openxiangda-devkit-core 2.0.0-alpha.12 → 2.0.0-alpha.121

package/dist/control-plane-client.js

@@ -1,13 +1,28 @@
-import { OPENXIANGDA_CONTRACT_VERSION, SCHEMA_VERSIONS, } from "openxiangda-contracts/browser";
+import { CONFIGURATION_COMPATIBILITY_CAPABILITY, CURRENT_APPLICATION_CONTRACT, OPENXIANGDA_CONTRACT_VERSION, } from "openxiangda-contracts/browser";
+import { Agent, fetch as undiciFetch } from "undici";
+const ARTIFACT_UPLOAD_HEADERS_TIMEOUT_MS = 30 * 60 * 1000;
+const ARTIFACT_UPLOAD_BODY_TIMEOUT_MS = 5 * 60 * 1000;
+function createArtifactUploadFetch() {
+    const dispatcher = new Agent({
+        headersTimeout: ARTIFACT_UPLOAD_HEADERS_TIMEOUT_MS,
+        bodyTimeout: ARTIFACT_UPLOAD_BODY_TIMEOUT_MS,
+    });
+    return async (input, init) => (await undiciFetch(input, {
+        ...(init || {}),
+        dispatcher,
+    }));
+}
 export class ControlPlaneError extends Error {
     status;
     code;
     data;
-    constructor(status, code, message, data) {
+    remote;
+    constructor(status, code, message, data, remote) {
         super(message);
         this.status = status;
         this.code = code;
         this.data = data;
+        this.remote = remote;
         this.name = "ControlPlaneError";
     }
 }
@@ -15,18 +30,83 @@ export class OpenXiangdaControlPlaneClient {
     options;
     baseUrl;
     fetch;
+    artifactUploadFetch;
     constructor(options) {
         this.options = options;
         this.baseUrl = options.baseUrl.replace(/\/+$/, "");
         this.fetch = options.fetch || globalThis.fetch.bind(globalThis);
+        this.artifactUploadFetch = options.fetch || createArtifactUploadFetch();
     }
     async capabilities() {
         const capabilities = await this.json("/openxiangda-api/v2/capabilities");
         if (capabilities.contractVersion !== OPENXIANGDA_CONTRACT_VERSION) {
-            throw new ControlPlaneError(409, "OPENXIANGDA_CONTRACT_VERSION_MISMATCH", `平台 contract ${capabilities.contractVersion} 与工具 ${OPENXIANGDA_CONTRACT_VERSION} 不兼容`, capabilities);
+            const compatibility = capabilities.configurationCompatibility;
+            throw new ControlPlaneError(409, "OPENXIANGDA_CONTRACT_VERSION_MISMATCH", `平台 contract ${capabilities.contractVersion} 与工具 ${OPENXIANGDA_CONTRACT_VERSION} 不兼容`, {
+                pointer: "/contractVersion",
+                clientContractVersion: OPENXIANGDA_CONTRACT_VERSION,
+                clientSchemaVersions: {
+                    appPackage: CURRENT_APPLICATION_CONTRACT.appPackageSchemaVersion,
+                    configuration: CURRENT_APPLICATION_CONTRACT.configurationBundleSchemaVersion,
+                    contract: CURRENT_APPLICATION_CONTRACT.contractBundleSchemaVersion,
+                    compiler: CURRENT_APPLICATION_CONTRACT.compilerContractVersion,
+                },
+                platformVersion: String(capabilities.platformVersion || "unknown"),
+                platformCapability: compatibility?.capability || {
+                    code: CONFIGURATION_COMPATIBILITY_CAPABILITY,
+                    version: "unknown",
+                    status: "unavailable",
+                },
+                required: { ...CURRENT_APPLICATION_CONTRACT },
+                supported: (compatibility?.supportedApplicationContracts || []).slice(0, 8),
+                requiredContractVersion: OPENXIANGDA_CONTRACT_VERSION,
+                supportedContractVersion: capabilities.contractVersion,
+            });
         }
         return capabilities;
     }
+    async validateConfigurationCompatibility(appCode, capabilities, input) {
+        const compatibility = capabilities.configurationCompatibility;
+        const expectedTemplate = "/openxiangda-api/v2/applications/{appCode}/configuration-compatibility";
+        if (compatibility.endpointTemplate !== expectedTemplate) {
+            throw new ControlPlaneError(409, "OPENXIANGDA_CONFIGURATION_COMPATIBILITY_ENDPOINT_INVALID", "平台配置兼容性端点不符合当前公开契约", {
+                pointer: "/configurationCompatibility/endpointTemplate",
+                clientContractVersion: OPENXIANGDA_CONTRACT_VERSION,
+                clientSchemaVersions: {
+                    appPackage: input.required.appPackageSchemaVersion,
+                    configuration: input.required.configurationBundleSchemaVersion,
+                    contract: input.required.contractBundleSchemaVersion,
+                    compiler: input.required.compilerContractVersion,
+                },
+                platformVersion: capabilities.platformVersion,
+                platformCapability: compatibility.capability,
+                required: { ...input.required },
+                supported: compatibility.supportedApplicationContracts.slice(0, 8),
+                requiredEndpointTemplate: expectedTemplate,
+                supportedEndpointTemplate: compatibility.endpointTemplate,
+            });
+        }
+        const body = JSON.stringify(input);
+        const requestBytes = new TextEncoder().encode(body).byteLength;
+        if (requestBytes > compatibility.limits.requestBytes) {
+            throw new ControlPlaneError(409, "OPENXIANGDA_CONFIGURATION_VALIDATION_REQUEST_TOO_LARGE", "配置兼容性请求超过目标平台公开上限", {
+                pointer: "/",
+                clientContractVersion: OPENXIANGDA_CONTRACT_VERSION,
+                clientSchemaVersions: {
+                    appPackage: input.required.appPackageSchemaVersion,
+                    configuration: input.required.configurationBundleSchemaVersion,
+                    contract: input.required.contractBundleSchemaVersion,
