@layervai/qurl 0.6.0 → 2.0.0

package/dist/cjs/crid.d.ts

@@ -0,0 +1,3 @@
+export declare const CRID_DOMAIN = "NHP-QURL-CRID-V1\0";
+export declare function parseCrid(value: unknown, knownVersionOnly?: boolean): Uint8Array | undefined;
+export declare function cridKeyMatches(value: unknown, der: Uint8Array): Promise<boolean>;

package/dist/cjs/crid.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CRID_DOMAIN = void 0;
+exports.parseCrid = parseCrid;
+exports.cridKeyMatches = cridKeyMatches;
+// CRID v1 local gate and delivered-key binding, matching qurl-go/crid.
+// The byte selects a version/environment/digest width, not a new hash scheme.
+// All key matches use the v1 domain separator, as in qurl-go/crid.KeyMatches.
+// Unknown nonzero versions remain forwardable; the service owns activation.
+// Access binding requires a locally known version and its registered width.
+const ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+exports.CRID_DOMAIN = "NHP-QURL-CRID-V1\0";
+function parseCrid(value, knownVersionOnly = false) {
+    if (typeof value !== "string" || ![47, 60].includes(value.length))
+        return undefined;
+    const bytes = new Uint8Array(Math.floor((value.length * 5) / 8));
+    let buffer = 0, bits = 0, offset = 0;
+    for (const character of value) {
+        const digit = ALPHABET.indexOf(character);
+        if (digit < 0)
+            return undefined;
+        buffer = (buffer << 5) | digit;
+        bits += 5;
+        if (bits >= 8) {
+            bits -= 8;
+            bytes[offset++] = buffer >>> bits;
+            buffer &= (1 << bits) - 1;
+        }
+    }
+    if (buffer !== 0 || bytes[0] === 0)
+        return undefined;
+    const payload = bytes.subarray(0, -4);
+    if (knownVersionOnly) {
+        const version = bytes[0];
+        const width = version === 1 || version === 0x81 ? 32 : version === 2 || version === 0x82 ? 24 : 0;
+        if (payload.length !== width + 1 || width === 0)
+            return undefined;
+    }
+    let crc = 0xffffffff;
+    for (const byte of payload) {
+        crc ^= byte;
+        for (let bit = 0; bit < 8; bit++)
+            crc = (crc >>> 1) ^ (crc & 1 ? 0x82f63b78 : 0);
+    }
+    if (~crc >>> 0 !== new DataView(bytes.buffer).getUint32(bytes.length - 4))
+        return undefined;
+    return payload.subarray(1);
+}
+async function cridKeyMatches(value, der) {
+    const expected = parseCrid(value);
+    if (!expected)
+        return false;
+    const prefix = new TextEncoder().encode(exports.CRID_DOMAIN);
+    const message = new Uint8Array(prefix.length + der.length);
+    message.set(prefix);
+    message.set(der, prefix.length);
+    const digest = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", message));
+    let difference = 0;
+    for (let i = 0; i < expected.length; i++)
+        difference |= expected[i] ^ digest[i];
+    return difference === 0;
+}

package/dist/cjs/errors.d.ts

@@ -14,8 +14,18 @@ export declare const ERROR_CODE_UNEXPECTED_RESPONSE = "unexpected_response";
 export declare const ERROR_CODE_NETWORK = "network_error";
 export declare const ERROR_CODE_TIMEOUT = "timeout";
 export declare const ERROR_CODE_RUNTIME = "runtime_error";
+/** A share response omitted the CRID required for delivered-key verification. */
+export declare const ERROR_CODE_MISSING_CRID = "missing_crid";
+/** A held CRID failed the local CRID v1 validation gate. */
+export declare const ERROR_CODE_INVALID_CRID = "invalid_crid";
+/** A caller supplied a non-binary runtime value where DER SPKI bytes are required. */
+export declare const ERROR_CODE_INVALID_CRID_KEY = "invalid_crid_key";
+/** A delivered key does not derive the held CRID. */
+export declare const ERROR_CODE_CRID_MISMATCH = "crid_mismatch";
 /** A dispatched Connector resource mutation could have committed and must be reconciled. */
 export declare const ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN = "connector_resource_outcome_unknown";
+/** A delegated batch create was dispatched but no valid acceptance was received. */
+export declare const ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN = "delegated_batch_outcome_unknown";
 /** A by-ID Connector resource lookup found a revoked lifecycle row. */
 export declare const ERROR_CODE_CONNECTOR_RESOURCE_REVOKED = "connector_resource_revoked";
 /** A Connector slug lookup found no active resource (client-detected, `status: 0`). */
@@ -28,8 +38,8 @@ export declare const ERROR_CODE_UNKNOWN = "unknown";
  * Base error thrown by the qURL API client. Catch this to handle all SDK errors.
