@layervai/qurl 3.1.0 → 4.0.0

package/dist/cjs/client-validation.js

@@ -0,0 +1,326 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireMaxLength = requireMaxLength;
+exports.requireMaxUtf8Bytes = requireMaxUtf8Bytes;
+exports.requireResourceNameIfPresent = requireResourceNameIfPresent;
+exports.requireNonEmptyIfPresent = requireNonEmptyIfPresent;
+exports.requireMaxSessionsInRange = requireMaxSessionsInRange;
+exports.requireBooleanIfPresent = requireBooleanIfPresent;
+exports.requireListLimitInRange = requireListLimitInRange;
+exports.containsControlCharacter = containsControlCharacter;
+exports.requireValidTags = requireValidTags;
+exports.describeShape = describeShape;
+exports.requireValidAccessPolicy = requireValidAccessPolicy;
+exports.requireValidHttpUrl = requireValidHttpUrl;
+exports.requireValidTargetUrl = requireValidTargetUrl;
+exports.requireObjectInput = requireObjectInput;
+exports.requireNonEmptyStringField = requireNonEmptyStringField;
+exports.requireNonEmptyArrayField = requireNonEmptyArrayField;
+exports.requireStringArrayElements = requireStringArrayElements;
+exports.requireAtLeastOneField = requireAtLeastOneField;
+exports.requireNoUnknownFields = requireNoUnknownFields;
+exports.normalizePatchFields = normalizePatchFields;
+exports.requireConsumerDecision = requireConsumerDecision;
+exports.requirePortalTargetUrl = requirePortalTargetUrl;
+const client_errors_js_1 = require("./client-errors.js");
+const client_limits_js_1 = require("./client-limits.js");
+// CreateQurlRequest.target_url pattern is loose (just a URI) but
+// UpdateQurlRequest.tags pattern is specific — enforce it here.
+const TAG_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9 _-]*$/;
+function requireMaxLength(value, field, max) {
+    if (value === undefined)
+        return;
+    // Untyped-JS safety: a non-string `value` would silently pass since
+    // `(42).length === undefined > max` is `false` and the bad value would
+    // sail through to the wire. Match the typeof guard pattern used by
+    // requireValidTags / requireValidTargetUrl.
+    if (typeof value !== "string") {
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must be a string (got ${value === null ? "null" : typeof value})`);
+    }
+    if (value.length > max) {
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must be ${max} characters or fewer (got ${value.length})`);
+    }
+}
+function requireMaxUtf8Bytes(value, field, max) {
+    if (value === undefined)
+        return;
+    if (typeof value !== "string") {
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must be a string (got ${value === null ? "null" : typeof value})`);
+    }
+    const bytes = client_errors_js_1.TEXT_ENCODER.encode(value).byteLength;
+    if (bytes > max) {
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must be ${max} UTF-8 bytes or fewer (got ${bytes})`);
+    }
+}
+/** Mirror qurl-service ValidatePreviewName: 100 code points; no Cc, Cf, U+2028/9 or padding. */
+function requireResourceNameIfPresent(value, field = "name") {
+    if (value === undefined)
+        return;
+    if (typeof value !== "string" || value.trim() === "") {
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must be a non-empty string`);
+    }
+    if ([...value].length > client_limits_js_1.MAX_RESOURCE_NAME) {
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must be ${client_limits_js_1.MAX_RESOURCE_NAME} characters or fewer`);
+    }
+    if (value.trim() !== value || /[\p{Cc}\p{Cf}\u2028\u2029]/u.test(value)) {
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must be one line without hidden characters or surrounding whitespace`);
+    }
+}
+function requireNonEmptyIfPresent(value, field) {
+    // Reject `""` so uninitialized form state doesn't reach the wire.
