@layervai/qurl 3.1.0 → 4.0.0

package/dist/cjs/client.js

@@ -1,50 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConnectorResource = exports.ProtectedResource = exports.QURLClient = exports.SIGNED_FRAGMENT_RE = void 0;
-exports.isApiKeyRequestScope = isApiKeyRequestScope;
-const crid_js_1 = require("./crid.js");
+exports.ConnectorResource = exports.ProtectedResource = exports.SIGNED_FRAGMENT_RE = exports.isApiKeyRequestScope = exports.QURLClient = void 0;
 const errors_js_1 = require("./errors.js");
+const response_metadata_js_1 = require("./response-metadata.js");
 const internal_js_1 = require("./internal.js");
-const share_js_1 = require("./share.js");
 const version_js_1 = require("./version.js");
+const share_js_1 = require("./share.js");
+const client_limits_js_1 = require("./client-limits.js");
+const client_errors_js_1 = require("./client-errors.js");
+const client_validation_js_1 = require("./client-validation.js");
+const client_input_fields_js_1 = require("./client-input-fields.js");
+const client_resources_js_1 = require("./client-resources.js");
+const client_portals_js_1 = require("./client-portals.js");
+const client_connectors_js_1 = require("./client-connectors.js");
+const client_paths_js_1 = require("./client-paths.js");
+const client_delegated_js_1 = require("./client-delegated.js");
+const client_management_js_1 = require("./client-management.js");
 const DEFAULT_BASE_URL = "https://api.layerv.ai";
 const DEFAULT_MAX_RETRIES = 3;
 const DEFAULT_TIMEOUT = 30_000;
-// Match qurl-go c4f2f98's exact API response cap. Current qurl-service list
-// routes cap pages at 100 items. A caller can still exceed this cap with a
-// large, heavily escaped webhook-delivery page, so list callers must request a
-// smaller page if the service reports the body-limit error. This cap is fixed:
-// do not add an override or widen one SDK independently from the other.
-// The limit is enforced from Content-Length when usable and again while
-// consuming the response stream.
-const MAX_RESPONSE_BODY_BYTES = 1 << 20;
-const MAX_ERROR_SNIPPET_BYTES = 512;
-// UTF-8 uses at least one byte per UTF-16 code unit. Reading more source units
-// cannot add a byte that fits in a 512-byte retained diagnostic.
-const MAX_ERROR_SNIPPET_SOURCE_CODE_UNITS = MAX_ERROR_SNIPPET_BYTES;
-const MAX_INVALID_FIELD_ENTRIES = 100;
-const MAX_DEBUG_BODY_KEYS = 100;
-// Bound each retained diagnostic collection as well as each string. Without
-// this aggregate cap, 100 valid 512-byte keys and values could turn a small
-// server error into a large caller-visible object. This is a diagnostic budget,
-// not part of the API wire contract.
-const MAX_DIAGNOSTIC_COLLECTION_BYTES = 8 << 10;
-const TEXT_ENCODER = new TextEncoder();
-const ERROR_SNIPPET_ELLIPSIS = "...";
-const ERROR_SNIPPET_ELLIPSIS_BYTES = 3;
-// RFC 8259 JSON exchanged between systems must be valid UTF-8. A non-fatal
-// decoder would replace malformed bytes with U+FFFD before JSON.parse and hide
-// the producer's exact contract violation.
-const TEXT_DECODER = new TextDecoder("utf-8", { fatal: true });
-const RETRY_BASE_DELAY_MS = 500;
-// Bounds local exponential backoff (NOT server-asserted Retry-After —
-// see `RETRY_AFTER_HARD_CAP_MS` for that).
-const RETRY_MAX_DELAY_MS = 30_000;
-// Hard cap on server-asserted Retry-After. Guards against `Retry-After`
-// values >2^31-1 ms overflowing Node's setTimeout (silently truncated to
-// 1ms — turns a "wait a month" directive into a hot retry loop).
-const RETRY_AFTER_HARD_CAP_MS = 60 * 60 * 1000;
-const RETRY_AFTER_PARSE_LIMIT_S = RETRY_AFTER_HARD_CAP_MS / 1000;
 const RETRYABLE_STATUS = new Set([429, 502, 503, 504]);
 // Keep mutating status retries 429-only until the service-side idempotency
 // cache contract is proven across 5xx, TTL, and replay-window edge cases.
@@ -54,12 +28,11 @@ const REDIRECT_RESPONSE_STATUSES = new Set([300, 301, 302, 303, 305, 307, 308]);
 const NO_RETRYABLE_STATUSES = new Set();
 const IDEMPOTENCY_KEY_METHODS = new Set(["POST", "PATCH"]);
 const MUTATING_RETRY_METHODS = new Set(["POST", "PATCH"]);
-const MAX_IDEMPOTENCY_KEY = 256;
 const IDEMPOTENCY_KEY_VALUE_RE = /^[\x21-\x7e](?:[\x20-\x7e]*[\x21-\x7e])?$/;
 const UUID_HEX = Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
 class ResponseBodyTooLargeError extends Error {
-    constructor() {
-        super(`Response body exceeds ${MAX_RESPONSE_BODY_BYTES}-byte limit`);
+    constructor(limit) {
+        super(`Response body exceeds ${limit}-byte limit`);
         this.name = "ResponseBodyTooLargeError";
     }
 }
@@ -78,288 +51,22 @@ class ResponseBodyMaterializationError extends Error {
 const NO_PASSTHROUGH_STATUSES = [];
 const BATCH_PASSTHROUGH_STATUSES = [400];
 const DELEGATED_BATCH_PASSTHROUGH_STATUSES = [304];
-/** Allowlist of known query-param keys for the `list()` endpoint. */
-const LIST_PARAM_KEYS = [
-    "limit",
-    "cursor",
-    "status",
-    "q",
-    "sort",
-    "created_after",
-    "created_before",
-    "expires_before",
-    "expires_after",
-];
-const REQUEST_OPTION_KEYS = ["idempotencyKey"];
-const DELEGATED_BATCH_INPUT_KEYS = [
-    "mint_capability",
-    "grants",
-];
-const DELEGATED_BATCH_GRANT_KEYS = [
-    "expires_in",
-    "label",
-    "one_time_use",
-    "max_sessions",
-    "session_duration",
-    "access_policy",
-];
-const DELEGATED_BATCH_CREATE_OPTION_KEYS = [
-    "idempotencyKey",
-];
-const DELEGATED_BATCH_GET_OPTION_KEYS = [
-    "etag",
-];
-// Compile-time witness: `Exclude<keyof X, (typeof KEYS)[number]>` is
-// `never` iff KEYS lists every key of X. Paired with the
-// `satisfies readonly (keyof X)[]` clause on the array (which catches
-// the other direction), this gives bidirectional drift detection on
-// the *_KEYS allowlists at zero runtime cost.
-function assertExhaustive(_) {
-    /* type-only check */
-}
-assertExhaustive(true);
-assertExhaustive(true);
-assertExhaustive(true);
-assertExhaustive(true);
-assertExhaustive(true);
-assertExhaustive(true);
-const CREATE_FIELD_KEYS = [
-    "private",
-    "type",
-    "target_url",
-    "expires_in",
-    "one_time_use",
-    "max_sessions",
-    "session_duration",
-    "label",
-    "access_policy",
-    "custom_domain",
-];
-assertExhaustive(true);
-/**
- * Fields accepted by `update()`. The empty-input pre-flight check in
- * {@link QURLClient.update} iterates this const — so adding a new field to
- * {@link UpdateInput} without listing it here will fail the
- * paired `assertExhaustive` witness at compile time rather than silently
- * sneaking through an empty-input request.
- */
-const UPDATE_FIELD_KEYS = [
-    "extend_by",
-    "expires_at",
-    "description",
-    "tags",
-];
-assertExhaustive(true);
-/**
- * Fields accepted by `mintLink()`. Iterated by the null-stripping
- * normalization loop in {@link QURLClient.mintLink} so unknown keys
- * from untyped-JS callers don't leak through to the wire body.
- * Symmetric with `LIST_PARAM_KEYS` / `UPDATE_FIELD_KEYS`.
- */
-const MINT_FIELD_KEYS = [
-    "expires_in",
-    "expires_at",
-    "label",
-    "one_time_use",
-    "max_sessions",
-    "session_duration",
-    "access_policy",
-];
-assertExhaustive(true);
-const RESOURCE_LIST_PARAM_KEYS = [
-    "cursor",
-    "limit",
-    "alias",
-    "slug",
-    "status",
-    "type",
-];
-assertExhaustive(true);
-const CREATE_RESOURCE_FIELD_KEYS = [
-    "private",
-    "consumer_access",
-    "type",
-    "target_url",
-    "description",
-    "tags",
-    "custom_domain",
-    "alias",
-    "slug",
-    "find_or_create",
-];
-assertExhaustive(true);
-const UPDATE_RESOURCE_FIELD_KEYS = [
-    "allowed_device_keys_add",
-    "allowed_device_keys_remove",
-    "consumer_access",
-    "expected_consumer_access_version",
-    "description",
-    "tags",
-    "custom_domain",
-    "preserve_host",
-    "alias",
-];
-assertExhaustive(true);
-const CREATE_QURL_FOR_RESOURCE_FIELD_KEYS = [
-    "expires_in",
-    "one_time_use",
-    "max_sessions",
-    "session_duration",
-    "label",
-    "access_policy",
-    "target_path",
-];
-const SHARE_RESOURCE_OPTION_KEYS = [
-    "ttlSeconds",
-];
-assertExhaustive(true);
-assertExhaustive(true);
-/**
- * Options accepted by the portal-verb `protectUrl` / `createPortal`
- * surface. These are camelCase caller-facing options (the portal verbs are
- * the idiomatic layer); the build helpers map them onto the same wire
- * fields the REST-shaped methods send.
- */
-const PROTECT_URL_OPTION_KEYS = [
-    "private",
-    "consumerAccess",
-    "description",
-    "tags",
-    "customDomain",
-    "alias",
-];
-assertExhaustive(true);
-const CREATE_PORTAL_OPTION_KEYS = [
-    "validFor",
-    "label",
-    "oneTimeUse",
-    "maxSessions",
-    "sessionDuration",
-    "targetPath",
-];
-assertExhaustive(true);
-const UPDATE_RESOURCE_QURL_FIELD_KEYS = [
-    "extend_by",
-    "expires_at",
-    "label",
-    "access_policy",
-    "max_sessions",
-    "session_duration",
-];
-assertExhaustive(true);
-const UPDATE_CUSTOMER_FIELD_KEYS = [
-    "spending_cap_cents",
-];
-assertExhaustive(true);
-const CREATE_BILLING_CHECKOUT_FIELD_KEYS = [
-    "plan",
-];
-assertExhaustive(true);
-const REGISTER_DOMAIN_FIELD_KEYS = [
-    "domain",
-];
-assertExhaustive(true);
-const CREATE_WEBHOOK_FIELD_KEYS = [
-    "url",
-    "events",
-    "description",
-];
-assertExhaustive(true);
-const UPDATE_WEBHOOK_FIELD_KEYS = [
-    "url",
-    "events",
-    "description",
-    "status",
-];
-assertExhaustive(true);
-const CREATE_API_KEY_FIELD_KEYS = [
-    "kind",
-    "name",
-    "scopes",
-    "target",
-    "claims",
-    "expires_in",
-];
-assertExhaustive(true);
-const UPDATE_API_KEY_FIELD_KEYS = [
-    "name",
-    "scopes",
-];
-assertExhaustive(true);
-const REDEEM_ACCESS_CODE_FIELD_KEYS = [
-    "code",
-    "honeypot",
-    "elapsed_ms",
-];
-assertExhaustive(true);
-const CREATE_ACCESS_CODE_FIELD_KEYS = [
-    "resource_id",
-    "name",
-    "max_uses",
-    "expires_at",
-];
-assertExhaustive(true);
-const CONNECTOR_INSTALLATION_LIST_PARAM_KEYS = [
-    "cursor",
-    "limit",
-];
-assertExhaustive(true);
-const BILLING_INVOICE_LIST_PARAM_KEYS = [
-    "limit",
-    "cursor",
-];
-assertExhaustive(true);
-const DOMAIN_LIST_PARAM_KEYS = [
-    "limit",
-    "cursor",
-];
-assertExhaustive(true);
-const WEBHOOK_LIST_PARAM_KEYS = [
-    "limit",
-    "cursor",
-];
-assertExhaustive(true);
-const WEBHOOK_DELIVERY_LIST_PARAM_KEYS = [
-    "limit",
-    "cursor",
-];
-assertExhaustive(true);
-const API_KEY_LIST_PARAM_KEYS = [
-    "limit",
-    "cursor",
-    "status",
-];
-assertExhaustive(true);
-/**
- * Construct a {@link ValidationError} for a client-side pre-flight check.
- * Uses `status: 0` (matching {@link NetworkError}/{@link TimeoutError}) and
- * `code: "client_validation"` so catch-by-class still works and callers can
- * tell the error originated inside the SDK rather than from the API.
- */
-function clientValidationError(detail) {
-    return new errors_js_1.ValidationError({
-        status: 0,
-        code: errors_js_1.ERROR_CODE_CLIENT_VALIDATION,
-        title: "Invalid Argument",
-        detail,
-    });
-}
 function validateRequestOptions(options) {
     if (options === undefined) {
         return;
     }
     if (typeof options !== "object" || options === null || Array.isArray(options)) {
-        throw clientValidationError(`request options: must be an object (got ${options === null ? "null" : describeShape(options)})`);
+        throw (0, client_errors_js_1.clientValidationError)(`request options: must be an object (got ${options === null ? "null" : (0, client_validation_js_1.describeShape)(options)})`);
     }
-    requireNoUnknownFields(options, REQUEST_OPTION_KEYS, "request options");
+    (0, client_validation_js_1.requireNoUnknownFields)(options, client_input_fields_js_1.REQUEST_OPTION_KEYS, "request options");
     const key = options.idempotencyKey;
     if (key !== undefined) {
         if (typeof key !== "string" || key.length === 0) {
-            throw clientValidationError("idempotencyKey: must be a non-empty string");
+            throw (0, client_errors_js_1.clientValidationError)("idempotencyKey: must be a non-empty string");
         }
-        requireMaxLength(key, "idempotencyKey", MAX_IDEMPOTENCY_KEY);
+        (0, client_validation_js_1.requireMaxLength)(key, "idempotencyKey", client_limits_js_1.MAX_IDEMPOTENCY_KEY);
         if (!IDEMPOTENCY_KEY_VALUE_RE.test(key)) {
-            throw clientValidationError("idempotencyKey: must contain only printable ASCII characters and must not start or end with spaces");
+            throw (0, client_errors_js_1.clientValidationError)("idempotencyKey: must contain only printable ASCII characters and must not start or end with spaces");
         }
     }
 }
@@ -415,171 +122,6 @@ function fillRandomBytes(bytes) {
     }
     throw new errors_js_1.RuntimeError("globalThis.crypto.getRandomValues is required to generate Idempotency-Key");
 }
-/**
- * Construct a {@link ValidationError} for the case where the API returned
- * a response that parsed as JSON but didn't match the expected schema
- * shape (e.g. 400 with a body that isn't a {@link BatchCreateOutput}).
- *
- * Distinct from {@link clientValidationError} so callers can `.code`-branch
- * between "I passed bad input locally" (`"client_validation"`) and "the
- * server returned a body I can't interpret" (`"unexpected_response"`).
- * Uses `status: 0` by default because a logical shape mismatch is not tied to
- * the HTTP classification. Callers that enforce an observed HTTP contract
- * pass that status explicitly.
- *
- * Threads `request_id` through to {@link QURLError.requestId} when the
- * server-side correlation ID is available — operators debugging
- * "unexpected response" tickets need it on the *error* path too, not
- * just on success/passthrough returns.
- */
-function unexpectedResponseError(detail, options = {}) {
-    // Every detail passed here is an SDK-authored contract message whose dynamic
-    // inputs were validated by the caller-side shape guards. Do not pass raw
-    // server strings to this helper. Server diagnostics use boundedErrorSnippet.
-    const safeRequestId = boundedErrorIdentifier(options.requestId);
-    return new errors_js_1.ValidationError({
-        status: options.status ?? 0,
-        code: errors_js_1.ERROR_CODE_UNEXPECTED_RESPONSE,
-        title: "Unexpected Response",
-        detail,
-        request_id: safeRequestId,
-    });
-}
-function withErrorCause(error, cause) {
-    // Match the native Error `cause` descriptor. In particular, do not leak a
-    // transport object through Object.keys(), object spread, or JSON logging.
-    Object.defineProperty(error, "cause", {
-        value: cause,
-        writable: true,
-        configurable: true,
-    });
-    return error;
-}
-function isIndependentAbort(error, requestSignal) {
-    return (error instanceof Error &&
-        (error.name === "AbortError" || error.name === "TimeoutError") &&
-        !requestSignal.aborted);
-}
-function isSdkTimeout(error, requestSignal) {
-    return (error instanceof Error &&
-        requestSignal.aborted &&
-        (error.name === "TimeoutError" || error.name === "AbortError"));
-}
-/**
- * Normalize a server-provided problem title/detail into a single-line,
- * UTF-8-safe snippet. Error messages must stay bounded even when a proxy or
- * compromised upstream returns very large structured problem fields.
- */
-function normalizedErrorSnippet(value) {
-    if (typeof value !== "string")
-        return undefined;
-    // Bound source work before the Unicode regular expressions allocate
-    // normalized copies. The response body cap is much larger than one retained
-    // diagnostic, so processing the full server string would waste memory.
-    const normalized = value
-        .slice(0, MAX_ERROR_SNIPPET_SOURCE_CODE_UNITS)
-        // Strip control characters plus bidi override/isolate controls that can
-        // visually reorder diagnostics. Preserve other formatting characters
-        // such as ZWJ/ZWNJ, which are required by legitimate scripts and emoji.
-        .replace(/[\p{Cc}\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/gu, " ")
-        .trim()
-        .replace(/\s+/g, " ");
-    return normalized === "" ? undefined : normalized;
-}
-function boundedErrorSnippet(value) {
-    const sourceTruncated = typeof value === "string" && value.length > MAX_ERROR_SNIPPET_SOURCE_CODE_UNITS;
-    const normalized = normalizedErrorSnippet(value);
-    if (normalized === undefined)
-        return undefined;
-    const contentLimit = sourceTruncated
-        ? MAX_ERROR_SNIPPET_BYTES - ERROR_SNIPPET_ELLIPSIS_BYTES
-        : MAX_ERROR_SNIPPET_BYTES;
-    // UTF-8 uses at most three bytes per UTF-16 code unit. Most diagnostics are
-    // short ASCII, so avoid an allocation only to prove they fit.
-    if (normalized.length * 3 <= contentLimit) {
-        return sourceTruncated ? `${normalized}${ERROR_SNIPPET_ELLIPSIS}` : normalized;
-    }
-    const encoded = TEXT_ENCODER.encode(normalized);
-    if (encoded.byteLength <= contentLimit) {
-        return sourceTruncated ? `${normalized}${ERROR_SNIPPET_ELLIPSIS}` : normalized;
-    }
-    let end = MAX_ERROR_SNIPPET_BYTES - ERROR_SNIPPET_ELLIPSIS_BYTES;
-    // Do not split a multi-byte UTF-8 sequence at the cap.
-    while (end > 0 && (encoded[end] & 0xc0) === 0x80)
-        end--;
-    return `${TEXT_DECODER.decode(encoded.subarray(0, end))}${ERROR_SNIPPET_ELLIPSIS}`;
-}
-/** Keep server identifiers useful as exact machine-readable discriminants. */
-function boundedErrorIdentifier(value) {
-    if (typeof value !== "string" || value.length > MAX_ERROR_SNIPPET_SOURCE_CODE_UNITS) {
-        return undefined;
-    }
-    const normalized = normalizedErrorSnippet(value);
-    if (normalized === undefined ||
-        normalized !== value ||
-        TEXT_ENCODER.encode(value).byteLength > MAX_ERROR_SNIPPET_BYTES) {
-        return undefined;
-    }
-    return value;
-}
-/** Collect at most the first N enumerable own string keys without a full key-array copy. */
-function firstEnumerableOwnKeys(value, limit) {
-    const keys = [];
-    for (const key in value) {
-        if (!Object.prototype.hasOwnProperty.call(value, key))
-            continue;
-        keys.push(key);
-        if (keys.length === limit)
-            break;
-    }
-    return keys;
-}
-/** Bound the structured per-field diagnostics exposed on ValidationError. */
-function boundedInvalidFields(value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
-        return undefined;
-    const entries = [];
-    const retainedKeys = new Set();
-    let retainedBytes = 0;
-    // Bound inspected entries as well as retained entries. A hostile envelope
-    // whose values all have the wrong type must not make diagnostics scan every
-    // key in the response body.
-    for (const rawKey of firstEnumerableOwnKeys(value, MAX_INVALID_FIELD_ENTRIES)) {
-        const rawValue = value[rawKey];
-        const key = boundedErrorSnippet(rawKey);
-        const fieldDetail = boundedErrorSnippet(rawValue);
-        if (key !== undefined && fieldDetail !== undefined && !retainedKeys.has(key)) {
-            const entryBytes = TEXT_ENCODER.encode(key).byteLength + TEXT_ENCODER.encode(fieldDetail).byteLength;
-            // A later, smaller entry can still fit even when this one cannot.
-            if (retainedBytes + entryBytes > MAX_DIAGNOSTIC_COLLECTION_BYTES)
-                continue;
-            retainedKeys.add(key);
-            entries.push([key, fieldDetail]);
-            retainedBytes += entryBytes;
-        }
-    }
-    return entries.length > 0 ? Object.fromEntries(entries) : undefined;
-}
-/** Bound server-controlled object keys before forwarding them to a debug sink. */
-function boundedObjectKeys(value) {
-    // Stop before normalization so a hostile envelope cannot force work over
-    // every enumerable own key. Some early keys may normalize away; bounded
-    // diagnostics are more important here than filling every available slot.
-    const retained = [];
-    let retainedBytes = 0;
-    for (const rawKey of firstEnumerableOwnKeys(value, MAX_DEBUG_BODY_KEYS)) {
-        const key = boundedErrorSnippet(rawKey);
-        if (key === undefined)
-            continue;
-        const keyBytes = TEXT_ENCODER.encode(key).byteLength;
-        // A later, smaller key can still fit even when this one cannot.
-        if (retainedBytes + keyBytes > MAX_DIAGNOSTIC_COLLECTION_BYTES)
-            continue;
-        retained.push(key);
-        retainedBytes += keyBytes;
-    }
-    return retained;
-}
 async function cancelResponseBody(body) {
     if (!body)
         return;
@@ -590,24 +132,27 @@ async function cancelResponseBody(body) {
         // Best-effort resource cleanup must not replace the deterministic SDK error.
     }
 }
-function materializedResponseBodyExceedsLimit(value) {
-    if (value.length > MAX_RESPONSE_BODY_BYTES)
+function materializedResponseBodyExceedsLimit(value, limit) {
+    if (value.length > limit)
         return true;
     // Encoding creates another buffer. UTF-8 uses at most three bytes per
     // UTF-16 code unit, so shorter strings are provably safe without that copy.
-    return (value.length * 3 > MAX_RESPONSE_BODY_BYTES &&
-        TEXT_ENCODER.encode(value).byteLength > MAX_RESPONSE_BODY_BYTES);
+    return value.length * 3 > limit && client_errors_js_1.TEXT_ENCODER.encode(value).byteLength > limit;
 }
-function contentLengthExceedsLimit(response) {
+function contentLengthExceedsLimit(response, limit) {
     // 204/205 never carry content, and a 304 Content-Length describes the
     // selected representation rather than a response body. Do not reject those
     // statuses for metadata about bytes that fetch will not deliver.
     if (response.status === 204 || response.status === 205 || response.status === 304)
         return false;
+    // Encoded Content-Length describes wire bytes; fetch exposes decoded bytes.
+    const encoding = response.headers.get("content-encoding");
+    if (encoding && encoding.trim().toLowerCase() !== "identity")
+        return false;
     const value = response.headers.get("content-length");
     if (value === null || !/^\d+$/.test(value.trim()))
         return false;
-    return Number(value) > MAX_RESPONSE_BODY_BYTES;
+    return Number(value) > limit;
 }
 /** Detect a followed redirect from fetch implementations that expose only the final URL. */
 function responseUrlState(responseUrl, requestUrl) {
@@ -635,16 +180,16 @@ function responseUrlState(responseUrl, requestUrl) {
  * optimization only; streaming byte accounting remains authoritative because
  * that header may be absent or false.
  */
-async function readBoundedResponseBody(response) {
+async function readBoundedResponseBody(response, limit) {
     // `headers.get` is part of the documented injected-fetch contract. Detect a
     // malformed local shim before it can be mistaken for a retryable body-stream
     // failure and replay an otherwise deterministic GET programming error.
     if (typeof response.headers?.get !== "function") {
         throw new ResponseBodyMaterializationError("Response-like fetch must provide headers.get(name)");
     }
-    if (contentLengthExceedsLimit(response)) {
+    if (contentLengthExceedsLimit(response, limit)) {
         await cancelResponseBody(response.body);
-        throw new ResponseBodyTooLargeError();
+        throw new ResponseBodyTooLargeError(limit);
     }
     const body = response.body;
     if (body === null)
@@ -666,8 +211,8 @@ async function readBoundedResponseBody(response) {
             }
         }
         const text = typeof materializedText === "string" ? materializedText : "";
-        if (materializedResponseBodyExceedsLimit(text)) {
-            throw new ResponseBodyTooLargeError();
+        if (materializedResponseBodyExceedsLimit(text, limit)) {
+            throw new ResponseBodyTooLargeError(limit);
         }
         if (text !== "" ||
             response.status === 204 ||
@@ -695,8 +240,8 @@ async function readBoundedResponseBody(response) {
         }
         if (serialized === undefined)
             return "";
-        if (materializedResponseBodyExceedsLimit(serialized)) {
-            throw new ResponseBodyTooLargeError();
+        if (materializedResponseBodyExceedsLimit(serialized, limit)) {
+            throw new ResponseBodyTooLargeError(limit);
         }
         return serialized;
     }
@@ -712,14 +257,14 @@ async function readBoundedResponseBody(response) {
                 throw new ResponseBodyMaterializationError("Response-like fetch body stream must yield Uint8Array chunks");
             }
             const nextTotal = total + value.byteLength;
-            if (nextTotal > MAX_RESPONSE_BODY_BYTES) {
+            if (nextTotal > limit) {
                 try {
                     await reader.cancel();
                 }
                 catch {
                     // Preserve the body-limit failure even if stream cancellation fails.
                 }
-                throw new ResponseBodyTooLargeError();
+                throw new ResponseBodyTooLargeError(limit);
             }
             chunks.push(value);
             total = nextTotal;
@@ -741,139 +286,12 @@ async function readBoundedResponseBody(response) {
         }
     }
     try {
-        return TEXT_DECODER.decode(bytes);
+        return client_errors_js_1.TEXT_DECODER.decode(bytes);
     }
     catch {
         throw new InvalidResponseEncodingError();
     }
 }
-// ---- Spec-derived validation helpers ------------------------------------
-// These mirror constraints documented on each request schema in
-// `openapi.yaml` so obvious mistakes fail fast instead of round-tripping
-// to the API and coming back as a generic 400.
-const MAX_TARGET_URL = 2048;
-const MAX_LABEL = 500;
-const MAX_BATCH_ITEMS = 100;
-const MAX_DESCRIPTION = 500;
-const MAX_CUSTOM_DOMAIN = 253;
-const MAX_MAX_SESSIONS = 1000;
-const MAX_API_KEY_NAME = 100;
-const API_KEY_REQUEST_SCOPE_VALUES = [
-    "qurl:read",
-    "qurl:write",
-    "qurl:resolve",
-    "qurl:agent",
-];
-assertExhaustive(true);
-const API_KEY_REQUEST_SCOPES = new Set(API_KEY_REQUEST_SCOPE_VALUES);
-/** Narrow a response scope before reusing it in a create/update request. */
-function isApiKeyRequestScope(scope) {
-    return API_KEY_REQUEST_SCOPES.has(scope);
-}
-const CREDENTIAL_TARGET_VALUES = [
-    "agent",
-    "connector",
-];
-assertExhaustive(true);
-const CREDENTIAL_TARGETS = new Set(CREDENTIAL_TARGET_VALUES);
-const CREDENTIAL_CLAIM_TYPE_VALUES = [
-    "connector",
-];
-assertExhaustive(true);
-const CREDENTIAL_CLAIM_TYPES = new Set(CREDENTIAL_CLAIM_TYPE_VALUES);
-// Mirrors CreateApiKeyRequest.expires_in in the service OpenAPI. Composite
-// durations are deliberately invalid on this endpoint. The 24h cap permits
-// 1d, but no positive whole-week duration.
