@relyio/sdk 0.17.0 → 0.19.0

package/dist/{chunk-VS2DEUTN.js → chunk-356SF5Y2.js}

@@ -1,7 +1,8 @@
-import { parseDevEnv, DEV_CONTEXT_DIR, DEV_CONTEXT_FILENAME, parseDevContextFile } from './chunk-BBUB7C2Z.js';
-import { VISITOR_CLOSE_CODES, HEADER_RETRY_AFTER, HEADER_IDEMPOTENCY_KEY, UNKNOWN_PREVIEW_RECHECK_MS, entityTag, HEADER_IF_MATCH, FRESH_PARAMETER, VISITOR_KEEPALIVE, parseVisitorFrame, VISITOR_FRAMES, VISITOR_POLL_INTERVAL_MS, VISITOR_CLOSE_RETRY, readVisitorPollAnswer, VISITOR_POLL_RETRY, VISITOR_LIVE_PATH, VISITOR_QUERY, previewAtRequest, previewDatasetSlug } from './chunk-OVMIHAYK.js';
-import { isBrowser } from './chunk-H6IBQSMM.js';
-import { __name, __publicField } from './chunk-XQ4QHWZE.js';
+import { isBrowser } from './chunk-NJQK5STK.js';
+import { parseDevEnv, DEV_CONTEXT_DIR, DEV_CONTEXT_FILENAME, parseDevContextFile } from './chunk-W2A4OTCI.js';
+import { UNKNOWN_PREVIEW_RECHECK_MS, previewAtRequest } from './chunk-HDHBYYEY.js';
+import { HEADER_END_USER, VISITOR_CLOSE_CODES, HEADER_RETRY_AFTER, END_USER_TOKEN_REFUSAL_REASONS, HEADER_IDEMPOTENCY_KEY, entityTag, HEADER_IF_MATCH, FRESH_PARAMETER, VISITOR_KEEPALIVE, parseVisitorFrame, VISITOR_FRAMES, VISITOR_POLL_INTERVAL_MS, VISITOR_CLOSE_RETRY, readVisitorPollAnswer, VISITOR_POLL_RETRY, VISITOR_LIVE_PATH, VISITOR_QUERY, previewDatasetSlug } from './chunk-T7LGREB3.js';
+import { __name, __publicField } from './chunk-DI6KFDBO.js';
 
 /* RelyIO SDK - Built with ❤️ by the RelyIO Team */
 
@@ -167,6 +168,70 @@ var _ReadOnlyKeyError = class _ReadOnlyKeyError extends SDKError {
 };
 __name(_ReadOnlyKeyError, "ReadOnlyKeyError");
 var ReadOnlyKeyError = _ReadOnlyKeyError;
+var _PublishableKeyRefusedError = class _PublishableKeyRefusedError extends SDKError {
+  constructor(message = "A publishable key writes a Record only for a signed-in End user", context) {
+    super(message, 403, void 0, context);
+    __publicField(this, "code", "PUBLISHABLE_KEY_REFUSED");
+    __publicField(this, "retryable", false);
+  }
+  getUserMessage() {
+    return "A publishable key writes a Record only with a signed-in End user's token, and runs only a Function declaring endUsers. Send the End user's token, declare endUsers on the Function, or call it from your server with a secret key.";
+  }
+};
+__name(_PublishableKeyRefusedError, "PublishableKeyRefusedError");
+var PublishableKeyRefusedError = _PublishableKeyRefusedError;
+var _FunctionRunFailedError = class _FunctionRunFailedError extends SDKError {
+  constructor(message = "The Function ended without an answer", run = {}, context) {
+    super(message, 500, void 0, context);
+    __publicField(this, "code", "FUNCTION_RUN_FAILED");
+    __publicField(this, "retryable", false);
+    __publicField(this, "runId");
+    __publicField(this, "failure");
+    __publicField(this, "runError");
+    this.runId = run.runId;
+    this.failure = run.failure;
+    this.runError = run.runError;
+  }
+  getUserMessage() {
+    return this.runId === void 0 ? "The Function ended without an answer." : `The Function ended without an answer; its run is ${this.runId}.`;
+  }
+};
+__name(_FunctionRunFailedError, "FunctionRunFailedError");
+var FunctionRunFailedError = _FunctionRunFailedError;
+var _FunctionContainersBusyError = class _FunctionContainersBusyError extends SDKError {
+  constructor(message = "The project is running as many Containers as its plan includes", name, context, retryAfterMs) {
+    super(message, 429, void 0, context);
+    __publicField(this, "code", "FUNCTION_CONTAINERS_BUSY");
