/current/revoke`, {
+            method: "POST",
+            body: "{}",
+            headers: this.connectedDevelopmentSessionHeaders(sessionToken),
+        });
+    }
+    async oauthClients(appCode) {
+        return await this.json(`${this.oauthPath(appCode)}/clients`);
+    }
+    async runtimeOAuthCredentialStatus(appCode, environmentKey) {
+        return await this.json(`${this.oauthPath(appCode)}/runtime-credentials/${encodeURIComponent(environmentKey)}`);
+    }
+    async stageRuntimeOAuthCredentialRotation(appCode, environmentKey, input) {
+        return await this.json(`${this.oauthPath(appCode)}/runtime-credentials/${encodeURIComponent(environmentKey)}/rotate`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async createOAuthClient(appCode, input) {
+        return await this.json(`${this.oauthPath(appCode)}/clients`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async updateOAuthClient(appCode, clientId, input) {
+        return await this.json(`${this.oauthPath(appCode)}/clients/${encodeURIComponent(clientId)}/update`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async rotateOAuthClientSecret(appCode, clientId, gracePeriodSeconds = 600) {
+        return await this.json(`${this.oauthPath(appCode)}/clients/${encodeURIComponent(clientId)}/rotate-secret`, {
+            method: "POST",
+            body: JSON.stringify({ gracePeriodSeconds }),
+        });
+    }
+    async revokeOAuthClient(appCode, clientId) {
+        return await this.json(`${this.oauthPath(appCode)}/clients/${encodeURIComponent(clientId)}/revoke`, { method: "POST", body: "{}" });
+    }
+    async oauthAuditEvents(appCode, input = {}) {
+        const query = new URLSearchParams();
+        if (input.environmentKey)
+            query.set("environmentKey", input.environmentKey);
+        if (input.clientId)
+            query.set("clientId", input.clientId);
+        if (input.limit)
+            query.set("limit", String(input.limit));
+        const suffix = query.size ? `?${query}` : "";
+        return await this.json(`${this.oauthPath(appCode)}/audit-events${suffix}`);
+    }
+    async oauthApplicationPrincipal(appCode) {
+        return await this.json(`${this.oauthPath(appCode)}/principal`);
+    }
+    async exchangeOAuthClientCredentials(input) {
+        const response = await this.fetch(`${this.baseUrl}/openxiangda-api/v2/oauth2/token`, {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/json",
+                Authorization: `Basic ${this.basicCredentials(input.clientId, input.clientSecret)}`,
+            },
+            body: JSON.stringify({
+                grant_type: "client_credentials",
+                ...(input.scope?.length ? { scope: input.scope.join(" ") } : {}),
+            }),
+        });
+        let data;
+        try {
+            data = (await response.json());
+        }
+        catch {
+            throw new ControlPlaneError(response.status, "OAUTH2_TOKEN_RESPONSE_INVALID", "OAuth2 token 端点返回的不是有效 JSON");
+        }
+        if (!response.ok || data.error) {
+            throw new ControlPlaneError(response.status, data.error || "OAUTH2_TOKEN_REQUEST_FAILED", data.error_description || `OAuth2 token 请求失败: ${response.status}`);
+        }
+        return data;
+    }
+    async applicationApiResponse(appCode, environmentKey, runtimePath, input) {
+        const path = this.applicationApiPath(appCode, environmentKey, runtimePath, input.query);
+        const { query: _query, perspectiveCode: _perspectiveCode, ...init } = input;
+        const token = await this.accessToken(false);
+        return await this.fetch(`${this.baseUrl}${path}`, {
+            ...init,
+            credentials: init.credentials || this.options.credentials || "include",
+            headers: {
+                Accept: "application/json",
+                ...(token ? { Authorization: `Bearer ${token}` } : {}),
+                ...this.perspectiveHeaders(input),
+                ...(init.headers || {}),
+            },
+        });
+    }
+    async applicationApiJson(appCode, environmentKey, runtimePath, input) {
+        const { body, ...request } = input;
+        const response = await this.applicationApiResponse(appCode, environmentKey, runtimePath, {
+            ...request,
+            headers: {
+                ...(body === undefined ? {} : { "Content-Type": "application/json" }),
+                ...(input.headers || {}),
+            },
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        });
+        const text = await response.text();
+        let data = undefined;
+        if (text) {