-const CREDENTIAL_DURATION_PATTERN = /^([0-9]+)([smhdw])$/;
-const CREDENTIAL_DURATION_MULTIPLIERS = {
-    s: 1n,
-    m: 60n,
-    h: 3600n,
-    d: 86400n,
-    w: 604800n,
-};
-const MAX_ENROLLMENT_TOKEN_TTL_SECONDS = 86400n;
-const MAX_ALIAS = 64;
-const MAX_SLUG = 64;
-const MAX_TARGET_PATH = 2048;
-const MAX_TAGS = 10;
-const MAX_TAG_LENGTH = 50;
-const MAX_AUTO_PAGINATION_PAGES = 10_000;
-const MIN_DELEGATED_BATCH_IDEMPOTENCY_KEY = 32;
-const MAX_DELEGATED_MINT_CAPABILITY = 8192;
-const MAX_DELEGATED_ETAG = 96;
-const MAX_DELEGATED_BATCH_ITEMS = 100;
-const DELEGATED_BATCH_ID_PATTERN = /^dqb_[A-Za-z0-9_-]{22}$/;
-const DELEGATED_QURL_ID_PATTERN = /^q_[0-9a-f]{11}$/;
-const STRONG_ETAG_PATTERN = /^"[\x21\x23-\x7e]+"$/;
-const UTC_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
-// Keep these identity contracts aligned with qurl-go and the public API.
-const CONNECTOR_SLUG_PATTERN = /^[a-z][a-z0-9-]{1,62}[a-z0-9]$/;
-// Current service schemas intentionally share this grammar, but keep the
-// mutable alias contract separate from the immutable lookup identity.
-const CONNECTOR_ALIAS_PATTERN = /^[a-z][a-z0-9-]{1,62}[a-z0-9]$/;
-const CONNECTOR_RESOURCE_ID_PATTERN = /^[A-Za-z0-9_-]{122}$/;
-const CONNECTOR_RESOURCE_ID_DER_PREFIX = "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE";
-const CONNECTOR_ROUTING_ID_PATTERN = /^c-[a-z2-7]{51}[aq]$/;
-// CreateQurlRequest.target_url pattern is loose (just a URI) but
-// UpdateQurlRequest.tags pattern is specific — enforce it here.
-const TAG_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9 _-]*$/;
-function requireMaxLength(value, field, max) {
-    if (value === undefined)
-        return;
-    // Untyped-JS safety: a non-string `value` would silently pass since
-    // `(42).length === undefined > max` is `false` and the bad value would
-    // sail through to the wire. Match the typeof guard pattern used by
-    // requireValidTags / requireValidTargetUrl.
-    if (typeof value !== "string") {
-        throw clientValidationError(`${field}: must be a string (got ${value === null ? "null" : typeof value})`);
-    }
-    if (value.length > max) {
-        throw clientValidationError(`${field}: must be ${max} characters or fewer (got ${value.length})`);
-    }
-}
-function requireMaxUtf8Bytes(value, field, max) {
-    if (value === undefined)
-        return;
-    if (typeof value !== "string") {
-        throw clientValidationError(`${field}: must be a string (got ${value === null ? "null" : typeof value})`);
-    }
-    const bytes = TEXT_ENCODER.encode(value).byteLength;
-    if (bytes > max) {
-        throw clientValidationError(`${field}: must be ${max} UTF-8 bytes or fewer (got ${bytes})`);
-    }
-}
-function requireNonEmptyIfPresent(value, field) {
-    // Reject `""` so uninitialized form state doesn't reach the wire.
-    if (value === "") {
-        throw clientValidationError(`${field}: must not be an empty string`);
-    }
-}
-function requireMaxSessionsInRange(value, field = "max_sessions") {
-    if (value === undefined)
-        return;
-    if (!Number.isInteger(value) || value < 0 || value > MAX_MAX_SESSIONS) {
-        throw clientValidationError(`${field}: must be an integer between 0 and ${MAX_MAX_SESSIONS} (got ${value})`);
-    }
-}
-function requireBooleanIfPresent(value, field) {
-    if (value === undefined)
-        return;
-    if (typeof value !== "boolean") {
-        throw clientValidationError(`${field}: must be a boolean (got ${describeShape(value)})`);
-    }
-}
-function requireListLimitInRange(value, methodName) {
-    if (value === undefined || value === null)
-        return;
-    // All current paginated OpenAPI query params share 1..100. If a future
-    // endpoint diverges, add a per-endpoint bound rather than changing this
-    // shared guard silently.
-    if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 100) {
-        const rendered = typeof value === "string" ? JSON.stringify(value) : String(value);
-        throw clientValidationError(`${methodName}: limit: must be an integer between 1 and 100 (got ${rendered})`);
-    }
-}
 function appendQuery(path, input, keys, methodName) {
     validateQueryInput(input, keys, methodName);
     const params = new URLSearchParams();
@@ -887,9 +305,9 @@ function appendQuery(path, input, keys, methodName) {
     return query ? `${path}?${query}` : path;
 }
 function validateQueryInput(input, keys, methodName) {
-    requireNoUnknownFields(input, keys, methodName);
+    (0, client_validation_js_1.requireNoUnknownFields)(input, keys, methodName);
     if (keys.includes("limit")) {
-        requireListLimitInRange(input.limit, methodName);
+        (0, client_validation_js_1.requireListLimitInRange)(input.limit, methodName);
     }
     for (const key of keys) {
         const value = input[key];
@@ -898,7 +316,7 @@ function validateQueryInput(input, keys, methodName) {
         if (key === "limit")
             continue;
         if (typeof value !== "string") {
-            throw clientValidationError(`${methodName}: ${key}: must be a string (got ${describeShape(value)})`);
+            throw (0, client_errors_js_1.clientValidationError)(`${methodName}: ${key}: must be a string (got ${(0, client_validation_js_1.describeShape)(value)})`);
         }
     }
 }
@@ -909,1330 +327,17 @@ function validateListAllInput(input, keys, methodName) {
     // each request revalidates the threaded cursor/filter set before dispatch.
     validateQueryInput(input, keys, methodName);
 }
+function withEnvelopeMetadata(value, meta) {
+    return (0, response_metadata_js_1.withResponseMetadata)(value, (0, client_errors_js_1.boundedErrorIdentifier)(meta?.request_id));
+}
 function pageFromMeta(out, meta) {
-    return {
+    return withEnvelopeMetadata({
         ...out,
         next_cursor: meta?.next_cursor,
         has_more: meta?.has_more ?? Boolean(meta?.next_cursor),
         request_id: meta?.request_id,
         page_size: meta?.page_size,
-    };
-}
-// Best-effort defence-in-depth against today's access-token grammar. The
-// service remains authoritative because resource IDs and credentials are both
-// opaque and future credential formats may not retain the `at_` prefix. The
-// delimiter requirement cannot collide with current base64url public keys,
-// standard-base64 keys, or base32 CRIDs.
-const PATH_EMBEDDED_ACCESS_TOKEN_RE = /[?&#=:\s]at_/i;
-const PATH_PREFIXED_ACCESS_TOKEN_RE = /\/at_/i;
-const QURL_LINK_URL_RE = /^(?:https?:\/\/)?(?:[a-z0-9-]+\.)*qurl\.link(?::\d{1,5})?(?:\/|[?#])/i;
-// ponytail: today's 22-character token suffix only improves URL-paste diagnostics;
-// other lengths are still rejected as URLs without echoing the input.
-const URL_EMBEDDED_ACCESS_TOKEN_RE = /[?&#=:/]at_[a-z0-9_-]{22}(?:$|[?&#:/])/i;
-// A host without a slash can be a legitimate domain identifier. Require the
-// path boundary so shared validation does not break the domain namespace.
-const PATH_SCHEMELESS_URL_RE = /^[a-z0-9-]+(?:\.[a-z0-9-]+)+(?::\d{1,5})?\//i;
-const QURL_DISPLAY_ID_PREFIX_RE = /^q_/i;
-const MAX_PATH_ID_DECODE_PASSES = 3;
-const MAX_PATH_ID_LENGTH = 4096;
-function isUrlLikePathId(value) {
-    return /^https?:\/\//i.test(value) || PATH_SCHEMELESS_URL_RE.test(value);
-}
-const REVOKE_INDIVIDUAL_QURL_RECOVERY = "revoke individual tokens with revokeResourceQurl(crid, qurlId)";
-const DELETE_RESOURCE_RECOVERY = "pass a CRID returned by the API; to revoke one qURL, call revokeResourceQurl(crid, qurlId)";
-const RESOURCE_OR_QURL_ID_PATH_OPTIONS = {
-    requireCridUnlessQurlDisplayId: true,
-};
-const QURL_ID_PATH_OPTIONS = {
-    rejectBareAccessToken: true,
-    accessTokenRecovery: "pass the qURL display ID, not its access token",
-};
-/**
- * Validates that a path-parameter argument is a non-empty string. Some callers
- * pass resource/qURL display IDs, while newer endpoints also pass domains,
- * session IDs, webhook IDs, and API-key IDs, so this intentionally enforces
- * only basic shape plus transport-safety rules and leaves endpoint-specific
- * identifier grammar to the service.
- */
-function validatePathId(id, method, field = "id", options = {}) {
-    if (options.requireCridUnlessQurlDisplayId && typeof id === "string" && !id.startsWith("q_")) {
-        requireResourceCrid(id, method, field);
-        return;
-    }
-    // `.trim()` catches whitespace-only and padded IDs before they round-trip as
-    // `%20...%20` paths that the server can only reject with a less useful 404.
-    // The pre-flight error is more actionable than the 404.
-    if (typeof id !== "string") {
-        const observedType = id === null ? "null" : typeof id;
-        throw clientValidationError(`${method}: ${field} is required (got ${observedType})`);
-    }
-    if (id.trim() === "") {
-        throw clientValidationError(`${method}: ${field} is required`);
-    }
-    if (id.trim() !== id) {
-        throw clientValidationError(`${method}: ${field} must not include leading or trailing whitespace`);
-    }
-    if (id.length > MAX_PATH_ID_LENGTH) {
-        throw clientValidationError(`${method}: ${field} must be ${MAX_PATH_ID_LENGTH} characters or fewer`);
-    }
-    const decodedIds = decodedPathIdForms(id);
-    // URL resolvers and intermediaries can normalize raw or pre-encoded dot
-    // segments before routing. Reject every decoded form we inspected so an
-    // item operation cannot be retargeted to a collection endpoint. Embedded
-    // `a/../b` remains an opaque single segment because the later URL builder
-    // percent-encodes its slash.
-    if (decodedIds.some((value) => value === "." || value === "..")) {
-        throw clientValidationError(`${method}: ${field} is an invalid URL path segment`);
-    }
-    // `/` is deliberately outside the general delimiter class so a URL path
-    // such as `/at_a_glance` is not misread as a credential. For non-URL input,
-    // `/at_` remains a strong pasted-path signal. Fragment, query, header, and
-    // pasted `Bearer at_...` / `token:at_...` forms are also strong signals.
-    // Bare `at_...` values are rejected only for resource/qURL identifiers:
-    // those current formats have fixed non-colliding prefixes, while domain,
-    // webhook, session, and API-key IDs are deliberately opaque/open contracts.
-    // Full URLs and delimiter/path-prefixed credentials remain rejected in
-    // every namespace.
-    const containsUrl = decodedIds.some(isUrlLikePathId);
-    const containsAccessToken = decodedIds.some((value) => {
-        const valueIsUrl = isUrlLikePathId(value);
-        return ((QURL_LINK_URL_RE.test(value) &&
-            (PATH_EMBEDDED_ACCESS_TOKEN_RE.test(value) || PATH_PREFIXED_ACCESS_TOKEN_RE.test(value))) ||
-            (valueIsUrl
-                ? URL_EMBEDDED_ACCESS_TOKEN_RE.test(value)
-                : PATH_EMBEDDED_ACCESS_TOKEN_RE.test(value) || PATH_PREFIXED_ACCESS_TOKEN_RE.test(value)) ||
-            (options.rejectBareAccessToken === true && value.slice(0, 3).toLowerCase() === "at_"));
-    });
-    if (containsAccessToken) {
-        const recovery = options.accessTokenRecovery ?? "pass the identifier returned by the API";
-        throw clientValidationError(`${method}: ${field} must not contain an access token; ${recovery}`);
-    }
-    // A full target/qURL is a common argument mix-up, but it is distinct from
-    // passing an access-token credential. Diagnose it accurately without
-    // echoing the URL, which may itself contain sensitive query parameters.
-    if (containsUrl) {
-        throw clientValidationError(`${method}: ${field} must be an identifier, not a URL`);
-    }
-    if (options.rejectQurlDisplayId === true &&
-        decodedIds.some((value) => QURL_DISPLAY_ID_PREFIX_RE.test(value))) {
-        throw clientValidationError(`${method}: ${field} must not be a qURL display ID; ${REVOKE_INDIVIDUAL_QURL_RECOVERY}`);
-    }
-}
-function decodedPathIdForms(id) {
-    // Probe repeatedly encoded input too. Callers sometimes pre-encode a copied
-    // link before passing it through a URL builder that encodes it again. Three
-    // passes cover the common accidental cases without allowing hostile input
-    // to create unbounded work. More deeply encoded or malformed-percent input
-    // deliberately fails open to the authoritative service after safe segment
-    // encoding; this heuristic is not an identifier parser.
-    const decodedIds = [id];
-    let decodedId = id;
-    for (let pass = 0; pass < MAX_PATH_ID_DECODE_PASSES; pass += 1) {
-        try {
-            const next = decodeURIComponent(decodedId);
-            if (next === decodedId)
-                break;
-            decodedIds.push(next);
-            decodedId = next;
-        }
-        catch {
-            // Malformed percent escapes remain opaque and are left to the service.
-            break;
-        }
-    }
-    return decodedIds;
-}
-function requireConnectorSlug(slug, method) {
-    if (typeof slug !== "string" || !CONNECTOR_SLUG_PATTERN.test(slug)) {
-        throw clientValidationError(`${method}: slug must be 3-64 lowercase alphanumeric or hyphen characters, start with a letter, and end alphanumeric`);
-    }
-}
-function classifyConnectorMutationFailure(operation, error) {
-    if (!(error instanceof errors_js_1.QURLError)) {
-        throw new errors_js_1.ConnectorResourceOutcomeUnknownError(new errors_js_1.RuntimeError("Unexpected failure after Connector mutation dispatch", { cause: error }));
-    }
-    // Most authoritative 4xx responses prove that the mutation was rejected.
-    // bootstrap_key_consumed is the exception: the service returns it from the
-    // consume phase after the resource may have been bound or found.
-    // Callers perform argument/runtime preflight outside their mutation try
-    // blocks; every other surfaced failure therefore follows dispatch or a
-    // nominal success whose resource contract could not be consumed, so callers
-    // must reconcile before retrying. Ensure's exact 201 + valid resource but
-    // missing found_existing is handled after this classifier: the row proves
-    // the selected resource, while only its required metadata is unavailable.
-    if (operation === "ensure" && error.status === 409 && error.code === "bootstrap_key_consumed") {
-        throw new errors_js_1.ConnectorResourceOutcomeUnknownError(error);
-    }
-    if (error.status >= 400 && error.status < 500) {
-        throw error;
-    }
-    throw new errors_js_1.ConnectorResourceOutcomeUnknownError(error);
-}
-function decodeCanonicalBase64Url(value) {
-    if (!CONNECTOR_RESOURCE_ID_PATTERN.test(value) ||
-        !value.startsWith(CONNECTOR_RESOURCE_ID_DER_PREFIX)) {
-        return undefined;
-    }
-    try {
-        const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "==";
-        const binary = atob(padded);
-        const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
-        const canonical = btoa(String.fromCharCode(...bytes))
-            .replace(/\+/g, "-")
-            .replace(/\//g, "_")
-            .replace(/=+$/, "");
-        return canonical === value ? bytes : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function requireConnectorSubtleCrypto(method) {
-    if (!globalThis.crypto?.subtle) {
-        throw new errors_js_1.RuntimeError(`${method}: requires the Web Crypto SubtleCrypto API`);
-    }
-}
-function requireResourceCrid(crid, method, field = "id") {
-    if ((0, crid_js_1.parseCrid)(crid))
-        return;
-    // Keep actionable paste errors without inspecting valid CRIDs twice.
-    validatePathId(crid, method, field, {
-        rejectBareAccessToken: true,
-        rejectQurlDisplayId: true,
-        accessTokenRecovery: method === "delete" || method === "deleteResource"
-            ? DELETE_RESOURCE_RECOVERY
-            : "pass a CRID returned by the API",
-    });
-    throw clientValidationError(`${method}: requires a valid CRID`);
-}
-async function importsAsConnectorPublicKey(der) {
-    try {
-        const keyData = new ArrayBuffer(der.byteLength);
-        new Uint8Array(keyData).set(der);
-        await globalThis.crypto.subtle.importKey("spki", keyData, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function containsControlCharacter(value) {
-    return Array.from(value).some((character) => {
-        const codePoint = character.codePointAt(0);
-        return codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f);
-    });
-}
-async function verifyResourceIdentity(resource, method, expectedCrid) {
-    if (!resource || typeof resource.resource_id !== "string") {
-        throw unexpectedResponseError(`${method}: response has missing or invalid resource_id`);
-    }
-    const resourceKey = decodeCanonicalBase64Url(resource.resource_id);
-    requireConnectorSubtleCrypto(method);
-    if (!resourceKey || !(await importsAsConnectorPublicKey(resourceKey))) {
-        throw unexpectedResponseError(`${method}: response has missing or invalid resource_id`);
-    }
-    if (expectedCrid !== undefined && resource.crid !== expectedCrid) {
-        throw unexpectedResponseError(`${method}: response crid does not match the request`);
-    }
-    if (!(await (0, crid_js_1.cridKeyMatches)(resource.crid, resourceKey))) {
-        throw unexpectedResponseError(`${method}: response has missing, invalid, or public-key-mismatched crid`);
-    }
-}
-async function parseConnectorResource(client, value, method, expectation = {}) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw unexpectedResponseError(`${method}: response is missing connector resource data`);
-    }
-    const resource = value;
-    await verifyResourceIdentity(resource, method, expectation.crid);
-    if (typeof resource.connector_routing_id !== "string" ||
-        !CONNECTOR_ROUTING_ID_PATTERN.test(resource.connector_routing_id)) {
-        throw unexpectedResponseError(`${method}: response has missing or invalid connector_routing_id`);
-    }
-    if (typeof resource.knock_resource_id !== "string" ||
-        resource.knock_resource_id.trim() === "" ||
-        resource.knock_resource_id.trim() !== resource.knock_resource_id ||
-        containsControlCharacter(resource.knock_resource_id)) {
-        throw unexpectedResponseError(`${method}: response has missing or invalid knock_resource_id`);
-    }
-    if (resource.resource_id === resource.knock_resource_id ||
-        resource.connector_routing_id === resource.knock_resource_id) {
-        throw unexpectedResponseError(`${method}: response cross-wires resource identity, routing, and admission values`);
-    }
-    if (resource.type !== "tunnel") {
-        throw unexpectedResponseError(`${method}: response resource type is not tunnel`);
-    }
-    if (typeof resource.slug !== "string" || !CONNECTOR_SLUG_PATTERN.test(resource.slug)) {
-        throw unexpectedResponseError(`${method}: response has missing or invalid slug`);
-    }
-    if (expectation.slug !== undefined && resource.slug !== expectation.slug) {
-        throw unexpectedResponseError(`${method}: response slug does not match the request`);
-    }
-    if (resource.alias !== undefined &&
-        resource.alias !== null &&
-        (typeof resource.alias !== "string" || !CONNECTOR_ALIAS_PATTERN.test(resource.alias))) {
-        // The public API intentionally gives mutable aliases and immutable slugs the
-        // same canonical wire grammar (domain aliasPattern/slugPattern). Keeping
-        // response validation aligned avoids accepting a row the service itself
-        // could not create or update.
-        throw unexpectedResponseError(`${method}: response has invalid alias`);
-    }
-    if (resource.status === "revoked") {
-        if (expectation.revokedIsLifecycleError !== true) {
-            throw unexpectedResponseError(`${method}: active-only operation returned a revoked connector resource`);
-        }
-        throw new errors_js_1.QURLError({
-            status: 0,
-            code: errors_js_1.ERROR_CODE_CONNECTOR_RESOURCE_REVOKED,
-            title: "Connector Resource Revoked",
-            detail: `${method}: qURL Connector resource is revoked`,
-        });
-    }
-    if (resource.status !== "active") {
-        throw unexpectedResponseError(`${method}: response has invalid resource status`);
-    }
-    return new ConnectorResource(client, resource, CONNECTOR_RESOURCE_CONSTRUCTOR_TOKEN);
-}
-function requireValidTags(tags) {
-    // null tolerance for untyped-JS callers — treated as "don't touch."
-    // Duplicates pass through to the server (authoritative on dedupe policy).
-    if (tags === undefined || tags === null)
-        return;
-    if (!Array.isArray(tags)) {
-        throw clientValidationError(`tags: must be an array of strings (got ${typeof tags})`);
-    }
-    if (tags.length > MAX_TAGS) {
-        throw clientValidationError(`tags: max ${MAX_TAGS} items allowed (got ${tags.length})`);
-    }
-    const errors = [];
-    for (let i = 0; i < tags.length; i++) {
-        const tag = tags[i];
-        // Per-element type guard for untyped-JS callers. Without this, a
-        // non-string element would silently pass (`.length` on a number is
-        // `undefined`; `TAG_PATTERN.test(42)` coerces to `"42"`) or TypeError
-        // (`null.length`).
-        if (typeof tag !== "string") {
-            errors.push(`tags[${i}]: must be a string (got ${tag === null ? "null" : typeof tag})`);
-            continue;
-        }
-        if (tag.length < 1 || tag.length > MAX_TAG_LENGTH) {
-            errors.push(`tags[${i}]: must be 1-${MAX_TAG_LENGTH} characters (got ${tag.length})`);
-            continue;
-        }
-        if (!TAG_PATTERN.test(tag)) {
-            errors.push(`tags[${i}]: must start with an alphanumeric and contain only letters, numbers, spaces, underscores, or hyphens`);
-        }
-    }
-    if (errors.length > 0) {
-        throw clientValidationError(errors.join("; "));
-    }
-}
-function describeShape(value) {
-    if (value === null)
-        return "null";
-    if (Array.isArray(value))
-        return "array";
-    return typeof value;
-}
-const ACCESS_POLICY_LIST_FIELDS = [
-    "ip_allowlist",
-    "ip_denylist",
-    "geo_allowlist",
-    "geo_denylist",
-];
-const ACCESS_POLICY_STRING_FIELDS = [
-    "user_agent_allow_regex",
-    "user_agent_deny_regex",
-];
-const AI_AGENT_POLICY_LIST_FIELDS = [
-    "deny_categories",
-    "allow_categories",
-];
-function requireValidAccessPolicy(policy) {
-    // null/undefined → "don't touch". Server is authoritative on CIDR /
-    // ISO-3166 / regex grammar; this guard catches only the shape errors
-    // an untyped-JS caller is likely to make (e.g. `geo_allowlist: "US"`
-    // instead of `["US"]`) so they get a structured ValidationError
-    // instead of a server 400 they have to debug.
