@layervai/qurl 3.1.0 → 4.0.0

package/README.md

@@ -1,37 +1,127 @@
-# @layervai/qurl
+# qURL TypeScript and Node.js SDK
 
 [![npm](https://img.shields.io/npm/v/@layervai/qurl)](https://www.npmjs.com/package/@layervai/qurl)
 [![CI](https://github.com/layervai/qurl-typescript/actions/workflows/ci.yml/badge.svg)](https://github.com/layervai/qurl-typescript/actions/workflows/ci.yml)
 [![License](https://img.shields.io/github/license/layervai/qurl-typescript)](LICENSE)
 
-**Use the LayerV [qURL™ Platform](https://docs.layerv.ai) from TypeScript: protect a
-private URL once, then mint short-lived portal links for it.**
+Use [qURL™ by LayerV](https://layerv.ai/qurl/) to share localhost web apps,
+private APIs, and files through expiring access links. This
+[TypeScript and Node.js SDK](https://layerv.ai/sdk/) creates and manages access
+from JavaScript or TypeScript. Use the
+`@layervai/qurl` package in a service or automation script to register
+resources, choose a link lifetime, and manage resource access.
 
-> **Quantum URL (qURL)** · The internet has a hidden layer. This is how you enter.
+For a local app, [publish it with the CLI](https://github.com/layervai/qurl-integrations/tree/main/apps/cli)
+or configure a connector before issuing links. Creating an access link does
+not start the app or close any separate public route to it. Your app's own
+sign-in still applies.
 
 Portal recipients do not need LayerV credentials, API keys, or SDK state. They
 open the qURL link. Credentials are only for software that protects URLs or
 creates portals.
 
-## Why qURL?
+[Installation](#installation) · [Quickstart](#quickstart) ·
+[Opening received links](#opening-portals) · [API reference](#api) ·
+[Resource and token management](#rest-shaped-api-compatibility)
+
+[Local preview workflow](#share-a-localhost-preview-from-nodejs) ·
+[File-sharing workflows](#share-files-from-a-nodejs-workflow) ·
+[Sharing questions](#typescript-and-nodejs-sharing-questions) · [Private links](https://qurl.link/)
+
+## Share a localhost preview from Node.js
+
+Use `@layervai/qurl` when a Node.js backend or automation job should issue
+temporary access to a preview, internal dashboard, or private API. Publish
+the running local app with the [CLI](https://github.com/layervai/qurl-integrations#share-a-localhost-web-app)
+or configure a compatible Connector before issuing a link from the SDK.
+
+For an existing SDK-managed Connector resource, use its immutable slug to
+look it up and create a portal. Set `QURL_API_KEY` to an issuer credential
+authorized for that resource, and `QURL_CONNECTOR_SLUG` to its configured slug:
+
+```typescript
+import { QURLClient } from '@layervai/qurl';
+
+const apiKey = process.env.QURL_API_KEY;
+const slug = process.env.QURL_CONNECTOR_SLUG;
+if (!apiKey || !slug) {
+  throw new Error('Set QURL_API_KEY and QURL_CONNECTOR_SLUG for your configured resource');
+}
+
+const client = new QURLClient({ apiKey });
+const resource = await client.getConnectorResourceBySlug(slug);
+const portal = await resource.createPortal({ validFor: '5m' });
+console.log(portal.link);
+```
+
+Read-only lookup requires the resource to exist. The API credential must have
+the required lookup and mint permissions. A Connector slug, a CRID, and an
+account key are different things; do not substitute a CLI CRID for the slug
+or assume your API key controls another device's published resource.
+For a preview published solely through the CLI, `qurl share` is the direct
+sharing path until compatible SDK resource management is configured.
+
+Send the full link through a private channel. A browser recipient can use the
+preview without installing the SDK; the app's own login continues to apply.
+The local host, app, and serving runtime must stay available. Existing resource
+handles can also mint links for a specific `targetPath` where the service
+supports it; see [quickstart](#quickstart) for its resource and path constraints.
+
+## Share files from a Node.js workflow
+
+qURL also supports private document and file sharing. The SDK's resource and
+portal calls issue access; they do not upload a file from your process or start
+a localhost server.
+
+| Use case | Serving or upload step | SDK role |
+| --- | --- | --- |
+| Share static preview files | Publish a dedicated localhost HTTP directory with the [CLI](https://github.com/layervai/qurl-integrations#share-files-and-documents). | Automate access only when the service is configured as a compatible resource for your credential; otherwise share through the CLI. |
+| Share a generated PDF or supported image | Use the [MCP upload workflow](https://github.com/layervai/qurl-mcp#let-an-ai-agent-share-a-pdf-or-image) or the [Gmail integration](https://github.com/layervai/qurl-integrations/tree/main/apps/chrome-extension). | Keep the upload service's identifiers, expiry, and revocation contract; its returned file ID is not automatically an SDK Connector resource. |
+| Give automation access to a private file service | Configure and register the service with the appropriate runtime. | Create a portal for the registered resource and use the documented opening and content-request flow. |
+
+For programmatic access, follow [opening portals](#opening-portals), including
+resource binding, HTTP request authorization, and redirect rules. Fetching the
+browser share URL itself does not substitute for that opening flow.
+
+## Choosing a Node.js preview workflow
+
+A Node.js service can issue a qURL link to an authorized, configured resource, establish connectivity with an Agent SDK, or provide a deployed preview. Choose the operation before choosing the package:
+
+| What the reviewer needs | Workflow |
+| --- | --- |
+| Temporary access to the current local app or private API | Publish through the CLI or configure the serving runtime, then use this SDK's resource and portal APIs with the appropriate issuer authority. |
+| An endpoint established from the Node.js process | The [ngrok JavaScript Agent SDK](https://github.com/ngrok/ngrok-javascript) can forward to a local service; configure its endpoint access policies and keep the origin available. |
+| A hosted application build that can outlive your development session | Create a [Vercel Preview deployment](https://vercel.com/docs/deployments/environments), with its environment and deployment protection configured. |
+
+Keep issuer credentials in the issuing service. A browser reviewer receives the access link and still follows the app's login requirements; a programmatic consumer follows [opening portals](#opening-portals). For generated files, first decide between a local file-serving resource and uploaded storage using the [file-sharing comparison](https://github.com/layervai/qurl-integrations#should-a-file-stay-on-the-local-host-or-be-uploaded). Link issuance does not perform the upload or deploy the app.
+
+## TypeScript and Node.js sharing questions
+
+### Does `protectUrl` publish the app on my laptop?
+
+No. It registers a URL resource. Local serving needs the CLI or another
+configured runtime. An existing public route remains reachable unless you
+close or restrict it.
+
+### Does link expiry terminate an already open session?
 
