@layervai/qurl 2.0.0 → 3.0.0

package/README.md

@@ -590,7 +590,9 @@ console.log(`Access granted to ${access.target_url} for ${access.access_grant?.e
 | `createApiKey(input)` / `listApiKeys(input?)` / `listAllApiKeys(input?)` / `updateApiKey(id, input)` / `revokeApiKey(id)` | API key management |
 | `createAccessCode(input)` / `listAccessCodes()` / `redeemAccessCode(input)` / `revokeAccessCode(id)` | Access code management |
 
-`listResourceSessions(id)` and `listAccessCodes()` reflect currently unpaginated service endpoints. Their outputs always return `has_more: false`; if the service starts surfacing cursor metadata, the SDK emits a debug log rather than exposing an unactionable next-page signal.
+`listResourceSessions(id)` opts in to bounded pages with `paged=true` and collects every service page, including empty intermediate pages, and returns `has_more: false`. Its `request_id` and `page_size` describe the last page. `terminateAllResourceSessions(id)` follows every page and sums closed sessions. Termination is not atomic: an error can occur after some sessions close. List sessions to reconcile before retrying; a retry can also close newly admitted sessions and counts only its own changes. A successful call returns the last page’s `request_id`.
+
+`listAccessCodes()` remains unpaginated. It returns `has_more: false` and logs unexpected cursor metadata.
 
 `listAll*()` methods validate ids and query params when called, before the async iterator is consumed. Wrap the `listAll*()` call itself in `try/catch` when passing dynamic input.
 
@@ -968,3 +970,30 @@ peer: registration, restart, relocation, exact retirement, and credential recove
 This checks protocol interoperability; the peer is not a sandbox authority.
 Shared conformance vectors cover assignment, registration,
 OTP, and completion packet construction and reply decryption.
+
+
+### Private consumer policies
+
+`createResource` accepts `private: true` and `consumer_access` with mode
+`keys`, `invite_only`, `email_capture`, `review` or `contract`, and version `1`.
+`updateResource` changes the policy with `expected_consumer_access_version` and
+the next version. Send policy changes separately from metadata updates.
+
+For a URL, `protectUrl(url, { consumerAccess: { mode: "invite_only", version: 1 } })`
+creates the private resource and checks the returned policy. For a local
+Connector, pass the policy as the third argument to `ensureConnectorResource`.
+A private policy cannot be combined with public access. A service that ignores
+the requested policy is refused.
+
+Publisher methods are `inviteConsumer`, `listConsumerInvitations`,
+`resendConsumerInvitation`, `revokeConsumerInvitation`, `listConsumerGrants`,
+`approveConsumerGrant`, `denyConsumerGrant` and `revokeConsumerGrant`. Decisions
+use the version read from the invitation or grant. Lists return the usual
+`nextCursor`. Contract entitlement approval requires a trusted publisher backend
+receipt and expiry; the SDK does not verify payment. Contract replies omit email
+and globally reusable credential data.
+
+A removal receipt reports `session_cleanup: pending` until connection cleanup
+is confirmed. Retry the same removal and version to confirm `complete`. These
+APIs require the matching service feature and remain off by default during
+integration. Consumer Noise enrollment and browser access are in the NHP agent.