-    if (policy === undefined || policy === null)
-        return;
-    if (typeof policy !== "object" || Array.isArray(policy)) {
-        throw clientValidationError(`access_policy: must be an object (got ${describeShape(policy)})`);
-    }
-    for (const field of ACCESS_POLICY_LIST_FIELDS) {
-        const value = policy[field];
-        if (value === undefined)
-            continue;
-        if (!Array.isArray(value)) {
-            throw clientValidationError(`access_policy.${field}: must be an array (got ${describeShape(value)})`);
-        }
-    }
-    for (const field of ACCESS_POLICY_STRING_FIELDS) {
-        const value = policy[field];
-        if (value === undefined)
-            continue;
-        if (typeof value !== "string") {
-            throw clientValidationError(`access_policy.${field}: must be a string (got ${describeShape(value)})`);
-        }
-    }
-    const aip = policy.ai_agent_policy;
-    if (aip !== undefined) {
-        if (aip === null || typeof aip !== "object" || Array.isArray(aip)) {
-            throw clientValidationError(`access_policy.ai_agent_policy: must be an object (got ${describeShape(aip)})`);
-        }
-        if (aip.block_all !== undefined && typeof aip.block_all !== "boolean") {
-            throw clientValidationError(`access_policy.ai_agent_policy.block_all: must be a boolean (got ${describeShape(aip.block_all)})`);
-        }
-        for (const field of AI_AGENT_POLICY_LIST_FIELDS) {
-            const value = aip[field];
-            if (value === undefined)
-                continue;
-            if (!Array.isArray(value)) {
-                throw clientValidationError(`access_policy.ai_agent_policy.${field}: must be an array (got ${describeShape(value)})`);
-            }
-        }
-    }
-}
-function validateCreateDelegatedQurlBatchInput(input) {
-    if (typeof input !== "object" || input === null || Array.isArray(input)) {
-        throw clientValidationError(`createDelegatedQurlBatch: input must be an object (got ${describeShape(input)})`);
-    }
-    const typed = input;
-    requireNoUnknownFields(typed, DELEGATED_BATCH_INPUT_KEYS, "createDelegatedQurlBatch");
-    if (typeof typed.mint_capability !== "string" ||
-        typed.mint_capability.length < 1 ||
-        typed.mint_capability.length > MAX_DELEGATED_MINT_CAPABILITY) {
-        throw clientValidationError(`createDelegatedQurlBatch: mint_capability must be a string of 1-${MAX_DELEGATED_MINT_CAPABILITY} characters`);
-    }
-    if (!Array.isArray(typed.grants) ||
-        typed.grants.length < 1 ||
-        typed.grants.length > MAX_DELEGATED_BATCH_ITEMS) {
-        throw clientValidationError(`createDelegatedQurlBatch: grants must contain 1-${MAX_DELEGATED_BATCH_ITEMS} items`);
-    }
-    for (const [index, grant] of typed.grants.entries()) {
-        const field = `createDelegatedQurlBatch: grants[${index}]`;
-        if (typeof grant !== "object" || grant === null || Array.isArray(grant)) {
-            throw clientValidationError(`${field}: must be an object (got ${describeShape(grant)})`);
-        }
-        requireNoUnknownFields(grant, DELEGATED_BATCH_GRANT_KEYS, field);
-        requireMaxUtf8Bytes(grant.label, `${field}.label`, MAX_LABEL);
-        requireBooleanIfPresent(grant.one_time_use, `${field}.one_time_use`);
-        requireMaxSessionsInRange(grant.max_sessions, `${field}.max_sessions`);
-        for (const durationField of ["expires_in", "session_duration"]) {
-            const value = grant[durationField];
-            if (value !== undefined && (typeof value !== "string" || value.length === 0)) {
-                throw clientValidationError(`${field}.${durationField}: must be a non-empty string`);
-            }
-        }
-        if (grant.access_policy !== undefined) {
-            requireValidAccessPolicy(grant.access_policy);
-        }
-    }
-}
-function validateDelegatedBatchCreateOptions(options) {
-    if (typeof options !== "object" || options === null || Array.isArray(options)) {
-        throw clientValidationError("createDelegatedQurlBatch: options are required");
-    }
-    requireNoUnknownFields(options, DELEGATED_BATCH_CREATE_OPTION_KEYS, "createDelegatedQurlBatch options");
-    const key = options.idempotencyKey;
-    if (typeof key !== "string" ||
-        key.length < MIN_DELEGATED_BATCH_IDEMPOTENCY_KEY ||
-        key.length > MAX_IDEMPOTENCY_KEY ||
-        !/^[!-~]+$/.test(key)) {
-        throw clientValidationError(`createDelegatedQurlBatch: idempotencyKey must contain ${MIN_DELEGATED_BATCH_IDEMPOTENCY_KEY}-${MAX_IDEMPOTENCY_KEY} visible ASCII characters`);
-    }
-}
-function validateGetDelegatedQurlBatchOptions(options) {
-    if (options === undefined)
-        return;
-    if (typeof options !== "object" || options === null || Array.isArray(options)) {
-        throw clientValidationError(`getDelegatedQurlBatch: options must be an object (got ${describeShape(options)})`);
-    }
-    requireNoUnknownFields(options, DELEGATED_BATCH_GET_OPTION_KEYS, "getDelegatedQurlBatch options");
-    const etag = options.etag;
-    if (etag !== undefined &&
-        (typeof etag !== "string" ||
-            etag.length > MAX_DELEGATED_ETAG ||
-            !STRONG_ETAG_PATTERN.test(etag))) {
-        throw clientValidationError("getDelegatedQurlBatch: etag must be a valid strong ETag");
-    }
-}
-function delegatedResponseError(status, detail, requestId) {
-    return unexpectedResponseError(`Delegated qURL batch ${detail}`, { status, requestId });
-}
-function delegatedResponseObject(value, status, label, requestId) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw delegatedResponseError(status, `${label} is not an object`, requestId);
-    }
-    return value;
-}
-function delegatedEnvelope(envelope, status) {
-    if (typeof envelope.meta !== "object" || envelope.meta === null || Array.isArray(envelope.meta)) {
-        throw delegatedResponseError(status, "response meta is not an object");
-    }
-    const meta = envelope.meta;
-    if (typeof meta.request_id !== "string") {
-        throw delegatedResponseError(status, "response meta has invalid request_id");
-    }
-    const data = delegatedResponseObject(envelope.data, status, "response data", meta.request_id);
-    return { data, requestId: meta.request_id };
-}
-function requiredDelegatedHeader(envelope, name, status, requestId) {
-    const headers = envelope.__http_headers;
-    if (!headers || typeof headers.get !== "function") {
-        throw delegatedResponseError(status, "response headers are unavailable", requestId);
-    }
-    const value = headers.get(name);
-    if (value === null) {
-        throw delegatedResponseError(status, `response is missing ${name}`, requestId);
-    }
-    return value;
-}
-function hasDelegatedNoStore(value) {
-    if (value === null)
-        return false;
-    const directives = new Set(value.split(",").map((directive) => directive.trim().split("=", 1)[0].toLowerCase()));
-    return directives.has("private") && directives.has("no-store");
-}
-function delegatedResponseHeaders(envelope, status, requestId) {
-    const cacheControl = envelope.__http_headers?.get("Cache-Control") ?? null;
-    if (cacheControl !== null) {
-        if (!hasDelegatedNoStore(cacheControl)) {
-            throw delegatedResponseError(status, "response has invalid Cache-Control", requestId);
-        }
-    }
-    else if (status !== 304) {
-        requiredDelegatedHeader(envelope, "Cache-Control", status, requestId);
-    }
-    const etag = envelope.__http_headers?.get("ETag") ?? undefined;
-    if (etag !== undefined && (etag.length > MAX_DELEGATED_ETAG || !STRONG_ETAG_PATTERN.test(etag))) {
-        throw delegatedResponseError(status, "response has invalid strong ETag", requestId);
-    }
-    const rawRetryAfter = envelope.__http_headers?.get("Retry-After") ?? "";
-    const trimmed = rawRetryAfter.trim();
-    const seconds = /^\d+$/.test(trimmed)
-        ? Number(trimmed)
-        : /^[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/.test(trimmed)
-            ? Math.ceil((Date.parse(trimmed) - Date.now()) / 1000)
-            : NaN;
-    const retryAfter = Number.isSafeInteger(seconds) && seconds > 0 && seconds <= RETRY_AFTER_PARSE_LIMIT_S
-        ? seconds
-        : undefined;
-    return { etag, retryAfter };
-}
-function isUtcTimestamp(value) {
-    return (typeof value === "string" &&
-        UTC_TIMESTAMP_PATTERN.test(value) &&
-        Number.isFinite(Date.parse(value)));
-}
-function delegatedBatchBase(data, status, requestId, expectedBatchId) {
-    if (typeof data.batch_id !== "string" ||
-        !DELEGATED_BATCH_ID_PATTERN.test(data.batch_id) ||
-        (expectedBatchId !== undefined && data.batch_id !== expectedBatchId)) {
-        throw delegatedResponseError(status, "response has invalid batch_id", requestId);
-    }
-    if (!Number.isInteger(data.item_count) ||
-        Number(data.item_count) < 1 ||
-        Number(data.item_count) > MAX_DELEGATED_BATCH_ITEMS) {
-        throw delegatedResponseError(status, "response has invalid item_count", requestId);
-    }
-    if (!isUtcTimestamp(data.submitted_at)) {
-        throw delegatedResponseError(status, "response has invalid submitted_at", requestId);
-    }
-    return {
-        batchId: data.batch_id,
-        itemCount: Number(data.item_count),
-        submittedAt: data.submitted_at,
-    };
-}
-function validateDelegatedLocation(value, baseUrl, batchId, status, requestId) {
-    let location;
-    try {
-        const base = new URL(`${baseUrl}/`);
-        const relative = value.startsWith("/v1/delegated-qurl-batches/")
-            ? `${base.pathname.replace(/\/$/, "")}${value}`
-            : value;
-        location = new URL(relative, base);
-    }
-    catch {
-        throw delegatedResponseError(status, "response has invalid Location", requestId);
-    }
-    const expected = new URL(`${baseUrl}/v1/delegated-qurl-batches/${batchId}`);
-    if (location.username !== "" ||
-        location.password !== "" ||
-        location.search !== "" ||
-        location.hash !== "" ||
-        location.href !== expected.href) {
-        throw delegatedResponseError(status, "response has invalid Location", requestId);
-    }
-    return location.href;
-}
-function validateDelegatedQurlLink(value) {
-    if (typeof value !== "string")
-        return false;
-    try {
-        const link = new URL(value);
-        return (link.protocol === "https:" &&
-            link.username === "" &&
-            link.password === "" &&
-            link.hash.length > 1);
-    }
-    catch {
-        return false;
-    }
-}
-function validateDelegatedQurl(value, expectedQurlId, status, requestId) {
-    const data = delegatedResponseObject(value, status, "response data", requestId);
-    if (data.qurl_id !== expectedQurlId) {
-        throw delegatedResponseError(status, "response has invalid qurl_id", requestId);
-    }
-    if (data.status !== "active" &&
-        data.status !== "consumed" &&
-        data.status !== "expired" &&
-        data.status !== "revoked") {
-        throw delegatedResponseError(status, "response has invalid status", requestId);
-    }
-    if (!isUtcTimestamp(data.expires_at) ||
-        typeof data.one_time_use !== "boolean" ||
-        !Number.isInteger(data.max_sessions) ||
-        Number(data.max_sessions) < 0 ||
-        !Number.isInteger(data.session_duration) ||
-        Number(data.session_duration) <= 0 ||
-        (data.label !== undefined && typeof data.label !== "string") ||
-        (data.access_policy !== undefined &&
-            (typeof data.access_policy !== "object" ||
-                data.access_policy === null ||
-                Array.isArray(data.access_policy)))) {
-        throw delegatedResponseError(status, "response has invalid qURL metadata", requestId);
-    }
-    return { ...data, request_id: requestId };
-}
-function validateDelegatedBatchResults(value, itemCount, batchStatus, status, requestId) {
-    if (!Array.isArray(value) || value.length !== itemCount) {
-        throw delegatedResponseError(status, "terminal response has invalid results", requestId);
-    }
-    let succeeded = 0;
-    const qurlIds = new Set();
-    const links = new Set();
-    const results = value.map((raw, index) => {
-        const item = delegatedResponseObject(raw, status, `result ${index}`, requestId);
-        if (item.index !== index) {
-            throw delegatedResponseError(status, `result ${index} has invalid index`, requestId);
-        }
-        if (item.status === "succeeded") {
-            if (item.error !== undefined && item.error !== null) {
-                throw delegatedResponseError(status, `result ${index} has conflicting fields`, requestId);
-            }
-            const qurl = delegatedResponseObject(item.qurl, status, `result ${index} qurl`, requestId);
-            if (typeof qurl.qurl_id !== "string" ||
-                !DELEGATED_QURL_ID_PATTERN.test(qurl.qurl_id) ||
-                !validateDelegatedQurlLink(qurl.qurl_link) ||
-                !isUtcTimestamp(qurl.expires_at) ||
-                qurlIds.has(qurl.qurl_id) ||
-                links.has(qurl.qurl_link)) {
-                throw delegatedResponseError(status, `result ${index} has invalid qurl`, requestId);
-            }
-            qurlIds.add(qurl.qurl_id);
-            links.add(qurl.qurl_link);
-            succeeded++;
-            return {
-                index,
-                status: "succeeded",
-                qurl: {
-                    qurl_id: qurl.qurl_id,
-                    qurl_link: qurl.qurl_link,
-                    expires_at: qurl.expires_at,
-                },
-            };
-        }
-        if (item.status !== "failed" || (item.qurl !== undefined && item.qurl !== null)) {
-            throw delegatedResponseError(status, `result ${index} has invalid status`, requestId);
-        }
-        const error = delegatedResponseObject(item.error, status, `result ${index} error`, requestId);
-        if (typeof error.code !== "string" ||
-            error.code.length === 0 ||
-            typeof error.message !== "string") {
-            throw delegatedResponseError(status, `result ${index} has invalid error`, requestId);
-        }
-        return {
-            index,
-            status: "failed",
-            error: { code: error.code, message: error.message },
-        };
-    });
-    if ((batchStatus === "succeeded" && succeeded !== itemCount) ||
-        (batchStatus === "failed" && succeeded !== 0) ||
-        (batchStatus === "partially_failed" && (succeeded === 0 || succeeded === itemCount))) {
-        throw delegatedResponseError(status, "terminal status does not match results", requestId);
-    }
-    return results;
-}
-function classifyDelegatedBatchCreateFailure(error, batchId) {
-    if (!(error instanceof errors_js_1.QURLError)) {
-        throw new errors_js_1.DelegatedBatchOutcomeUnknownError(new errors_js_1.RuntimeError("Unexpected failure after delegated batch dispatch", { cause: error }), batchId);
-    }
-    if ((error.status >= 400 && error.status < 500 && error.status !== 408) || error.status === 501) {
-        throw error;
-    }
-    throw new errors_js_1.DelegatedBatchOutcomeUnknownError(error, batchId);
-}
-// `format: uri` in the OpenAPI spec allows schemes the SDK doesn't
-// usefully support (`ftp://`, `file://`, `javascript:`, …). This is a
-// cheap client-side sanity check — the server is still the
-// authoritative validator (e.g. it rejects localhost, cloud metadata,
-// and private-range hosts; the SDK doesn't need to duplicate that).
-const ALLOWED_URL_SCHEMES = ["http://", "https://"];
-function requireValidHttpUrl(value, field) {
-    // Three checks in priority order: type guard, scheme, length.
-    // Stop at the first failure so a non-string URL doesn't
-    // produce both "must be a string" AND "must be ≤ 2048 characters"
-    // (the length check on a non-string would also typeof-fail and
-    // duplicate the type message). The collect-all loop in
-    // validateCreateInput runs each FIELD's validator independently — within
-    // a single URL field itself we want fail-fast.
-    if (typeof value !== "string") {
-        throw clientValidationError(`${field}: must be a string (got ${value === null ? "null" : typeof value})`);
-    }
-    if (!ALLOWED_URL_SCHEMES.some((scheme) => value.startsWith(scheme))) {
-        // Truncate to keep the error message compact and avoid
-        // pathologically long schemes from filling logs.
-        const repr = JSON.stringify(value).slice(0, 40);
-        throw clientValidationError(`${field}: must start with http:// or https:// (got ${repr})`);
-    }
-    if (value.length > MAX_TARGET_URL) {
-        throw clientValidationError(`${field}: must be ${MAX_TARGET_URL} characters or fewer (got ${value.length})`);
-    }
-}
-function requireValidTargetUrl(target_url) {
-    requireValidHttpUrl(target_url, "target_url");
-}
-function validateCreateInput(input) {
-    // Untyped-JS guard: surface as ValidationError instead of raw TypeError.
-    if (typeof input !== "object" || input === null) {
-        throw clientValidationError(`create: input must be an object (got ${input === null ? "null" : typeof input})`);
-    }
-    // Collect-all: run every validator and aggregate the messages so a
-    // caller fixing multiple bad fields sees them all at once instead
-    // of fix-re-run-repeat. Matches the documented batchCreate UX
-    // ("All failures are collected into a single ValidationError")
-    // and mirrors the requireValidTags collect-all pattern.
-    const errors = [];
-    const collect = (fn) => {
-        try {
-            fn();
-        }
-        catch (err) {
-            if (err instanceof errors_js_1.ValidationError) {
-                errors.push(err.detail);
-                return;
-            }
-            throw err;
-        }
-    };
-    collect(() => requireNoUnknownFields(input, CREATE_FIELD_KEYS, "create"));
-    const resourceType = input.type;
-    if (resourceType !== undefined && typeof resourceType !== "string") {
-        errors.push(`type: must be a string (got ${resourceType === null ? "null" : typeof resourceType})`);
-    }
-    collect(() => {
-        if (input.target_url === undefined) {
-            if (resourceType === undefined || resourceType === "url") {
-                throw clientValidationError("target_url: is required for url qURLs");
-            }
-            return;
-        }
-        requireValidTargetUrl(input.target_url);
-    });
-    collect(() => requireMaxLength(input.label, "label", MAX_LABEL));
-    collect(() => requireNonEmptyIfPresent(input.label, "label"));
-    collect(() => requireMaxLength(input.custom_domain, "custom_domain", MAX_CUSTOM_DOMAIN));
-    collect(() => requireNonEmptyIfPresent(input.custom_domain, "custom_domain"));
-    collect(() => requireBooleanIfPresent(input.private, "private"));
-    collect(() => requireBooleanIfPresent(input.one_time_use, "one_time_use"));
-    collect(() => requireMaxSessionsInRange(input.max_sessions));
-    collect(() => requireNonEmptyIfPresent(input.expires_in, "expires_in"));
-    collect(() => requireNonEmptyIfPresent(input.session_duration, "session_duration"));
-    collect(() => requireValidAccessPolicy(input.access_policy));
-    if (errors.length > 0) {
-        // Inner `; ` is contractual (paired with batchCreate's outer ` | `).
-        // Future field-level validators must not aggregate via `; ` internally.
-        throw clientValidationError(errors.join("; "));
-    }
-    // Intentional omission: duration *grammar* (`expires_in`,
-    // `session_duration`) is server-authoritative. Empty strings are
-    // rejected up front (see collect() calls above) but unit/whitespace
-    // edge cases ("24hh", "1w 3d") surface as a clean server 400 — a
-    // client-side regex would just create a drift surface against the
-    // server's rego/duration parser.
-    //
-    // `access_policy` contents (CIDRs, ISO-3166 codes, regex patterns)
-    // are pass-through for the same reason. The shape-guard above only
-    // catches structural mistakes (string-instead-of-array on list fields)
-    // an untyped-JS caller is likely to make.
-}
-function validateQurlTokenOptions(input) {
-    if (input === undefined)
-        return;
-    requireMaxLength(input.label, "label", MAX_LABEL);
-    requireNonEmptyIfPresent(input.label, "label");
-    requireNonEmptyIfPresent(input.expires_in, "expires_in");
-    requireNonEmptyIfPresent(input.session_duration, "session_duration");
-    // Mirror the service-documented size cap, but keep host-safety grammar
-    // (single leading slash, no scheme/host/backslash/etc.) and the tunnel-only
-    // gate server-authoritative (`invalid_target_path`); a client-side regex
-    // would create a drift surface. Keep max-before-empty consistent with label;
-    // empty strings pass the length check and are rejected by the next guard.
-    requireMaxUtf8Bytes(input.target_path, "target_path", MAX_TARGET_PATH);
-    requireNonEmptyIfPresent(input.target_path, "target_path");
-    requireBooleanIfPresent(input.one_time_use, "one_time_use");
-    requireMaxSessionsInRange(input.max_sessions);
-    requireValidAccessPolicy(input.access_policy);
-}
-function validateResourceQurlUpdateInput(input) {
-    requireMaxLength(input.label, "label", MAX_LABEL);
-    requireNonEmptyIfPresent(input.label, "label");
-    requireNonEmptyIfPresent(input.extend_by, "extend_by");
-    requireNonEmptyIfPresent(input.expires_at, "expires_at");
-    requireNonEmptyIfPresent(input.session_duration, "session_duration");
-    requireMaxSessionsInRange(input.max_sessions);
-    requireValidAccessPolicy(input.access_policy);
-    if (input.extend_by !== undefined && input.expires_at !== undefined) {
-        throw clientValidationError("updateResourceQurl: `extend_by` and `expires_at` are mutually exclusive — provide at most one");
-    }
-}
-function requireObjectInput(input, method) {
-    if (typeof input !== "object" || input === null || Array.isArray(input)) {
-        throw clientValidationError(`${method}: input must be an object (got ${input === null ? "null" : typeof input})`);
-    }
-}
-function requireNonEmptyStringField(input, field, method) {
-    const value = input[field];
-    if (typeof value !== "string" || value.length === 0) {
-        throw clientValidationError(`${method}: ${field} must be a non-empty string`);
-    }
-}
-function requireNonEmptyArrayField(input, field, method) {
-    const value = input[field];
-    if (!Array.isArray(value) || value.length === 0) {
-        throw clientValidationError(`${method}: ${field} must be a non-empty array`);
-    }
-}
-function requireStringArrayElements(value, field, method) {
-    if (!Array.isArray(value)) {
-        throw clientValidationError(`${method}: ${field} must be a non-empty array`);
-    }
-    value.forEach((entry, index) => {
-        if (typeof entry !== "string" || entry.length === 0) {
-            throw clientValidationError(`${method}: ${field}[${index}] must be a non-empty string`);
-        }
-    });
-}
-function requireAtLeastOneField(input, fields, method) {
-    if (!fields.some((field) => input[field] !== undefined)) {
-        throw clientValidationError(`${method}: at least one field (${fields.join(", ")}) must be provided`);
-    }
-}
-function requireNoUnknownFields(input, fields, method) {
-    const unknown = Object.keys(input).filter((field) => !fields.includes(field));
-    if (unknown.length > 0) {
-        const rendered = unknown.map((field) => `"${field}"`).join(", ");
-        const label = unknown.length === 1 ? "unknown field" : "unknown fields";
-        throw clientValidationError(`${method}: ${label} ${rendered}`);
-    }
-}
-function normalizePatchFields(input, fields, options = {}) {
-    const preserveNull = new Set(options.preserveNullFields ?? []);
-    const normalized = {};
-    for (const key of fields) {
-        const value = input[key];
-        if (value !== undefined && (value !== null || preserveNull.has(key))) {
-            normalized[key] = value;
-        }
-    }
-    return normalized;
-}
-function requireConsumerDecision(id, version, allowNew = false) {
-    if (typeof id !== "string" ||
-        (!/^[a-f0-9]{64}$/.test(id) && !(allowNew && id === "new")) ||
-        !Number.isSafeInteger(version) ||
-        version < (allowNew ? 0 : 1))
-        throw clientValidationError("consumer decision: invalid id or expected version");
-}
-function validateResourceWriteFields(input, options = {}) {
-    const errors = [];
-    const collect = (fn) => {
-        try {
-            fn();
-        }
-        catch (err) {
-            if (err instanceof errors_js_1.ValidationError) {
-                errors.push(err.detail);
-                return;
-            }
-            throw err;
-        }
-    };
-    collect(() => {
-        if (input.private !== undefined && typeof input.private !== "boolean") {
-            throw clientValidationError("private: must be a boolean");
-        }
-        if (input.consumer_access !== undefined) {
-            const policy = input.consumer_access;
-            requireObjectInput(policy, "consumer_access");
-            const p = policy;
-            requireNoUnknownFields(p, ["mode", "version", "contract_id"], "consumer_access");
-            if (!["keys", "invite_only", "email_capture", "review", "contract"].includes(p.mode) ||
-                !Number.isSafeInteger(p.version) ||
-                p.version < 1) {
-                throw clientValidationError("consumer_access: invalid mode or version");
-            }
-            if (p.mode === "contract") {
-                if (typeof p.contract_id !== "string" ||
-                    !p.contract_id.trim() ||
-                    new TextEncoder().encode(p.contract_id).length > 128) {
-                    throw clientValidationError("consumer_access: contract mode requires a bounded contract_id");
-                }
-            }
-            else if (p.contract_id !== undefined) {
-                throw clientValidationError("consumer_access: contract_id requires contract mode");
-            }
-            if (input.private === false)
-                throw clientValidationError("consumer_access: requires a private resource");
-            if (options.requireUrlTarget) {
-                if (p.version !== 1 || input.private !== true)
-                    throw clientValidationError("consumer_access: creation requires private true and version one");
-            }
-            else if (options.allowAliasClear) {
-                const expected = input.expected_consumer_access_version;
-                if (!Number.isSafeInteger(expected) ||
-                    expected < 0 ||
-                    p.version !== expected + 1 ||
-                    Object.keys(input).some((key) => key !== "consumer_access" && key !== "expected_consumer_access_version")) {
-                    throw clientValidationError("consumer_access: update requires its expected version and no metadata changes");
-                }
-            }
-        }
-        else if (input.expected_consumer_access_version !== undefined) {
-            throw clientValidationError("expected_consumer_access_version: requires consumer_access");
-        }
-    });
-    collect(() => {
-        const fields = ["allowed_device_keys_add", "allowed_device_keys_remove"];
-        for (const field of fields) {
-            const keys = input[field];
-            if (keys === undefined)
-                continue;
-            requireStringArrayElements(keys, field, "updateResource");
-            if (keys.length > 256 || new Set(keys).size !== keys.length) {
-                throw clientValidationError(`${field}: must contain at most 256 unique keys`);
-            }
-            for (const key of keys) {
-                let canonical = false;
-                try {
-                    canonical = key.length === 44 && atob(key).length === 32 && btoa(atob(key)) === key;
-                }
-                catch {
-                    /* Invalid base64 is rejected below. */
-                }
-                if (!canonical) {
-                    throw clientValidationError(`${field}: keys must be canonical padded base64 of 32 bytes`);
-                }
-            }
-            if (input.custom_domain !== undefined) {
-                throw clientValidationError(`${field}: update separately from custom_domain`);
-            }
-        }
-        const added = new Set(input.allowed_device_keys_add);
-        if (input.allowed_device_keys_remove?.some((key) => added.has(key))) {
-            throw clientValidationError("allowed device key additions and removals must not overlap");
-        }
-    });
-    const resourceType = input.type;
-    if (resourceType !== undefined && typeof resourceType !== "string") {
-        errors.push(`type: must be a string (got ${resourceType === null ? "null" : typeof resourceType})`);
-    }
-    collect(() => {
-        if (input.target_url === undefined) {
-            if (options.requireUrlTarget && (resourceType === undefined || resourceType === "url")) {
-                throw clientValidationError("target_url: is required for url resources");
-            }
-            return;
-        }
-        requireValidTargetUrl(input.target_url);
-    });
-    collect(() => requireMaxLength(input.description, "description", MAX_DESCRIPTION));
-    collect(() => requireMaxLength(input.custom_domain, "custom_domain", MAX_CUSTOM_DOMAIN));
-    collect(() => {
-        if (options.allowCustomDomainClear && input.custom_domain === "")
-            return;
-        requireNonEmptyIfPresent(input.custom_domain, "custom_domain");
-    });
-    collect(() => requireValidTags(input.tags));
-    collect(() => {
-        if (input.alias !== undefined) {
-            if (input.alias === null) {
-                if (!options.allowAliasClear) {
-                    throw clientValidationError("alias: must be a string (got null)");
-                }
-            }
-            else {
-                requireMaxLength(input.alias, "alias", MAX_ALIAS);
-                requireNonEmptyIfPresent(input.alias, "alias");
-            }
-        }
-    });
-    collect(() => {
-        if (input.slug === undefined)
-            return;
-        requireMaxLength(input.slug, "slug", MAX_SLUG);
-        requireNonEmptyIfPresent(input.slug, "slug");
-    });
-    collect(() => {
-        if (options.validateFindOrCreate &&
-            input.find_or_create !== undefined &&
-            typeof input.find_or_create !== "boolean") {
-            throw clientValidationError(`find_or_create: must be a boolean (got ${describeShape(input.find_or_create)})`);
-        }
-    });
-    collect(() => {
-        if (options.validatePreserveHost &&
-            input.preserve_host !== undefined &&
-            typeof input.preserve_host !== "boolean") {
-            throw clientValidationError(`preserve_host: must be a boolean (got ${describeShape(input.preserve_host)})`);
-        }
-    });
-    if (errors.length > 0) {
-        throw clientValidationError(errors.join("; "));
-    }
-}
-function validateWebhookWriteFields(input, method, requiredFields = {}) {
-    if (requiredFields.url || input.url !== undefined) {
-        requireNonEmptyStringField(input, "url", method);
-        requireValidHttpUrl(input.url, "url");
-    }
-    if (requiredFields.events || input.events !== undefined) {
-        requireNonEmptyArrayField(input, "events", method);
-        requireStringArrayElements(input.events, "events", method);
-    }
-    requireMaxLength(input.description, "description", MAX_DESCRIPTION);
-    if (input.status !== undefined) {
-        requireNonEmptyStringField(input, "status", method);
-    }
-}
-function validateApiKeyWriteFields(input, method, requiredFields = {}) {
-    if (requiredFields.name || input.name !== undefined) {
-        requireNonEmptyStringField(input, "name", method);
-        requireMaxLength(input.name, "name", MAX_API_KEY_NAME);
-    }
-    if (requiredFields.scopes || input.scopes !== undefined) {
-        requireNonEmptyArrayField(input, "scopes", method);
-        requireStringArrayElements(input.scopes, "scopes", method);
-        const unsupported = input.scopes.find((scope) => !API_KEY_REQUEST_SCOPES.has(scope));
-        if (unsupported !== undefined) {
-            throw clientValidationError(`${method}: scopes contains an unsupported permission ${JSON.stringify(unsupported)}; this SDK accepts ${API_KEY_REQUEST_SCOPE_VALUES.join(", ")}`);
-        }
-    }
-}
-function validateEnrollmentTokenFields(input, method) {
-    if (input.target !== undefined &&
-        (typeof input.target !== "string" || !CREDENTIAL_TARGETS.has(input.target))) {
-        throw clientValidationError(`${method}: target must be 'agent' or 'connector'`);
-    }
-    let claimCount = 0;
-    if (input.claims !== undefined) {
-        if (!Array.isArray(input.claims)) {
-            throw clientValidationError(`${method}: claims must be an array`);
-        }
-        if (input.claims.length > 1) {
-            throw clientValidationError(`${method}: claims must contain at most one claim`);
-        }
-        claimCount = input.claims.length;
-        for (const [index, claim] of input.claims.entries()) {
-            if (!claim || typeof claim !== "object" || Array.isArray(claim)) {
-                throw clientValidationError(`${method}: claims[${index}] must be an object`);
-            }
-            requireNoUnknownFields(claim, ["type", "id"], `${method}: claims[${index}]`);
-            const record = claim;
-            if (typeof record.type !== "string" || !CREDENTIAL_CLAIM_TYPES.has(record.type)) {
-                throw clientValidationError(`${method}: claims[${index}].type must be 'connector'`);
-            }
-            if (typeof record.id !== "string" || !CONNECTOR_SLUG_PATTERN.test(record.id)) {
-                throw clientValidationError(`${method}: claims[${index}].id is not a valid connector slug; use 3-64 lowercase letters, digits, or hyphens, starting with a letter and ending with a letter or digit`);
-            }
-        }
-    }
-    // CreateApiKeyRequest.target permits an agent with zero or one connector claim.
-    if (input.target === "connector" && claimCount !== 1) {
-        throw clientValidationError(`${method}: target 'connector' requires exactly one claim`);
-    }
-    if (input.expires_in !== undefined) {
-        if (typeof input.expires_in !== "string") {
-            throw clientValidationError(`${method}: expires_in must be a duration string`);
-        }
-        const match = CREDENTIAL_DURATION_PATTERN.exec(input.expires_in);
-        if (!match) {
-            throw clientValidationError(`${method}: expires_in must match <integer><s|m|h|d|w>`);
-        }
-        const seconds = BigInt(match[1]) * CREDENTIAL_DURATION_MULTIPLIERS[match[2]];
-        if (seconds <= 0n || seconds > MAX_ENROLLMENT_TOKEN_TTL_SECONDS) {
-            throw clientValidationError(`${method}: expires_in must be greater than zero and at most 24h`);
-        }
-    }
-}
-/**
- * Per-entry shape guard for {@link BatchItemResult}. Verifies every
- * non-optional field on the branch of the discriminated union selected
- * by the `success` discriminant. Protects consumers who narrow on
- * `success` and then access `resource_id` / `qurl_link` / `error` as
- * guaranteed-present — if the API ever omits one, we trip the guard
- * rather than returning `undefined` where the type says `string`.