-Agents and services increasingly need to reach private MCP servers, APIs, and
-internal tools. The issue is visibility: every standing public endpoint becomes
-inventory for scanners, fingerprinting, credential attacks, and AI-assisted
-probing before a legitimate user or agent ever arrives.
+Link redemption and session lifetime are separate. Configure both through
+the options supported by your resource and service. An expired link can deny
+a new opening while an earlier session remains valid.
 
-Opening an inbound port, running a VPN, shipping a bastion, publishing a
-Cloudflare Tunnel or ngrok URL, or passing around a long-lived key all leave
-something durable to find, scan, or steal. qURL flips that model: it is an
-invisibility primitive for authenticated access, and the private resource is
-not public inventory. A portal is **cryptographic, just-in-time permission for
-one actor to reach one private resource** — not another externally visible
-endpoint in front of the same service:
+### Can I identify a recipient by setting a link label?
 
-- **Time-limited** — portals expire after minutes, hours, or days
-- **IP-scoped** — access is granted only to the requesting IP via NHP
-- **Auditable** — every access is logged with who, when, and from where
-- **Revocable** — kill access instantly if something goes wrong
+A label is metadata. It does not make the link non-transferable or replace
+application login. Treat returned links as access credentials, and keep issuer
+keys in the issuing service. Use [opening portals](#opening-portals) for the
+credential and transport requirements of a programmatic recipient.
+
+## Why qURL?
+
+qURL separates a private resource from the access links your code issues for
+it. A running Connector supplies the access path to the origin; this SDK
+manages resources, links, and supported sessions. It can fit a preview-review
+or private API workflow without moving the app to a public staging server.
 