package/dist/cjs/client.d.ts

@@ -1,5 +1,5 @@
 import { ShareLink } from "./share.js";
-import type { AccessCodeListOutput, ApiKey, ApiKeyListOutput, ApiKeyRequestScope, BillingInvoiceListOutput, BatchCreateInput, BatchCreateOutput, ClientOptions, ConnectorInstallation, ConnectorInstallationListOutput, CreateAccessCodeInput, CreateAccessCodeOutput, CreateApiKeyInput, CreateApiKeyOutput, CreateBillingCheckoutInput, CreateDelegatedQurlBatchInput, CreateDelegatedQurlBatchOptions, CreateInput, CreateOutput, CreatePortalOptions, CreateQurlForResourceInput, CreateResourceInput, CreateWebhookInput, Customer, CheckoutSession, Domain, DomainListOutput, DomainVerifyResult, DelegatedQurl, DelegatedQurlBatchAccepted, GetDelegatedQurlBatchOptions, GetDelegatedQurlBatchOutput, ExtendInput, Invoice, ListInput, ListOutput, ListApiKeysInput, ListBillingInvoicesInput, ListConnectorInstallationsInput, ListDomainsInput, ListWebhookDeliveriesInput, ListWebhooksInput, MintInput, MintOutput, Portal, PortalSession, ProtectUrlOptions, QURL, QurlSummary, Quota, RedeemAccessCodeInput, RedeemAccessCodeOutput, RegisterDomainInput, Resource, ResourceDetail, ResourceHandle, ResourceListInput, ResourceListOutput, RequestOptions, ResolveInput, ResolveOutput, SessionListOutput, SessionTerminateOutput, ShareResourceOptions, UpdateApiKeyInput, UpdateCustomerInput, UpdateInput, UpdateResourceInput, UpdateResourceQurlInput, UpdateWebhookInput, UsageCurrentPeriod, UsageDaily, Webhook, WebhookDelivery, WebhookDeliveryListOutput, WebhookEventTypeInfo, WebhookListOutput, WebhookWithSecret } from "./types.js";
+import type { ConsumerAccessPolicy, ConsumerInvitation, ConsumerGrant, ConsumerGrantApprovalInput, ConsumerListInput, ConsumerInvitationListOutput, ConsumerGrantListOutput, AccessCodeListOutput, ApiKey, ApiKeyListOutput, ApiKeyRequestScope, BillingInvoiceListOutput, BatchCreateInput, BatchCreateOutput, ClientOptions, ConnectorInstallation, ConnectorInstallationListOutput, CreateAccessCodeInput, CreateAccessCodeOutput, CreateApiKeyInput, CreateApiKeyOutput, CreateBillingCheckoutInput, CreateDelegatedQurlBatchInput, CreateDelegatedQurlBatchOptions, CreateInput, CreateOutput, CreatePortalOptions, CreateQurlForResourceInput, CreateResourceInput, CreateWebhookInput, Customer, CheckoutSession, Domain, DomainListOutput, DomainVerifyResult, DelegatedQurl, DelegatedQurlBatchAccepted, GetDelegatedQurlBatchOptions, GetDelegatedQurlBatchOutput, ExtendInput, Invoice, ListInput, ListOutput, ListApiKeysInput, ListBillingInvoicesInput, ListConnectorInstallationsInput, ListDomainsInput, ListWebhookDeliveriesInput, ListWebhooksInput, MintInput, MintOutput, Portal, PortalSession, ProtectUrlOptions, QURL, QurlSummary, Quota, RedeemAccessCodeInput, RedeemAccessCodeOutput, RegisterDomainInput, Resource, ResourceDetail, ResourceHandle, ResourceListInput, ResourceListOutput, RequestOptions, ResolveInput, ResolveOutput, SessionListOutput, SessionTerminateOutput, ShareResourceOptions, UpdateApiKeyInput, UpdateCustomerInput, UpdateInput, UpdateResourceInput, UpdateResourceQurlInput, UpdateWebhookInput, UsageCurrentPeriod, UsageDaily, Webhook, WebhookDelivery, WebhookDeliveryListOutput, WebhookEventTypeInfo, WebhookListOutput, WebhookWithSecret } from "./types.js";
 /** Narrow a response scope before reusing it in a create/update request. */
 export declare function isApiKeyRequestScope(scope: string): scope is ApiKeyRequestScope;
 /**
@@ -96,7 +96,7 @@ export declare class QURLClient {
      */
     resourceByCrid(id: string): ProtectedResource;
     /** Find or create the active qURL Connector resource for an immutable slug. */
