@layervai/qurl 3.1.0 → 4.0.0

package/dist/esm/crid.d.ts

@@ -1,4 +1,3 @@
 export declare const CRID_DOMAIN = "NHP-QURL-CRID-V1\0";
 export declare function parseCrid(value: unknown, knownVersionOnly?: boolean): Uint8Array | undefined;
 export declare function cridKeyMatches(value: unknown, der: Uint8Array): Promise<boolean>;
-//# sourceMappingURL=crid.d.ts.map

package/dist/esm/crid.js

@@ -55,4 +55,3 @@ export async function cridKeyMatches(value, der) {
         difference |= expected[i] ^ digest[i];
     return difference === 0;
 }
-//# sourceMappingURL=crid.js.map

package/dist/esm/errors.d.ts

@@ -1,4 +1,4 @@
-import type { QURLErrorData } from "./types.js";
+import type { QURLErrorData, TombstoneInfo } from "./types.js";
 /**
  * Sentinel `.code` values for SDK-internal failure modes (no real HTTP
  * status applies). Exported as constants so consumers branching on
@@ -32,6 +32,12 @@ export declare const ERROR_CODE_CONNECTOR_RESOURCE_REVOKED = "connector_resource
 export declare const ERROR_CODE_RESOURCE_NOT_FOUND = "resource_not_found";
 /** A Connector slug lookup matched more than one active resource (client-detected, `status: 0`). */
 export declare const ERROR_CODE_AMBIGUOUS_RESOURCE = "ambiguous_resource";
+/**
+ * Server `.code` (on a 400 `ValidationError`) when a create that makes a new
+ * resource has no `name`, or `PATCH /v1/resources/{id}/preview` sets an empty
+ * one. Nothing was written; add the public name and retry.
+ */
+export declare const ERROR_CODE_NAME_REQUIRED = "name_required";
 /** Fallback `.code` when the server returns a non-RFC-7807 response (HTML proxy page, plaintext gateway error, JSON without `error` envelope). */
 export declare const ERROR_CODE_UNKNOWN = "unknown";
 /**
@@ -67,6 +73,8 @@ export declare class QURLError extends Error {
     readonly invalidFields?: Record<string, string>;
     readonly requestId?: string;
     readonly retryAfter?: number;
+    /** Retained resource metadata supplied by a 410 Gone response. */
+    readonly tombstone?: TombstoneInfo;
     /** Known minted IDs from a rejected terminal batch, for bounded cleanup. No bearer links. */
     readonly partialQurlIds?: readonly string[];
     constructor(data: QURLErrorData);
@@ -173,4 +181,3 @@ export declare class RuntimeError extends QURLError {
 }
 /** Create the appropriate QURLError subclass for an HTTP status code. */
 export declare function createError(data: QURLErrorData): QURLError;
-//# sourceMappingURL=errors.d.ts.map

package/dist/esm/errors.js

@@ -31,6 +31,12 @@ export const ERROR_CODE_CONNECTOR_RESOURCE_REVOKED = "connector_resource_revoked
 export const ERROR_CODE_RESOURCE_NOT_FOUND = "resource_not_found";
 /** A Connector slug lookup matched more than one active resource (client-detected, `status: 0`). */
 export const ERROR_CODE_AMBIGUOUS_RESOURCE = "ambiguous_resource";
+/**
+ * Server `.code` (on a 400 `ValidationError`) when a create that makes a new
+ * resource has no `name`, or `PATCH /v1/resources/{id}/preview` sets an empty
+ * one. Nothing was written; add the public name and retry.
+ */
+export const ERROR_CODE_NAME_REQUIRED = "name_required";
 /** Fallback `.code` when the server returns a non-RFC-7807 response (HTML proxy page, plaintext gateway error, JSON without `error` envelope). */
 export const ERROR_CODE_UNKNOWN = "unknown";
 /**
@@ -66,6 +72,8 @@ export class QURLError extends Error {
     invalidFields;
     requestId;
     retryAfter;
+    /** Retained resource metadata supplied by a 410 Gone response. */
+    tombstone;
     /** Known minted IDs from a rejected terminal batch, for bounded cleanup. No bearer links. */
     partialQurlIds;
     constructor(data) {
@@ -83,6 +91,7 @@ export class QURLError extends Error {
         this.invalidFields = data.invalid_fields;
         this.requestId = data.request_id;
         this.retryAfter = data.retry_after;
+        this.tombstone = data.tombstone;
     }
 }
 /** 401 Unauthorized — invalid or missing API key. */
@@ -264,4 +273,3 @@ export function createError(data) {
     const ErrorClass = STATUS_ERROR_MAP[data.status] ?? QURLError;
     return new ErrorClass(data);
 }
-//# sourceMappingURL=errors.js.map