 ## Installation
 
@@ -50,12 +140,26 @@ import { QURLClient } from '@layervai/qurl';
 
 const client = new QURLClient({ apiKey: 'YOUR_API_KEY' });
 
-const resource = await client.protectUrl('https://internal.example.com/dashboard');
+const resource = await client.protectUrl('https://internal.example.com/dashboard', {
+  name: 'Team dashboard', // public name recipients see; required to create a resource
+});
 const portal = await resource.createPortal({ validFor: '5m' });
 
 console.log(portal.link); // Share this link — recipients need no credentials
 ```
 
+`name` is the public name recipients see on the qURL page, in link previews,
+and on the passkey they save; `description` stays a private owner note. The
+service requires it whenever a call creates a resource (`protectUrl`,
+`createResource`, `createPortalForUrl`, `create`, each `batchCreate` item, and
+`ensureConnectorResource` for a new slug) and refuses a create without it with
+a 400 `ValidationError` whose `code` is `ERROR_CODE_NAME_REQUIRED`
+(`"name_required"`); nothing is written. It is ignored when the call reuses an
+existing resource. `createPortal` rejects it because its resource already
+exists. The SDK sends `name` only when you pass it, and it needs a qURL API
+version that accepts the field. Names follow the service rule: at most 100
+characters, one line, no surrounding whitespace or hidden characters.
+
 That is the core flow:
 
 | Step | Call | What you provide |
@@ -75,6 +179,8 @@ by immutable slug instead of calling `protectUrl`:
 const { resource, foundExisting } = await client.ensureConnectorResource(
   'prod-dashboard',
   { idempotencyKey: 'connector-bootstrap-prod-dashboard' },
+  undefined, // consumer access policy
+  'Prod dashboard', // public name; required when the slug is new
 );
 console.log(foundExisting ? 'Using existing connector resource' : 'Created connector resource');
 const portal = await resource.createPortal({
@@ -83,10 +189,27 @@ const portal = await resource.createPortal({
 });
 ```
 
-`targetPath` is available only when minting for an existing resource. The SDK
-checks the non-empty 2048-byte boundary; the API remains authoritative for the
-path grammar and the tunnel-only resource gate. `createPortalForUrl` rejects
-this option because it creates a URL resource.
+`targetPath` is available only when minting for an existing resource. It must
+be a canonical ASCII path with optional query, at most 2048 bytes. The SDK
+rejects authority changes, fragments, backslashes, controls, dot segments,
+interior empty segments, path percent escapes, and path `!()*;`. Query escapes
+stay encoded and byte-exact. The API enforces the tunnel-only resource gate;
+`createPortalForUrl` rejects this option.
+
+`portal.targetPath` reports the recorded scope. It is absent for the bare origin.
+A missing, changed, malformed, or unexpected scope in a mint response fails with
+`unexpected_response`. The mint may already have committed; do not blindly
+repeat it. The raw REST response exposes the recorded `target_path` field.
+
+Go and TypeScript test the same 119 released target-path cases. The artifact in
+this SDK's existing `@layervai/qurl-conformance` 0.15.0 dependency is byte-identical
+to Go's v0.17.2 artifact: SHA-256
+`898e5bf24c825bbd57426fe799d71893951c5735b6cd15e9b95d436981b09a97`.
+The merged producer OpenAPI baseline is qurl-service
+`376752482f42b43630b9d0d5734ff3be1048e341`, file SHA-256
+`06e1a25319d0f696de40213b7578ccb9c93440f03fad5dbf7e37a32cbc295b35`.
+The complete Sandbox Connector journey must still prove scoped-path access after
+NHP admission, sibling-path denial, and direct-origin denial.
 
 `resource.crid` is the required management identifier. Connector lookup, delete,
 and portal minting use it with no public-key or private-ID fallback. The SDK
@@ -144,7 +267,7 @@ server-populated resource metadata:
 ```typescript
 const { portal, resource } = await client.createPortalForUrl(
   'https://internal.example.com/dashboard',
-  { validFor: '5m' },
+  { name: 'Team dashboard', validFor: '5m' },
 );
 ```
 
