@layervai/qurl 3.1.0 → 4.0.0

package/dist/esm/client.js

@@ -1,46 +1,21 @@
-import { parseCrid, cridKeyMatches } from "./crid.js";
-import { ConnectorResourceOutcomeUnknownError, createError, DelegatedBatchOutcomeUnknownError, ERROR_CODE_AMBIGUOUS_RESOURCE, ERROR_CODE_CLIENT_VALIDATION, ERROR_CODE_RESOURCE_NOT_FOUND, ERROR_CODE_CONNECTOR_RESOURCE_REVOKED, ERROR_CODE_UNEXPECTED_RESPONSE, ERROR_CODE_UNKNOWN, NetworkError, NotFoundError, QURLError, RuntimeError, TimeoutError, ValidationError, } from "./errors.js";
+import { ERROR_CODE_AMBIGUOUS_RESOURCE, ERROR_CODE_RESOURCE_NOT_FOUND, ERROR_CODE_UNEXPECTED_RESPONSE, ERROR_CODE_UNKNOWN, NetworkError, NotFoundError, QURLError, RuntimeError, TimeoutError, ValidationError, createError, } from "./errors.js";
+import { copyResponseMetadata, withResponseMetadata } from "./response-metadata.js";
 import { stripTrailingSlashes } from "./internal.js";
-import { ShareLink } from "./share.js";
 import { VERSION } from "./version.js";
+import { ShareLink } from "./share.js";
+import { MAX_AUTO_PAGINATION_PAGES, MAX_BATCH_ITEMS, MAX_CUSTOM_DOMAIN, MAX_DELEGATED_ETAG, MAX_DESCRIPTION, MAX_IDEMPOTENCY_KEY, MAX_LABEL, MAX_RESPONSE_BODY_BYTES, MAX_CONFIGURABLE_RESPONSE_BODY_BYTES, RETRY_AFTER_HARD_CAP_MS, RETRY_AFTER_PARSE_LIMIT_S, RETRY_BASE_DELAY_MS, RETRY_MAX_DELAY_MS, } from "./client-limits.js";
+import { TEXT_DECODER, TEXT_ENCODER, boundedErrorIdentifier, boundedErrorSnippet, boundedInvalidFields, boundedObjectKeys, boundedTombstone, clientValidationError, isIndependentAbort, isSdkTimeout, unexpectedResponseError, withErrorCause, } from "./client-errors.js";
+import { describeShape, normalizePatchFields, requireAtLeastOneField, requireBooleanIfPresent, requireConsumerDecision, requireListLimitInRange, requireMaxLength, requireMaxSessionsInRange, requireNoUnknownFields, requireNonEmptyIfPresent, requireNonEmptyStringField, requireObjectInput, requirePortalTargetUrl, requireResourceNameIfPresent, requireValidAccessPolicy, requireValidTags, } from "./client-validation.js";
+import { API_KEY_LIST_PARAM_KEYS, BILLING_INVOICE_LIST_PARAM_KEYS, CONNECTOR_INSTALLATION_LIST_PARAM_KEYS, CREATE_ACCESS_CODE_FIELD_KEYS, CREATE_API_KEY_FIELD_KEYS, CREATE_BILLING_CHECKOUT_FIELD_KEYS, CREATE_QURL_FOR_RESOURCE_FIELD_KEYS, CREATE_RESOURCE_FIELD_KEYS, CREATE_WEBHOOK_FIELD_KEYS, DOMAIN_LIST_PARAM_KEYS, LIST_PARAM_KEYS, MINT_FIELD_KEYS, PROTECT_URL_OPTION_KEYS, REDEEM_ACCESS_CODE_FIELD_KEYS, REGISTER_DOMAIN_FIELD_KEYS, REQUEST_OPTION_KEYS, RESOURCE_LIST_PARAM_KEYS, SHARE_RESOURCE_OPTION_KEYS, UPDATE_API_KEY_FIELD_KEYS, UPDATE_CUSTOMER_FIELD_KEYS, UPDATE_FIELD_KEYS, UPDATE_RESOURCE_FIELD_KEYS, UPDATE_RESOURCE_QURL_FIELD_KEYS, UPDATE_WEBHOOK_FIELD_KEYS, WEBHOOK_DELIVERY_LIST_PARAM_KEYS, WEBHOOK_LIST_PARAM_KEYS, } from "./client-input-fields.js";
+import { batchItemResultValidationReason, sameConsumerPolicy, validateCreateInput, validateQurlTokenOptions, validateResourceQurlUpdateInput, validateResourceWriteFields, } from "./client-resources.js";
+import { ProtectedResource, buildCreatePortalBody, extractAccessToken, parseApiDate, parsePortal, } from "./client-portals.js";
+import { classifyConnectorMutationFailure, parseConnectorResource, requireConnectorSlug, requireConnectorSubtleCrypto, verifyResourceIdentity, } from "./client-connectors.js";
+import { QURL_ID_PATH_OPTIONS, RESOURCE_OR_QURL_ID_PATH_OPTIONS, requireResourceCrid, validatePathId, } from "./client-paths.js";
+import { DELEGATED_BATCH_ID_PATTERN, DELEGATED_QURL_ID_PATTERN, STRONG_ETAG_PATTERN, classifyDelegatedBatchCreateFailure, delegatedBatchBase, delegatedEnvelope, delegatedResponseError, delegatedResponseHeaders, hasDelegatedNoStore, isUtcTimestamp, requiredDelegatedHeader, validateCreateDelegatedQurlBatchInput, validateDelegatedBatchCreateOptions, validateDelegatedBatchResults, validateDelegatedLocation, validateDelegatedQurl, validateGetDelegatedQurlBatchOptions, } from "./client-delegated.js";
+import { validateApiKeyWriteFields, validateEnrollmentTokenFields, validateWebhookWriteFields, } from "./client-management.js";
 const DEFAULT_BASE_URL = "https://api.layerv.ai";
 const DEFAULT_MAX_RETRIES = 3;
 const DEFAULT_TIMEOUT = 30_000;
-// Match qurl-go c4f2f98's exact API response cap. Current qurl-service list
-// routes cap pages at 100 items. A caller can still exceed this cap with a
-// large, heavily escaped webhook-delivery page, so list callers must request a
-// smaller page if the service reports the body-limit error. This cap is fixed:
-// do not add an override or widen one SDK independently from the other.
-// The limit is enforced from Content-Length when usable and again while
-// consuming the response stream.
-const MAX_RESPONSE_BODY_BYTES = 1 << 20;
-const MAX_ERROR_SNIPPET_BYTES = 512;
-// UTF-8 uses at least one byte per UTF-16 code unit. Reading more source units
-// cannot add a byte that fits in a 512-byte retained diagnostic.
-const MAX_ERROR_SNIPPET_SOURCE_CODE_UNITS = MAX_ERROR_SNIPPET_BYTES;
-const MAX_INVALID_FIELD_ENTRIES = 100;
-const MAX_DEBUG_BODY_KEYS = 100;
-// Bound each retained diagnostic collection as well as each string. Without
-// this aggregate cap, 100 valid 512-byte keys and values could turn a small
-// server error into a large caller-visible object. This is a diagnostic budget,
-// not part of the API wire contract.
-const MAX_DIAGNOSTIC_COLLECTION_BYTES = 8 << 10;
-const TEXT_ENCODER = new TextEncoder();
-const ERROR_SNIPPET_ELLIPSIS = "...";
-const ERROR_SNIPPET_ELLIPSIS_BYTES = 3;
-// RFC 8259 JSON exchanged between systems must be valid UTF-8. A non-fatal
-// decoder would replace malformed bytes with U+FFFD before JSON.parse and hide
-// the producer's exact contract violation.
-const TEXT_DECODER = new TextDecoder("utf-8", { fatal: true });
-const RETRY_BASE_DELAY_MS = 500;
-// Bounds local exponential backoff (NOT server-asserted Retry-After —
-// see `RETRY_AFTER_HARD_CAP_MS` for that).
-const RETRY_MAX_DELAY_MS = 30_000;
-// Hard cap on server-asserted Retry-After. Guards against `Retry-After`
-// values >2^31-1 ms overflowing Node's setTimeout (silently truncated to
-// 1ms — turns a "wait a month" directive into a hot retry loop).
-const RETRY_AFTER_HARD_CAP_MS = 60 * 60 * 1000;
-const RETRY_AFTER_PARSE_LIMIT_S = RETRY_AFTER_HARD_CAP_MS / 1000;
 const RETRYABLE_STATUS = new Set([429, 502, 503, 504]);
 // Keep mutating status retries 429-only until the service-side idempotency
 // cache contract is proven across 5xx, TTL, and replay-window edge cases.
@@ -50,12 +25,11 @@ const REDIRECT_RESPONSE_STATUSES = new Set([300, 301, 302, 303, 305, 307, 308]);
 const NO_RETRYABLE_STATUSES = new Set();
 const IDEMPOTENCY_KEY_METHODS = new Set(["POST", "PATCH"]);
 const MUTATING_RETRY_METHODS = new Set(["POST", "PATCH"]);
-const MAX_IDEMPOTENCY_KEY = 256;
 const IDEMPOTENCY_KEY_VALUE_RE = /^[\x21-\x7e](?:[\x20-\x7e]*[\x21-\x7e])?$/;
 const UUID_HEX = Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
 class ResponseBodyTooLargeError extends Error {
-    constructor() {
-        super(`Response body exceeds ${MAX_RESPONSE_BODY_BYTES}-byte limit`);
+    constructor(limit) {
+        super(`Response body exceeds ${limit}-byte limit`);
         this.name = "ResponseBodyTooLargeError";
     }
 }
@@ -74,272 +48,6 @@ class ResponseBodyMaterializationError extends Error {
 const NO_PASSTHROUGH_STATUSES = [];
 const BATCH_PASSTHROUGH_STATUSES = [400];
 const DELEGATED_BATCH_PASSTHROUGH_STATUSES = [304];
-/** Allowlist of known query-param keys for the `list()` endpoint. */
-const LIST_PARAM_KEYS = [
-    "limit",
-    "cursor",
-    "status",
-    "q",
-    "sort",
-    "created_after",
-    "created_before",
-    "expires_before",
-    "expires_after",
-];
-const REQUEST_OPTION_KEYS = ["idempotencyKey"];
-const DELEGATED_BATCH_INPUT_KEYS = [
-    "mint_capability",
-    "grants",
-];
-const DELEGATED_BATCH_GRANT_KEYS = [
-    "expires_in",
-    "label",
-    "one_time_use",
-    "max_sessions",
-    "session_duration",
-    "access_policy",
-];
-const DELEGATED_BATCH_CREATE_OPTION_KEYS = [
-    "idempotencyKey",
-];
-const DELEGATED_BATCH_GET_OPTION_KEYS = [
-    "etag",
-];
-// Compile-time witness: `Exclude<keyof X, (typeof KEYS)[number]>` is
-// `never` iff KEYS lists every key of X. Paired with the
-// `satisfies readonly (keyof X)[]` clause on the array (which catches
-// the other direction), this gives bidirectional drift detection on
-// the *_KEYS allowlists at zero runtime cost.
-function assertExhaustive(_) {
-    /* type-only check */
-}
-assertExhaustive(true);
-assertExhaustive(true);
-assertExhaustive(true);
-assertExhaustive(true);
-assertExhaustive(true);
-assertExhaustive(true);
-const CREATE_FIELD_KEYS = [
-    "private",
-    "type",
-    "target_url",
-    "expires_in",
-    "one_time_use",
-    "max_sessions",
-    "session_duration",
-    "label",
-    "access_policy",
-    "custom_domain",
-];
-assertExhaustive(true);
-/**
- * Fields accepted by `update()`. The empty-input pre-flight check in
- * {@link QURLClient.update} iterates this const — so adding a new field to
- * {@link UpdateInput} without listing it here will fail the
- * paired `assertExhaustive` witness at compile time rather than silently
- * sneaking through an empty-input request.
- */
-const UPDATE_FIELD_KEYS = [
-    "extend_by",
-    "expires_at",
-    "description",
-    "tags",
-];
-assertExhaustive(true);
-/**
- * Fields accepted by `mintLink()`. Iterated by the null-stripping
- * normalization loop in {@link QURLClient.mintLink} so unknown keys
- * from untyped-JS callers don't leak through to the wire body.
- * Symmetric with `LIST_PARAM_KEYS` / `UPDATE_FIELD_KEYS`.
- */
-const MINT_FIELD_KEYS = [
-    "expires_in",
-    "expires_at",
-    "label",
-    "one_time_use",
-    "max_sessions",
-    "session_duration",
-    "access_policy",
-];
-assertExhaustive(true);
-const RESOURCE_LIST_PARAM_KEYS = [
-    "cursor",
-    "limit",
-    "alias",
-    "slug",
-    "status",
-    "type",
-];
-assertExhaustive(true);
-const CREATE_RESOURCE_FIELD_KEYS = [
-    "private",
-    "consumer_access",
-    "type",
-    "target_url",
-    "description",
-    "tags",
-    "custom_domain",
-    "alias",
-    "slug",
-    "find_or_create",
-];
-assertExhaustive(true);
-const UPDATE_RESOURCE_FIELD_KEYS = [
-    "allowed_device_keys_add",
-    "allowed_device_keys_remove",
-    "consumer_access",
-    "expected_consumer_access_version",
-    "description",
-    "tags",
-    "custom_domain",
-    "preserve_host",
-    "alias",
-];
-assertExhaustive(true);
-const CREATE_QURL_FOR_RESOURCE_FIELD_KEYS = [
-    "expires_in",
-    "one_time_use",
-    "max_sessions",
-    "session_duration",
-    "label",
-    "access_policy",
-    "target_path",
-];
-const SHARE_RESOURCE_OPTION_KEYS = [
-    "ttlSeconds",
-];
-assertExhaustive(true);
-assertExhaustive(true);
-/**
- * Options accepted by the portal-verb `protectUrl` / `createPortal`
- * surface. These are camelCase caller-facing options (the portal verbs are
- * the idiomatic layer); the build helpers map them onto the same wire
- * fields the REST-shaped methods send.
- */
-const PROTECT_URL_OPTION_KEYS = [
-    "private",
-    "consumerAccess",
-    "description",
-    "tags",
-    "customDomain",
-    "alias",
-];
-assertExhaustive(true);
-const CREATE_PORTAL_OPTION_KEYS = [
-    "validFor",
-    "label",
-    "oneTimeUse",
-    "maxSessions",
-    "sessionDuration",
-    "targetPath",
-];
-assertExhaustive(true);
-const UPDATE_RESOURCE_QURL_FIELD_KEYS = [
-    "extend_by",
-    "expires_at",
-    "label",
-    "access_policy",
-    "max_sessions",
-    "session_duration",
-];
-assertExhaustive(true);
-const UPDATE_CUSTOMER_FIELD_KEYS = [
-    "spending_cap_cents",
-];
-assertExhaustive(true);
-const CREATE_BILLING_CHECKOUT_FIELD_KEYS = [
-    "plan",
-];
-assertExhaustive(true);
-const REGISTER_DOMAIN_FIELD_KEYS = [
-    "domain",
-];
-assertExhaustive(true);
-const CREATE_WEBHOOK_FIELD_KEYS = [
-    "url",
-    "events",
-    "description",
-];
-assertExhaustive(true);
-const UPDATE_WEBHOOK_FIELD_KEYS = [
-    "url",
-    "events",
-    "description",
-    "status",
-];
-assertExhaustive(true);
-const CREATE_API_KEY_FIELD_KEYS = [
-    "kind",
-    "name",
-    "scopes",
-    "target",
-    "claims",
-    "expires_in",
-];
-assertExhaustive(true);
-const UPDATE_API_KEY_FIELD_KEYS = [
-    "name",
-    "scopes",
-];
-assertExhaustive(true);
-const REDEEM_ACCESS_CODE_FIELD_KEYS = [
-    "code",
-    "honeypot",
-    "elapsed_ms",
-];
-assertExhaustive(true);
-const CREATE_ACCESS_CODE_FIELD_KEYS = [
-    "resource_id",
-    "name",
-    "max_uses",
-    "expires_at",
-];
-assertExhaustive(true);
-const CONNECTOR_INSTALLATION_LIST_PARAM_KEYS = [
-    "cursor",
-    "limit",
-];
-assertExhaustive(true);
-const BILLING_INVOICE_LIST_PARAM_KEYS = [
-    "limit",
-    "cursor",
-];
-assertExhaustive(true);
-const DOMAIN_LIST_PARAM_KEYS = [
-    "limit",
-    "cursor",
-];
-assertExhaustive(true);
-const WEBHOOK_LIST_PARAM_KEYS = [
-    "limit",
-    "cursor",
-];
-assertExhaustive(true);
-const WEBHOOK_DELIVERY_LIST_PARAM_KEYS = [
-    "limit",
-    "cursor",
-];
-assertExhaustive(true);
-const API_KEY_LIST_PARAM_KEYS = [
-    "limit",
-    "cursor",
-    "status",
-];
-assertExhaustive(true);
-/**
- * Construct a {@link ValidationError} for a client-side pre-flight check.
- * Uses `status: 0` (matching {@link NetworkError}/{@link TimeoutError}) and
- * `code: "client_validation"` so catch-by-class still works and callers can
- * tell the error originated inside the SDK rather than from the API.
- */
-function clientValidationError(detail) {
-    return new ValidationError({
-        status: 0,
-        code: ERROR_CODE_CLIENT_VALIDATION,
-        title: "Invalid Argument",
-        detail,
-    });
-}
 function validateRequestOptions(options) {
     if (options === undefined) {
         return;
@@ -411,171 +119,6 @@ function fillRandomBytes(bytes) {
     }
     throw new RuntimeError("globalThis.crypto.getRandomValues is required to generate Idempotency-Key");
 }
-/**
- * Construct a {@link ValidationError} for the case where the API returned
- * a response that parsed as JSON but didn't match the expected schema
- * shape (e.g. 400 with a body that isn't a {@link BatchCreateOutput}).
- *
- * Distinct from {@link clientValidationError} so callers can `.code`-branch
- * between "I passed bad input locally" (`"client_validation"`) and "the
- * server returned a body I can't interpret" (`"unexpected_response"`).
- * Uses `status: 0` by default because a logical shape mismatch is not tied to
- * the HTTP classification. Callers that enforce an observed HTTP contract
- * pass that status explicitly.
- *
- * Threads `request_id` through to {@link QURLError.requestId} when the
- * server-side correlation ID is available — operators debugging
- * "unexpected response" tickets need it on the *error* path too, not
- * just on success/passthrough returns.