+    if (value === "") {
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must not be an empty string`);
+    }
+}
+function requireMaxSessionsInRange(value, field = "max_sessions") {
+    if (value === undefined)
+        return;
+    if (!Number.isInteger(value) || value < 0 || value > client_limits_js_1.MAX_MAX_SESSIONS) {
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must be an integer between 0 and ${client_limits_js_1.MAX_MAX_SESSIONS} (got ${value})`);
+    }
+}
+function requireBooleanIfPresent(value, field) {
+    if (value === undefined)
+        return;
+    if (typeof value !== "boolean") {
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must be a boolean (got ${describeShape(value)})`);
+    }
+}
+function requireListLimitInRange(value, methodName) {
+    if (value === undefined || value === null)
+        return;
+    // All current paginated OpenAPI query params share 1..100. If a future
+    // endpoint diverges, add a per-endpoint bound rather than changing this
+    // shared guard silently.
+    if (typeof value !== "number" ||
+        !Number.isInteger(value) ||
+        value < 1 ||
+        value > client_limits_js_1.MAX_LIST_LIMIT) {
+        const rendered = typeof value === "string" ? JSON.stringify(value) : String(value);
+        throw (0, client_errors_js_1.clientValidationError)(`${methodName}: limit: must be an integer between 1 and ${client_limits_js_1.MAX_LIST_LIMIT} (got ${rendered})`);
+    }
+}
+function containsControlCharacter(value) {
+    return Array.from(value).some((character) => {
+        const codePoint = character.codePointAt(0);
+        return codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f);
+    });
+}
+/** Match the API's tag grammar, which permits embedded spaces; values stay in JSON bodies. */
+function requireValidTags(tags) {
+    // null tolerance for untyped-JS callers — treated as "don't touch."
+    // Duplicates pass through to the server (authoritative on dedupe policy).
+    if (tags === undefined || tags === null)
+        return;
+    if (!Array.isArray(tags)) {
+        throw (0, client_errors_js_1.clientValidationError)(`tags: must be an array of strings (got ${typeof tags})`);
+    }
+    if (tags.length > client_limits_js_1.MAX_TAGS) {
+        throw (0, client_errors_js_1.clientValidationError)(`tags: max ${client_limits_js_1.MAX_TAGS} items allowed (got ${tags.length})`);
+    }
+    const errors = [];
+    for (let i = 0; i < tags.length; i++) {
+        const tag = tags[i];
+        // Per-element type guard for untyped-JS callers. Without this, a
+        // non-string element would silently pass (`.length` on a number is
+        // `undefined`; `TAG_PATTERN.test(42)` coerces to `"42"`) or TypeError
+        // (`null.length`).
+        if (typeof tag !== "string") {
+            errors.push(`tags[${i}]: must be a string (got ${tag === null ? "null" : typeof tag})`);
+            continue;
+        }
+        if (tag.length < 1 || tag.length > client_limits_js_1.MAX_TAG_LENGTH) {
+            errors.push(`tags[${i}]: must be 1-${client_limits_js_1.MAX_TAG_LENGTH} characters (got ${tag.length})`);
+            continue;
+        }
+        if (!TAG_PATTERN.test(tag)) {
+            errors.push(`tags[${i}]: must start with an alphanumeric and contain only letters, numbers, spaces, underscores, or hyphens`);
+        }
+    }
+    if (errors.length > 0) {
+        throw (0, client_errors_js_1.clientValidationError)(errors.join("; "));
+    }
+}
+function describeShape(value) {
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "array";
+    return typeof value;
+}
+const ACCESS_POLICY_LIST_FIELDS = [
+    "ip_allowlist",
+    "ip_denylist",
+    "geo_allowlist",
+    "geo_denylist",
+];
+const ACCESS_POLICY_STRING_FIELDS = [
+    "user_agent_allow_regex",
+    "user_agent_deny_regex",
+];
+const AI_AGENT_POLICY_LIST_FIELDS = [
+    "deny_categories",
+    "allow_categories",
+];
+function requireValidAccessPolicy(policy) {
+    // null/undefined → "don't touch". Server is authoritative on CIDR /
+    // ISO-3166 / regex grammar; this guard catches only the shape errors
+    // an untyped-JS caller is likely to make (e.g. `geo_allowlist: "US"`
+    // instead of `["US"]`) so they get a structured ValidationError
+    // instead of a server 400 they have to debug.