+    __publicField(this, "retryable", false);
+    /** The Function that was not started. */
+    __publicField(this, "function");
+    /** `Retry-After`, in milliseconds, where the response carried a readable one. */
+    __publicField(this, "retryAfterMs");
+    this.function = name;
+    this.retryAfterMs = retryAfterMs;
+  }
+  getUserMessage() {
+    return "Every Container this project may run at once is busy. Call again shortly.";
+  }
+};
+__name(_FunctionContainersBusyError, "FunctionContainersBusyError");
+var FunctionContainersBusyError = _FunctionContainersBusyError;
+var _FunctionRunTimedOutError = class _FunctionRunTimedOutError extends SDKError {
+  constructor(message = "The Function had not answered within the wait", run = {}, context) {
+    super(message, 504, void 0, context);
+    __publicField(this, "code", "FUNCTION_RUN_TIMED_OUT");
+    __publicField(this, "retryable", false);
+    __publicField(this, "runId");
+    __publicField(this, "waitedMs");
+    this.runId = run.runId;
+    this.waitedMs = run.waitedMs;
+  }
+  getUserMessage() {
+    return this.runId === void 0 ? "The Function had not answered within the wait; it runs on." : `The Function had not answered within the wait; run ${this.runId} runs on.`;
+  }
+};
+__name(_FunctionRunTimedOutError, "FunctionRunTimedOutError");
+var FunctionRunTimedOutError = _FunctionRunTimedOutError;
 var _PlanFeatureUnavailableError = class _PlanFeatureUnavailableError extends SDKError {
   constructor(message = "This feature is not available on the current plan", feature, context) {
     super(message, 403, void 0, context);
@@ -327,6 +392,19 @@ var _InvalidApiKeyError = class _InvalidApiKeyError extends SDKError {
 };
 __name(_InvalidApiKeyError, "InvalidApiKeyError");
 var InvalidApiKeyError = _InvalidApiKeyError;
+var _EndUserTokenInvalidError = class _EndUserTokenInvalidError extends SDKError {
+  constructor(message, reason, context) {
+    super(message, 401, void 0, context);
+    this.reason = reason;
+    __publicField(this, "code", "END_USER_TOKEN_INVALID");
+    __publicField(this, "retryable", false);
+  }
+  getUserMessage() {
+    return "Your session is not valid. Please sign in again.";
+  }
+};
+__name(_EndUserTokenInvalidError, "EndUserTokenInvalidError");
+var EndUserTokenInvalidError = _EndUserTokenInvalidError;
 
 // src/errors/network-errors.ts
 var _NetworkError = class _NetworkError extends SDKError {
@@ -528,12 +606,18 @@ var _ErrorMapper = class _ErrorMapper {
       case "INVALID_API_KEY": {
         return new InvalidApiKeyError(message, void 0, context);
       }
+      case "END_USER_TOKEN_INVALID": {
+        return new EndUserTokenInvalidError(message, endUserTokenReasonOf(refusal), context);
+      }
       case "ACCESS_DENIED": {
         return new AuthorizationError(message, 403, void 0, context);
       }
       case "READ_ONLY_KEY": {
         return new ReadOnlyKeyError(message, context);
       }
+      case "PUBLISHABLE_KEY_REFUSED": {
+        return new PublishableKeyRefusedError(message, context);
+      }
       case "PLAN_FEATURE_UNAVAILABLE": {
         return new PlanFeatureUnavailableError(message, detailString(refusal, "feature"), context);
       }
@@ -577,7 +661,8 @@ var _ErrorMapper = class _ErrorMapper {
         return new ResourceConflictError(guidance, 409, void 0, {
           ...context,
           // What stands in the way, as a declared kind a program switches on: `draft-exists`,
-          // `release-locked` or `slug-taken` from the Content API (REL-2446).