- *
- * Returns `null` when the entry is valid, or a human-readable reason
- * string describing the *specific* field that's missing or wrong. The
- * reason never echoes the entry's values — only field names and shape
- * descriptors — so the caller can safely surface it in error messages
- * that may end up in observability pipelines. Contrast with the outer
- * guard's intentional silence about response-body content for the
- * same info-leak reason.
- */
-function batchItemResultValidationReason(entry) {
-    if (!entry || typeof entry !== "object")
-        return "not an object";
-    const e = entry;
-    // `Number.isInteger` rejects NaN, Infinity, and floats; combined
-    // with `>= 0`, the check rules out pathological proxy bodies that
-    // would attribute to a useless index. `index` is informational, so
-    // this isn't a correctness hazard, but tightening the constraint
-    // matches the same posture as the count integer guards above.
-    if (!Number.isInteger(e.index) || e.index < 0) {
-        return "missing/invalid 'index' (expected non-negative integer)";
-    }
-    if (e.success === true) {
-        if (typeof e.resource_id !== "string") {
-            return "success-branch missing required field 'resource_id' (expected string)";
-        }
-        if (typeof e.qurl_link !== "string") {
-            return "success-branch missing required field 'qurl_link' (expected string)";
-        }
-        if (typeof e.qurl_site !== "string") {
-            return "success-branch missing required field 'qurl_site' (expected string)";
-        }
-        return null;
-    }
-    if (e.success === false) {
-        if (!e.error || typeof e.error !== "object") {
-            return "failure-branch missing required field 'error' (expected object)";
-        }
-        const err = e.error;
-        if (typeof err.code !== "string") {
-            return "failure-branch missing required field 'error.code' (expected string)";
-        }
-        if (typeof err.message !== "string") {
-            return "failure-branch missing required field 'error.message' (expected string)";
-        }
-        return null;
-    }
-    return "missing/invalid 'success' discriminant (expected boolean)";
-}
-// ---- Portal-verb helpers (mirrors qurl-go) -------------------------------
-// Client-side guardrails for the portal flow (protectUrl → createPortal →
-// enterPortal), kept in lockstep with qurl-go's option validation and
-// qurl-python's port of it.
-/**
- * Client-side floor for portal lifetimes, mirroring qurl-go's `ValidFor`.
- * The LayerV API remains the source of truth for account limits; there is
- * intentionally no SDK-side maximum because an account may allow
- * longer-lived portals.
- */
-const MIN_PORTAL_VALID_FOR_SECONDS = 60;
-/**
- * Client-side floor for session durations, mirroring qurl-go's
- * `WithSessionDuration` (at least one second; zero is rejected rather than
- * treated as the server default).
- */
-const MIN_SESSION_DURATION_SECONDS = 1;
-/**
- * Shape of qurl-go's offline signed-fragment links: three or more
- * dot-separated base64url parts (<version>.<claims>.<secret>.<sig>).
- * Detected only to give those links a precise error in extractAccessToken.
- *
- * @internal Exported for in-package tests; not re-exported from index.ts.
- */
-exports.SIGNED_FRAGMENT_RE = /^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+){2,}$/;
-// Access-token grammar accepted by enterPortal (base64url charset).
-const ACCESS_TOKEN_RE = /^[A-Za-z0-9_-]+$/;
-/**
- * Serialize a duration option to the API's h/m/s duration grammar.
- *
- * Strings pass through unvalidated — the server is authoritative, same as
- * the REST-shaped `expires_in` fields. Numbers are milliseconds and get
- * qurl-go's client-side guardrails: whole seconds only and at least
- * `minimumSeconds` (checked in that order so e.g. 30.5s reports "at least
- * 60s" in every SDK). Serialized with hours as the largest unit so all API
- * duration fields use the same grammar across SDKs.
- */
-function serializeApiDuration(value, field, minimumSeconds) {
-    if (value === undefined)
-        return undefined;
-    if (typeof value === "string") {
-        if (value.trim() === "") {
-            throw clientValidationError(`${field}: must be a non-empty duration string`);
-        }
-        return value;
-    }
-    if (typeof value === "number") {
-        // NaN fails no comparison, so an explicit finite check keeps the
-        // error actionable instead of a misleading "whole seconds" report.
-        if (!Number.isFinite(value)) {
-            throw clientValidationError(`${field}: must be a finite number of milliseconds`);
-        }
-        if (value < minimumSeconds * 1000) {
-            throw clientValidationError(`${field}: must be at least ${minimumSeconds}s`);
-        }
-        if (value % 1000 !== 0) {
-            throw clientValidationError(`${field}: must be whole seconds`);
-        }
-        const seconds = value / 1000;
-        if (seconds % 3600 === 0)
-            return `${seconds / 3600}h`;
-        if (seconds % 60 === 0)
-            return `${seconds / 60}m`;
-        return `${seconds}s`;
-    }
-    throw clientValidationError(`${field}: must be a duration string (e.g. "5m") or a number of milliseconds`);
-}
-/**
- * Portal-verb target URL validation (qurl-go `ProtectURL` parity). On top of
- * the shared scheme/length check, the URL must carry a host and must parse,
- * and embedded credentials (userinfo) are rejected. The added checks never
- * echo the URL — a userinfo URL contains credentials that must stay out of
- * logs and error messages. The REST-shaped compatibility layer keeps its
- * original prefix-only check so its accepted inputs don't change.
- */
-function requirePortalTargetUrl(targetUrl) {
-    requireValidTargetUrl(targetUrl);
-    const url = targetUrl; // requireValidTargetUrl only returns for http(s) strings
-    // WHATWG URL normalizes away an empty authority ("https:///x" parses
-    // with host "x"), so the host-presence check runs on the raw string,
-    // mirroring qurl-go's url.Parse which rejects authority-less URLs.
-    const afterScheme = url.slice(url.indexOf("://") + 3);
-    if (afterScheme === "" || "/?#".includes(afterScheme[0])) {
-        throw clientValidationError("target_url: must include a host");
-    }
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch {
-        throw clientValidationError("target_url: malformed URL");
-    }
-    if (parsed.username !== "" || parsed.password !== "") {
-        throw clientValidationError("target_url: must not include embedded credentials (userinfo)");
-    }
-}
-/**
- * Extract the access token from a qURL link, or pass a bare token through.
- *
- * Platform-issued links carry the access token in the URL fragment
- * (`https://qurl.link/#at_...`). Error messages deliberately never echo the
- * input — qURL links are credentials and must stay out of logs.
- */
-function extractAccessToken(qurlLink) {
-    if (typeof qurlLink !== "string" || qurlLink.trim() === "") {
-        throw clientValidationError("qurlLink: must be a non-empty string");
-    }
-    const hashIndex = qurlLink.indexOf("#");
-    const token = hashIndex >= 0 ? qurlLink.slice(hashIndex + 1) : qurlLink;
-    if (exports.SIGNED_FRAGMENT_RE.test(token)) {
-        throw clientValidationError("qurlLink: this is a signed qURL link (offline fragment format), which cannot be " +
-            "opened through the API resolver — enterPortal only accepts platform links " +
-            "(https://qurl.link/#at_...) or bare access tokens");
-    }
-    if (token === "" || !ACCESS_TOKEN_RE.test(token)) {
-        throw clientValidationError("qurlLink: no access token found — pass a platform qURL link " +
-            "(https://qurl.link/#at_...) or a bare access token");
-    }
-    return token;
-}
-/**
- * Parse an RFC 3339 timestamp from the API into a `Date`, or `undefined`
- * when absent or unparseable. The portal surface exposes `Date` (matching
- * qurl-go's `time.Time` and qurl-python's `datetime`); the REST-shaped
- * layer keeps raw wire strings.
- */
-function parseApiDate(value) {
-    if (typeof value !== "string" || value === "")
-        return undefined;
-    const parsed = new Date(value);
-    return Number.isNaN(parsed.getTime()) ? undefined : parsed;
-}
-/**
- * Parse a {@link Portal} from a create-portal API response. `resource_id`
- * and `qurl_link` are required, mirroring qurl-go's fail-closed response
- * check; everything else is optional because the two mint endpoints differ
- * in which ancillary fields they return.
- */
-async function parsePortal(data, method, expectedCrid) {
-    if (typeof data?.resource_id !== "string" || data.resource_id.trim() === "") {
-        throw unexpectedResponseError(`${method}: response is missing resource_id`);
-    }
-    if (typeof data.qurl_link !== "string" || data.qurl_link.trim() === "") {
-        throw unexpectedResponseError(`${method}: response is missing qurl_link`);
-    }
-    await verifyResourceIdentity(data, method, expectedCrid);
-    return {
-        crid: data.crid,
-        resourcePublicKey: data.resource_id,
-        link: data.qurl_link,
-        site: data.qurl_site,
-        expiresAt: parseApiDate(data.expires_at),
-        // Same empty-string → absent normalization the REST-shaped layer's
-        // consumers apply to qurl_id.
-        qurlId: data.qurl_id || undefined,
-        label: data.label,
-    };
-}
-/**
- * Validate portal options and build the create-portal wire body. The service
- * requires a JSON object even when every option is omitted; `{}` selects the
- * owner's plan defaults and matches qurl-go's zero-value request struct.
- */
-function buildCreatePortalBody(opts, method) {
-    requireObjectInput(opts, method);
-    requireNoUnknownFields(opts, CREATE_PORTAL_OPTION_KEYS, method);
-    // null → omitted, via the SDK-wide normalizePatchFields convention.
-    const { validFor, label, oneTimeUse, maxSessions, sessionDuration, targetPath } = normalizePatchFields(opts, CREATE_PORTAL_OPTION_KEYS);
-    if (label !== undefined) {
-        requireMaxLength(label, "label", MAX_LABEL);
-        // qurl-go's WithLabel rejects blank labels; the REST-shaped mintLink
-        // keeps its permissive whitespace behavior, so the check lives here.
-        if (label.trim() === "") {
-            throw clientValidationError("label: must not be empty");
-        }
-    }
-    requireBooleanIfPresent(oneTimeUse, "oneTimeUse");
-    requireMaxSessionsInRange(maxSessions, "maxSessions");
-    requireMaxUtf8Bytes(targetPath, "targetPath", MAX_TARGET_PATH);
-    requireNonEmptyIfPresent(targetPath, "targetPath");
-    if (targetPath !== undefined && method === "createPortalForUrl") {
-        throw clientValidationError("targetPath: requires an existing resource");
-    }
-    const body = {};
-    const expiresIn = serializeApiDuration(validFor, "validFor", MIN_PORTAL_VALID_FOR_SECONDS);
-    if (expiresIn !== undefined)
-        body.expires_in = expiresIn;
-    if (label !== undefined)
-        body.label = label;
-    if (oneTimeUse !== undefined)
-        body.one_time_use = oneTimeUse;
-    // Explicit 0 means unlimited and must survive body construction.
-    if (maxSessions !== undefined)
-        body.max_sessions = maxSessions;
-    const wireSessionDuration = serializeApiDuration(sessionDuration, "sessionDuration", MIN_SESSION_DURATION_SECONDS);
-    if (wireSessionDuration !== undefined)
-        body.session_duration = wireSessionDuration;
-    if (targetPath !== undefined)
-        body.target_path = targetPath;
-    return body;
+    }, meta);
 }
 /** qURL API client. */
 class QURLClient {
@@ -2240,19 +345,29 @@ class QURLClient {
     apiKey;
     fetchFn;
     maxRetries;
+    maxResponseBodyBytes;
     timeout;
     userAgent;
     debugFn;
     constructor(options) {
         if (!options.apiKey) {
-            throw clientValidationError("apiKey is required");
+            throw (0, client_errors_js_1.clientValidationError)("apiKey is required");
         }
         // Header-injection guard: `Authorization: Bearer ${apiKey}` would
         // otherwise be exploitable on a CR/LF-bearing key. Surface as
         // ValidationError at construction, not as TypeError on first request.
         if (/[\r\n]/.test(options.apiKey)) {
-            throw clientValidationError("apiKey: must not contain CR/LF characters");
+            throw (0, client_errors_js_1.clientValidationError)("apiKey: must not contain CR/LF characters");
         }
+        const responseLimit = options.maxResponseBodyBytes === undefined
+            ? client_limits_js_1.MAX_RESPONSE_BODY_BYTES
+            : options.maxResponseBodyBytes;
+        if (!Number.isSafeInteger(responseLimit) ||
+            responseLimit < 1 ||
+            responseLimit > client_limits_js_1.MAX_CONFIGURABLE_RESPONSE_BODY_BYTES) {
+            throw (0, client_errors_js_1.clientValidationError)("maxResponseBodyBytes: must be an integer from 1 through 16777216 bytes");
+        }
+        this.maxResponseBodyBytes = responseLimit;
         this.apiKey = options.apiKey;
         const rawBaseUrl = (0, internal_js_1.stripTrailingSlashes)(options.baseUrl ?? DEFAULT_BASE_URL);
         // Parse the URL so the loopback exemption matches on the hostname,
@@ -2265,13 +380,13 @@ class QURLClient {
             parsedBaseUrl = new URL(rawBaseUrl);
         }
         catch {
-            throw clientValidationError(`baseUrl: must be a valid URL (got ${JSON.stringify(rawBaseUrl).slice(0, 60)})`);
+            throw (0, client_errors_js_1.clientValidationError)(`baseUrl: must be a valid URL (got ${JSON.stringify(rawBaseUrl).slice(0, 60)})`);
         }
         // Reject any non-http/https scheme outright (ftp://, file://,
         // javascript:, ...). The loopback exemption logic below handles
         // IPv6 bracket form on `URL.hostname` — see the inner comment.
         if (parsedBaseUrl.protocol !== "http:" && parsedBaseUrl.protocol !== "https:") {
-            throw clientValidationError(`baseUrl: must use http:// or https:// scheme (got ${JSON.stringify(rawBaseUrl).slice(0, 60)})`);
+            throw (0, client_errors_js_1.clientValidationError)(`baseUrl: must use http:// or https:// scheme (got ${JSON.stringify(rawBaseUrl).slice(0, 60)})`);
         }
         if (parsedBaseUrl.protocol === "http:") {
             // Node's `URL.hostname` returns IPv6 hosts WITH brackets (e.g.
@@ -2282,7 +397,7 @@ class QURLClient {
             // `0.0.0.0` is bind-all, not loopback — would route the bearer to any local listener.
             const isLoopback = host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
             if (!isLoopback) {
-                throw clientValidationError(`baseUrl: must use https:// scheme (got ${JSON.stringify(rawBaseUrl).slice(0, 60)})`);
+                throw (0, client_errors_js_1.clientValidationError)(`baseUrl: must use https:// scheme (got ${JSON.stringify(rawBaseUrl).slice(0, 60)})`);
             }
         }
         this.baseUrl = rawBaseUrl;
@@ -2302,7 +417,7 @@ class QURLClient {
                 : DEFAULT_TIMEOUT;
         const userAgent = options.userAgent ?? `qurl-typescript/${version_js_1.VERSION}`;
         if (/[\r\n]/.test(userAgent)) {
-            throw clientValidationError("userAgent: must not contain CR/LF characters");
+            throw (0, client_errors_js_1.clientValidationError)("userAgent: must not contain CR/LF characters");
         }
         this.userAgent = userAgent;
         if (options.debug === true) {
@@ -2349,21 +464,21 @@ class QURLClient {
                 branch: "non-array",
                 qurls_type: typeof qurls,
             });
-            return rest;
+            return (0, response_metadata_js_1.copyResponseMetadata)(raw, rest);
         }
         // null is semantically "no tokens" — silent drop is fine, but surface
         // via debug so operators spot it if the API starts emitting null.
         if (qurls === null) {
             this.log("mapQurlsField: 'qurls' was null; dropping", { branch: "null" });
-            return rest;
+            return (0, response_metadata_js_1.copyResponseMetadata)(raw, rest);
         }
         if (qurls === undefined) {
             // Symmetric with null / non-array branches.
             this.log("mapQurlsField: 'qurls' was undefined; dropping", { branch: "undefined" });
-            return rest;
+            return (0, response_metadata_js_1.copyResponseMetadata)(raw, rest);
         }
         if (!rest.access_tokens) {
-            return { ...rest, access_tokens: qurls };
+            return (0, response_metadata_js_1.copyResponseMetadata)(raw, { ...rest, access_tokens: qurls });
         }
         // Server-side bug — drop `qurls` rather than merge. If the arrays
         // disagree, no consistent reconciliation exists; a silent merge
@@ -2373,7 +488,7 @@ class QURLClient {
             qurls_count: qurls.length,
             access_tokens_count: rest.access_tokens.length,
         });
-        return rest;
+        return (0, response_metadata_js_1.copyResponseMetadata)(raw, rest);
     }
     /**
      * Validate the response envelope from POST /v1/qurls/batch and return
@@ -2397,9 +512,9 @@ class QURLClient {
      * is malformed, additional shape errors don't help debug the upstream
      * issue.
      */
-    validateBatchCreateResponse(envelope, requestItemCount) {
-        const result = envelope.data;
-        const statusSuffix = envelope.__http_status !== undefined ? ` (HTTP ${envelope.__http_status})` : "";
+    validateBatchCreateResponse(response, requestItemCount) {
+        const result = response.envelope.data;
+        const statusSuffix = ` (HTTP ${response.status})`;
         // Thread the server's request_id into the shape-guard error so
         // operators debugging "unexpected response" tickets have the
         // correlation handle on the error path, mirroring the success-
@@ -2409,7 +524,7 @@ class QURLClient {
         // .requestId property AND the message string so a stack trace
         // pasted into a support ticket carries the correlation handle
         // without a follow-up round-trip.
-        const requestId = boundedErrorIdentifier(envelope.meta?.request_id);
+        const requestId = (0, client_errors_js_1.boundedErrorIdentifier)(response.envelope.meta?.request_id);
         const requestIdSuffix = requestId !== undefined ? ` [request_id=${requestId}]` : "";
         // `Number.isInteger` rejects NaN, Infinity, and floats. Combined
         // with `>= 0`, this rules out pathological proxy bodies (e.g.
@@ -2422,10 +537,10 @@ class QURLClient {
             !Number.isInteger(result.failed) ||
             result.failed < 0 ||
             !Array.isArray(result.results)) {
-            throw unexpectedResponseError(`Unexpected response shape from POST /v1/qurls/batch${statusSuffix}${requestIdSuffix}`, { requestId });
+            throw (0, client_errors_js_1.unexpectedResponseError)(`Unexpected response shape from POST /v1/qurls/batch${statusSuffix}${requestIdSuffix}`, { requestId });
         }
         if (result.succeeded + result.failed !== result.results.length) {
-            throw unexpectedResponseError(`Unexpected response shape from POST /v1/qurls/batch${statusSuffix}: ` +
+            throw (0, client_errors_js_1.unexpectedResponseError)(`Unexpected response shape from POST /v1/qurls/batch${statusSuffix}: ` +
                 `counts/results length mismatch (succeeded=${result.succeeded}, ` +
                 `failed=${result.failed}, results.length=${result.results.length})${requestIdSuffix}`, { requestId });
         }
@@ -2437,7 +552,7 @@ class QURLClient {
         // index range + dedup checks, this guarantees the seen-indices set is
         // exactly [0, requestItemCount).
         if (result.results.length !== requestItemCount) {
-            throw unexpectedResponseError(`Unexpected response shape from POST /v1/qurls/batch${statusSuffix}: ` +
+            throw (0, client_errors_js_1.unexpectedResponseError)(`Unexpected response shape from POST /v1/qurls/batch${statusSuffix}: ` +
                 `results.length (${result.results.length}) does not match request item count (${requestItemCount})${requestIdSuffix}`, { requestId });
         }
         // Per-entry discriminated-union contract. Reason strings report
@@ -2448,16 +563,16 @@ class QURLClient {
         // attribution, so fail closed to match this guard's posture.
         const seenIndices = new Set();
         for (let i = 0; i < result.results.length; i++) {
-            const reason = batchItemResultValidationReason(result.results[i]);
+            const reason = (0, client_resources_js_1.batchItemResultValidationReason)(result.results[i]);
             if (reason !== null) {
-                throw unexpectedResponseError(`Unexpected response shape from POST /v1/qurls/batch${statusSuffix}: results[${i}] ${reason}${requestIdSuffix}`, { requestId });
+                throw (0, client_errors_js_1.unexpectedResponseError)(`Unexpected response shape from POST /v1/qurls/batch${statusSuffix}: results[${i}] ${reason}${requestIdSuffix}`, { requestId });
             }
             const entry = result.results[i];
             if (entry.index >= requestItemCount) {
-                throw unexpectedResponseError(`Unexpected response shape from POST /v1/qurls/batch${statusSuffix}: results[${i}] index out of range (sent ${requestItemCount} items)${requestIdSuffix}`, { requestId });
+                throw (0, client_errors_js_1.unexpectedResponseError)(`Unexpected response shape from POST /v1/qurls/batch${statusSuffix}: results[${i}] index out of range (sent ${requestItemCount} items)${requestIdSuffix}`, { requestId });
             }
             if (seenIndices.has(entry.index)) {
-                throw unexpectedResponseError(`Unexpected response shape from POST /v1/qurls/batch${statusSuffix}: results[${i}] duplicate index${requestIdSuffix}`, { requestId });
+                throw (0, client_errors_js_1.unexpectedResponseError)(`Unexpected response shape from POST /v1/qurls/batch${statusSuffix}: results[${i}] duplicate index${requestIdSuffix}`, { requestId });
             }
             seenIndices.add(entry.index);
         }
@@ -2473,7 +588,7 @@ class QURLClient {
             pageCount += 1;
             const page = await loadPage({ ...input, cursor });
             for (const item of itemsFromPage(page)) {
-                yield item;
+                yield (0, response_metadata_js_1.copyResponseMetadata)(page, item);
             }
             cursor = page.next_cursor;
             if (page.has_more === false) {
@@ -2483,11 +598,11 @@ class QURLClient {
                 break;
             }
             if (seenCursors.has(cursor)) {
-                throw unexpectedResponseError(`${methodName}: server returned repeated cursor after ${pageCount} auto-pagination pages`, { requestId: page.request_id });
+                throw (0, client_errors_js_1.unexpectedResponseError)(`${methodName}: server returned repeated cursor after ${pageCount} auto-pagination pages`, { requestId: page.request_id });
             }
             seenCursors.add(cursor);
-            if (pageCount >= MAX_AUTO_PAGINATION_PAGES) {
-                throw unexpectedResponseError(`${methodName}: exceeded ${MAX_AUTO_PAGINATION_PAGES} auto-pagination pages without termination`, { requestId: page.request_id });
+            if (pageCount >= client_limits_js_1.MAX_AUTO_PAGINATION_PAGES) {
+                throw (0, client_errors_js_1.unexpectedResponseError)(`${methodName}: exceeded ${client_limits_js_1.MAX_AUTO_PAGINATION_PAGES} auto-pagination pages without termination`, { requestId: page.request_id });
             }
         } while (cursor);
     }
@@ -2500,7 +615,9 @@ class QURLClient {
      * {@link ProtectedResource.createPortal}:
      *
      * ```ts
-     * const resource = await client.protectUrl("https://internal.example.com/dashboard");
+     * const resource = await client.protectUrl("https://internal.example.com/dashboard", {
+     *   name: "Team dashboard",
+     * });
      * const portal = await resource.createPortal({ validFor: "5m" });
      * share(portal.link);
      * ```
@@ -2511,13 +628,15 @@ class QURLClient {
      * {@link createResource}.
      */
     async protectUrl(targetUrl, opts = {}, requestOptions) {
-        requirePortalTargetUrl(targetUrl);
-        requireObjectInput(opts, "protectUrl");
-        requireNoUnknownFields(opts, PROTECT_URL_OPTION_KEYS, "protectUrl");
+        (0, client_validation_js_1.requirePortalTargetUrl)(targetUrl);
+        (0, client_validation_js_1.requireObjectInput)(opts, "protectUrl");
+        (0, client_validation_js_1.requireNoUnknownFields)(opts, client_input_fields_js_1.PROTECT_URL_OPTION_KEYS, "protectUrl");
         // camelCase options → wire fields; null is treated as omitted, via the
         // SDK-wide normalizePatchFields convention.
-        const normalized = normalizePatchFields(opts, PROTECT_URL_OPTION_KEYS);
+        const normalized = (0, client_validation_js_1.normalizePatchFields)(opts, client_input_fields_js_1.PROTECT_URL_OPTION_KEYS);
         const body = { target_url: targetUrl };
+        if (normalized.name !== undefined)
+            body.name = normalized.name;
         if (normalized.private !== undefined)
             body.private = normalized.private;
         if (normalized.consumerAccess !== undefined) {
@@ -2532,20 +651,20 @@ class QURLClient {
             body.custom_domain = normalized.customDomain;
         if (normalized.alias !== undefined)
             body.alias = normalized.alias;
-        validateResourceWriteFields(body, { requireUrlTarget: true });
+        (0, client_resources_js_1.validateResourceWriteFields)(body, { requireUrlTarget: true });
         const response = await this.rawRequest("POST", "/v1/resources", body, {
             requestOptions,
         });
-        if (response.__http_status === 204)
-            throw unexpectedResponseError("protectUrl: expected a resource response body");
-        const resource = response.data;
-        await verifyResourceIdentity(resource, "protectUrl");
+        if (response.status === 204)
+            throw (0, client_errors_js_1.unexpectedResponseError)("protectUrl: expected a resource response body");
+        const resource = withEnvelopeMetadata(response.envelope.data, response.envelope.meta);
+        await (0, client_connectors_js_1.verifyResourceIdentity)(resource, "protectUrl");
         if (normalized.consumerAccess &&
             (resource.private !== true ||
-                !sameConsumerPolicy(resource.consumer_access, normalized.consumerAccess, response.meta?.found_existing === true))) {
-            throw unexpectedResponseError("protectUrl: private policy was not confirmed");
+                !(0, client_resources_js_1.sameConsumerPolicy)(resource.consumer_access, normalized.consumerAccess, response.envelope.meta?.found_existing === true))) {
+            throw (0, client_errors_js_1.unexpectedResponseError)("protectUrl: private policy was not confirmed");
         }
-        return new ProtectedResource(this, resource.crid, 
+        return new client_portals_js_1.ProtectedResource(this, resource.crid, 
         // Some resource types redact target_url in responses; fall back to
         // the caller-supplied URL so the handle stays useful.
         resource.target_url || targetUrl, resource);
@@ -2566,20 +685,31 @@ class QURLClient {
      * need the full resource details.
      */
     resourceByCrid(id) {
-        requireResourceCrid(id, "resourceByCrid");
-        return new ProtectedResource(this, id);
+        (0, client_paths_js_1.requireResourceCrid)(id, "resourceByCrid");
+        return new client_portals_js_1.ProtectedResource(this, id);
     }
-    /** Find or create the active qURL Connector resource for an immutable slug. */
-    async ensureConnectorResource(slug, requestOptions, consumerAccess) {
-        requireConnectorSlug(slug, "ensureConnectorResource");
+    /**
+     * Find or create the active qURL Connector resource for an immutable slug.
+     *
+     * `name` is the public name recipients see. The service requires it when the
+     * slug is new (`400 name_required` otherwise) and ignores it on reuse.
+     *
+     * @param slug - Immutable owner-scoped Connector slug.
+     * @param requestOptions - Per-call request options.
+     * @param consumerAccess - Private consumer policy for a new resource.
+     * @param name - Public resource name; required when the slug is new.
+     */
+    async ensureConnectorResource(slug, requestOptions, consumerAccess, name) {
+        (0, client_connectors_js_1.requireConnectorSlug)(slug, "ensureConnectorResource");
+        (0, client_validation_js_1.requireResourceNameIfPresent)(name);
         if (consumerAccess !== undefined) {
-            validateResourceWriteFields({ consumer_access: consumerAccess, private: true });
+            (0, client_resources_js_1.validateResourceWriteFields)({ consumer_access: consumerAccess, private: true });
             if (consumerAccess.version !== 1)
-                throw clientValidationError("consumer_access: creation requires version one");
+                throw (0, client_errors_js_1.clientValidationError)("consumer_access: creation requires version one");
         }
         // Response validation imports the producer's P-256 resource key. Preflight
         // before POST so a missing runtime capability cannot orphan a committed row.