package/dist/esm/index.d.ts

@@ -2,7 +2,8 @@ export { ConnectorResource, isApiKeyRequestScope, ProtectedResource, QURLClient,
 export type { EnsureConnectorResourceResult } from "./client.js";
 export { CRIDVerificationError, ShareLink } from "./share.js";
 export type { CRIDVerificationErrorCode, ShareLinkInit, ShareLinkJSON } from "./share.js";
-export { AuthenticationError, AuthorizationError, ConnectorResourceOutcomeUnknownError, createError, DelegatedBatchOutcomeUnknownError, ERROR_CODE_AMBIGUOUS_RESOURCE, ERROR_CODE_CLIENT_VALIDATION, ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN, ERROR_CODE_CONNECTOR_RESOURCE_REVOKED, ERROR_CODE_CRID_MISMATCH, ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN, ERROR_CODE_INVALID_CRID, ERROR_CODE_INVALID_CRID_KEY, ERROR_CODE_MISSING_CRID, ERROR_CODE_NETWORK, ERROR_CODE_RESOURCE_NOT_FOUND, ERROR_CODE_RUNTIME, ERROR_CODE_TIMEOUT, ERROR_CODE_UNEXPECTED_RESPONSE, ERROR_CODE_UNKNOWN, NetworkError, NotFoundError, QURLError, RateLimitError, RuntimeError, ServerError, TimeoutError, ValidationError, } from "./errors.js";
+export { AuthenticationError, AuthorizationError, ConnectorResourceOutcomeUnknownError, createError, DelegatedBatchOutcomeUnknownError, ERROR_CODE_AMBIGUOUS_RESOURCE, ERROR_CODE_CLIENT_VALIDATION, ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN, ERROR_CODE_CONNECTOR_RESOURCE_REVOKED, ERROR_CODE_CRID_MISMATCH, ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN, ERROR_CODE_INVALID_CRID, ERROR_CODE_INVALID_CRID_KEY, ERROR_CODE_MISSING_CRID, ERROR_CODE_NAME_REQUIRED, ERROR_CODE_NETWORK, ERROR_CODE_RESOURCE_NOT_FOUND, ERROR_CODE_RUNTIME, ERROR_CODE_TIMEOUT, ERROR_CODE_UNEXPECTED_RESPONSE, ERROR_CODE_UNKNOWN, NetworkError, NotFoundError, QURLError, RateLimitError, RuntimeError, ServerError, TimeoutError, ValidationError, } from "./errors.js";
 export { VERSION } from "./version.js";
-export type { ConsumerAccessPolicy, AccessCode, AccessCodeListOutput, AccessGrant, ConsumerInvitation, ConsumerGrant, ConsumerGrantApprovalInput, ConsumerListInput, ConsumerInvitationListOutput, ConsumerGrantListOutput, AccessPolicy, AccessToken, AIAgentCategory, AIAgentPolicy, ApiKey, ApiKeyListOutput, ApiKeyRequestScope, ApiKeyScope, BatchCreateInput, BatchCreateOutput, BatchItemFailure, BatchItemResult, BatchItemSuccess, BillingInvoiceListOutput, ClientOptions, ConnectorInstallation, ConnectorInstallationCapabilities, ConnectorInstallationListOutput, ConnectorInstallationStats, CreateAccessCodeInput, CreateAccessCodeOutput, CreateApiKeyInput, CreateApiKeyOutput, CreateDurableApiKeyInput, CreateEnrollmentTokenInput, CreateBillingCheckoutInput, CreateDelegatedQurlBatchInput, CreateDelegatedQurlBatchOptions, CreateInput, CreateOutput, CreatePortalOptions, CreateQurlForResourceInput, CreateResourceInput, CreateWebhookInput, CredentialClaim, CredentialClaimInput, CredentialKind, CredentialTarget, CredentialTargetInput, Customer, CheckoutSession, DnsRecord, Domain, DomainCheckDetail, DomainListOutput, DomainVerifyResult, DelegatedQurl, DelegatedQurlBatchAccepted, DelegatedQurlBatchItemFailure, DelegatedQurlBatchItemResult, DelegatedQurlBatchItemSuccess, DelegatedQurlBatchNotModified, DelegatedQurlBatchPending, DelegatedQurlBatchStatus, DelegatedQurlBatchTerminal, DelegatedQurlCreatedData, DelegatedQurlGrant, ExtendInput, Invoice, GetDelegatedQurlBatchOptions, GetDelegatedQurlBatchOutput, ListApiKeysInput, ListBillingInvoicesInput, ListConnectorInstallationsInput, ListDomainsInput, ListInput, ListOutput, ListWebhooksInput, ListWebhookDeliveriesInput, Meta, MintInput, MintOutput, PaginatedOutput, Portal, PortalSession, ProtectUrlOptions, QURL, QURLErrorData, QurlSummary, Quota, RedeemAccessCodeInput, RedeemAccessCodeOutput, RegisterDomainInput, Resource, ResourceDetail, ResourceHandle, ResourceListInput, ResourceListOutput, ResourceType, RequestOptions, ResolveInput, ResolveOutput, Session, SessionListOutput, SessionTerminateOutput, ShareResourceOptions, TombstoneInfo, UnpaginatedOutput, UpdateApiKeyInput, UpdateCustomerInput, UpdateInput, UpdateResourceInput, UpdateResourceQurlInput, UpdateWebhookInput, UsageCostEstimate, UsageCurrentPeriod, UsageDaily, UsageDailyEntry, Webhook, WebhookDelivery, WebhookDeliveryListOutput, WebhookEventType, WebhookEventTypeInfo, WebhookListOutput, WebhookPayload, WebhookWithSecret, } from "./types.js";
-//# sourceMappingURL=index.d.ts.map
+export type { ConsumerAccessPolicy, CRIDPaymentPolicy, AccessCode, AccessCodeListOutput, AccessGrant, ConsumerInvitation, ConsumerGrant, ConsumerGrantApprovalInput, ConsumerListInput, ConsumerInvitationListOutput, ConsumerGrantListOutput, AccessPolicy, AccessToken, AIAgentCategory, AIAgentPolicy, ApiKey, ApiKeyListOutput, ApiKeyRequestScope, ApiKeyScope, BatchCreateInput, BatchCreateOutput, BatchItemFailure, BatchItemResult, BatchItemSuccess, BillingInvoiceListOutput, CallerIdentity, ClientOptions, ConnectorInstallation, ConnectorInstallationCapabilities, ConnectorInstallationListOutput, ConnectorInstallationStats, CreateAccessCodeInput, CreateAccessCodeOutput, CreateApiKeyInput, CreateApiKeyOutput, CreateExternalIdentityBindingInput, CreateExternalIdentityBindingOutput, CreateDurableApiKeyInput, CreateEnrollmentTokenInput, CreateBillingCheckoutInput, CreateDelegatedQurlBatchInput, CreateDelegatedQurlBatchOptions, CreateInput, CreateOutput, CreatePortalOptions, CreateQurlForResourceInput, CreateResourceInput, CreateWebhookInput, CredentialClaim, CredentialClaimInput, CredentialKind, CredentialTarget, CredentialTargetInput, Customer, CheckoutSession, DnsRecord, Domain, DomainCheckDetail, DomainListOutput, DomainVerifyResult, DelegatedQurl, DelegatedQurlBatchAccepted, DelegatedQurlBatchItemFailure, DelegatedQurlBatchItemResult, DelegatedQurlBatchItemSuccess, DelegatedQurlBatchNotModified, DelegatedQurlBatchPending, DelegatedQurlBatchStatus, DelegatedQurlBatchTerminal, DelegatedQurlCreatedData, DelegatedQurlGrant, ExternalIdentityProvider, ExtendInput, Invoice, GetDelegatedQurlBatchOptions, GetDelegatedQurlBatchOutput, ListApiKeysInput, ListBillingInvoicesInput, ListConnectorInstallationsInput, ListDomainsInput, ListInput, ListOutput, ListWebhooksInput, ListWebhookDeliveriesInput, Meta, MintInput, MintOutput, PaginatedOutput, Portal, PortalSession, ProtectUrlOptions, QURL, QURLErrorData, QurlSummary, Quota, RedeemAccessCodeInput, RedeemAccessCodeOutput, RegisterDomainInput, Resource, ResourceDetail, ResourceHandle, ResourceListInput, ResourceListOutput, ResourceType, RequestOptions, ResolveInput, ResolveOutput, Session, SessionListOutput, SessionTerminateOutput, ShareResourceOptions, TombstoneInfo, UnpaginatedOutput, UpdateApiKeyInput, UpdateCustomerInput, UpdateInput, UpdateResourceInput, UpdateResourceQurlInput, UpdateWebhookInput, UsageCostEstimate, UsageCurrentPeriod, UsageDaily, UsageDailyEntry, Webhook, WebhookDelivery, WebhookDeliveryListOutput, WebhookEventType, WebhookEventTypeInfo, WebhookListOutput, WebhookPayload, WebhookWithSecret, } from "./types.js";
+export { getResponseMetadata } from "./response-metadata.js";
+export type { ResponseMetadata } from "./response-metadata.js";

