@layervai/qurl 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 LayerV, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,223 @@
+# @layervai/qurl
+
+[![npm](https://img.shields.io/npm/v/@layervai/qurl)](https://www.npmjs.com/package/@layervai/qurl)
+[![CI](https://github.com/layervai/qurl-typescript/actions/workflows/ci.yml/badge.svg)](https://github.com/layervai/qurl-typescript/actions/workflows/ci.yml)
+[![License](https://img.shields.io/github/license/layervai/qurl-typescript)](LICENSE)
+
+TypeScript SDK for the [qURL™ API](https://docs.layerv.ai) — secure, time-limited access links for AI agents.
+
+> **Quantum URL (qURL)** · The internet has a hidden layer. This is how you enter.
+
+## Why qURL?
+
+AI agents need to access protected resources — APIs, databases, internal tools — but giving them permanent credentials is a security risk. qURL creates time-limited, auditable access links that expire automatically. The SDK handles authentication, retries, pagination, and error handling so you can focus on your agent logic.
+
+## Installation
+
+```bash
+npm install @layervai/qurl
+```
+
+Requires Node.js 18+. Both `import { QURLClient } from '@layervai/qurl'` (ESM) and `const { QURLClient } = require('@layervai/qurl')` (CJS) work.
+
+## Quick Start
+
+```typescript
+import { QURLClient } from '@layervai/qurl';
+
+const client = new QURLClient({ apiKey: 'lv_live_xxx' });
+
+// Create a protected link
+const result = await client.create({
+  target_url: 'https://api.example.com/data',
+  expires_in: '24h',
+  label: 'API access for agent',
+});
+console.log(result.qurl_link);
+
+// Resolve a token (grants network access for your IP)
+const access = await client.resolve('at_...');
+console.log(`Access granted to ${access.target_url} for ${access.access_grant?.expires_in}s`);
+```
+
+## API
+
+### `new QURLClient(options)`
+
+| Option | Required | Default |
+|--------|----------|---------|
+| `apiKey` | Yes | — |
+| `baseUrl` | No | `https://api.layerv.ai` |
+| `maxRetries` | No | `3` |
+| `timeout` | No | `30000` (ms) — *per attempt*, not total |
+| `fetch` | No | `globalThis.fetch` |
+| `userAgent` | No | `qurl-typescript/<version>` |
+| `debug` | No | `false` |
+
+### Methods
+
+| Method | Description |
+|--------|-------------|
+| `create(input)` | Create a protected link |
+| `batchCreate(input)` | Create up to 100 protected links in one request |
+| `get(id)` | Get qURL details |
+| `list(input?)` | List qURLs (single page) |
+| `listAll(input?)` | Iterate all qURLs (auto-paginating) |
+| `delete(id)` | Revoke a qURL resource and all its tokens |
+| `extend(id, input)` | Extend expiration |
+| `update(id, input)` | Update qURL resource properties |
+| `mintLink(id, input?)` | Mint a new access link |
+| `resolve(input)` | Resolve token + grant network access |
+| `getQuota()` | Get quota/usage info |
+| `bootstrapAgent(input)` | Bootstrap a qURL Connector agent |
+| `listResources(input?)` / `listAllResources(input?)` / `createResource(input)` / `getResource(id)` | Resource management |
+| `updateResource(id, input)` / `deleteResource(id)` | Update or revoke resources |
+| `createQurlForResource(id, input?)` | Mint a qURL for an existing resource |
+| `updateResourceQurl(id, qurlId, input)` / `revokeResourceQurl(id, qurlId)` | Manage one token on a resource |
+| `listResourceSessions(id)` / `terminateAllResourceSessions(id)` / `terminateResourceSession(id, sessionId)` | Inspect or terminate active sessions |
+| `listConnectorInstallations(input?)` / `listAllConnectorInstallations(input?)` | List connector installations |