-    ensureConnectorResource(slug: string, requestOptions?: RequestOptions): Promise<EnsureConnectorResourceResult>;
+    ensureConnectorResource(slug: string, requestOptions?: RequestOptions, consumerAccess?: ConsumerAccessPolicy): Promise<EnsureConnectorResourceResult>;
     /** Fetch a qURL Connector resource by its CRID. */
     getConnectorResource(crid: string): Promise<ConnectorResource>;
     /** Fetch the single active qURL Connector resource for an immutable slug. */
@@ -358,6 +358,22 @@ export declare class QURLClient {
     getResource(id: string): Promise<ResourceDetail>;
     /** Update resource metadata. */
     updateResource(id: string, input: UpdateResourceInput, options?: RequestOptions): Promise<Resource>;
+    /** Send a publisher-only invitation. Mail delivery does not prove enrollment. */
+    inviteConsumer(id: string, email: string): Promise<ConsumerInvitation>;
+    listConsumerInvitations(id: string, input?: ConsumerListInput): Promise<ConsumerInvitationListOutput>;
+    listConsumerGrants(id: string, input?: ConsumerListInput): Promise<ConsumerGrantListOutput>;
+    resendConsumerInvitation(id: string, invitationId: string, expectedVersion: number): Promise<ConsumerInvitation>;
+    /** Remove the invitation and its grant. Inspect session_cleanup before reporting stream removal. */
+    revokeConsumerInvitation(id: string, invitationId: string, expectedVersion: number): Promise<ConsumerInvitation>;
+    /** Review approval, key opt-in with grantId new, or trusted publisher entitlement. */
+    approveConsumerGrant(id: string, grantId: string, input: ConsumerGrantApprovalInput): Promise<ConsumerGrant>;
+    denyConsumerGrant(id: string, grantId: string, expectedVersion: number): Promise<ConsumerGrant>;
+    revokeConsumerGrant(id: string, grantId: string, expectedVersion: number): Promise<ConsumerGrant>;
+    /**
+     * Revoke an API resource identifier retained by a client migrating to CRIDs.
+     * New callers should use deleteResource with the resource CRID.
+     */
+    deleteResourceByIdentifier(id: string): Promise<void>;
     /** Revoke a resource and all of its qURLs. */
     deleteResource(id: string): Promise<void>;
     /**
@@ -377,15 +393,13 @@ export declare class QURLClient {
     revokeResourceQurl(id: string, qurlId: string): Promise<void>;
     /** Update a specific qURL token on a resource. */
     updateResourceQurl(id: string, qurlId: string, input: UpdateResourceQurlInput, options?: RequestOptions): Promise<QurlSummary>;
+    /** List every active session, following bounded service pages. */
+    listResourceSessions(id: string): Promise<SessionListOutput>;
     /**
-     * List active access sessions for a resource.
-     *
-     * The current API contract has no cursor query params for this endpoint.
-     * If the service later advertises pagination metadata, the SDK returns
-     * this page and emits a debug log rather than pretending it fetched all pages.
+     * End every session page. This is not atomic: a failed page throws after earlier
+     * pages may have closed sessions. List sessions to reconcile, then retry the call.
+     * A retry can close newly admitted sessions and counts only its own transitions.
      */
-    listResourceSessions(id: string): Promise<SessionListOutput>;
-    /** Terminate all active sessions for a resource and return the server count. */
     terminateAllResourceSessions(id: string): Promise<SessionTerminateOutput>;
     /** Terminate a specific resource session. */
     terminateResourceSession(id: string, sessionId: string): Promise<void>;

