@superblocksteam/gateway 2.0.0-SNAPSHOT.1d4c72c0ab174c21

package/dist/server/client.js

@@ -0,0 +1,684 @@
+import { uploadAttachmentToServerApi } from "@superblocksteam/shared";
+import { recordIdentityReadOutcome } from "../telemetry/metrics.js";
+import { withGuardedIdentityReads, } from "./identity-reads.js";
+const MAX_DETAIL_LENGTH = 300;
+/**
+ * Pulls the server's own explanation out of an error body.
+ *
+ * Bounded because the body is attacker-influenced in principle and ends up in
+ * logs and in tool output the caller sees.
+ */
+function detailSuffix(body) {
+    if (!body.trim()) {
+        return "";
+    }
+    let detail = body;
+    try {
+        const parsed = JSON.parse(body);
+        if (parsed && typeof parsed === "object") {
+            const record = parsed;
+            const message = record.responseMeta?.message ?? record.message ?? record.error;
+            if (typeof message === "string" && message.trim()) {
+                detail = message;
+            }
+        }
+    }
+    catch {
+        // Not JSON — fall back to the raw body.
+    }
+    const trimmed = detail.trim().slice(0, MAX_DETAIL_LENGTH);
+    return ` — ${trimmed}`;
+}
+export class ServerHttpError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "ServerHttpError";
+    }
+}
+/**
+ * Generous enough for a sandbox start.
+ *
+ * It is not short enough to keep a tool call from hanging, which is what this
+ * used to claim: a tool call waits on the identity read, and that one is bounded
+ * by {@link DEFAULT_IDENTITY_TIMEOUT_MS} instead.
+ */
+const DEFAULT_TIMEOUT_MS = 120_000;
+/**
+ * The identity read gets its own, much tighter bound.
+ *
+ * {@link DEFAULT_TIMEOUT_MS} is sized for starting a sandbox. Nothing waits on
+ * that; every tool call waits on `/users/me`. Giving the two the same budget is
+ * what let a single wedged route hold each call for two minutes.
+ *
+ * Still well above the ~10s a caller waits (see
+ * {@link withGuardedIdentityReads}) so that an endpoint which answers slowly
+ * rather than never can still finish and fill the cache.
+ */
+const DEFAULT_IDENTITY_TIMEOUT_MS = 30_000;
+/**
+ * Whether a failed identity read means the endpoint is unhealthy rather than
+ * that this one credential is bad.
+ *
+ * A 4xx is a definite answer about a single caller, so it must not trip the
+ * breaker and start failing everyone else fast. A 5xx, a timeout or a
+ * transport error says nothing about the credential and everything about the
+ * route.
+ *
+ * 429 is the exception on the 4xx side: a shared rate limit is a statement
+ * about the route's capacity, not about this credential, and it is exactly the
+ * case where hammering on is worst. Treating it as the caller's fault left it
+ * neither retried (only >= 500 is) nor able to open the breaker, so every call
+ * kept going straight at an endpoint already asking for less load.
+ */
+function identityEndpointUnhealthy(error) {
+    return !(error instanceof ServerHttpError &&
+        error.status < 500 &&
+        error.status !== 429);
+}
+/**
+ * Extra attempts for reads that failed with a server-side error.
+ *
+ * Only GETs are retried: they carry no side effects, so a repeat is free. A
+ * failed POST may well have taken effect, and re-sending one can deploy or
+ * commit twice.
+ */
+const READ_RETRY_ATTEMPTS = 2;
+const READ_RETRY_BASE_DELAY_MS = 100;
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+const DEPLOY_STATUSES = [
+    "awaiting_ack",
+    "deployed",
+    "failed",
+    "queued",
+];
+function isDeployStatus(value) {
+    return DEPLOY_STATUSES.includes(value);
+}
+/**
+ * SABS's build status as this client's own vocabulary.
+ *
+ * It answers with `BUILD_STATUS_*` strings through the server, and with the
+ * matching protobuf ordinals when the response is not re-serialized on the way
+ * — the editor's own client normalizes both, and so does this.