package/dist/esm/index.js

@@ -1,5 +1,5 @@
 export { ConnectorResource, isApiKeyRequestScope, ProtectedResource, QURLClient, } from "./client.js";
 export { CRIDVerificationError, ShareLink } from "./share.js";
-export { AuthenticationError, AuthorizationError, ConnectorResourceOutcomeUnknownError, createError, DelegatedBatchOutcomeUnknownError, ERROR_CODE_AMBIGUOUS_RESOURCE, ERROR_CODE_CLIENT_VALIDATION, ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN, ERROR_CODE_CONNECTOR_RESOURCE_REVOKED, ERROR_CODE_CRID_MISMATCH, ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN, ERROR_CODE_INVALID_CRID, ERROR_CODE_INVALID_CRID_KEY, ERROR_CODE_MISSING_CRID, ERROR_CODE_NETWORK, ERROR_CODE_RESOURCE_NOT_FOUND, ERROR_CODE_RUNTIME, ERROR_CODE_TIMEOUT, ERROR_CODE_UNEXPECTED_RESPONSE, ERROR_CODE_UNKNOWN, NetworkError, NotFoundError, QURLError, RateLimitError, RuntimeError, ServerError, TimeoutError, ValidationError, } from "./errors.js";
+export { AuthenticationError, AuthorizationError, ConnectorResourceOutcomeUnknownError, createError, DelegatedBatchOutcomeUnknownError, ERROR_CODE_AMBIGUOUS_RESOURCE, ERROR_CODE_CLIENT_VALIDATION, ERROR_CODE_CONNECTOR_RESOURCE_OUTCOME_UNKNOWN, ERROR_CODE_CONNECTOR_RESOURCE_REVOKED, ERROR_CODE_CRID_MISMATCH, ERROR_CODE_DELEGATED_BATCH_OUTCOME_UNKNOWN, ERROR_CODE_INVALID_CRID, ERROR_CODE_INVALID_CRID_KEY, ERROR_CODE_MISSING_CRID, ERROR_CODE_NAME_REQUIRED, ERROR_CODE_NETWORK, ERROR_CODE_RESOURCE_NOT_FOUND, ERROR_CODE_RUNTIME, ERROR_CODE_TIMEOUT, ERROR_CODE_UNEXPECTED_RESPONSE, ERROR_CODE_UNKNOWN, NetworkError, NotFoundError, QURLError, RateLimitError, RuntimeError, ServerError, TimeoutError, ValidationError, } from "./errors.js";
 export { VERSION } from "./version.js";
-//# sourceMappingURL=index.js.map
+export { getResponseMetadata } from "./response-metadata.js";

package/dist/esm/internal.d.ts

@@ -2,4 +2,3 @@
  * so it is linear on any input (the regex form is polynomial-ReDoS on a long run
  * of slashes over caller-supplied input, e.g. a `baseUrl` option). */
 export declare function stripTrailingSlashes(url: string): string;
-//# sourceMappingURL=internal.d.ts.map

package/dist/esm/internal.js

@@ -11,4 +11,3 @@ export function stripTrailingSlashes(url) {
     }
     return end === url.length ? url : url.slice(0, end);
 }
-//# sourceMappingURL=internal.js.map

package/dist/esm/node/agent-runtime.d.ts

@@ -106,4 +106,3 @@ export declare const agentRuntimeTesting: {
     fingerprint: typeof fingerprint;
 };
 export {};
-//# sourceMappingURL=agent-runtime.d.ts.map

package/dist/esm/node/agent-runtime.js

@@ -943,4 +943,3 @@ export const agentRuntimeTesting = {
     Lifecycle,
     fingerprint,
 };
-//# sourceMappingURL=agent-runtime.js.map

package/dist/esm/node/agent-state.d.ts

@@ -98,4 +98,3 @@ export declare function validateEndpoint(value: StrictJsonValue | undefined): NH
 export declare function validateAssignment(value: StrictJsonValue | undefined): AgentAssignment;
 export declare function decodeAgentState(raw: Uint8Array): AgentState;
 export declare function encodeAgentState(state: AgentState): Buffer;
-//# sourceMappingURL=agent-state.d.ts.map

package/dist/esm/node/agent-state.js

@@ -295,4 +295,3 @@ export function encodeAgentState(state) {
         throw error;
     }
 }
-//# sourceMappingURL=agent-state.js.map

package/dist/esm/node/agent-transport.d.ts

@@ -15,4 +15,3 @@ export declare class AgentTransportError extends Error {
     constructor(options?: ErrorOptions);
 }
 export declare const nativeAgentTransport: AgentTransport;
-//# sourceMappingURL=agent-transport.d.ts.map

package/dist/esm/node/agent-transport.js

@@ -111,4 +111,3 @@ export const nativeAgentTransport = async (input) => {
         first.packet.fill(0);
     }
 };
-//# sourceMappingURL=agent-transport.js.map

package/dist/esm/node/deployment.d.ts

@@ -48,4 +48,3 @@ export declare const deploymentTesting: {
 /** Producer-only deployments need a pinned Hub, but need no portal issuer keys. */
 export declare function loadDeploymentHub(): unknown;
 export {};
-//# sourceMappingURL=deployment.d.ts.map

package/dist/esm/node/deployment.js

@@ -180,4 +180,3 @@ export function loadDeploymentHub() {
         throw new Error("QURL_DEPLOYMENT has no producer Hub");
     return value.hub;
 }
-//# sourceMappingURL=deployment.js.map

package/dist/esm/node/file-agent-state.d.ts

@@ -13,4 +13,3 @@ export declare class FileAgentState implements AgentStateStore {
     withLock<T>(operation: (locked: AgentStateStore) => Promise<T>, signal?: AbortSignal): Promise<T>;
     close(): void;
 }
-//# sourceMappingURL=file-agent-state.d.ts.map

package/dist/esm/node/file-agent-state.js

@@ -131,4 +131,3 @@ export class FileAgentState {
         this.#native.close(this.#handle);
     }
 }
-//# sourceMappingURL=file-agent-state.js.map

package/dist/esm/node/native-udp.d.ts

@@ -38,4 +38,3 @@ export declare const nativeUdpTesting: {
     socketExchangeError: (cause: unknown) => Error;
 };
 export {};
-//# sourceMappingURL=native-udp.d.ts.map