+                    compiler: input.required.compilerContractVersion,
+                },
+                platformVersion: capabilities.platformVersion,
+                platformCapability: compatibility.capability,
+                required: { ...input.required },
+                supported: compatibility.supportedApplicationContracts.slice(0, 8),
+                requiredRequestBytes: requestBytes,
+                supportedRequestBytes: compatibility.limits.requestBytes,
+            });
+        }
+        return await this.json(compatibility.endpointTemplate.replace("{appCode}", encodeURIComponent(appCode)), { method: "POST", body });
+    }
     async provisionApplication(input) {
         return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(input.appCode)}/provision`, {
             method: "POST",
@@ -36,6 +116,29 @@ export class OpenXiangdaControlPlaneClient {
             }),
         });
     }
+    async createConnectedDevelopmentSession(appCode, input) {
+        return await this.json(this.connectedDevelopmentSessionsPath(appCode), { method: "POST", body: JSON.stringify(input) });
+    }
+    async preparePreproductionAcceptanceIdentities(appCode, input) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/acceptance/identities/prepare`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async connectedDevelopmentSession(appCode, sessionToken) {
+        return await this.json(`${this.connectedDevelopmentSessionsPath(appCode)}/current`, { headers: this.connectedDevelopmentSessionHeaders(sessionToken) });
+    }
+    async refreshConnectedDevelopmentSession(appCode, sessionToken) {
+        return await this.json(`${this.connectedDevelopmentSessionsPath(appCode)}/current/refresh`, {
+            method: "POST",
+            body: "{}",
+            headers: this.connectedDevelopmentSessionHeaders(sessionToken),
+        });
+    }
+    async revokeConnectedDevelopmentSession(appCode, sessionToken) {
+        await this.json(`${this.connectedDevelopmentSessionsPath(appCode)}/current/revoke`, {
+            method: "POST",
+            body: "{}",
+            headers: this.connectedDevelopmentSessionHeaders(sessionToken),
+        });
+    }
     async oauthClients(appCode) {
         return await this.json(`${this.oauthPath(appCode)}/clients`);
     }
@@ -104,16 +207,15 @@ export class OpenXiangdaControlPlaneClient {
     }
     async applicationApiResponse(appCode, environmentKey, runtimePath, input) {
         const path = this.applicationApiPath(appCode, environmentKey, runtimePath, input.query);
-        const { query: _query, roleSessionId: _roleSessionId, ...init } = input;
+        const { query: _query, perspectiveCode: _perspectiveCode, ...init } = input;
+        const token = await this.accessToken(false);
         return await this.fetch(`${this.baseUrl}${path}`, {
             ...init,
             credentials: init.credentials || this.options.credentials || "include",
             headers: {
                 Accept: "application/json",
-                ...(this.options.token
-                    ? { Authorization: `Bearer ${this.options.token}` }
-                    : {}),
-                ...this.optionalRoleSessionHeaders(input),
+                ...(token ? { Authorization: `Bearer ${token}` } : {}),
+                ...this.perspectiveHeaders(input),
                 ...(init.headers || {}),
             },
         });
@@ -143,6 +245,16 @@ export class OpenXiangdaControlPlaneClient {
         }
         return data;
     }
+    async artifactStatus(appCode, digest) {
+        try {
+            return await this.request(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/artifacts/${digest}`, { method: 'GET' });
+        }
+        catch (error) {
+            if (error instanceof ControlPlaneError && error.status === 404 && error.code === 'DELIVERY_ARTIFACT_NOT_FOUND')
+                return null;
+            throw error;
+        }
+    }
     async uploadArtifact(input) {
         const params = new URLSearchParams({
             kind: input.kind,
@@ -151,7 +263,22 @@ export class OpenXiangdaControlPlaneClient {
         });
         const form = new FormData();
         form.append("file", new Blob([input.content], { type: input.contentType }), input.digest);
-        return await this.request(`/openxiangda-api/v2/applications/${encodeURIComponent(input.appCode)}/artifacts/${input.digest}?${params}`, { method: "POST", body: form });
+        try {
+            return await this.request(`/openxiangda-api/v2/applications/${encodeURIComponent(input.appCode)}/artifacts/${input.digest}?${params}`, { method: "POST", body: form }, this.artifactUploadFetch);
+        }
+        catch (error) {
+            if (error instanceof ControlPlaneError)
+                throw error;
+            const causeCode = String(error?.cause?.code || error?.code || "").trim();
+            throw new ControlPlaneError(503, "OPENXIANGDA_ARTIFACT_UPLOAD_FAILED", "Application v2 制品上传连接中断", {
+                digest: input.digest,
+                kind: input.kind,
+                ...(causeCode ? { causeCode } : {}),
+            }, {
+                retryable: true,
+                remediation: "重新运行 openxiangda deploy；已完成的内容寻址制品会自动去重",
+            });
+        }
     }
     async createDeployment(input) {
         return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(input.appCode)}/deployments`, {
@@ -173,6 +300,15 @@ export class OpenXiangdaControlPlaneClient {
     async deployments(appCode, limit = 20) {