+            try {
+                data = JSON.parse(text);
+            }
+            catch {
+                throw new ControlPlaneError(response.status, "APPLICATION_API_RESPONSE_INVALID", "应用后端返回的不是有效 JSON", text);
+            }
+        }
+        if (!response.ok) {
+            throw new ControlPlaneError(response.status, String(data?.errorCode || data?.code || "APPLICATION_API_REQUEST_FAILED"), String(data?.message || data?.error || `应用后端请求失败: ${response.status}`), data);
+        }
+        return data;
+    }
+    async uploadArtifact(input) {
+        const params = new URLSearchParams({
+            kind: input.kind,
+            contentType: input.contentType,
+            metadata: JSON.stringify(input.metadata || {}),
+        });
+        const form = new FormData();
+        form.append("file", new Blob([input.content], { type: input.contentType }), input.digest);
+        return await this.request(`/openxiangda-api/v2/applications/${encodeURIComponent(input.appCode)}/artifacts/${input.digest}?${params}`, { method: "POST", body: form });
+    }
+    async createDeployment(input) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(input.appCode)}/deployments`, {
+            method: "POST",
+            body: JSON.stringify({
+                environmentId: input.environmentId,
+                environmentKind: input.environmentKind,
+                kind: input.kind || "deploy",
+                packageDigest: input.packageDigest,
+                package: input.package,
+                idempotencyKey: input.idempotencyKey,
+                requestId: input.requestId,
+            }),
+        });
+    }
+    async deployment(appCode, deploymentId) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/deployments/${encodeURIComponent(deploymentId)}`);
+    }
+    async deployments(appCode, limit = 20) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/deployments?limit=${Math.min(Math.max(Number(limit) || 20, 1), 100)}`);
+    }
+    async applicationEnvironments(appCode) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/environments`);
+    }
+    async startEnvironment(appCode, environmentKey, input) {
+        return await this.changeEnvironmentRuntimeState(appCode, environmentKey, "start", input);
+    }
+    async stopEnvironment(appCode, environmentKey, input) {
+        return await this.changeEnvironmentRuntimeState(appCode, environmentKey, "stop", input);
+    }
+    async retryDeployment(appCode, deploymentId) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/deployments/${encodeURIComponent(deploymentId)}/retry`, { method: "POST", body: "{}" });
+    }
+    async cancelDeployment(appCode, deploymentId) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/deployments/${encodeURIComponent(deploymentId)}/cancel`, { method: "POST", body: "{}" });
+    }
+    async promote(input) {
+        return await this.deployExistingVersion(input, "promotions");
+    }
+    async redeploy(input) {
+        return await this.deployExistingVersion(input, "redeployments");
+    }
+    async rollback(input) {
+        return await this.deployExistingVersion(input, "rollbacks");
+    }
+    async appVersions(appCode, limit = 30) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/versions?limit=${Math.min(Math.max(Number(limit) || 30, 1), 100)}`);
+    }
+    async environmentHead(appCode, environmentKey) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/environment-heads/${encodeURIComponent(environmentKey)}`);
+    }
+    async changeEnvironmentRuntimeState(appCode, environmentKey, action, input) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/environments/${encodeURIComponent(environmentKey)}/${action}`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async applicationSecrets(appCode, environmentKey) {
+        return await this.json(this.applicationSecretsPath(appCode, environmentKey));
+    }
+    async applicationSecret(appCode, environmentKey, name) {
+        return await this.json(`${this.applicationSecretsPath(appCode, environmentKey)}/${encodeURIComponent(name)}`);
+    }
+    async createApplicationSecret(appCode, environmentKey, input) {
+        return await this.json(this.applicationSecretsPath(appCode, environmentKey), { method: "POST", body: JSON.stringify({ expectedRevision: 0, ...input }) });
+    }
+    async updateApplicationSecret(appCode, environmentKey, name, input) {
+        return await this.json(`${this.applicationSecretsPath(appCode, environmentKey)}/${encodeURIComponent(name)}`, { method: "PATCH", body: JSON.stringify(input) });
+    }
