@relyio/sdk 0.17.0 → 0.19.0

package/dist/{index-BBp8_tn9.d.ts → index-BxNnlc5D.d.ts}

@@ -1,143 +1,8 @@
-import { d2 as paths, cW as RetryConfig, d3 as MergedRelyIOConfig, cV as ApiResponse, aM as EntryMetadata, ap as Reading, cs as BaseContent, al as CheckedIncludes, d4 as ReadWhere, cx as WhereClause, d5 as components, aq as ReadWith, cI as UpdateInput, at as UntypedReading, cC as RevisedContent, cA as CreateInput, cB as CreatedContent, cH as ContentVersionRow, cG as ContentVersion, cF as RestoredContent, cl as SDKError, c$ as BaseValidationError, c_ as ValidationViolation, b2 as AssetServedBlocks, d6 as CheckedInclude, cw as WhereFieldCondition, cq as AssetFileBlock, ct as BaseSingleton, cD as WrittenSingleton, cu as BaseSettingsGroup, cE as WrittenSettingsGroup, aN as InferContentType, an as ContentReading, aT as InferSingleton, cm as RelyIOConfig, b0 as InferAssetType, ak as AssetReading, as as SingletonReading, aY as InferSettingsGroup, ar as SettingsReading, cn as RelyIOConfigUpdate } from './define-content-type-BGoQxqLf.js';
-import { a as SchemaDefinition, b as SchemaContentTypeNames, j as SchemaEntryOf, f as SchemaLocaleCodes, c as SchemaSingletonNames, A as AggregateBlock, K as QueryParameterValue, F as FullTextSearch, e as SchemaQueryNames, J as InferQueryParams, L as AnyQueryParameters, h as SchemaAssetTypeNames, g as SchemaSettingsGroupNames } from './define-schema-DgCX9YB7.js';
+import { e as ApiPath, f as ApiMethod, Q as QueryOf, W as Wire, H as HttpClient, A as AnySchemaDefinition, l as RecordsClient, B as BaseRecord, y as RecordBatchOperation, C as RecordBatchOptions, b as RecordBatchResult, R as RegisteredSchema } from './register-BiMQKVp-.js';
+import { aW as EntryMetadata, ay as Reading, da as BaseContent, au as CheckedIncludes, dL as ReadWhere, df as WhereClause, cR as components, az as ReadWith, dr as UpdateInput, aC as UntypedReading, dk as RevisedContent, di as CreateInput, dj as CreatedContent, dq as ContentVersionRow, dp as ContentVersion, dn as RestoredContent, d3 as SDKError, dI as BaseValidationError, dH as ValidationViolation, bc as AssetServedBlocks, dM as CheckedInclude, de as WhereFieldCondition, d8 as AssetFileBlock, db as BaseSingleton, dl as WrittenSingleton, dc as BaseSettingsGroup, dm as WrittenSettingsGroup, aX as InferContentType, aw as ContentReading, b1 as InferSingleton, c$ as paths, d4 as RelyIOConfig, ba as InferAssetType, at as AssetReading, aB as SingletonReading, b6 as InferSettingsGroup, aA as SettingsReading, d5 as RelyIOConfigUpdate, d1 as MergedRelyIOConfig } from './define-content-type-C12jh8cY.js';
+import { b as SchemaContentTypeNames, k as SchemaEntryOf, f as SchemaLocaleCodes, c as SchemaSingletonNames, y as AggregateBlock, a5 as QueryParameterValue, w as FullTextSearch, e as SchemaQueryNames, a4 as InferQueryParams, a6 as AnyQueryParameters, i as SchemaRecordTypeNames, I as InferRecordType, r as RecordWriteFieldsOf, q as RecordUpdateFieldsOf, h as SchemaAssetTypeNames, g as SchemaSettingsGroupNames } from './define-schema-CK7TtYot.js';
 import { DevUnreadableReason } from './dev-handshake/index.js';
 
-/**
- * Where the SDK's transport gets its truth.
- *
- * Every route this client calls is named by its **path template as the
- * committed document spells it**, and the body type it expects is read out of
- * that document rather than written down here. `api-schema.ts` beside this file
- * is generated by `pnpm api:types` from `apps/services/api/openapi-spec.json`,
- * which is itself generated from that service's `RouteContract`s
- * (`INV-API-DOCUMENT-IS-DERIVED`). So the chain is: one declaration in
- * `routes.ts` → the serializer that produces the body → the document → these
- * types → the method that reads it.
- *
- * That chain is the answer to the question this phase exists to close. Before
- * it, six SDK methods read a key the server does not send; each had no caller
- * and no test, so nothing could see them. Now:
- *
- * - A route that changes **kind** — `collection` to `object`, say — changes
- *   whether the document's 200 body carries `page` and whether `data` is an
- *   array. `Wire<…>` follows, `readPayload` follows, and the method's declared
- *   return type stops matching. `tsc` names the method.
- * - A route that changes **path** or is deleted stops being a `keyof paths`, so
- *   the call site fails on the literal.
- * - A route that changes **dialect** changes `page` from `CursorPage` to
- *   `OffsetPage`, and anything reading `nextCursor` fails.
- *
- * `/v1` lives in these templates because it lives in the document
- * (`INV-API-VERSION-IS-DECIDED-ONCE`). Before this phase the SDK's base URL was
- * `https://api.relyio.com` and its paths were `/{contentType}`, so every
- * versioned request went to a path the router does not serve.
- *
- * Spec: `devtools/docs/guide/engineering/api-contract-spec.md`,
- * `INV-API-CLIENT-IS-DERIVED`.
- */
-
-/** Every path the committed document declares. */
-type ApiPath = keyof paths;
-type Verb$1 = 'get' | 'post' | 'put' | 'patch' | 'delete';
-/** The verbs the document declares on this path — not the seven HTTP has. */
-type ApiMethod<P extends ApiPath> = {
-    [M in Verb$1]: M extends keyof paths[P] ? paths[P][M] extends {
-        responses: unknown;
-    } ? M : never : never;
-}[Verb$1];
-type Operation<P extends ApiPath, M extends ApiMethod<P>> = M extends keyof paths[P] ? paths[P][M] : never;
-type JsonBody<R> = R extends {
-    content: {
-        'application/json': infer B;
-    };
-} ? B : never;
-/**
- * The success body the document declares, preferring 200 where a route serves
- * both. A route with neither — `kind: 'empty'`, which serves 204 — resolves to
- * `never`, and `readPayload` cannot be called on it.