+ */
+const BUILD_PROGRESS_BY_ORDINAL = {
+    0: "none",
+    1: "running",
+    2: "success",
+    3: "failed",
+    4: "timed_out",
+};
+const BUILD_PROGRESS_BY_NAME = {
+    FAILED: "failed",
+    RUNNING: "running",
+    SUCCESS: "success",
+    TIMED_OUT: "timed_out",
+    UNSPECIFIED: "none",
+};
+function buildProgress(status) {
+    if (typeof status === "number") {
+        return BUILD_PROGRESS_BY_ORDINAL[status] ?? "none";
+    }
+    if (typeof status !== "string") {
+        return "none";
+    }
+    const name = status
+        .trim()
+        .toUpperCase()
+        .replace(/^BUILD_STATUS_/, "");
+    return BUILD_PROGRESS_BY_NAME[name] ?? "none";
+}
+function liveEditStatus(status) {
+    const normalized = String(status)
+        .replace(/^LIVE_EDIT_STATUS_/, "")
+        .toUpperCase();
+    switch (normalized) {
+        case "1":
+        case "STARTING":
+            return "starting";
+        case "2":
+        case "ACTIVE":
+            return "active";
+        case "3":
+        case "TERMINATED":
+            return "terminated";
+        case "5":
+        case "TERMINATING":
+            return "terminating";
+        default:
+            return "unknown";
+    }
+}
+export class HttpSuperblocksServerClient {
+    identityTimeoutMs;
+    readIdentity;
+    serverUrl;
+    timeoutMs;
+    constructor(serverUrl, options = {}) {
+        this.serverUrl = serverUrl;
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.identityTimeoutMs =
+            options.identityTimeoutMs ?? DEFAULT_IDENTITY_TIMEOUT_MS;
+        this.readIdentity = withGuardedIdentityReads((apiKey) => this.readIdentityFromServer(apiKey), {
+            onOutcome: recordIdentityReadOutcome,
+            opensBreaker: identityEndpointUnhealthy,
+            ...options.identityReads,
+        });
+    }
+    baseUrl() {
+        return this.serverUrl.replace(/\/$/, "");
+    }
+    /**
+     * Unwraps the Superblocks `ResponseDto` envelope.
+     *
+     * Every v1/v2/v3 route the gateway calls replies with
+     * `{ responseMeta, data }`. Reading the body directly yields `undefined` for
+     * every field, which is indistinguishable from a legitimately empty response
+     * — so this is deliberately strict rather than falling back to the raw body.
+     */
+    async requestData(path, init) {
+        const body = await this.request(path, init);
+        if (body?.data === undefined) {
+            throw new Error(`Server ${path} returned no data field; expected a { responseMeta, data } envelope`);
+        }
+        return body.data;
+    }
+    /**
+     * Issues the request, retrying a transient status when the verb makes that
+     * safe.
+     *
+     * A transient failure on the identity lookup used to fail the whole tool call
+     * and leave the caller guessing whether their account was broken.
+     *
+     * 429 counts as transient alongside 5xx: it is the route reporting its own
+     * capacity, and backing off is the whole point of it.
+     */
+    async request(path, init) {
+        const retryable = init.retry !== false && (init.method ?? "GET").toUpperCase() === "GET";
+        let lastError;
+        for (let attempt = 0; attempt <= (retryable ? READ_RETRY_ATTEMPTS : 0);) {
+            try {
+                return await this.send(path, init);
+            }
+            catch (error) {
+                lastError = error;
+                const transient = error instanceof ServerHttpError &&
+                    (error.status >= 500 || error.status === 429);
+                attempt += 1;
+                if (!retryable || !transient || attempt > READ_RETRY_ATTEMPTS) {
+                    throw error;
+                }
+                await delay(READ_RETRY_BASE_DELAY_MS * attempt);
+            }
+        }
+        throw lastError;
+    }
+    async send(path, init) {
+        const { apiKey, headers: callerHeaders, retry: _retry, signal: callerSignal, timeoutMs, ...rest } = init;
+        const bound = timeoutMs ?? this.timeoutMs;
+        const mergedHeaders = new Headers(callerHeaders);
+        // Auth and content-type are owned by this client — never override from callers.