  *
  * **`status: 0` convention:** Client-only validation, runtime, network, and
- * timeout failures use `status: 0` because no HTTP status applies. Logical
- * response-shape guards can also use zero. An `unexpected_response` tied to a
+ * timeout failures and local CRID verification failures use `status: 0`
+ * because no HTTP status applies. Logical response-shape guards can also use zero. An `unexpected_response` tied to a
  * concrete HTTP contract violation (redirect, oversized body, wrong
  * no-content status/body) instead preserves the observed status. Branch on
  * `.code` first and then `.status`; see {@link ValidationError}.
@@ -57,6 +67,8 @@ export declare class QURLError extends Error {
     readonly invalidFields?: Record<string, string>;
     readonly requestId?: string;
     readonly retryAfter?: number;
+    /** Known minted IDs from a rejected terminal batch, for bounded cleanup. No bearer links. */
+    readonly partialQurlIds?: readonly string[];
     constructor(data: QURLErrorData);
 }
 /** 401 Unauthorized — invalid or missing API key. */
@@ -84,9 +96,10 @@ export declare class NotFoundError extends QURLError {
  *
  * `instanceof ValidationError` catches both on ordinary client/response
  * paths. A Connector mutation wraps a post-dispatch `unexpected_response`
- * in {@link ConnectorResourceOutcomeUnknownError}; inspect that error's
- * typed `cause` before deciding whether to retry. To distinguish them, check
- * `.code` rather than using `instanceof` alone.
+ * in {@link ConnectorResourceOutcomeUnknownError} or
+ * {@link DelegatedBatchOutcomeUnknownError}; inspect the wrapper's typed
+ * `cause` before deciding whether to retry. To distinguish them, check `.code`
+ * rather than using `instanceof` alone.
  *
  * **`.status` asymmetry within `code: "unexpected_response"`:**
  * - Shape-guard failure on a parsed JSON body (wrong field types,
@@ -128,6 +141,18 @@ export declare class ConnectorResourceOutcomeUnknownError extends QURLError {
     readonly cause: QURLError;
     constructor(cause: QURLError);
 }
+/**
+ * A delegated batch create may have committed. Retry only with the same
+ * idempotency key and semantic body. The original typed failure is in `cause`.
+ * The wrapper uses `status: 0` so generic HTTP retry code cannot replay it.
+ */
+export declare class DelegatedBatchOutcomeUnknownError extends QURLError {
+    readonly code: typeof ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN;
+    readonly cause: QURLError;
+    /** Valid accepted batch identity, when the response body provided one. */
+    readonly batchId?: string;
+    constructor(cause: QURLError, batchId?: string);
+}
 /** Transport-level error — DNS failure, connection refused, etc. */
 export declare class NetworkError extends QURLError {
     constructor(message: string, options?: {

package/dist/cjs/errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RuntimeError = exports.TimeoutError = exports.NetworkError = exports.ConnectorResourceOutcomeUnknownError = exports.ServerError = exports.RateLimitError = exports.ValidationError = exports.NotFoundError = exports.AuthorizationError = exports.AuthenticationError = exports.QURLError = exports.ERROR_CODE_UNKNOWN = exports.ERROR_CODE_AMBIGUOUS_RESOURCE = exports.ERROR_CODE_RESOURCE_NOT_FOUND = exports.ERROR_CODE_CONNECTOR_RESOURCE_REVOKED = exports.ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN = exports.ERROR_CODE_RUNTIME = exports.ERROR_CODE_TIMEOUT = exports.ERROR_CODE_NETWORK = exports.ERROR_CODE_UNEXPECTED_RESPONSE = exports.ERROR_CODE_CLIENT_VALIDATION = void 0;
