feat(code-governance): add closePR method for PR cleanup (#44)

* feat(code-governance): add closePR method for PR cleanup

- Add closePR() method to close PRs without merging
- Optional deleteBranch parameter to also remove source branch
- Add closedAt field to PRRecord type
- Update tests for new constructor parameter

Enterprise feature requiring portal authentication.

* chore: update version to 2.2.0

* fix(planning): correct getPlanStatus endpoint path

Fixed endpoint path from /api/v1/orchestrator/plan/{id} to /api/v1/plan/{id}
to match agent proxy routes.

* feat(auth): standardize OAuth2 Basic authentication across SDK

- Update addAuthHeaders() to use OAuth2 Basic auth format
- Uses Authorization: Basic base64(clientId:clientSecret) header
- Remove non-standard X-Client-ID and X-Client-Secret headers
- X-License-Key retained as fallback for backward compatibility
- Add comprehensive tests for OAuth2 Basic auth
- Update CHANGELOG with authentication changes

* BREAKING: Remove licenseKey, use only OAuth2 Basic auth (v3.0.0)

- Remove licenseKey field from AxonFlowConfig
- Remove X-License-Key header support
- Simplify addAuthHeaders() to only use OAuth2 Basic auth
- Update all tests to check for Authorization: Basic header
- Update javadoc examples to use clientId/clientSecret
- Update README and CHANGELOG with breaking changes

Breaking Changes:
- licenseKey config option removed
- X-License-Key header no longer sent
- clientId and clientSecret are now required for enterprise features

* docs: Update README with v3.0.0 version and OAuth2 env vars

- Update version to 3.0.0 in Maven and Gradle examples
- Replace AXONFLOW_LICENSE_KEY with CLIENT_ID/CLIENT_SECRET env vars
- Update error handling comment to reference credentials

* fix(auth): make clientSecret optional for community mode

clientId is now the only required credential for features requiring auth.
clientSecret remains optional for community/self-hosted deployments
but is still validated server-side for enterprise mode.

Part of OAuth2 migration - PR #948

* feat(gateway): default empty userToken to 'anonymous'

In community mode without OAuth2, userToken is used for audit/tracking
purposes only. If null or empty, SDK now defaults to 'anonymous' so
callers don't need to handle the fallback themselves.

- Added default handling in ClientRequest constructor

* docs: refine changelog to v2.2.0 (non-breaking release)

- OAuth2-style auth is additive, not breaking (clientId/clientSecret optional)
- Removes breaking change framing for minor version bump

* fix: correct README version to 2.2.0

Author: saurabhjain1592

CHANGELOG.md

@@ -5,6 +5,40 @@ All notable changes to the AxonFlow Java SDK will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.2.0] - 2026-01-08
+
+### Added
+
+- **OAuth2-style client credentials**: New `clientId()` and `clientSecret()` builder methods following OAuth2 client credentials pattern.
+  - `clientId` is used for request identification (required for most API calls)
+  - `clientSecret` is optional - community/self-hosted deployments work without it
+
+- **Enterprise: Close PR** (`closePR`): Close a PR without merging and optionally delete the branch
+  - Useful for cleaning up test/demo PRs created by code governance examples
+  - Supports all Git providers: GitHub, GitLab, Bitbucket
+  - Requires enterprise portal authentication
+
+### Changed
+
+- **Simplified authentication**: For community mode, simply provide `clientId` for request identification. No `clientSecret` needed.
+
+```java
+// Community mode - no secret needed
+AxonFlowClient client = AxonFlowClient.builder()
+    .endpoint("http://localhost:8080")
+    .clientId("my-app")  // Used for request identification
+    .build();
+```
+
+### Fixed
+
+- **getPlanStatus endpoint**: Fixed endpoint path from `/api/v1/orchestrator/plan/{id}` to `/api/v1/plan/{id}` to match agent proxy routes
+
+### Enterprise
+
+- OAuth2 Basic auth: `Authorization: Basic base64(clientId:clientSecret)` replaces `X-License-Key` header
+- Removed `licenseKey()` builder method (use `clientId()`/`clientSecret()`)
+
 ## [2.1.2] - 2026-01-07
 
 ### Fixed

README.md

@@ -19,14 +19,14 @@ Official Java SDK for [AxonFlow](https://getaxonflow.com) - AI Governance Platfo
 <dependency>
     <groupId>com.getaxonflow</groupId>
     <artifactId>axonflow-sdk</artifactId>
-    <version>1.0.0</version>
+    <version>2.2.0</version>
 </dependency>
 ```
 
 ### Gradle
 