package/dist/cjs/client.js

@@ -175,6 +175,8 @@ const RESOURCE_LIST_PARAM_KEYS = [
 ];
 assertExhaustive(true);
 const CREATE_RESOURCE_FIELD_KEYS = [
+    "private",
+    "consumer_access",
     "type",
     "target_url",
     "description",
@@ -186,6 +188,8 @@ const CREATE_RESOURCE_FIELD_KEYS = [
 ];
 assertExhaustive(true);
 const UPDATE_RESOURCE_FIELD_KEYS = [
+    "consumer_access",
+    "expected_consumer_access_version",
     "description",
     "tags",
     "custom_domain",
@@ -214,6 +218,8 @@ assertExhaustive(true);
  * fields the REST-shaped methods send.
  */
 const PROTECT_URL_OPTION_KEYS = [
+    "private",
+    "consumerAccess",
     "description",
     "tags",
     "customDomain",
@@ -1740,6 +1746,13 @@ function normalizePatchFields(input, fields, options = {}) {
     }
     return normalized;
 }
+function requireConsumerDecision(id, version, allowNew = false) {
+    if (typeof id !== "string" ||
+        (!/^[a-f0-9]{64}$/.test(id) && !(allowNew && id === "new")) ||
+        !Number.isSafeInteger(version) ||
+        version < (allowNew ? 0 : 1))
+        throw clientValidationError("consumer decision: invalid id or expected version");
+}
 function validateResourceWriteFields(input, options = {}) {
     const errors = [];
     const collect = (fn) => {
@@ -1754,6 +1767,50 @@ function validateResourceWriteFields(input, options = {}) {
             throw err;
         }
     };
+    collect(() => {
+        if (input.private !== undefined && typeof input.private !== "boolean") {
+            throw clientValidationError("private: must be a boolean");
+        }
+        if (input.consumer_access !== undefined) {
+            const policy = input.consumer_access;
+            requireObjectInput(policy, "consumer_access");
+            const p = policy;
+            requireNoUnknownFields(p, ["mode", "version", "contract_id"], "consumer_access");
+            if (!["keys", "invite_only", "email_capture", "review", "contract"].includes(p.mode) ||
+                !Number.isSafeInteger(p.version) ||
+                p.version < 1) {
+                throw clientValidationError("consumer_access: invalid mode or version");
+            }
+            if (p.mode === "contract") {
+                if (typeof p.contract_id !== "string" ||
+                    !p.contract_id.trim() ||
+                    new TextEncoder().encode(p.contract_id).length > 128) {
+                    throw clientValidationError("consumer_access: contract mode requires a bounded contract_id");
+                }
+            }
+            else if (p.contract_id !== undefined) {
+                throw clientValidationError("consumer_access: contract_id requires contract mode");
+            }
+            if (input.private === false)
+                throw clientValidationError("consumer_access: requires a private resource");
+            if (options.requireUrlTarget) {
+                if (p.version !== 1 || input.private !== true)
+                    throw clientValidationError("consumer_access: creation requires private true and version one");
+            }
+            else if (options.allowAliasClear) {
+                const expected = input.expected_consumer_access_version;
+                if (!Number.isSafeInteger(expected) ||
+                    expected < 0 ||
+                    p.version !== expected + 1 ||
+                    Object.keys(input).some((key) => key !== "consumer_access" && key !== "expected_consumer_access_version")) {
+                    throw clientValidationError("consumer_access: update requires its expected version and no metadata changes");
+                }
+            }
+        }
+        else if (input.expected_consumer_access_version !== undefined) {
+            throw clientValidationError("expected_consumer_access_version: requires consumer_access");
+        }
+    });
     const resourceType = input.type;
     if (resourceType !== undefined && typeof resourceType !== "string") {
         errors.push(`type: must be a string (got ${resourceType === null ? "null" : typeof resourceType})`);
@@ -2426,6 +2483,12 @@ class QURLClient {
         // SDK-wide normalizePatchFields convention.
         const normalized = normalizePatchFields(opts, PROTECT_URL_OPTION_KEYS);
         const body = { target_url: targetUrl };
+        if (normalized.private !== undefined)
+            body.private = normalized.private;
+        if (normalized.consumerAccess !== undefined) {
+            body.private = normalized.private ?? true;
+            body.consumer_access = normalized.consumerAccess;
+        }
         if (normalized.description !== undefined)
             body.description = normalized.description;
         if (normalized.tags !== undefined)
@@ -2434,9 +2497,19 @@ class QURLClient {
             body.custom_domain = normalized.customDomain;
         if (normalized.alias !== undefined)
             body.alias = normalized.alias;
-        validateResourceWriteFields(body);
-        const resource = await this.request("POST", "/v1/resources", body, requestOptions);
+        validateResourceWriteFields(body, { requireUrlTarget: true });
+        const response = await this.rawRequest("POST", "/v1/resources", body, {
+            requestOptions,
+        });
+        if (response.__http_status === 204)
+            throw unexpectedResponseError("protectUrl: expected a resource response body");
+        const resource = response.data;
         await verifyResourceIdentity(resource, "protectUrl");
+        if (normalized.consumerAccess &&
+            (resource.private !== true ||
+                !sameConsumerPolicy(resource.consumer_access, normalized.consumerAccess, response.meta?.found_existing === true))) {
+            throw unexpectedResponseError("protectUrl: private policy was not confirmed");
+        }
         return new ProtectedResource(this, resource.crid, 
         // Some resource types redact target_url in responses; fall back to
         // the caller-supplied URL so the handle stays useful.