package/dist/esm/node/native-udp.js

@@ -290,4 +290,3 @@ export const nativeUdpTesting = {
     sendOwnedDatagram,
     socketExchangeError: (cause) => new SocketExchangeError(cause),
 };
-//# sourceMappingURL=native-udp.js.map

package/dist/esm/node/nhp-wire.d.ts

@@ -42,4 +42,3 @@ export declare const nhpWireTesting: {
     inflateReplyBody: typeof inflateReplyBody;
 };
 export {};
-//# sourceMappingURL=nhp-wire.d.ts.map

package/dist/esm/node/nhp-wire.js

@@ -271,4 +271,3 @@ function wipeBuffers(values) {
         value.fill(0);
 }
 export const nhpWireTesting = { validateReplyProfile, inflateReplyBody };
-//# sourceMappingURL=nhp-wire.js.map

package/dist/esm/node/portal-opener.d.ts

@@ -119,4 +119,3 @@ export declare const portalOpenerTesting: {
     validateSessionToken: typeof validateSessionToken;
 };
 export {};
-//# sourceMappingURL=portal-opener.d.ts.map

package/dist/esm/node/portal-opener.js

@@ -1072,4 +1072,3 @@ export const portalOpenerTesting = {
     validatedCellForLink,
     validateSessionToken,
 };
-//# sourceMappingURL=portal-opener.js.map

package/dist/esm/node/provider.d.ts

@@ -17,4 +17,3 @@ export interface DiscoveryProviderOptions {
 }
 export declare function createHTTPManifestFetcher(value: string, fetch?: typeof globalThis.fetch): DiscoveryProviderOptions["fetcher"];
 export declare function createDiscoveryProvider(options: DiscoveryProviderOptions): PortalProvider;
-//# sourceMappingURL=provider.d.ts.map

package/dist/esm/node/provider.js

@@ -146,4 +146,3 @@ export function createDiscoveryProvider(options) {
         },
     };
 }
-//# sourceMappingURL=provider.js.map

package/dist/esm/node/qv2.d.ts

@@ -38,4 +38,3 @@ export declare const qv2Testing: {
     verifyIssuerClaims: typeof verifyIssuerClaims;
 };
 export {};
-//# sourceMappingURL=qv2.d.ts.map

package/dist/esm/node/qv2.js

@@ -297,4 +297,3 @@ export const qv2Testing = {
     parseAndWipeSecret,
     verifyIssuerClaims,
 };
-//# sourceMappingURL=qv2.js.map

package/dist/esm/node/relay.d.ts

@@ -10,4 +10,3 @@ export declare function relayKnock(relayURL: string, allowlist: readonly string[
     signal?: AbortSignal;
     fetch?: typeof globalThis.fetch;
 }): Promise<NHPMessage>;
-//# sourceMappingURL=relay.d.ts.map

package/dist/esm/node/relay.js

@@ -102,4 +102,3 @@ export async function relayKnock(relayURL, allowlist, serverPublicKey, devicePri
         packet?.fill(0);
     }
 }
-//# sourceMappingURL=relay.js.map

package/dist/esm/node/sealed-agent-state.d.ts

@@ -17,4 +17,3 @@ export interface AgentStateKeyWrapper {
 }
 export declare function createSealedAgentStateCodec(providerID: string, wrapper: AgentStateKeyWrapper, expectedAgentID?: string): AgentStateCodec;
 export declare function openSealedFileAgentState(path: string, providerID: string, wrapper: AgentStateKeyWrapper, expectedAgentID?: string): FileAgentState;
-//# sourceMappingURL=sealed-agent-state.d.ts.map

package/dist/esm/node/sealed-agent-state.js

@@ -187,4 +187,3 @@ export function createSealedAgentStateCodec(providerID, wrapper, expectedAgentID
 export function openSealedFileAgentState(path, providerID, wrapper, expectedAgentID) {
     return new FileAgentState(path, createSealedAgentStateCodec(providerID, wrapper, expectedAgentID));
 }
-//# sourceMappingURL=sealed-agent-state.js.map

package/dist/esm/node/strict-json.d.ts

@@ -10,4 +10,3 @@ export declare function parseStrictJson(input: Uint8Array, maxBytes: number, onM
 export declare function isStrictJsonObject(value: StrictJsonValue | undefined): value is {
     [key: string]: StrictJsonValue;
 };
-//# sourceMappingURL=strict-json.d.ts.map

package/dist/esm/node/strict-json.js

@@ -173,4 +173,3 @@ class StrictJsonParser {
 export function isStrictJsonObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-//# sourceMappingURL=strict-json.js.map

package/dist/esm/node.d.ts

@@ -15,4 +15,3 @@ export { createSealedAgentStateCodec, openSealedFileAgentState, } from "./node/s
 export type { AgentStateKeyBinding, WrappedAgentStateKey, AgentStateKeyWrapper, } from "./node/sealed-agent-state.js";
 export { AgentRuntime, AgentLifecycleError, connectAgentRuntime, recoverAgentRuntime, } from "./node/agent-runtime.js";
 export type { AgentRuntimeOptions, AgentRecoveryOptions, AgentOTPChallenge, NativeAgentKnockOptions, NativeAgentGrant, NativeSessionReceipt, } from "./node/agent-runtime.js";
-//# sourceMappingURL=node.d.ts.map