         return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/deployments?limit=${Math.min(Math.max(Number(limit) || 20, 1), 100)}`);
     }
+    async applicationEnvironments(appCode) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/environments`);
+    }
+    async startEnvironment(appCode, environmentKey, input) {
+        return await this.changeEnvironmentRuntimeState(appCode, environmentKey, "start", input);
+    }
+    async stopEnvironment(appCode, environmentKey, input) {
+        return await this.changeEnvironmentRuntimeState(appCode, environmentKey, "stop", input);
+    }
     async retryDeployment(appCode, deploymentId) {
         return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/deployments/${encodeURIComponent(deploymentId)}/retry`, { method: "POST", body: "{}" });
     }
@@ -182,15 +318,27 @@ export class OpenXiangdaControlPlaneClient {
     async promote(input) {
         return await this.deployExistingVersion(input, "promotions");
     }
+    async redeploy(input) {
+        return await this.deployExistingVersion(input, "redeployments");
+    }
     async rollback(input) {
         return await this.deployExistingVersion(input, "rollbacks");
     }
     async appVersions(appCode, limit = 30) {
         return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/versions?limit=${Math.min(Math.max(Number(limit) || 30, 1), 100)}`);
     }
+    async productionPromotionPreflight(appCode, sourceDeploymentId) {
+        return this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/deployments/${encodeURIComponent(sourceDeploymentId)}/promotion-preflight`, { method: 'POST', body: '{}' });
+    }
     async environmentHead(appCode, environmentKey) {
         return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/environment-heads/${encodeURIComponent(environmentKey)}`);
     }
+    async changeEnvironmentRuntimeState(appCode, environmentKey, action, input) {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/environments/${encodeURIComponent(environmentKey)}/${action}`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
     async applicationSecrets(appCode, environmentKey) {
         return await this.json(this.applicationSecretsPath(appCode, environmentKey));
     }
@@ -212,19 +360,12 @@ export class OpenXiangdaControlPlaneClient {
     async applicationSecretAuditEvents(appCode, environmentKey, name, limit = 100) {
         return await this.json(`${this.applicationSecretsPath(appCode, environmentKey)}/${encodeURIComponent(name)}/audit?limit=${Math.min(Math.max(Number(limit) || 100, 1), 500)}`);
     }
-    async createEventSubscription(input) {
-        const { appCode, ...body } = input;
-        return await this.json(`${this.eventsPath(appCode)}/subscriptions`, { method: "POST", body: JSON.stringify(body) });
-    }
     async eventSubscriptions(appCode) {
         return await this.json(`${this.eventsPath(appCode)}/subscriptions`);
     }
     async setEventSubscriptionStatus(appCode, subscriptionId, input) {
         return await this.json(`${this.eventsPath(appCode)}/subscriptions/${encodeURIComponent(subscriptionId)}/status`, { method: "POST", body: JSON.stringify(input) });
     }
-    async rotateEventSubscriptionSecret(appCode, subscriptionId, input) {
-        return await this.json(`${this.eventsPath(appCode)}/subscriptions/${encodeURIComponent(subscriptionId)}/rotate-secret`, { method: "POST", body: JSON.stringify(input) });
-    }
     async eventDeliveries(appCode, limit = 100) {
         return await this.json(`${this.eventsPath(appCode)}/deliveries?limit=${Math.min(Math.max(Number(limit) || 100, 1), 500)}`);
     }
@@ -234,16 +375,18 @@ export class OpenXiangdaControlPlaneClient {
             body: JSON.stringify(idempotencyKey ? { idempotencyKey } : {}),
         });
     }
-    async createTimerSubscription(input) {
-        const { appCode, ...body } = input;
-        return await this.json(`${this.eventsPath(appCode)}/timers`, { method: "POST", body: JSON.stringify(body) });
-    }
     async timerSubscriptions(appCode) {
         return await this.json(`${this.eventsPath(appCode)}/timers`);
     }
     async setTimerSubscriptionStatus(appCode, timerId, input) {
         return await this.json(`${this.eventsPath(appCode)}/timers/${encodeURIComponent(timerId)}/status`, { method: "POST", body: JSON.stringify(input) });
     }
+    async dateTriggers(appCode) {
+        return await this.json(`${this.eventsPath(appCode)}/date-triggers`);
+    }
+    async setDateTriggerStatus(appCode, triggerId, input) {
+        return await this.json(`${this.eventsPath(appCode)}/date-triggers/${encodeURIComponent(triggerId)}/status`, { method: "POST", body: JSON.stringify(input) });
+    }
     async registerWorkflowDefinition(appCode, version, definition) {
         return await this.json(`${this.workflowPath(appCode)}/definitions`, {
             method: "POST",
@@ -268,98 +411,173 @@ export class OpenXiangdaControlPlaneClient {
     async activateWorkflow(appCode, workflowCode, input) {
         return await this.json(`${this.workflowPath(appCode)}/definitions/${encodeURIComponent(workflowCode)}/activate`, { method: "POST", body: JSON.stringify(input) });
     }
-    async prepareWorkflowStart(input) {
-        const { appCode, workflowCode, roleSessionId, ...body } = input;
-        return await this.json(`${this.workflowPath(appCode)}/definitions/${encodeURIComponent(workflowCode)}/prepare-start`, {
-            method: "POST",
-            body: JSON.stringify(body),
-            headers: this.roleSessionHeaders({ roleSessionId }),
-        });
-    }