+| `getUsageCurrentPeriod()` / `getUsageDaily()` | Usage reporting |
+| `getCustomer()` / `updateCustomer(input)` | Customer settings |
+| `createBillingCheckout(input)` / `createBillingPortal()` / `listBillingInvoices(input?)` / `listAllBillingInvoices(input?)` | Billing flows |
+| `registerDomain(input)` / `listDomains(input?)` / `listAllDomains(input?)` / `getDomain(domain)` | Custom domain management |
+| `verifyDomain(domain)` / `regenerateDomainToken(domain)` / `deleteDomain(domain)` | Domain verification and removal |
+| `listWebhooks(input?)` / `listAllWebhooks(input?)` / `createWebhook(input)` / `getWebhook(id)` | Webhook management |
+| `updateWebhook(id, input)` / `deleteWebhook(id)` / `regenerateWebhookSecret(id)` | Webhook updates and secret rotation |
+| `listWebhookEventTypes()` / `listWebhookDeliveries(id, input?)` / `listAllWebhookDeliveries(id, input?)` | Webhook metadata and delivery history |
+| `createApiKey(input)` / `listApiKeys(input?)` / `listAllApiKeys(input?)` / `updateApiKey(id, input)` / `revokeApiKey(id)` | API key management |
+| `createAccessCode(input)` / `listAccessCodes()` / `redeemAccessCode(input)` / `revokeAccessCode(id)` | Access code management |
+
+`listResourceSessions(id)` and `listAccessCodes()` reflect currently unpaginated service endpoints. Their outputs always return `has_more: false`; if the service starts surfacing cursor metadata, the SDK emits a debug log rather than exposing an unactionable next-page signal.
+
+`listAll*()` methods validate ids and query params when called, before the async iterator is consumed. Wrap the `listAll*()` call itself in `try/catch` when passing dynamic input.
+
+### `batchCreate(input)`
+
+Create up to 100 qURLs in a single request. **Does not throw on partial or total failure** — per-item errors are returned in the `results` array, so `try/catch` alone won't surface them. Always inspect `result.failed` and iterate `result.results`:
+
+```typescript
+const result = await client.batchCreate({
+  items: [
+    { target_url: 'https://api.example.com/data', expires_in: '24h' },
+    { target_url: 'https://api.example.com/admin', expires_in: '1h' },
+  ],
+});
+
+if (result.failed > 0) {
+  for (const r of result.results) {
+    if (!r.success) {
+      console.error(`items[${r.index}]: ${r.error.code} - ${r.error.message}`);
+    }
+  }
+}
+```
+
+Non-400 errors (401, 403, 429, 5xx, and unexpected 400 body shapes) still throw the appropriate `QURLError` subclass.
+
+**Slimmer per-item shape** — `BatchItemSuccess` returns `{ resource_id, qurl_link, qurl_site, expires_at? }` per item. Unlike single `client.create()`, the batch response intentionally **omits `qurl_id` and `label`** to keep the payload compact. If you migrate a per-item `create()` loop to `batchCreate` and rely on `qurl_id` for downstream addressing, fetch each via `client.get(resource_id)` after the batch (or stay on the single-create path).
+
+**Result ordering** — `result.results` is **not** guaranteed to be sorted by `index`. Each entry's `index` field carries the position in the original `items` array, so build per-input-position state by keying on `r.index` (e.g., `for (const r of result.results) { byInputIndex[r.index] = r; }`) rather than relying on iteration order.
+
+**Out-of-range or duplicate `index` values** — the SDK throws `QURLError` (`code: "unexpected_response"`) on either condition, since both indicate server misbehavior that would silently break per-item attribution (a `Map` keyed on `r.index` would last-write-wins, an out-of-range index would attribute to a non-existent slot).