+exports.RuntimeError = exports.TimeoutError = exports.NetworkError = exports.DelegatedBatchOutcomeUnknownError = exports.ConnectorResourceOutcomeUnknownError = exports.ServerError = exports.RateLimitError = exports.ValidationError = exports.NotFoundError = exports.AuthorizationError = exports.AuthenticationError = exports.QURLError = exports.ERROR_CODE_UNKNOWN = exports.ERROR_CODE_AMBIGUOUS_RESOURCE = exports.ERROR_CODE_RESOURCE_NOT_FOUND = exports.ERROR_CODE_CONNECTOR_RESOURCE_REVOKED = exports.ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN = exports.ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN = exports.ERROR_CODE_CRID_MISMATCH = exports.ERROR_CODE_INVALID_CRID_KEY = exports.ERROR_CODE_INVALID_CRID = exports.ERROR_CODE_MISSING_CRID = exports.ERROR_CODE_RUNTIME = exports.ERROR_CODE_TIMEOUT = exports.ERROR_CODE_NETWORK = exports.ERROR_CODE_UNEXPECTED_RESPONSE = exports.ERROR_CODE_CLIENT_VALIDATION = void 0;
 exports.createError = createError;
 /**
  * Sentinel `.code` values for SDK-internal failure modes (no real HTTP
@@ -17,8 +17,18 @@ exports.ERROR_CODE_UNEXPECTED_RESPONSE = "unexpected_response";
 exports.ERROR_CODE_NETWORK = "network_error";
 exports.ERROR_CODE_TIMEOUT = "timeout";
 exports.ERROR_CODE_RUNTIME = "runtime_error";
+/** A share response omitted the CRID required for delivered-key verification. */
+exports.ERROR_CODE_MISSING_CRID = "missing_crid";
+/** A held CRID failed the local CRID v1 validation gate. */
+exports.ERROR_CODE_INVALID_CRID = "invalid_crid";
+/** A caller supplied a non-binary runtime value where DER SPKI bytes are required. */
+exports.ERROR_CODE_INVALID_CRID_KEY = "invalid_crid_key";
+/** A delivered key does not derive the held CRID. */
+exports.ERROR_CODE_CRID_MISMATCH = "crid_mismatch";
 /** A dispatched Connector resource mutation could have committed and must be reconciled. */
 exports.ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN = "connector_resource_outcome_unknown";
+/** A delegated batch create was dispatched but no valid acceptance was received. */
+exports.ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN = "delegated_batch_outcome_unknown";
 /** A by-ID Connector resource lookup found a revoked lifecycle row. */
 exports.ERROR_CODE_CONNECTOR_RESOURCE_REVOKED = "connector_resource_revoked";
 /** A Connector slug lookup found no active resource (client-detected, `status: 0`). */
@@ -31,8 +41,8 @@ exports.ERROR_CODE_UNKNOWN = "unknown";
  * Base error thrown by the qURL API client. Catch this to handle all SDK errors.
  *
  * **`status: 0` convention:** Client-only validation, runtime, network, and
- * timeout failures use `status: 0` because no HTTP status applies. Logical
- * response-shape guards can also use zero. An `unexpected_response` tied to a
+ * timeout failures and local CRID verification failures use `status: 0`
+ * because no HTTP status applies. Logical response-shape guards can also use zero. An `unexpected_response` tied to a
  * concrete HTTP contract violation (redirect, oversized body, wrong
  * no-content status/body) instead preserves the observed status. Branch on
  * `.code` first and then `.status`; see {@link ValidationError}.
@@ -60,6 +70,8 @@ class QURLError extends Error {
     invalidFields;
     requestId;
     retryAfter;
+    /** Known minted IDs from a rejected terminal batch, for bounded cleanup. No bearer links. */
+    partialQurlIds;
     constructor(data) {
         // RFC 7807 leaves `detail` optional; the API can legitimately omit it and
         // `title` is required, so falling back to title keeps the Error.message
@@ -115,9 +127,10 @@ exports.NotFoundError = NotFoundError;
  *
  * `instanceof ValidationError` catches both on ordinary client/response
  * paths. A Connector mutation wraps a post-dispatch `unexpected_response`
- * in {@link ConnectorResourceOutcomeUnknownError}; inspect that error's
- * typed `cause` before deciding whether to retry. To distinguish them, check
- * `.code` rather than using `instanceof` alone.