@@ -2462,8 +2535,13 @@ class QURLClient {
         return new ProtectedResource(this, id);
     }
     /** Find or create the active qURL Connector resource for an immutable slug. */
-    async ensureConnectorResource(slug, requestOptions) {
+    async ensureConnectorResource(slug, requestOptions, consumerAccess) {
         requireConnectorSlug(slug, "ensureConnectorResource");
+        if (consumerAccess !== undefined) {
+            validateResourceWriteFields({ consumer_access: consumerAccess, private: true });
+            if (consumerAccess.version !== 1)
+                throw clientValidationError("consumer_access: creation requires version one");
+        }
         // Response validation imports the producer's P-256 resource key. Preflight
         // before POST so a missing runtime capability cannot orphan a committed row.
         requireConnectorSubtleCrypto("ensureConnectorResource");
@@ -2478,12 +2556,18 @@ class QURLClient {
                 type: "tunnel",
                 slug,
                 find_or_create: true,
+                ...(consumerAccess ? { private: true, consumer_access: consumerAccess } : {}),
             }, { requestOptions, retry: false, generateIdempotencyKey: false });
             // The find-or-create endpoint returns 201 for both newly-created
             // and found-existing rows; meta.found_existing distinguishes the arms.
             if (response.__http_status !== 201) {
                 throw unexpectedResponseError(`ensureConnectorResource: expected HTTP 201, got ${response.__http_status ?? "unknown"}`);
             }
+            if (consumerAccess &&
+                (response.data.private !== true ||
+                    !sameConsumerPolicy(response.data.consumer_access, consumerAccess, response.meta?.found_existing === true))) {
+                throw unexpectedResponseError("ensureConnectorResource: private policy was not confirmed");
+            }
             resource = await parseConnectorResource(this, response.data, "ensureConnectorResource", {
                 slug,
             });
@@ -3270,6 +3354,76 @@ class QURLClient {
         });
         return this.request("PATCH", `/v1/resources/${encodeURIComponent(id)}`, validationInput, options);
     }
+    /** Send a publisher-only invitation. Mail delivery does not prove enrollment. */
+    async inviteConsumer(id, email) {
+        requireResourceCrid(id, "inviteConsumer");
+        requireNonEmptyIfPresent(email, "email");
+        if (typeof email !== "string" || email.length > 320)
+            throw clientValidationError("email: must be a bounded string");
+        return this.request("POST", `/v1/resources/${encodeURIComponent(id)}/invitations`, { email });
+    }
+    async listConsumerInvitations(id, input = {}) {
+        requireResourceCrid(id, "listConsumerInvitations");
+        const { data, meta } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/invitations`, input, ["cursor", "limit"], "listConsumerInvitations"));
+        return pageFromMeta({ invitations: data ?? [] }, meta);
+    }
+    async listConsumerGrants(id, input = {}) {
+        requireResourceCrid(id, "listConsumerGrants");
+        const { data, meta } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/consumer-grants`, input, ["cursor", "limit"], "listConsumerGrants"));
+        return pageFromMeta({ grants: data ?? [] }, meta);
+    }
+    async resendConsumerInvitation(id, invitationId, expectedVersion) {
+        requireResourceCrid(id, "resendConsumerInvitation");
+        requireConsumerDecision(invitationId, expectedVersion);
+        return this.request("POST", `/v1/resources/${encodeURIComponent(id)}/invitations/${encodeURIComponent(invitationId)}/resend`, { expected_version: expectedVersion });
+    }
+    /** Remove the invitation and its grant. Inspect session_cleanup before reporting stream removal. */
+    async revokeConsumerInvitation(id, invitationId, expectedVersion) {
+        requireResourceCrid(id, "revokeConsumerInvitation");
+        requireConsumerDecision(invitationId, expectedVersion);
+        return this.request("DELETE", `/v1/resources/${encodeURIComponent(id)}/invitations/${encodeURIComponent(invitationId)}?expected_version=${expectedVersion}`);
+    }
+    /** Review approval, key opt-in with grantId new, or trusted publisher entitlement. */
+    async approveConsumerGrant(id, grantId, input) {
+        requireResourceCrid(id, "approveConsumerGrant");
+        requireObjectInput(input, "approveConsumerGrant");
+        requireNoUnknownFields(input, [
+            "expected_version",
+            "credential_kind",
+            "credential_id",
+            "credential_public_key_b64",
+            "entitlement_id",
+            "expires_at",
+        ], "approveConsumerGrant");
+        requireConsumerDecision(grantId, input.expected_version, grantId === "new");
+        return this.request("POST", `/v1/resources/${encodeURIComponent(id)}/consumer-grants/${encodeURIComponent(grantId)}/approve`, input);
+    }
+    async denyConsumerGrant(id, grantId, expectedVersion) {
+        requireResourceCrid(id, "denyConsumerGrant");
+        requireConsumerDecision(grantId, expectedVersion);
+        return this.request("POST", `/v1/resources/${encodeURIComponent(id)}/consumer-grants/${encodeURIComponent(grantId)}/deny`, { expected_version: expectedVersion });
+    }
+    async revokeConsumerGrant(id, grantId, expectedVersion) {
+        requireResourceCrid(id, "revokeConsumerGrant");
+        requireConsumerDecision(grantId, expectedVersion);
+        return this.request("DELETE", `/v1/resources/${encodeURIComponent(id)}/consumer-grants/${encodeURIComponent(grantId)}?expected_version=${expectedVersion}`);
+    }
+    /**
+     * Revoke an API resource identifier retained by a client migrating to CRIDs.
+     * New callers should use deleteResource with the resource CRID.
+     */
+    async deleteResourceByIdentifier(id) {
+        if (typeof id !== "string")
+            throw clientValidationError("id: invalid resource identifier");