+    if (policy === undefined || policy === null)
+        return;
+    if (typeof policy !== "object" || Array.isArray(policy)) {
+        throw (0, client_errors_js_1.clientValidationError)(`access_policy: must be an object (got ${describeShape(policy)})`);
+    }
+    for (const field of ACCESS_POLICY_LIST_FIELDS) {
+        const value = policy[field];
+        if (value === undefined)
+            continue;
+        if (!Array.isArray(value)) {
+            throw (0, client_errors_js_1.clientValidationError)(`access_policy.${field}: must be an array (got ${describeShape(value)})`);
+        }
+    }
+    for (const field of ACCESS_POLICY_STRING_FIELDS) {
+        const value = policy[field];
+        if (value === undefined)
+            continue;
+        if (typeof value !== "string") {
+            throw (0, client_errors_js_1.clientValidationError)(`access_policy.${field}: must be a string (got ${describeShape(value)})`);
+        }
+    }
+    const aip = policy.ai_agent_policy;
+    if (aip !== undefined) {
+        if (aip === null || typeof aip !== "object" || Array.isArray(aip)) {
+            throw (0, client_errors_js_1.clientValidationError)(`access_policy.ai_agent_policy: must be an object (got ${describeShape(aip)})`);
+        }
+        if (aip.block_all !== undefined && typeof aip.block_all !== "boolean") {
+            throw (0, client_errors_js_1.clientValidationError)(`access_policy.ai_agent_policy.block_all: must be a boolean (got ${describeShape(aip.block_all)})`);
+        }
+        for (const field of AI_AGENT_POLICY_LIST_FIELDS) {
+            const value = aip[field];
+            if (value === undefined)
+                continue;
+            if (!Array.isArray(value)) {
+                throw (0, client_errors_js_1.clientValidationError)(`access_policy.ai_agent_policy.${field}: must be an array (got ${describeShape(value)})`);
+            }
+        }
+    }
+}
+// `format: uri` in the OpenAPI spec allows schemes the SDK doesn't
+// usefully support (`ftp://`, `file://`, `javascript:`, …). This is a
+// cheap client-side sanity check — the server is still the
+// authoritative validator (e.g. it rejects localhost, cloud metadata,
+// and private-range hosts; the SDK doesn't need to duplicate that).
+const ALLOWED_URL_SCHEMES = ["http://", "https://"];
+function requireValidHttpUrl(value, field) {
+    // Three checks in priority order: type guard, scheme, length.
+    // Stop at the first failure so a non-string URL doesn't
+    // produce both "must be a string" AND "must be ≤ 2048 characters"
+    // (the length check on a non-string would also typeof-fail and
+    // duplicate the type message). The collect-all loop in
+    // validateCreateInput runs each FIELD's validator independently — within
+    // a single URL field itself we want fail-fast.
+    if (typeof value !== "string") {
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must be a string (got ${value === null ? "null" : typeof value})`);
+    }
+    if (!ALLOWED_URL_SCHEMES.some((scheme) => value.startsWith(scheme))) {
+        // Truncate to keep the error message compact and avoid
+        // pathologically long schemes from filling logs.