- */
-type ApiSuccessBody<P extends ApiPath, M extends ApiMethod<P>> = Operation<P, M> extends {
-    responses: infer R;
-} ? 200 extends keyof R ? JsonBody<R[200]> : 201 extends keyof R ? JsonBody<R[201]> : never : never;
-/**
- * The document's success body with the payload typed as the caller's `T`.
- *
- * The array arm is tested **first** on purpose: `{ data: unknown[] }` also
- * satisfies `{ data: unknown }`, so the object arm would swallow every
- * collection and hand a list route's caller a single entity — which is the
- * exact defect class (`ContentClient.children` reading `.data.items` from an
- * object route) that this phase makes unrepresentable.
- */
-type Wire<P extends ApiPath, M extends ApiMethod<P>, T> = ApiSuccessBody<P, M> extends {
-    data: unknown[];
-} ? Omit<ApiSuccessBody<P, M>, 'data'> & {
-    data: T[];
-} : ApiSuccessBody<P, M> extends {
-    data: unknown;
-} ? Omit<ApiSuccessBody<P, M>, 'data'> & {
-    data: T;
-} : ApiSuccessBody<P, M>;
-/**
- * The path parameters the document declares for this operation, or `never`
- * where it declares none.
- *
- * `never` rather than `{}`: a route with no segments must **forbid** a `path`
- * argument, not merely tolerate an empty one, and `keyof Record<string, never>`
- * is `string`, so an empty-object encoding cannot be told apart from a real
- * one at the type level.
- */
-type PathParamsOf<P extends ApiPath, M extends ApiMethod<P>> = Operation<P, M> extends {
-    parameters: {
-        path?: infer X;
-    };
-} ? [X] extends [undefined] ? never : NonNullable<X> : never;
-/**
- * The query parameters the document declares for this operation, or `never` where it declares
- * none (REL-687).
- *
- * The service declares them beside each route — a query DTO's whitelisted properties, the names a
- * handler reads, `?_fresh` on a read the edge keeps — and `apps/services/api`'s
- * `contract/query-parameters.spec.ts` holds the document to what each handler reads. So a name the
- * API stops reading stops compiling here, and a name it refuses — `offset` on the entry list, which
- * the SDK once sent on every `.offset()` and the API answered with a 400 — never compiled at all.
- *
- * `never` for the same reason {@link PathParamsOf} uses it: a route with no query must forbid one.
- */
-type QueryOf<P extends ApiPath, M extends ApiMethod<P>> = Operation<P, M> extends {
-    parameters: {
-        query?: infer Q;
-    };
-} ? [Q] extends [undefined] ? never : NonNullable<Q> : never;
-/** What {@link matchRoute} recovers from a URL the client emitted. */
-interface RouteMatch {
-    /** The document's path template — the value a tag translator switches on. */
-    path: ApiPath;
-    /** The template's `{name}` segments, decoded: the inverse of {@link fillPath}. */
-    params: Record<string, string>;
-    /** The query string; a key that appears more than once comes back as an array. */
-    query: Record<string, string | string[]>;
-}
-interface MatchRouteOptions {
-    /**
-     * The client's `baseUrl`, when it carries a path prefix of its own
-     * (`https://example.com/relyio`). Its path is removed before the template is
-     * matched. Unneeded for the default `https://api.relyio.com`.
-     */
-    baseUrl?: string;
-}
-/**
- * Recover the route a URL names: the inverse of {@link fillPath}, over the same
- * committed document (`INV-API-CLIENT-IS-DERIVED`).
- *
- * `matchRoute(url).path` is an `ApiPath`, so anything that keys behaviour on a
- * request — a cache-tag translator, say — switches on the document's templates
- * and never on a route table of its own.
- *
- * Returns `null` for a URL no declared template matches — a presigned storage
- * URL, or a path outside `baseUrl` — rather than a guess.
- */
-declare function matchRoute(url: string | URL, options?: MatchRouteOptions): RouteMatch | null;
-
 /**
  * Dev-mode detection for `relyio dev` sandboxes — the SDK's I/O shell over `../dev-handshake`.
  *
@@ -200,331 +65,6 @@ type ActiveSandbox = Extract<SandboxState, {
     state: 'active';
 }>;
 
-/**
- * The part of a request a retry decision is allowed to look at.
- *
- * `method` is typed as a plain `string` rather than as `RequestConfig['method']`
- * on purpose. The five verbs that union names are the five the typed transport
- * can express today; the question "may this be sent twice?" is a fact about
- * HTTP, and an unrecognised verb has to reach the conservative arm rather than
- * be unrepresentable.
- */
-interface RetryableRequest {
-    method: string;
-    headers?: Record<string, string>;
-}
-/**
- * Whether a failed request may be sent again, and after how long.
- *
- * The two halves are separate because they fail separately. The incumbent loop
- * had neither: it asked `error.retryable` and nothing else, so a `POST` that met
- * a 500 was sent again twice — and `SERVICE_INDETERMINATE`, whose whole meaning
- * is "the service could not decide", is marked retryable, which means the write
- * may already have landed. Meanwhile the `Retry-After` the service sent was
- * collected by the transport and read by nobody, so a 429 whose window is
- * measured in minutes was retried after an exponential guess capped at ten
- * seconds.
- *
- * `error` is `Error`, not `SDKError`, because that is what the loop actually
- * holds: a `TypeError: fetch failed` is only mapped to an `SDKError` **after**
- * the loop gives up, so a policy typed to `SDKError` could not see the transport
- * failures it most needs to retry.
- */
-interface RetryPolicy {
-    /**
-     * Never replays a request that could apply twice: a write is retried only
-     * when it carries `Idempotency-Key`, or the verb is idempotent.