+ * in {@link ConnectorResourceOutcomeUnknownError} or
+ * {@link DelegatedBatchOutcomeUnknownError}; inspect the wrapper's typed
+ * `cause` before deciding whether to retry. To distinguish them, check `.code`
+ * rather than using `instanceof` alone.
  *
  * **`.status` asymmetry within `code: "unexpected_response"`:**
  * - Shape-guard failure on a parsed JSON body (wrong field types,
@@ -191,6 +204,28 @@ class ConnectorResourceOutcomeUnknownError extends QURLError {
     }
 }
 exports.ConnectorResourceOutcomeUnknownError = ConnectorResourceOutcomeUnknownError;
+/**
+ * A delegated batch create may have committed. Retry only with the same
+ * idempotency key and semantic body. The original typed failure is in `cause`.
+ * The wrapper uses `status: 0` so generic HTTP retry code cannot replay it.
+ */
+class DelegatedBatchOutcomeUnknownError extends QURLError {
+    /** Valid accepted batch identity, when the response body provided one. */
+    batchId;
+    constructor(cause, batchId) {
+        super({
+            status: 0,
+            code: exports.ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN,
+            title: "Delegated Batch Outcome Unknown",
+            detail: `Mutation outcome is unknown; retry only with the same idempotency key and body. ${cause.detail}`,
+            request_id: cause.requestId,
+        });
+        this.name = "DelegatedBatchOutcomeUnknownError";
+        this.batchId = batchId;
+        attachErrorCause(this, { cause });
+    }
+}
+exports.DelegatedBatchOutcomeUnknownError = DelegatedBatchOutcomeUnknownError;
 /** Transport-level error — DNS failure, connection refused, etc. */
 class NetworkError extends QURLError {
     constructor(message, options) {

package/dist/cjs/index.d.ts

@@ -1,5 +1,7 @@
-export { ConnectorResource, ProtectedResource, QURLClient } from "./client.js";
+export { ConnectorResource, isApiKeyRequestScope, ProtectedResource, QURLClient, } from "./client.js";
 export type { EnsureConnectorResourceResult } from "./client.js";
-export { AuthenticationError, AuthorizationError, ConnectorResourceOutcomeUnknownError, createError, ERROR_CODE_AMBIGUOUS_RESOURCE, ERROR_CODE_CLIENT_VALIDATION, ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN, ERROR_CODE_CONNECTOR_RESOURCE_REVOKED, ERROR_CODE_NETWORK, ERROR_CODE_RESOURCE_NOT_FOUND, ERROR_CODE_RUNTIME, ERROR_CODE_TIMEOUT, ERROR_CODE_UNEXPECTED_RESPONSE, ERROR_CODE_UNKNOWN, NetworkError, NotFoundError, QURLError, RateLimitError, RuntimeError, ServerError, TimeoutError, ValidationError, } from "./errors.js";
+export { CRIDVerificationError, ShareLink } from "./share.js";
+export type { CRIDVerificationErrorCode, ShareLinkInit, ShareLinkJSON } from "./share.js";
+export { AuthenticationError, AuthorizationError, ConnectorResourceOutcomeUnknownError, createError, DelegatedBatchOutcomeUnknownError, ERROR_CODE_AMBIGUOUS_RESOURCE, ERROR_CODE_CLIENT_VALIDATION, ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN, ERROR_CODE_CONNECTOR_RESOURCE_REVOKED, ERROR_CODE_CRID_MISMATCH, ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN, ERROR_CODE_INVALID_CRID, ERROR_CODE_INVALID_CRID_KEY, ERROR_CODE_MISSING_CRID, ERROR_CODE_NETWORK, ERROR_CODE_RESOURCE_NOT_FOUND, ERROR_CODE_RUNTIME, ERROR_CODE_TIMEOUT, ERROR_CODE_UNEXPECTED_RESPONSE, ERROR_CODE_UNKNOWN, NetworkError, NotFoundError, QURLError, RateLimitError, RuntimeError, ServerError, TimeoutError, ValidationError, } from "./errors.js";
 export { VERSION } from "./version.js";