- */
-function unexpectedResponseError(detail, options = {}) {
-    // Every detail passed here is an SDK-authored contract message whose dynamic
-    // inputs were validated by the caller-side shape guards. Do not pass raw
-    // server strings to this helper. Server diagnostics use boundedErrorSnippet.
-    const safeRequestId = boundedErrorIdentifier(options.requestId);
-    return new ValidationError({
-        status: options.status ?? 0,
-        code: ERROR_CODE_UNEXPECTED_RESPONSE,
-        title: "Unexpected Response",
-        detail,
-        request_id: safeRequestId,
-    });
-}
-function withErrorCause(error, cause) {
-    // Match the native Error `cause` descriptor. In particular, do not leak a
-    // transport object through Object.keys(), object spread, or JSON logging.
-    Object.defineProperty(error, "cause", {
-        value: cause,
-        writable: true,
-        configurable: true,
-    });
-    return error;
-}
-function isIndependentAbort(error, requestSignal) {
-    return (error instanceof Error &&
-        (error.name === "AbortError" || error.name === "TimeoutError") &&
-        !requestSignal.aborted);
-}
-function isSdkTimeout(error, requestSignal) {
-    return (error instanceof Error &&
-        requestSignal.aborted &&
-        (error.name === "TimeoutError" || error.name === "AbortError"));
-}
-/**
- * Normalize a server-provided problem title/detail into a single-line,
- * UTF-8-safe snippet. Error messages must stay bounded even when a proxy or
- * compromised upstream returns very large structured problem fields.
- */
-function normalizedErrorSnippet(value) {
-    if (typeof value !== "string")
-        return undefined;
-    // Bound source work before the Unicode regular expressions allocate
-    // normalized copies. The response body cap is much larger than one retained
-    // diagnostic, so processing the full server string would waste memory.
-    const normalized = value
-        .slice(0, MAX_ERROR_SNIPPET_SOURCE_CODE_UNITS)
-        // Strip control characters plus bidi override/isolate controls that can
-        // visually reorder diagnostics. Preserve other formatting characters
-        // such as ZWJ/ZWNJ, which are required by legitimate scripts and emoji.
-        .replace(/[\p{Cc}\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/gu, " ")
-        .trim()
-        .replace(/\s+/g, " ");
-    return normalized === "" ? undefined : normalized;
-}
-function boundedErrorSnippet(value) {
-    const sourceTruncated = typeof value === "string" && value.length > MAX_ERROR_SNIPPET_SOURCE_CODE_UNITS;
-    const normalized = normalizedErrorSnippet(value);
-    if (normalized === undefined)
-        return undefined;
-    const contentLimit = sourceTruncated
-        ? MAX_ERROR_SNIPPET_BYTES - ERROR_SNIPPET_ELLIPSIS_BYTES
-        : MAX_ERROR_SNIPPET_BYTES;
-    // UTF-8 uses at most three bytes per UTF-16 code unit. Most diagnostics are
-    // short ASCII, so avoid an allocation only to prove they fit.
-    if (normalized.length * 3 <= contentLimit) {
-        return sourceTruncated ? `${normalized}${ERROR_SNIPPET_ELLIPSIS}` : normalized;
-    }
-    const encoded = TEXT_ENCODER.encode(normalized);
-    if (encoded.byteLength <= contentLimit) {
-        return sourceTruncated ? `${normalized}${ERROR_SNIPPET_ELLIPSIS}` : normalized;
-    }
-    let end = MAX_ERROR_SNIPPET_BYTES - ERROR_SNIPPET_ELLIPSIS_BYTES;
-    // Do not split a multi-byte UTF-8 sequence at the cap.
-    while (end > 0 && (encoded[end] & 0xc0) === 0x80)
-        end--;
-    return `${TEXT_DECODER.decode(encoded.subarray(0, end))}${ERROR_SNIPPET_ELLIPSIS}`;
-}
-/** Keep server identifiers useful as exact machine-readable discriminants. */
-function boundedErrorIdentifier(value) {
-    if (typeof value !== "string" || value.length > MAX_ERROR_SNIPPET_SOURCE_CODE_UNITS) {
-        return undefined;
-    }
-    const normalized = normalizedErrorSnippet(value);
-    if (normalized === undefined ||
-        normalized !== value ||
-        TEXT_ENCODER.encode(value).byteLength > MAX_ERROR_SNIPPET_BYTES) {
-        return undefined;
-    }
-    return value;
-}
-/** Collect at most the first N enumerable own string keys without a full key-array copy. */
-function firstEnumerableOwnKeys(value, limit) {
-    const keys = [];
-    for (const key in value) {
-        if (!Object.prototype.hasOwnProperty.call(value, key))
-            continue;
-        keys.push(key);
-        if (keys.length === limit)
-            break;
-    }
-    return keys;
-}
-/** Bound the structured per-field diagnostics exposed on ValidationError. */
-function boundedInvalidFields(value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
-        return undefined;
-    const entries = [];
-    const retainedKeys = new Set();
-    let retainedBytes = 0;
-    // Bound inspected entries as well as retained entries. A hostile envelope
-    // whose values all have the wrong type must not make diagnostics scan every
-    // key in the response body.
-    for (const rawKey of firstEnumerableOwnKeys(value, MAX_INVALID_FIELD_ENTRIES)) {
-        const rawValue = value[rawKey];
-        const key = boundedErrorSnippet(rawKey);
-        const fieldDetail = boundedErrorSnippet(rawValue);
-        if (key !== undefined && fieldDetail !== undefined && !retainedKeys.has(key)) {
-            const entryBytes = TEXT_ENCODER.encode(key).byteLength + TEXT_ENCODER.encode(fieldDetail).byteLength;
-            // A later, smaller entry can still fit even when this one cannot.
-            if (retainedBytes + entryBytes > MAX_DIAGNOSTIC_COLLECTION_BYTES)
-                continue;
-            retainedKeys.add(key);
-            entries.push([key, fieldDetail]);
-            retainedBytes += entryBytes;
-        }
-    }
-    return entries.length > 0 ? Object.fromEntries(entries) : undefined;
-}
-/** Bound server-controlled object keys before forwarding them to a debug sink. */
-function boundedObjectKeys(value) {
-    // Stop before normalization so a hostile envelope cannot force work over
-    // every enumerable own key. Some early keys may normalize away; bounded
-    // diagnostics are more important here than filling every available slot.
-    const retained = [];
-    let retainedBytes = 0;
-    for (const rawKey of firstEnumerableOwnKeys(value, MAX_DEBUG_BODY_KEYS)) {
-        const key = boundedErrorSnippet(rawKey);
-        if (key === undefined)
-            continue;
-        const keyBytes = TEXT_ENCODER.encode(key).byteLength;
-        // A later, smaller key can still fit even when this one cannot.
-        if (retainedBytes + keyBytes > MAX_DIAGNOSTIC_COLLECTION_BYTES)
-            continue;
-        retained.push(key);
-        retainedBytes += keyBytes;
-    }
-    return retained;
-}
 async function cancelResponseBody(body) {
     if (!body)
         return;
@@ -586,24 +129,27 @@ async function cancelResponseBody(body) {
         // Best-effort resource cleanup must not replace the deterministic SDK error.
     }
 }
-function materializedResponseBodyExceedsLimit(value) {
-    if (value.length > MAX_RESPONSE_BODY_BYTES)
+function materializedResponseBodyExceedsLimit(value, limit) {
+    if (value.length > limit)
         return true;
     // Encoding creates another buffer. UTF-8 uses at most three bytes per
     // UTF-16 code unit, so shorter strings are provably safe without that copy.
-    return (value.length * 3 > MAX_RESPONSE_BODY_BYTES &&
-        TEXT_ENCODER.encode(value).byteLength > MAX_RESPONSE_BODY_BYTES);
+    return value.length * 3 > limit && TEXT_ENCODER.encode(value).byteLength > limit;
 }
-function contentLengthExceedsLimit(response) {
+function contentLengthExceedsLimit(response, limit) {
     // 204/205 never carry content, and a 304 Content-Length describes the
     // selected representation rather than a response body. Do not reject those
     // statuses for metadata about bytes that fetch will not deliver.
     if (response.status === 204 || response.status === 205 || response.status === 304)
         return false;
+    // Encoded Content-Length describes wire bytes; fetch exposes decoded bytes.
+    const encoding = response.headers.get("content-encoding");
+    if (encoding && encoding.trim().toLowerCase() !== "identity")
+        return false;
     const value = response.headers.get("content-length");
     if (value === null || !/^\d+$/.test(value.trim()))
         return false;
-    return Number(value) > MAX_RESPONSE_BODY_BYTES;
+    return Number(value) > limit;
 }
 /** Detect a followed redirect from fetch implementations that expose only the final URL. */
 function responseUrlState(responseUrl, requestUrl) {
@@ -631,16 +177,16 @@ function responseUrlState(responseUrl, requestUrl) {
  * optimization only; streaming byte accounting remains authoritative because
  * that header may be absent or false.
  */
-async function readBoundedResponseBody(response) {
+async function readBoundedResponseBody(response, limit) {
     // `headers.get` is part of the documented injected-fetch contract. Detect a
     // malformed local shim before it can be mistaken for a retryable body-stream
     // failure and replay an otherwise deterministic GET programming error.
     if (typeof response.headers?.get !== "function") {
         throw new ResponseBodyMaterializationError("Response-like fetch must provide headers.get(name)");
     }
-    if (contentLengthExceedsLimit(response)) {
+    if (contentLengthExceedsLimit(response, limit)) {
         await cancelResponseBody(response.body);
-        throw new ResponseBodyTooLargeError();
+        throw new ResponseBodyTooLargeError(limit);
     }
     const body = response.body;
     if (body === null)
@@ -662,8 +208,8 @@ async function readBoundedResponseBody(response) {
             }
         }
         const text = typeof materializedText === "string" ? materializedText : "";
-        if (materializedResponseBodyExceedsLimit(text)) {
-            throw new ResponseBodyTooLargeError();
+        if (materializedResponseBodyExceedsLimit(text, limit)) {
+            throw new ResponseBodyTooLargeError(limit);
         }
         if (text !== "" ||
             response.status === 204 ||
@@ -691,8 +237,8 @@ async function readBoundedResponseBody(response) {
         }
         if (serialized === undefined)
             return "";
-        if (materializedResponseBodyExceedsLimit(serialized)) {
-            throw new ResponseBodyTooLargeError();
+        if (materializedResponseBodyExceedsLimit(serialized, limit)) {
+            throw new ResponseBodyTooLargeError(limit);
         }
         return serialized;
     }
@@ -708,14 +254,14 @@ async function readBoundedResponseBody(response) {
                 throw new ResponseBodyMaterializationError("Response-like fetch body stream must yield Uint8Array chunks");
             }
             const nextTotal = total + value.byteLength;
-            if (nextTotal > MAX_RESPONSE_BODY_BYTES) {
+            if (nextTotal > limit) {
                 try {
                     await reader.cancel();
                 }
                 catch {
                     // Preserve the body-limit failure even if stream cancellation fails.
                 }
-                throw new ResponseBodyTooLargeError();
+                throw new ResponseBodyTooLargeError(limit);
             }
             chunks.push(value);
             total = nextTotal;
@@ -743,133 +289,6 @@ async function readBoundedResponseBody(response) {
         throw new InvalidResponseEncodingError();
     }
 }
-// ---- Spec-derived validation helpers ------------------------------------
-// These mirror constraints documented on each request schema in
-// `openapi.yaml` so obvious mistakes fail fast instead of round-tripping
-// to the API and coming back as a generic 400.
-const MAX_TARGET_URL = 2048;
-const MAX_LABEL = 500;
-const MAX_BATCH_ITEMS = 100;
-const MAX_DESCRIPTION = 500;
-const MAX_CUSTOM_DOMAIN = 253;
-const MAX_MAX_SESSIONS = 1000;
-const MAX_API_KEY_NAME = 100;
-const API_KEY_REQUEST_SCOPE_VALUES = [
-    "qurl:read",
-    "qurl:write",
-    "qurl:resolve",
-    "qurl:agent",
-];
-assertExhaustive(true);
-const API_KEY_REQUEST_SCOPES = new Set(API_KEY_REQUEST_SCOPE_VALUES);
-/** Narrow a response scope before reusing it in a create/update request. */
-export function isApiKeyRequestScope(scope) {
-    return API_KEY_REQUEST_SCOPES.has(scope);
-}
-const CREDENTIAL_TARGET_VALUES = [
-    "agent",
-    "connector",
-];
-assertExhaustive(true);
-const CREDENTIAL_TARGETS = new Set(CREDENTIAL_TARGET_VALUES);
-const CREDENTIAL_CLAIM_TYPE_VALUES = [
-    "connector",
-];
-assertExhaustive(true);
-const CREDENTIAL_CLAIM_TYPES = new Set(CREDENTIAL_CLAIM_TYPE_VALUES);
-// Mirrors CreateApiKeyRequest.expires_in in the service OpenAPI. Composite
-// durations are deliberately invalid on this endpoint. The 24h cap permits
-// 1d, but no positive whole-week duration.
-const CREDENTIAL_DURATION_PATTERN = /^([0-9]+)([smhdw])$/;
-const CREDENTIAL_DURATION_MULTIPLIERS = {
-    s: 1n,
-    m: 60n,
-    h: 3600n,
-    d: 86400n,
-    w: 604800n,
-};
-const MAX_ENROLLMENT_TOKEN_TTL_SECONDS = 86400n;
-const MAX_ALIAS = 64;
-const MAX_SLUG = 64;
-const MAX_TARGET_PATH = 2048;
-const MAX_TAGS = 10;
-const MAX_TAG_LENGTH = 50;
-const MAX_AUTO_PAGINATION_PAGES = 10_000;
-const MIN_DELEGATED_BATCH_IDEMPOTENCY_KEY = 32;
-const MAX_DELEGATED_MINT_CAPABILITY = 8192;
-const MAX_DELEGATED_ETAG = 96;
-const MAX_DELEGATED_BATCH_ITEMS = 100;
-const DELEGATED_BATCH_ID_PATTERN = /^dqb_[A-Za-z0-9_-]{22}$/;
-const DELEGATED_QURL_ID_PATTERN = /^q_[0-9a-f]{11}$/;
-const STRONG_ETAG_PATTERN = /^"[\x21\x23-\x7e]+"$/;
-const UTC_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
-// Keep these identity contracts aligned with qurl-go and the public API.
-const CONNECTOR_SLUG_PATTERN = /^[a-z][a-z0-9-]{1,62}[a-z0-9]$/;
-// Current service schemas intentionally share this grammar, but keep the
-// mutable alias contract separate from the immutable lookup identity.
-const CONNECTOR_ALIAS_PATTERN = /^[a-z][a-z0-9-]{1,62}[a-z0-9]$/;
-const CONNECTOR_RESOURCE_ID_PATTERN = /^[A-Za-z0-9_-]{122}$/;
-const CONNECTOR_RESOURCE_ID_DER_PREFIX = "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE";
-const CONNECTOR_ROUTING_ID_PATTERN = /^c-[a-z2-7]{51}[aq]$/;
-// CreateQurlRequest.target_url pattern is loose (just a URI) but
-// UpdateQurlRequest.tags pattern is specific — enforce it here.
-const TAG_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9 _-]*$/;
-function requireMaxLength(value, field, max) {
-    if (value === undefined)
-        return;
-    // Untyped-JS safety: a non-string `value` would silently pass since
-    // `(42).length === undefined > max` is `false` and the bad value would
-    // sail through to the wire. Match the typeof guard pattern used by
-    // requireValidTags / requireValidTargetUrl.
-    if (typeof value !== "string") {
-        throw clientValidationError(`${field}: must be a string (got ${value === null ? "null" : typeof value})`);
-    }
-    if (value.length > max) {
-        throw clientValidationError(`${field}: must be ${max} characters or fewer (got ${value.length})`);
-    }
-}
-function requireMaxUtf8Bytes(value, field, max) {
-    if (value === undefined)
-        return;
-    if (typeof value !== "string") {
-        throw clientValidationError(`${field}: must be a string (got ${value === null ? "null" : typeof value})`);
-    }
-    const bytes = TEXT_ENCODER.encode(value).byteLength;
-    if (bytes > max) {
-        throw clientValidationError(`${field}: must be ${max} UTF-8 bytes or fewer (got ${bytes})`);
-    }
-}
-function requireNonEmptyIfPresent(value, field) {
-    // Reject `""` so uninitialized form state doesn't reach the wire.
-    if (value === "") {
-        throw clientValidationError(`${field}: must not be an empty string`);
-    }
-}
-function requireMaxSessionsInRange(value, field = "max_sessions") {
-    if (value === undefined)
-        return;
-    if (!Number.isInteger(value) || value < 0 || value > MAX_MAX_SESSIONS) {
-        throw clientValidationError(`${field}: must be an integer between 0 and ${MAX_MAX_SESSIONS} (got ${value})`);
-    }
-}
-function requireBooleanIfPresent(value, field) {
-    if (value === undefined)
-        return;
-    if (typeof value !== "boolean") {
-        throw clientValidationError(`${field}: must be a boolean (got ${describeShape(value)})`);
-    }
-}
-function requireListLimitInRange(value, methodName) {
-    if (value === undefined || value === null)
-        return;
-    // All current paginated OpenAPI query params share 1..100. If a future
-    // endpoint diverges, add a per-endpoint bound rather than changing this
-    // shared guard silently.
-    if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 100) {
-        const rendered = typeof value === "string" ? JSON.stringify(value) : String(value);
-        throw clientValidationError(`${methodName}: limit: must be an integer between 1 and 100 (got ${rendered})`);
-    }
-}
 function appendQuery(path, input, keys, methodName) {
     validateQueryInput(input, keys, methodName);
     const params = new URLSearchParams();
@@ -905,1330 +324,17 @@ function validateListAllInput(input, keys, methodName) {
     // each request revalidates the threaded cursor/filter set before dispatch.
     validateQueryInput(input, keys, methodName);
 }
+function withEnvelopeMetadata(value, meta) {
+    return withResponseMetadata(value, boundedErrorIdentifier(meta?.request_id));
+}
 function pageFromMeta(out, meta) {
-    return {
+    return withEnvelopeMetadata({
         ...out,
         next_cursor: meta?.next_cursor,
         has_more: meta?.has_more ?? Boolean(meta?.next_cursor),
         request_id: meta?.request_id,
         page_size: meta?.page_size,
-    };
-}
-// Best-effort defence-in-depth against today's access-token grammar. The
-// service remains authoritative because resource IDs and credentials are both
-// opaque and future credential formats may not retain the `at_` prefix. The
-// delimiter requirement cannot collide with current base64url public keys,
-// standard-base64 keys, or base32 CRIDs.