-     *
-     * @param attempt - How many attempts have been made, 1 for the first.
-     */
-    shouldRetry(attempt: number, error: Error, request: RetryableRequest): boolean;
-    /** Honours `Retry-After` / `RateLimitError.resetAt` over exponential backoff. */
-    delayFor(attempt: number, error: Error): number;
-}
-/**
- * Whether sending this request a second time can apply it a second time.
- *
- * Two ways to be safe, and they are genuinely different questions: the verb may
- * be idempotent by definition, or the request may carry an `Idempotency-Key`
- * that makes the service answer a replay from the original outcome rather than
- * applying it again.
- */
-declare function isReplaySafe(request: RetryableRequest): boolean;
-/**
- * The policy the SDK ships with.
- *
- * Construction takes the same `RetryConfig` the SDK has always exported; what
- * it no longer takes is a `retryCondition`, because a caller-supplied predicate
- * over `(error, attempt)` structurally **cannot** see the request and so cannot
- * express the rule this class exists for.
- */
-declare class DefaultRetryPolicy implements RetryPolicy {
-    private readonly config;
-    constructor(config: RetryConfig);
-    shouldRetry(attempt: number, error: Error, request: RetryableRequest): boolean;
-    delayFor(attempt: number, error: Error): number;
-}
-/**
- * The retry policy a client sends with, at `maxAttempts` attempts (the first included): the SDK's
- * own, from `retryAttempts`, and the CLI's (REL-721).
- *
- * The backoff numbers are stated here once. The CLI ran a second policy beside this one —
- * `axios-retry` with its own delays and its own reading of a refusal, which retried by numeric
- * status — so a refusal one client gave up on, the other sent again. Now both ask this function, and
- * a change to when a request is replayed reaches both.
- */
-declare function retryPolicyFor(maxAttempts: number): RetryPolicy;
-
-/**
- * What a call site supplies beside the route it named.
- *
- * `path` is required exactly when the document's template has segments, and
- * forbidden when it does not — so a call that forgot to scope a request, or one
- * that scoped a request the route does not scope, is a compile error rather
- * than a URL with a literal `{id}` in it.
- */
-type SendOptions<P extends ApiPath, M extends ApiMethod<P>> = {
-    /**
-     * Query string values: exactly the names the document declares for this route, at the types it
-     * declares them (`QueryOf`, REL-687). An undeclared name is a compile error, not a 400.
-     */
-    query?: QueryOf<P, M>;
-    body?: unknown;
-    /** Request headers this call adds, e.g. `If-Match` / `Idempotency-Key` (API4). */
-    headers?: Record<string, string>;
-    signal?: AbortSignal;
-    timeout?: number;
-} & ([PathParamsOf<P, M>] extends [never] ? {
-    path?: never;
-} : {
-    path: PathParamsOf<P, M>;
-});
-/**
- * Core HTTP client for the RelyIO SDK.
- *
- * `send` is **the** typed entry: it names a route by the path template the
- * committed document declares, and returns that operation's body type with the
- * payload typed as `T`. `readPayload` from `@relyio/api-contract/client` is
- * then the one unwrap — there is no second spelling and no runtime test of
- * which envelope arrived (`INV-API-CLIENT-IS-DERIVED`).
- *
- * What the class makes public is what something outside it calls: `send` and `fetchPayload` are
- * the requests; `configure`, `withHeaders` and `setApiKey` are the owning client's (`updateConfig()`,
- * `with()`, `setApiKey()`). There are no verb helpers, no header or base-URL accessors and no
- * untyped `request` (REL-717): a route is named by its document path, or it is not called.
- */
-declare class HttpClient {
-    /** What every request reads off the configuration, derived by {@link configure} and nowhere else. */
-    protected connection: Connection;
-    /**
-     * Set on a view {@link withHeaders} made: the client every request is sent through, and the
-     * headers laid beneath each request's own. A view keeps no connection of its own that matters —
-     * everything it is asked to change, it changes on that client.
-     */
-    protected view?: {
-        readonly client: ControlledHttpClient;
-        readonly headers: Readonly<Record<string, string>>;
-    };
-    constructor(config: MergedRelyIOConfig);
-    protected announce(): void;
-    /**
-     * Send bytes to an address that is not a RelyIO route — an asset upload's presigned `PUT` and its
-     * multipart parts — through the client's configured `fetch`, so a wrapper that records, proxies or
-     * forbids network access sees every request this client makes (REL-2671). Nothing else is added: no
-     * key, no retry, no timeout, because the address belongs to the storage service, not to RelyIO.
-     *
-     * Static so the instances a customer holds stay `send` and `fetchPayload` (REL-3107). The `fetch`
-     * is read per call, from the client a view sends through, like the requests are.
-     */
-    static transfer(client: HttpClient, url: string, init: RequestInit): Promise<Response>;
-    /**
-     * Call a route the committed document declares, and get back the body that
-     * document says it serves.
-     */
-    send<P extends ApiPath, M extends ApiMethod<P>, T = unknown>(path: P, method: M, options: SendOptions<P, M>): Promise<ApiResponse<Wire<P, M, T>>>;
-    /**
-     * Call a route and return its payload — `send` plus the one unwrap, which is
-     * what all but a handful of call sites want.
-     */
-    fetchPayload<P extends ApiPath, M extends ApiMethod<P>, T = unknown>(path: P, method: M, options: SendOptions<P, M>): Promise<Wire<P, M, T> extends {
-        data: unknown;
-    } ? Wire<P, M, T>['data'] : never>;
-    /**
-     * Make an HTTP request, retrying only where a retry is safe.
-     *
-     * The headers are merged **once**, before the first attempt, and every attempt
-     * sends that same object. That is what makes a minted `Idempotency-Key` stable
-     * across the retries of one logical write: the service sees one key and
-     * answers the replay from the original outcome instead of applying it twice.
-     *
-     * The loop always makes one attempt. The incumbent's `while (attempt <
-     * maxAttempts)` made none at `retryAttempts: 0` — a value the config validator
-     * then accepted, and now refuses — and then dereferenced an unassigned
-     * `lastError`. `retryAttempts` is the most attempts, the first included; an
-     * `HttpClient` constructed directly is not validated, so the first attempt
-     * stays unconditional.