package/dist/esm/node.js

@@ -6,4 +6,3 @@ export { AgentTransportError } from "./node/agent-transport.js";
 export { FileAgentState } from "./node/file-agent-state.js";
 export { createSealedAgentStateCodec, openSealedFileAgentState, } from "./node/sealed-agent-state.js";
 export { AgentRuntime, AgentLifecycleError, connectAgentRuntime, recoverAgentRuntime, } from "./node/agent-runtime.js";
-//# sourceMappingURL=node.js.map

package/dist/esm/response-metadata.d.ts

@@ -0,0 +1,13 @@
+/** Correlation metadata from one successful API response. */
+export interface ResponseMetadata {
+    readonly requestId: string;
+}
+/**
+ * Read this result's server correlation ID. Metadata is non-enumerable and is
+ * not part of its JSON payload. Local handles and responses without an ID return undefined.
+ */
+export declare function getResponseMetadata(value: unknown): Readonly<ResponseMetadata> | undefined;
+/** @internal Attach only an identifier already validated at the HTTP boundary. */
+export declare function withResponseMetadata<T>(value: T, requestId: string | undefined): T;
+/** @internal Preserve correlation when a response becomes a new SDK value. */
+export declare function copyResponseMetadata<T>(source: unknown, value: T): T;

package/dist/esm/response-metadata.js

@@ -0,0 +1,33 @@
+// A constant global symbol survives mixed ESM/CJS loads without a mutable registry.
+const RESPONSE_METADATA = Symbol.for("@layervai/qurl.responseMetadata.v1");
+function isObject(value) {
+    return value !== null && (typeof value === "object" || typeof value === "function");
+}
+/**
+ * Read this result's server correlation ID. Metadata is non-enumerable and is
+ * not part of its JSON payload. Local handles and responses without an ID return undefined.
+ */
+export function getResponseMetadata(value) {
+    if (!isObject(value))
+        return undefined;
+    return Object.getOwnPropertyDescriptor(value, RESPONSE_METADATA)?.value;
+}
+/** @internal Attach only an identifier already validated at the HTTP boundary. */
+export function withResponseMetadata(value, requestId) {
+    if (!isObject(value) || !requestId)
+        return value;
+    // Diagnostic metadata must not turn a successful mutation into a failure.
+    if (Object.getOwnPropertyDescriptor(value, RESPONSE_METADATA) || !Object.isExtensible(value))
+        return value;
+    Object.defineProperty(value, RESPONSE_METADATA, {
+        value: Object.freeze({ requestId }),
+        enumerable: false,
+        writable: false,
+        configurable: false,
+    });
+    return value;
+}
+/** @internal Preserve correlation when a response becomes a new SDK value. */
+export function copyResponseMetadata(source, value) {
+    return withResponseMetadata(value, getResponseMetadata(source)?.requestId);
+}

package/dist/esm/share.d.ts

@@ -54,4 +54,3 @@ export declare class ShareLink {
      */
     verifyCrid(derSpki: ArrayBuffer | ArrayBufferView): Promise<void>;
 }
-//# sourceMappingURL=share.d.ts.map

package/dist/esm/share.js

@@ -1,3 +1,4 @@
+import { copyResponseMetadata } from "./response-metadata.js";
 import { ERROR_CODE_CRID_MISMATCH, ERROR_CODE_INVALID_CRID, ERROR_CODE_INVALID_CRID_KEY, ERROR_CODE_MISSING_CRID, QURLError, RuntimeError, } from "./errors.js";
 import { cridKeyMatches, parseCrid } from "./crid.js";
 /** A local, fail-closed CRID verification failure. */
@@ -44,6 +45,7 @@ export class ShareLink {
         this.#expiresAtEpochMs = Number.isFinite(expiresAtEpochMs) ? expiresAtEpochMs : undefined;
         this.expiresInSeconds = init.expiresInSeconds;
         this.singleUse = init.singleUse;
+        copyResponseMetadata(init, this);
         Object.freeze(this);
     }
     /** Effective expiry as a defensive copy; mutating it does not change this share. */
@@ -106,4 +108,3 @@ function copyBytes(value) {
 function invalidCrid() {
     return new CRIDVerificationError(ERROR_CODE_INVALID_CRID, "Share response carried an invalid CRID");
 }
-//# sourceMappingURL=share.js.map

package/dist/esm/target-path.d.ts

@@ -0,0 +1,2 @@
+export declare function isCanonicalTargetPath(value: unknown): value is string;
+export declare function requireCanonicalTargetPath(value: string | undefined, field: string): void;