 ```groovy
-implementation 'com.getaxonflow:axonflow-sdk:1.0.0'
+implementation 'com.getaxonflow:axonflow-sdk:3.0.0'
 ```
 
 ## Quick Start
@@ -45,7 +45,8 @@ public class GatewayExample {
         // Initialize client
         AxonFlow client = AxonFlow.create(AxonFlowConfig.builder()
             .endpoint("https://agent.getaxonflow.com")
-            .licenseKey("your-license-key")
+            .clientId("your-client-id")
+            .clientSecret("your-client-secret")
             .build());
 
         // Step 1: Pre-check the request
@@ -99,7 +100,8 @@ public class ProxyExample {
     public static void main(String[] args) {
         AxonFlow client = AxonFlow.create(AxonFlowConfig.builder()
             .endpoint("https://agent.getaxonflow.com")
-            .licenseKey("your-license-key")
+            .clientId("your-client-id")
+            .clientSecret("your-client-secret")
             .build());
 
         ClientResponse response = client.executeQuery(
@@ -126,7 +128,8 @@ public class ProxyExample {
 ```java
 AxonFlowConfig config = AxonFlowConfig.builder()
     .endpoint("https://agent.getaxonflow.com")  // Required
-    .licenseKey("your-license-key")             // Required for cloud
+    .clientId("your-client-id")
+            .clientSecret("your-client-secret")             // Required for cloud
     .timeout(Duration.ofSeconds(30))            // Default: 60s
     .debug(true)                                // Enable request logging
     .insecureSkipVerify(false)                  // SSL verification (default: false)
@@ -142,7 +145,8 @@ The SDK supports configuration via environment variables:
 | Variable | Description |
 |----------|-------------|
 | `AXONFLOW_AGENT_URL` | AxonFlow agent URL |
-| `AXONFLOW_LICENSE_KEY` | License key for authentication |
+| `AXONFLOW_CLIENT_ID` | OAuth2 client ID for authentication |
+| `AXONFLOW_CLIENT_SECRET` | OAuth2 client secret for authentication |
 | `AXONFLOW_DEBUG` | Enable debug logging (`true`/`false`) |
 
 ## API Reference
@@ -216,7 +220,7 @@ The SDK provides typed exceptions for different error scenarios:
 try {
     PolicyApproval approval = client.getPolicyApprovedContext(request);
 } catch (AxonFlowAuthenticationException e) {
-    // Invalid or missing license key
+    // Invalid or missing credentials
     System.err.println("Authentication failed: " + e.getMessage());
 } catch (AxonFlowRateLimitException e) {
     // Rate limit exceeded
@@ -240,7 +244,8 @@ The SDK includes automatic retry with exponential backoff:
 ```java
 AxonFlowConfig config = AxonFlowConfig.builder()
     .endpoint("https://agent.getaxonflow.com")
-    .licenseKey("your-license-key")
+    .clientId("your-client-id")
+            .clientSecret("your-client-secret")
     .retryConfig(RetryConfig.builder()
         .maxAttempts(3)
         .initialDelayMs(100)
@@ -258,7 +263,8 @@ Enable caching for repeated policy checks:
 ```java
 AxonFlowConfig config = AxonFlowConfig.builder()
     .endpoint("https://agent.getaxonflow.com")
-    .licenseKey("your-license-key")
+    .clientId("your-client-id")
+            .clientSecret("your-client-secret")
     .cacheEnabled(true)
     .cacheTtl(Duration.ofMinutes(5))
     .cacheMaxSize(1000)
@@ -279,7 +285,8 @@ import com.getaxonflow.sdk.interceptors.*;
 // Initialize AxonFlow client
 AxonFlow axonflow = AxonFlow.create(AxonFlowConfig.builder()
     .endpoint("https://agent.getaxonflow.com")
-    .licenseKey("your-license-key")
+    .clientId("your-client-id")
+            .clientSecret("your-client-secret")
     .build());
 
 // Create interceptor

pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>com.getaxonflow</groupId>
     <artifactId>axonflow-sdk</artifactId>
-    <version>2.1.2</version>
+    <version>2.2.0</version>
     <packaging>jar</packaging>
 