-    async startWorkflow(appCode, input) {
-        const { roleSessionId, ...body } = input;
-        return await this.json(`${this.workflowPath(appCode)}/instances`, {
-            method: "POST",
-            body: JSON.stringify(body),
-            headers: this.roleSessionHeaders({ roleSessionId }),
-        });
-    }
-    async createWorkflowDelegation(appCode, input, request) {
+    async createWorkflowDelegation(appCode, input) {
         return await this.json(`${this.workflowPath(appCode)}/delegations`, {
             method: "POST",
             body: JSON.stringify(input),
-            headers: this.roleSessionHeaders(request),
         });
     }
-    async workflowDelegationTargets(appCode, userId, request) {
-        return await this.json(`${this.workflowPath(appCode)}/delegations/targets?userId=${encodeURIComponent(userId)}`, { headers: this.roleSessionHeaders(request) });
+    async workflowDelegationTargets(appCode, userId, environmentKey) {
+        return await this.json(`${this.workflowPath(appCode)}/delegations/targets?userId=${encodeURIComponent(userId)}${environmentKey ? `&environmentKey=${encodeURIComponent(environmentKey)}` : ""}`);
     }
-    async workflowDelegations(appCode, request, input = {}) {
-        return await this.json(`${this.workflowPath(appCode)}/delegations?all=${input.all === true}`, { headers: this.roleSessionHeaders(request) });
+    async workflowDelegations(appCode, input = {}) {
+        return await this.json(`${this.workflowPath(appCode)}/delegations?all=${input.all === true}${input.environmentKey
+            ? `&environmentKey=${encodeURIComponent(input.environmentKey)}`
+            : ""}`);
     }
-    async revokeWorkflowDelegation(appCode, delegationId, request) {
-        return await this.json(`${this.workflowPath(appCode)}/delegations/${encodeURIComponent(delegationId)}/revoke`, {
+    async revokeWorkflowDelegation(appCode, delegationId, environmentKey) {
+        return await this.json(`${this.workflowPath(appCode)}/delegations/${encodeURIComponent(delegationId)}/revoke${environmentKey
+            ? `?environmentKey=${encodeURIComponent(environmentKey)}`
+            : ""}`, {
             method: "POST",
-            headers: this.roleSessionHeaders(request),
         });
     }
-    async workflowTaskSurface(appCode, taskId, request) {
-        return await this.json(`${this.workflowPath(appCode)}/tasks/${encodeURIComponent(taskId)}/surface`, { headers: this.roleSessionHeaders(request) });
+    async workflowTaskSurface(appCode, taskId, csrfToken) {
+        return await this.json(`${this.workflowPath(appCode)}/tasks/${encodeURIComponent(taskId)}/surface`, { headers: { "X-OpenXiangda-CSRF-Token": csrfToken } });
     }
-    async workflowInstanceSurface(appCode, instanceId, request) {
-        return await this.json(`${this.workflowPath(appCode)}/instances/${encodeURIComponent(instanceId)}/surface`, { headers: this.roleSessionHeaders(request) });
+    async workflowInstanceSurface(appCode, instanceId, csrfToken) {
+        return await this.json(`${this.workflowPath(appCode)}/instances/${encodeURIComponent(instanceId)}/surface`, { headers: { "X-OpenXiangda-CSRF-Token": csrfToken } });
     }
-    async executeWorkflowTaskCommand(appCode, taskId, command, input, request) {
+    async executeWorkflowTaskCommand(appCode, taskId, command, input) {
+        const { csrfToken, ...request } = input;
         return await this.json(`${this.workflowPath(appCode)}/tasks/${encodeURIComponent(taskId)}/commands/${encodeURIComponent(command)}`, {
             method: "POST",
-            body: JSON.stringify(input),
-            headers: this.roleSessionHeaders(request),
+            headers: { "X-OpenXiangda-CSRF-Token": csrfToken },
+            body: JSON.stringify(request),
         });
     }
-    async executeWorkflowInstanceCommand(appCode, instanceId, command, input, request) {
+    async executeWorkflowInstanceCommand(appCode, instanceId, command, input) {
+        const { csrfToken, ...request } = input;
         return await this.json(`${this.workflowPath(appCode)}/instances/${encodeURIComponent(instanceId)}/commands/${command}`, {
             method: "POST",
-            body: JSON.stringify(input),
-            headers: this.roleSessionHeaders(request),
+            headers: { "X-OpenXiangda-CSRF-Token": csrfToken },
+            body: JSON.stringify(request),
         });
     }
-    async workflowAssignmentExplain(appCode, taskId, request) {
-        return await this.json(`${this.workflowPath(appCode)}/tasks/${encodeURIComponent(taskId)}/assignment-explain`, { headers: this.roleSessionHeaders(request) });
+    async workflowAssignmentExplain(appCode, taskId) {
+        return await this.json(`${this.workflowPath(appCode)}/tasks/${encodeURIComponent(taskId)}/assignment-explain`);
     }
-    async workflowTimeline(appCode, instanceId, request) {
-        return await this.json(`${this.workflowPath(appCode)}/instances/${encodeURIComponent(instanceId)}/timeline`, { headers: this.roleSessionHeaders(request) });
+    async workflowTimeline(appCode, instanceId) {
+        return await this.json(`${this.workflowPath(appCode)}/instances/${encodeURIComponent(instanceId)}/timeline`);
     }
-    async workflowWorkCenter(appCode, request, input = {}) {
+    async workflowWorkCenter(appCode, input = {}) {
         const query = new URLSearchParams({
             status: input.status || "pending",
             limit: String(Math.min(Math.max(Number(input.limit) || 50, 1), 200)),
+            ...(input.environmentKey ? { environmentKey: input.environmentKey } : {}),