+          // `release-locked`, `slug-taken` or `value-taken` from the Content API (REL-2446,
+          // REL-3767).
           blockage,
           expectedVersion,
           actualVersion: detailNumber(refusal, "actualVersion"),
@@ -614,6 +699,32 @@ var _ErrorMapper = class _ErrorMapper {
           retryAfterMs
         );
       }
+      case "FUNCTION_RUN_FAILED": {
+        return new FunctionRunFailedError(
+          message,
+          {
+            runId: detailString(refusal, "runId"),
+            failure: detailString(refusal, "failure"),
+            runError: runErrorOf(refusal)
+          },
+          context
+        );
+      }
+      case "FUNCTION_RUN_TIMED_OUT": {
+        return new FunctionRunTimedOutError(
+          message,
+          { runId: detailString(refusal, "runId"), waitedMs: detailNumber(refusal, "waitedMs") },
+          context
+        );
+      }
+      case "FUNCTION_CONTAINERS_BUSY": {
+        return new FunctionContainersBusyError(
+          message,
+          detailString(refusal, "function"),
+          context,
+          retryAfterMs
+        );
+      }
       case "INTERNAL_ERROR": {
         return new ServerError(message, status, context);
       }
@@ -678,6 +789,13 @@ function detailNumber(refusal, key) {
   return typeof value === "number" ? value : void 0;
 }
 __name(detailNumber, "detailNumber");
+function runErrorOf(refusal) {
+  const error = detailBag(refusal)?.error;
+  if (typeof error !== "object" || error === null) return void 0;
+  const { name, message } = error;
+  return typeof name === "string" && typeof message === "string" ? { name, message } : void 0;
+}
+__name(runErrorOf, "runErrorOf");
 function blockageOf(refusal) {
   const blockage = detailBag(refusal)?.blockage;
   if (typeof blockage !== "object" || blockage === null) return void 0;
@@ -698,6 +816,15 @@ function violationsOf(refusal) {
   }));
 }
 __name(violationsOf, "violationsOf");
+function endUserTokenReasonOf(refusal) {
+  const reason = detailString(refusal, "reason");
+  return isEndUserTokenReason(reason) ? reason : void 0;
+}
+__name(endUserTokenReasonOf, "endUserTokenReasonOf");
+function isEndUserTokenReason(value) {
+  return value !== void 0 && END_USER_TOKEN_REFUSAL_REASONS.includes(value);
+}
+__name(isEndUserTokenReason, "isEndUserTokenReason");
 
 // src/http/api-routes.ts
 function fillPath(template, params) {
@@ -725,6 +852,17 @@ var DECLARED_PATHS = {
   "/health/cache": true,
   "/health/live": true,
   "/health/ready": true,
+  "/internal/functions/runs/{runId}/actions": true,
+  "/internal/functions/runs/{runId}/bundle": true,
+  "/internal/functions/runs/{runId}/content": true,
+  "/internal/functions/runs/{runId}/outcome": true,
+  "/internal/functions/runs/{runId}/recorded": true,
+  "/internal/functions/runs/{runId}/records/batch": true,
+  "/internal/functions/runs/{runId}/records/file": true,
+  "/internal/functions/runs/{runId}/records/read": true,
+  "/internal/functions/tasks/{taskId}/run": true,
+  "/internal/functions/test-runs/{projectId}/{name}": true,
+  "/internal/functions/tool-calls/{projectId}/{name}": true,
   "/internal/live/visitor-feed/{projectId}/{datasetId}/changes": true,
   "/internal/live/visitor-key": true,
   "/internal/media/claim": true,
@@ -761,6 +899,11 @@ var DECLARED_PATHS = {
   "/v1/project": true,
   "/v1/queries/{name}": true,
   "/v1/query": true,
+  "/v1/functions/{name}": true,
+  "/v1/records/batch": true,
+  "/v1/records/{recordType}": true,
+  "/v1/records/{recordType}/files": true,
+  "/v1/records/{recordType}/{uid}": true,
   "/v1/search": true,
   "/v1/search/autocomplete": true,
   "/v1/search/similar": true,
@@ -1054,22 +1197,33 @@ var _HttpClient = class _HttpClient {
    * constructor accepts one so that a module-scope client can be evaluated by a
    * build that holds no key (REL-1120) — and so does one whose `setApiKey` was
    * given none.
+   *
+   * The End user's token is asked for once, after the key is known to be there and before the first
+   * attempt — of `getToken`, the nearest view's function, or the configuration's — so every retry
+   * of one call sends the token its first attempt sent. See `RelyIOConfig.getToken`.