-        requireConnectorSubtleCrypto("ensureConnectorResource");
+        (0, client_connectors_js_1.requireConnectorSubtleCrypto)("ensureConnectorResource");
         // Keep invalid options in the known pre-dispatch error arm. rawRequest
         // validates again when building the request, which protects future callers
         // that do not have this mutation-specific outcome contract.
@@ -2591,67 +721,67 @@ class QURLClient {
                 type: "tunnel",
                 slug,
                 find_or_create: true,
+                ...(name !== undefined ? { name } : {}),
                 ...(consumerAccess ? { private: true, consumer_access: consumerAccess } : {}),
             }, { requestOptions, retry: false, generateIdempotencyKey: false });
             // The find-or-create endpoint returns 201 for both newly-created
             // and found-existing rows; meta.found_existing distinguishes the arms.
-            if (response.__http_status !== 201) {
-                throw unexpectedResponseError(`ensureConnectorResource: expected HTTP 201, got ${response.__http_status ?? "unknown"}`);
+            if (response.status !== 201) {
+                throw (0, client_errors_js_1.unexpectedResponseError)(`ensureConnectorResource: expected HTTP 201, got ${response.status ?? "unknown"}`);
             }
             if (consumerAccess &&
-                (response.data.private !== true ||
-                    !sameConsumerPolicy(response.data.consumer_access, consumerAccess, response.meta?.found_existing === true))) {
-                throw unexpectedResponseError("ensureConnectorResource: private policy was not confirmed");
+                (response.envelope.data.private !== true ||
+                    !(0, client_resources_js_1.sameConsumerPolicy)(response.envelope.data.consumer_access, consumerAccess, response.envelope.meta?.found_existing === true))) {
+                throw (0, client_errors_js_1.unexpectedResponseError)("ensureConnectorResource: private policy was not confirmed");
             }
-            resource = await parseConnectorResource(this, response.data, "ensureConnectorResource", {
+            resource = await (0, client_connectors_js_1.parseConnectorResource)(this, response.envelope.data, "ensureConnectorResource", {
                 slug,
             });
         }
         catch (error) {
-            classifyConnectorMutationFailure("ensure", error);
+            (0, client_connectors_js_1.classifyConnectorMutationFailure)("ensure", error);
         }
-        if (response.meta !== undefined &&
-            response.meta !== null &&
-            (typeof response.meta !== "object" || Array.isArray(response.meta))) {
-            classifyConnectorMutationFailure("ensure", unexpectedResponseError("ensureConnectorResource: response has invalid meta"));
+        if (response.envelope.meta !== undefined &&
+            response.envelope.meta !== null &&
+            (typeof response.envelope.meta !== "object" || Array.isArray(response.envelope.meta))) {
+            (0, client_connectors_js_1.classifyConnectorMutationFailure)("ensure", (0, client_errors_js_1.unexpectedResponseError)("ensureConnectorResource: response has invalid meta"));
         }
-        const foundExisting = response.meta
-            ?.found_existing;
+        const foundExisting = response.envelope.meta?.found_existing;
         if (foundExisting === undefined || foundExisting === null) {
-            throw unexpectedResponseError("ensureConnectorResource: response is missing meta.found_existing; the validated resource exists, so reconcile by slug before retrying");
+            throw (0, client_errors_js_1.unexpectedResponseError)("ensureConnectorResource: response is missing meta.found_existing; the validated resource exists, so reconcile by slug before retrying");
         }
         if (typeof foundExisting !== "boolean") {
-            classifyConnectorMutationFailure("ensure", unexpectedResponseError("ensureConnectorResource: response has invalid meta.found_existing"));
+            (0, client_connectors_js_1.classifyConnectorMutationFailure)("ensure", (0, client_errors_js_1.unexpectedResponseError)("ensureConnectorResource: response has invalid meta.found_existing"));
         }
-        return { resource, foundExisting };
+        return withEnvelopeMetadata({ resource: withEnvelopeMetadata(resource, response.envelope.meta), foundExisting }, response.envelope.meta);
     }
     /** Fetch a qURL Connector resource by its CRID. */
     async getConnectorResource(crid) {
-        requireResourceCrid(crid, "getConnectorResource");
-        requireConnectorSubtleCrypto("getConnectorResource");
-        const { data, __http_status } = await this.rawRequest("GET", `/v1/resources/${encodeURIComponent(crid)}`, undefined, { retry: false });
-        if (__http_status !== 200) {
-            throw unexpectedResponseError(`getConnectorResource: expected HTTP 200, got ${__http_status ?? "unknown"}`);
+        (0, client_paths_js_1.requireResourceCrid)(crid, "getConnectorResource");
+        (0, client_connectors_js_1.requireConnectorSubtleCrypto)("getConnectorResource");
+        const { envelope: { data, meta }, status: httpStatus, } = await this.rawRequest("GET", `/v1/resources/${encodeURIComponent(crid)}`, undefined, { retry: false });
+        if (httpStatus !== 200) {
+            throw (0, client_errors_js_1.unexpectedResponseError)(`getConnectorResource: expected HTTP 200, got ${httpStatus ?? "unknown"}`);
         }
-        return parseConnectorResource(this, data?.resource, "getConnectorResource", {
+        return withEnvelopeMetadata(await (0, client_connectors_js_1.parseConnectorResource)(this, data?.resource, "getConnectorResource", {
             crid,
             revokedIsLifecycleError: true,
-        });
+        }), meta);
     }
     /** Fetch the single active qURL Connector resource for an immutable slug. */
     async getConnectorResourceBySlug(slug) {
-        requireConnectorSlug(slug, "getConnectorResourceBySlug");
+        (0, client_connectors_js_1.requireConnectorSlug)(slug, "getConnectorResourceBySlug");
         // Parsing validates the returned P-256 resource key; avoid dispatching a
         // read that this runtime cannot safely consume.
-        requireConnectorSubtleCrypto("getConnectorResourceBySlug");
+        (0, client_connectors_js_1.requireConnectorSubtleCrypto)("getConnectorResourceBySlug");
         // The slug point lookup is intrinsically active-only. It also
         // rejects combining `slug` with `status`, so this query must stay slug-only.
-        const { data, __http_status } = await this.rawRequest("GET", `/v1/resources?slug=${encodeURIComponent(slug)}`, undefined, { retry: false });
-        if (__http_status !== 200) {
-            throw unexpectedResponseError(`getConnectorResourceBySlug: expected HTTP 200, got ${__http_status ?? "unknown"}`);
+        const { envelope: { data, meta }, status: httpStatus, } = await this.rawRequest("GET", `/v1/resources?slug=${encodeURIComponent(slug)}`, undefined, { retry: false });
+        if (httpStatus !== 200) {
+            throw (0, client_errors_js_1.unexpectedResponseError)(`getConnectorResourceBySlug: expected HTTP 200, got ${httpStatus ?? "unknown"}`);
         }
         if (!Array.isArray(data)) {
-            throw unexpectedResponseError("getConnectorResourceBySlug: response has missing or invalid data");
+            throw (0, client_errors_js_1.unexpectedResponseError)("getConnectorResourceBySlug: response has missing or invalid data");
         }
         if (data.length === 0) {
             throw new errors_js_1.NotFoundError({
@@ -2669,7 +799,7 @@ class QURLClient {
                 detail: `getConnectorResourceBySlug: expected one active resource, got ${data.length}`,
             });
         }
-        return parseConnectorResource(this, data[0], "getConnectorResourceBySlug", { slug });
+        return withEnvelopeMetadata(await (0, client_connectors_js_1.parseConnectorResource)(this, data[0], "getConnectorResourceBySlug", { slug }), meta);
     }
     /**
      * Revoke a qURL Connector resource by CRID.
@@ -2678,12 +808,12 @@ class QURLClient {
      * outcome-unknown failure, reconcile by ID before issuing a deliberate retry.
      */
     async deleteConnectorResource(crid) {
-        requireResourceCrid(crid, "deleteConnectorResource");
+        (0, client_paths_js_1.requireResourceCrid)(crid, "deleteConnectorResource");
         try {
             await this.requestNoContent(`/v1/resources/${encodeURIComponent(crid)}`);
         }
         catch (error) {
-            classifyConnectorMutationFailure("delete", error);
+            (0, client_connectors_js_1.classifyConnectorMutationFailure)("delete", error);
         }
     }
     /**
@@ -2708,19 +838,19 @@ class QURLClient {
         if (typeof resource === "string") {
             resourceId = resource;
         }
-        else if (resource instanceof ProtectedResource) {
-            if (!ProtectedResource.isBoundTo(resource, this)) {
-                throw clientValidationError("createPortal: resource is bound to a different client");
+        else if (resource instanceof client_portals_js_1.ProtectedResource) {
+            if (!client_portals_js_1.ProtectedResource.isBoundTo(resource, this)) {
+                throw (0, client_errors_js_1.clientValidationError)("createPortal: resource is bound to a different client");
             }
             resourceId = resource.crid;
         }
         else {
-            throw clientValidationError(`createPortal: resource must be a ProtectedResource handle or a CRID string (got ${describeShape(resource)})`);
+            throw (0, client_errors_js_1.clientValidationError)(`createPortal: resource must be a ProtectedResource handle or a CRID string (got ${(0, client_validation_js_1.describeShape)(resource)})`);
         }
-        requireResourceCrid(resourceId, "createPortal");
-        const body = buildCreatePortalBody(opts, "createPortal");
+        (0, client_paths_js_1.requireResourceCrid)(resourceId, "createPortal");
+        const body = (0, client_portals_js_1.buildCreatePortalBody)(opts, "createPortal");
         const data = await this.request("POST", `/v1/resources/${encodeURIComponent(resourceId)}/qurls`, body, requestOptions);
-        return parsePortal(data, "createPortal", resourceId);
+        return (0, client_portals_js_1.parsePortal)(data, "createPortal", resourceId, body.target_path);
     }
     /**
      * Protect `targetUrl` and mint a portal in one API call.
@@ -2736,17 +866,17 @@ class QURLClient {
      * equivalent: {@link create}.
      */
     async createPortalForUrl(targetUrl, opts = {}, requestOptions) {
-        requirePortalTargetUrl(targetUrl);
+        (0, client_validation_js_1.requirePortalTargetUrl)(targetUrl);
         const body = {
             target_url: targetUrl,
-            ...buildCreatePortalBody(opts, "createPortalForUrl"),
+            ...(0, client_portals_js_1.buildCreatePortalBody)(opts, "createPortalForUrl"),
         };
         const data = await this.request("POST", "/v1/qurls", body, requestOptions);
-        const portal = await parsePortal(data, "createPortalForUrl");
-        return {
+        const portal = await (0, client_portals_js_1.parsePortal)(data, "createPortalForUrl");
+        return (0, response_metadata_js_1.copyResponseMetadata)(data, {
             portal,
-            resource: new ProtectedResource(this, portal.crid, targetUrl),
-        };
+            resource: (0, response_metadata_js_1.copyResponseMetadata)(data, new client_portals_js_1.ProtectedResource(this, portal.crid, targetUrl)),
+        });
     }
     /**
      * Open a qURL link programmatically and return the reachable resource.
@@ -2771,16 +901,16 @@ class QURLClient {
      * credentials.
      */
     async enterPortal(qurlLink, requestOptions) {
-        const token = extractAccessToken(qurlLink);
+        const token = (0, client_portals_js_1.extractAccessToken)(qurlLink);
         const resolved = await this.resolve(token, requestOptions);
         if (typeof resolved?.target_url !== "string" || resolved.target_url === "") {
-            throw unexpectedResponseError("enterPortal: access was granted but the API returned no resource URL");
+            throw (0, client_errors_js_1.unexpectedResponseError)("enterPortal: access was granted but the API returned no resource URL");
         }
-        return {
+        return (0, response_metadata_js_1.copyResponseMetadata)(resolved, {
             resourceUrl: resolved.target_url,
             openSeconds: resolved.access_grant?.expires_in ?? 0,
             resourcePublicKey: resolved.resource_id,
-        };
+        });
     }
     // --- Public API ---
     /**
@@ -2790,7 +920,7 @@ class QURLClient {
      * returns a {@link Portal} plus a reusable resource handle).
      */
     async create(input, options) {
-        validateCreateInput(input);
+        (0, client_resources_js_1.validateCreateInput)(input);
         return this.request("POST", "/v1/qurls", input, options);
     }
     /**
@@ -2804,6 +934,8 @@ class QURLClient {
      *   populated `BatchCreateOutput` body in this case; whitelisted via
      *   `passthroughStatuses` so the structured per-item errors aren't
      *   swallowed by the generic error path.
+     *   HTTP 400 is the documented all-item validation failure. HTTP 422 is
+     *   not a batch passthrough status and follows normal error handling.
      *
      * Callers that only catch thrown errors will **silently miss partial
      * failures**. Always branch on `result.failed > 0` before treating the
@@ -2851,17 +983,17 @@ class QURLClient {
         // for non-conforming inputs. Without this guard, `batchCreate({} as
         // any)` would throw a raw TypeError on `.length`. Match the pattern.
         if (!input || !Array.isArray(input.items)) {
-            throw clientValidationError("batchCreate: items must be an array");
+            throw (0, client_errors_js_1.clientValidationError)("batchCreate: items must be an array");
         }
         // Size checks are fail-fast (binary, no useful aggregation), per-item
         // validation below is collect-all (multiple bad items aggregate into
         // one throw). The asymmetry is deliberate: there's nothing to combine
         // for empty input or oversized batches — the size is wrong or it isn't.
         if (input.items.length === 0) {
-            throw clientValidationError("batchCreate requires at least 1 item");
+            throw (0, client_errors_js_1.clientValidationError)("batchCreate requires at least 1 item");
         }
-        if (input.items.length > MAX_BATCH_ITEMS) {
-            throw clientValidationError(`batchCreate accepts at most ${MAX_BATCH_ITEMS} items, got ${input.items.length}`);
+        if (input.items.length > client_limits_js_1.MAX_BATCH_ITEMS) {
+            throw (0, client_errors_js_1.clientValidationError)(`batchCreate accepts at most ${client_limits_js_1.MAX_BATCH_ITEMS} items, got ${input.items.length}`);
         }
         // Collect ALL per-item validation errors in one pass (not fail-fast)
         // so callers see every problem without fix-re-run-repeat. Kept inline
@@ -2870,7 +1002,7 @@ class QURLClient {
         const perItemErrors = [];
         for (let i = 0; i < input.items.length; i++) {
             try {
-                validateCreateInput(input.items[i]);
+                (0, client_resources_js_1.validateCreateInput)(input.items[i]);
             }
             catch (err) {
                 if (err instanceof errors_js_1.ValidationError) {
@@ -2887,18 +1019,18 @@ class QURLClient {
             // Without this asymmetry, the same `; ` at both levels makes
             // it ambiguous which separator is "next item" vs "next field
             // within item". Mirrors the JSDoc example shape.
-            throw clientValidationError(`batchCreate: ${perItemErrors.join(" | ")}`);
+            throw (0, client_errors_js_1.clientValidationError)(`batchCreate: ${perItemErrors.join(" | ")}`);
         }
         // 400 carries per-item errors (see rawRequest JSDoc). Use rawRequest
         // directly (not `this.request`) so we can read `meta.request_id`
         // from the envelope and propagate it into the returned
         // BatchCreateOutput — consumers filing support tickets on partial
         // or total batch failures need the correlation ID.
-        const envelope = await this.rawRequest("POST", "/v1/qurls/batch", input, {
+        const response = await this.rawRequest("POST", "/v1/qurls/batch", input, {
             passthroughStatuses: BATCH_PASSTHROUGH_STATUSES,
             requestOptions: options,
         });
-        const result = this.validateBatchCreateResponse(envelope, input.items.length);
+        const result = this.validateBatchCreateResponse(response, input.items.length);
         // Attach the server request_id from the envelope meta without
         // mutating `result` (which is the parsed JSON body). Mirrors the
         // non-mutating style used elsewhere (e.g. `mapQurlsField`). In the
@@ -2915,7 +1047,7 @@ class QURLClient {
         // as the source, and `meta.request_id` is the canonical envelope
         // field. The data-side variant would be a wire-format duplication
         // we don't want to silently honor.
-        const requestId = envelope.meta?.request_id;
+        const requestId = response.envelope.meta?.request_id;
         // Both-fields-present and data-only-present are both worth surfacing
         // via debug — the former because meta wins silently, the latter
         // because it suggests an envelope-shape transition. Data-side value
@@ -2937,7 +1069,7 @@ class QURLClient {
                 });
             }
         }
-        return requestId !== undefined ? { ...result, request_id: requestId } : result;
+        return withEnvelopeMetadata(requestId !== undefined ? { ...result, request_id: requestId } : result, response.envelope.meta);
     }
     /**
      * Start one durable delegated qURL batch. The SDK sends this mutation once.
@@ -2945,12 +1077,12 @@ class QURLClient {
      * semantic body.
      */
     async createDelegatedQurlBatch(input, options) {
-        validateCreateDelegatedQurlBatchInput(input);
-        validateDelegatedBatchCreateOptions(options);
+        (0, client_delegated_js_1.validateCreateDelegatedQurlBatchInput)(input);
+        (0, client_delegated_js_1.validateDelegatedBatchCreateOptions)(options);
         let dispatched = false;
         let acceptedBatchId;
         try {
-            const envelope = await this.rawRequest("POST", "/v1/delegated-qurl-batches", input, {
+            const response = await this.rawRequest("POST", "/v1/delegated-qurl-batches", input, {
                 requestOptions: options,
                 retry: false,
                 generateIdempotencyKey: false,
@@ -2959,25 +1091,25 @@ class QURLClient {
                     dispatched = true;
                 },
             });
-            const status = envelope.__http_status ?? 0;
+            const status = response.status ?? 0;
             if (status !== 202) {
-                throw delegatedResponseError(status, "create returned an unexpected success status");
+                throw (0, client_delegated_js_1.delegatedResponseError)(status, "create returned an unexpected success status");
             }
-            const rawData = envelope.data;
+            const rawData = response.envelope.data;
             if (typeof rawData === "object" && rawData !== null && !Array.isArray(rawData)) {
                 const candidate = rawData.batch_id;
-                if (typeof candidate === "string" && DELEGATED_BATCH_ID_PATTERN.test(candidate)) {
+                if (typeof candidate === "string" && client_delegated_js_1.DELEGATED_BATCH_ID_PATTERN.test(candidate)) {
                     acceptedBatchId = candidate;
                 }
             }
-            const { data, requestId } = delegatedEnvelope(envelope, status);
-            const base = delegatedBatchBase(data, status, requestId);
+            const { data, requestId } = (0, client_delegated_js_1.delegatedEnvelope)(response, status);
+            const base = (0, client_delegated_js_1.delegatedBatchBase)(data, status, requestId);
             if (data.status !== "queued" || base.itemCount !== input.grants.length) {
-                throw delegatedResponseError(status, "acceptance data is inconsistent", requestId);
+                throw (0, client_delegated_js_1.delegatedResponseError)(status, "acceptance data is inconsistent", requestId);
             }
-            const responseHeaders = delegatedResponseHeaders(envelope, status, requestId);
-            const location = validateDelegatedLocation(requiredDelegatedHeader(envelope, "Location", status, requestId), this.baseUrl, base.batchId, status, requestId);
-            return {
+            const responseHeaders = (0, client_delegated_js_1.delegatedResponseHeaders)(response, status, requestId);
+            const location = (0, client_delegated_js_1.validateDelegatedLocation)((0, client_delegated_js_1.requiredDelegatedHeader)(response, "Location", status, requestId), this.baseUrl, base.batchId, status, requestId);
+            return withEnvelopeMetadata({
                 http_status: 202,
                 batch_id: base.batchId,
                 status: "queued",
@@ -2987,12 +1119,12 @@ class QURLClient {
                 retry_after: responseHeaders.retryAfter,
                 location,
                 request_id: requestId,
-            };
+            }, response.envelope.meta);
         }
         catch (error) {
             if (!dispatched)
                 throw error;
-            classifyDelegatedBatchCreateFailure(error, acceptedBatchId);
+            (0, client_delegated_js_1.classifyDelegatedBatchCreateFailure)(error, acceptedBatchId);
         }
     }
     /**
@@ -3000,45 +1132,45 @@ class QURLClient {
      * callers retain control of the poll count and total deadline.
      */
     async getDelegatedQurlBatch(batchId, options) {
-        if (typeof batchId !== "string" || !DELEGATED_BATCH_ID_PATTERN.test(batchId)) {
-            throw clientValidationError("getDelegatedQurlBatch: batchId must match dqb_ plus 22 URL-safe characters");
+        if (typeof batchId !== "string" || !client_delegated_js_1.DELEGATED_BATCH_ID_PATTERN.test(batchId)) {
+            throw (0, client_errors_js_1.clientValidationError)("getDelegatedQurlBatch: batchId must match dqb_ plus 22 URL-safe characters");
         }
-        validateGetDelegatedQurlBatchOptions(options);
-        const envelope = await this.rawRequest("GET", `/v1/delegated-qurl-batches/${encodeURIComponent(batchId)}`, undefined, {
+        (0, client_delegated_js_1.validateGetDelegatedQurlBatchOptions)(options);
+        const response = await this.rawRequest("GET", `/v1/delegated-qurl-batches/${encodeURIComponent(batchId)}`, undefined, {
             passthroughStatuses: DELEGATED_BATCH_PASSTHROUGH_STATUSES,
             allowEmptyPassthroughBody: true,
             ifNoneMatch: options?.etag,
             retry: false,
             captureResponseHeaders: true,
         });
-        const status = envelope.__http_status ?? 0;
+        const status = response.status ?? 0;
         if (status === 304) {
-            if (envelope.__http_body_empty !== true || options?.etag === undefined) {
-                throw delegatedResponseError(status, "304 response is inconsistent");
+            if (response.bodyEmpty !== true || options?.etag === undefined) {
+                throw (0, client_delegated_js_1.delegatedResponseError)(status, "304 response is inconsistent");
             }
-            const responseHeaders = delegatedResponseHeaders(envelope, status);
+            const responseHeaders = (0, client_delegated_js_1.delegatedResponseHeaders)(response, status);
             if (responseHeaders.etag !== undefined && responseHeaders.etag !== options.etag) {
-                throw delegatedResponseError(status, "304 response changed the ETag");
+                throw (0, client_delegated_js_1.delegatedResponseError)(status, "304 response changed the ETag");
             }
-            return {
+            return withEnvelopeMetadata({
                 http_status: 304,
                 etag: responseHeaders.etag ?? options.etag,
                 ...(responseHeaders.retryAfter === undefined
                     ? {}
                     : { retry_after: responseHeaders.retryAfter }),
-            };
+            }, response.envelope.meta);
         }
         if (status !== 200 && status !== 202) {
-            throw delegatedResponseError(status, "read returned an unexpected success status");
+            throw (0, client_delegated_js_1.delegatedResponseError)(status, "read returned an unexpected success status");
         }
-        const { data, requestId } = delegatedEnvelope(envelope, status);
-        const base = delegatedBatchBase(data, status, requestId, batchId);
+        const { data, requestId } = (0, client_delegated_js_1.delegatedEnvelope)(response, status);
+        const base = (0, client_delegated_js_1.delegatedBatchBase)(data, status, requestId, batchId);
         if (status === 202) {
             if (data.status !== "queued" && data.status !== "running") {
-                throw delegatedResponseError(status, "pending data has a terminal status", requestId);
+                throw (0, client_delegated_js_1.delegatedResponseError)(status, "pending data has a terminal status", requestId);
             }
-            const responseHeaders = delegatedResponseHeaders(envelope, status, requestId);
-            return {
+            const responseHeaders = (0, client_delegated_js_1.delegatedResponseHeaders)(response, status, requestId);
+            return withEnvelopeMetadata({
                 http_status: 202,
                 batch_id: base.batchId,
                 status: data.status,
@@ -3047,19 +1179,19 @@ class QURLClient {
                 etag: responseHeaders.etag,
                 retry_after: responseHeaders.retryAfter,
                 request_id: requestId,
-            };
+            }, response.envelope.meta);
         }
         if (data.status !== "succeeded" &&
             data.status !== "partially_failed" &&
             data.status !== "failed") {
-            throw delegatedResponseError(status, "terminal data has a non-terminal status", requestId);
+            throw (0, client_delegated_js_1.delegatedResponseError)(status, "terminal data has a non-terminal status", requestId);
         }
         let results;
         try {
-            if (!isUtcTimestamp(data.completed_at)) {
-                throw delegatedResponseError(status, "terminal data has invalid completed_at", requestId);
+            if (!(0, client_delegated_js_1.isUtcTimestamp)(data.completed_at)) {
+                throw (0, client_delegated_js_1.delegatedResponseError)(status, "terminal data has invalid completed_at", requestId);
             }
-            results = validateDelegatedBatchResults(data.results, base.itemCount, data.status, status, requestId);
+            results = (0, client_delegated_js_1.validateDelegatedBatchResults)(data.results, base.itemCount, data.status, status, requestId);
         }
         catch (error) {
             const partialQurlIds = Array.isArray(data.results)
@@ -3068,7 +1200,7 @@ class QURLClient {
                         typeof item === "object" &&
                         item.status === "succeeded" &&
                         typeof item.qurl?.qurl_id === "string" &&
-                        DELEGATED_QURL_ID_PATTERN.test(item.qurl.qurl_id)
+                        client_delegated_js_1.DELEGATED_QURL_ID_PATTERN.test(item.qurl.qurl_id)
                         ? [item.qurl.qurl_id]
                         : [])),
                 ]
@@ -3083,17 +1215,17 @@ class QURLClient {
         // This is the caller's only copy of the bearer links. Do not discard a
         // valid terminal body because an intermediary removed a cache validator;
         // qurl-service owns the required no-store response policy.
-        const cacheControl = envelope.__http_headers?.get("Cache-Control") ?? null;
-        if (!hasDelegatedNoStore(cacheControl)) {
+        const cacheControl = response.headers?.get("Cache-Control") ?? null;
+        if (!(0, client_delegated_js_1.hasDelegatedNoStore)(cacheControl)) {
             this.log("delegated batch terminal response is missing private, no-store", {
                 batch_id: base.batchId,
             });
         }
-        const etag = envelope.__http_headers?.get("ETag") ?? undefined;
-        const terminalEtag = etag !== undefined && etag.length <= MAX_DELEGATED_ETAG && STRONG_ETAG_PATTERN.test(etag)
+        const etag = response.headers?.get("ETag") ?? undefined;
+        const terminalEtag = etag !== undefined && etag.length <= client_limits_js_1.MAX_DELEGATED_ETAG && client_delegated_js_1.STRONG_ETAG_PATTERN.test(etag)
             ? etag
             : undefined;
-        return {
+        return withEnvelopeMetadata({
             http_status: 200,
             batch_id: base.batchId,
             status: data.status,
@@ -3103,28 +1235,28 @@ class QURLClient {
             results,
             ...(terminalEtag === undefined ? {} : { etag: terminalEtag }),
             request_id: requestId,
-        };
+        }, response.envelope.meta);
     }
     /** Read owner-visible metadata for one delegated qURL. */
     async getDelegatedQurl(qurlId) {
-        if (typeof qurlId !== "string" || !DELEGATED_QURL_ID_PATTERN.test(qurlId)) {
-            throw clientValidationError("getDelegatedQurl: qurlId must match q_ plus 11 lowercase hexadecimal characters");
+        if (typeof qurlId !== "string" || !client_delegated_js_1.DELEGATED_QURL_ID_PATTERN.test(qurlId)) {
+            throw (0, client_errors_js_1.clientValidationError)("getDelegatedQurl: qurlId must match q_ plus 11 lowercase hexadecimal characters");
         }
-        const envelope = await this.rawRequest("GET", `/v1/delegated-qurls/${encodeURIComponent(qurlId)}`);
-        const status = envelope.__http_status ?? 0;
+        const response = await this.rawRequest("GET", `/v1/delegated-qurls/${encodeURIComponent(qurlId)}`);
+        const status = response.status ?? 0;
         if (status !== 200) {
-            throw delegatedResponseError(status, "read returned an unexpected success status");
+            throw (0, client_delegated_js_1.delegatedResponseError)(status, "read returned an unexpected success status");
         }
-        const { data, requestId } = delegatedEnvelope(envelope, status);
-        return validateDelegatedQurl(data, qurlId, status, requestId);
+        const { data, requestId } = (0, client_delegated_js_1.delegatedEnvelope)(response, status);
+        return withEnvelopeMetadata((0, client_delegated_js_1.validateDelegatedQurl)(data, qurlId, status, requestId), response.envelope.meta);
     }
     /**
      * Revoke one delegated qURL. DELETE is never retried automatically. A 503
      * `mutation_outcome_unknown` is safe to retry with the same qURL ID.