+        const repr = JSON.stringify(value).slice(0, 40);
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must start with http:// or https:// (got ${repr})`);
+    }
+    if (value.length > client_limits_js_1.MAX_TARGET_URL) {
+        throw (0, client_errors_js_1.clientValidationError)(`${field}: must be ${client_limits_js_1.MAX_TARGET_URL} characters or fewer (got ${value.length})`);
+    }
+}
+function requireValidTargetUrl(target_url) {
+    requireValidHttpUrl(target_url, "target_url");
+}
+function requireObjectInput(input, method) {
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        throw (0, client_errors_js_1.clientValidationError)(`${method}: input must be an object (got ${input === null ? "null" : typeof input})`);
+    }
+}
+function requireNonEmptyStringField(input, field, method) {
+    const value = input[field];
+    if (typeof value !== "string" || value.length === 0) {
+        throw (0, client_errors_js_1.clientValidationError)(`${method}: ${field} must be a non-empty string`);
+    }
+}
+function requireNonEmptyArrayField(input, field, method) {
+    const value = input[field];
+    if (!Array.isArray(value) || value.length === 0) {
+        throw (0, client_errors_js_1.clientValidationError)(`${method}: ${field} must be a non-empty array`);
+    }
+}
+function requireStringArrayElements(value, field, method) {
+    if (!Array.isArray(value)) {
+        throw (0, client_errors_js_1.clientValidationError)(`${method}: ${field} must be a non-empty array`);
+    }
+    value.forEach((entry, index) => {
+        if (typeof entry !== "string" || entry.length === 0) {
+            throw (0, client_errors_js_1.clientValidationError)(`${method}: ${field}[${index}] must be a non-empty string`);
+        }
+    });
+}
+function requireAtLeastOneField(input, fields, method) {
+    if (!fields.some((field) => input[field] !== undefined)) {
+        throw (0, client_errors_js_1.clientValidationError)(`${method}: at least one field (${fields.join(", ")}) must be provided`);
+    }
+}
+function requireNoUnknownFields(input, fields, method) {
+    const unknown = Object.keys(input).filter((field) => !fields.includes(field));
+    if (unknown.length > 0) {
+        const rendered = unknown.map((field) => `"${field}"`).join(", ");
+        const label = unknown.length === 1 ? "unknown field" : "unknown fields";
+        throw (0, client_errors_js_1.clientValidationError)(`${method}: ${label} ${rendered}`);
+    }
+}
+function normalizePatchFields(input, fields, options = {}) {
+    const preserveNull = new Set(options.preserveNullFields ?? []);
+    const normalized = {};
+    for (const key of fields) {
+        const value = input[key];
+        if (value !== undefined && (value !== null || preserveNull.has(key))) {
+            normalized[key] = value;
+        }
+    }
+    return normalized;
+}
+function requireConsumerDecision(id, version, allowNew = false) {
+    if (typeof id !== "string" ||
+        (!/^[a-f0-9]{64}$/.test(id) && !(allowNew && id === "new")) ||
+        !Number.isSafeInteger(version) ||
+        version < (allowNew ? 0 : 1))
+        throw (0, client_errors_js_1.clientValidationError)("consumer decision: invalid id or expected version");
+}
+/**
+ * Portal-verb target URL validation (qurl-go `ProtectURL` parity). On top of
+ * the shared scheme/length check, the URL must carry a host and must parse,
+ * and embedded credentials (userinfo) are rejected. The added checks never
+ * echo the URL — a userinfo URL contains credentials that must stay out of
+ * logs and error messages. The REST-shaped compatibility layer keeps its
+ * original prefix-only check so its accepted inputs don't change.
+ */
+function requirePortalTargetUrl(targetUrl) {
+    requireValidTargetUrl(targetUrl);
+    const url = targetUrl; // requireValidTargetUrl only returns for http(s) strings
+    // WHATWG URL normalizes away an empty authority ("https:///x" parses
+    // with host "x"), so the host-presence check runs on the raw string,
+    // mirroring qurl-go's url.Parse which rejects authority-less URLs.
+    const afterScheme = url.slice(url.indexOf("://") + 3);
+    if (afterScheme === "" || "/?#".includes(afterScheme[0])) {
+        throw (0, client_errors_js_1.clientValidationError)("target_url: must include a host");