-     *
-     * A request that would carry no `X-API-Key` makes none: it rejects with
-     * `MissingApiKeyError` before `fetch` is called, is not retried, and names
-     * `apiKey`. This is where a client built without a key learns it — the
-     * constructor accepts one so that a module-scope client can be evaluated by a
-     * build that holds no key (REL-1120) — and so does one whose `setApiKey` was
-     * given none.
-     */
-    private request;
-    /**
-     * One attempt.
-     *
-     * The caller's `signal` and the timeout both end it, through one controller.
-     * The incumbent handed `fetch` the caller's signal **instead of** its own, so a
-     * request that passed a signal had no timeout at all — and a caller abort then
-     * surfaced as `Request timed out`. `timedOut` is what tells the two apart: a
-     * timeout is a `TimeoutError`, a caller abort is the platform's `AbortError`,
-     * rethrown as it came.
-     */
-    private makeRequest;
-    /**
-     * The headers without those a browser controls itself, when this is a browser; unchanged when it
-     * is not.
-     *
-     * A name is matched without regard to case (RFC 9110 §5.1), because a browser refuses `Origin`
-     * whatever case a page spells it in. This matched only the all-lowercase and all-uppercase
-     * spellings, so `Origin` and `User-Agent` — how people write them — reached `fetch` (REL-1409).
-     */
-    private filterHeadersForBrowser;
-    /**
-     * Prepare request body based on content type and environment
-     */
-    private prepareRequestBody;
-    private parseResponse;
-    private resolveUrl;
-    private mergeRequestConfig;
-    private buildQueryString;
-    private headersToObject;
-    private log;
-}
-/**
- * The client the SDK's own factory holds: {@link HttpClient} plus the three things only the owning
- * client does to it — `configure` (`updateConfig()`), `withHeaders` (`with()`) and `setApiKey`
- * (`setApiKey()`). It is not exported from the package, so a customer holding the client from
- * `getHttpClient()` sees `send` and `fetchPayload` and nothing else (REL-3107).
- */
-declare class ControlledHttpClient extends HttpClient {
-    /**
-     * A view of this client that sends every request through it with `headers` added — beneath the
-     * request's own, over this client's — and changes nothing else: its key, base URL, timeout,
-     * retries and `fetch` are this client's as they are when each request is sent, so a later
-     * `configure()` or `setApiKey()` on this client reaches the view, and one on the view reaches
-     * this client. `client.with({ dataset })` is one (REL-2417).
-     */
-    withHeaders(headers: Readonly<Record<string, string>>): ControlledHttpClient;
-    /**
-     * Run on `config` from now on: every later request — whoever holds this client — is sent to its
-     * `baseUrl`, with its headers, key and dataset, its timeout and retries, through its `fetch`, and
-     * logged by its `debug` options.
-     *
-     * The client's own `updateConfig()` calls this rather than building a second client, so a
-     * `content()` or other sub-client taken before the update sends through the update too. Anything
-     * set on this client since it was last configured — `setApiKey()` — is replaced by what `config`
-     * says.
-     */
-    configure(config: MergedRelyIOConfig): void;
-    /**
-     * Replace the key every later request sends as `X-API-Key`, and the `apiKey` the configuration
-     * reports.
-     *
-     * The key is read the way construction reads it (`presentKey`): an absent, empty or blank key is
-     * no key, so the header is dropped and the next request is refused with `MissingApiKeyError`
-     * before anything is sent. A key header of any other spelling — one given in `headers` — goes
-     * too, from the headers sent and from the headers the configuration reports, so the old key is
-     * never sent beside the new one.
-     *
-     * The configuration is the one the owning `TypedRelyIOClient` holds (it hands its own to the
-     * constructor), so its `getConfig().apiKey` — what a surface reads to decide a key's kind — is the
-     * key sent from here on.
-     *
-     * This replaced `setAuthToken`, which added `Authorization: Bearer` beside an `X-API-Key` it
-     * never touched: the API reads `X-API-Key` first, so the old key was the one used (REL-1385).
-     */
-    setApiKey(apiKey: string): void;
-}
-/** Everything a request reads off the configuration, replaced whole whenever it changes. */
-interface Connection {
-    /**
-     * The configuration itself, for what is read per request — `fetch`, the `browser` options,
-     * `debug` — and the object `setApiKey` writes the key into, which the owning client reports.
-     */
-    readonly config: MergedRelyIOConfig;
-    readonly baseUrl: string;
-    readonly defaultHeaders: Readonly<Record<string, string>>;
-    readonly timeout: number;
-    readonly retryPolicy: RetryPolicy;
-}
-
-/**
- * API4's two request headers, as the SDK's writes send them.
- *
- * `Idempotency-Key` is an option on every write whose route declares it (`idempotencyKey`), and the
- * SDK mints one when none is given. `If-Match` is never an option: a checked write builds it from
- * the entry it was read as (`versionCheckOf`), from the `_metadata` every read carries in its body
- * whether or not the edge cache served it (REL-2418). The SDK does not read the separate
- * `X-Entity-Tag` header, which the edge removes from what it stores; the API keeps sending it for
- * callers using plain HTTP (REL-2427). A batch operation carries its check in its own body, as
- * `ifMatch` (`batch/batch-operations.ts`, REL-2421).
- */
-interface RetryableWriteOptions {
-    /**
-     * A key that makes a retry of **this** write safe.
-     *
-     * A replay inside the service's window returns the original outcome rather
-     * than applying twice. The service derives that response from committed state
-     * pinned to the recorded version — it does not store bytes — so a replay after
-     * the version has been pruned is refused `RESOURCE_EXPIRED` rather than
-     * answered from a stale copy.
-     *
-     * **The SDK mints one when you do not.** It used to be caller-supplied and
-     * nothing else, which meant the default write carried no key while the retry
-     * loop replayed it anyway — the one mechanism that makes a replay safe was
-     * optional on the one path that needed it. Supply your own to make a key
-     * outlive the process: a job that may be restarted wants a key derived from
-     * the work, not one minted per call.