-const PATH_EMBEDDED_ACCESS_TOKEN_RE = /[?&#=:\s]at_/i;
-const PATH_PREFIXED_ACCESS_TOKEN_RE = /\/at_/i;
-const QURL_LINK_URL_RE = /^(?:https?:\/\/)?(?:[a-z0-9-]+\.)*qurl\.link(?::\d{1,5})?(?:\/|[?#])/i;
-// ponytail: today's 22-character token suffix only improves URL-paste diagnostics;
-// other lengths are still rejected as URLs without echoing the input.
-const URL_EMBEDDED_ACCESS_TOKEN_RE = /[?&#=:/]at_[a-z0-9_-]{22}(?:$|[?&#:/])/i;
-// A host without a slash can be a legitimate domain identifier. Require the
-// path boundary so shared validation does not break the domain namespace.
-const PATH_SCHEMELESS_URL_RE = /^[a-z0-9-]+(?:\.[a-z0-9-]+)+(?::\d{1,5})?\//i;
-const QURL_DISPLAY_ID_PREFIX_RE = /^q_/i;
-const MAX_PATH_ID_DECODE_PASSES = 3;
-const MAX_PATH_ID_LENGTH = 4096;
-function isUrlLikePathId(value) {
-    return /^https?:\/\//i.test(value) || PATH_SCHEMELESS_URL_RE.test(value);
-}
-const REVOKE_INDIVIDUAL_QURL_RECOVERY = "revoke individual tokens with revokeResourceQurl(crid, qurlId)";
-const DELETE_RESOURCE_RECOVERY = "pass a CRID returned by the API; to revoke one qURL, call revokeResourceQurl(crid, qurlId)";
-const RESOURCE_OR_QURL_ID_PATH_OPTIONS = {
-    requireCridUnlessQurlDisplayId: true,
-};
-const QURL_ID_PATH_OPTIONS = {
-    rejectBareAccessToken: true,
-    accessTokenRecovery: "pass the qURL display ID, not its access token",
-};
-/**
- * Validates that a path-parameter argument is a non-empty string. Some callers
- * pass resource/qURL display IDs, while newer endpoints also pass domains,
- * session IDs, webhook IDs, and API-key IDs, so this intentionally enforces
- * only basic shape plus transport-safety rules and leaves endpoint-specific
- * identifier grammar to the service.
- */
-function validatePathId(id, method, field = "id", options = {}) {
-    if (options.requireCridUnlessQurlDisplayId && typeof id === "string" && !id.startsWith("q_")) {
-        requireResourceCrid(id, method, field);
-        return;
-    }
-    // `.trim()` catches whitespace-only and padded IDs before they round-trip as
-    // `%20...%20` paths that the server can only reject with a less useful 404.
-    // The pre-flight error is more actionable than the 404.
-    if (typeof id !== "string") {
-        const observedType = id === null ? "null" : typeof id;
-        throw clientValidationError(`${method}: ${field} is required (got ${observedType})`);
-    }
-    if (id.trim() === "") {
-        throw clientValidationError(`${method}: ${field} is required`);
-    }
-    if (id.trim() !== id) {
-        throw clientValidationError(`${method}: ${field} must not include leading or trailing whitespace`);
-    }
-    if (id.length > MAX_PATH_ID_LENGTH) {
-        throw clientValidationError(`${method}: ${field} must be ${MAX_PATH_ID_LENGTH} characters or fewer`);
-    }
-    const decodedIds = decodedPathIdForms(id);
-    // URL resolvers and intermediaries can normalize raw or pre-encoded dot
-    // segments before routing. Reject every decoded form we inspected so an
-    // item operation cannot be retargeted to a collection endpoint. Embedded
-    // `a/../b` remains an opaque single segment because the later URL builder
-    // percent-encodes its slash.
-    if (decodedIds.some((value) => value === "." || value === "..")) {
-        throw clientValidationError(`${method}: ${field} is an invalid URL path segment`);
-    }
-    // `/` is deliberately outside the general delimiter class so a URL path
-    // such as `/at_a_glance` is not misread as a credential. For non-URL input,
-    // `/at_` remains a strong pasted-path signal. Fragment, query, header, and
-    // pasted `Bearer at_...` / `token:at_...` forms are also strong signals.
-    // Bare `at_...` values are rejected only for resource/qURL identifiers:
-    // those current formats have fixed non-colliding prefixes, while domain,
-    // webhook, session, and API-key IDs are deliberately opaque/open contracts.
-    // Full URLs and delimiter/path-prefixed credentials remain rejected in
-    // every namespace.
-    const containsUrl = decodedIds.some(isUrlLikePathId);
-    const containsAccessToken = decodedIds.some((value) => {
-        const valueIsUrl = isUrlLikePathId(value);
-        return ((QURL_LINK_URL_RE.test(value) &&
-            (PATH_EMBEDDED_ACCESS_TOKEN_RE.test(value) || PATH_PREFIXED_ACCESS_TOKEN_RE.test(value))) ||
-            (valueIsUrl
-                ? URL_EMBEDDED_ACCESS_TOKEN_RE.test(value)
-                : PATH_EMBEDDED_ACCESS_TOKEN_RE.test(value) || PATH_PREFIXED_ACCESS_TOKEN_RE.test(value)) ||
-            (options.rejectBareAccessToken === true && value.slice(0, 3).toLowerCase() === "at_"));
-    });
-    if (containsAccessToken) {
-        const recovery = options.accessTokenRecovery ?? "pass the identifier returned by the API";
-        throw clientValidationError(`${method}: ${field} must not contain an access token; ${recovery}`);
-    }
-    // A full target/qURL is a common argument mix-up, but it is distinct from
-    // passing an access-token credential. Diagnose it accurately without
-    // echoing the URL, which may itself contain sensitive query parameters.
-    if (containsUrl) {
-        throw clientValidationError(`${method}: ${field} must be an identifier, not a URL`);
-    }
-    if (options.rejectQurlDisplayId === true &&
-        decodedIds.some((value) => QURL_DISPLAY_ID_PREFIX_RE.test(value))) {
-        throw clientValidationError(`${method}: ${field} must not be a qURL display ID; ${REVOKE_INDIVIDUAL_QURL_RECOVERY}`);
-    }
-}
-function decodedPathIdForms(id) {
-    // Probe repeatedly encoded input too. Callers sometimes pre-encode a copied
-    // link before passing it through a URL builder that encodes it again. Three
-    // passes cover the common accidental cases without allowing hostile input
-    // to create unbounded work. More deeply encoded or malformed-percent input
-    // deliberately fails open to the authoritative service after safe segment
-    // encoding; this heuristic is not an identifier parser.
-    const decodedIds = [id];
-    let decodedId = id;
-    for (let pass = 0; pass < MAX_PATH_ID_DECODE_PASSES; pass += 1) {
-        try {
-            const next = decodeURIComponent(decodedId);
-            if (next === decodedId)
-                break;
-            decodedIds.push(next);
-            decodedId = next;
-        }
-        catch {
-            // Malformed percent escapes remain opaque and are left to the service.
-            break;
-        }
-    }
-    return decodedIds;
-}
-function requireConnectorSlug(slug, method) {
-    if (typeof slug !== "string" || !CONNECTOR_SLUG_PATTERN.test(slug)) {
-        throw clientValidationError(`${method}: slug must be 3-64 lowercase alphanumeric or hyphen characters, start with a letter, and end alphanumeric`);
-    }
-}
-function classifyConnectorMutationFailure(operation, error) {
-    if (!(error instanceof QURLError)) {
-        throw new ConnectorResourceOutcomeUnknownError(new RuntimeError("Unexpected failure after Connector mutation dispatch", { cause: error }));
-    }
-    // Most authoritative 4xx responses prove that the mutation was rejected.
-    // bootstrap_key_consumed is the exception: the service returns it from the
-    // consume phase after the resource may have been bound or found.
-    // Callers perform argument/runtime preflight outside their mutation try
-    // blocks; every other surfaced failure therefore follows dispatch or a
-    // nominal success whose resource contract could not be consumed, so callers
-    // must reconcile before retrying. Ensure's exact 201 + valid resource but
-    // missing found_existing is handled after this classifier: the row proves
-    // the selected resource, while only its required metadata is unavailable.
-    if (operation === "ensure" && error.status === 409 && error.code === "bootstrap_key_consumed") {
-        throw new ConnectorResourceOutcomeUnknownError(error);
-    }
-    if (error.status >= 400 && error.status < 500) {
-        throw error;
-    }
-    throw new ConnectorResourceOutcomeUnknownError(error);
-}
-function decodeCanonicalBase64Url(value) {
-    if (!CONNECTOR_RESOURCE_ID_PATTERN.test(value) ||
-        !value.startsWith(CONNECTOR_RESOURCE_ID_DER_PREFIX)) {
-        return undefined;
-    }
-    try {
-        const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "==";
-        const binary = atob(padded);
-        const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
-        const canonical = btoa(String.fromCharCode(...bytes))
-            .replace(/\+/g, "-")
-            .replace(/\//g, "_")
-            .replace(/=+$/, "");
-        return canonical === value ? bytes : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function requireConnectorSubtleCrypto(method) {
-    if (!globalThis.crypto?.subtle) {
-        throw new RuntimeError(`${method}: requires the Web Crypto SubtleCrypto API`);
-    }
-}
-function requireResourceCrid(crid, method, field = "id") {
-    if (parseCrid(crid))
-        return;
-    // Keep actionable paste errors without inspecting valid CRIDs twice.
-    validatePathId(crid, method, field, {
-        rejectBareAccessToken: true,
-        rejectQurlDisplayId: true,
-        accessTokenRecovery: method === "delete" || method === "deleteResource"
-            ? DELETE_RESOURCE_RECOVERY
-            : "pass a CRID returned by the API",
-    });
-    throw clientValidationError(`${method}: requires a valid CRID`);
-}
-async function importsAsConnectorPublicKey(der) {
-    try {
-        const keyData = new ArrayBuffer(der.byteLength);
-        new Uint8Array(keyData).set(der);
-        await globalThis.crypto.subtle.importKey("spki", keyData, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function containsControlCharacter(value) {
-    return Array.from(value).some((character) => {
-        const codePoint = character.codePointAt(0);
-        return codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f);
-    });
-}
-async function verifyResourceIdentity(resource, method, expectedCrid) {
-    if (!resource || typeof resource.resource_id !== "string") {
-        throw unexpectedResponseError(`${method}: response has missing or invalid resource_id`);
-    }
-    const resourceKey = decodeCanonicalBase64Url(resource.resource_id);
-    requireConnectorSubtleCrypto(method);
-    if (!resourceKey || !(await importsAsConnectorPublicKey(resourceKey))) {
-        throw unexpectedResponseError(`${method}: response has missing or invalid resource_id`);
-    }
-    if (expectedCrid !== undefined && resource.crid !== expectedCrid) {
-        throw unexpectedResponseError(`${method}: response crid does not match the request`);
-    }
-    if (!(await cridKeyMatches(resource.crid, resourceKey))) {
-        throw unexpectedResponseError(`${method}: response has missing, invalid, or public-key-mismatched crid`);
-    }
-}
-async function parseConnectorResource(client, value, method, expectation = {}) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw unexpectedResponseError(`${method}: response is missing connector resource data`);
-    }
-    const resource = value;
-    await verifyResourceIdentity(resource, method, expectation.crid);
-    if (typeof resource.connector_routing_id !== "string" ||
-        !CONNECTOR_ROUTING_ID_PATTERN.test(resource.connector_routing_id)) {
-        throw unexpectedResponseError(`${method}: response has missing or invalid connector_routing_id`);
-    }
-    if (typeof resource.knock_resource_id !== "string" ||
-        resource.knock_resource_id.trim() === "" ||
-        resource.knock_resource_id.trim() !== resource.knock_resource_id ||
-        containsControlCharacter(resource.knock_resource_id)) {
-        throw unexpectedResponseError(`${method}: response has missing or invalid knock_resource_id`);
-    }
-    if (resource.resource_id === resource.knock_resource_id ||
-        resource.connector_routing_id === resource.knock_resource_id) {
-        throw unexpectedResponseError(`${method}: response cross-wires resource identity, routing, and admission values`);
-    }
-    if (resource.type !== "tunnel") {
-        throw unexpectedResponseError(`${method}: response resource type is not tunnel`);
-    }
-    if (typeof resource.slug !== "string" || !CONNECTOR_SLUG_PATTERN.test(resource.slug)) {
-        throw unexpectedResponseError(`${method}: response has missing or invalid slug`);
-    }
-    if (expectation.slug !== undefined && resource.slug !== expectation.slug) {
-        throw unexpectedResponseError(`${method}: response slug does not match the request`);
-    }
-    if (resource.alias !== undefined &&
-        resource.alias !== null &&
-        (typeof resource.alias !== "string" || !CONNECTOR_ALIAS_PATTERN.test(resource.alias))) {
-        // The public API intentionally gives mutable aliases and immutable slugs the
-        // same canonical wire grammar (domain aliasPattern/slugPattern). Keeping
-        // response validation aligned avoids accepting a row the service itself
-        // could not create or update.
-        throw unexpectedResponseError(`${method}: response has invalid alias`);
-    }
-    if (resource.status === "revoked") {
-        if (expectation.revokedIsLifecycleError !== true) {
-            throw unexpectedResponseError(`${method}: active-only operation returned a revoked connector resource`);
-        }
-        throw new QURLError({
-            status: 0,
-            code: ERROR_CODE_CONNECTOR_RESOURCE_REVOKED,
-            title: "Connector Resource Revoked",
-            detail: `${method}: qURL Connector resource is revoked`,
-        });
-    }
-    if (resource.status !== "active") {
-        throw unexpectedResponseError(`${method}: response has invalid resource status`);
-    }
-    return new ConnectorResource(client, resource, CONNECTOR_RESOURCE_CONSTRUCTOR_TOKEN);
-}
-function requireValidTags(tags) {
-    // null tolerance for untyped-JS callers — treated as "don't touch."
-    // Duplicates pass through to the server (authoritative on dedupe policy).
-    if (tags === undefined || tags === null)
-        return;
-    if (!Array.isArray(tags)) {
-        throw clientValidationError(`tags: must be an array of strings (got ${typeof tags})`);
-    }
-    if (tags.length > MAX_TAGS) {
-        throw clientValidationError(`tags: max ${MAX_TAGS} items allowed (got ${tags.length})`);
-    }
-    const errors = [];
-    for (let i = 0; i < tags.length; i++) {
-        const tag = tags[i];
-        // Per-element type guard for untyped-JS callers. Without this, a
-        // non-string element would silently pass (`.length` on a number is
-        // `undefined`; `TAG_PATTERN.test(42)` coerces to `"42"`) or TypeError
-        // (`null.length`).
-        if (typeof tag !== "string") {
-            errors.push(`tags[${i}]: must be a string (got ${tag === null ? "null" : typeof tag})`);
-            continue;
-        }
-        if (tag.length < 1 || tag.length > MAX_TAG_LENGTH) {
-            errors.push(`tags[${i}]: must be 1-${MAX_TAG_LENGTH} characters (got ${tag.length})`);
-            continue;
-        }
-        if (!TAG_PATTERN.test(tag)) {
-            errors.push(`tags[${i}]: must start with an alphanumeric and contain only letters, numbers, spaces, underscores, or hyphens`);
-        }
-    }
-    if (errors.length > 0) {
-        throw clientValidationError(errors.join("; "));
-    }
-}
-function describeShape(value) {
-    if (value === null)
-        return "null";
-    if (Array.isArray(value))
-        return "array";
-    return typeof value;
-}
-const ACCESS_POLICY_LIST_FIELDS = [
-    "ip_allowlist",
-    "ip_denylist",
-    "geo_allowlist",
-    "geo_denylist",
-];
-const ACCESS_POLICY_STRING_FIELDS = [
-    "user_agent_allow_regex",
-    "user_agent_deny_regex",
-];
-const AI_AGENT_POLICY_LIST_FIELDS = [
-    "deny_categories",
-    "allow_categories",
-];
-function requireValidAccessPolicy(policy) {
-    // null/undefined → "don't touch". Server is authoritative on CIDR /
-    // ISO-3166 / regex grammar; this guard catches only the shape errors
-    // an untyped-JS caller is likely to make (e.g. `geo_allowlist: "US"`
-    // instead of `["US"]`) so they get a structured ValidationError
-    // instead of a server 400 they have to debug.