+    async rotateApplicationSecret(appCode, environmentKey, name, input) {
+        return await this.json(`${this.applicationSecretsPath(appCode, environmentKey)}/${encodeURIComponent(name)}/rotate`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async deleteApplicationSecret(appCode, environmentKey, name, input) {
+        return await this.json(`${this.applicationSecretsPath(appCode, environmentKey)}/${encodeURIComponent(name)}`, { method: "DELETE", body: JSON.stringify(input) });
+    }
+    async applicationSecretAuditEvents(appCode, environmentKey, name, limit = 100) {
+        return await this.json(`${this.applicationSecretsPath(appCode, environmentKey)}/${encodeURIComponent(name)}/audit?limit=${Math.min(Math.max(Number(limit) || 100, 1), 500)}`);
+    }
+    async eventSubscriptions(appCode) {
+        return await this.json(`${this.eventsPath(appCode)}/subscriptions`);
+    }
+    async setEventSubscriptionStatus(appCode, subscriptionId, input) {
+        return await this.json(`${this.eventsPath(appCode)}/subscriptions/${encodeURIComponent(subscriptionId)}/status`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async eventDeliveries(appCode, limit = 100) {
+        return await this.json(`${this.eventsPath(appCode)}/deliveries?limit=${Math.min(Math.max(Number(limit) || 100, 1), 500)}`);
+    }
+    async replayEventDelivery(appCode, deliveryId, idempotencyKey) {
+        return await this.json(`${this.eventsPath(appCode)}/deliveries/${encodeURIComponent(deliveryId)}/replay`, {
+            method: "POST",
+            body: JSON.stringify(idempotencyKey ? { idempotencyKey } : {}),
+        });
+    }
+    async timerSubscriptions(appCode) {
+        return await this.json(`${this.eventsPath(appCode)}/timers`);
+    }
+    async setTimerSubscriptionStatus(appCode, timerId, input) {
+        return await this.json(`${this.eventsPath(appCode)}/timers/${encodeURIComponent(timerId)}/status`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async dateTriggers(appCode) {
+        return await this.json(`${this.eventsPath(appCode)}/date-triggers`);
+    }
+    async setDateTriggerStatus(appCode, triggerId, input) {
+        return await this.json(`${this.eventsPath(appCode)}/date-triggers/${encodeURIComponent(triggerId)}/status`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async registerWorkflowDefinition(appCode, version, definition) {
+        return await this.json(`${this.workflowPath(appCode)}/definitions`, {
+            method: "POST",
+            body: JSON.stringify({ version, definition }),
+        });
+    }
+    async registerWorkflowBinding(appCode, version, binding) {
+        return await this.json(`${this.workflowPath(appCode)}/bindings`, {
+            method: "POST",
+            body: JSON.stringify({ version, binding }),
+        });
+    }
+    async applyWorkflowAssigneeProvider(appCode, input) {
+        return await this.json(`${this.workflowPath(appCode)}/assignee-providers`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async workflowAssigneeProviders(appCode, environmentKey = "production") {
+        return await this.json(`${this.workflowPath(appCode)}/assignee-providers?environmentKey=${encodeURIComponent(environmentKey)}`);
+    }
+    async rotateWorkflowAssigneeProviderSecret(appCode, providerCode, input) {
+        return await this.json(`${this.workflowPath(appCode)}/assignee-providers/${encodeURIComponent(providerCode)}/rotate-secret`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async activateWorkflow(appCode, workflowCode, input) {
+        return await this.json(`${this.workflowPath(appCode)}/definitions/${encodeURIComponent(workflowCode)}/activate`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async createWorkflowDelegation(appCode, input) {
+        return await this.json(`${this.workflowPath(appCode)}/delegations`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async workflowDelegationTargets(appCode, userId, environmentKey) {
+        return await this.json(`${this.workflowPath(appCode)}/delegations/targets?userId=${encodeURIComponent(userId)}${environmentKey ? `&environmentKey=${encodeURIComponent(environmentKey)}` : ""}`);
+    }
+    async workflowDelegations(appCode, input = {}) {
+        return await this.json(`${this.workflowPath(appCode)}/delegations?all=${input.all === true}${input.environmentKey
+            ? `&environmentKey=${encodeURIComponent(input.environmentKey)}`
+            : ""}`);
+    }
+    async revokeWorkflowDelegation(appCode, delegationId, environmentKey) {