+
+## Error Handling
+
+All API errors throw typed error subclasses, so you can catch specific failure modes:
+
+```typescript
+import {
+  QURLError,
+  AuthenticationError,
+  NotFoundError,
+  RateLimitError,
+  ValidationError,
+} from '@layervai/qurl';
+
+try {
+  await client.create({ target_url: '' });
+} catch (err) {
+  if (err instanceof ValidationError) {
+    console.error('Invalid input:', err.invalidFields);
+  } else if (err instanceof RateLimitError) {
+    console.error(`Rate limited — retry after ${err.retryAfter}s`);
+  } else if (err instanceof AuthenticationError) {
+    console.error('Bad API key');
+  } else if (err instanceof NotFoundError) {
+    console.error('Resource not found');
+  } else if (err instanceof QURLError) {
+    console.error(`API error [${err.code}]: ${err.detail}`);
+  }
+}
+```
+
+| Error Class | HTTP Status | When |
+|-------------|-------------|------|
+| `AuthenticationError` | 401 | Invalid or missing API key |
+| `AuthorizationError` | 403 | Key lacks required scope |
+| `NotFoundError` | 404 | Resource doesn't exist |
+| `ValidationError` | 400, 422 | Invalid request body |
+| `RateLimitError` | 429 | Too many requests |
+| `ServerError` | 5xx | Server-side failure |
+| `NetworkError` | — | Connection failure |
+| `TimeoutError` | — | Request exceeded timeout |
+
+## Pagination
+
+```typescript
+// Single page
+const page = await client.list({ limit: 10, status: 'active' });
+
+// Auto-paginate through all results
+for await (const qurl of client.listAll({ status: 'active' })) {
+  console.log(qurl.resource_id);
+}
+```
+
+## Debug Logging
+
+Enable debug output to see all HTTP requests and retries:
+
+```typescript
+// Log to console
+const client = new QURLClient({ apiKey: 'lv_live_xxx', debug: true });
+
+// Custom logger
+const client = new QURLClient({
+  apiKey: 'lv_live_xxx',
+  debug: (message, data) => myLogger.debug(message, data),
+});
+```
+
+## Retry Behavior
+
+The client automatically retries failed requests with exponential backoff:
+
+- **GET/DELETE**: Retries on 429, 502, 503, 504
+- **POST/PATCH**: Retries status responses only on 429
+- **Network errors**: Always retried; POST/PATCH requests send an `Idempotency-Key` on the first attempt and reuse it on retries
+- **`Retry-After` header**: Honored on 429 and 503 responses (RFC 7231 §7.1.3). Currently the SDK only parses **delta-seconds** values (e.g. `Retry-After: 30`); HTTP-date values (`Retry-After: Wed, 21 Oct 2026 07:28:00 GMT`) silently fall back to exponential backoff. Tracked in [#61](https://github.com/layervai/qurl-typescript/issues/61).
+
+Configure with `maxRetries` (default: 3). Set to `0` to disable.
+
+> **Worst-case latency**: `timeout` is enforced per *attempt*, not for the whole request. Total worst-case latency is roughly `timeout × (maxRetries + 1) + sum(retry delays)`. Operators tuning `timeout` should account for this when sizing health-check budgets.
+
+For POST/PATCH requests, the SDK generates a UUIDv7 `Idempotency-Key` once per logical call and reuses it across SDK-managed retries, so the API can return the original result instead of creating duplicate resources. If your application catches an error and calls the SDK again, pass a stable override so the new call deduplicates with the first one. Caller-provided keys must be non-empty printable ASCII strings of at most 256 characters and must not start or end with spaces. Use a unique key for each logical operation; reusing one key for a different request can return the first cached response. To tie retries to your own upstream job or request ID, pass a per-call override:
+
+```typescript
+await client.create(
+  { target_url: 'https://api.example.com/data' },
+  { idempotencyKey: 'job_12345_create_qurl' },
+);
+```
+
+SDK-generated keys require `globalThis.crypto.getRandomValues`, which is available in supported Node 20+ runtimes and modern edge/browser runtimes. In constrained runtimes without Web Crypto, pass a caller-provided key with `idempotencyKey`; otherwise POST/PATCH calls throw `RuntimeError` before sending a request.
+
+## Versioning & breaking changes
+
+This SDK is pre-1.0; breaking changes between minor versions are possible until the API surface stabilizes. Significant changes are called out in [`CHANGELOG.md`](CHANGELOG.md) and in the corresponding GitHub release notes.
+
+When upgrading, check the release notes for migration guidance — recent breaking changes have included field renames (`description` → `label` on create), removed fields (`metadata`), narrowed type unions (`QURL.status`), and endpoint relocations (`/v1/qurl` → `/v1/qurls`).