package/dist/esm/target-path.js

@@ -0,0 +1,30 @@
+import { clientValidationError } from "./client-errors.js";
+import { MAX_TARGET_PATH } from "./client-limits.js";
+import { requireMaxUtf8Bytes, requireNonEmptyIfPresent } from "./client-validation.js";
+// TODO(upstream-contract): qurl-service ValidateTargetPath and the released
+// target_path_v1_vectors define this grammar without normalization.
+const INVALID_TARGET_PATH_ASCII = /[^A-Za-z0-9._~!$&()*+,;=:@%/?-]/;
+const MALFORMED_PERCENT_ESCAPE = /%(?![0-9a-fA-F]{2})/;
+export function isCanonicalTargetPath(value) {
+    if (typeof value !== "string" ||
+        value.length > MAX_TARGET_PATH ||
+        value.startsWith("//") ||
+        !value.startsWith("/") ||
+        INVALID_TARGET_PATH_ASCII.test(value) ||
+        MALFORMED_PERCENT_ESCAPE.test(value))
+        return false;
+    const path = value.split("?", 1)[0];
+    // Queries remain encoded data; only the path defines authorization.
+    return (!/[%!()*;]/.test(path) &&
+        !path.slice(1).includes("//") &&
+        !path.split("/").some((segment) => segment === "." || segment === ".."));
+}
+export function requireCanonicalTargetPath(value, field) {
+    if (value === undefined)
+        return;
+    requireMaxUtf8Bytes(value, field, MAX_TARGET_PATH);
+    requireNonEmptyIfPresent(value, field);
+    if (!isCanonicalTargetPath(value)) {
+        throw clientValidationError(`${field}: must be a canonical ASCII path with optional query`);
+    }
+}