+        return await this.json(`${this.workflowPath(appCode)}/delegations/${encodeURIComponent(delegationId)}/revoke${environmentKey
+            ? `?environmentKey=${encodeURIComponent(environmentKey)}`
+            : ""}`, {
+            method: "POST",
+        });
+    }
+    async workflowTaskSurface(appCode, taskId, csrfToken) {
+        return await this.json(`${this.workflowPath(appCode)}/tasks/${encodeURIComponent(taskId)}/surface`, { headers: { "X-OpenXiangda-CSRF-Token": csrfToken } });
+    }
+    async workflowInstanceSurface(appCode, instanceId, csrfToken) {
+        return await this.json(`${this.workflowPath(appCode)}/instances/${encodeURIComponent(instanceId)}/surface`, { headers: { "X-OpenXiangda-CSRF-Token": csrfToken } });
+    }
+    async executeWorkflowTaskCommand(appCode, taskId, command, input) {
+        const { csrfToken, ...request } = input;
+        return await this.json(`${this.workflowPath(appCode)}/tasks/${encodeURIComponent(taskId)}/commands/${encodeURIComponent(command)}`, {
+            method: "POST",
+            headers: { "X-OpenXiangda-CSRF-Token": csrfToken },
+            body: JSON.stringify(request),
+        });
+    }
+    async executeWorkflowInstanceCommand(appCode, instanceId, command, input) {
+        const { csrfToken, ...request } = input;
+        return await this.json(`${this.workflowPath(appCode)}/instances/${encodeURIComponent(instanceId)}/commands/${command}`, {
+            method: "POST",
+            headers: { "X-OpenXiangda-CSRF-Token": csrfToken },
+            body: JSON.stringify(request),
+        });
+    }
+    async workflowAssignmentExplain(appCode, taskId) {
+        return await this.json(`${this.workflowPath(appCode)}/tasks/${encodeURIComponent(taskId)}/assignment-explain`);
+    }
+    async workflowTimeline(appCode, instanceId) {
+        return await this.json(`${this.workflowPath(appCode)}/instances/${encodeURIComponent(instanceId)}/timeline`);
+    }
+    async workflowWorkCenter(appCode, input = {}) {
+        const query = new URLSearchParams({
+            status: input.status || "pending",
+            limit: String(Math.min(Math.max(Number(input.limit) || 50, 1), 200)),
+            ...(input.environmentKey ? { environmentKey: input.environmentKey } : {}),
+        });
+        return await this.json(`${this.workflowPath(appCode)}/work-center/items?${query}`);
+    }
+    async workflowDiagnostics(appCode, limit = 100) {
+        return await this.json(`${this.workflowPath(appCode)}/diagnostics?limit=${Math.min(Math.max(Number(limit) || 100, 1), 500)}`);
+    }
+    async nativeAuthorizationCatalog(appCode, input = {}) {
+        const query = this.query({
+            environmentKey: input.environmentKey || "preproduction",
+        });
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/catalog?${query}`);
+    }
+    async nativeScopeValues(appCode, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/scope-values?${this.query({
+            ...input,
+            environmentKey: input.environmentKey || "preproduction",
+        })}`);
+    }
+    async nativeRoleMemberships(appCode, input = {}) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/memberships?${this.query({
+            ...input,
+            environmentKey: input.environmentKey || "preproduction",
+        })}`);
+    }
+    async createNativeRoleMembership(appCode, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/memberships`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async updateNativeRoleMembership(appCode, membershipId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/memberships/${encodeURIComponent(membershipId)}/update`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async revokeNativeRoleMembership(appCode, membershipId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/memberships/${encodeURIComponent(membershipId)}/revoke`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async nativeSuperAdmins(appCode, input = {}) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/super-admins?${this.query({ ...input, environmentKey: input.environmentKey || "preproduction" })}`);
+    }
+    async grantNativeSuperAdmin(appCode, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/super-admins`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async revokeNativeSuperAdmin(appCode, grantId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/super-admins/${encodeURIComponent(grantId)}/revoke`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async nativeRelationshipGrants(appCode, input = {}) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/relationship-grants?${this.query({