    */
-  async request(config) {
+  async request(config, getToken) {
     if (this.view !== void 0) {
-      return this.view.client.request({
-        ...config,
-        headers: layerHeaders(this.view.headers, config.headers)
-      });
+      return this.view.client.request(
+        { ...config, headers: layerHeaders(this.view.headers, config.headers) },
+        getToken ?? this.view.getToken
+      );
     }
     if (config.timeout !== void 0) assertRequestTimeout(config.timeout);
     const mergedConfig = this.mergeRequestConfig(config);
-    if (presentKey(headerValue(mergedConfig.headers, API_KEY_HEADER)) === void 0) {
+    if (presentCredential(headerValue(mergedConfig.headers, API_KEY_HEADER)) === void 0) {
       throw new MissingApiKeyError(
         "`apiKey` is missing: this client holds no API key, so the request was not sent. Pass `apiKey` to createClient \u2014 the documented setup reads it from RELYIO_API_KEY.",
         { url: mergedConfig.url, method: mergedConfig.method, sent: false }
       );
     }
+    const tokenSource = getToken ?? this.connection.config.getToken;
+    if (tokenSource !== void 0) {
+      const token = presentCredential(await tokenSource());
+      mergedConfig.headers = layerHeaders(mergedConfig.headers ?? {}, {
+        [END_USER_HEADER]: token ?? null
+      });
+    }
     this.log("debug", "Making request", {
       method: mergedConfig.method,
       url: mergedConfig.url
@@ -1113,7 +1267,7 @@ var _HttpClient = class _HttpClient {
         });
         if (preview !== void 0 && answersUnknownDataset(sdkError, preview)) {
           rememberUnknownPreview(preview);
-          return this.request(config);
+          return this.request(config, getToken);
         }
         this.log("error", "Request failed after all retries", {
           error: sdkError.toJSON(),
@@ -1334,10 +1488,17 @@ var _ControlledHttpClient = class _ControlledHttpClient extends HttpClient {
    * retries and `fetch` are this client's as they are when each request is sent, so a later
    * `configure()` or `setApiKey()` on this client reaches the view, and one on the view reaches
    * this client. `client.with({ dataset })` is one (REL-2417).
+   *
+   * `options.getToken` is the End user's token function the view asks in place of this client's,
+   * and of any view it is made from: `client.with({ getToken })` (REL-3882).
    */
-  withHeaders(headers) {
+  withHeaders(headers, options = {}) {
     const view = new _ControlledHttpClient(this.connection.config);
-    view.view = { client: this, headers: { ...headers } };
+    view.view = {
+      client: this,
+      headers: { ...headers },
+      ...options.getToken === void 0 ? {} : { getToken: options.getToken }
+    };
     return view;
   }
   /**
@@ -1359,7 +1520,7 @@ var _ControlledHttpClient = class _ControlledHttpClient extends HttpClient {
    * Replace the key every later request sends as `X-API-Key`, and the `apiKey` the configuration
    * reports.
    *
-   * The key is read the way construction reads it (`presentKey`): an absent, empty or blank key is
+   * The key is read the way construction reads it (`presentCredential`): an absent, empty or blank key is
    * no key, so the header is dropped and the next request is refused with `MissingApiKeyError`
    * before anything is sent. A key header of any other spelling — one given in `headers` — goes
    * too, from the headers sent and from the headers the configuration reports, so the old key is
@@ -1380,7 +1541,7 @@ var _ControlledHttpClient = class _ControlledHttpClient extends HttpClient {
     this.connection = {
       ...this.connection,
       defaultHeaders: layerHeaders(this.connection.defaultHeaders, {
-        [API_KEY_HEADER]: presentKey(apiKey) ?? null
+        [API_KEY_HEADER]: presentCredential(apiKey) ?? null
       })
     };
   }
@@ -1389,6 +1550,7 @@ __name(_ControlledHttpClient, "ControlledHttpClient");
 var ControlledHttpClient = _ControlledHttpClient;
 var API_KEY_HEADER = "X-API-Key";
 var DATASET_HEADER = "X-RelyIO-Dataset";
+var END_USER_HEADER = HEADER_END_USER.name;
 function derivedPreviewIn(headers) {
   const dataset = headerValue(headers, DATASET_HEADER);
   return dataset !== void 0 && isDerivedPreview(dataset) ? dataset : void 0;
@@ -1407,7 +1569,7 @@ function connectionFor(config) {
   const defaultHeaders = layerHeaders(
     layerHeaders({ "Content-Type": "application/json" }, config.headers),
     {
-      [API_KEY_HEADER]: presentKey(config.apiKey),
+      [API_KEY_HEADER]: presentCredential(config.apiKey),
       [DATASET_HEADER]: config.dataset,
       // Only outside a browser, which controls this header. "A browser" is the core's one
       // definition, `isBrowser()` — every environment question in this file asks it.