-    if (policy === undefined || policy === null)
-        return;
-    if (typeof policy !== "object" || Array.isArray(policy)) {
-        throw clientValidationError(`access_policy: must be an object (got ${describeShape(policy)})`);
-    }
-    for (const field of ACCESS_POLICY_LIST_FIELDS) {
-        const value = policy[field];
-        if (value === undefined)
-            continue;
-        if (!Array.isArray(value)) {
-            throw clientValidationError(`access_policy.${field}: must be an array (got ${describeShape(value)})`);
-        }
-    }
-    for (const field of ACCESS_POLICY_STRING_FIELDS) {
-        const value = policy[field];
-        if (value === undefined)
-            continue;
-        if (typeof value !== "string") {
-            throw clientValidationError(`access_policy.${field}: must be a string (got ${describeShape(value)})`);
-        }
-    }
-    const aip = policy.ai_agent_policy;
-    if (aip !== undefined) {
-        if (aip === null || typeof aip !== "object" || Array.isArray(aip)) {
-            throw clientValidationError(`access_policy.ai_agent_policy: must be an object (got ${describeShape(aip)})`);
-        }
-        if (aip.block_all !== undefined && typeof aip.block_all !== "boolean") {
-            throw clientValidationError(`access_policy.ai_agent_policy.block_all: must be a boolean (got ${describeShape(aip.block_all)})`);
-        }
-        for (const field of AI_AGENT_POLICY_LIST_FIELDS) {
-            const value = aip[field];
-            if (value === undefined)
-                continue;
-            if (!Array.isArray(value)) {
-                throw clientValidationError(`access_policy.ai_agent_policy.${field}: must be an array (got ${describeShape(value)})`);
-            }
-        }
-    }
-}
-function validateCreateDelegatedQurlBatchInput(input) {
-    if (typeof input !== "object" || input === null || Array.isArray(input)) {
-        throw clientValidationError(`createDelegatedQurlBatch: input must be an object (got ${describeShape(input)})`);
-    }
-    const typed = input;
-    requireNoUnknownFields(typed, DELEGATED_BATCH_INPUT_KEYS, "createDelegatedQurlBatch");
-    if (typeof typed.mint_capability !== "string" ||
-        typed.mint_capability.length < 1 ||
-        typed.mint_capability.length > MAX_DELEGATED_MINT_CAPABILITY) {
-        throw clientValidationError(`createDelegatedQurlBatch: mint_capability must be a string of 1-${MAX_DELEGATED_MINT_CAPABILITY} characters`);
-    }
-    if (!Array.isArray(typed.grants) ||
-        typed.grants.length < 1 ||
-        typed.grants.length > MAX_DELEGATED_BATCH_ITEMS) {
-        throw clientValidationError(`createDelegatedQurlBatch: grants must contain 1-${MAX_DELEGATED_BATCH_ITEMS} items`);
-    }
-    for (const [index, grant] of typed.grants.entries()) {
-        const field = `createDelegatedQurlBatch: grants[${index}]`;
-        if (typeof grant !== "object" || grant === null || Array.isArray(grant)) {
-            throw clientValidationError(`${field}: must be an object (got ${describeShape(grant)})`);
-        }
-        requireNoUnknownFields(grant, DELEGATED_BATCH_GRANT_KEYS, field);
-        requireMaxUtf8Bytes(grant.label, `${field}.label`, MAX_LABEL);
-        requireBooleanIfPresent(grant.one_time_use, `${field}.one_time_use`);
-        requireMaxSessionsInRange(grant.max_sessions, `${field}.max_sessions`);
-        for (const durationField of ["expires_in", "session_duration"]) {
-            const value = grant[durationField];
-            if (value !== undefined && (typeof value !== "string" || value.length === 0)) {
-                throw clientValidationError(`${field}.${durationField}: must be a non-empty string`);
-            }
-        }
-        if (grant.access_policy !== undefined) {
-            requireValidAccessPolicy(grant.access_policy);
-        }
-    }
-}
-function validateDelegatedBatchCreateOptions(options) {
-    if (typeof options !== "object" || options === null || Array.isArray(options)) {
-        throw clientValidationError("createDelegatedQurlBatch: options are required");
-    }
-    requireNoUnknownFields(options, DELEGATED_BATCH_CREATE_OPTION_KEYS, "createDelegatedQurlBatch options");
-    const key = options.idempotencyKey;
-    if (typeof key !== "string" ||
-        key.length < MIN_DELEGATED_BATCH_IDEMPOTENCY_KEY ||
-        key.length > MAX_IDEMPOTENCY_KEY ||
-        !/^[!-~]+$/.test(key)) {
-        throw clientValidationError(`createDelegatedQurlBatch: idempotencyKey must contain ${MIN_DELEGATED_BATCH_IDEMPOTENCY_KEY}-${MAX_IDEMPOTENCY_KEY} visible ASCII characters`);
-    }
-}
-function validateGetDelegatedQurlBatchOptions(options) {
-    if (options === undefined)
-        return;
-    if (typeof options !== "object" || options === null || Array.isArray(options)) {
-        throw clientValidationError(`getDelegatedQurlBatch: options must be an object (got ${describeShape(options)})`);
-    }
-    requireNoUnknownFields(options, DELEGATED_BATCH_GET_OPTION_KEYS, "getDelegatedQurlBatch options");
-    const etag = options.etag;
-    if (etag !== undefined &&
-        (typeof etag !== "string" ||
-            etag.length > MAX_DELEGATED_ETAG ||
-            !STRONG_ETAG_PATTERN.test(etag))) {
-        throw clientValidationError("getDelegatedQurlBatch: etag must be a valid strong ETag");
-    }
-}
-function delegatedResponseError(status, detail, requestId) {
-    return unexpectedResponseError(`Delegated qURL batch ${detail}`, { status, requestId });
-}
-function delegatedResponseObject(value, status, label, requestId) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw delegatedResponseError(status, `${label} is not an object`, requestId);
-    }
-    return value;
-}
-function delegatedEnvelope(envelope, status) {
-    if (typeof envelope.meta !== "object" || envelope.meta === null || Array.isArray(envelope.meta)) {
-        throw delegatedResponseError(status, "response meta is not an object");
-    }
-    const meta = envelope.meta;
-    if (typeof meta.request_id !== "string") {
-        throw delegatedResponseError(status, "response meta has invalid request_id");
-    }
-    const data = delegatedResponseObject(envelope.data, status, "response data", meta.request_id);
-    return { data, requestId: meta.request_id };
-}
-function requiredDelegatedHeader(envelope, name, status, requestId) {
-    const headers = envelope.__http_headers;
-    if (!headers || typeof headers.get !== "function") {
-        throw delegatedResponseError(status, "response headers are unavailable", requestId);
-    }
-    const value = headers.get(name);
-    if (value === null) {
-        throw delegatedResponseError(status, `response is missing ${name}`, requestId);
-    }
-    return value;
-}
-function hasDelegatedNoStore(value) {
-    if (value === null)
-        return false;
-    const directives = new Set(value.split(",").map((directive) => directive.trim().split("=", 1)[0].toLowerCase()));
-    return directives.has("private") && directives.has("no-store");
-}
-function delegatedResponseHeaders(envelope, status, requestId) {
-    const cacheControl = envelope.__http_headers?.get("Cache-Control") ?? null;
-    if (cacheControl !== null) {
-        if (!hasDelegatedNoStore(cacheControl)) {
-            throw delegatedResponseError(status, "response has invalid Cache-Control", requestId);
-        }
-    }
-    else if (status !== 304) {
-        requiredDelegatedHeader(envelope, "Cache-Control", status, requestId);
-    }
-    const etag = envelope.__http_headers?.get("ETag") ?? undefined;
-    if (etag !== undefined && (etag.length > MAX_DELEGATED_ETAG || !STRONG_ETAG_PATTERN.test(etag))) {
-        throw delegatedResponseError(status, "response has invalid strong ETag", requestId);
-    }
-    const rawRetryAfter = envelope.__http_headers?.get("Retry-After") ?? "";
-    const trimmed = rawRetryAfter.trim();
-    const seconds = /^\d+$/.test(trimmed)
-        ? Number(trimmed)
-        : /^[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/.test(trimmed)
-            ? Math.ceil((Date.parse(trimmed) - Date.now()) / 1000)
-            : NaN;
-    const retryAfter = Number.isSafeInteger(seconds) && seconds > 0 && seconds <= RETRY_AFTER_PARSE_LIMIT_S
-        ? seconds
-        : undefined;
-    return { etag, retryAfter };
-}
-function isUtcTimestamp(value) {
-    return (typeof value === "string" &&
-        UTC_TIMESTAMP_PATTERN.test(value) &&
-        Number.isFinite(Date.parse(value)));
-}
-function delegatedBatchBase(data, status, requestId, expectedBatchId) {
-    if (typeof data.batch_id !== "string" ||
-        !DELEGATED_BATCH_ID_PATTERN.test(data.batch_id) ||
-        (expectedBatchId !== undefined && data.batch_id !== expectedBatchId)) {
-        throw delegatedResponseError(status, "response has invalid batch_id", requestId);
-    }
-    if (!Number.isInteger(data.item_count) ||
-        Number(data.item_count) < 1 ||
-        Number(data.item_count) > MAX_DELEGATED_BATCH_ITEMS) {
-        throw delegatedResponseError(status, "response has invalid item_count", requestId);
-    }
-    if (!isUtcTimestamp(data.submitted_at)) {
-        throw delegatedResponseError(status, "response has invalid submitted_at", requestId);
-    }
-    return {
-        batchId: data.batch_id,
-        itemCount: Number(data.item_count),
-        submittedAt: data.submitted_at,
-    };
-}
-function validateDelegatedLocation(value, baseUrl, batchId, status, requestId) {
-    let location;
-    try {
-        const base = new URL(`${baseUrl}/`);
-        const relative = value.startsWith("/v1/delegated-qurl-batches/")
-            ? `${base.pathname.replace(/\/$/, "")}${value}`
-            : value;
-        location = new URL(relative, base);
-    }
-    catch {
-        throw delegatedResponseError(status, "response has invalid Location", requestId);
-    }
-    const expected = new URL(`${baseUrl}/v1/delegated-qurl-batches/${batchId}`);
-    if (location.username !== "" ||
-        location.password !== "" ||
-        location.search !== "" ||
-        location.hash !== "" ||
-        location.href !== expected.href) {
-        throw delegatedResponseError(status, "response has invalid Location", requestId);
-    }
-    return location.href;
-}
-function validateDelegatedQurlLink(value) {
-    if (typeof value !== "string")
-        return false;
-    try {
-        const link = new URL(value);
-        return (link.protocol === "https:" &&
-            link.username === "" &&
-            link.password === "" &&
-            link.hash.length > 1);
-    }
-    catch {
-        return false;
-    }
-}
-function validateDelegatedQurl(value, expectedQurlId, status, requestId) {
-    const data = delegatedResponseObject(value, status, "response data", requestId);
-    if (data.qurl_id !== expectedQurlId) {
-        throw delegatedResponseError(status, "response has invalid qurl_id", requestId);
-    }
-    if (data.status !== "active" &&
-        data.status !== "consumed" &&
-        data.status !== "expired" &&
-        data.status !== "revoked") {
-        throw delegatedResponseError(status, "response has invalid status", requestId);
-    }
-    if (!isUtcTimestamp(data.expires_at) ||
-        typeof data.one_time_use !== "boolean" ||
-        !Number.isInteger(data.max_sessions) ||
-        Number(data.max_sessions) < 0 ||
-        !Number.isInteger(data.session_duration) ||
-        Number(data.session_duration) <= 0 ||
-        (data.label !== undefined && typeof data.label !== "string") ||
-        (data.access_policy !== undefined &&
-            (typeof data.access_policy !== "object" ||
-                data.access_policy === null ||
-                Array.isArray(data.access_policy)))) {
-        throw delegatedResponseError(status, "response has invalid qURL metadata", requestId);
-    }
-    return { ...data, request_id: requestId };
-}
-function validateDelegatedBatchResults(value, itemCount, batchStatus, status, requestId) {
-    if (!Array.isArray(value) || value.length !== itemCount) {
-        throw delegatedResponseError(status, "terminal response has invalid results", requestId);
-    }
-    let succeeded = 0;
-    const qurlIds = new Set();
-    const links = new Set();
-    const results = value.map((raw, index) => {
-        const item = delegatedResponseObject(raw, status, `result ${index}`, requestId);
-        if (item.index !== index) {
-            throw delegatedResponseError(status, `result ${index} has invalid index`, requestId);
-        }
-        if (item.status === "succeeded") {
-            if (item.error !== undefined && item.error !== null) {
-                throw delegatedResponseError(status, `result ${index} has conflicting fields`, requestId);
-            }
-            const qurl = delegatedResponseObject(item.qurl, status, `result ${index} qurl`, requestId);
-            if (typeof qurl.qurl_id !== "string" ||
-                !DELEGATED_QURL_ID_PATTERN.test(qurl.qurl_id) ||
-                !validateDelegatedQurlLink(qurl.qurl_link) ||
-                !isUtcTimestamp(qurl.expires_at) ||
-                qurlIds.has(qurl.qurl_id) ||
-                links.has(qurl.qurl_link)) {
-                throw delegatedResponseError(status, `result ${index} has invalid qurl`, requestId);
-            }
-            qurlIds.add(qurl.qurl_id);
-            links.add(qurl.qurl_link);
-            succeeded++;
-            return {
-                index,
-                status: "succeeded",
-                qurl: {
-                    qurl_id: qurl.qurl_id,
-                    qurl_link: qurl.qurl_link,
-                    expires_at: qurl.expires_at,
-                },
-            };
-        }
-        if (item.status !== "failed" || (item.qurl !== undefined && item.qurl !== null)) {
-            throw delegatedResponseError(status, `result ${index} has invalid status`, requestId);
-        }
-        const error = delegatedResponseObject(item.error, status, `result ${index} error`, requestId);
-        if (typeof error.code !== "string" ||
-            error.code.length === 0 ||
-            typeof error.message !== "string") {
-            throw delegatedResponseError(status, `result ${index} has invalid error`, requestId);
-        }
-        return {
-            index,
-            status: "failed",
-            error: { code: error.code, message: error.message },
-        };
-    });
-    if ((batchStatus === "succeeded" && succeeded !== itemCount) ||
-        (batchStatus === "failed" && succeeded !== 0) ||
-        (batchStatus === "partially_failed" && (succeeded === 0 || succeeded === itemCount))) {
-        throw delegatedResponseError(status, "terminal status does not match results", requestId);
-    }
-    return results;
-}
-function classifyDelegatedBatchCreateFailure(error, batchId) {
-    if (!(error instanceof QURLError)) {
-        throw new DelegatedBatchOutcomeUnknownError(new RuntimeError("Unexpected failure after delegated batch dispatch", { cause: error }), batchId);
-    }
-    if ((error.status >= 400 && error.status < 500 && error.status !== 408) || error.status === 501) {
-        throw error;
-    }
-    throw new DelegatedBatchOutcomeUnknownError(error, batchId);
-}
-// `format: uri` in the OpenAPI spec allows schemes the SDK doesn't
-// usefully support (`ftp://`, `file://`, `javascript:`, …). This is a
-// cheap client-side sanity check — the server is still the
-// authoritative validator (e.g. it rejects localhost, cloud metadata,
-// and private-range hosts; the SDK doesn't need to duplicate that).
-const ALLOWED_URL_SCHEMES = ["http://", "https://"];
-function requireValidHttpUrl(value, field) {
-    // Three checks in priority order: type guard, scheme, length.
-    // Stop at the first failure so a non-string URL doesn't
-    // produce both "must be a string" AND "must be ≤ 2048 characters"
-    // (the length check on a non-string would also typeof-fail and
-    // duplicate the type message). The collect-all loop in
-    // validateCreateInput runs each FIELD's validator independently — within
-    // a single URL field itself we want fail-fast.
-    if (typeof value !== "string") {
-        throw clientValidationError(`${field}: must be a string (got ${value === null ? "null" : typeof value})`);
-    }
-    if (!ALLOWED_URL_SCHEMES.some((scheme) => value.startsWith(scheme))) {
-        // Truncate to keep the error message compact and avoid
-        // pathologically long schemes from filling logs.
-        const repr = JSON.stringify(value).slice(0, 40);
-        throw clientValidationError(`${field}: must start with http:// or https:// (got ${repr})`);
-    }
-    if (value.length > MAX_TARGET_URL) {
-        throw clientValidationError(`${field}: must be ${MAX_TARGET_URL} characters or fewer (got ${value.length})`);
-    }
-}
-function requireValidTargetUrl(target_url) {
-    requireValidHttpUrl(target_url, "target_url");
-}
-function validateCreateInput(input) {
-    // Untyped-JS guard: surface as ValidationError instead of raw TypeError.
-    if (typeof input !== "object" || input === null) {
-        throw clientValidationError(`create: input must be an object (got ${input === null ? "null" : typeof input})`);
-    }
-    // Collect-all: run every validator and aggregate the messages so a
-    // caller fixing multiple bad fields sees them all at once instead
-    // of fix-re-run-repeat. Matches the documented batchCreate UX
-    // ("All failures are collected into a single ValidationError")
-    // and mirrors the requireValidTags collect-all pattern.
-    const errors = [];
-    const collect = (fn) => {
-        try {
-            fn();
-        }
-        catch (err) {
-            if (err instanceof ValidationError) {
-                errors.push(err.detail);
-                return;
-            }
-            throw err;
-        }
-    };
-    collect(() => requireNoUnknownFields(input, CREATE_FIELD_KEYS, "create"));
-    const resourceType = input.type;
-    if (resourceType !== undefined && typeof resourceType !== "string") {
-        errors.push(`type: must be a string (got ${resourceType === null ? "null" : typeof resourceType})`);
-    }
-    collect(() => {
-        if (input.target_url === undefined) {
-            if (resourceType === undefined || resourceType === "url") {
-                throw clientValidationError("target_url: is required for url qURLs");
-            }
-            return;
-        }
-        requireValidTargetUrl(input.target_url);
-    });
-    collect(() => requireMaxLength(input.label, "label", MAX_LABEL));
-    collect(() => requireNonEmptyIfPresent(input.label, "label"));
-    collect(() => requireMaxLength(input.custom_domain, "custom_domain", MAX_CUSTOM_DOMAIN));
-    collect(() => requireNonEmptyIfPresent(input.custom_domain, "custom_domain"));
-    collect(() => requireBooleanIfPresent(input.private, "private"));
-    collect(() => requireBooleanIfPresent(input.one_time_use, "one_time_use"));
-    collect(() => requireMaxSessionsInRange(input.max_sessions));
-    collect(() => requireNonEmptyIfPresent(input.expires_in, "expires_in"));
-    collect(() => requireNonEmptyIfPresent(input.session_duration, "session_duration"));
-    collect(() => requireValidAccessPolicy(input.access_policy));
-    if (errors.length > 0) {
-        // Inner `; ` is contractual (paired with batchCreate's outer ` | `).
-        // Future field-level validators must not aggregate via `; ` internally.
-        throw clientValidationError(errors.join("; "));
-    }
-    // Intentional omission: duration *grammar* (`expires_in`,
-    // `session_duration`) is server-authoritative. Empty strings are
-    // rejected up front (see collect() calls above) but unit/whitespace
-    // edge cases ("24hh", "1w 3d") surface as a clean server 400 — a
-    // client-side regex would just create a drift surface against the
-    // server's rego/duration parser.
-    //
-    // `access_policy` contents (CIDRs, ISO-3166 codes, regex patterns)
-    // are pass-through for the same reason. The shape-guard above only
-    // catches structural mistakes (string-instead-of-array on list fields)
-    // an untyped-JS caller is likely to make.
-}
-function validateQurlTokenOptions(input) {
-    if (input === undefined)
-        return;
-    requireMaxLength(input.label, "label", MAX_LABEL);
-    requireNonEmptyIfPresent(input.label, "label");
-    requireNonEmptyIfPresent(input.expires_in, "expires_in");
-    requireNonEmptyIfPresent(input.session_duration, "session_duration");
-    // Mirror the service-documented size cap, but keep host-safety grammar
-    // (single leading slash, no scheme/host/backslash/etc.) and the tunnel-only
-    // gate server-authoritative (`invalid_target_path`); a client-side regex
-    // would create a drift surface. Keep max-before-empty consistent with label;
-    // empty strings pass the length check and are rejected by the next guard.