+    }
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw (0, client_errors_js_1.clientValidationError)("target_url: malformed URL");
+    }
+    if (parsed.username !== "" || parsed.password !== "") {
+        throw (0, client_errors_js_1.clientValidationError)("target_url: must not include embedded credentials (userinfo)");
+    }
+}

package/dist/cjs/client.d.ts

@@ -1,21 +1,15 @@
+import type { AccessCodeListOutput, ApiKey, ApiKeyListOutput, BatchCreateInput, BatchCreateOutput, BillingInvoiceListOutput, CallerIdentity, CheckoutSession, ClientOptions, ConnectorInstallation, ConnectorInstallationListOutput, ConsumerAccessPolicy, ConsumerGrant, ConsumerGrantApprovalInput, ConsumerGrantListOutput, ConsumerInvitation, ConsumerInvitationListOutput, ConsumerListInput, CreateAccessCodeInput, CreateAccessCodeOutput, CreateApiKeyInput, CreateApiKeyOutput, CreateBillingCheckoutInput, CreateDelegatedQurlBatchInput, CreateDelegatedQurlBatchOptions, CreateExternalIdentityBindingInput, CreateExternalIdentityBindingOutput, CreateInput, CreateOutput, CreatePortalOptions, CreateQurlForResourceInput, CreateResourceInput, CreateWebhookInput, Customer, DelegatedQurl, DelegatedQurlBatchAccepted, Domain, DomainListOutput, DomainVerifyResult, ExtendInput, GetDelegatedQurlBatchOptions, GetDelegatedQurlBatchOutput, Invoice, ListApiKeysInput, ListBillingInvoicesInput, ListConnectorInstallationsInput, ListDomainsInput, ListInput, ListOutput, ListWebhookDeliveriesInput, ListWebhooksInput, MintInput, MintOutput, Portal, PortalSession, ProtectUrlOptions, QURL, Quota, QurlSummary, RedeemAccessCodeInput, RedeemAccessCodeOutput, RegisterDomainInput, RequestOptions, ResolveInput, ResolveOutput, Resource, ResourceDetail, ResourceHandle, ResourceListInput, ResourceListOutput, SessionListOutput, SessionTerminateOutput, ShareResourceOptions, UpdateApiKeyInput, UpdateCustomerInput, UpdateInput, UpdateResourceInput, UpdateResourceQurlInput, UpdateWebhookInput, UsageCurrentPeriod, UsageDaily, Webhook, WebhookDelivery, WebhookDeliveryListOutput, WebhookEventTypeInfo, WebhookListOutput, WebhookWithSecret } from "./types.js";
 import { ShareLink } from "./share.js";
-import type { ConsumerAccessPolicy, ConsumerInvitation, ConsumerGrant, ConsumerGrantApprovalInput, ConsumerListInput, ConsumerInvitationListOutput, ConsumerGrantListOutput, AccessCodeListOutput, ApiKey, ApiKeyListOutput, ApiKeyRequestScope, BillingInvoiceListOutput, BatchCreateInput, BatchCreateOutput, ClientOptions, ConnectorInstallation, ConnectorInstallationListOutput, CreateAccessCodeInput, CreateAccessCodeOutput, CreateApiKeyInput, CreateApiKeyOutput, CreateBillingCheckoutInput, CreateDelegatedQurlBatchInput, CreateDelegatedQurlBatchOptions, CreateInput, CreateOutput, CreatePortalOptions, CreateQurlForResourceInput, CreateResourceInput, CreateWebhookInput, Customer, CheckoutSession, Domain, DomainListOutput, DomainVerifyResult, DelegatedQurl, DelegatedQurlBatchAccepted, GetDelegatedQurlBatchOptions, GetDelegatedQurlBatchOutput, ExtendInput, Invoice, ListInput, ListOutput, ListApiKeysInput, ListBillingInvoicesInput, ListConnectorInstallationsInput, ListDomainsInput, ListWebhookDeliveriesInput, ListWebhooksInput, MintInput, MintOutput, Portal, PortalSession, ProtectUrlOptions, QURL, QurlSummary, Quota, RedeemAccessCodeInput, RedeemAccessCodeOutput, RegisterDomainInput, Resource, ResourceDetail, ResourceHandle, ResourceListInput, ResourceListOutput, RequestOptions, ResolveInput, ResolveOutput, SessionListOutput, SessionTerminateOutput, ShareResourceOptions, UpdateApiKeyInput, UpdateCustomerInput, UpdateInput, UpdateResourceInput, UpdateResourceQurlInput, UpdateWebhookInput, UsageCurrentPeriod, UsageDaily, Webhook, WebhookDelivery, WebhookDeliveryListOutput, WebhookEventTypeInfo, WebhookListOutput, WebhookWithSecret } from "./types.js";
-/** Narrow a response scope before reusing it in a create/update request. */
-export declare function isApiKeyRequestScope(scope: string): scope is ApiKeyRequestScope;
-/**
- * Shape of qurl-go's offline signed-fragment links: three or more
- * dot-separated base64url parts (<version>.<claims>.<secret>.<sig>).
- * Detected only to give those links a precise error in extractAccessToken.
- *
- * @internal Exported for in-package tests; not re-exported from index.ts.