         });
-        return await this.json(`${this.workflowPath(appCode)}/work-center/items?${query}`, { headers: this.roleSessionHeaders(request) });
+        return await this.json(`${this.workflowPath(appCode)}/work-center/items?${query}`);
+    }
+    async workflowDiagnostics(appCode, limit = 100) {
+        return await this.json(`${this.workflowPath(appCode)}/diagnostics?limit=${Math.min(Math.max(Number(limit) || 100, 1), 500)}`);
     }
-    async workflowKernelInstance(appCode, instanceId, request) {
-        return await this.json(`${this.workflowPath(appCode)}/kernel/instances/${encodeURIComponent(instanceId)}`, { headers: this.roleSessionHeaders(request) });
+    async applicationAdministrationContext(appCode, environmentKey) {
+        return await this.json(`${this.administrationPath(appCode)}/context?${this.query({ environmentKey })}`);
     }
-    async workflowKernelWorkCenter(appCode, request, input = {}) {
-        const query = new URLSearchParams({
-            category: input.category || "pending",
-            limit: String(Math.min(Math.max(Number(input.limit) || 50, 1), 200)),
+    async workflowNodeConfigurations(appCode, workflowCode, environmentKey) {
+        return await this.json(`${this.administrationPath(appCode)}/workflows/${encodeURIComponent(workflowCode)}/node-configurations?${this.query({ environmentKey })}`);
+    }
+    async nativeAuthorizationCatalog(appCode, input = {}) {
+        const query = this.query({
+            environmentKey: input.environmentKey || "preproduction",
         });
-        return await this.json(`${this.workflowPath(appCode)}/kernel/work-center?${query}`, { headers: this.roleSessionHeaders(request) });
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/catalog?${query}`);
     }
-    async workflowDiagnostics(appCode, limit = 100) {
-        return await this.json(`${this.workflowPath(appCode)}/diagnostics?limit=${Math.min(Math.max(Number(limit) || 100, 1), 500)}`);
+    async nativeScopeValues(appCode, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/scope-values?${this.query({
+            ...input,
+            environmentKey: input.environmentKey || "preproduction",
+        })}`);
+    }
+    async nativeRoleMemberships(appCode, input = {}) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/memberships?${this.query({
+            ...input,
+            environmentKey: input.environmentKey || "preproduction",
+        })}`);
+    }
+    async createNativeRoleMembership(appCode, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/memberships`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
     }
-    async bootstrapRoleSession(appCode) {
-        return await this.json(`${this.authzPath(appCode)}/role-session`);
+    async updateNativeRoleMembership(appCode, membershipId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/memberships/${encodeURIComponent(membershipId)}/update`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
     }
-    async switchRoleSession(appCode, roleAssignmentId) {
-        return await this.json(`${this.authzPath(appCode)}/role-session/switch`, {
+    async revokeNativeRoleMembership(appCode, membershipId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/memberships/${encodeURIComponent(membershipId)}/revoke`, {
             method: "POST",
-            body: JSON.stringify({ roleAssignmentId }),
+            body: JSON.stringify(input),
         });
     }
-    async currentPrincipal(appCode, request) {
-        return await this.json(`${this.authzPath(appCode)}/principal`, { headers: this.roleSessionHeaders(request) });
+    async nativeRoleManagementGrants(appCode, input = {}) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/role-management-grants?${this.query({
+            ...input,
+            environmentKey: input.environmentKey || "preproduction",
+        })}`);
+    }
+    async createNativeRoleManagementGrant(appCode, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/role-management-grants`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async updateNativeRoleManagementGrant(appCode, grantId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/role-management-grants/${encodeURIComponent(grantId)}/update`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async revokeNativeRoleManagementGrant(appCode, grantId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/role-management-grants/${encodeURIComponent(grantId)}/revoke`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async nativeAuthorizationMutationReceipt(appCode, operationId) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/mutation-receipts/${encodeURIComponent(operationId)}`);
+    }
+    async nativeSuperAdmins(appCode, input = {}) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/super-admins?${this.query({ ...input, environmentKey: input.environmentKey || "preproduction" })}`);
+    }
+    async grantNativeSuperAdmin(appCode, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/super-admins`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async revokeNativeSuperAdmin(appCode, grantId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/super-admins/${encodeURIComponent(grantId)}/revoke`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async nativeRelationshipGrants(appCode, input = {}) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/relationship-grants?${this.query({
+            ...input,
+            environmentKey: input.environmentKey || "preproduction",
+        })}`);
+    }