-export type { AccessCode, AccessCodeListOutput, AccessGrant, AccessPolicy, AccessToken, AIAgentCategory, AIAgentPolicy, ApiKey, ApiKeyListOutput, ApiKeyScope, BatchCreateInput, BatchCreateOutput, BatchItemFailure, BatchItemResult, BatchItemSuccess, BillingInvoiceListOutput, ClientOptions, ConnectorInstallation, ConnectorInstallationCapabilities, ConnectorInstallationListOutput, ConnectorInstallationStats, CreateAccessCodeInput, CreateAccessCodeOutput, CreateApiKeyInput, CreateApiKeyOutput, CreateBillingCheckoutInput, CreateInput, CreateOutput, CreatePortalOptions, CreateQurlForResourceInput, CreateResourceInput, CreateWebhookInput, Customer, CheckoutSession, DnsRecord, Domain, DomainCheckDetail, DomainListOutput, DomainVerifyResult, ExtendInput, Invoice, ListApiKeysInput, ListBillingInvoicesInput, ListConnectorInstallationsInput, ListDomainsInput, ListInput, ListOutput, ListWebhooksInput, ListWebhookDeliveriesInput, Meta, MintInput, MintOutput, PaginatedOutput, Portal, PortalSession, ProtectUrlOptions, QURL, QURLErrorData, QurlSummary, Quota, RedeemAccessCodeInput, RedeemAccessCodeOutput, RegisterDomainInput, Resource, ResourceDetail, ResourceHandle, ResourceListInput, ResourceListOutput, ResourceType, RequestOptions, ResolveInput, ResolveOutput, Session, SessionListOutput, SessionTerminateOutput, TombstoneInfo, UnpaginatedOutput, UpdateApiKeyInput, UpdateCustomerInput, UpdateInput, UpdateResourceInput, UpdateResourceQurlInput, UpdateWebhookInput, UsageCostEstimate, UsageCurrentPeriod, UsageDaily, UsageDailyEntry, Webhook, WebhookDelivery, WebhookDeliveryListOutput, WebhookEventType, WebhookEventTypeInfo, WebhookListOutput, WebhookPayload, WebhookWithSecret, } from "./types.js";
+export type { AccessCode, AccessCodeListOutput, AccessGrant, AccessPolicy, AccessToken, AIAgentCategory, AIAgentPolicy, ApiKey, ApiKeyListOutput, ApiKeyRequestScope, ApiKeyScope, BatchCreateInput, BatchCreateOutput, BatchItemFailure, BatchItemResult, BatchItemSuccess, BillingInvoiceListOutput, ClientOptions, ConnectorInstallation, ConnectorInstallationCapabilities, ConnectorInstallationListOutput, ConnectorInstallationStats, CreateAccessCodeInput, CreateAccessCodeOutput, CreateApiKeyInput, CreateApiKeyOutput, CreateDurableApiKeyInput, CreateEnrollmentTokenInput, CreateBillingCheckoutInput, CreateDelegatedQurlBatchInput, CreateDelegatedQurlBatchOptions, CreateInput, CreateOutput, CreatePortalOptions, CreateQurlForResourceInput, CreateResourceInput, CreateWebhookInput, CredentialClaim, CredentialClaimInput, CredentialKind, CredentialTarget, CredentialTargetInput, Customer, CheckoutSession, DnsRecord, Domain, DomainCheckDetail, DomainListOutput, DomainVerifyResult, DelegatedQurl, DelegatedQurlBatchAccepted, DelegatedQurlBatchItemFailure, DelegatedQurlBatchItemResult, DelegatedQurlBatchItemSuccess, DelegatedQurlBatchNotModified, DelegatedQurlBatchPending, DelegatedQurlBatchStatus, DelegatedQurlBatchTerminal, DelegatedQurlCreatedData, DelegatedQurlGrant, ExtendInput, Invoice, GetDelegatedQurlBatchOptions, GetDelegatedQurlBatchOutput, ListApiKeysInput, ListBillingInvoicesInput, ListConnectorInstallationsInput, ListDomainsInput, ListInput, ListOutput, ListWebhooksInput, ListWebhookDeliveriesInput, Meta, MintInput, MintOutput, PaginatedOutput, Portal, PortalSession, ProtectUrlOptions, QURL, QURLErrorData, QurlSummary, Quota, RedeemAccessCodeInput, RedeemAccessCodeOutput, RegisterDomainInput, Resource, ResourceDetail, ResourceHandle, ResourceListInput, ResourceListOutput, ResourceType, RequestOptions, ResolveInput, ResolveOutput, Session, SessionListOutput, SessionTerminateOutput, ShareResourceOptions, TombstoneInfo, UnpaginatedOutput, UpdateApiKeyInput, UpdateCustomerInput, UpdateInput, UpdateResourceInput, UpdateResourceQurlInput, UpdateWebhookInput, UsageCostEstimate, UsageCurrentPeriod, UsageDaily, UsageDailyEntry, Webhook, WebhookDelivery, WebhookDeliveryListOutput, WebhookEventType, WebhookEventTypeInfo, WebhookListOutput, WebhookPayload, WebhookWithSecret, } from "./types.js";