      */
     async deleteDelegatedQurl(qurlId) {
-        if (typeof qurlId !== "string" || !DELEGATED_QURL_ID_PATTERN.test(qurlId)) {
-            throw clientValidationError("deleteDelegatedQurl: qurlId must match q_ plus 11 lowercase hexadecimal characters");
+        if (typeof qurlId !== "string" || !client_delegated_js_1.DELEGATED_QURL_ID_PATTERN.test(qurlId)) {
+            throw (0, client_errors_js_1.clientValidationError)("deleteDelegatedQurl: qurlId must match q_ plus 11 lowercase hexadecimal characters");
         }
         await this.requestNoContent(`/v1/delegated-qurls/${encodeURIComponent(qurlId)}`);
     }
@@ -3136,7 +1268,7 @@ class QURLClient {
      * resource automatically.
      */
     async get(id) {
-        validatePathId(id, "get", "id", RESOURCE_OR_QURL_ID_PATH_OPTIONS);
+        (0, client_paths_js_1.validatePathId)(id, "get", "id", client_paths_js_1.RESOURCE_OR_QURL_ID_PATH_OPTIONS);
         const raw = await this.request("GET", `/v1/qurls/${encodeURIComponent(id)}`);
         return this.mapQurlsField(raw);
     }
@@ -3153,8 +1285,8 @@ class QURLClient {
      * validation style used for `max_sessions`, `tag count`, URL length.
      */
     async list(input = {}) {
-        const path = appendQuery("/v1/qurls", input, LIST_PARAM_KEYS, "list");
-        const { data, meta } = await this.rawRequest("GET", path);
+        const path = appendQuery("/v1/qurls", input, client_input_fields_js_1.LIST_PARAM_KEYS, "list");
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", path);
         return pageFromMeta({
             // Defensive: map in case API includes nested tokens on list items in the future.
             qurls: (data ?? []).map((raw) => this.mapQurlsField(raw)),
@@ -3172,7 +1304,7 @@ class QURLClient {
      * iteration begins.
      */
     listAll(input = {}) {
-        validateListAllInput(input, LIST_PARAM_KEYS, "listAll");
+        validateListAllInput(input, client_input_fields_js_1.LIST_PARAM_KEYS, "listAll");
         return this.paginateAll("listAll", input, (pageInput) => this.list(pageInput), (page) => page.qurls);
     }
     /**
@@ -3184,7 +1316,7 @@ class QURLClient {
      * @throws {ValidationError} If `id` is not a canonical CRID.
      */
     async delete(id) {
-        requireResourceCrid(id, "delete");
+        (0, client_paths_js_1.requireResourceCrid)(id, "delete");
         await this.requestNoContent(`/v1/qurls/${encodeURIComponent(id)}`);
     }
     /**
@@ -3203,14 +1335,14 @@ class QURLClient {
      * enforced separately by the runtime check inside `update()`.
      */
     async extend(id, input, options) {
-        validatePathId(id, "extend", "id", RESOURCE_OR_QURL_ID_PATH_OPTIONS);
-        requireObjectInput(input, "extend");
+        (0, client_paths_js_1.validatePathId)(id, "extend", "id", client_paths_js_1.RESOURCE_OR_QURL_ID_PATH_OPTIONS);
+        (0, client_validation_js_1.requireObjectInput)(input, "extend");
         const { extend_by, expires_at } = input;
         if (extend_by === undefined && expires_at === undefined) {
-            throw clientValidationError("extend: exactly one of `extend_by` or `expires_at` is required");
+            throw (0, client_errors_js_1.clientValidationError)("extend: exactly one of `extend_by` or `expires_at` is required");
         }
         if (extend_by !== undefined && expires_at !== undefined) {
-            throw clientValidationError("extend: `extend_by` and `expires_at` are mutually exclusive — provide exactly one");
+            throw (0, client_errors_js_1.clientValidationError)("extend: `extend_by` and `expires_at` are mutually exclusive — provide exactly one");
         }
         return this.update(id, { extend_by, expires_at }, options);
     }
@@ -3222,25 +1354,25 @@ class QURLClient {
      * resource automatically.
      */
     async update(id, input, options) {
-        validatePathId(id, "update", "id", RESOURCE_OR_QURL_ID_PATH_OPTIONS);
-        requireObjectInput(input, "update");
-        requireNoUnknownFields(input, UPDATE_FIELD_KEYS, "update");
+        (0, client_paths_js_1.validatePathId)(id, "update", "id", client_paths_js_1.RESOURCE_OR_QURL_ID_PATH_OPTIONS);
+        (0, client_validation_js_1.requireObjectInput)(input, "update");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.UPDATE_FIELD_KEYS, "update");
         // Normalize null → undefined so untyped-JS callers passing
         // `{ tags: null }` don't leak null into the wire body or crash
         // downstream validators. Shallow copy keeps caller input untouched.
-        const normalized = normalizePatchFields(input, UPDATE_FIELD_KEYS);
+        const normalized = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.UPDATE_FIELD_KEYS);
         // Timing fields have no clear-semantic (unlike `description: ""`).
-        requireNonEmptyIfPresent(normalized.extend_by, "extend_by");
-        requireNonEmptyIfPresent(normalized.expires_at, "expires_at");
+        (0, client_validation_js_1.requireNonEmptyIfPresent)(normalized.extend_by, "extend_by");
+        (0, client_validation_js_1.requireNonEmptyIfPresent)(normalized.expires_at, "expires_at");
         if (normalized.extend_by !== undefined && normalized.expires_at !== undefined) {
-            throw clientValidationError("update: `extend_by` and `expires_at` are mutually exclusive — provide at most one");
+            throw (0, client_errors_js_1.clientValidationError)("update: `extend_by` and `expires_at` are mutually exclusive — provide at most one");
         }
-        requireAtLeastOneField(normalized, UPDATE_FIELD_KEYS, "update");
+        (0, client_validation_js_1.requireAtLeastOneField)(normalized, client_input_fields_js_1.UPDATE_FIELD_KEYS, "update");
         // Per-field validators run after the empty-input guard so the
         // cheap binary check short-circuits first; order is correctness-neutral
         // (`requireMaxLength(undefined, …)` is a no-op).
-        requireMaxLength(normalized.description, "description", MAX_DESCRIPTION);
-        requireValidTags(normalized.tags);
+        (0, client_validation_js_1.requireMaxLength)(normalized.description, "description", client_limits_js_1.MAX_DESCRIPTION);
+        (0, client_validation_js_1.requireValidTags)(normalized.tags);
         const raw = await this.request("PATCH", `/v1/qurls/${encodeURIComponent(id)}`, normalized, options);
         return this.mapQurlsField(raw);
     }
@@ -3258,7 +1390,7 @@ class QURLClient {
      * server applies its 24h default expiration.
      */
     async mintLink(id, input, options) {
-        validatePathId(id, "mintLink", "id", RESOURCE_OR_QURL_ID_PATH_OPTIONS);
+        (0, client_paths_js_1.validatePathId)(id, "mintLink", "id", client_paths_js_1.RESOURCE_OR_QURL_ID_PATH_OPTIONS);
         // Normalize null → omitted so untyped-JS callers passing
         // `{ expires_in: null, expires_at: "..." }` don't leak null into
         // the wire body via JSON.stringify and don't bypass the XOR check
@@ -3266,15 +1398,15 @@ class QURLClient {
         // pattern used by update(); keeps the two write surfaces symmetric.
         let normalized = input;
         if (input !== undefined) {
-            requireObjectInput(input, "mintLink");
-            requireNoUnknownFields(input, MINT_FIELD_KEYS, "mintLink");
+            (0, client_validation_js_1.requireObjectInput)(input, "mintLink");
+            (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.MINT_FIELD_KEYS, "mintLink");
             // Iterate the explicit allowlist (matching update() / list())
             // so unknown keys from untyped-JS callers can't leak through
             // to the wire body. The compile-time `assertExhaustive` check
             // on MINT_FIELD_KEYS keeps this in sync with MintInput.
             const stripped = {};
             let hasAnyField = false;
-            for (const key of MINT_FIELD_KEYS) {
+            for (const key of client_input_fields_js_1.MINT_FIELD_KEYS) {
                 const value = input[key];
                 if (value !== null && value !== undefined) {
                     stripped[key] = value;
@@ -3287,16 +1419,16 @@ class QURLClient {
             normalized = hasAnyField ? stripped : undefined;
         }
         if (normalized !== undefined) {
-            requireNonEmptyIfPresent(normalized.expires_in, "expires_in");
-            requireNonEmptyIfPresent(normalized.expires_at, "expires_at");
+            (0, client_validation_js_1.requireNonEmptyIfPresent)(normalized.expires_in, "expires_in");
+            (0, client_validation_js_1.requireNonEmptyIfPresent)(normalized.expires_at, "expires_at");
             if (normalized.expires_in !== undefined && normalized.expires_at !== undefined) {
-                throw clientValidationError("mintLink: `expires_in` and `expires_at` are mutually exclusive — provide at most one");
+                throw (0, client_errors_js_1.clientValidationError)("mintLink: `expires_in` and `expires_at` are mutually exclusive — provide at most one");
             }
-            requireMaxLength(normalized.label, "label", MAX_LABEL);
-            requireNonEmptyIfPresent(normalized.label, "label");
-            requireNonEmptyIfPresent(normalized.session_duration, "session_duration");
-            requireMaxSessionsInRange(normalized.max_sessions);
-            requireValidAccessPolicy(normalized.access_policy);
+            (0, client_validation_js_1.requireMaxLength)(normalized.label, "label", client_limits_js_1.MAX_LABEL);
+            (0, client_validation_js_1.requireNonEmptyIfPresent)(normalized.label, "label");
+            (0, client_validation_js_1.requireNonEmptyIfPresent)(normalized.session_duration, "session_duration");
+            (0, client_validation_js_1.requireMaxSessionsInRange)(normalized.max_sessions);
+            (0, client_validation_js_1.requireValidAccessPolicy)(normalized.access_policy);
             // Duration *grammar* and access_policy contents are server-authoritative
             // (same rationale as validateCreateInput). Empty-string rejection happens
             // above; bound/unit checks happen server-side.
@@ -3319,29 +1451,47 @@ class QURLClient {
         let body;
         if (typeof input === "string") {
             if (input.length === 0) {
-                throw clientValidationError("resolve: access_token must be a non-empty string");
+                throw (0, client_errors_js_1.clientValidationError)("resolve: access_token must be a non-empty string");
             }
             body = { access_token: input };
         }
         else if (typeof input === "object" && input !== null) {
             if (typeof input.access_token !== "string" || input.access_token.length === 0) {
-                throw clientValidationError("resolve: access_token must be a non-empty string");
+                throw (0, client_errors_js_1.clientValidationError)("resolve: access_token must be a non-empty string");
             }
             // Allowlist-rebuild — symmetric with list()/update()/mintLink().
             body = { access_token: input.access_token };
         }
         else {
-            throw clientValidationError(`resolve: input must be a string or { access_token } object (got ${input === null ? "null" : typeof input})`);
+            throw (0, client_errors_js_1.clientValidationError)(`resolve: input must be a string or { access_token } object (got ${input === null ? "null" : typeof input})`);
         }
         return this.request("POST", "/v1/resolve", body, options);
     }
+    /** Get the caller's account and credential identity. */
+    async getIdentity() {
+        const identity = await this.request("GET", "/v1/me");
+        if (!identity ||
+            typeof identity !== "object" ||
+            Array.isArray(identity) ||
+            typeof identity.owner_id !== "string" ||
+            !identity.owner_id ||
+            typeof identity.auth_type !== "string" ||
+            !identity.auth_type ||
+            (identity.api_key !== undefined &&
+                (!identity.api_key ||
+                    typeof identity.api_key !== "object" ||
+                    Array.isArray(identity.api_key)))) {
+            throw (0, client_errors_js_1.unexpectedResponseError)("getIdentity: invalid caller identity response");
+        }
+        return identity;
+    }
     /** Get quota and usage information. */
     async getQuota() {
         return this.request("GET", "/v1/quota");
     }
     /** List resources from the `/v1/resources` API. */
     async listResources(input = {}) {
-        const { data, meta } = await this.rawRequest("GET", appendQuery("/v1/resources", input, RESOURCE_LIST_PARAM_KEYS, "listResources"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery("/v1/resources", input, client_input_fields_js_1.RESOURCE_LIST_PARAM_KEYS, "listResources"));
         return pageFromMeta({ resources: data ?? [] }, meta);
     }
     /**
@@ -3351,7 +1501,7 @@ class QURLClient {
      * iteration begins.
      */
     listAllResources(input = {}) {
-        validateListAllInput(input, RESOURCE_LIST_PARAM_KEYS, "listAllResources");
+        validateListAllInput(input, client_input_fields_js_1.RESOURCE_LIST_PARAM_KEYS, "listAllResources");
         return this.paginateAll("listAllResources", input, (pageInput) => this.listResources(pageInput), (page) => page.resources);
     }
     /**
@@ -3361,10 +1511,10 @@ class QURLClient {
      * a portal-minting handle).
      */
     async createResource(input, options) {
-        requireObjectInput(input, "createResource");
-        requireNoUnknownFields(input, CREATE_RESOURCE_FIELD_KEYS, "createResource");
-        const normalized = normalizePatchFields(input, CREATE_RESOURCE_FIELD_KEYS);
-        validateResourceWriteFields(normalized, {
+        (0, client_validation_js_1.requireObjectInput)(input, "createResource");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.CREATE_RESOURCE_FIELD_KEYS, "createResource");
+        const normalized = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.CREATE_RESOURCE_FIELD_KEYS);
+        (0, client_resources_js_1.validateResourceWriteFields)(normalized, {
             requireUrlTarget: true,
             validateFindOrCreate: true,
         });
@@ -3372,57 +1522,82 @@ class QURLClient {
     }
     /** Get one resource plus its bounded qURL preview. */
     async getResource(id) {
-        requireResourceCrid(id, "getResource");
+        (0, client_paths_js_1.requireResourceCrid)(id, "getResource");
         return this.request("GET", `/v1/resources/${encodeURIComponent(id)}`);
     }
     /** Update resource metadata. */
     async updateResource(id, input, options) {
-        requireResourceCrid(id, "updateResource");
-        requireObjectInput(input, "updateResource");
-        requireNoUnknownFields(input, UPDATE_RESOURCE_FIELD_KEYS, "updateResource");
-        const validationInput = normalizePatchFields(input, UPDATE_RESOURCE_FIELD_KEYS, { preserveNullFields: ["alias"] });
-        requireAtLeastOneField(validationInput, UPDATE_RESOURCE_FIELD_KEYS, "updateResource");
-        validateResourceWriteFields(validationInput, {
+        (0, client_paths_js_1.requireResourceCrid)(id, "updateResource");
+        (0, client_validation_js_1.requireObjectInput)(input, "updateResource");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.UPDATE_RESOURCE_FIELD_KEYS, "updateResource");
+        const validationInput = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.UPDATE_RESOURCE_FIELD_KEYS, { preserveNullFields: ["alias"] });
+        (0, client_validation_js_1.requireAtLeastOneField)(validationInput, client_input_fields_js_1.UPDATE_RESOURCE_FIELD_KEYS, "updateResource");
+        (0, client_resources_js_1.validateResourceWriteFields)(validationInput, {
             allowAliasClear: true,
             allowCustomDomainClear: true,
             validatePreserveHost: true,
         });
         return this.request("PATCH", `/v1/resources/${encodeURIComponent(id)}`, validationInput, options);
     }
+    /** Start Stripe Connect onboarding for this publisher. LayerV collects 3%. */
+    async connectPublisherStripe() {
+        const result = await this.request("POST", "/v1/payments/connect");
+        let target;
+        try {
+            target = new URL(result.url);
+        }
+        catch {
+            throw (0, client_errors_js_1.clientValidationError)("invalid Stripe connection URL");
+        }
+        if (target.protocol !== "https:" ||
+            target.host !== "connect.stripe.com" ||
+            target.username ||
+            target.password)
+            throw (0, client_errors_js_1.clientValidationError)("invalid Stripe connection URL");
+        return result;
+    }
+    /** Read this publisher's connected account and the fixed application fee. */
+    async publisherStripeAccount() {
+        const result = await this.request("GET", "/v1/payments/account");
+        if ((result.account_id !== "" && !/^acct_[A-Za-z0-9]{1,128}$/.test(result.account_id)) ||
+            result.layerv_fee_percent !== 3)
+            throw (0, client_errors_js_1.clientValidationError)("invalid Stripe account response");
+        return result;
+    }
     /** Send a publisher-only invitation. Mail delivery does not prove enrollment. */
     async inviteConsumer(id, email) {
-        requireResourceCrid(id, "inviteConsumer");
-        requireNonEmptyIfPresent(email, "email");
+        (0, client_paths_js_1.requireResourceCrid)(id, "inviteConsumer");
+        (0, client_validation_js_1.requireNonEmptyIfPresent)(email, "email");
         if (typeof email !== "string" || email.length > 320)
-            throw clientValidationError("email: must be a bounded string");
+            throw (0, client_errors_js_1.clientValidationError)("email: must be a bounded string");
         return this.request("POST", `/v1/resources/${encodeURIComponent(id)}/invitations`, { email });
     }
     async listConsumerInvitations(id, input = {}) {
-        requireResourceCrid(id, "listConsumerInvitations");
-        const { data, meta } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/invitations`, input, ["cursor", "limit"], "listConsumerInvitations"));
+        (0, client_paths_js_1.requireResourceCrid)(id, "listConsumerInvitations");
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/invitations`, input, ["cursor", "limit"], "listConsumerInvitations"));
         return pageFromMeta({ invitations: data ?? [] }, meta);
     }
     async listConsumerGrants(id, input = {}) {
-        requireResourceCrid(id, "listConsumerGrants");
-        const { data, meta } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/consumer-grants`, input, ["cursor", "limit"], "listConsumerGrants"));
+        (0, client_paths_js_1.requireResourceCrid)(id, "listConsumerGrants");
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/consumer-grants`, input, ["cursor", "limit"], "listConsumerGrants"));
         return pageFromMeta({ grants: data ?? [] }, meta);
     }
     async resendConsumerInvitation(id, invitationId, expectedVersion) {
-        requireResourceCrid(id, "resendConsumerInvitation");
-        requireConsumerDecision(invitationId, expectedVersion);
+        (0, client_paths_js_1.requireResourceCrid)(id, "resendConsumerInvitation");
+        (0, client_validation_js_1.requireConsumerDecision)(invitationId, expectedVersion);
         return this.request("POST", `/v1/resources/${encodeURIComponent(id)}/invitations/${encodeURIComponent(invitationId)}/resend`, { expected_version: expectedVersion });
     }
     /** Remove the invitation and its grant. Inspect session_cleanup before reporting stream removal. */
     async revokeConsumerInvitation(id, invitationId, expectedVersion) {
-        requireResourceCrid(id, "revokeConsumerInvitation");
-        requireConsumerDecision(invitationId, expectedVersion);
+        (0, client_paths_js_1.requireResourceCrid)(id, "revokeConsumerInvitation");
+        (0, client_validation_js_1.requireConsumerDecision)(invitationId, expectedVersion);
         return this.request("DELETE", `/v1/resources/${encodeURIComponent(id)}/invitations/${encodeURIComponent(invitationId)}?expected_version=${expectedVersion}`);
     }
     /** Review approval, key opt-in with grantId new, or trusted publisher entitlement. */
     async approveConsumerGrant(id, grantId, input) {
-        requireResourceCrid(id, "approveConsumerGrant");
-        requireObjectInput(input, "approveConsumerGrant");
-        requireNoUnknownFields(input, [
+        (0, client_paths_js_1.requireResourceCrid)(id, "approveConsumerGrant");
+        (0, client_validation_js_1.requireObjectInput)(input, "approveConsumerGrant");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, [
             "expected_version",
             "credential_kind",
             "credential_id",
@@ -3432,19 +1607,19 @@ class QURLClient {
         ], "approveConsumerGrant");
         if (input.credential_kind !== undefined &&
             !["passkey", "device"].includes(input.credential_kind)) {
-            throw clientValidationError("approveConsumerGrant: credential_kind must be passkey or device");
+            throw (0, client_errors_js_1.clientValidationError)("approveConsumerGrant: credential_kind must be passkey or device");
         }
-        requireConsumerDecision(grantId, input.expected_version, grantId === "new");
+        (0, client_validation_js_1.requireConsumerDecision)(grantId, input.expected_version, grantId === "new");
         return this.request("POST", `/v1/resources/${encodeURIComponent(id)}/consumer-grants/${encodeURIComponent(grantId)}/approve`, input);
     }
     async denyConsumerGrant(id, grantId, expectedVersion) {
-        requireResourceCrid(id, "denyConsumerGrant");
-        requireConsumerDecision(grantId, expectedVersion);
+        (0, client_paths_js_1.requireResourceCrid)(id, "denyConsumerGrant");
+        (0, client_validation_js_1.requireConsumerDecision)(grantId, expectedVersion);
         return this.request("POST", `/v1/resources/${encodeURIComponent(id)}/consumer-grants/${encodeURIComponent(grantId)}/deny`, { expected_version: expectedVersion });
     }
     async revokeConsumerGrant(id, grantId, expectedVersion) {
-        requireResourceCrid(id, "revokeConsumerGrant");
-        requireConsumerDecision(grantId, expectedVersion);
+        (0, client_paths_js_1.requireResourceCrid)(id, "revokeConsumerGrant");
+        (0, client_validation_js_1.requireConsumerDecision)(grantId, expectedVersion);
         return this.request("DELETE", `/v1/resources/${encodeURIComponent(id)}/consumer-grants/${encodeURIComponent(grantId)}?expected_version=${expectedVersion}`);
     }
     /**
@@ -3453,19 +1628,19 @@ class QURLClient {
      */
     async deleteResourceByIdentifier(id) {
         if (typeof id !== "string")
-            throw clientValidationError("id: invalid resource identifier");
+            throw (0, client_errors_js_1.clientValidationError)("id: invalid resource identifier");
         if (/^r_[a-z0-9_-]{11}$/.test(id)) {
             await this.requestNoContent(`/v1/qurls/${encodeURIComponent(id)}`);
             return;
         }
         const publicKey = /^[A-Za-z0-9_-]{107,214}$/.test(id) && id.length % 4 !== 1;
         if (!publicKey)
-            requireResourceCrid(id, "deleteResourceByIdentifier");
+            (0, client_paths_js_1.requireResourceCrid)(id, "deleteResourceByIdentifier");
         await this.requestNoContent(`/v1/resources/${encodeURIComponent(id)}`);
     }
     /** Revoke a resource and all of its qURLs. */
     async deleteResource(id) {
-        requireResourceCrid(id, "deleteResource");
+        (0, client_paths_js_1.requireResourceCrid)(id, "deleteResource");
         await this.requestNoContent(`/v1/resources/${encodeURIComponent(id)}`);
     }
     /**
@@ -3474,15 +1649,15 @@ class QURLClient {
      * Portal-flow equivalent: {@link createPortal} (same endpoint).
      */
     async createQurlForResource(id, input, options) {
-        requireResourceCrid(id, "createQurlForResource");
+        (0, client_paths_js_1.requireResourceCrid)(id, "createQurlForResource");
         let normalized = input;
         if (input !== undefined) {
-            requireObjectInput(input, "createQurlForResource");
-            requireNoUnknownFields(input, CREATE_QURL_FOR_RESOURCE_FIELD_KEYS, "createQurlForResource");
-            const stripped = normalizePatchFields(input, CREATE_QURL_FOR_RESOURCE_FIELD_KEYS);
+            (0, client_validation_js_1.requireObjectInput)(input, "createQurlForResource");
+            (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.CREATE_QURL_FOR_RESOURCE_FIELD_KEYS, "createQurlForResource");
+            const stripped = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.CREATE_QURL_FOR_RESOURCE_FIELD_KEYS);
             normalized = Object.keys(stripped).length > 0 ? stripped : undefined;
         }
-        validateQurlTokenOptions(normalized);
+        (0, client_resources_js_1.validateQurlTokenOptions)(normalized);
         return this.request("POST", `/v1/resources/${encodeURIComponent(id)}/qurls`, normalized, options);
     }
     /**
@@ -3492,36 +1667,36 @@ class QURLClient {
      * before delivery to verify that the response CRID derives from that key.
