Expose token-scoped revoke method (DELETE /v1/resources/:id/qurls/:qurl_id)

[justin-layerv]

Context

The OpenAPI spec defines two delete endpoints for QURL lifecycle:

1. DELETE /v1/qurls/:id — revokes a resource and ALL its access tokens. Exposed as QURLClient.delete() / AsyncQURLClient.delete(). Only accepts r_ (resource) IDs; require_resource_id_prefix enforces this client-side.
2. DELETE /v1/resources/:id/qurls/:qurl_id — revokes a single access token under a resource. Not yet exposed by the SDK.

Why this matters

The require_resource_id_prefix helper in src/layerv_qurl/_utils.py currently emits this error when a user passes a q_ (QURL display) ID to delete():

delete: only resource IDs (r_ prefix) are accepted — got an ID starting with 'q_'.
To revoke a single access token, use the token-scoped revoke endpoint
(not yet available in this SDK version).

That "(not yet available in this SDK version)" wording will go stale the moment we expose this endpoint. A TODO comment was added to require_resource_id_prefix in PR #8 (commit a34696c) flagging this, but an actual tracking issue is more durable.

The same gap exists in:

• layervai/qurl-typescript — delete() uses identical wording (intentional cross-SDK parity).
• layervai/qurl-mcp — whatever the MCP tool surface exposes.

Scope

• Add revoke_token(resource_id: str, qurl_id: str) (or similar) to QURLClient and AsyncQURLClient.
• Validate both IDs have the right prefix (r_ for resource_id, q_ or at_ for qurl_id).
• Wire through _request / _raw_request with appropriate retry policy (DELETE is idempotent; use the read retry set).
• Add sync and async tests covering the happy path, prefix-mismatch rejection, and info-leak guards in error messages.
• Update require_resource_id_prefix error message to point at the new SDK method instead of "not yet available in this SDK version."
• Remove the TODO comment from require_resource_id_prefix.
• Cross-SDK: file companion issues (or unified one) for qurl-typescript and qurl-mcp.

Related

• PR feat!: align types and client with latest API spec #8 require_resource_id_prefix TODO: https://github.com/layervai/qurl-python/blob/feat/align-api-v2/src/layerv_qurl/_utils.py
• Spec: qurl/api/openapi.yaml — /v1/resources/{id}/qurls/{qurl_id} DELETE operation