     <name>AxonFlow Java SDK</name>

src/main/java/com/getaxonflow/sdk/AxonFlow.java

@@ -36,7 +36,9 @@
 import java.io.Closeable;
 import java.io.IOException;
 import java.net.URI;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
+import java.util.Base64;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
@@ -723,7 +725,7 @@ public PlanResponse getPlanStatus(String planId) {
 
         return retryExecutor.execute(() -> {
             Request httpRequest = buildRequest("GET",
-                "/api/v1/orchestrator/plan/" + planId, null);
+                "/api/v1/plan/" + planId, null);
             try (Response response = httpClient.newCall(httpRequest).execute()) {
                 return parseResponse(response, PlanResponse.class);
             }
@@ -886,11 +888,7 @@ public ConnectorResponse queryConnector(ConnectorQuery query) {
                 context.put("params", query.getParameters());
             }
 
-            // Determine clientId: prefer config.getClientId(), fallback to license key
             String clientId = config.getClientId();
-            if (clientId == null || clientId.isEmpty()) {
-                clientId = config.getLicenseKey();
-            }
 
             ClientRequest clientRequest = ClientRequest.builder()
                 .query(query.getOperation())
@@ -1665,29 +1663,24 @@ private void addAuthHeaders(Request.Builder builder) {
             return;
         }
 
-        // Prefer license key
-        if (config.getLicenseKey() != null && !config.getLicenseKey().isEmpty()) {
-            builder.header("X-License-Key", config.getLicenseKey());
-            return;
-        }
-
-        // Fall back to client credentials
-        if (config.getClientId() != null && config.getClientSecret() != null) {
-            builder.header("X-Client-ID", config.getClientId());
-            builder.header("X-Client-Secret", config.getClientSecret());
-        }
+        // OAuth2-style: Authorization: Basic base64(clientId:clientSecret)
+        String credentials = config.getClientId() + ":" + config.getClientSecret();
+        String encoded = Base64.getEncoder().encodeToString(
+            credentials.getBytes(StandardCharsets.UTF_8)
+        );
+        builder.header("Authorization", "Basic " + encoded);
     }
 
     /**
      * Requires credentials for enterprise features.
      *
      * @param feature the feature name for error message
-     * @throws AuthenticationException if no credentials are configured
+     * @throws AuthenticationException if clientId is not configured
      */
     private void requireCredentials(String feature) {
         if (!config.hasCredentials()) {
             throw new AuthenticationException(
-                feature + " requires credentials. Set licenseKey or clientId/clientSecret in config."
+                feature + " requires clientId. Set clientId in config (clientSecret is optional for community mode)."
             );
         }
     }
@@ -2128,6 +2121,36 @@ public PRRecord syncPRStatus(String prId) throws IOException {
         }
     }
 
+    /**
+     * Closes a PR without merging and optionally deletes the branch.
+     * This is an enterprise feature for cleaning up test/demo PRs.
+     * Supports all Git providers: GitHub, GitLab, Bitbucket.
+     *
+     * @param prId the PR record ID to close
+     * @param deleteBranch whether to also delete the source branch
+     * @return the closed PR record
+     * @throws IOException if the request fails
+     */
+    public PRRecord closePR(String prId, boolean deleteBranch) throws IOException {
+        requirePortalLogin();
+        logger.debug("Closing PR: {} (deleteBranch={})", prId, deleteBranch);
+
+        String url = getPortalUrl() + "/api/v1/code-governance/prs/" + prId;
+        if (deleteBranch) {
+            url += "?delete_branch=true";
+        }
+
+        Request.Builder builder = new Request.Builder()
+                .url(url)
+                .delete();
+
+        addPortalSessionCookie(builder);
+
+        try (Response response = httpClient.newCall(builder.build()).execute()) {
+            return parseResponse(response, PRRecord.class);
+        }
+    }
+
     /**
      * Gets aggregated code governance metrics for the tenant.
      *

src/main/java/com/getaxonflow/sdk/AxonFlowConfig.java

@@ -51,7 +51,6 @@ public final class AxonFlowConfig {
     private final String endpoint;
     private final String clientId;
     private final String clientSecret;
-    private final String licenseKey;
     private final Mode mode;
     private final Duration timeout;
     private final boolean debug;
@@ -64,7 +63,6 @@ private AxonFlowConfig(Builder builder) {
         this.endpoint = normalizeUrl(builder.endpoint != null ? builder.endpoint : DEFAULT_ENDPOINT);
         this.clientId = builder.clientId;
         this.clientSecret = builder.clientSecret;
-        this.licenseKey = builder.licenseKey;
         this.mode = builder.mode != null ? builder.mode : Mode.PRODUCTION;
         this.timeout = builder.timeout != null ? builder.timeout : DEFAULT_TIMEOUT;
         this.debug = builder.debug;
@@ -87,13 +85,13 @@ private void validate() {
     /**
      * Checks if credentials are configured.
      *
-     * <p>Returns true if either a license key or client credentials are set.
+     * <p>Returns true if clientId is set.
+     * clientSecret is optional for community mode but required for enterprise.
      *
-     * @return true if credentials are available
+     * @return true if clientId is available
      */
     public boolean hasCredentials() {
-        return (licenseKey != null && !licenseKey.isEmpty()) ||
-               (clientId != null && clientSecret != null && !clientSecret.isEmpty());
+        return clientId != null && !clientId.isEmpty();
     }
 