+        mergedHeaders.set("Authorization", `Bearer ${apiKey}`);
+        if (!mergedHeaders.has("Content-Type")) {
+            mergedHeaders.set("Content-Type", "application/json");
+        }
+        const timeoutSignal = AbortSignal.timeout(bound);
+        let response;
+        try {
+            response = await fetch(`${this.baseUrl()}${path}`, {
+                ...rest,
+                headers: mergedHeaders,
+                signal: callerSignal
+                    ? AbortSignal.any([callerSignal, timeoutSignal])
+                    : timeoutSignal,
+            });
+        }
+        catch (error) {
+            if (timeoutSignal.aborted &&
+                error instanceof Error &&
+                error.name === "TimeoutError") {
+                throw new Error(`Server ${path} timed out after ${bound}ms`);
+            }
+            throw error;
+        }
+        if (!response.ok) {
+            throw new ServerHttpError(`Server ${path} failed: ${response.status}${detailSuffix(await response.text().catch(() => ""))}`, response.status);
+        }
+        return (await response.json());
+    }
+    /**
+     * The Superblocks user behind a downstream credential.
+     *
+     * Cached, collapsed, deadlined and circuit-broken: this is the first thing
+     * every MCP tool call does, so reading it straight through coupled the whole
+     * tool surface to the health of one route.
+     */
+    async validateApiKey(apiKey) {
+        return this.readIdentity(apiKey);
+    }
+    /** The unguarded read behind {@link validateApiKey}. */
+    async readIdentityFromServer(apiKey) {
+        try {
+            const data = await this.requestData("/api/v1/users/me", {
+                apiKey,
+                method: "GET",
+                timeoutMs: this.identityTimeoutMs,
+            });
+            const user = data.user;
+            const organizationId = user?.currentOrganizationId ?? data.organizations?.[0]?.id;
+            if (!user || !organizationId) {
+                return undefined;
+            }
+            return {
+                email: user.email,
+                organizationId,
+                userId: user.id,
+            };
+        }
+        catch (error) {
+            // Auth failures → undefined (caller elicits login). Transport errors rethrow.
+            if (error instanceof ServerHttpError && error.status === 401) {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    async getAgentInventory(input) {
+        const data = await this.requestData("/api/v1/users/me", {
+            apiKey: input.apiKey,
+            method: "GET",
+            // Same route, so the same bound. This one runs on the build path rather
+            // than per tool call, and left at the sandbox timeout a wedged
+            // /users/me held a start_app open for two minutes here instead.
+            timeoutMs: this.identityTimeoutMs,
+        });
+        const organization = data.organizations?.find((org) => org.id === input.organizationId) ??
+            data.organizations?.find((org) => org.id === data.user?.currentOrganizationId) ??
+            data.organizations?.[0];
+        if (organization?.agentType === undefined) {
+            throw new Error(`Server /api/v1/users/me returned no agentType for organization ${input.organizationId}`);
+        }
+        const agents = [];
+        for (const raw of data.agents ?? []) {
+            if (typeof raw.url !== "string" ||
+                !raw.url ||
+                typeof raw.type !== "number" ||
+                typeof raw.status !== "string") {
+                continue;
+            }
+            agents.push({
+                status: raw.status,
+                tags: raw.tags ?? {},
+                type: raw.type,
+                url: raw.url,
+            });
+        }
+        return {
+            agentType: organization.agentType,
+            agents,
+        };
+    }
+    async createApplication(input) {
+        return this.requestData("/api/v2/applications/", {
+            apiKey: input.apiKey,
+            // Live edit only attaches to code-mode apps; without this the server
+            // builds a legacy DSL app and `connect` rejects it.
+            body: JSON.stringify({
+                createUsingReact: true,
+                name: input.name,
+                organizationId: input.organizationId,
+                ...(input.templateName ? { templateName: input.templateName } : {}),
+            }),
+            method: "POST",
+            ...(input.signal ? { signal: input.signal } : {}),
+            ...(input.timeoutMs === undefined
+                ? {}
+                : { timeoutMs: input.timeoutMs }),
+        });
+    }
+    async uploadAttachment(input) {
+        const mimeType = input.mimeType ?? "application/zip";
+        // Multipart must not go through {@link send}: that helper forces
+        // application/json and would break the boundary.