+        if (/^r_[a-z0-9_-]{11}$/.test(id)) {
+            await this.requestNoContent(`/v1/qurls/${encodeURIComponent(id)}`);
+            return;
+        }
+        const publicKey = /^[A-Za-z0-9_-]{107,214}$/.test(id) && id.length % 4 !== 1;
+        if (!publicKey)
+            requireResourceCrid(id, "deleteResourceByIdentifier");
+        await this.requestNoContent(`/v1/resources/${encodeURIComponent(id)}`);
+    }
     /** Revoke a resource and all of its qURLs. */
     async deleteResource(id) {
         requireResourceCrid(id, "deleteResource");
@@ -3376,43 +3530,63 @@ class QURLClient {
         validateResourceQurlUpdateInput(normalized);
         return this.request("PATCH", `/v1/resources/${encodeURIComponent(id)}/qurls/${encodeURIComponent(qurlId)}`, normalized, options);
     }
-    /**
-     * List active access sessions for a resource.
-     *
-     * The current API contract has no cursor query params for this endpoint.
-     * If the service later advertises pagination metadata, the SDK returns
-     * this page and emits a debug log rather than pretending it fetched all pages.
-     */
+    /** List every active session, following bounded service pages. */
     async listResourceSessions(id) {
         requireResourceCrid(id, "listResourceSessions");
-        const { data, meta } = await this.rawRequest("GET", `/v1/resources/${encodeURIComponent(id)}/sessions`);
-        if (meta?.has_more || meta?.next_cursor) {
-            this.log("listResourceSessions: pagination metadata surfaced on unpaginated endpoint", {
-                has_more: meta.has_more,
-                next_cursor: meta.next_cursor,
-            });
+        const sessions = [];
+        let request_id;
+        let page_size;
+        for await (const session of this.paginateAll("listResourceSessions", {}, async ({ cursor }) => {
+            const { data, meta } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/sessions`, { paged: "true", cursor }, ["paged", "cursor"], "listResourceSessions"));
+            if (meta?.has_more && !meta.next_cursor) {
+                throw unexpectedResponseError("Session page has no continuation cursor", {
+                    requestId: meta.request_id,
+                });
+            }
+            request_id = meta?.request_id;
+            page_size = meta?.page_size;
+            return { ...meta, sessions: data ?? [] };
+        }, (page) => page.sessions)) {
+            sessions.push(session);
         }
-        return {
-            sessions: data ?? [],
-            request_id: meta?.request_id,
-            has_more: false,
-            page_size: meta?.page_size,
-        };
+        return { sessions, request_id, has_more: false, page_size };
     }
-    /** Terminate all active sessions for a resource and return the server count. */
+    /**
+     * End every session page. This is not atomic: a failed page throws after earlier
+     * pages may have closed sessions. List sessions to reconcile, then retry the call.
+     * A retry can close newly admitted sessions and counts only its own transitions.
+     */
     async terminateAllResourceSessions(id) {
         requireResourceCrid(id, "terminateAllResourceSessions");
         const path = `/v1/resources/${encodeURIComponent(id)}/sessions`;
-        const { data, meta, __http_status } = await this.rawRequest("DELETE", path);
-        if (__http_status === 204) {
-            throw unexpectedResponseError(`Unexpected 204 No Content from DELETE ${path}; expected response body`);
-        }
-        if (data?.terminated === undefined) {
-            this.log("terminateAllResourceSessions: missing terminated count; defaulting to zero", {
-                request_id: meta?.request_id,
-            });
+        let terminated = 0;
+        let request_id;
+        for await (const count of this.paginateAll("terminateAllResourceSessions", {}, async ({ cursor }) => {
+            const { data, meta, __http_status } = await this.rawRequest("DELETE", appendQuery(path, { paged: "true", cursor }, ["paged", "cursor"], "terminateAllResourceSessions"));
+            if (__http_status === 204) {
+                throw unexpectedResponseError(`Unexpected 204 No Content from DELETE ${path}; expected response body`, { status: 204, requestId: meta?.request_id });
+            }
+            if (meta?.has_more && !meta.next_cursor) {
+                throw unexpectedResponseError("Session page has no continuation cursor", {
+                    requestId: meta.request_id,
+                });
+            }
+            if (data?.terminated === undefined) {
+                this.log("terminateAllResourceSessions: missing terminated count; defaulting to zero", {
+                    request_id: meta?.request_id,
+                });
+            }
+            else if (!Number.isSafeInteger(data.terminated) || data.terminated < 0) {
+                throw unexpectedResponseError("terminateAllResourceSessions: invalid terminated count", {
+                    requestId: meta?.request_id,
+                });
+            }
+            request_id = meta?.request_id;
+            return { ...meta, counts: [data?.terminated ?? 0] };
+        }, (page) => page.counts)) {
+            terminated += count;
         }
-        return { terminated: data?.terminated ?? 0, request_id: meta?.request_id };
+        return { terminated, request_id };
     }
     /** Terminate a specific resource session. */
     async terminateResourceSession(id, sessionId) {
@@ -4294,3 +4468,11 @@ class ConnectorResource {
     }
 }
 exports.ConnectorResource = ConnectorResource;
+function sameConsumerPolicy(actual, expected, foundExisting) {
+    return (actual?.mode === expected.mode &&
+        (actual?.version === expected.version ||
+            (foundExisting &&
+                Number.isSafeInteger(actual?.version) &&
+                Number(actual?.version) > expected.version)) &&
+        actual?.contract_id === expected.contract_id);
+}