-    requireMaxUtf8Bytes(input.target_path, "target_path", MAX_TARGET_PATH);
-    requireNonEmptyIfPresent(input.target_path, "target_path");
-    requireBooleanIfPresent(input.one_time_use, "one_time_use");
-    requireMaxSessionsInRange(input.max_sessions);
-    requireValidAccessPolicy(input.access_policy);
-}
-function validateResourceQurlUpdateInput(input) {
-    requireMaxLength(input.label, "label", MAX_LABEL);
-    requireNonEmptyIfPresent(input.label, "label");
-    requireNonEmptyIfPresent(input.extend_by, "extend_by");
-    requireNonEmptyIfPresent(input.expires_at, "expires_at");
-    requireNonEmptyIfPresent(input.session_duration, "session_duration");
-    requireMaxSessionsInRange(input.max_sessions);
-    requireValidAccessPolicy(input.access_policy);
-    if (input.extend_by !== undefined && input.expires_at !== undefined) {
-        throw clientValidationError("updateResourceQurl: `extend_by` and `expires_at` are mutually exclusive — provide at most one");
-    }
-}
-function requireObjectInput(input, method) {
-    if (typeof input !== "object" || input === null || Array.isArray(input)) {
-        throw clientValidationError(`${method}: input must be an object (got ${input === null ? "null" : typeof input})`);
-    }
-}
-function requireNonEmptyStringField(input, field, method) {
-    const value = input[field];
-    if (typeof value !== "string" || value.length === 0) {
-        throw clientValidationError(`${method}: ${field} must be a non-empty string`);
-    }
-}
-function requireNonEmptyArrayField(input, field, method) {
-    const value = input[field];
-    if (!Array.isArray(value) || value.length === 0) {
-        throw clientValidationError(`${method}: ${field} must be a non-empty array`);
-    }
-}
-function requireStringArrayElements(value, field, method) {
-    if (!Array.isArray(value)) {
-        throw clientValidationError(`${method}: ${field} must be a non-empty array`);
-    }
-    value.forEach((entry, index) => {
-        if (typeof entry !== "string" || entry.length === 0) {
-            throw clientValidationError(`${method}: ${field}[${index}] must be a non-empty string`);
-        }
-    });
-}
-function requireAtLeastOneField(input, fields, method) {
-    if (!fields.some((field) => input[field] !== undefined)) {
-        throw clientValidationError(`${method}: at least one field (${fields.join(", ")}) must be provided`);
-    }
-}
-function requireNoUnknownFields(input, fields, method) {
-    const unknown = Object.keys(input).filter((field) => !fields.includes(field));
-    if (unknown.length > 0) {
-        const rendered = unknown.map((field) => `"${field}"`).join(", ");
-        const label = unknown.length === 1 ? "unknown field" : "unknown fields";
-        throw clientValidationError(`${method}: ${label} ${rendered}`);
-    }
-}
-function normalizePatchFields(input, fields, options = {}) {
-    const preserveNull = new Set(options.preserveNullFields ?? []);
-    const normalized = {};
-    for (const key of fields) {
-        const value = input[key];
-        if (value !== undefined && (value !== null || preserveNull.has(key))) {
-            normalized[key] = value;
-        }
-    }
-    return normalized;
-}
-function requireConsumerDecision(id, version, allowNew = false) {
-    if (typeof id !== "string" ||
-        (!/^[a-f0-9]{64}$/.test(id) && !(allowNew && id === "new")) ||
-        !Number.isSafeInteger(version) ||
-        version < (allowNew ? 0 : 1))
-        throw clientValidationError("consumer decision: invalid id or expected version");
-}
-function validateResourceWriteFields(input, options = {}) {
-    const errors = [];
-    const collect = (fn) => {
-        try {
-            fn();
-        }
-        catch (err) {
-            if (err instanceof ValidationError) {
-                errors.push(err.detail);
-                return;
-            }
-            throw err;
-        }
-    };
-    collect(() => {
-        if (input.private !== undefined && typeof input.private !== "boolean") {
-            throw clientValidationError("private: must be a boolean");
-        }
-        if (input.consumer_access !== undefined) {
-            const policy = input.consumer_access;
-            requireObjectInput(policy, "consumer_access");
-            const p = policy;
-            requireNoUnknownFields(p, ["mode", "version", "contract_id"], "consumer_access");
-            if (!["keys", "invite_only", "email_capture", "review", "contract"].includes(p.mode) ||
-                !Number.isSafeInteger(p.version) ||
-                p.version < 1) {
-                throw clientValidationError("consumer_access: invalid mode or version");
-            }
-            if (p.mode === "contract") {
-                if (typeof p.contract_id !== "string" ||
-                    !p.contract_id.trim() ||
-                    new TextEncoder().encode(p.contract_id).length > 128) {
-                    throw clientValidationError("consumer_access: contract mode requires a bounded contract_id");
-                }
-            }
-            else if (p.contract_id !== undefined) {
-                throw clientValidationError("consumer_access: contract_id requires contract mode");
-            }
-            if (input.private === false)
-                throw clientValidationError("consumer_access: requires a private resource");
-            if (options.requireUrlTarget) {
-                if (p.version !== 1 || input.private !== true)
-                    throw clientValidationError("consumer_access: creation requires private true and version one");
-            }
-            else if (options.allowAliasClear) {
-                const expected = input.expected_consumer_access_version;
-                if (!Number.isSafeInteger(expected) ||
-                    expected < 0 ||
-                    p.version !== expected + 1 ||
-                    Object.keys(input).some((key) => key !== "consumer_access" && key !== "expected_consumer_access_version")) {
-                    throw clientValidationError("consumer_access: update requires its expected version and no metadata changes");
-                }
-            }
-        }
-        else if (input.expected_consumer_access_version !== undefined) {
-            throw clientValidationError("expected_consumer_access_version: requires consumer_access");
-        }
-    });
-    collect(() => {
-        const fields = ["allowed_device_keys_add", "allowed_device_keys_remove"];
-        for (const field of fields) {
-            const keys = input[field];
-            if (keys === undefined)
-                continue;
-            requireStringArrayElements(keys, field, "updateResource");
-            if (keys.length > 256 || new Set(keys).size !== keys.length) {
-                throw clientValidationError(`${field}: must contain at most 256 unique keys`);
-            }
-            for (const key of keys) {
-                let canonical = false;
-                try {
-                    canonical = key.length === 44 && atob(key).length === 32 && btoa(atob(key)) === key;
-                }
-                catch {
-                    /* Invalid base64 is rejected below. */
-                }
-                if (!canonical) {
-                    throw clientValidationError(`${field}: keys must be canonical padded base64 of 32 bytes`);
-                }
-            }
-            if (input.custom_domain !== undefined) {
-                throw clientValidationError(`${field}: update separately from custom_domain`);
-            }
-        }
-        const added = new Set(input.allowed_device_keys_add);
-        if (input.allowed_device_keys_remove?.some((key) => added.has(key))) {
-            throw clientValidationError("allowed device key additions and removals must not overlap");
-        }
-    });
-    const resourceType = input.type;
-    if (resourceType !== undefined && typeof resourceType !== "string") {
-        errors.push(`type: must be a string (got ${resourceType === null ? "null" : typeof resourceType})`);
-    }
-    collect(() => {
-        if (input.target_url === undefined) {
-            if (options.requireUrlTarget && (resourceType === undefined || resourceType === "url")) {
-                throw clientValidationError("target_url: is required for url resources");
-            }
-            return;
-        }
-        requireValidTargetUrl(input.target_url);
-    });
-    collect(() => requireMaxLength(input.description, "description", MAX_DESCRIPTION));
-    collect(() => requireMaxLength(input.custom_domain, "custom_domain", MAX_CUSTOM_DOMAIN));
-    collect(() => {
-        if (options.allowCustomDomainClear && input.custom_domain === "")
-            return;
-        requireNonEmptyIfPresent(input.custom_domain, "custom_domain");
-    });
-    collect(() => requireValidTags(input.tags));
-    collect(() => {
-        if (input.alias !== undefined) {
-            if (input.alias === null) {
-                if (!options.allowAliasClear) {
-                    throw clientValidationError("alias: must be a string (got null)");
-                }
-            }
-            else {
-                requireMaxLength(input.alias, "alias", MAX_ALIAS);
-                requireNonEmptyIfPresent(input.alias, "alias");
-            }
-        }
-    });
-    collect(() => {
-        if (input.slug === undefined)
-            return;
-        requireMaxLength(input.slug, "slug", MAX_SLUG);
-        requireNonEmptyIfPresent(input.slug, "slug");
-    });
-    collect(() => {
-        if (options.validateFindOrCreate &&
-            input.find_or_create !== undefined &&
-            typeof input.find_or_create !== "boolean") {
-            throw clientValidationError(`find_or_create: must be a boolean (got ${describeShape(input.find_or_create)})`);
-        }
-    });
-    collect(() => {
-        if (options.validatePreserveHost &&
-            input.preserve_host !== undefined &&
-            typeof input.preserve_host !== "boolean") {
-            throw clientValidationError(`preserve_host: must be a boolean (got ${describeShape(input.preserve_host)})`);
-        }
-    });
-    if (errors.length > 0) {
-        throw clientValidationError(errors.join("; "));
-    }
-}
-function validateWebhookWriteFields(input, method, requiredFields = {}) {
-    if (requiredFields.url || input.url !== undefined) {
-        requireNonEmptyStringField(input, "url", method);
-        requireValidHttpUrl(input.url, "url");
-    }
-    if (requiredFields.events || input.events !== undefined) {
-        requireNonEmptyArrayField(input, "events", method);
-        requireStringArrayElements(input.events, "events", method);
-    }
-    requireMaxLength(input.description, "description", MAX_DESCRIPTION);
-    if (input.status !== undefined) {
-        requireNonEmptyStringField(input, "status", method);
-    }
-}
-function validateApiKeyWriteFields(input, method, requiredFields = {}) {
-    if (requiredFields.name || input.name !== undefined) {
-        requireNonEmptyStringField(input, "name", method);
-        requireMaxLength(input.name, "name", MAX_API_KEY_NAME);
-    }
-    if (requiredFields.scopes || input.scopes !== undefined) {
-        requireNonEmptyArrayField(input, "scopes", method);
-        requireStringArrayElements(input.scopes, "scopes", method);
-        const unsupported = input.scopes.find((scope) => !API_KEY_REQUEST_SCOPES.has(scope));
-        if (unsupported !== undefined) {
-            throw clientValidationError(`${method}: scopes contains an unsupported permission ${JSON.stringify(unsupported)}; this SDK accepts ${API_KEY_REQUEST_SCOPE_VALUES.join(", ")}`);
-        }
-    }
-}
-function validateEnrollmentTokenFields(input, method) {
-    if (input.target !== undefined &&
-        (typeof input.target !== "string" || !CREDENTIAL_TARGETS.has(input.target))) {
-        throw clientValidationError(`${method}: target must be 'agent' or 'connector'`);
-    }
-    let claimCount = 0;
-    if (input.claims !== undefined) {
-        if (!Array.isArray(input.claims)) {
-            throw clientValidationError(`${method}: claims must be an array`);
-        }
-        if (input.claims.length > 1) {
-            throw clientValidationError(`${method}: claims must contain at most one claim`);
-        }
-        claimCount = input.claims.length;
-        for (const [index, claim] of input.claims.entries()) {
-            if (!claim || typeof claim !== "object" || Array.isArray(claim)) {
-                throw clientValidationError(`${method}: claims[${index}] must be an object`);
-            }
-            requireNoUnknownFields(claim, ["type", "id"], `${method}: claims[${index}]`);
-            const record = claim;
-            if (typeof record.type !== "string" || !CREDENTIAL_CLAIM_TYPES.has(record.type)) {
-                throw clientValidationError(`${method}: claims[${index}].type must be 'connector'`);
-            }
-            if (typeof record.id !== "string" || !CONNECTOR_SLUG_PATTERN.test(record.id)) {
-                throw clientValidationError(`${method}: claims[${index}].id is not a valid connector slug; use 3-64 lowercase letters, digits, or hyphens, starting with a letter and ending with a letter or digit`);
-            }
-        }
-    }
-    // CreateApiKeyRequest.target permits an agent with zero or one connector claim.
-    if (input.target === "connector" && claimCount !== 1) {
-        throw clientValidationError(`${method}: target 'connector' requires exactly one claim`);
-    }
-    if (input.expires_in !== undefined) {
-        if (typeof input.expires_in !== "string") {
-            throw clientValidationError(`${method}: expires_in must be a duration string`);
-        }
-        const match = CREDENTIAL_DURATION_PATTERN.exec(input.expires_in);
-        if (!match) {
-            throw clientValidationError(`${method}: expires_in must match <integer><s|m|h|d|w>`);
-        }
-        const seconds = BigInt(match[1]) * CREDENTIAL_DURATION_MULTIPLIERS[match[2]];
-        if (seconds <= 0n || seconds > MAX_ENROLLMENT_TOKEN_TTL_SECONDS) {
-            throw clientValidationError(`${method}: expires_in must be greater than zero and at most 24h`);
-        }
-    }
-}
-/**
- * Per-entry shape guard for {@link BatchItemResult}. Verifies every
- * non-optional field on the branch of the discriminated union selected
- * by the `success` discriminant. Protects consumers who narrow on
- * `success` and then access `resource_id` / `qurl_link` / `error` as
- * guaranteed-present — if the API ever omits one, we trip the guard
- * rather than returning `undefined` where the type says `string`.
- *
- * Returns `null` when the entry is valid, or a human-readable reason
- * string describing the *specific* field that's missing or wrong. The
- * reason never echoes the entry's values — only field names and shape
- * descriptors — so the caller can safely surface it in error messages
- * that may end up in observability pipelines. Contrast with the outer
- * guard's intentional silence about response-body content for the
- * same info-leak reason.
- */
-function batchItemResultValidationReason(entry) {
-    if (!entry || typeof entry !== "object")
-        return "not an object";
-    const e = entry;
-    // `Number.isInteger` rejects NaN, Infinity, and floats; combined
-    // with `>= 0`, the check rules out pathological proxy bodies that
-    // would attribute to a useless index. `index` is informational, so
-    // this isn't a correctness hazard, but tightening the constraint
-    // matches the same posture as the count integer guards above.
-    if (!Number.isInteger(e.index) || e.index < 0) {
-        return "missing/invalid 'index' (expected non-negative integer)";
-    }
-    if (e.success === true) {
-        if (typeof e.resource_id !== "string") {
-            return "success-branch missing required field 'resource_id' (expected string)";
-        }
-        if (typeof e.qurl_link !== "string") {
-            return "success-branch missing required field 'qurl_link' (expected string)";
-        }
-        if (typeof e.qurl_site !== "string") {
-            return "success-branch missing required field 'qurl_site' (expected string)";
-        }
-        return null;
-    }
-    if (e.success === false) {
-        if (!e.error || typeof e.error !== "object") {
-            return "failure-branch missing required field 'error' (expected object)";
-        }
-        const err = e.error;
-        if (typeof err.code !== "string") {
-            return "failure-branch missing required field 'error.code' (expected string)";
-        }
-        if (typeof err.message !== "string") {
-            return "failure-branch missing required field 'error.message' (expected string)";
-        }
-        return null;
-    }
-    return "missing/invalid 'success' discriminant (expected boolean)";
-}
-// ---- Portal-verb helpers (mirrors qurl-go) -------------------------------
-// Client-side guardrails for the portal flow (protectUrl → createPortal →
-// enterPortal), kept in lockstep with qurl-go's option validation and
-// qurl-python's port of it.
-/**
- * Client-side floor for portal lifetimes, mirroring qurl-go's `ValidFor`.
- * The LayerV API remains the source of truth for account limits; there is
- * intentionally no SDK-side maximum because an account may allow
- * longer-lived portals.
- */
-const MIN_PORTAL_VALID_FOR_SECONDS = 60;
-/**
- * Client-side floor for session durations, mirroring qurl-go's
- * `WithSessionDuration` (at least one second; zero is rejected rather than
- * treated as the server default).
- */
-const MIN_SESSION_DURATION_SECONDS = 1;
-/**
- * Shape of qurl-go's offline signed-fragment links: three or more
- * dot-separated base64url parts (<version>.<claims>.<secret>.<sig>).
- * Detected only to give those links a precise error in extractAccessToken.
- *
- * @internal Exported for in-package tests; not re-exported from index.ts.
- */
-export const SIGNED_FRAGMENT_RE = /^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+){2,}$/;
-// Access-token grammar accepted by enterPortal (base64url charset).
-const ACCESS_TOKEN_RE = /^[A-Za-z0-9_-]+$/;
-/**
- * Serialize a duration option to the API's h/m/s duration grammar.
- *
- * Strings pass through unvalidated — the server is authoritative, same as
- * the REST-shaped `expires_in` fields. Numbers are milliseconds and get
- * qurl-go's client-side guardrails: whole seconds only and at least
- * `minimumSeconds` (checked in that order so e.g. 30.5s reports "at least
- * 60s" in every SDK). Serialized with hours as the largest unit so all API
- * duration fields use the same grammar across SDKs.
- */
-function serializeApiDuration(value, field, minimumSeconds) {
-    if (value === undefined)
-        return undefined;
-    if (typeof value === "string") {
-        if (value.trim() === "") {
-            throw clientValidationError(`${field}: must be a non-empty duration string`);
-        }
-        return value;
-    }
-    if (typeof value === "number") {
-        // NaN fails no comparison, so an explicit finite check keeps the
-        // error actionable instead of a misleading "whole seconds" report.
-        if (!Number.isFinite(value)) {
-            throw clientValidationError(`${field}: must be a finite number of milliseconds`);
-        }
-        if (value < minimumSeconds * 1000) {
-            throw clientValidationError(`${field}: must be at least ${minimumSeconds}s`);
-        }
-        if (value % 1000 !== 0) {
-            throw clientValidationError(`${field}: must be whole seconds`);
-        }
-        const seconds = value / 1000;
-        if (seconds % 3600 === 0)
-            return `${seconds / 3600}h`;
-        if (seconds % 60 === 0)
-            return `${seconds / 60}m`;
-        return `${seconds}s`;
-    }
-    throw clientValidationError(`${field}: must be a duration string (e.g. "5m") or a number of milliseconds`);
-}
-/**
- * Portal-verb target URL validation (qurl-go `ProtectURL` parity). On top of
- * the shared scheme/length check, the URL must carry a host and must parse,
- * and embedded credentials (userinfo) are rejected. The added checks never
- * echo the URL — a userinfo URL contains credentials that must stay out of
- * logs and error messages. The REST-shaped compatibility layer keeps its
- * original prefix-only check so its accepted inputs don't change.