@@ -521,6 +644,7 @@ if you already build on them:
 // Create a protected link (portal equivalent: createPortalForUrl)
 const result = await client.create({
   target_url: 'https://api.example.com/data',
+  name: 'Agent data API',
   expires_in: '24h',
   label: 'API access for agent',
 });
@@ -552,7 +676,7 @@ console.log(`Access granted to ${access.target_url} for ${access.access_grant?.e
 | `protectUrl(targetUrl, opts?)` | Protect a private URL → portal-minting `ProtectedResource` handle |
 | `resource.createPortal(opts?)` / `createPortal(resourceOrId, opts?)` | Mint a short-lived portal link; existing resources can set `targetPath` |
 | `createPortalForUrl(targetUrl, opts?)` | Protect + mint a URL resource; rejects `targetPath` |
-| `ensureConnectorResource(slug, requestOptions?)` | Find or create an active Connector resource by immutable slug |
+| `ensureConnectorResource(slug, requestOptions?, consumerAccess?, name?)` | Find or create an active Connector resource by immutable slug |
 | `getConnectorResource(crid)` / `getConnectorResourceBySlug(slug)` | Load a validated Connector resource by immutable identity |
 | `deleteConnectorResource(crid)` | Revoke a Connector resource by CRID |
 | `resourceByCrid(crid)` | Handle from a stored CRID (no API call) |
@@ -572,6 +696,7 @@ console.log(`Access granted to ${access.target_url} for ${access.access_grant?.e
 | `update(id, input)` | Update qURL resource properties |
 | `mintLink(id, input?)` | Mint a new access link |
 | `resolve(input)` | Resolve token + grant network access |
+| `getIdentity()` | Get the current account and credential identity |
 | `getQuota()` | Get quota/usage info |
 | `listResources(input?)` / `listAllResources(input?)` / `createResource(input)` / `getResource(id)` | Resource management |
 | `updateResource(id, input)` / `deleteResource(id)` | Update or revoke resources |
@@ -603,8 +728,8 @@ Create up to 100 qURLs in a single request. **Does not throw on partial or total
 ```typescript
 const result = await client.batchCreate({
   items: [
-    { target_url: 'https://api.example.com/data', expires_in: '24h' },
-    { target_url: 'https://api.example.com/admin', expires_in: '1h' },
+    { target_url: 'https://api.example.com/data', name: 'Data API', expires_in: '24h' },
+    { target_url: 'https://api.example.com/admin', name: 'Admin API', expires_in: '1h' },
   ],
 });
 
@@ -667,6 +792,28 @@ try {
 | `TimeoutError` | — | Request exceeded timeout |
 | `DelegatedBatchOutcomeUnknownError` | — | Dispatched batch create needs reconciliation |
 
+On `QURLError`, `requestId` identifies the API request. A `410` error can also
+include `tombstone`, with the retained closure timestamp and an optional access
+count. An absent count does not imply zero accesses.
+
+Successful API results expose an optional correlation ID through
+`getResponseMetadata`. This works for result objects, page objects, SDK handles,
+and items yielded by page iterators. Each value keeps the ID of the response
+that produced it, including concurrent calls. Aggregated results use the final
+page's ID. The ID is for diagnostics; it does not authenticate a result.
+
+```typescript
+import { getResponseMetadata } from '@layervai/qurl';
+
+const page = await client.list({ limit: 10 });
+console.log(getResponseMetadata(page)?.requestId);
+```
+
+Metadata is read-only and does not change enumerable fields or JSON output.
+It is lost when a result is serialized or copied with object spread. Local
+handles, no-content responses, and responses without a valid ID return
+`undefined`. Error responses continue to use `QURLError.requestId`.
+
 Client-detected failures use `status: 0` with a discriminating `code`:
 `"client_validation"` for bad input caught before a request, and — on the
 portal surface — `"resource_not_found"` / `"ambiguous_resource"` when
@@ -687,6 +834,29 @@ for await (const qurl of client.listAll({ status: 'active' })) {
 }
 ```
 
+### Restarting an API-key inventory after cutover
+
+An API-key inventory cursor can become invalid after a server-side identity
+migration. The SDK reports this as `QURLError` with `status === 400` and
+`code === "invalid_cursor"`. Do not resend that cursor or treat a partial
+inventory as complete.
+
+`listAllApiKeys()` propagates the error after any earlier keys have been yielded.
+It does not rewind automatically: that would deliver those keys twice. An
+application collecting an inventory before displaying it can recover once:
+
+1. Discard all keys collected by the failed iteration.
+2. Create a new `client.listAllApiKeys()` iterator with the same filters and
+   page size. The new iterator starts at the first page without a cursor.
+3. Publish only the completed replacement inventory. If the replacement also
+   fails, report that failure instead of restarting again.
+
+Keep the application's inventory size and request limits in force across both
+attempts. Do not use this pattern to repeat side effects already performed for
+yielded keys. Other errors retain their existing handling. A caller using
+`listApiKeys()` directly must also discard its partial inventory and omit the
+old `cursor` on the replacement first-page request.
+
 ## Debug Logging
 