@@ -1439,10 +1601,10 @@ function layerHeaders(base, over) {
   return layered;
 }
 __name(layerHeaders, "layerHeaders");
-function presentKey(value) {
+function presentCredential(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
-__name(presentKey, "presentKey");
+__name(presentCredential, "presentCredential");
 function credentialsModeFor(includeCredentials) {
   return includeCredentials ? "include" : "same-origin";
 }
@@ -2744,6 +2906,200 @@ var _SettingsClient = class _SettingsClient extends DocumentHandle {
 __name(_SettingsClient, "SettingsClient");
 var SettingsClient = _SettingsClient;
 
+// src/content/records-client.ts
+function isMissingRecord(error) {
+  return error instanceof ResourceNotFoundError && error.context?.resourceType === "record";
+}
+__name(isMissingRecord, "isMissingRecord");
+var _RecordsClient = class _RecordsClient {
+  constructor(httpClient, recordType) {
+    this.httpClient = httpClient;
+    this.recordType = recordType;
+  }
+  /**
+   * Store a Record, live the moment it lands. Values that break the Record type's fields are
+   * refused with `ValidationError` naming each field, and nothing is stored. Values a unique set of
+   * the type claims, held by another Record, are refused with `ResourceConflictError` — its
+   * `blockage` is `{ kind: 'value-taken', facts: { fields, recordId } }` (REL-3782) — with no
+   * `recordId` for an End user's write, whose read Policy may hide the holder (REL-3863).
+   */
+  async create(fields, options = {}) {
+    return this.httpClient.fetchPayload(
+      "/v1/records/{recordType}",
+      "post",
+      {
+        path: { recordType: this.recordType },
+        body: { fields },
+        headers: readHeaders(options),
+        ...signalOf(options)
+      }
+    );
+  }
+  /** One page of the Records `where` keeps, newest first unless `sort` names one key. */
+  async list(options = {}) {
+    const response = await this.httpClient.send(
+      "/v1/records/{recordType}",
+      "get",
+      {
+        path: { recordType: this.recordType },
+        query: {
+          ...options.where === void 0 ? {} : { filters: JSON.stringify(options.where) },
+          ...options.sort === void 0 ? {} : { sort: options.sort },
+          ...options.limit === void 0 ? {} : { limit: options.limit },
+          ...options.cursor === void 0 ? {} : { cursor: options.cursor },
+          ...options.count === true ? { count: "true" } : {},
+          ...options.facets === void 0 || options.facets.length === 0 ? {} : { facets: options.facets.join(",") },
+          ...includeQuery(options)
+        },
+        headers: readHeaders(options),
+        ...signalOf(options)
+      }
+    );
+    return response.body;
+  }
+  /**
+   * Upload a File for one of this Record type's file fields (REL-3824), and answer what a create or
+   * update sets the field to. The bytes go straight to object storage at the address the upload
+   * names, never through RelyIO; a File outside the field's `accept` or over its `maxSize` is
+   * refused with `ValidationError` naming the field before any byte is sent. An upload no write
+   * names within a day is deleted with its bytes. Server-side only, as every Record call is.
+   *
+   * @example
+   * ```typescript
+   * const invoice = await relyio.records('order').upload('invoice', pdfBytes, {
+   *   name: 'invoice-1001.pdf',
+   *   type: 'application/pdf',
+   * })
+   * await relyio.records('order').update(id, { invoice }, { revision })
+   * ```
+   */
+  async upload(field, bytes, options) {
+    const size = bytes instanceof Blob ? bytes.size : bytes.byteLength;
+    const upload = await this.httpClient.fetchPayload("/v1/records/{recordType}/files", "post", {
+      path: { recordType: this.recordType },
+      body: { field, name: options.name, type: options.type, size },
+      headers: readHeaders(options),
+      ...signalOf(options)
+    });
+    const response = await HttpClient.transfer(this.httpClient, upload.url, {
+      method: upload.method,
+      headers: upload.headers,
+      body: bytes,
+      ...signalOf(options)
+    });
+    if (!response.ok) {
+      throw new FileUploadError(
+        "INTERNAL",
+        `Upload failed (${response.status} ${response.statusText}) for ${this.recordType}.${field}`,
+        { retriable: response.status >= 500, statusCode: response.status }
+      );
+    }
+    return { upload: upload.id };
+  }
+  /**
+   * One Record by its id, or `null` when none is stored. A Record type nobody deployed throws
+   * `ResourceNotFoundError` naming it, so it never reads as a missing Record.