+
+## License
+
+MIT

package/dist/cjs/client.d.ts

@@ -0,0 +1,372 @@
+import type { AccessCodeListOutput, AgentBootstrapInput, AgentBootstrapOutput, ApiKey, ApiKeyListOutput, BillingInvoiceListOutput, BatchCreateInput, BatchCreateOutput, ClientOptions, ConnectorInstallation, ConnectorInstallationListOutput, CreateAccessCodeInput, CreateAccessCodeOutput, CreateApiKeyInput, CreateApiKeyOutput, CreateBillingCheckoutInput, CreateInput, CreateOutput, CreateQurlForResourceInput, CreateResourceInput, CreateWebhookInput, Customer, CheckoutSession, Domain, DomainListOutput, DomainVerifyResult, ExtendInput, Invoice, ListInput, ListOutput, ListApiKeysInput, ListBillingInvoicesInput, ListConnectorInstallationsInput, ListDomainsInput, ListWebhookDeliveriesInput, ListWebhooksInput, MintInput, MintOutput, PortalSession, QURL, QurlSummary, Quota, RedeemAccessCodeInput, RedeemAccessCodeOutput, RegisterDomainInput, Resource, ResourceDetail, ResourceListInput, ResourceListOutput, RequestOptions, ResolveInput, ResolveOutput, SessionListOutput, SessionTerminateOutput, UpdateApiKeyInput, UpdateCustomerInput, UpdateInput, UpdateResourceInput, UpdateResourceQurlInput, UpdateWebhookInput, UsageCurrentPeriod, UsageDaily, Webhook, WebhookDelivery, WebhookDeliveryListOutput, WebhookEventTypeInfo, WebhookListOutput, WebhookWithSecret } from "./types.js";
+/** qURL API client. */
+export declare class QURLClient {
+    private readonly baseUrl;
+    private readonly apiKey;
+    private readonly fetchFn;
+    private readonly maxRetries;
+    private readonly timeout;
+    private readonly userAgent;
+    private readonly debugFn;
+    constructor(options: ClientOptions);
+    /** Returns a JSON-safe representation with the API key masked. */
+    toJSON(): {
+        baseUrl: string;
+        apiKey: string;
+    };
+    private maskKey;
+    private log;
+    /**
+     * Map the API's wire-format `qurls` field to the SDK's `access_tokens`.
+     *
+     * Uses `hasOwnProperty.call` (not `if (raw.qurls)`) so empty `qurls: []`
+     * still enters the rename branch — consumers expect `access_tokens: []`,
+     * not `qurls: []` leaking through. `.call` form confines the check to
+     * own-properties; safe even on pre-parsed bodies from arbitrary sources.
+     */
+    private mapQurlsField;
+    /**
+     * Validate the response envelope from POST /v1/qurls/batch and return
+     * the inner {@link BatchCreateOutput}. Throws
+     * {@link unexpectedResponseError} on any shape-guard failure.
+     *
+     * Three layers of defense:
+     *   1. Top-level shape (succeeded/failed are non-negative integers;
+     *      results is an array).
+     *   2. Arithmetic invariants: `succeeded + failed === results.length`
+     *      and `results.length === requestItemCount` (catches silent
+     *      server-side item drops).
+     *   3. Per-entry discriminated-union contract + index range / dedupe.
+     *
+     * Error messages include the observed HTTP status as a suffix so
+     * operators can attribute drift; entry values are deliberately
+     * never echoed (unexpected bodies may carry sensitive data).
+     *
+     * **Fail-fast, unlike `validateCreateInput`'s collect-all.** This is
+     * a server-contract integrity check, not user input — once the envelope
+     * is malformed, additional shape errors don't help debug the upstream
+     * issue.
+     */
+    private validateBatchCreateResponse;
+    private paginateAll;
+    /** Create a new qURL. */
+    create(input: CreateInput, options?: RequestOptions): Promise<CreateOutput>;
+    /**
+     * Batch create multiple qURLs (1-`MAX_BATCH_ITEMS` items).