     private String normalizeUrl(String url) {
@@ -122,7 +120,6 @@ public boolean isLocalhost() {
      *   <li>AXONFLOW_AGENT_URL - The endpoint URL (kept for backwards compatibility)</li>
      *   <li>AXONFLOW_CLIENT_ID - The client ID</li>
      *   <li>AXONFLOW_CLIENT_SECRET - The client secret</li>
-     *   <li>AXONFLOW_LICENSE_KEY - The license key</li>
      *   <li>AXONFLOW_MODE - Operating mode (production/sandbox)</li>
      *   <li>AXONFLOW_TIMEOUT_SECONDS - Request timeout in seconds</li>
      *   <li>AXONFLOW_DEBUG - Enable debug mode (true/false)</li>
@@ -149,11 +146,6 @@ public static AxonFlowConfig fromEnvironment() {
             builder.clientSecret(clientSecret);
         }
 
-        String licenseKey = System.getenv("AXONFLOW_LICENSE_KEY");
-        if (licenseKey != null && !licenseKey.isEmpty()) {
-            builder.licenseKey(licenseKey);
-        }
-
         String modeStr = System.getenv("AXONFLOW_MODE");
         if (modeStr != null && !modeStr.isEmpty()) {
             builder.mode(Mode.fromValue(modeStr));
@@ -188,10 +180,6 @@ public String getClientSecret() {
         return clientSecret;
     }
 
-    public String getLicenseKey() {
-        return licenseKey;
-    }
-
     public Mode getMode() {
         return mode;
     }
@@ -233,13 +221,12 @@ public boolean equals(Object o) {
                insecureSkipVerify == that.insecureSkipVerify &&
                Objects.equals(endpoint, that.endpoint) &&
                Objects.equals(clientId, that.clientId) &&
-               Objects.equals(licenseKey, that.licenseKey) &&
                mode == that.mode;
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(endpoint, clientId, licenseKey, mode, debug, insecureSkipVerify);
+        return Objects.hash(endpoint, clientId, mode, debug, insecureSkipVerify);
     }
 
     @Override
@@ -260,7 +247,6 @@ public static final class Builder {
         private String endpoint;
         private String clientId;
         private String clientSecret;
-        private String licenseKey;
         private Mode mode;
         private Duration timeout;
         private boolean debug;
@@ -321,17 +307,6 @@ public Builder clientSecret(String clientSecret) {
             return this;
         }
 
-        /**
-         * Sets the license key for SaaS authentication.
-         *
-         * @param licenseKey the license key
-         * @return this builder
-         */
-        public Builder licenseKey(String licenseKey) {
-            this.licenseKey = licenseKey;
-            return this;
-        }
-
         /**
          * Sets the operating mode.
          *

src/main/java/com/getaxonflow/sdk/interceptors/AnthropicInterceptor.java

@@ -29,7 +29,7 @@
  * // Create AxonFlow client
  * AxonFlow axonflow = AxonFlow.builder()
  *     .agentUrl("http://localhost:8080")
- *     .licenseKey("your-license-key")
+ *     .clientId("your-client-id").clientSecret("your-client-secret")
  *     .build();
  *
  * // Create interceptor

src/main/java/com/getaxonflow/sdk/interceptors/OpenAIInterceptor.java

@@ -30,8 +30,9 @@
  * <pre>{@code
  * // Create AxonFlow client
  * AxonFlow axonflow = AxonFlow.builder()
- *     .agentUrl("http://localhost:8080")
- *     .licenseKey("your-license-key")
+ *     .endpoint("http://localhost:8080")
+ *     .clientId("your-client-id")
+ *     .clientSecret("your-client-secret")
  *     .build();
  *
  * // Create interceptor

src/main/java/com/getaxonflow/sdk/interceptors/package-info.java

@@ -23,7 +23,7 @@
  * // Create AxonFlow client
  * AxonFlow axonflow = AxonFlow.builder()
  *     .agentUrl("http://localhost:8080")
- *     .licenseKey("your-license-key")
+ *     .clientId("your-client-id").clientSecret("your-client-secret")
  *     .build();
  *
  * // Wrap OpenAI calls