-     */
-    idempotencyKey?: string;
-}
-/**
- * An entry a read handed back, as much of it as a version check needs: its `_metadata`'s id, the
- * locale it was read in and the two counters it was read at (REL-2418).
- *
- * Every read carries these in its body, whether origin or the edge cache served it — the edge
- * removes only the separate `X-Entity-Tag` header from what it stores, so a check taken from that
- * header vanished after a cached read. A `Pick` of the document's `EntryMetadata`, so a counter the
- * API stops reporting stops compiling here.
- */
-interface ReadEntry {
-    readonly _metadata: Pick<EntryMetadata, 'id' | 'locale' | 'version' | 'sharedVersion'>;
-}
-/**
- * The version check a write takes from the entry it was read as: the entry's id, the locale it was
- * read in — which the write addresses, so a read negotiated from `Accept-Language` is written back
- * to that locale — and the `If-Match` tag over its two counters, spelled as the API mints it.
- */
-declare function versionCheckOf(entry: ReadEntry): {
-    id: string;
-    locale: string;
-    ifMatch: string;
-};
-
-/**
- * The client's locale as a sub-client holds it: a function it asks on every call, or a locale fixed
- * when it was built.
- *
- * `TypedRelyIOClient` hands every sub-client and builder a function over the configuration it holds,
- * so one taken before `updateConfig({ locale })` sends the locale the client holds when the call is
- * made, and none once `updateConfig({ locale: null })` has cleared it (REL-1453). A string is a locale
- * fixed at construction — a handle built directly, as the tests build one — and stays what it was.
- */
-type ClientLocale = string | (() => string | undefined);
-
 /**
  * Site-visitor live, declared once for everyone who speaks it (`live-layer-spec.md` decisions 15, 19
  * and 20; phase LV5): the wire a visitor's browser meets at `live.relyio.com`, and the two internal
@@ -625,6 +165,70 @@ type VisitorResyncReason = VisitorLedgerResyncReason | 'too-far-behind';
  */
 type VisitorRetry = 'stop' | 'retry' | 'back-off';
 
+/**
+ * API4's two request headers, as the SDK's writes send them.
+ *
+ * `Idempotency-Key` is an option on every write whose route declares it (`idempotencyKey`), and the
+ * SDK mints one when none is given. `If-Match` is never an option: a checked write builds it from
+ * the entry it was read as (`versionCheckOf`), from the `_metadata` every read carries in its body
+ * whether or not the edge cache served it (REL-2418). The SDK does not read the separate
+ * `X-Entity-Tag` header, which the edge removes from what it stores; the API keeps sending it for
+ * callers using plain HTTP (REL-2427). A batch operation carries its check in its own body, as
+ * `ifMatch` (`batch/batch-operations.ts`, REL-2421).
+ */
+interface RetryableWriteOptions {
+    /**
+     * A key that makes a retry of **this** write safe.
+     *
+     * A replay inside the service's window returns the original outcome rather
+     * than applying twice. The service derives that response from committed state
+     * pinned to the recorded version — it does not store bytes — so a replay after
+     * the version has been pruned is refused `RESOURCE_EXPIRED` rather than
+     * answered from a stale copy.
+     *
+     * **The SDK mints one when you do not.** It used to be caller-supplied and
+     * nothing else, which meant the default write carried no key while the retry
+     * loop replayed it anyway — the one mechanism that makes a replay safe was
+     * optional on the one path that needed it. Supply your own to make a key
+     * outlive the process: a job that may be restarted wants a key derived from
+     * the work, not one minted per call.
+     */
+    idempotencyKey?: string;
+}
+/**
+ * An entry a read handed back, as much of it as a version check needs: its `_metadata`'s id, the
+ * locale it was read in and the two counters it was read at (REL-2418).
+ *
+ * Every read carries these in its body, whether origin or the edge cache served it — the edge
+ * removes only the separate `X-Entity-Tag` header from what it stores, so a check taken from that
+ * header vanished after a cached read. A `Pick` of the document's `EntryMetadata`, so a counter the
+ * API stops reporting stops compiling here.
+ */
+interface ReadEntry {
+    readonly _metadata: Pick<EntryMetadata, 'id' | 'locale' | 'version' | 'sharedVersion'>;
+}
+/**
+ * The version check a write takes from the entry it was read as: the entry's id, the locale it was
+ * read in — which the write addresses, so a read negotiated from `Accept-Language` is written back
+ * to that locale — and the `If-Match` tag over its two counters, spelled as the API mints it.
+ */
+declare function versionCheckOf(entry: ReadEntry): {
+    id: string;
+    locale: string;
+    ifMatch: string;
+};
+
+/**
+ * The client's locale as a sub-client holds it: a function it asks on every call, or a locale fixed
+ * when it was built.
+ *
+ * `TypedRelyIOClient` hands every sub-client and builder a function over the configuration it holds,
+ * so one taken before `updateConfig({ locale })` sends the locale the client holds when the call is
+ * made, and none once `updateConfig({ locale: null })` has cleared it (REL-1453). A string is a locale
+ * fixed at construction — a handle built directly, as the tests build one — and stays what it was.
+ */
+type ClientLocale = string | (() => string | undefined);
+
 /**
  * Two read terms every read that takes them writes the same way: the children an entry embeds,
  * and the refusal of a condition on `_metadata`. Here once, for the list and entry reads
@@ -1871,39 +1475,44 @@ declare class SettingsClient<T = BaseSettingsGroup, R extends Reading = UntypedR
 }
 
 /**
- * Any schema the client can be typed by. `any` is deliberate: the client accepts whatever content
- * types, singletons, queries and settings groups a customer declares.
- *
- * This is the constraint `TypedRelyIOClient`'s `TSchema` carries, so `RegisteredSchema` is inferred
- * against the same one — `createClient` returns `TypedRelyIOClient<RegisteredSchema>`, and a schema
- * inferred against any wider alias would not be provably inside the client's bound.
- */
-type AnySchemaDefinition = SchemaDefinition<any, any, any, any, any>;
-/**
- * The seam `relyio generate-types` fills (`INV-SS-TYPES-INFERRED`).