+        const response = await uploadAttachmentToServerApi({
+            applicationId: input.applicationId,
+            authorization: `Bearer ${input.apiKey}`,
+            baseUrl: this.baseUrl(),
+            descriptor: {
+                blob: new Blob([Buffer.from(input.bytes)], { type: mimeType }),
+                fileName: input.fileName,
+                mimeType,
+            },
+            prefix: "message-attachment",
+            purpose: "attachment",
+            scopeType: input.applicationId?.trim() ? "app" : "org",
+        });
+        return {
+            applicationId: response.applicationId,
+            attachmentId: response.attachmentId,
+            contentUrl: response.contentUrl,
+            fileName: response.fileName,
+            mimeType: response.mimeType,
+            signedUrl: response.signedUrl,
+            signedUrlExpiresAt: response.signedUrlExpiresAt,
+            storageKey: response.storageKey,
+        };
+    }
+    async connectLiveEdit(input) {
+        const deadlineAtMs = Date.now() + this.timeoutMs;
+        const branchSegment = input.branch
+            ? `/branches/${encodeURIComponent(input.branch)}`
+            : "";
+        const path = `/api/v3/applications/${input.applicationId}${branchSegment}/connect`;
+        let liveEditId = "session";
+        const deadlineError = () => new Error(`Live edit ${liveEditId} did not become active within ${this.timeoutMs}ms`);
+        const requestBeforeDeadline = async (query) => {
+            if (Date.now() >= deadlineAtMs) {
+                throw deadlineError();
+            }
+            try {
+                return await this.requestData(`${path}${query}`, {
+                    apiKey: input.apiKey,
+                    method: "GET",
+                    retry: false,
+                    timeoutMs: Math.max(1, deadlineAtMs - Date.now()),
+                });
+            }
+            catch (error) {
+                if (Date.now() >= deadlineAtMs) {
+                    throw deadlineError();
+                }
+                throw error;
+            }
+        };
+        let data = await requestBeforeDeadline("?returnBeforeReady=true");
+        let polled = false;
+        for (;;) {
+            const session = data.sandboxStartData;
+            if (!session) {
+                // Absent for a LOCAL lock — there is no remote sandbox to drive.
+                throw new Error("Server returned no live edit session for this application");
+            }
+            liveEditId = session.sandboxId || liveEditId;
+            const status = liveEditStatus(session.status);
+            if (session.pitcherURL &&
+                (session.status === undefined || status === "active")) {
+                return {
+                    liveEditId: session.sandboxId,
+                    liveEditUrl: session.pitcherURL,
+                    pitcherToken: session.pitcherToken,
+                    pitcherURL: session.pitcherURL,
+                };
+            }
+            if (status !== "starting") {
+                throw new Error(`Live edit ${session.sandboxId || "session"} is not connectable (${status})`);
+            }
+            if (polled) {
+                await delay(Math.min(1_000, Math.max(0, deadlineAtMs - Date.now())));
+            }
+            if (Date.now() >= deadlineAtMs) {
+                throw deadlineError();
+            }
+            polled = true;
+            data = await requestBeforeDeadline(`?liveEditId=${encodeURIComponent(session.sandboxId)}`);
+        }
+    }
+    async getLiveEditStatus(input) {
+        const branchSegment = input.branch
+            ? `/branches/${encodeURIComponent(input.branch)}`
+            : "";
+        const path = `/api/v3/applications/${input.applicationId}${branchSegment}/connect?liveEditId=${encodeURIComponent(input.liveEditId)}`;
+        try {
+            const data = await this.requestData(path, {
+                apiKey: input.apiKey,
+                method: "GET",
+                retry: false,
+                signal: input.signal,
+            });
+            if (data.sandboxStartData?.sandboxId !== input.liveEditId) {
+                return "unknown";
+            }
+            return liveEditStatus(data.sandboxStartData.status);
+        }
+        catch (error) {
+            if (error instanceof ServerHttpError && error.status === 404) {
+                // This route also returns 404 for an expired or mismatched editor lock
+                // before it queries SABS, so 404 does not prove the live edit is gone.
+                return "unknown";
+            }
+            throw error;
+        }
+    }
+    /**
+     * Mints an application-scoped credential. Connect's `pitcherToken` is a
+     * placeholder in the local sandbox path, so live-edit callers mint their
+     * own token here too.
+     */
+    async issueScopedToken(input) {
+        // Alone among the routes here, this one answers with a bare OAuth-shaped
+        // body rather than the `{ responseMeta, data }` envelope.