package/dist/cjs/index.d.ts

@@ -4,4 +4,4 @@ export { CRIDVerificationError, ShareLink } from "./share.js";
 export type { CRIDVerificationErrorCode, ShareLinkInit, ShareLinkJSON } from "./share.js";
 export { AuthenticationError, AuthorizationError, ConnectorResourceOutcomeUnknownError, createError, DelegatedBatchOutcomeUnknownError, ERROR_CODE_AMBIGUOUS_RESOURCE, ERROR_CODE_CLIENT_VALIDATION, ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN, ERROR_CODE_CONNECTOR_RESOURCE_REVOKED, ERROR_CODE_CRID_MISMATCH, ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN, ERROR_CODE_INVALID_CRID, ERROR_CODE_INVALID_CRID_KEY, ERROR_CODE_MISSING_CRID, ERROR_CODE_NETWORK, ERROR_CODE_RESOURCE_NOT_FOUND, ERROR_CODE_RUNTIME, ERROR_CODE_TIMEOUT, ERROR_CODE_UNEXPECTED_RESPONSE, ERROR_CODE_UNKNOWN, NetworkError, NotFoundError, QURLError, RateLimitError, RuntimeError, ServerError, TimeoutError, ValidationError, } from "./errors.js";
 export { VERSION } from "./version.js";
-export type { AccessCode, AccessCodeListOutput, AccessGrant, AccessPolicy, AccessToken, AIAgentCategory, AIAgentPolicy, ApiKey, ApiKeyListOutput, ApiKeyRequestScope, ApiKeyScope, BatchCreateInput, BatchCreateOutput, BatchItemFailure, BatchItemResult, BatchItemSuccess, BillingInvoiceListOutput, ClientOptions, ConnectorInstallation, ConnectorInstallationCapabilities, ConnectorInstallationListOutput, ConnectorInstallationStats, CreateAccessCodeInput, CreateAccessCodeOutput, CreateApiKeyInput, CreateApiKeyOutput, CreateDurableApiKeyInput, CreateEnrollmentTokenInput, CreateBillingCheckoutInput, CreateDelegatedQurlBatchInput, CreateDelegatedQurlBatchOptions, CreateInput, CreateOutput, CreatePortalOptions, CreateQurlForResourceInput, CreateResourceInput, CreateWebhookInput, CredentialClaim, CredentialClaimInput, CredentialKind, CredentialTarget, CredentialTargetInput, Customer, CheckoutSession, DnsRecord, Domain, DomainCheckDetail, DomainListOutput, DomainVerifyResult, DelegatedQurl, DelegatedQurlBatchAccepted, DelegatedQurlBatchItemFailure, DelegatedQurlBatchItemResult, DelegatedQurlBatchItemSuccess, DelegatedQurlBatchNotModified, DelegatedQurlBatchPending, DelegatedQurlBatchStatus, DelegatedQurlBatchTerminal, DelegatedQurlCreatedData, DelegatedQurlGrant, ExtendInput, Invoice, GetDelegatedQurlBatchOptions, GetDelegatedQurlBatchOutput, ListApiKeysInput, ListBillingInvoicesInput, ListConnectorInstallationsInput, ListDomainsInput, ListInput, ListOutput, ListWebhooksInput, ListWebhookDeliveriesInput, Meta, MintInput, MintOutput, PaginatedOutput, Portal, PortalSession, ProtectUrlOptions, QURL, QURLErrorData, QurlSummary, Quota, RedeemAccessCodeInput, RedeemAccessCodeOutput, RegisterDomainInput, Resource, ResourceDetail, ResourceHandle, ResourceListInput, ResourceListOutput, ResourceType, RequestOptions, ResolveInput, ResolveOutput, Session, SessionListOutput, SessionTerminateOutput, ShareResourceOptions, TombstoneInfo, UnpaginatedOutput, UpdateApiKeyInput, UpdateCustomerInput, UpdateInput, UpdateResourceInput, UpdateResourceQurlInput, UpdateWebhookInput, UsageCostEstimate, UsageCurrentPeriod, UsageDaily, UsageDailyEntry, Webhook, WebhookDelivery, WebhookDeliveryListOutput, WebhookEventType, WebhookEventTypeInfo, WebhookListOutput, WebhookPayload, WebhookWithSecret, } from "./types.js";
+export type { ConsumerAccessPolicy, AccessCode, AccessCodeListOutput, AccessGrant, ConsumerInvitation, ConsumerGrant, ConsumerGrantApprovalInput, ConsumerListInput, ConsumerInvitationListOutput, ConsumerGrantListOutput, AccessPolicy, AccessToken, AIAgentCategory, AIAgentPolicy, ApiKey, ApiKeyListOutput, ApiKeyRequestScope, ApiKeyScope, BatchCreateInput, BatchCreateOutput, BatchItemFailure, BatchItemResult, BatchItemSuccess, BillingInvoiceListOutput, ClientOptions, ConnectorInstallation, ConnectorInstallationCapabilities, ConnectorInstallationListOutput, ConnectorInstallationStats, CreateAccessCodeInput, CreateAccessCodeOutput, CreateApiKeyInput, CreateApiKeyOutput, CreateDurableApiKeyInput, CreateEnrollmentTokenInput, CreateBillingCheckoutInput, CreateDelegatedQurlBatchInput, CreateDelegatedQurlBatchOptions, CreateInput, CreateOutput, CreatePortalOptions, CreateQurlForResourceInput, CreateResourceInput, CreateWebhookInput, CredentialClaim, CredentialClaimInput, CredentialKind, CredentialTarget, CredentialTargetInput, Customer, CheckoutSession, DnsRecord, Domain, DomainCheckDetail, DomainListOutput, DomainVerifyResult, DelegatedQurl, DelegatedQurlBatchAccepted, DelegatedQurlBatchItemFailure, DelegatedQurlBatchItemResult, DelegatedQurlBatchItemSuccess, DelegatedQurlBatchNotModified, DelegatedQurlBatchPending, DelegatedQurlBatchStatus, DelegatedQurlBatchTerminal, DelegatedQurlCreatedData, DelegatedQurlGrant, ExtendInput, Invoice, GetDelegatedQurlBatchOptions, GetDelegatedQurlBatchOutput, ListApiKeysInput, ListBillingInvoicesInput, ListConnectorInstallationsInput, ListDomainsInput, ListInput, ListOutput, ListWebhooksInput, ListWebhookDeliveriesInput, Meta, MintInput, MintOutput, PaginatedOutput, Portal, PortalSession, ProtectUrlOptions, QURL, QURLErrorData, QurlSummary, Quota, RedeemAccessCodeInput, RedeemAccessCodeOutput, RegisterDomainInput, Resource, ResourceDetail, ResourceHandle, ResourceListInput, ResourceListOutput, ResourceType, RequestOptions, ResolveInput, ResolveOutput, Session, SessionListOutput, SessionTerminateOutput, ShareResourceOptions, TombstoneInfo, UnpaginatedOutput, UpdateApiKeyInput, UpdateCustomerInput, UpdateInput, UpdateResourceInput, UpdateResourceQurlInput, UpdateWebhookInput, UsageCostEstimate, UsageCurrentPeriod, UsageDaily, UsageDailyEntry, Webhook, WebhookDelivery, WebhookDeliveryListOutput, WebhookEventType, WebhookEventTypeInfo, WebhookListOutput, WebhookPayload, WebhookWithSecret, } from "./types.js";