- */
-export declare const SIGNED_FRAGMENT_RE: RegExp;
+import { ProtectedResource } from "./client-portals.js";
+import { ConnectorResource } from "./client-connectors.js";
+import type { EnsureConnectorResourceResult } from "./client-connectors.js";
 /** qURL API client. */
 export declare class QURLClient {
     private readonly baseUrl;
     private readonly apiKey;
     private readonly fetchFn;
     private readonly maxRetries;
+    private readonly maxResponseBodyBytes;
     private readonly timeout;
     private readonly userAgent;
     private readonly debugFn;
@@ -68,7 +62,9 @@ export declare class QURLClient {
      * {@link ProtectedResource.createPortal}:
      *
      * ```ts
-     * const resource = await client.protectUrl("https://internal.example.com/dashboard");
+     * const resource = await client.protectUrl("https://internal.example.com/dashboard", {
+     *   name: "Team dashboard",
+     * });
      * const portal = await resource.createPortal({ validFor: "5m" });
      * share(portal.link);
      * ```
@@ -95,8 +91,18 @@ export declare class QURLClient {
      * need the full resource details.
      */
     resourceByCrid(id: string): ProtectedResource;
-    /** Find or create the active qURL Connector resource for an immutable slug. */
-    ensureConnectorResource(slug: string, requestOptions?: RequestOptions, consumerAccess?: ConsumerAccessPolicy): Promise<EnsureConnectorResourceResult>;
+    /**
+     * Find or create the active qURL Connector resource for an immutable slug.
+     *
+     * `name` is the public name recipients see. The service requires it when the
+     * slug is new (`400 name_required` otherwise) and ignores it on reuse.
+     *
+     * @param slug - Immutable owner-scoped Connector slug.
+     * @param requestOptions - Per-call request options.
+     * @param consumerAccess - Private consumer policy for a new resource.
+     * @param name - Public resource name; required when the slug is new.
+     */
+    ensureConnectorResource(slug: string, requestOptions?: RequestOptions, consumerAccess?: ConsumerAccessPolicy, name?: string): Promise<EnsureConnectorResourceResult>;
     /** Fetch a qURL Connector resource by its CRID. */
     getConnectorResource(crid: string): Promise<ConnectorResource>;
     /** Fetch the single active qURL Connector resource for an immutable slug. */
@@ -184,6 +190,8 @@ export declare class QURLClient {
      *   populated `BatchCreateOutput` body in this case; whitelisted via
      *   `passthroughStatuses` so the structured per-item errors aren't
      *   swallowed by the generic error path.
+     *   HTTP 400 is the documented all-item validation failure. HTTP 422 is
+     *   not a batch passthrough status and follows normal error handling.
      *
      * Callers that only catch thrown errors will **silently miss partial
      * failures**. Always branch on `result.failed > 0` before treating the
@@ -336,6 +344,8 @@ export declare class QURLClient {
      * Accepts a plain token string or a `ResolveInput` object.
      */
     resolve(input: ResolveInput | string, options?: RequestOptions): Promise<ResolveOutput>;
+    /** Get the caller's account and credential identity. */
+    getIdentity(): Promise<CallerIdentity>;
     /** Get quota and usage information. */
     getQuota(): Promise<Quota>;
     /** List resources from the `/v1/resources` API. */
@@ -358,6 +368,15 @@ export declare class QURLClient {
     getResource(id: string): Promise<ResourceDetail>;
     /** Update resource metadata. */
     updateResource(id: string, input: UpdateResourceInput, options?: RequestOptions): Promise<Resource>;
+    /** Start Stripe Connect onboarding for this publisher. LayerV collects 3%. */
+    connectPublisherStripe(): Promise<{
+        url: string;
+    }>;
+    /** Read this publisher's connected account and the fixed application fee. */
+    publisherStripeAccount(): Promise<{
+        account_id: string;
+        layerv_fee_percent: number;
+    }>;
     /** Send a publisher-only invitation. Mail delivery does not prove enrollment. */
     inviteConsumer(id: string, email: string): Promise<ConsumerInvitation>;
     listConsumerInvitations(id: string, input?: ConsumerListInput): Promise<ConsumerInvitationListOutput>;
@@ -482,6 +501,13 @@ export declare class QURLClient {
      * iteration begins.