+        const scope = input.scope ?? "apps:update";
+        const body = { scope };
+        if (scope === "integrations:build") {
+            if (!input.integrationId?.trim()) {
+                throw new Error("integrations:build scoped tokens require an integrationId; the token authorizes exactly one integration");
+            }
+            body.integrationId = input.integrationId;
+        }
+        else {
+            if (!input.applicationId?.trim()) {
+                throw new Error(`${scope} scoped tokens require an applicationId`);
+            }
+            body.applicationId = input.applicationId;
+        }
+        if (scope === "apps:preview") {
+            if (!input.commitId?.trim()) {
+                throw new Error("apps:preview scoped tokens require a commitId so the viewer can load that commit");
+            }
+            body.commitId = input.commitId;
+        }
+        const data = await this.request("/api/v1/token/scoped", {
+            apiKey: input.apiKey,
+            body: JSON.stringify(body),
+            method: "POST",
+        });
+        if (!data?.access_token) {
+            throw new Error("Server /api/v1/token/scoped returned no access_token; the live-edit session has nothing to verify");
+        }
+        return data.access_token;
+    }
+    async getSupersetIntegrations(input) {
+        const params = new URLSearchParams({
+            // The endpoint rejects a request without `kind` (400 "Kind must be
+            // provided."); PLUGIN is what the editor asks for when it builds the
+            // integration list Clark sees.
+            kind: "PLUGIN",
+            organizationId: input.organizationId,
+        });
+        if (input.applicationId) {
+            params.set("applicationId", input.applicationId);
+        }
+        const data = await this.requestData(`/api/v1/integrations/superset?${params.toString()}`, { apiKey: input.apiKey, method: "GET" });
+        return Array.isArray(data) ? data : [];
+    }
+    async getIntegration(input) {
+        try {
+            return await this.requestData(`/api/v1/integrations/${encodeURIComponent(input.integrationId)}`, { apiKey: input.apiKey, method: "GET" });
+        }
+        catch (error) {
+            if (error instanceof ServerHttpError && error.status === 404) {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    async getOrganizationProfiles(input) {
+        const data = await this.requestData(`/api/v1/organizations/${encodeURIComponent(input.organizationId)}/profiles`, { apiKey: input.apiKey, method: "GET" });
+        if (!Array.isArray(data)) {
+            return [];
+        }
+        return data
+            .filter((row) => typeof row?.key === "string" && row.key.length > 0)
+            .map((row) => ({
+            ...(row.allowedInEditor !== undefined
+                ? { allowedInEditor: row.allowedInEditor }
+                : {}),
+            ...(row.displayName ? { displayName: row.displayName } : {}),
+            ...(row.id ? { id: row.id } : {}),
+            key: row.key,
+        }));
+    }
+    /**
+     * Snapshots the application's current live-edit state as a commit.
+     *
+     * Deploys address a commit, never a branch head, so anything publishing work
+     * that has not been committed yet has to make one first — the same thing the
+     * editor's publish flow does.
+     */
+    async createCommit(input) {
+        const branchSegment = input.branch
+            ? `/branches/${encodeURIComponent(input.branch)}`
+            : "";
+        const data = await this.requestData(`/api/v2/applications/${input.applicationId}${branchSegment}/commit`, {
+            apiKey: input.apiKey,
+            body: JSON.stringify({
+                commitMessage: input.message,
+                // The server compares this against the last live-edit write to catch
+                // a commit racing an editor that has moved on since.
+                lastSuccessfulWrite: Date.now(),
+            }),
+            method: "POST",
+            ...(input.signal ? { signal: input.signal } : {}),
+            ...(input.timeoutMs !== undefined ? { timeoutMs: input.timeoutMs } : {}),
+        });
+        return {
+            commitId: data.commitId,
+            ...(data.directoryContentsHash
+                ? { directoryHash: data.directoryContentsHash }
+                : {}),
+        };
+    }
+    /**
+     * Starts a SABS build of a commit's content, the same call the editor makes
+     * behind Preview and behind a publish.
+     *
+     * The response carries a build id this caller has no use for: progress is
+     * observed by content hash, which is also how a preview and a publish of the
+     * same content end up watching one build instead of racing two.
+     */
+    async createBuild(input) {
+        await this.request(`/api/v3/applications/${input.applicationId}/${encodeURIComponent(input.directoryHash)}/builds`, {
+            apiKey: input.apiKey,
+            body: JSON.stringify({ commitId: input.commitId }),
+            method: "POST",
+        });
+    }
+    async getBuildProgress(input) {
+        const path = `/api/v3/applications/${input.applicationId}/build-bulk-status`;
+        // POST because the hashes go in the body, but it is a read: the server
+        // asks SABS for status and changes nothing.