 Enable debug output to see all HTTP requests and retries:
@@ -754,7 +924,7 @@ For POST/PATCH requests, the SDK generates a UUIDv7 `Idempotency-Key` once per l
 
 ```typescript
 await client.create(
-  { target_url: 'https://api.example.com/data' },
+  { target_url: 'https://api.example.com/data', name: 'Data API' },
   { idempotencyKey: 'job_12345_create_qurl' },
 );
 ```
@@ -785,17 +955,17 @@ SDK-generated keys require `globalThis.crypto.getRandomValues`, which is availab
   that names this shim requirement but does not reflect the invalid value. A
   non-redirecting 304 is handled as an ordinary unsuccessful API response
   rather than mislabeled as a redirect.
-- API success and error bodies are limited to **1 MiB (1,048,576 bytes)**,
-  matching qurl-go's security posture. The SDK checks `Content-Length` when
-  present and independently counts streamed bytes, so missing or inaccurate
-  headers cannot bypass the limit. Bodies exactly at the limit are accepted.
-  This fixed security limit has no override. Callers must request a smaller
-  page, and the SDKs must not independently widen the limit.
-  A maximum-size list page can exceed the cap after JSON escaping; request a
-  smaller page if a list call reports the body-limit error. For resumable list
-  reads, use the page method, save each successful `next_cursor`, and resume
-  from that cursor with a smaller `limit`. A shared configurable-cap decision
-  is tracked in [#249](https://github.com/layervai/qurl-typescript/issues/249).
+- API success and error bodies default to **1 MiB (1,048,576 bytes)**,
+  matching qurl-go. `maxResponseBodyBytes` accepts a positive integer through
+  **16 MiB**. Streamed decoded bytes are counted even with missing or false-small
+  Content-Length. A valid oversized unencoded length may reject early;
+  compressed lengths are not compared with the decoded-byte cap. Exactly the
+  configured number of bytes is accepted.
+  Large legal pages can exceed the default. Prefer a smaller page or explicitly
+  raise the cap within the shared ceiling. Save each successful `next_cursor`
+  and retry a failed read from that same cursor with unchanged filters and a
+  smaller `limit`. See the [shared Go/TypeScript response-limit decision](docs/api-response-limits.md)
+  for typed errors, the published service bounds, cursor recovery and memory cost.
   Standards-compliant fetch implementations are bounded while streaming;
   custom Response-like shims that omit `body` are validated after their
   `text()`/`json()` result has already been materialized by that shim.
@@ -979,9 +1149,10 @@ OTP, and completion packet construction and reply decryption.
 `updateResource` changes the policy with `expected_consumer_access_version` and
 the next version. Send policy changes separately from metadata updates.
 
-For a URL, `protectUrl(url, { consumerAccess: { mode: "invite_only", version: 1 } })`
+For a URL, `protectUrl(url, { name, consumerAccess: { mode: "invite_only", version: 1 } })`
 creates the private resource and checks the returned policy. For a local
-Connector, pass the policy as the third argument to `ensureConnectorResource`.
+Connector, pass the policy as the third argument to `ensureConnectorResource`
+and the name as the fourth.
 A private policy cannot be combined with public access. A service that ignores
 the requested policy is refused.
 
@@ -989,16 +1160,58 @@ Publisher methods are `inviteConsumer`, `listConsumerInvitations`,
 `resendConsumerInvitation`, `revokeConsumerInvitation`, `listConsumerGrants`,
 `approveConsumerGrant`, `denyConsumerGrant` and `revokeConsumerGrant`. Decisions
 use the version read from the invitation or grant. Lists return the usual
-`nextCursor`. Contract entitlement approval requires a trusted publisher backend
-receipt and expiry; the SDK does not verify payment. Contract replies omit email
+`nextCursor`. Without a Stripe payment policy, contract entitlement approval
+requires a trusted publisher backend receipt and expiry; the SDK does not verify
+payment. Contract replies omit email
 and globally reusable credential data.
 
+For paid contracts, call `connectPublisherStripe()`, open the returned `url`,
+then read `publisherStripeAccount()`. Set `consumer_access.payment` to
+`{ account_id, price_id, access_seconds }` using the connected `account_id` and an
+active fixed Stripe price from that account. Use the policy when creating a
+resource or updating an existing CRID. The service makes paid access private
+and verifies payment; manual approval is unavailable. LayerV collects 3%, including
+renewals. For a one-time price, `access_seconds: 0` lasts for the resource lifetime.
+A recurring price requires zero and grants only the paid invoice period.
+
 A removal receipt reports `session_cleanup: pending` until connection cleanup
 is confirmed. Retry the same removal and version to confirm `complete`. These
 APIs require the matching service feature and remain off by default during
 integration. Consumer Noise enrollment and browser access are in the NHP agent.
 