      */
     async shareResource(id, options = {}, requestOptions) {
-        requireResourceCrid(id, "shareResource");
-        requireObjectInput(options, "shareResource");
-        requireNoUnknownFields(options, SHARE_RESOURCE_OPTION_KEYS, "shareResource");
+        (0, client_paths_js_1.requireResourceCrid)(id, "shareResource");
+        (0, client_validation_js_1.requireObjectInput)(options, "shareResource");
+        (0, client_validation_js_1.requireNoUnknownFields)(options, client_input_fields_js_1.SHARE_RESOURCE_OPTION_KEYS, "shareResource");
         const body = {};
         if (options.ttlSeconds !== undefined) {
             if (typeof options.ttlSeconds !== "number" ||
                 !Number.isSafeInteger(options.ttlSeconds) ||
                 options.ttlSeconds <= 0) {
-                throw clientValidationError("shareResource: ttlSeconds must be a positive safe integer");
+                throw (0, client_errors_js_1.clientValidationError)("shareResource: ttlSeconds must be a positive safe integer");
             }
             body.ttl_seconds = options.ttlSeconds;
         }
         const data = await this.request("POST", `/v1/resources/${encodeURIComponent(id)}/share`, body, requestOptions);
         if (typeof data?.qurl !== "string" || data.qurl.trim() === "") {
-            throw unexpectedResponseError("shareResource: response is missing qurl");
+            throw (0, client_errors_js_1.unexpectedResponseError)("shareResource: response is missing qurl");
         }
         if (data.crid !== id) {
-            throw unexpectedResponseError("shareResource: response CRID does not match the requested CRID");
+            throw (0, client_errors_js_1.unexpectedResponseError)("shareResource: response CRID does not match the requested CRID");
         }
         const wire = data;
         for (const field of ["qurl_id", "type", "expires_at"]) {
             const value = wire[field];
             if (value !== undefined && value !== null && typeof value !== "string") {
-                throw unexpectedResponseError(`shareResource: response has invalid ${field}`);
+                throw (0, client_errors_js_1.unexpectedResponseError)(`shareResource: response has invalid ${field}`);
             }
         }
         for (const field of ["qurl_id", "type"]) {
             const value = wire[field];
             if (typeof value === "string" && (value.trim() === "" || value.trim() !== value)) {
-                throw unexpectedResponseError(`shareResource: response has invalid ${field}`);
+                throw (0, client_errors_js_1.unexpectedResponseError)(`shareResource: response has invalid ${field}`);
             }
         }
         if (wire.expires_in_seconds !== undefined &&
@@ -3529,18 +1704,18 @@ class QURLClient {
             (typeof wire.expires_in_seconds !== "number" ||
                 !Number.isSafeInteger(wire.expires_in_seconds) ||
                 wire.expires_in_seconds < 0)) {
-            throw unexpectedResponseError("shareResource: response has invalid expires_in_seconds");
+            throw (0, client_errors_js_1.unexpectedResponseError)("shareResource: response has invalid expires_in_seconds");
         }
         if (wire.single_use !== undefined &&
             wire.single_use !== null &&
             typeof wire.single_use !== "boolean") {
-            throw unexpectedResponseError("shareResource: response has invalid single_use");
+            throw (0, client_errors_js_1.unexpectedResponseError)("shareResource: response has invalid single_use");
         }
-        const expiresAt = parseApiDate(typeof wire.expires_at === "string" ? wire.expires_at : undefined);
+        const expiresAt = (0, client_portals_js_1.parseApiDate)(typeof wire.expires_at === "string" ? wire.expires_at : undefined);
         if (typeof wire.expires_at === "string" && expiresAt === undefined) {
-            throw unexpectedResponseError("shareResource: response has invalid expires_at");
+            throw (0, client_errors_js_1.unexpectedResponseError)("shareResource: response has invalid expires_at");
         }
-        return new share_js_1.ShareLink({
+        return new share_js_1.ShareLink((0, response_metadata_js_1.copyResponseMetadata)(data, {
             // Repair transport-only edge whitespace on the one-time credential;
             // ancillary identifiers fail closed instead of being normalized.
             link: data.qurl.trim(),
@@ -3550,45 +1725,45 @@ class QURLClient {
             expiresAt,
             expiresInSeconds: typeof wire.expires_in_seconds === "number" ? wire.expires_in_seconds : undefined,
             singleUse: typeof wire.single_use === "boolean" ? wire.single_use : undefined,
-        });
+        }));
     }
     /** Revoke a specific qURL token on a resource. */
     async revokeResourceQurl(id, qurlId) {
-        requireResourceCrid(id, "revokeResourceQurl");
-        validatePathId(qurlId, "revokeResourceQurl", "qurl id", QURL_ID_PATH_OPTIONS);
+        (0, client_paths_js_1.requireResourceCrid)(id, "revokeResourceQurl");
+        (0, client_paths_js_1.validatePathId)(qurlId, "revokeResourceQurl", "qurl id", client_paths_js_1.QURL_ID_PATH_OPTIONS);
         await this.requestNoContent(`/v1/resources/${encodeURIComponent(id)}/qurls/${encodeURIComponent(qurlId)}`);
     }
     /** Update a specific qURL token on a resource. */
     async updateResourceQurl(id, qurlId, input, options) {
-        requireResourceCrid(id, "updateResourceQurl");
-        validatePathId(qurlId, "updateResourceQurl", "qurl id", QURL_ID_PATH_OPTIONS);
-        requireObjectInput(input, "updateResourceQurl");
-        requireNoUnknownFields(input, UPDATE_RESOURCE_QURL_FIELD_KEYS, "updateResourceQurl");
-        const normalized = normalizePatchFields(input, UPDATE_RESOURCE_QURL_FIELD_KEYS);
-        requireAtLeastOneField(normalized, UPDATE_RESOURCE_QURL_FIELD_KEYS, "updateResourceQurl");
-        validateResourceQurlUpdateInput(normalized);
+        (0, client_paths_js_1.requireResourceCrid)(id, "updateResourceQurl");
+        (0, client_paths_js_1.validatePathId)(qurlId, "updateResourceQurl", "qurl id", client_paths_js_1.QURL_ID_PATH_OPTIONS);
+        (0, client_validation_js_1.requireObjectInput)(input, "updateResourceQurl");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.UPDATE_RESOURCE_QURL_FIELD_KEYS, "updateResourceQurl");
+        const normalized = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.UPDATE_RESOURCE_QURL_FIELD_KEYS);
+        (0, client_validation_js_1.requireAtLeastOneField)(normalized, client_input_fields_js_1.UPDATE_RESOURCE_QURL_FIELD_KEYS, "updateResourceQurl");
+        (0, client_resources_js_1.validateResourceQurlUpdateInput)(normalized);
         return this.request("PATCH", `/v1/resources/${encodeURIComponent(id)}/qurls/${encodeURIComponent(qurlId)}`, normalized, options);
     }
     /** List every active session, following bounded service pages. */
     async listResourceSessions(id) {
-        requireResourceCrid(id, "listResourceSessions");
+        (0, client_paths_js_1.requireResourceCrid)(id, "listResourceSessions");
         const sessions = [];
         let request_id;
         let page_size;
         for await (const session of this.paginateAll("listResourceSessions", {}, async ({ cursor }) => {
-            const { data, meta } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/sessions`, { paged: "true", cursor }, ["paged", "cursor"], "listResourceSessions"));
+            const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery(`/v1/resources/${encodeURIComponent(id)}/sessions`, { paged: "true", cursor }, ["paged", "cursor"], "listResourceSessions"));
             if (meta?.has_more && !meta.next_cursor) {
-                throw unexpectedResponseError("Session page has no continuation cursor", {
+                throw (0, client_errors_js_1.unexpectedResponseError)("Session page has no continuation cursor", {
                     requestId: meta.request_id,
                 });
             }
             request_id = meta?.request_id;
             page_size = meta?.page_size;
-            return { ...meta, sessions: data ?? [] };
+            return withEnvelopeMetadata({ ...meta, sessions: data ?? [] }, meta);
         }, (page) => page.sessions)) {
             sessions.push(session);
         }
-        return { sessions, request_id, has_more: false, page_size };
+        return withEnvelopeMetadata({ sessions, request_id, has_more: false, page_size }, { request_id });
     }
     /**
      * End every session page. This is not atomic: a failed page throws after earlier
@@ -3596,46 +1771,43 @@ class QURLClient {
      * A retry can close newly admitted sessions and counts only its own transitions.
      */
     async terminateAllResourceSessions(id) {
-        requireResourceCrid(id, "terminateAllResourceSessions");
+        (0, client_paths_js_1.requireResourceCrid)(id, "terminateAllResourceSessions");
         const path = `/v1/resources/${encodeURIComponent(id)}/sessions`;
         let terminated = 0;
         let request_id;
         for await (const count of this.paginateAll("terminateAllResourceSessions", {}, async ({ cursor }) => {
-            const { data, meta, __http_status } = await this.rawRequest("DELETE", appendQuery(path, { paged: "true", cursor }, ["paged", "cursor"], "terminateAllResourceSessions"));
-            if (__http_status === 204) {
-                throw unexpectedResponseError(`Unexpected 204 No Content from DELETE ${path}; expected response body`, { status: 204, requestId: meta?.request_id });
+            const { envelope: { data, meta }, status: httpStatus, } = await this.rawRequest("DELETE", appendQuery(path, { paged: "true", cursor }, ["paged", "cursor"], "terminateAllResourceSessions"));
+            if (httpStatus === 204) {
+                throw (0, client_errors_js_1.unexpectedResponseError)(`Unexpected 204 No Content from DELETE ${path}; expected response body`, { status: 204, requestId: meta?.request_id });
             }
             if (meta?.has_more && !meta.next_cursor) {
-                throw unexpectedResponseError("Session page has no continuation cursor", {
+                throw (0, client_errors_js_1.unexpectedResponseError)("Session page has no continuation cursor", {
                     requestId: meta.request_id,
                 });
             }
-            if (data?.terminated === undefined) {
-                this.log("terminateAllResourceSessions: missing terminated count; defaulting to zero", {
-                    request_id: meta?.request_id,
-                });
-            }
-            else if (!Number.isSafeInteger(data.terminated) || data.terminated < 0) {
-                throw unexpectedResponseError("terminateAllResourceSessions: invalid terminated count", {
-                    requestId: meta?.request_id,
-                });
+            const count = data?.terminated;
+            if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0) {
+                throw (0, client_errors_js_1.unexpectedResponseError)("terminateAllResourceSessions: missing or invalid terminated count; inspect sessions before retrying", { requestId: meta?.request_id });
             }
             request_id = meta?.request_id;
-            return { ...meta, counts: [data?.terminated ?? 0] };
+            return withEnvelopeMetadata({ ...meta, counts: [count] }, meta);
         }, (page) => page.counts)) {
             terminated += count;
+            if (!Number.isSafeInteger(terminated)) {
+                throw (0, client_errors_js_1.unexpectedResponseError)("terminateAllResourceSessions: total exceeds safe integer range; inspect sessions before retrying", { requestId: request_id });
+            }
         }
-        return { terminated, request_id };
+        return withEnvelopeMetadata({ terminated, request_id }, { request_id });
     }
     /** Terminate a specific resource session. */
     async terminateResourceSession(id, sessionId) {
-        requireResourceCrid(id, "terminateResourceSession");
-        validatePathId(sessionId, "terminateResourceSession", "session id");
+        (0, client_paths_js_1.requireResourceCrid)(id, "terminateResourceSession");
+        (0, client_paths_js_1.validatePathId)(sessionId, "terminateResourceSession", "session id");
         await this.requestNoContent(`/v1/resources/${encodeURIComponent(id)}/sessions/${encodeURIComponent(sessionId)}`);
     }
     /** List connector installations. */
     async listConnectorInstallations(input = {}) {
-        const { data, meta } = await this.rawRequest("GET", appendQuery("/v1/connectors/installations", input, CONNECTOR_INSTALLATION_LIST_PARAM_KEYS, "listConnectorInstallations"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery("/v1/connectors/installations", input, client_input_fields_js_1.CONNECTOR_INSTALLATION_LIST_PARAM_KEYS, "listConnectorInstallations"));
         return pageFromMeta({ installations: data ?? [] }, meta);
     }
     /**
@@ -3645,7 +1817,7 @@ class QURLClient {
      * iteration begins.
      */
     listAllConnectorInstallations(input = {}) {
-        validateListAllInput(input, CONNECTOR_INSTALLATION_LIST_PARAM_KEYS, "listAllConnectorInstallations");
+        validateListAllInput(input, client_input_fields_js_1.CONNECTOR_INSTALLATION_LIST_PARAM_KEYS, "listAllConnectorInstallations");
         return this.paginateAll("listAllConnectorInstallations", input, (pageInput) => this.listConnectorInstallations(pageInput), (page) => page.installations);
     }
     /** Get current-period usage. */
@@ -3662,27 +1834,27 @@ class QURLClient {
     }
     /** Update customer settings. */
     async updateCustomer(input, options) {
-        requireObjectInput(input, "updateCustomer");
-        requireNoUnknownFields(input, UPDATE_CUSTOMER_FIELD_KEYS, "updateCustomer");
-        const normalizedRecord = normalizePatchFields(input, UPDATE_CUSTOMER_FIELD_KEYS);
+        (0, client_validation_js_1.requireObjectInput)(input, "updateCustomer");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.UPDATE_CUSTOMER_FIELD_KEYS, "updateCustomer");
+        const normalizedRecord = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.UPDATE_CUSTOMER_FIELD_KEYS);
         const normalized = normalizedRecord;
         const spendingCap = normalized.spending_cap_cents;
         if (spendingCap === undefined) {
-            throw clientValidationError("updateCustomer: spending_cap_cents is required");
+            throw (0, client_errors_js_1.clientValidationError)("updateCustomer: spending_cap_cents is required");
         }
         if (!Number.isInteger(spendingCap) || spendingCap < 0) {
-            const rendered = typeof spendingCap === "number" ? String(spendingCap) : describeShape(spendingCap);
-            throw clientValidationError(`updateCustomer: spending_cap_cents must be a non-negative integer (got ${rendered})`);
+            const rendered = typeof spendingCap === "number" ? String(spendingCap) : (0, client_validation_js_1.describeShape)(spendingCap);
+            throw (0, client_errors_js_1.clientValidationError)(`updateCustomer: spending_cap_cents must be a non-negative integer (got ${rendered})`);
         }
         return this.request("PATCH", "/v1/customer", normalized, options);
     }
     /** Create a Stripe checkout session. */
     async createBillingCheckout(input, options) {
-        requireObjectInput(input, "createBillingCheckout");
-        requireNoUnknownFields(input, CREATE_BILLING_CHECKOUT_FIELD_KEYS, "createBillingCheckout");
-        const normalizedRecord = normalizePatchFields(input, CREATE_BILLING_CHECKOUT_FIELD_KEYS);
+        (0, client_validation_js_1.requireObjectInput)(input, "createBillingCheckout");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.CREATE_BILLING_CHECKOUT_FIELD_KEYS, "createBillingCheckout");
+        const normalizedRecord = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.CREATE_BILLING_CHECKOUT_FIELD_KEYS);
         const normalized = normalizedRecord;
-        requireNonEmptyStringField(normalizedRecord, "plan", "createBillingCheckout");
+        (0, client_validation_js_1.requireNonEmptyStringField)(normalizedRecord, "plan", "createBillingCheckout");
         return this.request("POST", "/v1/billing/checkout", normalized, options);
     }
     /** Create a Stripe billing portal session. */
@@ -3693,7 +1865,7 @@ class QURLClient {
     async listBillingInvoices(input = {}) {
         // This endpoint nests the list in `data.invoices` unlike the other list
         // endpoints, which return `data` as the array directly.
-        const { data, meta } = await this.rawRequest("GET", appendQuery("/v1/billing/invoices", input, BILLING_INVOICE_LIST_PARAM_KEYS, "listBillingInvoices"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery("/v1/billing/invoices", input, client_input_fields_js_1.BILLING_INVOICE_LIST_PARAM_KEYS, "listBillingInvoices"));
         return pageFromMeta({ invoices: data?.invoices ?? [] }, meta);
     }
     /**
@@ -3703,22 +1875,22 @@ class QURLClient {
      * iteration begins.
      */
     listAllBillingInvoices(input = {}) {
-        validateListAllInput(input, BILLING_INVOICE_LIST_PARAM_KEYS, "listAllBillingInvoices");
+        validateListAllInput(input, client_input_fields_js_1.BILLING_INVOICE_LIST_PARAM_KEYS, "listAllBillingInvoices");
         return this.paginateAll("listAllBillingInvoices", input, (pageInput) => this.listBillingInvoices(pageInput), (page) => page.invoices);
     }
     /** Register a custom domain. */
     async registerDomain(input, options) {
-        requireObjectInput(input, "registerDomain");
-        requireNoUnknownFields(input, REGISTER_DOMAIN_FIELD_KEYS, "registerDomain");
-        const normalizedRecord = normalizePatchFields(input, REGISTER_DOMAIN_FIELD_KEYS);
+        (0, client_validation_js_1.requireObjectInput)(input, "registerDomain");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.REGISTER_DOMAIN_FIELD_KEYS, "registerDomain");
+        const normalizedRecord = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.REGISTER_DOMAIN_FIELD_KEYS);
         const normalized = normalizedRecord;
-        requireNonEmptyStringField(normalizedRecord, "domain", "registerDomain");
-        requireMaxLength(normalized.domain, "domain", MAX_CUSTOM_DOMAIN);
+        (0, client_validation_js_1.requireNonEmptyStringField)(normalizedRecord, "domain", "registerDomain");
+        (0, client_validation_js_1.requireMaxLength)(normalized.domain, "domain", client_limits_js_1.MAX_CUSTOM_DOMAIN);
         return this.request("POST", "/v1/domains", normalized, options);
     }
     /** List custom domains. */
     async listDomains(input = {}) {
-        const { data, meta } = await this.rawRequest("GET", appendQuery("/v1/domains", input, DOMAIN_LIST_PARAM_KEYS, "listDomains"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery("/v1/domains", input, client_input_fields_js_1.DOMAIN_LIST_PARAM_KEYS, "listDomains"));
         return pageFromMeta({ domains: data ?? [] }, meta);
     }
     /**
@@ -3728,32 +1900,32 @@ class QURLClient {
      * iteration begins.
      */
     listAllDomains(input = {}) {
-        validateListAllInput(input, DOMAIN_LIST_PARAM_KEYS, "listAllDomains");
+        validateListAllInput(input, client_input_fields_js_1.DOMAIN_LIST_PARAM_KEYS, "listAllDomains");
         return this.paginateAll("listAllDomains", input, (pageInput) => this.listDomains(pageInput), (page) => page.domains);
     }
     /** Get custom domain status. */
     async getDomain(domain) {
-        validatePathId(domain, "getDomain", "domain");
+        (0, client_paths_js_1.validatePathId)(domain, "getDomain", "domain");
         return this.request("GET", `/v1/domains/${encodeURIComponent(domain)}`);
     }
     /** Remove a custom domain. */
     async deleteDomain(domain) {
-        validatePathId(domain, "deleteDomain", "domain");
+        (0, client_paths_js_1.validatePathId)(domain, "deleteDomain", "domain");
         await this.requestNoContent(`/v1/domains/${encodeURIComponent(domain)}`);
     }
     /** Trigger DNS verification for a custom domain. */
     async verifyDomain(domain, options) {
-        validatePathId(domain, "verifyDomain", "domain");
+        (0, client_paths_js_1.validatePathId)(domain, "verifyDomain", "domain");
         return this.request("POST", `/v1/domains/${encodeURIComponent(domain)}/verify`, undefined, options);
     }
     /** Regenerate a domain verification token. */
     async regenerateDomainToken(domain, options) {
-        validatePathId(domain, "regenerateDomainToken", "domain");
+        (0, client_paths_js_1.validatePathId)(domain, "regenerateDomainToken", "domain");
         return this.request("POST", `/v1/domains/${encodeURIComponent(domain)}/regenerate-token`, undefined, options);
     }
     /** List webhooks. */
     async listWebhooks(input = {}) {
-        const { data, meta } = await this.rawRequest("GET", appendQuery("/v1/webhooks", input, WEBHOOK_LIST_PARAM_KEYS, "listWebhooks"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery("/v1/webhooks", input, client_input_fields_js_1.WEBHOOK_LIST_PARAM_KEYS, "listWebhooks"));
         return pageFromMeta({ webhooks: data ?? [] }, meta);
     }
     /**
@@ -3763,16 +1935,16 @@ class QURLClient {
      * iteration begins.
      */
     listAllWebhooks(input = {}) {
-        validateListAllInput(input, WEBHOOK_LIST_PARAM_KEYS, "listAllWebhooks");
+        validateListAllInput(input, client_input_fields_js_1.WEBHOOK_LIST_PARAM_KEYS, "listAllWebhooks");
         return this.paginateAll("listAllWebhooks", input, (pageInput) => this.listWebhooks(pageInput), (page) => page.webhooks);
     }
     /** Create a webhook. */
     async createWebhook(input, options) {
-        requireObjectInput(input, "createWebhook");
-        requireNoUnknownFields(input, CREATE_WEBHOOK_FIELD_KEYS, "createWebhook");
-        const normalizedRecord = normalizePatchFields(input, CREATE_WEBHOOK_FIELD_KEYS);
+        (0, client_validation_js_1.requireObjectInput)(input, "createWebhook");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.CREATE_WEBHOOK_FIELD_KEYS, "createWebhook");
+        const normalizedRecord = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.CREATE_WEBHOOK_FIELD_KEYS);
         const normalized = normalizedRecord;
-        validateWebhookWriteFields(normalizedRecord, "createWebhook", {
+        (0, client_management_js_1.validateWebhookWriteFields)(normalizedRecord, "createWebhook", {
             url: true,
             events: true,
         });
@@ -3784,33 +1956,33 @@ class QURLClient {
     }
     /** Get a webhook. */
     async getWebhook(id) {
-        validatePathId(id, "getWebhook");
+        (0, client_paths_js_1.validatePathId)(id, "getWebhook");
         return this.request("GET", `/v1/webhooks/${encodeURIComponent(id)}`);
     }
     /** Update a webhook. */
     async updateWebhook(id, input, options) {
-        validatePathId(id, "updateWebhook");
-        requireObjectInput(input, "updateWebhook");
-        requireNoUnknownFields(input, UPDATE_WEBHOOK_FIELD_KEYS, "updateWebhook");
-        const normalized = normalizePatchFields(input, UPDATE_WEBHOOK_FIELD_KEYS);
-        requireAtLeastOneField(normalized, UPDATE_WEBHOOK_FIELD_KEYS, "updateWebhook");
-        validateWebhookWriteFields(normalized, "updateWebhook");
+        (0, client_paths_js_1.validatePathId)(id, "updateWebhook");
+        (0, client_validation_js_1.requireObjectInput)(input, "updateWebhook");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.UPDATE_WEBHOOK_FIELD_KEYS, "updateWebhook");
+        const normalized = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.UPDATE_WEBHOOK_FIELD_KEYS);
+        (0, client_validation_js_1.requireAtLeastOneField)(normalized, client_input_fields_js_1.UPDATE_WEBHOOK_FIELD_KEYS, "updateWebhook");
+        (0, client_management_js_1.validateWebhookWriteFields)(normalized, "updateWebhook");
         return this.request("PATCH", `/v1/webhooks/${encodeURIComponent(id)}`, normalized, options);
     }
     /** Delete a webhook. */
     async deleteWebhook(id) {
-        validatePathId(id, "deleteWebhook");
+        (0, client_paths_js_1.validatePathId)(id, "deleteWebhook");
         await this.requestNoContent(`/v1/webhooks/${encodeURIComponent(id)}`);
     }
     /** Regenerate a webhook signing secret. */
     async regenerateWebhookSecret(id, options) {
-        validatePathId(id, "regenerateWebhookSecret");
+        (0, client_paths_js_1.validatePathId)(id, "regenerateWebhookSecret");
         return this.request("POST", `/v1/webhooks/${encodeURIComponent(id)}/secret`, undefined, options);
     }
     /** List delivery attempts for a webhook. */
     async listWebhookDeliveries(id, input = {}) {
-        validatePathId(id, "listWebhookDeliveries");
-        const { data, meta } = await this.rawRequest("GET", appendQuery(`/v1/webhooks/${encodeURIComponent(id)}/deliveries`, input, WEBHOOK_DELIVERY_LIST_PARAM_KEYS, "listWebhookDeliveries"));
+        (0, client_paths_js_1.validatePathId)(id, "listWebhookDeliveries");
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery(`/v1/webhooks/${encodeURIComponent(id)}/deliveries`, input, client_input_fields_js_1.WEBHOOK_DELIVERY_LIST_PARAM_KEYS, "listWebhookDeliveries"));
         return pageFromMeta({ deliveries: data ?? [] }, meta);
     }
     /**
@@ -3820,20 +1992,101 @@ class QURLClient {
      * iteration begins.
      */
     listAllWebhookDeliveries(id, input = {}) {
-        validatePathId(id, "listAllWebhookDeliveries");
-        validateListAllInput(input, WEBHOOK_DELIVERY_LIST_PARAM_KEYS, "listAllWebhookDeliveries");
+        (0, client_paths_js_1.validatePathId)(id, "listAllWebhookDeliveries");
+        validateListAllInput(input, client_input_fields_js_1.WEBHOOK_DELIVERY_LIST_PARAM_KEYS, "listAllWebhookDeliveries");
         return this.paginateAll("listAllWebhookDeliveries", input, (pageInput) => this.listWebhookDeliveries(id, pageInput), (page) => page.deliveries);
     }
+    /**
+     * Bind an external identity using the provider's trusted OAuth JWT as the
+     * client's bearer credential. Persist the request key before calling, then
+     * securely store the returned one-time plaintext key without logging it.
+     * Retry a lost response within 24 hours with the same key and body.
+     */
+    async createExternalIdentityBinding(input, options) {
+        const method = "createExternalIdentityBinding";
+        (0, client_validation_js_1.requireObjectInput)(input, method);
+        (0, client_validation_js_1.requireNoUnknownFields)(input, ["provider", "external_id", "display_name", "rotate_existing"], method);
+        if (!["slack", "discord", "teams"].includes(input.provider)) {
+            throw (0, client_errors_js_1.clientValidationError)(`${method}: provider must be slack, discord, or teams`);
+        }
+        if (typeof input.external_id !== "string" ||
+            input.external_id.length > 256 ||
+            !/^[\x21-\x22\x24-\x7e]+$/.test(input.external_id)) {
+            throw (0, client_errors_js_1.clientValidationError)(`${method}: external_id must contain 1-256 visible ASCII characters without #`);
+        }
+        if (input.display_name !== undefined &&
+            (typeof input.display_name !== "string" ||
+                [...input.display_name].length > 100 ||
+                /[\uD800-\uDFFF]/u.test(input.display_name))) {
+            throw (0, client_errors_js_1.clientValidationError)(`${method}: display_name must contain at most 100 Unicode characters`);
+        }
+        (0, client_validation_js_1.requireBooleanIfPresent)(input.rotate_existing, `${method}.rotate_existing`);
+        validateRequestOptions(options);
+        if (!options?.idempotencyKey || options.idempotencyKey.length < 32) {
+            throw (0, client_errors_js_1.clientValidationError)(`${method}: a persisted idempotencyKey of 32-256 characters is required`);
+        }
+        const body = {
+            provider: input.provider,
+            external_id: input.external_id,
+            ...(input.display_name !== undefined ? { display_name: input.display_name } : {}),
+            ...(input.rotate_existing !== undefined ? { rotate_existing: input.rotate_existing } : {}),
+        };
+        const raw = await this.rawRequest("POST", "/v1/external-identity-bindings", body, {
+            requestOptions: options,
+            generateIdempotencyKey: false,
+        });
+        // This operation returns a flat document, unlike the data/meta endpoints.
+        const result = raw.envelope;
+        const expectedScopes = body.provider === "discord"
+            ? ["qurl:read", "qurl:write"]
+            : ["qurl:read", "qurl:write", "qurl:agent"];
+        if (raw.status !== 201 ||
+            typeof result.binding_id !== "string" ||
+            !/^eib_[A-Za-z0-9]{11}$/.test(result.binding_id) ||
+            result.provider !== body.provider ||
+            result.external_id !== body.external_id ||
+            !result.api_key ||
+            typeof result.api_key !== "object" ||
+            Array.isArray(result.api_key) ||
+            typeof result.api_key.key_id !== "string" ||
+            !/^key_[A-Za-z0-9]{12}$/.test(result.api_key.key_id) ||
+            typeof result.api_key.plaintext !== "string" ||
+            !/^lv_(?:live|test)_[A-Za-z0-9_-]{43}$/.test(result.api_key.plaintext) ||
+            result.api_key.key_prefix !== result.api_key.plaintext.slice(0, 12) ||
+            !Array.isArray(result.scopes) ||
+            result.scopes.length !== expectedScopes.length ||
+            !expectedScopes.every((scope) => result.scopes.includes(scope)) ||
+            !(0, client_delegated_js_1.isUtcTimestamp)(result.created_at) ||
+            (result.display_name !== undefined &&
+                (typeof result.display_name !== "string" ||
+                    [...result.display_name].length > 100 ||
+                    /[\uD800-\uDFFF]/u.test(result.display_name)))) {
+            throw (0, client_errors_js_1.unexpectedResponseError)(`${method}: invalid binding response; reconcile with the same request key before retrying`);
+        }
+        return withEnvelopeMetadata({
+            binding_id: result.binding_id,
+            provider: result.provider,
+            external_id: result.external_id,
+            ...(result.display_name !== undefined ? { display_name: result.display_name } : {}),
+            api_key: {
+                key_id: result.api_key.key_id,
+                key_prefix: result.api_key.key_prefix,
+                plaintext: result.api_key.plaintext,
+            },
+            scopes: result.scopes,
+            created_at: result.created_at,
+        }, raw.envelope.meta);
+    }
     /** Create a new API key. */
     async createApiKey(input, options) {
-        requireObjectInput(input, "createApiKey");
-        requireNoUnknownFields(input, CREATE_API_KEY_FIELD_KEYS, "createApiKey");
-        const normalizedRecord = normalizePatchFields(input, CREATE_API_KEY_FIELD_KEYS);
+        (0, client_validation_js_1.requireObjectInput)(input, "createApiKey");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.CREATE_API_KEY_FIELD_KEYS, "createApiKey");
+        const normalizedRecord = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.CREATE_API_KEY_FIELD_KEYS);
         // `kind` is required by the server and has no default there. Filling it
         // in keeps the common durable-key call site unchanged.
         normalizedRecord.kind ??= "api_key";
         if (normalizedRecord.kind !== "api_key" && normalizedRecord.kind !== "enrollment_token") {
-            throw clientValidationError("createApiKey: kind must be 'api_key' or 'enrollment_token'");
+            throw (0, client_errors_js_1.clientValidationError)("createApiKey: kind must be 'api_key' or 'enrollment_token'");
         }
         // `scopes` and `target`/`claims` are mutually exclusive by kind, and the
         // server rejects either mismatch with 400 invalid_input. Fail both
@@ -3841,20 +2094,20 @@ class QURLClient {
         const isEnrollmentToken = normalizedRecord.kind === "enrollment_token";
         if (isEnrollmentToken) {
             if (normalizedRecord.scopes !== undefined) {
-                throw clientValidationError("createApiKey: scopes is not accepted for kind 'enrollment_token'; " +
+                throw (0, client_errors_js_1.clientValidationError)("createApiKey: scopes is not accepted for kind 'enrollment_token'; " +
                     "the server assigns them from target");
             }
-            validateEnrollmentTokenFields(normalizedRecord, "createApiKey");
+            (0, client_management_js_1.validateEnrollmentTokenFields)(normalizedRecord, "createApiKey");
         }
         else {
             for (const field of ["target", "claims", "expires_in"]) {
                 if (normalizedRecord[field] !== undefined) {
-                    throw clientValidationError(`createApiKey: ${field} is only accepted for kind 'enrollment_token'`);
+                    throw (0, client_errors_js_1.clientValidationError)(`createApiKey: ${field} is only accepted for kind 'enrollment_token'`);
                 }
             }
         }
         const normalized = normalizedRecord;
-        validateApiKeyWriteFields(normalizedRecord, "createApiKey", {
+        (0, client_management_js_1.validateApiKeyWriteFields)(normalizedRecord, "createApiKey", {
             name: true,
             scopes: !isEnrollmentToken,
         });
@@ -3862,7 +2115,7 @@ class QURLClient {
     }
     /** List API keys. */
     async listApiKeys(input = {}) {
-        const { data, meta } = await this.rawRequest("GET", appendQuery("/v1/api-keys", input, API_KEY_LIST_PARAM_KEYS, "listApiKeys"));
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", appendQuery("/v1/api-keys", input, client_input_fields_js_1.API_KEY_LIST_PARAM_KEYS, "listApiKeys"));
         return pageFromMeta({ api_keys: data ?? [] }, meta);
     }
     /**
@@ -3872,40 +2125,40 @@ class QURLClient {
      * iteration begins.