+     *
+     * **Partial failures do not throw.** Two paths resolve normally with
+     * structured per-item results:
+     * - **HTTP 207 Multi-Status** (some succeeded, some failed) — passes the
+     *   `response.ok` check naturally since 207 is in the 2xx range.
+     * - **HTTP 400** (every item failed validation) — the API returns a
+     *   populated `BatchCreateOutput` body in this case; whitelisted via
+     *   `passthroughStatuses` so the structured per-item errors aren't
+     *   swallowed by the generic error path.
+     *
+     * Callers that only catch thrown errors will **silently miss partial
+     * failures**. Always branch on `result.failed > 0` before treating the
+     * call as successful. Other error statuses (401, 403, 429, 5xx) still
+     * throw the appropriate `QURLError` subclass.
+     *
+     * **Client-side validation:** All items are validated before any network
+     * request is made (target_url scheme, label length, max_sessions range,
+     * tag constraints). All failures are collected into a single
+     * `ValidationError` with per-index attribution
+     * (`"items[0]: ... | items[3]: ..."`) — items are separated by ` | ` and
+     * field-level errors within an item by `; ` so callers can split the
+     * detail message reliably. Every problem surfaces in one throw instead
+     * of fix-re-run-repeat.
+     *
+     * Throws `ValidationError` client-side (`status: 0`, `code: "client_validation"`)
+     * when `items` is empty or exceeds `MAX_BATCH_ITEMS`, or when the
+     * HTTP 400 response body doesn't match the expected `BatchCreateOutput`
+     * shape (defense-in-depth for cases where the endpoint returns a non-batch
+     * error on 400).
+     *
+     * @example
+     * Always check `result.failed` after the call — exceptions alone are
+     * not enough, because 207 / 400 partial failures resolve normally:
+     * ```ts
+     * const result = await client.batchCreate({ items });
+     *
+     * if (result.failed > 0) {
+     *   console.warn(`${result.failed}/${result.results.length} items failed`);
+     * }
+     *
+     * // Discriminated union on `success` lets you narrow per-item:
+     * for (const r of result.results) {
+     *   if (r.success) {
+     *     handleOk(r.resource_id, r.qurl_link);
+     *   } else {
+     *     handleErr(r.index, r.error.code, r.error.message);
+     *   }
+     * }
+     * ```
+     */
+    batchCreate(input: BatchCreateInput, options?: RequestOptions): Promise<BatchCreateOutput>;
+    /**
+     * Get a qURL resource and its access tokens.
+     *
+     * Accepts either a resource ID (`r_` prefix) or a qURL display ID (`q_`
+     * prefix); the API resolves `q_` IDs to the parent resource automatically.
+     */
+    get(id: string): Promise<QURL>;
+    /**
+     * Lists protected URLs. Each qURL groups access tokens sharing the same target URL.
+     * Note: list items include qurl_count but not access_tokens (too expensive at scale).
+     *
+     * **`limit` semantics:** `limit` is validated client-side to be in
+     * the range `[1, 100]` per the OpenAPI spec (`GET /v1/qurls` defines
+     * `limit: integer, minimum: 1, maximum: 100, default: 20`). Passing
+     * a value outside that range throws `ValidationError` before the
+     * request is issued. Omitting `limit` lets the server apply its
+     * default page size (currently 20). Matches the client-side
+     * validation style used for `max_sessions`, `tag count`, URL length.
+     */
+    list(input?: ListInput): Promise<ListOutput>;
+    /**
+     * Iterate over all qURLs, automatically paginating.
+     *
+     * Termination honors explicit `has_more: false` first, then falls back
+     * to the cursor shape. A missing `next_cursor` still terminates even if
+     * a buggy response claimed `has_more: true`, and a stale cursor with
+     * `has_more: false` does not trigger an extra round-trip.
+     *
+     * Input is validated synchronously when this method is called, before
+     * iteration begins.
+     */
+    listAll(input?: Omit<ListInput, "cursor">): AsyncGenerator<QURL, void, undefined>;
+    /**
+     * Delete (revoke) a qURL resource and all its access tokens.
+     *
+     * Only accepts a resource ID (`r_` prefix), not a qURL display ID (`q_`
+     * prefix). Per the OpenAPI spec: *"Requires a resource ID (r_ prefix).