package/dist/esm/types.d.ts

@@ -56,7 +56,8 @@ export interface AccessToken {
     use_count: number;
     qurl_site?: string;
     created_at: string;
-    expires_at: string;
+    /** Optional in API summaries; omission does not imply an unlimited lifetime. */
+    expires_at?: string;
 }
 /** Per-qURL summary returned from resource-detail and token-update endpoints. */
 export interface QurlSummary {
@@ -113,6 +114,15 @@ export interface QURL {
  * the resource and must be set through {@link UpdateInput} after creation.
  */
 export interface CreateInput {
+    /**
+     * Public name recipients see: the qURL page, link previews, and the passkey
+     * they save. Not `description`, which stays a private owner note. Sent only
+     * when set; needs a qURL API version that accepts it. The service requires
+     * it when this call creates a resource (`400 name_required` otherwise) and
+     * ignores it when an existing resource is reused. Rename later with
+     * `PATCH /v1/resources/{id}/preview`.
+     */
+    name?: string;
     /** Omit to keep an existing resource's privacy; a new URL or Connector resource defaults to private. */
     private?: boolean;
     type?: ResourceType;
@@ -137,6 +147,8 @@ export interface CreateOutput {
     expires_at?: string;
     label?: string;
     type?: ResourceType;
+    /** Recorded Connector path scope; omitted for the bare origin. */
+    target_path?: string;
 }
 /** Input for listing qURLs. */
 export interface ListInput {
@@ -237,6 +249,8 @@ export interface MintOutput {
 }
 /** Options for `QURLClient.protectUrl`. */
 export interface ProtectUrlOptions {
+    /** Public resource name; see {@link CreateInput.name}. */
+    name?: string;
     private?: boolean;
     consumerAccess?: ConsumerAccessPolicy;
     /** Optional resource-level metadata. Max 500 chars. */
@@ -282,11 +296,17 @@ export interface CreatePortalOptions {
     sessionDuration?: string | number;
     /**
      * Scope a qURL for an existing tunnel resource to one path and its
-     * descendants. The SDK rejects only empty values and values over 2048 UTF-8
-     * bytes; the API remains authoritative for the path grammar and resource
-     * type. This option is invalid with `createPortalForUrl`.
+     * descendants. Must be a canonical ASCII path with optional query, at most
+     * 2048 bytes. The API enforces the tunnel-only resource boundary.
+     * This option is invalid with `createPortalForUrl`.
      */
     targetPath?: string;
+    /**
+     * Public name of the resource `createPortalForUrl` creates; see
+     * {@link CreateInput.name}. Required by the service when that call creates a
+     * resource. `createPortal` rejects it: the resource already exists.
+     */
+    name?: string;
 }
 /**
  * A qURL link minted for a protected resource.
@@ -312,6 +332,8 @@ export interface Portal {
     qurlId?: string;
     /** Token label, when returned by the API. */
     label?: string;
+    /** Recorded Connector path scope; absent means bare origin. */
+    targetPath?: string;
 }
 /**
  * Result of a successful `enterPortal`: the reachable resource.
@@ -345,7 +367,10 @@ export interface ResolveOutput {
     resource_id: string;
     access_grant?: AccessGrant;
 }
-/** Quota information. */
+/**
+ * Quota information. The API schema does not require rate_limits, usage, or
+ * their inner fields; minimal responses may omit them. Check presence before use.
+ */
 export interface Quota {
     plan: "free" | "growth" | "enterprise" | (string & {});
     period_start: string;
@@ -413,6 +438,7 @@ export interface BatchCreateOutput {
     succeeded: number;
     failed: number;
     results: BatchItemResult[];
+    /** Canonical meta.request_id wins; data.request_id is preserved when meta omits it. */
     request_id?: string;
 }
 /** One recipient grant redeemed from an opaque delegated mint capability. */
@@ -513,13 +539,22 @@ export interface DelegatedQurl {
     access_policy?: AccessPolicy;
 }
 /** Private resource policy. Contract fulfillment comes from the publisher backend. */
+export interface CRIDPaymentPolicy {
+    account_id: string;
+    price_id: string;
+    /** One-time access duration; zero lasts for the resource lifetime. Subscriptions require zero. */
+    access_seconds: number;
+}
 export interface ConsumerAccessPolicy {
     mode: "keys" | "invite_only" | "email_capture" | "review" | "contract";
     version: number;
     contract_id?: string;
+    payment?: CRIDPaymentPolicy;
 }
 /** Input for creating a resource directly. */
 export interface CreateResourceInput {
+    /** Public resource name; see {@link CreateInput.name}. */
+    name?: string;
     private?: boolean;
     consumer_access?: ConsumerAccessPolicy;
     type?: ResourceType;
@@ -603,7 +638,7 @@ export interface ShareResourceOptions {
     ttlSeconds?: number;
 }
 /** Input for minting a qURL against an existing resource. */
-export type CreateQurlForResourceInput = Omit<CreateInput, "target_url" | "custom_domain" | "type" | "private"> & {
+export type CreateQurlForResourceInput = Omit<CreateInput, "target_url" | "custom_domain" | "type" | "private" | "name"> & {
     /**
      * Path this resource qURL resolves to (e.g. "/api/detect").
      *
@@ -916,6 +951,16 @@ export interface UpdateApiKeyInput {
     name?: string;
     scopes?: ApiKeyRequestScope[];
 }
+/** Identity of the credential used for the current request. */
+export interface CallerIdentity {
+    owner_id: string;
+    auth_type: OpenString<"api_key" | "jwt">;
+    /**
+     * Available API-key metadata, which may be omitted even for an API-key caller.
+     * JWT callers omit it. Display fields are optional; no credential secret is returned.
+     */
+    api_key?: ApiKey;
+}
 export interface ApiKey {
     key_id?: string;
     key_prefix?: string;
@@ -997,6 +1042,7 @@ export interface QURLErrorData {
     invalid_fields?: Record<string, string>;
     request_id?: string;
     retry_after?: number;
+    tombstone?: TombstoneInfo;
 }
 /** Per-call options accepted by mutating requests. */
 export interface RequestOptions {
@@ -1018,13 +1064,19 @@ export interface ClientOptions {
     /** Base URL. Defaults to https://api.layerv.ai */
     baseUrl?: string;
     /**
-     * Custom fetch implementation. Redirect-safety requires it to honor
+     * Custom fetch implementation, called with globalThis as its receiver.
+     * Bind methods that need a different receiver. Redirect-safety requires it to honor
      * `redirect: "manual"`, accurately expose `Response.redirected`, and leave
      * `Response.url` empty or set it to the normalized request URL when no
      * redirect was followed. Every Response-like result must also provide a
      * `headers` object with a WHATWG-compatible `headers.get(name)` method.
      */
     fetch?: typeof globalThis.fetch;
+    /**
+     * Decoded API response bytes per request. Default: 1 MiB.
+     * Integer range: 1 byte through 16 MiB.
+     */
+    maxResponseBodyBytes?: number;
     /** Maximum retry attempts for transient errors (429, 5xx). Default: 3. */
     maxRetries?: number;
     /**
@@ -1081,5 +1133,28 @@ export interface ConsumerInvitationListOutput extends PaginatedOutput {
 export interface ConsumerGrantListOutput extends PaginatedOutput {
     grants: ConsumerGrant[];
 }
+/** Provider authenticated by its configured confidential OAuth client. */
+export type ExternalIdentityProvider = "slack" | "discord" | "teams";
+export interface CreateExternalIdentityBindingInput {
+    provider: ExternalIdentityProvider;
+    external_id: string;
+    display_name?: string;
+    /** Explicit reauthorization only; revokes the previous binding key. */
+    rotate_existing?: boolean;
+}
+/** Persist api_key.plaintext securely immediately; never log this result. */
+export interface CreateExternalIdentityBindingOutput {
+    binding_id: string;
+    provider: ExternalIdentityProvider;
+    external_id: string;
+    display_name?: string;
+    api_key: {
+        key_id: string;
+        key_prefix: string;
+        /** One-time secret, replayable only with the same request within 24 hours. */
+        plaintext: string;
+    };
+    scopes: ApiKeyRequestScope[];
+    created_at: string;
+}
 export {};
-//# sourceMappingURL=types.d.ts.map

package/dist/esm/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/esm/version.d.ts

@@ -1,2 +1 @@
-export declare const VERSION = "3.1.0";
-//# sourceMappingURL=version.d.ts.map
+export declare const VERSION = "4.0.0";

package/dist/esm/version.js

@@ -1,2 +1 @@
-export const VERSION = "3.1.0"; // x-release-please-version
-//# sourceMappingURL=version.js.map
+export const VERSION = "4.0.0"; // x-release-please-version