package/dist/cjs/index.js

@@ -1,19 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VERSION = exports.ValidationError = exports.TimeoutError = exports.ServerError = exports.RuntimeError = exports.RateLimitError = exports.QURLError = exports.NotFoundError = exports.NetworkError = exports.ERROR_CODE_UNKNOWN = exports.ERROR_CODE_UNEXPECTED_RESPONSE = exports.ERROR_CODE_TIMEOUT = exports.ERROR_CODE_RUNTIME = exports.ERROR_CODE_RESOURCE_NOT_FOUND = exports.ERROR_CODE_NETWORK = exports.ERROR_CODE_CONNECTOR_RESOURCE_REVOKED = exports.ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN = exports.ERROR_CODE_CLIENT_VALIDATION = exports.ERROR_CODE_AMBIGUOUS_RESOURCE = exports.createError = exports.ConnectorResourceOutcomeUnknownError = exports.AuthorizationError = exports.AuthenticationError = exports.QURLClient = exports.ProtectedResource = exports.ConnectorResource = void 0;
+exports.VERSION = exports.ValidationError = exports.TimeoutError = exports.ServerError = exports.RuntimeError = exports.RateLimitError = exports.QURLError = exports.NotFoundError = exports.NetworkError = exports.ERROR_CODE_UNKNOWN = exports.ERROR_CODE_UNEXPECTED_RESPONSE = exports.ERROR_CODE_TIMEOUT = exports.ERROR_CODE_RUNTIME = exports.ERROR_CODE_RESOURCE_NOT_FOUND = exports.ERROR_CODE_NETWORK = exports.ERROR_CODE_MISSING_CRID = exports.ERROR_CODE_INVALID_CRID_KEY = exports.ERROR_CODE_INVALID_CRID = exports.ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN = exports.ERROR_CODE_CRID_MISMATCH = exports.ERROR_CODE_CONNECTOR_RESOURCE_REVOKED = exports.ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN = exports.ERROR_CODE_CLIENT_VALIDATION = exports.ERROR_CODE_AMBIGUOUS_RESOURCE = exports.DelegatedBatchOutcomeUnknownError = exports.createError = exports.ConnectorResourceOutcomeUnknownError = exports.AuthorizationError = exports.AuthenticationError = exports.ShareLink = exports.CRIDVerificationError = exports.QURLClient = exports.ProtectedResource = exports.isApiKeyRequestScope = exports.ConnectorResource = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "ConnectorResource", { enumerable: true, get: function () { return client_js_1.ConnectorResource; } });
+Object.defineProperty(exports, "isApiKeyRequestScope", { enumerable: true, get: function () { return client_js_1.isApiKeyRequestScope; } });
 Object.defineProperty(exports, "ProtectedResource", { enumerable: true, get: function () { return client_js_1.ProtectedResource; } });
 Object.defineProperty(exports, "QURLClient", { enumerable: true, get: function () { return client_js_1.QURLClient; } });
+var share_js_1 = require("./share.js");
+Object.defineProperty(exports, "CRIDVerificationError", { enumerable: true, get: function () { return share_js_1.CRIDVerificationError; } });
+Object.defineProperty(exports, "ShareLink", { enumerable: true, get: function () { return share_js_1.ShareLink; } });
 var errors_js_1 = require("./errors.js");
 Object.defineProperty(exports, "AuthenticationError", { enumerable: true, get: function () { return errors_js_1.AuthenticationError; } });
 Object.defineProperty(exports, "AuthorizationError", { enumerable: true, get: function () { return errors_js_1.AuthorizationError; } });
 Object.defineProperty(exports, "ConnectorResourceOutcomeUnknownError", { enumerable: true, get: function () { return errors_js_1.ConnectorResourceOutcomeUnknownError; } });