+     * To revoke a single token, use DELETE /v1/resources/:id/qurls/:qurl_id"*.
+     * A client-side prefix check catches the mistake before the API round-trip.
+     */
+    delete(id: string): Promise<void>;
+    /**
+     * Extend a qURL's expiration.
+     *
+     * Accepts either a resource ID (`r_` prefix) or a qURL display ID (`q_`
+     * prefix). Convenience method — delegates to {@link update} with only the
+     * expiration fields. `ExtendInput` shares its `extend_by` / `expires_at`
+     * fields with `UpdateInput` but is *narrower in two ways*: (1) exactly
+     * one of the two must be present (XOR via `?: never`), where `UpdateInput`
+     * allows neither; and (2) `description` / `tags` are absent.
+     *
+     * Destructuring before delegation strips wider fields at runtime, so an
+     * untyped-JS caller spreading `{ description, tags, ... }` can't leak
+     * those through this path. The XOR (exactly-one-of-two) invariant is
+     * enforced separately by the runtime check inside `update()`.
+     */
+    extend(id: string, input: ExtendInput, options?: RequestOptions): Promise<QURL>;
+    /**
+     * Update a qURL — extend expiration, change description, rename tags.
+     *
+     * Accepts either a resource ID (`r_` prefix) or a qURL display ID (`q_`
+     * prefix); the API resolves `q_` IDs to the parent resource automatically.
+     */
+    update(id: string, input: UpdateInput, options?: RequestOptions): Promise<QURL>;
+    /**
+     * Mint a new access link for a qURL.
+     *
+     * Accepts either a resource ID (`r_` prefix) or a qURL display ID (`q_`
+     * prefix); the API resolves `q_` IDs to the parent resource automatically.
+     *
+     * Passing `{}` or an object with all fields `null`/`undefined` is
+     * equivalent to omitting the second argument: no body is sent, and the
+     * server applies its 24h default expiration.
+     */
+    mintLink(id: string, input?: MintInput, options?: RequestOptions): Promise<MintOutput>;
+    /**
+     * Resolve a qURL access token (headless).
+     *
+     * Triggers an NHP knock to grant network access for the caller's IP.
+     * Requires `qurl:resolve` scope on the API key.
+     *
+     * Accepts a plain token string or a `ResolveInput` object.
+     */
+    resolve(input: ResolveInput | string, options?: RequestOptions): Promise<ResolveOutput>;
+    /** Get quota and usage information. */
+    getQuota(): Promise<Quota>;
+    /** Bootstrap a LayerV qURL Connector agent. */
+    bootstrapAgent(input: AgentBootstrapInput, options?: RequestOptions): Promise<AgentBootstrapOutput>;
+    /** List resources from the `/v1/resources` API. */
+    listResources(input?: ResourceListInput): Promise<ResourceListOutput>;
+    /**
+     * Iterate all resources, automatically paginating.
+     *
+     * Input is validated synchronously when this method is called, before
+     * iteration begins.
+     */
+    listAllResources(input?: Omit<ResourceListInput, "cursor">): AsyncGenerator<Resource, void, undefined>;
+    /** Create a resource directly. */
+    createResource(input: CreateResourceInput, options?: RequestOptions): Promise<Resource>;
+    /** Get one resource plus its bounded qURL preview. */
+    getResource(id: string): Promise<ResourceDetail>;
+    /** Update resource metadata. */
+    updateResource(id: string, input: UpdateResourceInput, options?: RequestOptions): Promise<Resource>;
+    /** Revoke a resource and all of its qURLs. */
+    deleteResource(id: string): Promise<void>;
+    /** Mint a qURL against an existing resource. */
+    createQurlForResource(id: string, input?: CreateQurlForResourceInput, options?: RequestOptions): Promise<CreateOutput>;
+    /** Revoke a specific qURL token on a resource. */
+    revokeResourceQurl(id: string, qurlId: string): Promise<void>;
+    /** Update a specific qURL token on a resource. */
+    updateResourceQurl(id: string, qurlId: string, input: UpdateResourceQurlInput, options?: RequestOptions): Promise<QurlSummary>;
+    /**
+     * List active access sessions for a resource.