package/dist/cjs/types.d.ts

@@ -235,6 +235,8 @@ export interface MintOutput {
 }
 /** Options for `QURLClient.protectUrl`. */
 export interface ProtectUrlOptions {
+    private?: boolean;
+    consumerAccess?: ConsumerAccessPolicy;
     /** Optional resource-level metadata. Max 500 chars. */
     description?: string;
     /** Optional resource-level tags. Max 10 items. */
@@ -356,7 +358,6 @@ export interface Quota {
         list_per_minute?: number;
         resolve_per_minute?: number;
         max_active_qurls?: number;
-        max_tokens_per_qurl?: number;
         max_expiry_seconds?: number;
     };
     usage?: {
@@ -509,8 +510,16 @@ export interface DelegatedQurl {
     session_duration: number;
     access_policy?: AccessPolicy;
 }
+/** Private resource policy. Contract fulfillment comes from the publisher backend. */
+export interface ConsumerAccessPolicy {
+    mode: "keys" | "invite_only" | "email_capture" | "review" | "contract";
+    version: number;
+    contract_id?: string;
+}
 /** Input for creating a resource directly. */
 export interface CreateResourceInput {
+    private?: boolean;
+    consumer_access?: ConsumerAccessPolicy;
     type?: ResourceType;
     target_url?: string;
     description?: string;
@@ -522,6 +531,8 @@ export interface CreateResourceInput {
 }
 /** Input for updating resource metadata. */
 export interface UpdateResourceInput {
+    consumer_access?: ConsumerAccessPolicy;
+    expected_consumer_access_version?: number;
     description?: string;
     tags?: string[];
     /** Omit to leave unchanged; send `""` to clear. `null` is not a clear signal. */
@@ -532,6 +543,9 @@ export interface UpdateResourceInput {
 }
 /** Resource data returned by the `/v1/resources` surface. */
 export interface Resource {
+    private?: boolean;
+    consumer_access?: ConsumerAccessPolicy;
+    consumer_access_version?: number;
     resource_id: string;
     /** Cryptographic Resource ID derived from the resource public key. */
     crid?: string;
@@ -632,13 +646,13 @@ export interface UnpaginatedOutput {
     has_more: false;
     page_size?: number;
 }
-export interface SessionListOutput extends UnpaginatedOutput {
-    /**
-     * Active sessions. The current OpenAPI contract has no cursor query params;
-     * if pagination metadata appears, the SDK surfaces it for observability but
-     * returns this page only.
-     */
+/** All session pages collected by the SDK; request_id and page_size describe the last page. */
+export interface SessionListOutput {
     sessions: Session[];
+    request_id?: string;
+    /** Always false because the SDK follows every page; retained for compatibility. */
+    has_more: false;
+    page_size?: number;
 }
 export interface SessionTerminateOutput {
     terminated: number;
@@ -775,7 +789,7 @@ export interface DomainVerifyResult {
         traffic_routing?: DomainCheckDetail;
     };
 }
-export type WebhookEventType = OpenString<"qurl.created" | "qurl.expired" | "qurl.revoked" | "qurl.updated" | "resource.closed" | "qurl.accessed" | "qurl.access_denied" | "qurl.token_exhausted" | "quota.warning" | "quota.exceeded" | "token.minted" | "token.expired" | "domain.verified" | "domain.failed" | "domain.deleted">;
+export type WebhookEventType = OpenString<"qurl.created" | "qurl.expired" | "qurl.revoked" | "qurl.updated" | "resource.closed" | "qurl.accessed" | "consumer.subscribed" | "qurl.access_denied" | "qurl.token_exhausted" | "quota.warning" | "quota.exceeded" | "token.minted" | "token.expired" | "domain.verified" | "domain.failed" | "domain.deleted">;
 export interface CreateWebhookInput {
     /** Webhook receiver URL. The service accepts public http/https URLs; prefer https in production. */
     url: string;
@@ -1019,4 +1033,46 @@ export interface ClientOptions {
     /** Enable debug logging. Pass `true` for console.debug, or a custom callback. */
     debug?: boolean | ((message: string, data?: Record<string, unknown>) => void);
 }
+/** Publisher-only invitation status; no link secret is returned. */
+export interface ConsumerInvitation {
+    id: string;
+    email: string;
+    status: "open" | "enrolled" | "revoked";
+    delivery: "queued" | "accepted" | "failed";
+    version: number;
+    expires_at: string;
+    session_cleanup?: "pending" | "complete";
+}
+/** Resource-scoped consumer decision. Contract mode omits identity. */
+export interface ConsumerGrant {
+    id: string;
+    status: "pending" | "active" | "revoked";
+    version: number;
+    credential_kind?: "passkey" | "device";
+    credential_id?: string;
+    credential_public_key_b64?: string;
+    email?: string;
+    email_verified_at?: string;
+    entitlement_id?: string;
+    expires_at?: string;
+    session_cleanup?: "pending" | "complete";
+}
+export interface ConsumerGrantApprovalInput {
+    expected_version: number;
+    credential_kind?: "passkey" | "device";
+    credential_id?: string;
+    credential_public_key_b64?: string;
+    entitlement_id?: string;
+    expires_at?: string;
+}
+export interface ConsumerListInput {
+    cursor?: string;
+    limit?: number;
+}
+export interface ConsumerInvitationListOutput extends PaginatedOutput {
+    invitations: ConsumerInvitation[];
+}
+export interface ConsumerGrantListOutput extends PaginatedOutput {
+    grants: ConsumerGrant[];
+}
 export {};

package/dist/cjs/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "2.0.0";
+export declare const VERSION = "3.0.0";

package/dist/cjs/version.js

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
-exports.VERSION = "2.0.0"; // x-release-please-version
+exports.VERSION = "3.0.0"; // x-release-please-version