 Object.defineProperty(exports, "createError", { enumerable: true, get: function () { return errors_js_1.createError; } });
+Object.defineProperty(exports, "DelegatedBatchOutcomeUnknownError", { enumerable: true, get: function () { return errors_js_1.DelegatedBatchOutcomeUnknownError; } });
 Object.defineProperty(exports, "ERROR_CODE_AMBIGUOUS_RESOURCE", { enumerable: true, get: function () { return errors_js_1.ERROR_CODE_AMBIGUOUS_RESOURCE; } });
 Object.defineProperty(exports, "ERROR_CODE_CLIENT_VALIDATION", { enumerable: true, get: function () { return errors_js_1.ERROR_CODE_CLIENT_VALIDATION; } });
 Object.defineProperty(exports, "ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN", { enumerable: true, get: function () { return errors_js_1.ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN; } });
 Object.defineProperty(exports, "ERROR_CODE_CONNECTOR_RESOURCE_REVOKED", { enumerable: true, get: function () { return errors_js_1.ERROR_CODE_CONNECTOR_RESOURCE_REVOKED; } });
+Object.defineProperty(exports, "ERROR_CODE_CRID_MISMATCH", { enumerable: true, get: function () { return errors_js_1.ERROR_CODE_CRID_MISMATCH; } });
+Object.defineProperty(exports, "ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN", { enumerable: true, get: function () { return errors_js_1.ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN; } });
+Object.defineProperty(exports, "ERROR_CODE_INVALID_CRID", { enumerable: true, get: function () { return errors_js_1.ERROR_CODE_INVALID_CRID; } });
+Object.defineProperty(exports, "ERROR_CODE_INVALID_CRID_KEY", { enumerable: true, get: function () { return errors_js_1.ERROR_CODE_INVALID_CRID_KEY; } });
+Object.defineProperty(exports, "ERROR_CODE_MISSING_CRID", { enumerable: true, get: function () { return errors_js_1.ERROR_CODE_MISSING_CRID; } });
 Object.defineProperty(exports, "ERROR_CODE_NETWORK", { enumerable: true, get: function () { return errors_js_1.ERROR_CODE_NETWORK; } });
 Object.defineProperty(exports, "ERROR_CODE_RESOURCE_NOT_FOUND", { enumerable: true, get: function () { return errors_js_1.ERROR_CODE_RESOURCE_NOT_FOUND; } });
 Object.defineProperty(exports, "ERROR_CODE_RUNTIME", { enumerable: true, get: function () { return errors_js_1.ERROR_CODE_RUNTIME; } });

package/dist/cjs/node/agent-runtime.d.ts

@@ -0,0 +1,108 @@
+import { QURLClient } from "../client.js";
+import { type StrictJsonValue } from "./strict-json.js";
+import { type AgentAssignment, type AgentState, type AgentStateStore, type NHPUDPEndpoint } from "./agent-state.js";
+import { type AgentTransport } from "./agent-transport.js";
+export interface AgentOTPChallenge {
+    agentID: string;
+    cellID: string;
+    assignmentTicketExpiresAt: string;
+    pendingActivationRecovery: boolean;
+}
+export interface AgentRuntimeOptions {
+    hub?: NHPUDPEndpoint;
+    agentID?: string;
+    enrollmentCredential?: string;
+    enrollmentCredentialProvider?: (request: {
+        agentID: string;
+        pendingActivationRecovery: boolean;
+    }, signal: AbortSignal) => Promise<string>;
+    otpProvider?: (challenge: AgentOTPChallenge, signal: AbortSignal) => Promise<string>;
+    headless?: boolean;
+    offline?: boolean;
+    hostname?: string;
+    version?: string;
+    signal?: AbortSignal;
+    baseUrl?: string;
+    fetch?: typeof globalThis.fetch;
+}
+export declare class AgentLifecycleError extends Error {
+    readonly code: string;
+    readonly retryAfterMs?: number | undefined;
+    constructor(code: string, retryAfterMs?: number | undefined, options?: ErrorOptions);
+}
+declare function fingerprint(kind: "activation-enrollment" | "credential-recovery", credential: string): string;