- */
-function requirePortalTargetUrl(targetUrl) {
-    requireValidTargetUrl(targetUrl);
-    const url = targetUrl; // requireValidTargetUrl only returns for http(s) strings
-    // WHATWG URL normalizes away an empty authority ("https:///x" parses
-    // with host "x"), so the host-presence check runs on the raw string,
-    // mirroring qurl-go's url.Parse which rejects authority-less URLs.
-    const afterScheme = url.slice(url.indexOf("://") + 3);
-    if (afterScheme === "" || "/?#".includes(afterScheme[0])) {
-        throw clientValidationError("target_url: must include a host");
-    }
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch {
-        throw clientValidationError("target_url: malformed URL");
-    }
-    if (parsed.username !== "" || parsed.password !== "") {
-        throw clientValidationError("target_url: must not include embedded credentials (userinfo)");
-    }
-}
-/**
- * Extract the access token from a qURL link, or pass a bare token through.
- *
- * Platform-issued links carry the access token in the URL fragment
- * (`https://qurl.link/#at_...`). Error messages deliberately never echo the
- * input — qURL links are credentials and must stay out of logs.
- */
-function extractAccessToken(qurlLink) {
-    if (typeof qurlLink !== "string" || qurlLink.trim() === "") {
-        throw clientValidationError("qurlLink: must be a non-empty string");
-    }
-    const hashIndex = qurlLink.indexOf("#");
-    const token = hashIndex >= 0 ? qurlLink.slice(hashIndex + 1) : qurlLink;
-    if (SIGNED_FRAGMENT_RE.test(token)) {
-        throw clientValidationError("qurlLink: this is a signed qURL link (offline fragment format), which cannot be " +
-            "opened through the API resolver — enterPortal only accepts platform links " +
-            "(https://qurl.link/#at_...) or bare access tokens");
-    }
-    if (token === "" || !ACCESS_TOKEN_RE.test(token)) {
-        throw clientValidationError("qurlLink: no access token found — pass a platform qURL link " +
-            "(https://qurl.link/#at_...) or a bare access token");
-    }
-    return token;
-}
-/**
- * Parse an RFC 3339 timestamp from the API into a `Date`, or `undefined`
- * when absent or unparseable. The portal surface exposes `Date` (matching
- * qurl-go's `time.Time` and qurl-python's `datetime`); the REST-shaped
- * layer keeps raw wire strings.
- */
-function parseApiDate(value) {
-    if (typeof value !== "string" || value === "")
-        return undefined;
-    const parsed = new Date(value);
-    return Number.isNaN(parsed.getTime()) ? undefined : parsed;
-}
-/**
- * Parse a {@link Portal} from a create-portal API response. `resource_id`
- * and `qurl_link` are required, mirroring qurl-go's fail-closed response
- * check; everything else is optional because the two mint endpoints differ
- * in which ancillary fields they return.
- */
-async function parsePortal(data, method, expectedCrid) {
-    if (typeof data?.resource_id !== "string" || data.resource_id.trim() === "") {
-        throw unexpectedResponseError(`${method}: response is missing resource_id`);
-    }
-    if (typeof data.qurl_link !== "string" || data.qurl_link.trim() === "") {
-        throw unexpectedResponseError(`${method}: response is missing qurl_link`);
-    }
-    await verifyResourceIdentity(data, method, expectedCrid);
-    return {
-        crid: data.crid,
-        resourcePublicKey: data.resource_id,
-        link: data.qurl_link,
-        site: data.qurl_site,
-        expiresAt: parseApiDate(data.expires_at),
-        // Same empty-string → absent normalization the REST-shaped layer's
-        // consumers apply to qurl_id.
-        qurlId: data.qurl_id || undefined,
-        label: data.label,
-    };
-}
-/**
- * Validate portal options and build the create-portal wire body. The service
- * requires a JSON object even when every option is omitted; `{}` selects the
- * owner's plan defaults and matches qurl-go's zero-value request struct.
- */
-function buildCreatePortalBody(opts, method) {
-    requireObjectInput(opts, method);
-    requireNoUnknownFields(opts, CREATE_PORTAL_OPTION_KEYS, method);
-    // null → omitted, via the SDK-wide normalizePatchFields convention.
-    const { validFor, label, oneTimeUse, maxSessions, sessionDuration, targetPath } = normalizePatchFields(opts, CREATE_PORTAL_OPTION_KEYS);
-    if (label !== undefined) {
-        requireMaxLength(label, "label", MAX_LABEL);
-        // qurl-go's WithLabel rejects blank labels; the REST-shaped mintLink
-        // keeps its permissive whitespace behavior, so the check lives here.
-        if (label.trim() === "") {
-            throw clientValidationError("label: must not be empty");
-        }
-    }
-    requireBooleanIfPresent(oneTimeUse, "oneTimeUse");
-    requireMaxSessionsInRange(maxSessions, "maxSessions");
-    requireMaxUtf8Bytes(targetPath, "targetPath", MAX_TARGET_PATH);
-    requireNonEmptyIfPresent(targetPath, "targetPath");
-    if (targetPath !== undefined && method === "createPortalForUrl") {
-        throw clientValidationError("targetPath: requires an existing resource");
-    }
-    const body = {};
-    const expiresIn = serializeApiDuration(validFor, "validFor", MIN_PORTAL_VALID_FOR_SECONDS);
-    if (expiresIn !== undefined)
-        body.expires_in = expiresIn;
-    if (label !== undefined)
-        body.label = label;
-    if (oneTimeUse !== undefined)
-        body.one_time_use = oneTimeUse;
-    // Explicit 0 means unlimited and must survive body construction.
-    if (maxSessions !== undefined)
-        body.max_sessions = maxSessions;
-    const wireSessionDuration = serializeApiDuration(sessionDuration, "sessionDuration", MIN_SESSION_DURATION_SECONDS);
-    if (wireSessionDuration !== undefined)
-        body.session_duration = wireSessionDuration;
-    if (targetPath !== undefined)
-        body.target_path = targetPath;
-    return body;
+    }, meta);
 }
 /** qURL API client. */
 export class QURLClient {
@@ -2236,6 +342,7 @@ export class QURLClient {
     apiKey;
     fetchFn;
     maxRetries;
+    maxResponseBodyBytes;
     timeout;
     userAgent;
     debugFn;
@@ -2249,6 +356,15 @@ export class QURLClient {
         if (/[\r\n]/.test(options.apiKey)) {
             throw clientValidationError("apiKey: must not contain CR/LF characters");
         }
+        const responseLimit = options.maxResponseBodyBytes === undefined
+            ? MAX_RESPONSE_BODY_BYTES
+            : options.maxResponseBodyBytes;
+        if (!Number.isSafeInteger(responseLimit) ||
+            responseLimit < 1 ||
+            responseLimit > MAX_CONFIGURABLE_RESPONSE_BODY_BYTES) {
+            throw clientValidationError("maxResponseBodyBytes: must be an integer from 1 through 16777216 bytes");
+        }
+        this.maxResponseBodyBytes = responseLimit;
         this.apiKey = options.apiKey;
         const rawBaseUrl = stripTrailingSlashes(options.baseUrl ?? DEFAULT_BASE_URL);
         // Parse the URL so the loopback exemption matches on the hostname,
@@ -2345,21 +461,21 @@ export class QURLClient {
                 branch: "non-array",
                 qurls_type: typeof qurls,
             });
-            return rest;
+            return copyResponseMetadata(raw, rest);
         }
         // null is semantically "no tokens" — silent drop is fine, but surface
         // via debug so operators spot it if the API starts emitting null.
         if (qurls === null) {
             this.log("mapQurlsField: 'qurls' was null; dropping", { branch: "null" });
-            return rest;
+            return copyResponseMetadata(raw, rest);
         }
         if (qurls === undefined) {
             // Symmetric with null / non-array branches.
             this.log("mapQurlsField: 'qurls' was undefined; dropping", { branch: "undefined" });
-            return rest;
+            return copyResponseMetadata(raw, rest);
         }
         if (!rest.access_tokens) {
-            return { ...rest, access_tokens: qurls };
+            return copyResponseMetadata(raw, { ...rest, access_tokens: qurls });
         }
         // Server-side bug — drop `qurls` rather than merge. If the arrays
         // disagree, no consistent reconciliation exists; a silent merge
@@ -2369,7 +485,7 @@ export class QURLClient {
             qurls_count: qurls.length,
             access_tokens_count: rest.access_tokens.length,
         });
-        return rest;
+        return copyResponseMetadata(raw, rest);
     }
     /**
      * Validate the response envelope from POST /v1/qurls/batch and return
@@ -2393,9 +509,9 @@ export class QURLClient {
      * is malformed, additional shape errors don't help debug the upstream
      * issue.
      */
-    validateBatchCreateResponse(envelope, requestItemCount) {
-        const result = envelope.data;
-        const statusSuffix = envelope.__http_status !== undefined ? ` (HTTP ${envelope.__http_status})` : "";
+    validateBatchCreateResponse(response, requestItemCount) {
+        const result = response.envelope.data;
+        const statusSuffix = ` (HTTP ${response.status})`;
         // Thread the server's request_id into the shape-guard error so
         // operators debugging "unexpected response" tickets have the
         // correlation handle on the error path, mirroring the success-
@@ -2405,7 +521,7 @@ export class QURLClient {
         // .requestId property AND the message string so a stack trace
         // pasted into a support ticket carries the correlation handle
         // without a follow-up round-trip.
-        const requestId = boundedErrorIdentifier(envelope.meta?.request_id);
+        const requestId = boundedErrorIdentifier(response.envelope.meta?.request_id);
         const requestIdSuffix = requestId !== undefined ? ` [request_id=${requestId}]` : "";
         // `Number.isInteger` rejects NaN, Infinity, and floats. Combined
         // with `>= 0`, this rules out pathological proxy bodies (e.g.
@@ -2469,7 +585,7 @@ export class QURLClient {
             pageCount += 1;
             const page = await loadPage({ ...input, cursor });
             for (const item of itemsFromPage(page)) {
-                yield item;
+                yield copyResponseMetadata(page, item);
             }
             cursor = page.next_cursor;
             if (page.has_more === false) {
@@ -2496,7 +612,9 @@ export class QURLClient {
      * {@link ProtectedResource.createPortal}:
      *
      * ```ts
-     * const resource = await client.protectUrl("https://internal.example.com/dashboard");
+     * const resource = await client.protectUrl("https://internal.example.com/dashboard", {
+     *   name: "Team dashboard",
+     * });
      * const portal = await resource.createPortal({ validFor: "5m" });
      * share(portal.link);
      * ```
@@ -2514,6 +632,8 @@ export class QURLClient {
         // SDK-wide normalizePatchFields convention.
         const normalized = normalizePatchFields(opts, PROTECT_URL_OPTION_KEYS);
         const body = { target_url: targetUrl };
+        if (normalized.name !== undefined)
+            body.name = normalized.name;
         if (normalized.private !== undefined)
             body.private = normalized.private;
         if (normalized.consumerAccess !== undefined) {
@@ -2532,13 +652,13 @@ export class QURLClient {
         const response = await this.rawRequest("POST", "/v1/resources", body, {
             requestOptions,
         });
-        if (response.__http_status === 204)
+        if (response.status === 204)
             throw unexpectedResponseError("protectUrl: expected a resource response body");
-        const resource = response.data;
+        const resource = withEnvelopeMetadata(response.envelope.data, response.envelope.meta);
         await verifyResourceIdentity(resource, "protectUrl");
         if (normalized.consumerAccess &&
             (resource.private !== true ||
-                !sameConsumerPolicy(resource.consumer_access, normalized.consumerAccess, response.meta?.found_existing === true))) {
+                !sameConsumerPolicy(resource.consumer_access, normalized.consumerAccess, response.envelope.meta?.found_existing === true))) {
             throw unexpectedResponseError("protectUrl: private policy was not confirmed");
         }
         return new ProtectedResource(this, resource.crid, 
@@ -2565,9 +685,20 @@ export class QURLClient {
         requireResourceCrid(id, "resourceByCrid");
         return new ProtectedResource(this, id);
     }
-    /** Find or create the active qURL Connector resource for an immutable slug. */
-    async ensureConnectorResource(slug, requestOptions, consumerAccess) {
+    /**
+     * Find or create the active qURL Connector resource for an immutable slug.
+     *
+     * `name` is the public name recipients see. The service requires it when the
+     * slug is new (`400 name_required` otherwise) and ignores it on reuse.
+     *
+     * @param slug - Immutable owner-scoped Connector slug.
+     * @param requestOptions - Per-call request options.
+     * @param consumerAccess - Private consumer policy for a new resource.
+     * @param name - Public resource name; required when the slug is new.
+     */
+    async ensureConnectorResource(slug, requestOptions, consumerAccess, name) {
         requireConnectorSlug(slug, "ensureConnectorResource");
+        requireResourceNameIfPresent(name);
         if (consumerAccess !== undefined) {
             validateResourceWriteFields({ consumer_access: consumerAccess, private: true });
             if (consumerAccess.version !== 1)
@@ -2587,52 +718,52 @@ export class QURLClient {
                 type: "tunnel",
                 slug,
                 find_or_create: true,
+                ...(name !== undefined ? { name } : {}),
                 ...(consumerAccess ? { private: true, consumer_access: consumerAccess } : {}),
             }, { requestOptions, retry: false, generateIdempotencyKey: false });
             // The find-or-create endpoint returns 201 for both newly-created
             // and found-existing rows; meta.found_existing distinguishes the arms.
-            if (response.__http_status !== 201) {
-                throw unexpectedResponseError(`ensureConnectorResource: expected HTTP 201, got ${response.__http_status ?? "unknown"}`);
+            if (response.status !== 201) {
+                throw unexpectedResponseError(`ensureConnectorResource: expected HTTP 201, got ${response.status ?? "unknown"}`);
             }
             if (consumerAccess &&
-                (response.data.private !== true ||
-                    !sameConsumerPolicy(response.data.consumer_access, consumerAccess, response.meta?.found_existing === true))) {
+                (response.envelope.data.private !== true ||
+                    !sameConsumerPolicy(response.envelope.data.consumer_access, consumerAccess, response.envelope.meta?.found_existing === true))) {
                 throw unexpectedResponseError("ensureConnectorResource: private policy was not confirmed");
             }
-            resource = await parseConnectorResource(this, response.data, "ensureConnectorResource", {
+            resource = await parseConnectorResource(this, response.envelope.data, "ensureConnectorResource", {
                 slug,
             });
         }
         catch (error) {
             classifyConnectorMutationFailure("ensure", error);
         }
-        if (response.meta !== undefined &&
-            response.meta !== null &&
-            (typeof response.meta !== "object" || Array.isArray(response.meta))) {
+        if (response.envelope.meta !== undefined &&
+            response.envelope.meta !== null &&
+            (typeof response.envelope.meta !== "object" || Array.isArray(response.envelope.meta))) {
             classifyConnectorMutationFailure("ensure", unexpectedResponseError("ensureConnectorResource: response has invalid meta"));
         }
-        const foundExisting = response.meta
-            ?.found_existing;
+        const foundExisting = response.envelope.meta?.found_existing;
         if (foundExisting === undefined || foundExisting === null) {
             throw unexpectedResponseError("ensureConnectorResource: response is missing meta.found_existing; the validated resource exists, so reconcile by slug before retrying");
         }
         if (typeof foundExisting !== "boolean") {
             classifyConnectorMutationFailure("ensure", unexpectedResponseError("ensureConnectorResource: response has invalid meta.found_existing"));
         }
-        return { resource, foundExisting };
+        return withEnvelopeMetadata({ resource: withEnvelopeMetadata(resource, response.envelope.meta), foundExisting }, response.envelope.meta);
     }
     /** Fetch a qURL Connector resource by its CRID. */
     async getConnectorResource(crid) {
         requireResourceCrid(crid, "getConnectorResource");
         requireConnectorSubtleCrypto("getConnectorResource");
-        const { data, __http_status } = await this.rawRequest("GET", `/v1/resources/${encodeURIComponent(crid)}`, undefined, { retry: false });
-        if (__http_status !== 200) {
-            throw unexpectedResponseError(`getConnectorResource: expected HTTP 200, got ${__http_status ?? "unknown"}`);
+        const { envelope: { data, meta }, status: httpStatus, } = await this.rawRequest("GET", `/v1/resources/${encodeURIComponent(crid)}`, undefined, { retry: false });
+        if (httpStatus !== 200) {
+            throw unexpectedResponseError(`getConnectorResource: expected HTTP 200, got ${httpStatus ?? "unknown"}`);
         }
-        return parseConnectorResource(this, data?.resource, "getConnectorResource", {
+        return withEnvelopeMetadata(await parseConnectorResource(this, data?.resource, "getConnectorResource", {
             crid,
             revokedIsLifecycleError: true,
-        });
+        }), meta);
     }
     /** Fetch the single active qURL Connector resource for an immutable slug. */
     async getConnectorResourceBySlug(slug) {
@@ -2642,9 +773,9 @@ export class QURLClient {
         requireConnectorSubtleCrypto("getConnectorResourceBySlug");
         // The slug point lookup is intrinsically active-only. It also
         // rejects combining `slug` with `status`, so this query must stay slug-only.
-        const { data, __http_status } = await this.rawRequest("GET", `/v1/resources?slug=${encodeURIComponent(slug)}`, undefined, { retry: false });
-        if (__http_status !== 200) {
-            throw unexpectedResponseError(`getConnectorResourceBySlug: expected HTTP 200, got ${__http_status ?? "unknown"}`);
+        const { envelope: { data, meta }, status: httpStatus, } = await this.rawRequest("GET", `/v1/resources?slug=${encodeURIComponent(slug)}`, undefined, { retry: false });
+        if (httpStatus !== 200) {
+            throw unexpectedResponseError(`getConnectorResourceBySlug: expected HTTP 200, got ${httpStatus ?? "unknown"}`);
         }
         if (!Array.isArray(data)) {
             throw unexpectedResponseError("getConnectorResourceBySlug: response has missing or invalid data");
@@ -2665,7 +796,7 @@ export class QURLClient {
                 detail: `getConnectorResourceBySlug: expected one active resource, got ${data.length}`,
             });
         }
-        return parseConnectorResource(this, data[0], "getConnectorResourceBySlug", { slug });
+        return withEnvelopeMetadata(await parseConnectorResource(this, data[0], "getConnectorResourceBySlug", { slug }), meta);
     }
     /**
      * Revoke a qURL Connector resource by CRID.
@@ -2716,7 +847,7 @@ export class QURLClient {
         requireResourceCrid(resourceId, "createPortal");
         const body = buildCreatePortalBody(opts, "createPortal");
         const data = await this.request("POST", `/v1/resources/${encodeURIComponent(resourceId)}/qurls`, body, requestOptions);
-        return parsePortal(data, "createPortal", resourceId);
+        return parsePortal(data, "createPortal", resourceId, body.target_path);
     }
     /**
      * Protect `targetUrl` and mint a portal in one API call.