+     *
+     * The current API contract has no cursor query params for this endpoint.
+     * If the service later advertises pagination metadata, the SDK returns
+     * this page and emits a debug log rather than pretending it fetched all pages.
+     */
+    listResourceSessions(id: string): Promise<SessionListOutput>;
+    /**
+     * Terminate all active sessions for a resource.
+     *
+     * The returned count is best-effort under retries: if the first DELETE
+     * succeeds server-side but the response is lost, a retried request may
+     * return `0` because there are no sessions left to terminate.
+     */
+    terminateAllResourceSessions(id: string): Promise<SessionTerminateOutput>;
+    /** Terminate a specific resource session. */
+    terminateResourceSession(id: string, sessionId: string): Promise<void>;
+    /** List connector installations. */
+    listConnectorInstallations(input?: ListConnectorInstallationsInput): Promise<ConnectorInstallationListOutput>;
+    /**
+     * Iterate all connector installations, automatically paginating.
+     *
+     * Input is validated synchronously when this method is called, before
+     * iteration begins.
+     */
+    listAllConnectorInstallations(input?: Omit<ListConnectorInstallationsInput, "cursor">): AsyncGenerator<ConnectorInstallation, void, undefined>;
+    /** Get current-period usage. */
+    getUsageCurrentPeriod(): Promise<UsageCurrentPeriod>;
+    /** Get daily usage for the current period. */
+    getUsageDaily(): Promise<UsageDaily>;
+    /** Get the customer profile. */
+    getCustomer(): Promise<Customer>;
+    /** Update customer settings. */
+    updateCustomer(input: UpdateCustomerInput, options?: RequestOptions): Promise<Customer>;
+    /** Create a Stripe checkout session. */
+    createBillingCheckout(input: CreateBillingCheckoutInput, options?: RequestOptions): Promise<CheckoutSession>;
+    /** Create a Stripe billing portal session. */
+    createBillingPortal(options?: RequestOptions): Promise<PortalSession>;
+    /** List billing invoices. */
+    listBillingInvoices(input?: ListBillingInvoicesInput): Promise<BillingInvoiceListOutput>;
+    /**
+     * Iterate all billing invoices, automatically paginating.
+     *
+     * Input is validated synchronously when this method is called, before
+     * iteration begins.
+     */
+    listAllBillingInvoices(input?: Omit<ListBillingInvoicesInput, "cursor">): AsyncGenerator<Invoice, void, undefined>;
+    /** Register a custom domain. */
+    registerDomain(input: RegisterDomainInput, options?: RequestOptions): Promise<Domain>;
+    /** List custom domains. */
+    listDomains(input?: ListDomainsInput): Promise<DomainListOutput>;
+    /**
+     * Iterate all domains, automatically paginating.
+     *
+     * Input is validated synchronously when this method is called, before
+     * iteration begins.
+     */
+    listAllDomains(input?: Omit<ListDomainsInput, "cursor">): AsyncGenerator<Domain, void, undefined>;
+    /** Get custom domain status. */
+    getDomain(domain: string): Promise<Domain>;
+    /** Remove a custom domain. */
+    deleteDomain(domain: string): Promise<void>;
+    /** Trigger DNS verification for a custom domain. */
+    verifyDomain(domain: string, options?: RequestOptions): Promise<DomainVerifyResult>;
+    /** Regenerate a domain verification token. */
+    regenerateDomainToken(domain: string, options?: RequestOptions): Promise<Domain>;
+    /** List webhooks. */
+    listWebhooks(input?: ListWebhooksInput): Promise<WebhookListOutput>;
+    /**
+     * Iterate all webhooks, automatically paginating.
+     *
+     * Input is validated synchronously when this method is called, before
+     * iteration begins.