+    async createNativeRelationshipGrant(appCode, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/relationship-grants`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async updateNativeRelationshipGrant(appCode, grantId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/relationship-grants/${encodeURIComponent(grantId)}/update`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async revokeNativeRelationshipGrant(appCode, grantId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/relationship-grants/${encodeURIComponent(grantId)}/revoke`, {
+            method: "POST",
+            body: JSON.stringify(input),
+        });
+    }
+    async nativeAuthorizationProjectionHealth(appCode, environmentKey = "preproduction") {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/projections/health?${this.query({ environmentKey })}`);
+    }
+    async rebuildNativeAuthorizationProjections(appCode, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/projections/rebuild`, { method: "POST", body: JSON.stringify(input) });
+    }
+    async recoverNativeAuthorizationProjection(appCode, jobId, input) {
+        return await this.json(`${this.nativeAuthzManagementPath(appCode)}/projections/jobs/${encodeURIComponent(jobId)}/recover`, { method: "POST", body: JSON.stringify(input) });
     }
     async myRoleAssignments(appCode) {
         return await this.json(`${this.authzPath(appCode)}/assignments/me`);
@@ -376,38 +594,37 @@ export class OpenXiangdaControlPlaneClient {
     async revokeRoleAssignment(appCode, assignmentId, expectedRevision) {
         return await this.json(`${this.authzPath(appCode)}/assignments/${encodeURIComponent(assignmentId)}/revoke`, { method: "POST", body: JSON.stringify({ expectedRevision }) });
     }
-    async explainAuthorization(appCode, input) {
-        const { roleSessionId, ...body } = input;
-        return await this.json(`${this.authzPath(appCode)}/explain`, {
-            method: "POST",
-            body: JSON.stringify(body),
-            headers: this.roleSessionHeaders({ roleSessionId }),
-        });
-    }
-    async explainAuthorizations(appCode, input) {
-        return await this.json(`${this.authzPath(appCode)}/explain-batch`, {
-            method: "POST",
-            body: JSON.stringify({
-                schemaVersion: SCHEMA_VERSIONS.authorizationBatchRequest,
-                requests: input.requests,
-            }),
-            headers: this.roleSessionHeaders({
-                roleSessionId: input.roleSessionId,
-            }),
-        });
-    }
-    async searchDirectoryEntries(appCode, kind, input, request) {
+    async searchDirectoryEntries(appCode, kind, input) {
         const query = new URLSearchParams({
             keyword: input.keyword.trim(),
             limit: String(Math.min(Math.max(Number(input.limit) || 20, 1), 50)),
         });
-        return await this.json(`${this.directoryPath(appCode)}/${kind}s?${query}`, { headers: this.roleSessionHeaders(request) });
+        return await this.json(`${this.directoryPath(appCode)}/${kind}s?${query}`);
+    }
+    async browseDepartmentEntries(appCode, input) {
+        const query = new URLSearchParams({
+            offset: String(Math.max(Number(input.offset) || 0, 0)),
+            limit: String(Math.min(Math.max(Number(input.limit) || 100, 1), 100)),
+        });
+        const parentId = String(input.parentId || "").trim();
+        if (parentId)
+            query.set("parentId", parentId);
+        return await this.json(`${this.directoryPath(appCode)}/departments/tree?${query}`);
+    }
+    async browseDepartmentUserEntries(appCode, input) {
+        const departmentId = String(input.departmentId || "").trim();
+        if (!departmentId)
+            throw new Error("departmentId is required");
+        const query = new URLSearchParams({
+            page: String(Math.max(Number(input.page) || 1, 1)),
+            limit: String(Math.min(Math.max(Number(input.limit) || 50, 1), 100)),
+        });
+        return await this.json(`${this.directoryPath(appCode)}/departments/${encodeURIComponent(departmentId)}/users?${query}`);
     }
-    async resolveDirectoryEntries(appCode, input, request) {
+    async resolveDirectoryEntries(appCode, input) {
         return await this.json(`${this.directoryPath(appCode)}/resolve`, {
             method: "POST",
             body: JSON.stringify(input),
-            headers: this.roleSessionHeaders(request),
         });
     }
     async applyDataResource(resource, input = {}) {
@@ -445,17 +662,24 @@ export class OpenXiangdaControlPlaneClient {
         return await this.json(this.dataPath(appCode, resourceCode, "query"), {
             method: "POST",
             body: JSON.stringify(query),
-            headers: this.optionalRoleSessionHeaders(request),
+            headers: this.perspectiveHeaders(request),
         });
     }
+    async chinaDivisions(parentAdcode) {
+        const query = new URLSearchParams();
+        if (parentAdcode)
+            query.set("parentAdcode", parentAdcode);
+        const suffix = query.size ? `?${query}` : "";
+        return await this.json(`/china-divisions/${suffix}`);
+    }
     async getData(appCode, resourceCode, id, request = {}) {
-        return await this.json(this.dataPath(appCode, resourceCode, `records/${encodeURIComponent(id)}`), { headers: this.optionalRoleSessionHeaders(request) });
+        return await this.json(this.dataPath(appCode, resourceCode, `records/${encodeURIComponent(id)}`), { headers: this.perspectiveHeaders(request) });
     }
     async aggregateData(appCode, resourceCode, query, request = {}) {