+            ...input,
+            environmentKey: input.environmentKey || "preproduction",
+        })}`);
+    }
+    async createNativeRelationshipGrant(appCode, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/relationship-grants`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async updateNativeRelationshipGrant(appCode, grantId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/relationship-grants/${encodeURIComponent(grantId)}/update`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async revokeNativeRelationshipGrant(appCode, grantId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/relationship-grants/${encodeURIComponent(grantId)}/revoke`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async nativeAuthorizationProjectionHealth(appCode, environmentKey = "preproduction") {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/projections/health?${this.query({ environmentKey })}`);
+    }
+    async rebuildNativeAuthorizationProjections(appCode, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/projections/rebuild`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async recoverNativeAuthorizationProjection(appCode, jobId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/projections/jobs/${encodeURIComponent(jobId)}/recover`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async myRoleAssignments(appCode) {
+        return await this.json(`${this.authzPath(appCode)}/assignments/me`);
+    }
+    async applicationRoles(appCode) {
+        return await this.json(`${this.authzPath(appCode)}/roles`);
+    }
+    async createRoleAssignment(appCode, input) {
+        return await this.json(`${this.authzPath(appCode)}/assignments`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async updateRoleAssignment(appCode, assignmentId, input) {
+        return await this.json(`${this.authzPath(appCode)}/assignments/${encodeURIComponent(assignmentId)}/update`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async revokeRoleAssignment(appCode, assignmentId, expectedRevision) {
+        return await this.json(`${this.authzPath(appCode)}/assignments/${encodeURIComponent(assignmentId)}/revoke`, { method: "POST", body: JSON.stringify({ expectedRevision }) });
+    }
+    async searchDirectoryEntries(appCode, kind, input) {
+        const query = new URLSearchParams({
+            keyword: input.keyword.trim(),
+            limit: String(Math.min(Math.max(Number(input.limit) || 20, 1), 50)),
+        });
+        return await this.json(`${this.directoryPath(appCode)}/${kind}s?${query}`);
+    }
+    async browseDepartmentEntries(appCode, input) {
+        const query = new URLSearchParams({
+            offset: String(Math.max(Number(input.offset) || 0, 0)),
+            limit: String(Math.min(Math.max(Number(input.limit) || 100, 1), 100)),
+        });
+        const parentId = String(input.parentId || "").trim();
+        if (parentId)
+            query.set("parentId", parentId);
+        return await this.json(`${this.directoryPath(appCode)}/departments/tree?${query}`);
+    }
+    async browseDepartmentUserEntries(appCode, input) {
+        const departmentId = String(input.departmentId || "").trim();
+        if (!departmentId)
+            throw new Error("departmentId is required");
+        const query = new URLSearchParams({
+            page: String(Math.max(Number(input.page) || 1, 1)),
+            limit: String(Math.min(Math.max(Number(input.limit) || 50, 1), 100)),
+        });
+        return await this.json(`${this.directoryPath(appCode)}/departments/${encodeURIComponent(departmentId)}/users?${query}`);
+    }
+    async resolveDirectoryEntries(appCode, input) {
+        return await this.json(`${this.directoryPath(appCode)}/resolve`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async applyDataResource(resource, input = {}) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(resource.appCode)}/data-resources/${encodeURIComponent(resource.code)}/apply`, {
+            method: "POST",
+            body: JSON.stringify({
+                name: resource.name,
+                schema: resource.schema,
+                capabilities: resource.capabilities,
+                dataPolicyCode: resource.dataPolicyCode,
+                fieldPolicies: resource.fieldPolicies,
+                expectedRevision: input.expectedRevision,
+            }),
+        });
+    }
+    async relationshipGrants(appCode, filter = {}) {
+        const query = new URLSearchParams();
+        for (const [key, value] of Object.entries(filter)) {
+            if (value !== undefined && value !== "")