@@ -2739,10 +870,10 @@ export class QURLClient {
         };
         const data = await this.request("POST", "/v1/qurls", body, requestOptions);
         const portal = await parsePortal(data, "createPortalForUrl");
-        return {
+        return copyResponseMetadata(data, {
             portal,
-            resource: new ProtectedResource(this, portal.crid, targetUrl),
-        };
+            resource: copyResponseMetadata(data, new ProtectedResource(this, portal.crid, targetUrl)),
+        });
     }
     /**
      * Open a qURL link programmatically and return the reachable resource.
@@ -2772,11 +903,11 @@ export class QURLClient {
         if (typeof resolved?.target_url !== "string" || resolved.target_url === "") {
             throw unexpectedResponseError("enterPortal: access was granted but the API returned no resource URL");
         }
-        return {
+        return copyResponseMetadata(resolved, {
             resourceUrl: resolved.target_url,
             openSeconds: resolved.access_grant?.expires_in ?? 0,
             resourcePublicKey: resolved.resource_id,
-        };
+        });
     }
     // --- Public API ---
     /**
@@ -2800,6 +931,8 @@ export class QURLClient {
      *   populated `BatchCreateOutput` body in this case; whitelisted via
      *   `passthroughStatuses` so the structured per-item errors aren't
      *   swallowed by the generic error path.
+     *   HTTP 400 is the documented all-item validation failure. HTTP 422 is
+     *   not a batch passthrough status and follows normal error handling.
      *
      * Callers that only catch thrown errors will **silently miss partial
      * failures**. Always branch on `result.failed > 0` before treating the
@@ -2890,11 +1023,11 @@ export class QURLClient {
         // from the envelope and propagate it into the returned
         // BatchCreateOutput — consumers filing support tickets on partial
         // or total batch failures need the correlation ID.
-        const envelope = await this.rawRequest("POST", "/v1/qurls/batch", input, {
+        const response = await this.rawRequest("POST", "/v1/qurls/batch", input, {
             passthroughStatuses: BATCH_PASSTHROUGH_STATUSES,
             requestOptions: options,
         });
-        const result = this.validateBatchCreateResponse(envelope, input.items.length);
+        const result = this.validateBatchCreateResponse(response, input.items.length);
         // Attach the server request_id from the envelope meta without
         // mutating `result` (which is the parsed JSON body). Mirrors the
         // non-mutating style used elsewhere (e.g. `mapQurlsField`). In the
@@ -2911,7 +1044,7 @@ export class QURLClient {
         // as the source, and `meta.request_id` is the canonical envelope
         // field. The data-side variant would be a wire-format duplication
         // we don't want to silently honor.
-        const requestId = envelope.meta?.request_id;
+        const requestId = response.envelope.meta?.request_id;
         // Both-fields-present and data-only-present are both worth surfacing
         // via debug — the former because meta wins silently, the latter
         // because it suggests an envelope-shape transition. Data-side value
@@ -2933,7 +1066,7 @@ export class QURLClient {
                 });
             }
         }
-        return requestId !== undefined ? { ...result, request_id: requestId } : result;
+        return withEnvelopeMetadata(requestId !== undefined ? { ...result, request_id: requestId } : result, response.envelope.meta);
     }
     /**
      * Start one durable delegated qURL batch. The SDK sends this mutation once.
@@ -2946,7 +1079,7 @@ export class QURLClient {
         let dispatched = false;
         let acceptedBatchId;
         try {
-            const envelope = await this.rawRequest("POST", "/v1/delegated-qurl-batches", input, {
+            const response = await this.rawRequest("POST", "/v1/delegated-qurl-batches", input, {
                 requestOptions: options,
                 retry: false,
                 generateIdempotencyKey: false,
@@ -2955,25 +1088,25 @@ export class QURLClient {
                     dispatched = true;
                 },
             });
-            const status = envelope.__http_status ?? 0;
+            const status = response.status ?? 0;
             if (status !== 202) {
                 throw delegatedResponseError(status, "create returned an unexpected success status");
             }
-            const rawData = envelope.data;
+            const rawData = response.envelope.data;
             if (typeof rawData === "object" && rawData !== null && !Array.isArray(rawData)) {
                 const candidate = rawData.batch_id;
                 if (typeof candidate === "string" && DELEGATED_BATCH_ID_PATTERN.test(candidate)) {
                     acceptedBatchId = candidate;
                 }
             }
-            const { data, requestId } = delegatedEnvelope(envelope, status);
+            const { data, requestId } = delegatedEnvelope(response, status);
             const base = delegatedBatchBase(data, status, requestId);
             if (data.status !== "queued" || base.itemCount !== input.grants.length) {
                 throw delegatedResponseError(status, "acceptance data is inconsistent", requestId);
             }
-            const responseHeaders = delegatedResponseHeaders(envelope, status, requestId);
-            const location = validateDelegatedLocation(requiredDelegatedHeader(envelope, "Location", status, requestId), this.baseUrl, base.batchId, status, requestId);
-            return {
+            const responseHeaders = delegatedResponseHeaders(response, status, requestId);
+            const location = validateDelegatedLocation(requiredDelegatedHeader(response, "Location", status, requestId), this.baseUrl, base.batchId, status, requestId);
+            return withEnvelopeMetadata({
                 http_status: 202,
                 batch_id: base.batchId,
                 status: "queued",
@@ -2983,7 +1116,7 @@ export class QURLClient {
                 retry_after: responseHeaders.retryAfter,
                 location,
                 request_id: requestId,
-            };
+            }, response.envelope.meta);
         }
         catch (error) {
             if (!dispatched)
@@ -3000,41 +1133,41 @@ export class QURLClient {
             throw clientValidationError("getDelegatedQurlBatch: batchId must match dqb_ plus 22 URL-safe characters");
         }
         validateGetDelegatedQurlBatchOptions(options);
-        const envelope = await this.rawRequest("GET", `/v1/delegated-qurl-batches/${encodeURIComponent(batchId)}`, undefined, {
+        const response = await this.rawRequest("GET", `/v1/delegated-qurl-batches/${encodeURIComponent(batchId)}`, undefined, {
             passthroughStatuses: DELEGATED_BATCH_PASSTHROUGH_STATUSES,
             allowEmptyPassthroughBody: true,
             ifNoneMatch: options?.etag,
             retry: false,
             captureResponseHeaders: true,
         });
-        const status = envelope.__http_status ?? 0;
+        const status = response.status ?? 0;
         if (status === 304) {
-            if (envelope.__http_body_empty !== true || options?.etag === undefined) {
+            if (response.bodyEmpty !== true || options?.etag === undefined) {
                 throw delegatedResponseError(status, "304 response is inconsistent");
             }
-            const responseHeaders = delegatedResponseHeaders(envelope, status);
+            const responseHeaders = delegatedResponseHeaders(response, status);
             if (responseHeaders.etag !== undefined && responseHeaders.etag !== options.etag) {
                 throw delegatedResponseError(status, "304 response changed the ETag");
             }
-            return {
+            return withEnvelopeMetadata({
                 http_status: 304,
                 etag: responseHeaders.etag ?? options.etag,
                 ...(responseHeaders.retryAfter === undefined
                     ? {}
                     : { retry_after: responseHeaders.retryAfter }),
-            };
+            }, response.envelope.meta);
         }
         if (status !== 200 && status !== 202) {
             throw delegatedResponseError(status, "read returned an unexpected success status");
         }
-        const { data, requestId } = delegatedEnvelope(envelope, status);
+        const { data, requestId } = delegatedEnvelope(response, status);
         const base = delegatedBatchBase(data, status, requestId, batchId);
         if (status === 202) {
             if (data.status !== "queued" && data.status !== "running") {
                 throw delegatedResponseError(status, "pending data has a terminal status", requestId);
             }
-            const responseHeaders = delegatedResponseHeaders(envelope, status, requestId);
-            return {
+            const responseHeaders = delegatedResponseHeaders(response, status, requestId);
+            return withEnvelopeMetadata({
                 http_status: 202,
                 batch_id: base.batchId,
                 status: data.status,
@@ -3043,7 +1176,7 @@ export class QURLClient {
                 etag: responseHeaders.etag,
                 retry_after: responseHeaders.retryAfter,
                 request_id: requestId,
-            };
+            }, response.envelope.meta);
         }
         if (data.status !== "succeeded" &&
             data.status !== "partially_failed" &&
@@ -3079,17 +1212,17 @@ export class QURLClient {
         // This is the caller's only copy of the bearer links. Do not discard a
         // valid terminal body because an intermediary removed a cache validator;
         // qurl-service owns the required no-store response policy.
-        const cacheControl = envelope.__http_headers?.get("Cache-Control") ?? null;
+        const cacheControl = response.headers?.get("Cache-Control") ?? null;
         if (!hasDelegatedNoStore(cacheControl)) {
             this.log("delegated batch terminal response is missing private, no-store", {
                 batch_id: base.batchId,
             });
         }
-        const etag = envelope.__http_headers?.get("ETag") ?? undefined;
+        const etag = response.headers?.get("ETag") ?? undefined;
         const terminalEtag = etag !== undefined && etag.length <= MAX_DELEGATED_ETAG && STRONG_ETAG_PATTERN.test(etag)
             ? etag
             : undefined;
-        return {
+        return withEnvelopeMetadata({
             http_status: 200,
             batch_id: base.batchId,
             status: data.status,
@@ -3099,20 +1232,20 @@ export class QURLClient {
             results,
             ...(terminalEtag === undefined ? {} : { etag: terminalEtag }),
             request_id: requestId,
-        };
+        }, response.envelope.meta);
     }
     /** Read owner-visible metadata for one delegated qURL. */
     async getDelegatedQurl(qurlId) {
         if (typeof qurlId !== "string" || !DELEGATED_QURL_ID_PATTERN.test(qurlId)) {
             throw clientValidationError("getDelegatedQurl: qurlId must match q_ plus 11 lowercase hexadecimal characters");
         }
-        const envelope = await this.rawRequest("GET", `/v1/delegated-qurls/${encodeURIComponent(qurlId)}`);
-        const status = envelope.__http_status ?? 0;
+        const response = await this.rawRequest("GET", `/v1/delegated-qurls/${encodeURIComponent(qurlId)}`);
+        const status = response.status ?? 0;
         if (status !== 200) {
             throw delegatedResponseError(status, "read returned an unexpected success status");
         }
-        const { data, requestId } = delegatedEnvelope(envelope, status);
-        return validateDelegatedQurl(data, qurlId, status, requestId);
+        const { data, requestId } = delegatedEnvelope(response, status);
+        return withEnvelopeMetadata(validateDelegatedQurl(data, qurlId, status, requestId), response.envelope.meta);
     }
     /**
      * Revoke one delegated qURL. DELETE is never retried automatically. A 503
@@ -3150,7 +1283,7 @@ export class QURLClient {
      */
     async list(input = {}) {
         const path = appendQuery("/v1/qurls", input, LIST_PARAM_KEYS, "list");
-        const { data, meta } = await this.rawRequest("GET", path);
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", path);
         return pageFromMeta({
             // Defensive: map in case API includes nested tokens on list items in the future.
             qurls: (data ?? []).map((raw) => this.mapQurlsField(raw)),
@@ -3331,13 +1464,31 @@ export class QURLClient {
         }
         return this.request("POST", "/v1/resolve", body, options);
     }
+    /** Get the caller's account and credential identity. */
+    async getIdentity() {
+        const identity = await this.request("GET", "/v1/me");
+        if (!identity ||
+            typeof identity !== "object" ||
+            Array.isArray(identity) ||
+            typeof identity.owner_id !== "string" ||
+            !identity.owner_id ||
+            typeof identity.auth_type !== "string" ||
+            !identity.auth_type ||
+            (identity.api_key !== undefined &&
+                (!identity.api_key ||
+                    typeof identity.api_key !== "object" ||
+                    Array.isArray(identity.api_key)))) {
+            throw unexpectedResponseError("getIdentity: invalid caller identity response");
+        }
+        return identity;
+    }
     /** Get quota and usage information. */
     async getQuota() {
         return this.request("GET", "/v1/quota");
     }
     /** List resources from the `/v1/resources` API. */
     async listResources(input = {}) {
-        const { data, meta } = await this.rawRequest("GET", appendQuery("/v1/resources", input, RESOURCE_LIST_PARAM_KEYS, "listResources"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery("/v1/resources", input, RESOURCE_LIST_PARAM_KEYS, "listResources"));
         return pageFromMeta({ resources: data ?? [] }, meta);
     }
     /**
@@ -3385,6 +1536,31 @@ export class QURLClient {
         });
         return this.request("PATCH", `/v1/resources/${encodeURIComponent(id)}`, validationInput, options);
     }
+    /** Start Stripe Connect onboarding for this publisher. LayerV collects 3%. */
+    async connectPublisherStripe() {
+        const result = await this.request("POST", "/v1/payments/connect");
+        let target;
+        try {
+            target = new URL(result.url);
+        }
+        catch {
+            throw clientValidationError("invalid Stripe connection URL");
+        }
+        if (target.protocol !== "https:" ||
+            target.host !== "connect.stripe.com" ||
+            target.username ||
+            target.password)
+            throw clientValidationError("invalid Stripe connection URL");
+        return result;
+    }
+    /** Read this publisher's connected account and the fixed application fee. */
+    async publisherStripeAccount() {
+        const result = await this.request("GET", "/v1/payments/account");
+        if ((result.account_id !== "" && !/^acct_[A-Za-z0-9]{1,128}$/.test(result.account_id)) ||
+            result.layerv_fee_percent !== 3)
+            throw clientValidationError("invalid Stripe account response");
+        return result;
+    }
     /** Send a publisher-only invitation. Mail delivery does not prove enrollment. */
     async inviteConsumer(id, email) {
         requireResourceCrid(id, "inviteConsumer");
@@ -3395,12 +1571,12 @@ export class QURLClient {
     }
     async listConsumerInvitations(id, input = {}) {
         requireResourceCrid(id, "listConsumerInvitations");
-        const { data, meta } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/invitations`, input, ["cursor", "limit"], "listConsumerInvitations"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/invitations`, input, ["cursor", "limit"], "listConsumerInvitations"));
         return pageFromMeta({ invitations: data ?? [] }, meta);
     }
     async listConsumerGrants(id, input = {}) {
         requireResourceCrid(id, "listConsumerGrants");
-        const { data, meta } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/consumer-grants`, input, ["cursor", "limit"], "listConsumerGrants"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/consumer-grants`, input, ["cursor", "limit"], "listConsumerGrants"));
         return pageFromMeta({ grants: data ?? [] }, meta);
     }
     async resendConsumerInvitation(id, invitationId, expectedVersion) {
@@ -3536,7 +1712,7 @@ export class QURLClient {
         if (typeof wire.expires_at === "string" && expiresAt === undefined) {
             throw unexpectedResponseError("shareResource: response has invalid expires_at");
         }
-        return new ShareLink({
+        return new ShareLink(copyResponseMetadata(data, {
             // Repair transport-only edge whitespace on the one-time credential;
             // ancillary identifiers fail closed instead of being normalized.
             link: data.qurl.trim(),
@@ -3546,7 +1722,7 @@ export class QURLClient {
             expiresAt,
             expiresInSeconds: typeof wire.expires_in_seconds === "number" ? wire.expires_in_seconds : undefined,
             singleUse: typeof wire.single_use === "boolean" ? wire.single_use : undefined,
-        });
+        }));
     }
     /** Revoke a specific qURL token on a resource. */
     async revokeResourceQurl(id, qurlId) {
@@ -3572,7 +1748,7 @@ export class QURLClient {
         let request_id;
         let page_size;
         for await (const session of this.paginateAll("listResourceSessions", {}, async ({ cursor }) => {
-            const { data, meta } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/sessions`, { paged: "true", cursor }, ["paged", "cursor"], "listResourceSessions"));
+            const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/sessions`, { paged: "true", cursor }, ["paged", "cursor"], "listResourceSessions"));
             if (meta?.has_more && !meta.next_cursor) {
                 throw unexpectedResponseError("Session page has no continuation cursor", {
                     requestId: meta.request_id,
@@ -3580,11 +1756,11 @@ export class QURLClient {
             }
             request_id = meta?.request_id;
             page_size = meta?.page_size;
-            return { ...meta, sessions: data ?? [] };
+            return withEnvelopeMetadata({ ...meta, sessions: data ?? [] }, meta);
         }, (page) => page.sessions)) {
             sessions.push(session);
         }
-        return { sessions, request_id, has_more: false, page_size };
+        return withEnvelopeMetadata({ sessions, request_id, has_more: false, page_size }, { request_id });
     }
     /**
      * End every session page. This is not atomic: a failed page throws after earlier
@@ -3597,8 +1773,8 @@ export class QURLClient {
         let terminated = 0;
         let request_id;
         for await (const count of this.paginateAll("terminateAllResourceSessions", {}, async ({ cursor }) => {
-            const { data, meta, __http_status } = await this.rawRequest("DELETE", appendQuery(path, { paged: "true", cursor }, ["paged", "cursor"], "terminateAllResourceSessions"));
-            if (__http_status === 204) {
+            const { envelope: { data, meta }, status: httpStatus, } = await this.rawRequest("DELETE", appendQuery(path, { paged: "true", cursor }, ["paged", "cursor"], "terminateAllResourceSessions"));
+            if (httpStatus === 204) {
                 throw unexpectedResponseError(`Unexpected 204 No Content from DELETE ${path}; expected response body`, { status: 204, requestId: meta?.request_id });
             }
             if (meta?.has_more && !meta.next_cursor) {
@@ -3606,22 +1782,19 @@ export class QURLClient {
                     requestId: meta.request_id,
                 });
             }
-            if (data?.terminated === undefined) {
-                this.log("terminateAllResourceSessions: missing terminated count; defaulting to zero", {
-                    request_id: meta?.request_id,
-                });
-            }
-            else if (!Number.isSafeInteger(data.terminated) || data.terminated < 0) {
-                throw unexpectedResponseError("terminateAllResourceSessions: invalid terminated count", {
-                    requestId: meta?.request_id,
-                });
+            const count = data?.terminated;
+            if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0) {
+                throw unexpectedResponseError("terminateAllResourceSessions: missing or invalid terminated count; inspect sessions before retrying", { requestId: meta?.request_id });
             }
             request_id = meta?.request_id;
-            return { ...meta, counts: [data?.terminated ?? 0] };
+            return withEnvelopeMetadata({ ...meta, counts: [count] }, meta);
         }, (page) => page.counts)) {
             terminated += count;
+            if (!Number.isSafeInteger(terminated)) {
+                throw unexpectedResponseError("terminateAllResourceSessions: total exceeds safe integer range; inspect sessions before retrying", { requestId: request_id });
+            }
         }
-        return { terminated, request_id };
+        return withEnvelopeMetadata({ terminated, request_id }, { request_id });
     }
     /** Terminate a specific resource session. */
     async terminateResourceSession(id, sessionId) {
@@ -3631,7 +1804,7 @@ export class QURLClient {
     }
     /** List connector installations. */
     async listConnectorInstallations(input = {}) {
-        const { data, meta } = await this.rawRequest("GET", appendQuery("/v1/connectors/installations", input, CONNECTOR_INSTALLATION_LIST_PARAM_KEYS, "listConnectorInstallations"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery("/v1/connectors/installations", input, CONNECTOR_INSTALLATION_LIST_PARAM_KEYS, "listConnectorInstallations"));
         return pageFromMeta({ installations: data ?? [] }, meta);
     }
     /**
@@ -3689,7 +1862,7 @@ export class QURLClient {
     async listBillingInvoices(input = {}) {
         // This endpoint nests the list in `data.invoices` unlike the other list
         // endpoints, which return `data` as the array directly.