         return await this.json(this.dataPath(appCode, resourceCode, "aggregate"), {
             method: "POST",
             body: JSON.stringify(query),
-            headers: this.optionalRoleSessionHeaders(request),
+            headers: this.perspectiveHeaders(request),
         });
     }
     async dataAudit(appCode, resourceCode, id, input = {}, request = {}) {
@@ -465,40 +689,45 @@ export class OpenXiangdaControlPlaneClient {
         if (input.offset !== undefined)
             query.set("offset", String(input.offset));
         const suffix = query.size ? `?${query}` : "";
-        return await this.json(`${this.dataPath(appCode, resourceCode, `records/${encodeURIComponent(id)}/audit`)}${suffix}`, { headers: this.optionalRoleSessionHeaders(request) });
+        return await this.json(`${this.dataPath(appCode, resourceCode, `records/${encodeURIComponent(id)}/audit`)}${suffix}`, { headers: this.perspectiveHeaders(request) });
     }
     async initiateDataFileUpload(appCode, resourceCode, input, request = {}) {
         return await this.json(this.dataPath(appCode, resourceCode, "files/uploads/initiate"), {
             method: "POST",
             body: JSON.stringify(input),
-            headers: this.optionalRoleSessionHeaders(request),
+            headers: this.perspectiveHeaders(request),
         });
     }
     async completeDataFileUpload(appCode, resourceCode, fileId, request = {}) {
         return await this.json(this.dataPath(appCode, resourceCode, `files/${encodeURIComponent(fileId)}/complete`), {
             method: "POST",
             body: "{}",
-            headers: this.optionalRoleSessionHeaders(request),
+            headers: this.perspectiveHeaders(request),
         });
     }
-    async deleteUnboundDataFile(appCode, resourceCode, fileId, request = {}) {
+    async deleteUnreferencedDataFile(appCode, resourceCode, fileId, request = {}) {
         return await this.json(this.dataPath(appCode, resourceCode, `files/${encodeURIComponent(fileId)}/delete`), {
             method: "POST",
             body: "{}",
-            headers: this.optionalRoleSessionHeaders(request),
+            headers: this.perspectiveHeaders(request),
         });
     }
     async dataFileContent(appCode, resourceCode, fileId, request = {}) {
         const path = this.dataPath(appCode, resourceCode, `files/${encodeURIComponent(fileId)}/content`);
-        const response = await this.fetch(`${this.baseUrl}${path}`, {
-            credentials: this.options.credentials || "same-origin",
-            headers: {
-                ...(this.options.token
-                    ? { Authorization: `Bearer ${this.options.token}` }
-                    : {}),
-                ...this.optionalRoleSessionHeaders(request),
-            },
-        });
+        const download = async (forceRefresh) => {
+            const token = await this.accessToken(forceRefresh);
+            return await this.fetch(`${this.baseUrl}${path}`, {
+                credentials: this.options.credentials || "same-origin",
+                headers: {
+                    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+                    ...this.perspectiveHeaders(request),
+                },
+            });
+        };
+        let response = await download(false);
+        if (response.status === 401 && this.options.tokenProvider) {
+            response = await download(true);
+        }
         if (!response.ok) {
             let data = null;
             try {
@@ -515,32 +744,32 @@ export class OpenXiangdaControlPlaneClient {
         return await this.json(this.dataPath(appCode, resourceCode, "records"), {
             method: "POST",
             body: JSON.stringify({ data }),
-            headers: this.optionalRoleSessionHeaders(request),
+            headers: this.perspectiveHeaders(request),
         });
     }
     async updateData(appCode, resourceCode, id, input, request = {}) {
         return await this.json(this.dataPath(appCode, resourceCode, `records/${encodeURIComponent(id)}/update`), {
             method: "POST",
             body: JSON.stringify(input),
-            headers: this.optionalRoleSessionHeaders(request),
+            headers: this.perspectiveHeaders(request),
         });
     }
     async deleteData(appCode, resourceCode, id, expectedRevision, request = {}) {
         return await this.json(this.dataPath(appCode, resourceCode, `records/${encodeURIComponent(id)}/delete`), {
             method: "POST",
             body: JSON.stringify({ expectedRevision }),
-            headers: this.optionalRoleSessionHeaders(request),
+            headers: this.perspectiveHeaders(request),
         });
     }
     async transactData(appCode, transaction, request = {}) {
-        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/data/transactions`, {
+        return await this.json(`/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/native/data/transactions`, {
             method: "POST",
             body: JSON.stringify(transaction),
-            headers: this.optionalRoleSessionHeaders(request),
+            headers: this.perspectiveHeaders(request),
         });
     }
     dataPath(appCode, resourceCode, suffix) {
-        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/data/${encodeURIComponent(resourceCode)}/${suffix}`;
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/native/data/${encodeURIComponent(resourceCode)}/${suffix}`;
     }
     applicationApiPath(appCode, environmentKey, runtimePath, query = {}) {