+                query.set(key, value);
+        }
+        const suffix = query.size ? `?${query.toString()}` : "";
+        return await this.json(`${this.authzPath(appCode)}/relationship-grants${suffix}`);
+    }
+    async createRelationshipGrant(appCode, input) {
+        return await this.json(`${this.authzPath(appCode)}/relationship-grants`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async updateRelationshipGrant(appCode, grantId, input) {
+        return await this.json(`${this.authzPath(appCode)}/relationship-grants/${encodeURIComponent(grantId)}/update`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async revokeRelationshipGrant(appCode, grantId, expectedRevision) {
+        return await this.json(`${this.authzPath(appCode)}/relationship-grants/${encodeURIComponent(grantId)}/revoke`, { method: "POST", body: JSON.stringify({ expectedRevision }) });
+    }
+    async queryData(appCode, resourceCode, query, request = {}) {
+        return await this.json(this.dataPath(appCode, resourceCode, "query"), {
+            method: "POST",
+            body: JSON.stringify(query),
+            headers: this.perspectiveHeaders(request),
+        });
+    }
+    async chinaDivisions(parentAdcode) {
+        const query = new URLSearchParams();
+        if (parentAdcode)
+            query.set("parentAdcode", parentAdcode);
+        const suffix = query.size ? `?${query}` : "";
+        return await this.json(`/china-divisions/${suffix}`);
+    }
+    async getData(appCode, resourceCode, id, request = {}) {
+        return await this.json(this.dataPath(appCode, resourceCode, `records/${encodeURIComponent(id)}`), { headers: this.perspectiveHeaders(request) });
+    }
+    async aggregateData(appCode, resourceCode, query, request = {}) {
+        return await this.json(this.dataPath(appCode, resourceCode, "aggregate"), {
+            method: "POST",
+            body: JSON.stringify(query),
+            headers: this.perspectiveHeaders(request),
+        });
+    }
+    async dataAudit(appCode, resourceCode, id, input = {}, request = {}) {
+        const query = new URLSearchParams();
+        if (input.limit !== undefined)
+            query.set("limit", String(input.limit));
+        if (input.offset !== undefined)
+            query.set("offset", String(input.offset));
+        const suffix = query.size ? `?${query}` : "";
+        return await this.json(`${this.dataPath(appCode, resourceCode, `records/${encodeURIComponent(id)}/audit`)}${suffix}`, { headers: this.perspectiveHeaders(request) });
+    }
+    async initiateDataFileUpload(appCode, resourceCode, input, request = {}) {
+        return await this.json(this.dataPath(appCode, resourceCode, "files/uploads/initiate"), {
+            method: "POST",
+            body: JSON.stringify(input),
+            headers: this.perspectiveHeaders(request),
+        });
+    }
+    async completeDataFileUpload(appCode, resourceCode, fileId, request = {}) {
+        return await this.json(this.dataPath(appCode, resourceCode, `files/${encodeURIComponent(fileId)}/complete`), {
+            method: "POST",
+            body: "{}",
+            headers: this.perspectiveHeaders(request),
+        });
+    }
+    async deleteUnboundDataFile(appCode, resourceCode, fileId, request = {}) {
+        return await this.json(this.dataPath(appCode, resourceCode, `files/${encodeURIComponent(fileId)}/delete`), {
+            method: "POST",
+            body: "{}",
+            headers: this.perspectiveHeaders(request),
+        });
+    }
+    async dataFileContent(appCode, resourceCode, fileId, request = {}) {
+        const path = this.dataPath(appCode, resourceCode, `files/${encodeURIComponent(fileId)}/content`);
+        const download = async (forceRefresh) => {
+            const token = await this.accessToken(forceRefresh);
+            return await this.fetch(`${this.baseUrl}${path}`, {
+                credentials: this.options.credentials || "same-origin",
+                headers: {
+                    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+                    ...this.perspectiveHeaders(request),
+                },
+            });
+        };
+        let response = await download(false);
+        if (response.status === 401 && this.options.tokenProvider) {
+            response = await download(true);
+        }
+        if (!response.ok) {
+            let data = null;
+            try {
+                data = await response.json();
+            }
+            catch {
+                // Binary endpoints may fail before the platform writes a JSON body.