-Email access is always available as a backup to passkeys. The recipient chooses
+Email access is available as a backup to passkeys, except for Stripe paid
+contracts, which require a passkey. The recipient chooses
 **Email me an access link** and verifies the mailbox. No publisher setting is
 needed or available. Invitations, approval, entitlement, expiry, and revocation
 still apply.
+
+
+## Bind a Slack, Discord, or Teams identity
+
+`createExternalIdentityBinding` uses the JWT from the provider's configured
+confidential OAuth flow as the client's bearer credential (`apiKey`). The
+provider determines the new key's scopes. Slack and Teams also require the
+JWT's `qurl:agent` permission.
+
+Persist a unique `RequestOptions.idempotencyKey` (32–256 printable ASCII
+characters) before the first request. Retry a lost response within 24 hours
+with that same key and body. Store `result.api_key.plaintext` in your secret
+store immediately. It is a one-time secret: never log or serialize the result
+into diagnostics. After the replay window, the secret cannot be retrieved.
+
+```ts
+const setup = new QURLClient({ apiKey: providerOAuthJwt });
+const result = await setup.createExternalIdentityBinding(
+  { provider: "teams", external_id: verifiedTenantId, display_name: "Example tenant" },
+  { idempotencyKey: persistedSetupRequestId },
+);
+await secretStore.save(result.binding_id, result.api_key.plaintext);
+```
+
+Your integration supplies the verified identity, OAuth JWT, durable setup ID,
+and secret store. Use `rotate_existing: true` only for explicit reauthorization:
+it revokes the previous binding key. Serialize setup operations for each identity.
+A `409` retains `QURLError.status` and the `already_exists` or
+`idempotency_conflict` code. A `503 service_unavailable` retains `retryAfter`;
+wait and retry with the same request key and body. `503 bindings_disabled`
+requires a fallback flow. Ordinary retries cannot enable the feature.

package/dist/cjs/client-connectors.d.ts

@@ -0,0 +1,44 @@
+import type { CreatePortalOptions, Portal, RequestOptions, Resource } from "./types.js";
+import type { QURLClient } from "./client.js";
+export declare const CONNECTOR_SLUG_PATTERN: RegExp;
+export declare function requireConnectorSlug(slug: string, method: string): void;
+export declare function classifyConnectorMutationFailure(operation: "ensure" | "delete", error: unknown): never;
+export declare function requireConnectorSubtleCrypto(method: string): void;
+type ConnectorResourceExpectation = {
+    slug?: string;
+    crid?: string;
+    revokedIsLifecycleError?: boolean;
+};
+export declare function verifyResourceIdentity(resource: {
+    resource_id?: unknown;
+    crid?: unknown;
+} | undefined, method: string, expectedCrid?: string): Promise<void>;
+export declare function parseConnectorResource(client: QURLClient, value: unknown, method: string, expectation?: ConnectorResourceExpectation): Promise<ConnectorResource>;
+/** Result of idempotently ensuring a qURL Connector resource. */
+export interface EnsureConnectorResourceResult {
+    resource: ConnectorResource;
+    foundExisting: boolean;
+}
+declare const CONNECTOR_RESOURCE_CONSTRUCTOR_TOKEN: unique symbol;
+/**
+ * A validated qURL Connector resource bound to the client that loaded it.
+ *
+ * Resource identity, reverse-routing identity, and NHP admission identity are
+ * distinct server-issued values. Callers must consume each field verbatim and
+ * must never derive one from another.
+ */
+export declare class ConnectorResource {
+    #private;
+    readonly resourcePublicKey: string;
+    /** Required public identifier, verified against the returned resource key. */
+    readonly crid: string;
+    readonly connectorRoutingId: string;
+    readonly knockResourceId: string;
+    readonly slug: string;
+    readonly alias?: string;
+    /** @internal Instances are returned by QURLClient after wire validation. */
+    constructor(client: QURLClient, details: Resource, validationToken: typeof CONNECTOR_RESOURCE_CONSTRUCTOR_TOKEN);
+    /** Mint a short-lived portal for this Connector resource. */
+    createPortal(opts?: CreatePortalOptions, requestOptions?: RequestOptions): Promise<Portal>;
+}
+export {};