      */
     listAllWebhookDeliveries(id: string, input?: Omit<ListWebhookDeliveriesInput, "cursor">): AsyncGenerator<WebhookDelivery, void, undefined>;
+    /**
+     * Bind an external identity using the provider's trusted OAuth JWT as the
+     * client's bearer credential. Persist the request key before calling, then
+     * securely store the returned one-time plaintext key without logging it.
+     * Retry a lost response within 24 hours with the same key and body.
+     */
+    createExternalIdentityBinding(input: CreateExternalIdentityBindingInput, options: RequestOptions): Promise<CreateExternalIdentityBindingOutput>;
     /** Create a new API key. */
     createApiKey(input: CreateApiKeyInput, options?: RequestOptions): Promise<CreateApiKeyOutput>;
     /** List API keys. */
@@ -547,64 +573,8 @@ export declare class QURLClient {
     private classifyFetchError;
     private classifyResponseReadError;
 }
-/**
- * A LayerV-protected resource, bound to the client that produced it.
- *
- * Obtained from {@link QURLClient.protectUrl} or {@link QURLClient.resourceByCrid} —
- * not constructed directly. Mint short-lived access links for the resource
- * with {@link createPortal} (qurl-go: `qurl.Resource`).
- */
-export declare class ProtectedResource {
-    #private;
-    /** The public resource CRID. */
-    readonly crid: string;
-    /** The private URL protected by this resource, when known. */
-    readonly targetUrl?: string;
-    /**
-     * Full server-populated {@link Resource} metadata when the handle came
-     * from an API response; `undefined` for {@link QURLClient.resourceByCrid}
-     * handles and for the one-call {@link QURLClient.createPortalForUrl} path.
-     */
-    readonly details?: Resource;
-    constructor(client: QURLClient, id: string, targetUrl?: string, details?: Resource);
-    /**
-     * Whether `resource` was produced by `client`. A static because the
-     * binding lives in a private field that only this class can read; used
-     * by {@link QURLClient.createPortal} to refuse handles bound to a
-     * different client.
-     */
-    static isBoundTo(resource: ProtectedResource, client: QURLClient): boolean;
-    /**
-     * Mint a short-lived qURL link (a portal) for this resource. See
-     * {@link QURLClient.createPortal} for the option reference.
-     */
-    createPortal(opts?: CreatePortalOptions, requestOptions?: RequestOptions): Promise<Portal>;
-}
-/** Result of idempotently ensuring a qURL Connector resource. */
-export interface EnsureConnectorResourceResult {
-    resource: ConnectorResource;
-    foundExisting: boolean;
-}
-declare const CONNECTOR_RESOURCE_CONSTRUCTOR_TOKEN: unique symbol;
-/**
- * A validated qURL Connector resource bound to the client that loaded it.
- *
- * Resource identity, reverse-routing identity, and NHP admission identity are
- * distinct server-issued values. Callers must consume each field verbatim and
- * must never derive one from another.
- */
-export declare class ConnectorResource {
-    #private;
-    readonly resourcePublicKey: string;
-    /** Required public identifier, verified against the returned resource key. */
-    readonly crid: string;
-    readonly connectorRoutingId: string;
-    readonly knockResourceId: string;
-    readonly slug: string;
-    readonly alias?: string;
-    /** @internal Instances are returned by QURLClient after wire validation. */
-    constructor(client: QURLClient, details: Resource, validationToken: typeof CONNECTOR_RESOURCE_CONSTRUCTOR_TOKEN);
-    /** Mint a short-lived portal for this Connector resource. */
-    createPortal(opts?: CreatePortalOptions, requestOptions?: RequestOptions): Promise<Portal>;
-}
-export {};
+export { isApiKeyRequestScope } from "./client-management.js";
+export { SIGNED_FRAGMENT_RE } from "./client-portals.js";
+export { ProtectedResource } from "./client-portals.js";
+export type { EnsureConnectorResourceResult } from "./client-connectors.js";
+export { ConnectorResource } from "./client-connectors.js";