- *
- * Empty here on purpose. The generated `schema.ts` augments it —
- *
- * ```ts
- * declare module '@relyio/sdk' {
- *   interface Register {
- *     schema: typeof schema
- *   }
- * }
- * ```
+ * The project's Functions over the Content API (spec 2, REL-3821): `relyio.functions.checkout(input)`
+ * runs the Function `checkout` that the key's Branch runs, on the key's Dataset, and answers its
+ * output.
  *
- * — and from then on `createClient({ apiKey })`, with no generic and no `schema:`, is typed by that
- * schema. The pattern is TanStack Router's. It is type-level only: nothing at runtime reads it.
+ * Call it from your server with a secret key. A publishable key calls only a Function declaring
+ * `endUsers` (spec 4, REL-3892) — with a signed-in End user's token (`getToken`) when it says
+ * `'required'` — and is refused any other (`PublishableKeyRefusedError`); a read-only secret key
+ * runs only a Function whose reach writes nothing (`ReadOnlyKeyError`). A call carrying an End
+ * user's token hands the run `run.endUser`, whatever the key. A run whose code threw or was ended at a limit throws
+ * `FunctionRunFailedError`, and one that outlived the service's five-minute wait
+ * `FunctionRunTimedOutError` — each naming the run (`runId`), whose record and console output Manage
+ * serves. A call is never retried: a Function may write, and a second call would be a second run.
  */
-interface Register {
+
+/** What a Function call takes beside its input. */
+interface FunctionCallOptions {
+    /** The dataset, by id or name, over the client's. */
+    dataset?: string;
+    signal?: AbortSignal;
+    /** How long to wait, in milliseconds. {@link FUNCTION_CALL_TIMEOUT_MS} when left out. */
+    timeout?: number;
+    /**
+     * A key naming this call (REL-3822): every Record batch the run sends is keyed by it, so the same
+     * key sent again — a shopper's double click, your own retry — runs the Function again but writes
+     * nothing the first call wrote, answering what it answered. Kept 24 hours. None is minted: a call
+     * is never retried by this client.
+     */
+    idempotencyKey?: string;
 }
+/** One Function, called: its input, as its input Fields declare it, and its output. */
+type FunctionCall = (input?: Record<string, unknown>, options?: FunctionCallOptions) => Promise<unknown>;
 /**
- * The schema the project registered through `Register`, or `undefined` when nothing did — which is
- * the untyped client, exactly as before the generator ran.
+ * `relyio.functions`: every Function the key's Branch runs, by name. A name the Branch does not run
+ * is refused by the service (`ResourceNotFoundError`), not here.
  */
-type RegisteredSchema = Register extends {
-    schema: infer S extends AnySchemaDefinition;
-} ? S : undefined;
+type FunctionsAccessor = {
+    readonly [name: string]: FunctionCall;
+};
 
 /**
  * What the search family's routes answer, read from the committed document, and what a search over
@@ -2823,11 +2432,19 @@ interface DeployedContentType {
 }
 /**
  * The defaults `client.with()` gives the client it makes (REL-2417, Q9): the locale and the dataset
- * its reads and writes are in unless a call names its own. A locale is one the schema declares.
+ * its reads and writes are in unless a call names its own, and the End user's token function its
+ * requests ask in place of the parent's (REL-3882). A locale is one the schema declares.
  */
 interface ClientDefaults<TSchema extends AnySchemaDefinition | undefined = undefined> {
     readonly locale?: LocaleCodeOf<TSchema>;
     readonly dataset?: string;
+    /**
+     * The signed-in End user's token, asked for on every request this client sends — and every
+     * request of a client `with()` makes from it that names none — in place of the parent's
+     * `getToken`. `@relyio/react`'s provider hands it Clerk's `useAuth().getToken`. See
+     * `RelyIOConfig.getToken`.
+     */
+    readonly getToken?: () => Promise<string | null>;
 }
 /** The locale codes a client's reads may name: the schema's, or any where no schema types it. */
 type LocaleCodeOf<TSchema extends AnySchemaDefinition | undefined> = TSchema extends AnySchemaDefinition ? SchemaLocaleCodes<TSchema> : string;
@@ -2861,6 +2478,21 @@ interface TypedClientConfig<TSchema extends AnySchemaDefinition | undefined = un
  * const batch = await relyio.batch([{ create: 'product', data: { title: 'New' } }])
  * ```
  */
+/** The Record type names a client's schema declares, or any string without one. */
+type RecordTypeNameOf<TSchema> = TSchema extends AnySchemaDefinition ? SchemaRecordTypeNames<TSchema> : string;
+/**
+ * `relyio.records`: called with a Record type, that type's Records; `.batch([...])`, a list of
+ * Record operations across types in one transaction, all or none (REL-3774).
+ */
+interface RecordsAccessor<TSchema extends AnySchemaDefinition | undefined> {
+    <K extends RecordTypeNameOf<TSchema>>(recordType: K): TSchema extends AnySchemaDefinition ? RecordsClient<InferRecordType<NonNullable<TSchema['recordTypes']>[K & keyof NonNullable<TSchema['recordTypes']>]>, RecordWriteFieldsOf<NonNullable<TSchema['recordTypes']>[K & keyof NonNullable<TSchema['recordTypes']>]>, RecordUpdateFieldsOf<NonNullable<TSchema['recordTypes']>[K & keyof NonNullable<TSchema['recordTypes']>]>> : RecordsClient<BaseRecord>;
+    /**
+     * Run Record operations — `create`, `update`, `delete`, `increment`, `decrement`, across Record
+     * types — in one transaction: every one lands, or none does. A refused one rolls the batch back
+     * and throws naming it (`refusedOperationOf(error)` reads its index).
+     */
+    batch(operations: ReadonlyArray<RecordBatchOperation<RecordTypeNameOf<TSchema>>>, options?: RecordBatchOptions): Promise<RecordBatchResult>;
+}
 declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined = undefined> {
     /**
      * The one HTTP client every sub-client sends through. `updateConfig()` and `setApiKey()` change it
@@ -2887,7 +2519,10 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * `createClient()` made, which reads its own.