      */
     listAllApiKeys(input = {}) {
-        validateListAllInput(input, API_KEY_LIST_PARAM_KEYS, "listAllApiKeys");
+        validateListAllInput(input, client_input_fields_js_1.API_KEY_LIST_PARAM_KEYS, "listAllApiKeys");
         return this.paginateAll("listAllApiKeys", input, (pageInput) => this.listApiKeys(pageInput), (page) => page.api_keys);
     }
     /** Update an API key. */
     async updateApiKey(keyId, input, options) {
-        validatePathId(keyId, "updateApiKey");
-        requireObjectInput(input, "updateApiKey");
-        requireNoUnknownFields(input, UPDATE_API_KEY_FIELD_KEYS, "updateApiKey");
-        const normalized = normalizePatchFields(input, UPDATE_API_KEY_FIELD_KEYS);
-        requireAtLeastOneField(normalized, UPDATE_API_KEY_FIELD_KEYS, "updateApiKey");
-        validateApiKeyWriteFields(normalized, "updateApiKey");
+        (0, client_paths_js_1.validatePathId)(keyId, "updateApiKey");
+        (0, client_validation_js_1.requireObjectInput)(input, "updateApiKey");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.UPDATE_API_KEY_FIELD_KEYS, "updateApiKey");
+        const normalized = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.UPDATE_API_KEY_FIELD_KEYS);
+        (0, client_validation_js_1.requireAtLeastOneField)(normalized, client_input_fields_js_1.UPDATE_API_KEY_FIELD_KEYS, "updateApiKey");
+        (0, client_management_js_1.validateApiKeyWriteFields)(normalized, "updateApiKey");
         return this.request("PATCH", `/v1/api-keys/${encodeURIComponent(keyId)}`, normalized, options);
     }
     /** Revoke an API key. */
     async revokeApiKey(keyId) {
-        validatePathId(keyId, "revokeApiKey");
+        (0, client_paths_js_1.validatePathId)(keyId, "revokeApiKey");
         await this.requestNoContent(`/v1/api-keys/${encodeURIComponent(keyId)}`);
     }
     /** Redeem an access code. */
     async redeemAccessCode(input, options) {
-        requireObjectInput(input, "redeemAccessCode");
-        requireNoUnknownFields(input, REDEEM_ACCESS_CODE_FIELD_KEYS, "redeemAccessCode");
-        const normalizedRecord = normalizePatchFields(input, REDEEM_ACCESS_CODE_FIELD_KEYS);
+        (0, client_validation_js_1.requireObjectInput)(input, "redeemAccessCode");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.REDEEM_ACCESS_CODE_FIELD_KEYS, "redeemAccessCode");
+        const normalizedRecord = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.REDEEM_ACCESS_CODE_FIELD_KEYS);
         const normalized = normalizedRecord;
-        requireNonEmptyStringField(normalizedRecord, "code", "redeemAccessCode");
+        (0, client_validation_js_1.requireNonEmptyStringField)(normalizedRecord, "code", "redeemAccessCode");
         return this.request("POST", "/v1/access-codes/redeem", normalized, options);
     }
     /** Create an access code. */
     async createAccessCode(input, options) {
-        requireObjectInput(input, "createAccessCode");
-        requireNoUnknownFields(input, CREATE_ACCESS_CODE_FIELD_KEYS, "createAccessCode");
-        const normalizedRecord = normalizePatchFields(input, CREATE_ACCESS_CODE_FIELD_KEYS);
+        (0, client_validation_js_1.requireObjectInput)(input, "createAccessCode");
+        (0, client_validation_js_1.requireNoUnknownFields)(input, client_input_fields_js_1.CREATE_ACCESS_CODE_FIELD_KEYS, "createAccessCode");
+        const normalizedRecord = (0, client_validation_js_1.normalizePatchFields)(input, client_input_fields_js_1.CREATE_ACCESS_CODE_FIELD_KEYS);
         const normalized = normalizedRecord;
-        requireResourceCrid(normalizedRecord.resource_id, "createAccessCode", "resource_id");
+        (0, client_paths_js_1.requireResourceCrid)(normalizedRecord.resource_id, "createAccessCode", "resource_id");
         return this.request("POST", "/v1/access-codes", normalized, options);
     }
     /**
@@ -3916,36 +2169,36 @@ class QURLClient {
      * this page and emits a debug log rather than pretending it fetched all pages.
      */
     async listAccessCodes() {
-        const { data, meta } = await this.rawRequest("GET", "/v1/access-codes");
+        const { envelope: { data, meta }, } = await this.rawRequest("GET", "/v1/access-codes");
         if (meta?.has_more || meta?.next_cursor) {
             this.log("listAccessCodes: pagination metadata surfaced on unpaginated endpoint", {
                 has_more: meta.has_more,
                 next_cursor: meta.next_cursor,
             });
         }
-        return {
+        return withEnvelopeMetadata({
             access_codes: data ?? [],
             request_id: meta?.request_id,
             has_more: false,
             page_size: meta?.page_size,
-        };
+        }, meta);
     }
     /** Revoke an access code. */
     async revokeAccessCode(id) {
-        validatePathId(id, "revokeAccessCode");
+        (0, client_paths_js_1.validatePathId)(id, "revokeAccessCode");
         await this.requestNoContent(`/v1/access-codes/${encodeURIComponent(id)}`);
     }
     // --- Internal HTTP plumbing ---
     async request(method, path, body, requestOptions) {
         // List methods call rawRequest directly so 204 can degrade to an empty page.
         // Body-returning endpoints declare 200 JSON today, so this path fails closed.
-        const { data, __http_status } = await this.rawRequest(method, path, body, {
+        const { envelope: { data, meta }, status: httpStatus, } = await this.rawRequest(method, path, body, {
             requestOptions,
         });
-        if (__http_status === 204) {
-            throw unexpectedResponseError(`Unexpected 204 No Content from ${method} ${path}; expected response body`);
+        if (httpStatus === 204) {
+            throw (0, client_errors_js_1.unexpectedResponseError)(`Unexpected 204 No Content from ${method} ${path}; expected response body`);
         }
-        return data;
+        return withEnvelopeMetadata(data, meta);
     }
     /**
      * Require the service's exact 204 response with no response bytes exposed by
@@ -3956,10 +2209,10 @@ class QURLClient {
         const response = await this.rawRequest("DELETE", path, undefined, {
             allowEmptySuccessBody: true,
         });
-        if (response.__http_status !== 204 || response.__http_body_empty !== true) {
-            const status = response.__http_status ?? 0;
-            const bodyShape = response.__http_body_empty ? "with an empty body" : "with response bytes";
-            throw unexpectedResponseError(`Unexpected response from DELETE; expected empty HTTP 204, received HTTP ${status} ${bodyShape}. ` +
+        if (response.status !== 204 || response.bodyEmpty !== true) {
+            const status = response.status ?? 0;
+            const bodyShape = response.bodyEmpty ? "with an empty body" : "with response bytes";
+            throw (0, client_errors_js_1.unexpectedResponseError)(`Unexpected response from DELETE; expected empty HTTP 204, received HTTP ${status} ${bodyShape}. ` +
                 "The delete may already have been applied; reconcile resource state before retrying.", { status });
         }
     }
@@ -4027,7 +2280,8 @@ class QURLClient {
                 // request bound: roughly `timeout * (maxRetries + 1) +
                 // sum(retryDelay)`.
                 onDispatch?.();
-                response = await this.fetchFn(url, {
+                // Native edge fetch requires the global receiver, not this client.
+                response = await this.fetchFn.call(globalThis, url, {
                     method,
                     headers,
                     body: serializedBody,
@@ -4038,13 +2292,13 @@ class QURLClient {
             catch (err) {
                 lastError = this.classifyFetchError(err, requestSignal);
                 this.log(`${method} ${url} ${lastError instanceof errors_js_1.TimeoutError ? "timed out" : "network error"}`, {
-                    error: boundedErrorSnippet(lastError.message),
+                    error: (0, client_errors_js_1.boundedErrorSnippet)(lastError.message),
                 });
                 // An injected fetch can abort or impose a deadline for its own reason.
                 // That is not this SDK's timeout. Replaying it can defeat caller-side
                 // cancellation or deadline policy.
                 if (retryFetchFailure &&
-                    !isIndependentAbort(err, requestSignal) &&
+                    !(0, client_errors_js_1.isIndependentAbort)(err, requestSignal) &&
                     attempt < this.maxRetries) {
                     continue;
                 }
@@ -4069,23 +2323,23 @@ class QURLClient {
                             : REDIRECT_RESPONSE_STATUSES.has(response.status)
                                 ? `HTTP ${response.status}`
                                 : "opaque";
-                throw unexpectedResponseError(`Refused ${redirectKind} redirect response for ${method}`, {
+                throw (0, client_errors_js_1.unexpectedResponseError)(`Refused ${redirectKind} redirect response for ${method}`, {
                     status: response.status,
                 });
             }
             let responseBody;
             try {
-                responseBody = await readBoundedResponseBody(response);
+                responseBody = await readBoundedResponseBody(response, this.maxResponseBodyBytes);
             }
             catch (err) {
                 if (err instanceof ResponseBodyTooLargeError) {
                     this.log(`rejected oversized response body from ${response.status}`, {
                         status: response.status,
                     });
-                    const detail = `Response body exceeds ${MAX_RESPONSE_BODY_BYTES}-byte limit on HTTP ${response.status}; ` +
+                    const detail = `Response body exceeds ${this.maxResponseBodyBytes}-byte limit on HTTP ${response.status}; ` +
                         "request a smaller page when listing collections";
                     if (response.ok) {
-                        throw unexpectedResponseError(detail, { status: response.status });
+                        throw (0, client_errors_js_1.unexpectedResponseError)(detail, { status: response.status });
                     }
                     const bodyError = (0, errors_js_1.createError)({
                         status: response.status,
@@ -4093,7 +2347,7 @@ class QURLClient {
                         // the real HTTP status class (429/5xx) just like other unreadable
                         // error bodies instead of reclassifying it as client validation.
                         code: errors_js_1.ERROR_CODE_UNKNOWN,
-                        title: boundedErrorSnippet(response.statusText) || `HTTP ${response.status}`,
+                        title: (0, client_errors_js_1.boundedErrorSnippet)(response.statusText) || `HTTP ${response.status}`,
                         detail,
                         retry_after: this.parseRetryAfter(response),
                     });
@@ -4115,12 +2369,12 @@ class QURLClient {
                     if (response.ok) {
                         // A successful status with an invalid wire body is a deterministic
                         // response-contract failure. Do not replay a GET or a mutation.
-                        throw unexpectedResponseError(detail, { status: response.status });
+                        throw (0, client_errors_js_1.unexpectedResponseError)(detail, { status: response.status });
                     }
                     const encodingError = (0, errors_js_1.createError)({
                         status: response.status,
                         code: errors_js_1.ERROR_CODE_UNKNOWN,
-                        title: boundedErrorSnippet(response.statusText) || `HTTP ${response.status}`,
+                        title: (0, client_errors_js_1.boundedErrorSnippet)(response.statusText) || `HTTP ${response.status}`,
                         detail,
                         retry_after: this.parseRetryAfter(response),
                     });
@@ -4144,7 +2398,7 @@ class QURLClient {
                     // path retries. Mutations are never replayed after a body transport
                     // failure because the operation may have applied.
                     if (method === "GET" &&
-                        !isIndependentAbort(err, requestSignal) &&
+                        !(0, client_errors_js_1.isIndependentAbort)(err, requestSignal) &&
                         (response.ok || retryable.has(response.status)) &&
                         attempt < this.maxRetries) {
                         lastError = transportReadError;
@@ -4161,11 +2415,11 @@ class QURLClient {
                     ? err.message
                     : `Failed to read response body on HTTP ${response.status}`;
                 const readError = response.ok
-                    ? unexpectedResponseError(detail, { status: response.status })
+                    ? (0, client_errors_js_1.unexpectedResponseError)(detail, { status: response.status })
                     : (0, errors_js_1.createError)({
                         status: response.status,
                         code: errors_js_1.ERROR_CODE_UNKNOWN,
-                        title: boundedErrorSnippet(response.statusText) || `HTTP ${response.status}`,
+                        title: (0, client_errors_js_1.boundedErrorSnippet)(response.statusText) || `HTTP ${response.status}`,
                         detail,
                         retry_after: this.parseRetryAfter(response),
                     });
@@ -4173,7 +2427,7 @@ class QURLClient {
                 // example a BigInt returned by json()) and non-Error throws. Do not
                 // replay them: another attempt will see the same local contract bug.
                 throw err instanceof ResponseBodyMaterializationError
-                    ? withErrorCause(readError, err)
+                    ? (0, client_errors_js_1.withErrorCause)(readError, err)
                     : readError;
             }
             // `response.ok` is true for the entire 200-299 range, so partial-
@@ -4199,10 +2453,10 @@ class QURLClient {
                         });
                     }
                     return {
-                        data: undefined,
-                        __http_status: response.status,
-                        __http_body_empty: responseBody.length === 0,
-                        __http_headers: captureResponseHeaders ? response.headers : undefined,
+                        envelope: { data: undefined },
+                        status: response.status,
+                        bodyEmpty: responseBody.length === 0,
+                        headers: captureResponseHeaders ? response.headers : undefined,
                     };
                 }
                 // Exact no-content helpers must inspect both axes of the success
@@ -4212,20 +2466,20 @@ class QURLClient {
                     (isPassthrough && allowEmptyPassthroughBody)) &&
                     responseBody.length === 0) {
                     return {
-                        data: undefined,
-                        __http_status: response.status,
-                        __http_body_empty: true,
-                        __http_headers: captureResponseHeaders ? response.headers : undefined,
+                        envelope: { data: undefined },
+                        status: response.status,
+                        bodyEmpty: true,
+                        headers: captureResponseHeaders ? response.headers : undefined,
                     };
                 }
                 try {
                     const json = JSON.parse(responseBody);
                     return {
-                        ...json,
-                        __http_status: response.status,
+                        envelope: { ...json },
+                        status: response.status,
                         // JSON.parse("") throws, so parsed JSON is necessarily non-empty.
-                        __http_body_empty: false,
-                        __http_headers: captureResponseHeaders ? response.headers : undefined,
+                        bodyEmpty: false,
+                        headers: captureResponseHeaders ? response.headers : undefined,
                     };
                 }
                 catch {
@@ -4236,12 +2490,12 @@ class QURLClient {
                     // by-class don't miss the contract failure.
                     this.log(`non-JSON body on ${isPassthrough ? "passthrough" : "success"} response ${response.status}`, {
                         status: response.status,
-                        content_type: boundedErrorSnippet(response.headers.get("content-type")),
+                        content_type: (0, client_errors_js_1.boundedErrorSnippet)(response.headers.get("content-type")),
                     });
                     throw (0, errors_js_1.createError)({
                         status: response.status,
                         code: errors_js_1.ERROR_CODE_UNEXPECTED_RESPONSE,
-                        title: boundedErrorSnippet(response.statusText) || `HTTP ${response.status}`,
+                        title: (0, client_errors_js_1.boundedErrorSnippet)(response.statusText) || `HTTP ${response.status}`,
                         detail: `Expected JSON response body on HTTP ${response.status} but received non-JSON content`,
                     });
                 }
@@ -4272,13 +2526,13 @@ class QURLClient {
                 //   3. err.title    (RFC 7807 required field)
                 //   4. HTTP status  (final safety net)
                 // This prevents `"Title (403): undefined"` when the API omits detail.
-                const detail = boundedErrorSnippet(err.detail) ??
-                    boundedErrorSnippet(err.message) ??
-                    boundedErrorSnippet(err.title) ??
+                const detail = (0, client_errors_js_1.boundedErrorSnippet)(err.detail) ??
+                    (0, client_errors_js_1.boundedErrorSnippet)(err.message) ??
+                    (0, client_errors_js_1.boundedErrorSnippet)(err.title) ??
                     `HTTP ${response.status}`;
                 // HTTP/2 omits reason-phrases — `statusText` may be "".
-                const title = boundedErrorSnippet(err.title) ??
-                    boundedErrorSnippet(response.statusText) ??
+                const title = (0, client_errors_js_1.boundedErrorSnippet)(err.title) ??
+                    (0, client_errors_js_1.boundedErrorSnippet)(response.statusText) ??
                     `HTTP ${response.status}`;
                 // The transport status is authoritative for error classification. A
                 // conflicting or malformed RFC 7807 body must not turn a real 5xx into
@@ -4286,13 +2540,14 @@ class QURLClient {
                 const status = response.status;
                 return {
                     status,
-                    code: boundedErrorIdentifier(err.code) ?? errors_js_1.ERROR_CODE_UNKNOWN,
+                    code: (0, client_errors_js_1.boundedErrorIdentifier)(err.code) ?? errors_js_1.ERROR_CODE_UNKNOWN,
                     title,
                     detail,
-                    type: boundedErrorIdentifier(err.type),
-                    instance: boundedErrorIdentifier(err.instance),
-                    invalid_fields: boundedInvalidFields(err.invalid_fields),
-                    request_id: boundedErrorIdentifier(json.meta?.request_id),
+                    type: (0, client_errors_js_1.boundedErrorIdentifier)(err.type),
+                    instance: (0, client_errors_js_1.boundedErrorIdentifier)(err.instance),
+                    invalid_fields: (0, client_errors_js_1.boundedInvalidFields)(err.invalid_fields),
+                    request_id: (0, client_errors_js_1.boundedErrorIdentifier)(json.meta?.request_id),
+                    tombstone: response.status === 410 ? (0, client_errors_js_1.boundedTombstone)(json.meta?.tombstone) : undefined,
                     retry_after: this.parseRetryAfter(response),
                 };
             }
@@ -4302,7 +2557,7 @@ class QURLClient {
             // status-only safety net below.
             this.log(`unexpected error response shape from ${response.status}`, {
                 status: response.status,
-                body_keys: typeof json === "object" && json !== null ? boundedObjectKeys(json) : undefined,
+                body_keys: typeof json === "object" && json !== null ? (0, client_errors_js_1.boundedObjectKeys)(json) : undefined,
             });
         }
         catch {
@@ -4310,10 +2565,10 @@ class QURLClient {
             // malformed envelope, and fall through to the status-only safety net.
             this.log(`non-JSON error response from ${response.status}`, {
                 status: response.status,
-                content_type: boundedErrorSnippet(response.headers.get("content-type")),
+                content_type: (0, client_errors_js_1.boundedErrorSnippet)(response.headers.get("content-type")),
             });
         }
-        const statusText = boundedErrorSnippet(response.statusText) || `HTTP ${response.status}`;
+        const statusText = (0, client_errors_js_1.boundedErrorSnippet)(response.statusText) || `HTTP ${response.status}`;
         return {
             status: response.status,
             code: errors_js_1.ERROR_CODE_UNKNOWN,
@@ -4339,8 +2594,8 @@ class QURLClient {
         const trimmed = header.trim();
         if (/^[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/.test(trimmed)) {
             const seconds = Math.ceil((Date.parse(trimmed) - Date.now()) / 1000);
-            return Number.isSafeInteger(seconds) && seconds > 0 && seconds <= RETRY_AFTER_PARSE_LIMIT_S
-                ? seconds
+            return Number.isSafeInteger(seconds)
+                ? Math.min(Math.max(0, seconds), client_limits_js_1.RETRY_AFTER_PARSE_LIMIT_S)
                 : undefined;
         }
         if (!/^\d+$/.test(trimmed)) {
@@ -4355,10 +2610,10 @@ class QURLClient {
         // `*1000` ms-conversion in retryDelay before the hard cap clamps
         // them — fail fast instead, with a debug breadcrumb. Cutoff matches
         // the hard cap so a clean cap-bounded value still parses.
-        if (value > RETRY_AFTER_PARSE_LIMIT_S) {
+        if (value > client_limits_js_1.RETRY_AFTER_PARSE_LIMIT_S) {
             this.log("Retry-After header exceeded parse limit, using exponential backoff", {
                 header_value: header.slice(0, 100),
-                limit_seconds: RETRY_AFTER_PARSE_LIMIT_S,
+                limit_seconds: client_limits_js_1.RETRY_AFTER_PARSE_LIMIT_S,
             });
             return undefined;
         }
@@ -4380,24 +2635,24 @@ class QURLClient {
     retryDelay(attempt, lastError) {
         if (lastError instanceof errors_js_1.QURLError && lastError.retryAfter !== undefined) {
             const requestedMs = lastError.retryAfter * 1000;
-            if (requestedMs > RETRY_AFTER_HARD_CAP_MS) {
+            if (requestedMs > client_limits_js_1.RETRY_AFTER_HARD_CAP_MS) {
                 this.log("Retry-After exceeded hard cap, truncating", {
                     requested_seconds: lastError.retryAfter,
-                    capped_ms: RETRY_AFTER_HARD_CAP_MS,
+                    capped_ms: client_limits_js_1.RETRY_AFTER_HARD_CAP_MS,
                 });
-                return RETRY_AFTER_HARD_CAP_MS;
+                return client_limits_js_1.RETRY_AFTER_HARD_CAP_MS;
             }
             return requestedMs;
         }
-        const base = RETRY_BASE_DELAY_MS * Math.pow(2, attempt - 1);
+        const base = client_limits_js_1.RETRY_BASE_DELAY_MS * Math.pow(2, attempt - 1);
         const jitter = Math.random() * base * 0.5;
-        return Math.min(base + jitter, RETRY_MAX_DELAY_MS);
+        return Math.min(base + jitter, client_limits_js_1.RETRY_MAX_DELAY_MS);
     }
     classifyFetchError(err, requestSignal) {
         // AbortSignal.timeout is the only timeout source owned by this SDK. Keep
         // this check tied to that signal instead of trusting an injected fetch's
         // AbortError or TimeoutError name.
-        if (isSdkTimeout(err, requestSignal)) {
+        if ((0, client_errors_js_1.isSdkTimeout)(err, requestSignal)) {
             return new errors_js_1.TimeoutError("Request timed out", { cause: err });
         }
         const cause = err instanceof Error ? err : undefined;
@@ -4409,8 +2664,8 @@ class QURLClient {
         if (!(err instanceof Error))
             return undefined;
         if (!response.ok) {
-            const statusText = boundedErrorSnippet(response.statusText) || `HTTP ${response.status}`;
-            return withErrorCause((0, errors_js_1.createError)({
+            const statusText = (0, client_errors_js_1.boundedErrorSnippet)(response.statusText) || `HTTP ${response.status}`;
+            return (0, client_errors_js_1.withErrorCause)((0, errors_js_1.createError)({
                 status: response.status,
                 code: errors_js_1.ERROR_CODE_UNKNOWN,
                 title: statusText,
@@ -4418,100 +2673,18 @@ class QURLClient {
                 retry_after: this.parseRetryAfter(response),
             }), err);
         }
-        if (isSdkTimeout(err, requestSignal)) {
+        if ((0, client_errors_js_1.isSdkTimeout)(err, requestSignal)) {
             return new errors_js_1.TimeoutError(`Request timed out while reading response body after HTTP ${response.status}`, { cause: err });
         }
         return new errors_js_1.NetworkError(`Network failure while reading response body after HTTP ${response.status}`, { cause: err });
     }
 }
 exports.QURLClient = QURLClient;
-/**
- * A LayerV-protected resource, bound to the client that produced it.
- *
- * Obtained from {@link QURLClient.protectUrl} or {@link QURLClient.resourceByCrid} —
- * not constructed directly. Mint short-lived access links for the resource
- * with {@link createPortal} (qurl-go: `qurl.Resource`).
- */
-class ProtectedResource {
-    // A true private field (not a module-scope WeakMap registry, which
-    // CONTRIBUTING.md's dual-build rule bars) so the binding stays on the
-    // instance and out of Object.keys/JSON.stringify output.
-    #client;
-    /** The public resource CRID. */
-    crid;
-    /** The private URL protected by this resource, when known. */
-    targetUrl;
-    /**
-     * Full server-populated {@link Resource} metadata when the handle came
-     * from an API response; `undefined` for {@link QURLClient.resourceByCrid}
-     * handles and for the one-call {@link QURLClient.createPortalForUrl} path.
-     */
-    details;
-    constructor(client, id, targetUrl, details) {
-        this.#client = client;
-        this.crid = id;
-        this.targetUrl = targetUrl;
-        this.details = details;
-    }
-    /**
-     * Whether `resource` was produced by `client`. A static because the
-     * binding lives in a private field that only this class can read; used
-     * by {@link QURLClient.createPortal} to refuse handles bound to a
-     * different client.
-     */
-    static isBoundTo(resource, client) {
-        return resource.#client === client;
-    }
-    /**
-     * Mint a short-lived qURL link (a portal) for this resource. See
-     * {@link QURLClient.createPortal} for the option reference.
-     */
-    async createPortal(opts = {}, requestOptions) {
-        return this.#client.createPortal(this, opts, requestOptions);
-    }
-}
-exports.ProtectedResource = ProtectedResource;
-const CONNECTOR_RESOURCE_CONSTRUCTOR_TOKEN = Symbol("validated ConnectorResource");
-/**
- * A validated qURL Connector resource bound to the client that loaded it.
- *
- * Resource identity, reverse-routing identity, and NHP admission identity are
- * distinct server-issued values. Callers must consume each field verbatim and
- * must never derive one from another.
- */
-class ConnectorResource {
-    #client;
-    resourcePublicKey;
-    /** Required public identifier, verified against the returned resource key. */
-    crid;
-    connectorRoutingId;
-    knockResourceId;
-    slug;
-    alias;
-    /** @internal Instances are returned by QURLClient after wire validation. */
-    constructor(client, details, validationToken) {
-        if (validationToken !== CONNECTOR_RESOURCE_CONSTRUCTOR_TOKEN) {
-            throw clientValidationError("ConnectorResource cannot be constructed directly; load it through QURLClient");
-        }
-        this.#client = client;
-        this.resourcePublicKey = details.resource_id;
-        this.crid = details.crid;
-        this.connectorRoutingId = details.connector_routing_id;
-        this.knockResourceId = details.knock_resource_id;
-        this.slug = details.slug;
-        this.alias = details.alias ?? undefined;
-    }
-    /** Mint a short-lived portal for this Connector resource. */
-    async createPortal(opts = {}, requestOptions) {
-        return this.#client.createPortal(this.crid, opts, requestOptions);
-    }
-}
-exports.ConnectorResource = ConnectorResource;
-function sameConsumerPolicy(actual, expected, foundExisting) {
-    return (actual?.mode === expected.mode &&
-        (actual?.version === expected.version ||
-            (foundExisting &&
-                Number.isSafeInteger(actual?.version) &&
-                Number(actual?.version) > expected.version)) &&
-        actual?.contract_id === expected.contract_id);
-}
+var client_management_js_2 = require("./client-management.js");
+Object.defineProperty(exports, "isApiKeyRequestScope", { enumerable: true, get: function () { return client_management_js_2.isApiKeyRequestScope; } });
+var client_portals_js_2 = require("./client-portals.js");
+Object.defineProperty(exports, "SIGNED_FRAGMENT_RE", { enumerable: true, get: function () { return client_portals_js_2.SIGNED_FRAGMENT_RE; } });
+var client_portals_js_3 = require("./client-portals.js");
+Object.defineProperty(exports, "ProtectedResource", { enumerable: true, get: function () { return client_portals_js_3.ProtectedResource; } });
+var client_connectors_js_2 = require("./client-connectors.js");
+Object.defineProperty(exports, "ConnectorResource", { enumerable: true, get: function () { return client_connectors_js_2.ConnectorResource; } });