+   */
+  async get(id, options = {}) {
+    try {
+      return await this.httpClient.fetchPayload(
+        "/v1/records/{recordType}/{uid}",
+        "get",
+        {
+          path: { recordType: this.recordType, uid: id },
+          query: includeQuery(options),
+          headers: readHeaders(options),
+          ...signalOf(options)
+        }
+      );
+    } catch (error) {
+      if (isMissingRecord(error)) return null;
+      throw error;
+    }
+  }
+  /**
+   * Change the fields named, against the revision the change was made on, and answer the Record at
+   * its next revision. A field given `null` is removed; one not named keeps its value. A Record
+   * written since `revision` is refused with `ResourceConflictError` — its `blockage` is
+   * `{ kind: 'revision-stale', facts: { changedFields } }` — and nothing is written. Values that
+   * break the Record type are refused with `ValidationError` naming each field, and values another
+   * Record holds under a unique set with `ResourceConflictError`, its blockage `value-taken`.
+   *
+   * @example
+   * ```typescript
+   * const order = await relyio.records('order').get(id)
+   * await relyio.records('order').update(id, { status: 'shipped' }, {
+   *   revision: order._metadata.revision,
+   * })
+   * ```
+   */
+  async update(id, fields, options) {
+    return this.httpClient.fetchPayload(
+      "/v1/records/{recordType}/{uid}",
+      "patch",
+      {
+        path: { recordType: this.recordType, uid: id },
+        body: { fields },
+        headers: { ...readHeaders(options), "If-Match": `"${options.revision}"` },
+        ...signalOf(options)
+      }
+    );
+  }
+  /**
+   * Remove a Record. Another Record holding it through a reference declared to block its delete —
+   * the default — is refused with `ResourceConflictError`, its `blockage`
+   * (`{ kind: 'referenced', facts: { referrers } }`) naming each; one declared `nullify` is cleared.
+   */
+  async delete(id, options = {}) {
+    await this.httpClient.send(
+      "/v1/records/{recordType}/{uid}",
+      "delete",
+      {
+        path: { recordType: this.recordType, uid: id },
+        headers: readHeaders(options),
+        ...signalOf(options)
+      }
+    );
+  }
+};
+__name(_RecordsClient, "RecordsClient");
+var RecordsClient = _RecordsClient;
+function includeQuery(options) {
+  return {
+    ...options.include === void 0 || options.include.length === 0 ? {} : { include: options.include.join(",") },
+    ...options.locale === void 0 ? {} : { locale: options.locale }
+  };
+}
+__name(includeQuery, "includeQuery");
+
+// src/content/record-batch.ts
+async function sendRecordBatch(httpClient, operations, options = {}) {
+  const { idempotencyKey, ...call } = options;
+  return httpClient.fetchPayload(
+    "/v1/records/batch",
+    "post",
+    {
+      body: { operations },
+      headers: { ...readHeaders(call), ...writeHeaders({ idempotencyKey }) },
+      ...signalOf(call)
+    }
+  );
+}
+__name(sendRecordBatch, "sendRecordBatch");
+var OPERATION_PATH = /^operations\[(\d+)\]/;
+function refusedOperationOf(error) {
+  if (typeof error !== "object" || error === null) return void 0;
+  const { context, violations } = error;
+  const operation = context?.blockage?.facts?.operation;
+  if (typeof operation === "number") return operation;
+  for (const violation of violations ?? []) {
+    const match = typeof violation.field === "string" ? OPERATION_PATH.exec(violation.field) : null;
+    if (match?.[1] !== void 0) return Number(match[1]);
+  }
+  return void 0;
+}
+__name(refusedOperationOf, "refusedOperationOf");
+
 // src/changes/changes.ts
 var CHANGES_POLL_TIMEOUT_MS = 25e3 + 5e3;
 var EXPIRED_REASONS2 = {
@@ -3362,6 +3718,32 @@ function hasOwn(object, key) {
 }
 __name(hasOwn, "hasOwn");
 
+// src/content/functions-client.ts
+var FUNCTION_CALL_TIMEOUT_MS = 31e4;
+async function callFunction(http, name, input, options) {
+  return await http.fetchPayload("/v1/functions/{name}", "post", {
+    path: { name },
+    body: { input },
+    headers: {
+      ...readHeaders({ dataset: options.dataset }),
+      ...options.idempotencyKey === void 0 ? {} : { [HEADER_IDEMPOTENCY_KEY.name]: options.idempotencyKey }
+    },
+    timeout: options.timeout ?? FUNCTION_CALL_TIMEOUT_MS,
+    ...signalOf(options)
+  });
+}
+__name(callFunction, "callFunction");
+function functionsAccessor(http) {
+  return new Proxy({}, {
+    get: /* @__PURE__ */ __name((_target, property) => {
+      if (typeof property !== "string" || property === "then") return void 0;
+      const call = /* @__PURE__ */ __name((input = {}, options = {}) => callFunction(http(), property, input, options), "call");
+      return call;
+    }, "get")
+  });
+}
+__name(functionsAccessor, "functionsAccessor");
+
 // src/search/search-options.ts
 function scopeOf(contentType) {
   if (contentType === void 0) return { contentTypes: "*" };
@@ -3780,6 +4162,9 @@ function validateConfig(config) {
   if (config.webSocket != null && typeof config.webSocket !== "function") {
     throw new Error("webSocket must be a WebSocket class");
   }
+  if (config.getToken != null && typeof config.getToken !== "function") {
+    throw new Error("getToken must be a function that answers the End user\u2019s token, or null");
+  }
   if (config.timeout != null) assertRequestTimeout(config.timeout);
   if (config.retryAttempts != null && !(Number.isInteger(config.retryAttempts) && config.retryAttempts >= 1)) {
     throw new Error(
@@ -3908,10 +4293,57 @@ var _TypedRelyIOClient = class _TypedRelyIOClient {
      * `createClient()` made, which reads its own.