-        const { data, meta } = await this.rawRequest("GET", appendQuery("/v1/billing/invoices", input, BILLING_INVOICE_LIST_PARAM_KEYS, "listBillingInvoices"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery("/v1/billing/invoices", input, BILLING_INVOICE_LIST_PARAM_KEYS, "listBillingInvoices"));
         return pageFromMeta({ invoices: data?.invoices ?? [] }, meta);
     }
     /**
@@ -3714,7 +1887,7 @@ export class QURLClient {
     }
     /** List custom domains. */
     async listDomains(input = {}) {
-        const { data, meta } = await this.rawRequest("GET", appendQuery("/v1/domains", input, DOMAIN_LIST_PARAM_KEYS, "listDomains"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery("/v1/domains", input, DOMAIN_LIST_PARAM_KEYS, "listDomains"));
         return pageFromMeta({ domains: data ?? [] }, meta);
     }
     /**
@@ -3749,7 +1922,7 @@ export class QURLClient {
     }
     /** List webhooks. */
     async listWebhooks(input = {}) {
-        const { data, meta } = await this.rawRequest("GET", appendQuery("/v1/webhooks", input, WEBHOOK_LIST_PARAM_KEYS, "listWebhooks"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery("/v1/webhooks", input, WEBHOOK_LIST_PARAM_KEYS, "listWebhooks"));
         return pageFromMeta({ webhooks: data ?? [] }, meta);
     }
     /**
@@ -3806,7 +1979,7 @@ export class QURLClient {
     /** List delivery attempts for a webhook. */
     async listWebhookDeliveries(id, input = {}) {
         validatePathId(id, "listWebhookDeliveries");
-        const { data, meta } = await this.rawRequest("GET", appendQuery(`/v1/webhooks/${encodeURIComponent(id)}/deliveries`, input, WEBHOOK_DELIVERY_LIST_PARAM_KEYS, "listWebhookDeliveries"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery(`/v1/webhooks/${encodeURIComponent(id)}/deliveries`, input, WEBHOOK_DELIVERY_LIST_PARAM_KEYS, "listWebhookDeliveries"));
         return pageFromMeta({ deliveries: data ?? [] }, meta);
     }
     /**
@@ -3820,6 +1993,87 @@ export class QURLClient {
         validateListAllInput(input, WEBHOOK_DELIVERY_LIST_PARAM_KEYS, "listAllWebhookDeliveries");
         return this.paginateAll("listAllWebhookDeliveries", input, (pageInput) => this.listWebhookDeliveries(id, pageInput), (page) => page.deliveries);
     }
+    /**
+     * Bind an external identity using the provider's trusted OAuth JWT as the
+     * client's bearer credential. Persist the request key before calling, then
+     * securely store the returned one-time plaintext key without logging it.
+     * Retry a lost response within 24 hours with the same key and body.
+     */
+    async createExternalIdentityBinding(input, options) {
+        const method = "createExternalIdentityBinding";
+        requireObjectInput(input, method);
+        requireNoUnknownFields(input, ["provider", "external_id", "display_name", "rotate_existing"], method);
+        if (!["slack", "discord", "teams"].includes(input.provider)) {
+            throw clientValidationError(`${method}: provider must be slack, discord, or teams`);
+        }
+        if (typeof input.external_id !== "string" ||
+            input.external_id.length > 256 ||
+            !/^[\x21-\x22\x24-\x7e]+$/.test(input.external_id)) {
+            throw clientValidationError(`${method}: external_id must contain 1-256 visible ASCII characters without #`);
+        }
+        if (input.display_name !== undefined &&
+            (typeof input.display_name !== "string" ||
+                [...input.display_name].length > 100 ||
+                /[\uD800-\uDFFF]/u.test(input.display_name))) {
+            throw clientValidationError(`${method}: display_name must contain at most 100 Unicode characters`);
+        }
+        requireBooleanIfPresent(input.rotate_existing, `${method}.rotate_existing`);
+        validateRequestOptions(options);
+        if (!options?.idempotencyKey || options.idempotencyKey.length < 32) {
+            throw clientValidationError(`${method}: a persisted idempotencyKey of 32-256 characters is required`);
+        }
+        const body = {
+            provider: input.provider,
+            external_id: input.external_id,
+            ...(input.display_name !== undefined ? { display_name: input.display_name } : {}),
+            ...(input.rotate_existing !== undefined ? { rotate_existing: input.rotate_existing } : {}),
+        };
+        const raw = await this.rawRequest("POST", "/v1/external-identity-bindings", body, {
+            requestOptions: options,
+            generateIdempotencyKey: false,
+        });
+        // This operation returns a flat document, unlike the data/meta endpoints.
+        const result = raw.envelope;
+        const expectedScopes = body.provider === "discord"
+            ? ["qurl:read", "qurl:write"]
+            : ["qurl:read", "qurl:write", "qurl:agent"];
+        if (raw.status !== 201 ||
+            typeof result.binding_id !== "string" ||
+            !/^eib_[A-Za-z0-9]{11}$/.test(result.binding_id) ||
+            result.provider !== body.provider ||
+            result.external_id !== body.external_id ||
+            !result.api_key ||
+            typeof result.api_key !== "object" ||
+            Array.isArray(result.api_key) ||
+            typeof result.api_key.key_id !== "string" ||
+            !/^key_[A-Za-z0-9]{12}$/.test(result.api_key.key_id) ||
+            typeof result.api_key.plaintext !== "string" ||
+            !/^lv_(?:live|test)_[A-Za-z0-9_-]{43}$/.test(result.api_key.plaintext) ||
+            result.api_key.key_prefix !== result.api_key.plaintext.slice(0, 12) ||
+            !Array.isArray(result.scopes) ||
+            result.scopes.length !== expectedScopes.length ||
+            !expectedScopes.every((scope) => result.scopes.includes(scope)) ||
+            !isUtcTimestamp(result.created_at) ||
+            (result.display_name !== undefined &&
+                (typeof result.display_name !== "string" ||
+                    [...result.display_name].length > 100 ||
+                    /[\uD800-\uDFFF]/u.test(result.display_name)))) {
+            throw unexpectedResponseError(`${method}: invalid binding response; reconcile with the same request key before retrying`);
+        }
+        return withEnvelopeMetadata({
+            binding_id: result.binding_id,
+            provider: result.provider,
+            external_id: result.external_id,
+            ...(result.display_name !== undefined ? { display_name: result.display_name } : {}),
+            api_key: {
+                key_id: result.api_key.key_id,
+                key_prefix: result.api_key.key_prefix,
+                plaintext: result.api_key.plaintext,
+            },
+            scopes: result.scopes,
+            created_at: result.created_at,
+        }, raw.envelope.meta);
+    }
     /** Create a new API key. */
     async createApiKey(input, options) {
         requireObjectInput(input, "createApiKey");
@@ -3858,7 +2112,7 @@ export class QURLClient {
     }
     /** List API keys. */
     async listApiKeys(input = {}) {
-        const { data, meta } = await this.rawRequest("GET", appendQuery("/v1/api-keys", input, API_KEY_LIST_PARAM_KEYS, "listApiKeys"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery("/v1/api-keys", input, API_KEY_LIST_PARAM_KEYS, "listApiKeys"));
         return pageFromMeta({ api_keys: data ?? [] }, meta);
     }
     /**
@@ -3912,19 +2166,19 @@ export class QURLClient {
      * this page and emits a debug log rather than pretending it fetched all pages.
      */
     async listAccessCodes() {
-        const { data, meta } = await this.rawRequest("GET", "/v1/access-codes");
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", "/v1/access-codes");
         if (meta?.has_more || meta?.next_cursor) {
             this.log("listAccessCodes: pagination metadata surfaced on unpaginated endpoint", {
                 has_more: meta.has_more,
                 next_cursor: meta.next_cursor,
             });
         }
-        return {
+        return withEnvelopeMetadata({
             access_codes: data ?? [],
             request_id: meta?.request_id,
             has_more: false,
             page_size: meta?.page_size,
-        };
+        }, meta);
     }
     /** Revoke an access code. */
     async revokeAccessCode(id) {
@@ -3935,13 +2189,13 @@ export class QURLClient {
     async request(method, path, body, requestOptions) {
         // List methods call rawRequest directly so 204 can degrade to an empty page.
         // Body-returning endpoints declare 200 JSON today, so this path fails closed.
-        const { data, __http_status } = await this.rawRequest(method, path, body, {
+        const { envelope: { data, meta }, status: httpStatus, } = await this.rawRequest(method, path, body, {
             requestOptions,
         });
-        if (__http_status === 204) {
+        if (httpStatus === 204) {
             throw unexpectedResponseError(`Unexpected 204 No Content from ${method} ${path}; expected response body`);
         }
-        return data;
+        return withEnvelopeMetadata(data, meta);
     }
     /**
      * Require the service's exact 204 response with no response bytes exposed by
@@ -3952,9 +2206,9 @@ export class QURLClient {
         const response = await this.rawRequest("DELETE", path, undefined, {
             allowEmptySuccessBody: true,
         });
-        if (response.__http_status !== 204 || response.__http_body_empty !== true) {
-            const status = response.__http_status ?? 0;
-            const bodyShape = response.__http_body_empty ? "with an empty body" : "with response bytes";
+        if (response.status !== 204 || response.bodyEmpty !== true) {
+            const status = response.status ?? 0;
+            const bodyShape = response.bodyEmpty ? "with an empty body" : "with response bytes";
             throw unexpectedResponseError(`Unexpected response from DELETE; expected empty HTTP 204, received HTTP ${status} ${bodyShape}. ` +
                 "The delete may already have been applied; reconcile resource state before retrying.", { status });
         }
@@ -4023,7 +2277,8 @@ export class QURLClient {
                 // request bound: roughly `timeout * (maxRetries + 1) +
                 // sum(retryDelay)`.
                 onDispatch?.();
-                response = await this.fetchFn(url, {
+                // Native edge fetch requires the global receiver, not this client.
+                response = await this.fetchFn.call(globalThis, url, {
                     method,
                     headers,
                     body: serializedBody,
@@ -4071,14 +2326,14 @@ export class QURLClient {
             }
             let responseBody;
             try {
-                responseBody = await readBoundedResponseBody(response);
+                responseBody = await readBoundedResponseBody(response, this.maxResponseBodyBytes);
             }
             catch (err) {
                 if (err instanceof ResponseBodyTooLargeError) {
                     this.log(`rejected oversized response body from ${response.status}`, {
                         status: response.status,
                     });
-                    const detail = `Response body exceeds ${MAX_RESPONSE_BODY_BYTES}-byte limit on HTTP ${response.status}; ` +
+                    const detail = `Response body exceeds ${this.maxResponseBodyBytes}-byte limit on HTTP ${response.status}; ` +
                         "request a smaller page when listing collections";
                     if (response.ok) {
                         throw unexpectedResponseError(detail, { status: response.status });
@@ -4195,10 +2450,10 @@ export class QURLClient {
                         });
                     }
                     return {
-                        data: undefined,
-                        __http_status: response.status,
-                        __http_body_empty: responseBody.length === 0,
-                        __http_headers: captureResponseHeaders ? response.headers : undefined,
+                        envelope: { data: undefined },
+                        status: response.status,
+                        bodyEmpty: responseBody.length === 0,
+                        headers: captureResponseHeaders ? response.headers : undefined,
                     };
                 }
                 // Exact no-content helpers must inspect both axes of the success
@@ -4208,20 +2463,20 @@ export class QURLClient {
                     (isPassthrough && allowEmptyPassthroughBody)) &&
                     responseBody.length === 0) {
                     return {
-                        data: undefined,
-                        __http_status: response.status,
-                        __http_body_empty: true,
-                        __http_headers: captureResponseHeaders ? response.headers : undefined,
+                        envelope: { data: undefined },
+                        status: response.status,
+                        bodyEmpty: true,
+                        headers: captureResponseHeaders ? response.headers : undefined,
                     };
                 }
                 try {
                     const json = JSON.parse(responseBody);
                     return {
-                        ...json,
-                        __http_status: response.status,
+                        envelope: { ...json },
+                        status: response.status,
                         // JSON.parse("") throws, so parsed JSON is necessarily non-empty.
-                        __http_body_empty: false,
-                        __http_headers: captureResponseHeaders ? response.headers : undefined,
+                        bodyEmpty: false,
+                        headers: captureResponseHeaders ? response.headers : undefined,
                     };
                 }
                 catch {
@@ -4289,6 +2544,7 @@ export class QURLClient {
                     instance: boundedErrorIdentifier(err.instance),
                     invalid_fields: boundedInvalidFields(err.invalid_fields),
                     request_id: boundedErrorIdentifier(json.meta?.request_id),
+                    tombstone: response.status === 410 ? boundedTombstone(json.meta?.tombstone) : undefined,
                     retry_after: this.parseRetryAfter(response),
                 };
             }
@@ -4335,8 +2591,8 @@ export class QURLClient {
         const trimmed = header.trim();
         if (/^[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/.test(trimmed)) {
             const seconds = Math.ceil((Date.parse(trimmed) - Date.now()) / 1000);
-            return Number.isSafeInteger(seconds) && seconds > 0 && seconds <= RETRY_AFTER_PARSE_LIMIT_S
-                ? seconds
+            return Number.isSafeInteger(seconds)
+                ? Math.min(Math.max(0, seconds), RETRY_AFTER_PARSE_LIMIT_S)
                 : undefined;
         }
         if (!/^\d+$/.test(trimmed)) {
@@ -4420,92 +2676,7 @@ export class QURLClient {
         return new NetworkError(`Network failure while reading response body after HTTP ${response.status}`, { cause: err });
     }
 }
-/**
- * A LayerV-protected resource, bound to the client that produced it.
- *
- * Obtained from {@link QURLClient.protectUrl} or {@link QURLClient.resourceByCrid} —
- * not constructed directly. Mint short-lived access links for the resource
- * with {@link createPortal} (qurl-go: `qurl.Resource`).
- */
-export class ProtectedResource {
-    // A true private field (not a module-scope WeakMap registry, which
-    // CONTRIBUTING.md's dual-build rule bars) so the binding stays on the
-    // instance and out of Object.keys/JSON.stringify output.
-    #client;
-    /** The public resource CRID. */
-    crid;
-    /** The private URL protected by this resource, when known. */
-    targetUrl;
-    /**
-     * Full server-populated {@link Resource} metadata when the handle came
-     * from an API response; `undefined` for {@link QURLClient.resourceByCrid}
-     * handles and for the one-call {@link QURLClient.createPortalForUrl} path.
-     */
-    details;
-    constructor(client, id, targetUrl, details) {
-        this.#client = client;
-        this.crid = id;
-        this.targetUrl = targetUrl;
-        this.details = details;
-    }
-    /**
-     * Whether `resource` was produced by `client`. A static because the
-     * binding lives in a private field that only this class can read; used
-     * by {@link QURLClient.createPortal} to refuse handles bound to a
-     * different client.
-     */
-    static isBoundTo(resource, client) {
-        return resource.#client === client;
-    }
-    /**
-     * Mint a short-lived qURL link (a portal) for this resource. See
-     * {@link QURLClient.createPortal} for the option reference.
-     */
-    async createPortal(opts = {}, requestOptions) {
-        return this.#client.createPortal(this, opts, requestOptions);
-    }
-}
-const CONNECTOR_RESOURCE_CONSTRUCTOR_TOKEN = Symbol("validated ConnectorResource");
-/**
- * A validated qURL Connector resource bound to the client that loaded it.
- *
- * Resource identity, reverse-routing identity, and NHP admission identity are
- * distinct server-issued values. Callers must consume each field verbatim and
- * must never derive one from another.
- */
-export class ConnectorResource {
-    #client;
-    resourcePublicKey;
-    /** Required public identifier, verified against the returned resource key. */
-    crid;
-    connectorRoutingId;
-    knockResourceId;
-    slug;
-    alias;
-    /** @internal Instances are returned by QURLClient after wire validation. */
-    constructor(client, details, validationToken) {
-        if (validationToken !== CONNECTOR_RESOURCE_CONSTRUCTOR_TOKEN) {
-            throw clientValidationError("ConnectorResource cannot be constructed directly; load it through QURLClient");
-        }
-        this.#client = client;
-        this.resourcePublicKey = details.resource_id;
-        this.crid = details.crid;
-        this.connectorRoutingId = details.connector_routing_id;
-        this.knockResourceId = details.knock_resource_id;
-        this.slug = details.slug;
-        this.alias = details.alias ?? undefined;
-    }
-    /** Mint a short-lived portal for this Connector resource. */
-    async createPortal(opts = {}, requestOptions) {
-        return this.#client.createPortal(this.crid, opts, requestOptions);
-    }
-}
-function sameConsumerPolicy(actual, expected, foundExisting) {
-    return (actual?.mode === expected.mode &&
-        (actual?.version === expected.version ||
-            (foundExisting &&
-                Number.isSafeInteger(actual?.version) &&
-                Number(actual?.version) > expected.version)) &&
-        actual?.contract_id === expected.contract_id);
-}
-//# sourceMappingURL=client.js.map
+export { isApiKeyRequestScope } from "./client-management.js";
+export { SIGNED_FRAGMENT_RE } from "./client-portals.js";
+export { ProtectedResource } from "./client-portals.js";
+export { ConnectorResource } from "./client-connectors.js";