+            }
+            throw new ControlPlaneError(response.status, data?.errorCode || "DATA_FILE_DOWNLOAD_FAILED", data?.message || `文件下载失败: ${response.status}`, data);
+        }
+        return response;
+    }
+    async createData(appCode, resourceCode, data, request = {}) {
+        return await this.json(this.dataPath(appCode, resourceCode, "records"), {
+            method: "POST",
+            body: JSON.stringify({ data }),
+            headers: this.perspectiveHeaders(request),
+        });
+    }
+    async updateData(appCode, resourceCode, id, input, request = {}) {
+        return await this.json(this.dataPath(appCode, resourceCode, `records/${encodeURIComponent(id)}/update`), {
+            method: "POST",
+            body: JSON.stringify(input),
+            headers: this.perspectiveHeaders(request),
+        });
+    }
+    async deleteData(appCode, resourceCode, id, expectedRevision, request = {}) {
+        return await this.json(this.dataPath(appCode, resourceCode, `records/${encodeURIComponent(id)}/delete`), {
+            method: "POST",
+            body: JSON.stringify({ expectedRevision }),
+            headers: this.perspectiveHeaders(request),
+        });
+    }
+    async transactData(appCode, transaction, request = {}) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/native/data/transactions`, {
+            method: "POST",
+            body: JSON.stringify(transaction),
+            headers: this.perspectiveHeaders(request),
+        });
+    }
+    dataPath(appCode, resourceCode, suffix) {
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/native/data/${encodeURIComponent(resourceCode)}/${suffix}`;
+    }
+    applicationApiPath(appCode, environmentKey, runtimePath, query = {}) {
+        const normalized = String(runtimePath || "")
+            .replace(/^\/+/, "")
+            .replace(/\/+$/, "");
+        if (!normalized ||
+            normalized.includes("\0") ||
+            normalized
+                .split("/")
+                .some((part) => !part || part === "." || part === "..")) {
+            throw new ControlPlaneError(400, "APPLICATION_API_PATH_INVALID", "应用后端路径不能为空或包含路径穿越片段");
+        }
+        const params = new URLSearchParams();
+        for (const [key, value] of Object.entries(query)) {
+            if (value !== undefined && value !== null)
+                params.set(key, String(value));
+        }
+        const suffix = params.size ? `?${params}` : "";
+        return `/openxiangda-app-api/v2/${encodeURIComponent(appCode)}/${encodeURIComponent(environmentKey)}/${normalized
+            .split("/")
+            .map((part) => encodeURIComponent(part))
+            .join("/")}${suffix}`;
+    }
+    async deployExistingVersion(input, action) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(input.appCode)}/${action}`, {
+            method: "POST",
+            body: JSON.stringify({
+                appVersionId: input.appVersionId,
+                environmentId: input.environmentId,
+                environmentKind: input.environmentKind,
+                idempotencyKey: input.idempotencyKey,
+                requestId: input.requestId,
+            }),
+        });
+    }
+    authzPath(appCode) {
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/authz`;
+    }
+    nativeAuthzPath(appCode) {
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/native/authz`;
+    }
+    nativeAuthzManagementPath(appCode) {
+        return `${this.nativeAuthzPath(appCode)}/management`;
+    }
+    query(input) {
+        const query = new URLSearchParams();
+        for (const [key, value] of Object.entries(input)) {
+            if (value === undefined || value === null || value === "")
+                continue;
+            query.set(key, String(value));
+        }
+        return query.toString();
+    }
+    directoryPath(appCode) {
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/directory`;
+    }
+    oauthPath(appCode) {
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/oauth2`;
+    }