+     */
+    listAllWebhooks(input?: Omit<ListWebhooksInput, "cursor">): AsyncGenerator<Webhook, void, undefined>;
+    /** Create a webhook. */
+    createWebhook(input: CreateWebhookInput, options?: RequestOptions): Promise<WebhookWithSecret>;
+    /** List available webhook event types. */
+    listWebhookEventTypes(): Promise<WebhookEventTypeInfo[]>;
+    /** Get a webhook. */
+    getWebhook(id: string): Promise<Webhook>;
+    /** Update a webhook. */
+    updateWebhook(id: string, input: UpdateWebhookInput, options?: RequestOptions): Promise<Webhook>;
+    /** Delete a webhook. */
+    deleteWebhook(id: string): Promise<void>;
+    /** Regenerate a webhook signing secret. */
+    regenerateWebhookSecret(id: string, options?: RequestOptions): Promise<WebhookWithSecret>;
+    /** List delivery attempts for a webhook. */
+    listWebhookDeliveries(id: string, input?: ListWebhookDeliveriesInput): Promise<WebhookDeliveryListOutput>;
+    /**
+     * Iterate all delivery attempts for a webhook, automatically paginating.
+     *
+     * Input is validated synchronously when this method is called, before
+     * iteration begins.
+     */
+    listAllWebhookDeliveries(id: string, input?: Omit<ListWebhookDeliveriesInput, "cursor">): AsyncGenerator<WebhookDelivery, void, undefined>;
+    /** Create a new API key. */
+    createApiKey(input: CreateApiKeyInput, options?: RequestOptions): Promise<CreateApiKeyOutput>;
+    /** List API keys. */
+    listApiKeys(input?: ListApiKeysInput): Promise<ApiKeyListOutput>;
+    /**
+     * Iterate all API keys, automatically paginating.
+     *
+     * Input is validated synchronously when this method is called, before
+     * iteration begins.
+     */
+    listAllApiKeys(input?: Omit<ListApiKeysInput, "cursor">): AsyncGenerator<ApiKey, void, undefined>;
+    /** Update an API key. */
+    updateApiKey(keyId: string, input: UpdateApiKeyInput, options?: RequestOptions): Promise<ApiKey>;
+    /** Revoke an API key. */
+    revokeApiKey(keyId: string): Promise<void>;
+    /** Redeem an access code. */
+    redeemAccessCode(input: RedeemAccessCodeInput, options?: RequestOptions): Promise<RedeemAccessCodeOutput>;
+    /** Create an access code. */
+    createAccessCode(input: CreateAccessCodeInput, options?: RequestOptions): Promise<CreateAccessCodeOutput>;
+    /**
+     * List access codes.
+     *
+     * The current API contract has no cursor query params for this endpoint.
+     * If the service later advertises pagination metadata, the SDK returns
+     * this page and emits a debug log rather than pretending it fetched all pages.
+     */
+    listAccessCodes(): Promise<AccessCodeListOutput>;
+    /** Revoke an access code. */
+    revokeAccessCode(id: string): Promise<void>;
+    private request;
+    /**
+     * Issue an HTTP request and parse the JSON response.
+     *
+     * `passthroughStatuses` lets a caller opt certain non-2xx codes out of the
+     * default throw-on-error path and receive the parsed body instead. This is
+     * used by `batchCreate`, where the API returns a structured
+     * `BatchCreateOutput` on HTTP 400 (all items rejected) — throwing would
+     * drop the per-item errors.
+     */
+    private rawRequest;
+    private parseError;
+    private parseRetryAfter;
+    /**
+     * Compute the delay before the next retry attempt.
+     *
+     * - If the server sent a usable `Retry-After`, the value (converted
+     *   from seconds to ms) is honored without the `RETRY_MAX_DELAY_MS`
+     *   clamp — the cap exists to bound exponential backoff against
+     *   ourselves; clamping a server-asserted directive (e.g.
+     *   `Retry-After: 60`) down to 30s would just re-trip the rate limit.
+     *   `Retry-After: 0` is honored verbatim per RFC 7231 §7.1.3 ("retry
+     *   immediately").
+     * - Otherwise: `RETRY_BASE_DELAY_MS * 2^(attempt-1)` plus 0-50%
+     *   jitter, capped at `RETRY_MAX_DELAY_MS`.
+     */
+    private retryDelay;
+    private classifyFetchError;
+}