+        const data = await this.requestData(path, {
+            apiKey: input.apiKey,
+            body: JSON.stringify({ directoryHashes: [input.directoryHash] }),
+            method: "POST",
+        });
+        // Absent for content SABS has never built. Same meaning as UNSPECIFIED:
+        // there is no build to wait for.
+        return buildProgress(data.directoryHashToStatus?.[input.directoryHash]?.status);
+    }
+    async deployApplication(input) {
+        const path = `/api/v2/applications/${input.applicationId}/deployments`;
+        const body = await this.request(path, {
+            apiKey: input.apiKey,
+            // PostApplicationDeployRequestBody rejects unknown properties, so this
+            // body carries the commit and nothing else — the branch is already
+            // fixed by the commit being deployed.
+            body: JSON.stringify({ commitId: input.commitId }),
+            method: "POST",
+            ...(input.signal ? { signal: input.signal } : {}),
+            ...(input.timeoutMs !== undefined ? { timeoutMs: input.timeoutMs } : {}),
+        });
+        if (body?.data?.deploymentId) {
+            return { deploymentId: body.data.deploymentId, status: "deployed" };
+        }
+        if (isDeployStatus(body?.status)) {
+            return { message: body?.message, status: body.status };
+        }
+        // Neither shape. Guessing "it worked" here would report a publish that
+        // never happened as a success.
+        throw new Error(`Server ${path} returned neither a deployment nor a deploy status`);
+    }
+    /**
+     * Polls the deploy queue for a commit the UI watches after a queued publish.
+     */
+    async getDeployStatus(input) {
+        const path = `/api/v2/applications/${input.applicationId}/deploy-status/${encodeURIComponent(input.commitId)}`;
+        const body = await this.request(path, {
+            apiKey: input.apiKey,
+            method: "GET",
+            retry: false,
+            ...(input.signal ? { signal: input.signal } : {}),
+            ...(input.timeoutMs !== undefined ? { timeoutMs: input.timeoutMs } : {}),
+        });
+        const status = body?.status;
+        if (status === "none" ||
+            status === "QUEUED" ||
+            status === "DEPLOYING" ||
+            status === "DEPLOYED" ||
+            status === "FAILED" ||
+            status === "AWAITING_ACK") {
+            return {
+                error: typeof body?.error === "string" ? body.error : undefined,
+                isLive: typeof body?.isLive === "boolean" ? body.isLive : undefined,
+                status,
+            };
+        }
+        throw new Error(`Server ${path} returned an unknown deploy status`);
+    }
+    /**
+     * Asks Clark for an app name, the same way the editor header does after a
+     * prompt-created app loads.
+     */
+    async generateAppName(input) {
+        // Another bare body rather than the `{ responseMeta, data }` envelope.
+        const data = await this.request("/api/v1/ai/generate-app-name", {
+            apiKey: input.apiKey,
+            body: JSON.stringify({
+                applicationId: input.applicationId,
+                prompt: input.prompt,
+            }),
+            method: "POST",
+        });
+        if (!data?.name?.trim()) {
+            throw new Error("Server /api/v1/ai/generate-app-name returned no name");
+        }
+        return data.name.trim();
+    }
+    /**
+     * Looks a name up in the org-wide application listing.
+     *
+     * The API exposes no single-application GET that carries a name — only this
+     * listing and the metadata PUT — so one label costs a list read. That is
+     * affordable where it is used (alongside a build and a screenshot) and is
+     * why nothing on a hot path should call it.
+     */
+    async getApplicationName(input) {
+        const body = await this.request("/api/v2/applications", { apiKey: input.apiKey, method: "GET" });
+        const found = body?.data?.applications?.find((application) => application?.id === input.applicationId);
+        return found?.name?.trim() || undefined;
+    }
+    async renameApplication(input) {
+        await this.request(`/api/v2/applications/${input.applicationId}/metadata`, {
+            apiKey: input.apiKey,
+            // PutApplicationMetadataUpdateRequestBody accepts exactly one of name,
+            // folderId, or isPublic — sending more than one fails validation.
+            body: JSON.stringify({ name: input.name }),
+            method: "PUT",
+        });
+    }
+}
+//# sourceMappingURL=client.js.map