+    applicationSecretsPath(appCode, environmentKey) {
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/environments/${encodeURIComponent(environmentKey)}/secrets`;
+    }
+    eventsPath(appCode) {
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/events`;
+    }
+    connectedDevelopmentSessionsPath(appCode) {
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/dev-sessions`;
+    }
+    connectedDevelopmentSessionHeaders(sessionToken) {
+        const token = String(sessionToken || "").trim();
+        if (!token)
+            throw new Error("OPENXIANGDA_CONNECTED_DEV_SESSION_REQUIRED");
+        return { "X-OpenXiangda-Dev-Session": token };
+    }
+    workflowPath(appCode) {
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/workflow`;
+    }
+    perspectiveHeaders(request) {
+        const perspectiveCode = String(request?.perspectiveCode || "").trim();
+        if (perspectiveCode && !/^[a-z][a-z0-9._-]{0,127}$/.test(perspectiveCode)) {
+            throw new ControlPlaneError(400, "OPENXIANGDA_PERSPECTIVE_INVALID", "perspectiveCode must be a stable lowercase identifier");
+        }
+        return perspectiveCode
+            ? { "X-OpenXiangda-Perspective": perspectiveCode }
+            : {};
+    }
+    basicCredentials(clientId, clientSecret) {
+        const value = `${clientId}:${clientSecret}`;
+        if (typeof Buffer !== "undefined")
+            return Buffer.from(value).toString("base64");
+        return globalThis.btoa(value);
+    }
+    async json(path, init = {}) {
+        return await this.request(path, {
+            ...init,
+            headers: {
+                "Content-Type": "application/json",
+                ...(init.headers || {}),
+            },
+        });
+    }
+    async request(path, init = {}) {
+        try {
+            return await this.requestOnce(path, init, false);
+        }
+        catch (error) {
+            if (!this.options.tokenProvider || !this.isUnauthorized(error))
+                throw error;
+            return await this.requestOnce(path, init, true);
+        }
+    }
+    async requestOnce(path, init, forceRefresh) {
+        const token = await this.accessToken(forceRefresh);
+        const response = await this.fetch(`${this.baseUrl}${path}`, {
+            ...init,
+            credentials: init.credentials || this.options.credentials || "same-origin",
+            headers: {
+                Accept: "application/json",
+                ...(token ? { Authorization: `Bearer ${token}` } : {}),
+                ...(init.headers || {}),
+            },
+        });
+        let envelope;
+        try {
+            envelope = (await response.json());
+        }
+        catch {
+            throw new ControlPlaneError(response.status, "CONTROL_PLANE_RESPONSE_INVALID", "平台返回的不是有效 JSON");
+        }
+        if (!response.ok || Number(envelope.code) >= 400) {
+            const status = response.ok ? Number(envelope.code) : response.status;
+            throw new ControlPlaneError(status, envelope.errorCode || "CONTROL_PLANE_REQUEST_FAILED", envelope.message || `平台请求失败: ${response.status}`, envelope.data, {
+                ...(envelope.retryable === undefined
+                    ? {}
+                    : { retryable: envelope.retryable }),
+                ...(envelope.remediation
+                    ? { remediation: envelope.remediation }
+                    : {}),
+                ...(envelope.requestId ? { requestId: envelope.requestId } : {}),
+                ...(envelope.path ? { path: envelope.path } : {}),
+                ...(envelope.field ? { field: envelope.field } : {}),
+            });
+        }
+        return envelope.data;
+    }
+    isUnauthorized(error) {
+        return error instanceof ControlPlaneError && error.status === 401;
+    }
+    async accessToken(forceRefresh) {
+        return this.options.tokenProvider
+            ? await this.options.tokenProvider.getAccessToken({ forceRefresh })
+            : this.options.token;
+    }
+}
+//# sourceMappingURL=control-plane-client.js.map