      */
     __publicField(this, "parent");
-    /** What `with()` gave this client over its parent's: the locale and dataset it names, and no other. */
+    /**
+     * What `with()` gave this client over its parent's: the locale, dataset and End user's token
+     * function it names, and no other.
+     */
     __publicField(this, "defaults", {});
     /** The live edge's poll client id: chosen once, when first needed, and kept for this client's life. */
     __publicField(this, "_liveClientId");
+    /**
+     * The Records of one Record type (spec 1, REL-3771): `create`, `list`, `get`, `update`, `delete`.
+     * Type-safe when a schema is provided — the names autocomplete its `recordTypes` and the fields
+     * are the type's. `relyio.records.batch([...])` writes Records of any types in one transaction,
+     * all or none (REL-3774).
+     *
+     * A Record is an app's data, written by your server with a secret key and live the moment it
+     * lands. A publishable key reads the Records a Record type's read Policy grants it (spec 4,
+     * REL-3883), and writes them only for the End user whose token it carries, as the type's write
+     * Policy allows (REL-3884); with no token it writes nothing (`PUBLISHABLE_KEY_REFUSED`).
+     *
+     * @example
+     * ```typescript
+     * const order = await relyio.records('order').create({ shopperEmail: 'ada@example.com', total: 19 })
+     * const { data: orders } = await relyio.records('order').list({ where: { status: 'paid' } })
+     * await relyio.records.batch([
+     *   { op: 'decrement', type: 'inventory', where: { product: mugId }, field: 'available', by: 1 },
+     *   { op: 'create', type: 'order', fields: { shopperEmail: 'ada@example.com', total: 19 } },
+     * ])
+     * ```
+     */
+    __publicField(this, "records", Object.assign(
+      (recordType) => new RecordsClient(this.httpClient, recordType),
+      {
+        // Read when called, never when made: `with()` and `updateConfig()` move `httpClient`
+        batch: /* @__PURE__ */ __name((operations, options) => sendRecordBatch(this.httpClient, operations, options), "batch")
+      }
+      // The one function both call signatures describe; the cast restates the schema's typing of its
+      // argument and answer, as `content()` does, and widens nothing it is called with.
+    ));
+    /**
+     * The project's Functions, by name (spec 2, REL-3821): `relyio.functions.checkout({ cartId })`
+     * runs the Function `checkout` that the key's Branch runs, on the key's Dataset, and answers its
+     * output. Call it from your server with a secret key; a run that failed throws
+     * `FunctionRunFailedError` and one past five minutes `FunctionRunTimedOutError`, each naming the
+     * run. Never retried: a Function may write.