         const normalized = String(runtimePath || "")
@@ -579,6 +808,21 @@ export class OpenXiangdaControlPlaneClient {
     authzPath(appCode) {
         return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/authz`;
     }
+    nativeAuthzPath(appCode) {
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/native/authz`;
+    }
+    nativeAuthzManagementPath(appCode) {
+        return `${this.nativeAuthzPath(appCode)}/management`;
+    }
+    query(input) {
+        const query = new URLSearchParams();
+        for (const [key, value] of Object.entries(input)) {
+            if (value === undefined || value === null || value === "")
+                continue;
+            query.set(key, String(value));
+        }
+        return query.toString();
+    }
     directoryPath(appCode) {
         return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/directory`;
     }
@@ -591,21 +835,28 @@ export class OpenXiangdaControlPlaneClient {
     eventsPath(appCode) {
         return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/events`;
     }
+    connectedDevelopmentSessionsPath(appCode) {
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/dev-sessions`;
+    }
+    connectedDevelopmentSessionHeaders(sessionToken) {
+        const token = String(sessionToken || "").trim();
+        if (!token)
+            throw new Error("OPENXIANGDA_CONNECTED_DEV_SESSION_REQUIRED");
+        return { "X-OpenXiangda-Dev-Session": token };
+    }
     workflowPath(appCode) {
         return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/workflow`;
     }
-    roleSessionHeaders(request) {
-        if (!request?.roleSessionId?.trim()) {
-            throw new ControlPlaneError(400, "ROLE_SESSION_REQUIRED", "OpenXiangda v2 用户作用域请求必须显式携带 roleSessionId");
-        }
-        return {
-            "X-OpenXiangda-Role-Session-Id": request.roleSessionId,
-        };
+    administrationPath(appCode) {
+        return `/openxiangda-api/v2/applications/${encodeURIComponent(appCode)}/admin`;
     }
-    optionalRoleSessionHeaders(request) {
-        const roleSessionId = String(request?.roleSessionId || "").trim();
-        return roleSessionId
-            ? { "X-OpenXiangda-Role-Session-Id": roleSessionId }
+    perspectiveHeaders(request) {
+        const perspectiveCode = String(request?.perspectiveCode || "").trim();
+        if (perspectiveCode && !/^[a-z][a-z0-9._-]{0,127}$/.test(perspectiveCode)) {
+            throw new ControlPlaneError(400, "OPENXIANGDA_PERSPECTIVE_INVALID", "perspectiveCode must be a stable lowercase identifier");
+        }
+        return perspectiveCode
+            ? { "X-OpenXiangda-Perspective": perspectiveCode }
             : {};
     }
     basicCredentials(clientId, clientSecret) {
@@ -623,15 +874,24 @@ export class OpenXiangdaControlPlaneClient {
             },
         });
     }
-    async request(path, init = {}) {
-        const response = await this.fetch(`${this.baseUrl}${path}`, {
+    async request(path, init = {}, fetcher = this.fetch) {
+        try {
+            return await this.requestOnce(path, init, false, fetcher);
+        }
+        catch (error) {
+            if (!this.options.tokenProvider || !this.isUnauthorized(error))
+                throw error;
+            return await this.requestOnce(path, init, true, fetcher);
+        }
+    }
+    async requestOnce(path, init, forceRefresh, fetcher) {
+        const token = await this.accessToken(forceRefresh);
+        const response = await fetcher(`${this.baseUrl}${path}`, {
             ...init,
             credentials: init.credentials || this.options.credentials || "same-origin",
             headers: {
                 Accept: "application/json",
-                ...(this.options.token
-                    ? { Authorization: `Bearer ${this.options.token}` }
-                    : {}),
+                ...(token ? { Authorization: `Bearer ${token}` } : {}),
                 ...(init.headers || {}),
             },
         });
@@ -643,9 +903,28 @@ export class OpenXiangdaControlPlaneClient {
             throw new ControlPlaneError(response.status, "CONTROL_PLANE_RESPONSE_INVALID", "平台返回的不是有效 JSON");
         }
         if (!response.ok || Number(envelope.code) >= 400) {
-            throw new ControlPlaneError(response.status, envelope.errorCode || "CONTROL_PLANE_REQUEST_FAILED", envelope.message || `平台请求失败: ${response.status}`, envelope.data);
+            const status = response.ok ? Number(envelope.code) : response.status;
+            throw new ControlPlaneError(status, envelope.errorCode || "CONTROL_PLANE_REQUEST_FAILED", envelope.message || `平台请求失败: ${response.status}`, envelope.data, {
+                ...(envelope.retryable === undefined
+                    ? {}
+                    : { retryable: envelope.retryable }),
+                ...(envelope.remediation
+                    ? { remediation: envelope.remediation }
+                    : {}),
+                ...(envelope.requestId ? { requestId: envelope.requestId } : {}),
+                ...(envelope.path ? { path: envelope.path } : {}),
+                ...(envelope.field ? { field: envelope.field } : {}),
+            });
         }
         return envelope.data;
     }
+    isUnauthorized(error) {
+        return error instanceof ControlPlaneError && error.status === 401;
+    }
+    async accessToken(forceRefresh) {
+        return this.options.tokenProvider
+            ? await this.options.tokenProvider.getAccessToken({ forceRefresh })
+            : this.options.token;
+    }
 }
 //# sourceMappingURL=control-plane-client.js.map