      */
     private parent;
-    /** What `with()` gave this client over its parent's: the locale and dataset it names, and no other. */
+    /**
+     * What `with()` gave this client over its parent's: the locale, dataset and End user's token
+     * function it names, and no other.
+     */
     private defaults;
     /** The live edge's poll client id: chosen once, when first needed, and kept for this client's life. */
     private _liveClientId;
@@ -2936,6 +2571,41 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * ```
      */
     content<K extends TSchema extends AnySchemaDefinition ? SchemaContentTypeNames<TSchema> : string>(contentType: K): TSchema extends AnySchemaDefinition ? ContentClient<InferContentType<TSchema['contentTypes'][K & keyof TSchema['contentTypes']], TSchema>, ContentReading<TSchema['contentTypes'][K & keyof TSchema['contentTypes']], TSchema>> : ContentClient<BaseContent>;
+    /**
+     * The Records of one Record type (spec 1, REL-3771): `create`, `list`, `get`, `update`, `delete`.
+     * Type-safe when a schema is provided — the names autocomplete its `recordTypes` and the fields
+     * are the type's. `relyio.records.batch([...])` writes Records of any types in one transaction,
+     * all or none (REL-3774).
+     *
+     * A Record is an app's data, written by your server with a secret key and live the moment it
+     * lands. A publishable key reads the Records a Record type's read Policy grants it (spec 4,
+     * REL-3883), and writes them only for the End user whose token it carries, as the type's write
+     * Policy allows (REL-3884); with no token it writes nothing (`PUBLISHABLE_KEY_REFUSED`).
+     *
+     * @example
+     * ```typescript
+     * const order = await relyio.records('order').create({ shopperEmail: 'ada@example.com', total: 19 })
+     * const { data: orders } = await relyio.records('order').list({ where: { status: 'paid' } })
+     * await relyio.records.batch([
+     *   { op: 'decrement', type: 'inventory', where: { product: mugId }, field: 'available', by: 1 },
+     *   { op: 'create', type: 'order', fields: { shopperEmail: 'ada@example.com', total: 19 } },
+     * ])
+     * ```
+     */
+    readonly records: RecordsAccessor<TSchema>;
+    /**
+     * The project's Functions, by name (spec 2, REL-3821): `relyio.functions.checkout({ cartId })`
+     * runs the Function `checkout` that the key's Branch runs, on the key's Dataset, and answers its
+     * output. Call it from your server with a secret key; a run that failed throws
+     * `FunctionRunFailedError` and one past five minutes `FunctionRunTimedOutError`, each naming the
+     * run. Never retried: a Function may write.
+     *
+     * @example
+     * ```typescript
+     * const { orderId } = (await relyio.functions.checkout({ cartId })) as { orderId: string }
+     * ```
+     */
+    readonly functions: FunctionsAccessor;
     /**
      * Get an asset client for a specific asset type.
      *
@@ -3280,6 +2950,9 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * const { data } = await staging.content('post').list({ limit: 10 })
      *
      * const french = relyio.with({ locale: 'fr-FR' }) // ← autocompletes the schema's locales
+     *
+     * // Every request this one sends carries the signed-in End user's token (REL-3882)
+     * const visitor = relyio.with({ getToken: () => session.getToken() })
      * ```
      */
     with(defaults: ClientDefaults<TSchema>): TypedRelyIOClient<TSchema>;
@@ -3361,4 +3034,4 @@ declare function createClient<TSchema extends AnySchemaDefinition>(config: Typed
  */
 type ClientSchema<T extends TypedRelyIOClient<AnySchemaDefinition>> = T extends TypedRelyIOClient<infer TSchema> ? TSchema : never;
 
-export { type ChildrenOptions as $, type AnySchemaDefinition as A, LIVE_KEEPALIVE_INTERVAL_MS as B, type Change as C, type DeployedLocale as D, LIVE_SOCKET_OPEN_TIMEOUT_MS as E, type FeedChange as F, type LiveChangesOptions as G, type Health as H, ContentClient as I, type CreateEntryOptions as J, type EntryPlacement as K, type LocaleCodeOf as L, type MatchRouteOptions as M, type EntryWriteOptions as N, SingletonClient as O, type Project as P, SettingsClient as Q, type Register as R, type SandboxState as S, TypedRelyIOClient as T, type DocumentFields as U, type VisitorRetry as V, type Wire as W, type DocumentVersion as X, type DocumentVersionRow as Y, type DocumentVersionsOptions as Z, type DocumentWriteOptions as _, ChangesExpiredError as a, AssetClient as a$, type ChildrenListOptions as a0, type DocumentReadOptions as a1, type EntryList as a2, type FieldKey as a3, type FreshOption as a4, type GetOptions as a5, type ListAllOptions as a6, type ListOptions as a7, type LocaleOption as a8, type Paging as a9, type SearchSortOption as aA, type SearchWhere as aB, type SimilarOptions as aC, type BatchOperationResult as aD, type BatchSummary as aE, type BatchResponse as aF, type BatchWrite as aG, type BatchWriteOptions as aH, type BatchBody as aI, type BatchCreate as aJ, type BatchUpdate as aK, type BatchReplace as aL, type BatchDelete as aM, type BatchSingletonWrite as aN, type BatchTarget as aO, type BatchDeleteTarget as aP, type AggregateMetric as aQ, type QueryMetadata as aR, type AdhocQuery as aS, type AdhocRecord as aT, type NamedQueryOptions as aU, type NamedQueryParams as aV, type QueryAggregate as aW, type QueryAnswer as aX, type QueryCall as aY, type QueryName as aZ, type QueryTypeName as a_, type ChildEntry as aa, type ChildrenRead as ab, type ReadAs as ac, type WithChildren as ad, type ReadLocale as ae, type SortOption as af, type VersionOptions as ag, type WrittenReadScope as ah, type WrittenSort as ai, type SearchResultItem