+/** One driver per producer operation. Persistence failures never enter the network retry loop. */
+declare class Lifecycle {
+    readonly store: AgentStateStore;
+    readonly options: AgentRuntimeOptions;
+    readonly transport: AgentTransport;
+    readonly replacement?: {
+        anchor: string;
+        deadline: string;
+    } | undefined;
+    constructor(store: AgentStateStore, options: AgentRuntimeOptions, transport: AgentTransport, replacement?: {
+        anchor: string;
+        deadline: string;
+    } | undefined);
+    hub(): NHPUDPEndpoint;
+    exchange(state: AgentState, endpoint: NHPUDPEndpoint, type: 1 | 5 | 12 | 13 | 16, value: unknown, phase: "assignment" | "assignment-refresh" | "registration" | "completion" | "recovery-issue" | "recovery-completion" | "session", expires?: string, reknock?: unknown, detachedSignal?: AbortSignal): Promise<Record<string, StrictJsonValue>>;
+    assignment(state: AgentState, mode: "enroll" | "refresh", enrollment?: string): Promise<{
+        list: Record<string, StrictJsonValue>;
+        assignment: AgentAssignment;
+    }>;
+    refresh(state: AgentState, allowRecovered?: boolean): Promise<AgentState>;
+    complete(state: AgentState): Promise<AgentState>;
+    enroll(state: AgentState): Promise<AgentState>;
+}
+export interface NativeAgentKnockOptions {
+    runID: string;
+    runAttempt: bigint;
+    protectedResourceID: string;
+    signal?: AbortSignal;
+}
+export interface NativeSessionReceipt {
+    readonly cellID: string;
+    readonly sessionID: bigint;
+    readonly sessionIssuedAtMillis: bigint;
+    readonly runID: string;
+    readonly runAttempt: bigint;
+}
+export interface NativeAgentGrant {
+    token: string;
+    resourceHost: string;
+    openTime: number;
+    agentAddress: string;
+    receipt: NativeSessionReceipt;
+}
+export declare class AgentRuntime {
+    #private;
+    readonly store: AgentStateStore;
+    readonly transport: AgentTransport;
+    readonly client: QURLClient;
+    constructor(state: AgentState, store: AgentStateStore, options: AgentRuntimeOptions, transport: AgentTransport);
+    get agentID(): string;
+    assignment(): AgentAssignment;
+    refresh(signal?: AbortSignal): Promise<void>;
+    knock(knockResourceID: string, options: NativeAgentKnockOptions): Promise<NativeAgentGrant>;
+    retire(receipt: NativeSessionReceipt, signal?: AbortSignal): Promise<{
+        closeEventID: string;
+        state: "closing" | "closed";
+    }>;
+    close(): Promise<void>;
+    toJSON(): {
+        agentID: string | undefined;
+        closed: boolean;
+    };
+}
+export declare function connectAgentRuntime(store: AgentStateStore, options?: AgentRuntimeOptions): Promise<AgentRuntime>;
+export type AgentRecoveryOptions = Pick<AgentRuntimeOptions, "hub" | "agentID" | "signal" | "baseUrl" | "fetch">;
+export declare function recoverAgentRuntime(store: AgentStateStore, recoveryCredential: string | ((signal: AbortSignal) => Promise<string>), options?: AgentRecoveryOptions): Promise<AgentRuntime>;
+declare function recoverWithTransport(store: AgentStateStore, provider: string | ((signal: AbortSignal) => Promise<string>), options: AgentRecoveryOptions, transport: AgentTransport): Promise<AgentRuntime>;
+declare function connectWithTransport(store: AgentStateStore, options: AgentRuntimeOptions, transport: AgentTransport): Promise<AgentRuntime>;
+export declare const agentRuntimeTesting: {
+    connectWithTransport: typeof connectWithTransport;
+    recoverWithTransport: typeof recoverWithTransport;
+    Lifecycle: typeof Lifecycle;
+    fingerprint: typeof fingerprint;
+};
+export {};