+     *
+     * @example
+     * ```typescript
+     * const { orderId } = (await relyio.functions.checkout({ cartId })) as { orderId: string }
+     * ```
+     */
+    // Read when called, never when made: `with()` and `updateConfig()` move `httpClient`
+    __publicField(this, "functions", functionsAccessor(() => this.httpClient));
     const { schema, ...clientConfig } = config;
     this._schema = schema;
     const resolved = resolveConfig(clientConfig);
@@ -4361,6 +4793,9 @@ var _TypedRelyIOClient = class _TypedRelyIOClient {
    * const { data } = await staging.content('post').list({ limit: 10 })
    *
    * const french = relyio.with({ locale: 'fr-FR' }) // ← autocompletes the schema's locales
+   *
+   * // Every request this one sends carries the signed-in End user's token (REL-3882)
+   * const visitor = relyio.with({ getToken: () => session.getToken() })
    * ```
    */
   with(defaults) {
@@ -4374,14 +4809,16 @@ var _TypedRelyIOClient = class _TypedRelyIOClient {
   }
   /** Make this client one `with()` made from `parent`: see {@link with}. */
   follow(parent, defaults) {
-    const { locale, dataset } = defaults;
+    const { locale, dataset, getToken } = defaults;
     this.parent = parent;
     this.defaults = {
       ...locale === void 0 ? {} : { locale },
-      ...dataset === void 0 ? {} : { dataset }
+      ...dataset === void 0 ? {} : { dataset },
+      ...getToken === void 0 ? {} : { getToken }
     };
     this.httpClient = parent.httpClient.withHeaders(
-      dataset === void 0 ? {} : { [DATASET_HEADER]: dataset }
+      dataset === void 0 ? {} : { [DATASET_HEADER]: dataset },
+      getToken === void 0 ? {} : { getToken }
     );
   }
   /**
@@ -4432,6 +4869,6 @@ function randomClientId() {
 }
 __name(randomClientId, "randomClientId");
 
-export { AssetClient, AssetFileBuilder, AssetUploadBuilder, AuthorizationError, BaseValidationError, ChangesExpiredError, ConnectionError, ContentClient, DefaultRetryPolicy, ErrorMapper, FileUploadError, FileValidationError, HttpClient, InvalidApiKeyError, InvalidPayloadError, LIVE_KEEPALIVE_INTERVAL_MS, LIVE_SOCKET_OPEN_TIMEOUT_MS, LiveEdgeError, MethodNotAllowedError, MissingApiKeyError, NetworkError, PREVIEW_KEY_PREFIX, PUBLISHABLE_KEY_PREFIX, PayloadTooLargeError, PlanFeatureUnavailableError, RateLimitError, ReadOnlyKeyError, ResourceConflictError, ResourceExpiredError, ResourceNotFoundError, SDKError, ServerError, ServiceIndeterminateError, SettingsClient, SingletonClient, TimeoutError, TransactionRolledBackError, TypedRelyIOClient, UnknownContractError, UsageQuotaExceededError, ValidationError, createClient, isAborted, isAssetEntry, isMissingEntry, isPreviewKey, isPublishableKey, isReplaySafe, isResourceNotFound, matchRoute, retryPolicyFor, serviceInstructedDelayMs, sleep, validateFile, versionCheckOf };
-//# sourceMappingURL=chunk-VS2DEUTN.js.map
-//# sourceMappingURL=chunk-VS2DEUTN.js.map
+export { AssetClient, AssetFileBuilder, AssetUploadBuilder, AuthorizationError, BaseValidationError, ChangesExpiredError, ConnectionError, ContentClient, DefaultRetryPolicy, EndUserTokenInvalidError, ErrorMapper, FileUploadError, FileValidationError, FunctionContainersBusyError, FunctionRunFailedError, FunctionRunTimedOutError, HttpClient, InvalidApiKeyError, InvalidPayloadError, LIVE_KEEPALIVE_INTERVAL_MS, LIVE_SOCKET_OPEN_TIMEOUT_MS, LiveEdgeError, MethodNotAllowedError, MissingApiKeyError, NetworkError, PREVIEW_KEY_PREFIX, PUBLISHABLE_KEY_PREFIX, PayloadTooLargeError, PlanFeatureUnavailableError, PublishableKeyRefusedError, RateLimitError, ReadOnlyKeyError, RecordsClient, ResourceConflictError, ResourceExpiredError, ResourceNotFoundError, SDKError, ServerError, ServiceIndeterminateError, SettingsClient, SingletonClient, TimeoutError, TransactionRolledBackError, TypedRelyIOClient, UnknownContractError, UsageQuotaExceededError, ValidationError, createClient, isAborted, isAssetEntry, isMissingEntry, isPreviewKey, isPublishableKey, isReplaySafe, isResourceNotFound, matchRoute, refusedOperationOf, retryPolicyFor, serviceInstructedDelayMs, sleep, validateFile, versionCheckOf };
+//# sourceMappingURL=chunk-356SF5Y2.js.map
+//# sourceMappingURL=chunk-356SF5Y2.js.map