as aj, type SearchHitMetadata as ak, type SearchResponse as al, type AutocompleteSuggestion as am, type AutocompleteResponse as an, type SimilarResult as ao, type SimilarResponse as ap, type SearchTypeName as aq, type SearchEntry as ar, type AutocompleteOptions as as, type SearchFacet as at, type SearchFieldKey as au, type SearchHighlight as av, type SearchOptions as aw, type SearchPage as ax, type SearchScope as ay, type SearchSelected as az, type ChangesExpiredReason as b, AssetFileBuilder as b0, AssetUploadBuilder as b1, isAssetEntry as b2, type AssetVisibility as b3, type FileStatus as b4, type FileBackend as b5, type AssetFileExtracted as b6, type FileStatusResult as b7, type AssetEntryResponse as b8, type AssetFileWhere as b9, type PopulatedAssetReference as ba, type PresignInput as bb, type PresignResult as bc, type ConfirmInput as bd, type ConfirmResult as be, type ResolveUrlInput as bf, type ResolveUrlResult as bg, type CreateAssetOptions as bh, type AssetPlacement as bi, type UpdateAssetOptions as bj, type WaitUntilReadyOptions as bk, type MultipartCreateResult as bl, type MultipartPart as bm, type MultipartTarget as bn, type UploadProgress as bo, ResourceNotFoundError as bp, ResourceConflictError as bq, ResourceExpiredError as br, isResourceNotFound as bs, isMissingEntry as bt, type FileErrorCode as bu, type FileUploadErrorCode as bv, FileUploadError as bw, FileValidationError as bx, type FileValidationConstraints as by, validateFile as bz, createClient as c, type TypedClientConfig as d, type ClientDefaults as e, type ClientSchema as f, type DeployedContentType as g, type RegisteredSchema as h, type ActiveSandbox as i, HttpClient as j, type SendOptions as k, type ApiPath as l, type ApiMethod as m, type ApiSuccessBody as n, matchRoute as o, type RouteMatch as p, type ReadEntry as q, type RetryableWriteOptions as r, DefaultRetryPolicy as s, isReplaySafe as t, retryPolicyFor as u, versionCheckOf as v, type RetryPolicy as w, type RetryableRequest as x, type ChangesHeadOptions as y, type ChangesOptions as z };
+export { type SortOption as $, type ActiveSandbox as A, type ChildrenListOptions as B, type Change as C, type DeployedLocale as D, type EntryPlacement as E, type FeedChange as F, type DocumentReadOptions as G, type Health as H, type EntryList as I, type FieldKey as J, type FreshOption as K, type LocaleCodeOf as L, type GetOptions as M, type ListAllOptions as N, type ListOptions as O, type Project as P, type LocaleOption as Q, type RecordsAccessor as R, type SandboxState as S, TypedRelyIOClient as T, type Paging as U, type VisitorRetry as V, type ChildEntry as W, type ChildrenRead as X, type ReadAs as Y, type WithChildren as Z, type ReadLocale as _, ChangesExpiredError as a, type ResolveUrlInput as a$, type VersionOptions as a0, type WrittenReadScope as a1, type WrittenSort as a2, type SearchResultItem as a3, type SearchHitMetadata as a4, type SearchResponse as a5, type AutocompleteSuggestion as a6, type AutocompleteResponse as a7, type SimilarResult as a8, type SimilarResponse as a9, type AggregateMetric as aA, type QueryMetadata as aB, type AdhocQuery as aC, type AdhocRecord as aD, type NamedQueryOptions as aE, type NamedQueryParams as aF, type QueryAggregate as aG, type QueryAnswer as aH, type QueryCall as aI, type QueryName as aJ, type QueryTypeName as aK, AssetClient as aL, AssetFileBuilder as aM, AssetUploadBuilder as aN, isAssetEntry as aO, type AssetVisibility as aP, type FileStatus as aQ, type FileBackend as aR, type AssetFileExtracted as aS, type FileStatusResult as aT, type AssetEntryResponse as aU, type AssetFileWhere as aV, type PopulatedAssetReference as aW, type PresignInput as aX, type PresignResult as aY, type ConfirmInput as aZ, type ConfirmResult as a_, type SearchTypeName as aa, type SearchEntry as ab, type AutocompleteOptions as ac, type SearchFacet as ad, type SearchFieldKey as ae, type SearchHighlight as af, type SearchOptions as ag, type SearchPage as ah, type SearchScope as ai, type SearchSelected as aj, type SearchSortOption as ak, type SearchWhere as al, type SimilarOptions as am, type BatchOperationResult as an, type BatchSummary as ao, type BatchResponse as ap, type BatchWrite as aq, type BatchWriteOptions as ar, type BatchBody as as, type BatchCreate as at, type BatchUpdate as au, type BatchReplace as av, type BatchDelete as aw, type BatchSingletonWrite as ax, type BatchTarget as ay, type BatchDeleteTarget as az, type ChangesExpiredReason as b, type ResolveUrlResult as b0, type CreateAssetOptions as b1, type AssetPlacement as b2, type UpdateAssetOptions as b3, type WaitUntilReadyOptions as b4, type MultipartCreateResult as b5, type MultipartPart as b6, type MultipartTarget as b7, type UploadProgress as b8, ResourceNotFoundError as b9, ResourceConflictError as ba, ResourceExpiredError as bb, isResourceNotFound as bc, isMissingEntry as bd, type FileErrorCode as be, type FileUploadErrorCode as bf, FileUploadError as bg, FileValidationError as bh, type FileValidationConstraints as bi, validateFile as bj, createClient as c, type TypedClientConfig as d, type ClientDefaults as e, type ClientSchema as f, type DeployedContentType as g, type ReadEntry as h, type RetryableWriteOptions as i, type ChangesHeadOptions as j, type ChangesOptions as k, LIVE_KEEPALIVE_INTERVAL_MS as l, LIVE_SOCKET_OPEN_TIMEOUT_MS as m, type LiveChangesOptions as n, ContentClient as o, type CreateEntryOptions as p, type EntryWriteOptions as q, SingletonClient as r, SettingsClient as s, type DocumentFields as t, type DocumentVersion as u, versionCheckOf as v, type DocumentVersionRow as w, type DocumentVersionsOptions as x, type DocumentWriteOptions as y, type ChildrenOptions as z };