@relyio/sdk 0.18.0 → 0.19.0

package/dist/extensions/index.js

@@ -1,6 +1,6 @@
-import { extensionTrigger } from '../chunk-R6E4HE7R.js';
-import '../chunk-W7JFHSFM.js';
-import { EXTENSION_SURFACES } from '../chunk-EDE2H37D.js';
+import { extensionTrigger } from '../chunk-W2GRVXDG.js';
+import { keyedField } from '../chunk-PZCDJFMA.js';
+import { contributedFieldKindName, CONTRIBUTED_FIELD_KIND_OPTION, EXTENSION_SURFACES } from '../chunk-T7LGREB3.js';
 import { __name } from '../chunk-DI6KFDBO.js';
 
 /* RelyIO SDK - Built with ❤️ by the RelyIO Team */
@@ -8,6 +8,18 @@ import { __name } from '../chunk-DI6KFDBO.js';
 // src/extensions/index.ts
 var DECLARED = "declared";
 var SURFACES = EXTENSION_SURFACES;
+function fieldKindBuilder(slug, name, kind) {
+  return (options = {}) => {
+    const ui = options.ui;
+    const widget = typeof ui === "object" && ui !== null ? ui : {};
+    return keyedField("reference", {
+      ...options,
+      to: kind.base.to,
+      ui: { ...widget, [CONTRIBUTED_FIELD_KIND_OPTION]: contributedFieldKindName(slug, name) }
+    });
+  };
+}
+__name(fieldKindBuilder, "fieldKindBuilder");
 function handleOf(slug) {
   const surface = SURFACES[slug];
   if (surface === void 0) {
@@ -27,7 +39,15 @@ function handleOf(slug) {
         name,
         (options) => extensionTrigger(slug, trigger, options)
       ])
-    )
+    ),
+    ...Object.fromEntries(
+      Object.entries(surface.fieldKinds).map(([name, kind]) => [
+        name,
+        fieldKindBuilder(slug, name, kind)
+      ])
+    ),
+    // Its Managed Record types, by name: `clerk.user` is `'clerkUser'` (REL-3863)
+    ...surface.recordTypes
   };
 }
 __name(handleOf, "handleOf");

package/dist/functions/index.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
-var chunkZAMAR3X2_cjs = require('../chunk-ZAMAR3X2.cjs');
+var chunk5F3YYPLZ_cjs = require('../chunk-5F3YYPLZ.cjs');
+require('../chunk-NN45CSPZ.cjs');
 var chunkL6DXCKVQ_cjs = require('../chunk-L6DXCKVQ.cjs');
 
 /* RelyIO SDK - Built with ❤️ by the RelyIO Team */
@@ -30,8 +31,8 @@ function defineFunction(config) {
     runtime: config.runtime ?? "isolate",
     ...config.container === void 0 ? {} : { container: { size: config.container.size } },
     ...config.limits === void 0 ? {} : { limits: { ...config.limits } },
-    input: chunkZAMAR3X2_cjs.compileKeyedMembers(config.input ?? {}),
-    ...config.output === void 0 ? {} : { output: chunkZAMAR3X2_cjs.compileKeyedMembers(config.output) },
+    input: chunk5F3YYPLZ_cjs.compileKeyedMembers(config.input ?? {}),
+    ...config.output === void 0 ? {} : { output: chunk5F3YYPLZ_cjs.compileKeyedMembers(config.output) },
     records: { read: [...config.records?.read ?? []], write: [...config.records?.write ?? []] },
     content: config.content ?? "none",
     network: (config.network ?? []).map((host) => ({ ...host })),
@@ -43,6 +44,8 @@ function defineFunction(config) {
     ),
     // Absent when it declares none, so a Function declaring none hashes as it did before
     ...actions.length === 0 ? {} : { actions },
+    // Absent when undeclared, so a Function declaring none hashes as it did before
+    ...config.endUsers === void 0 ? {} : { endUsers: config.endUsers },
     ...config.route === void 0 ? {} : { route: config.route },
     ...config.tool === void 0 ? {} : { tool: { description: config.tool.description } },
     ...config.schedule === void 0 ? {} : { schedule: { ...config.schedule } }
@@ -57,7 +60,7 @@ chunkL6DXCKVQ_cjs.__name(isFunctionDefinition, "isFunctionDefinition");
 
 Object.defineProperty(exports, "fields", {
   enumerable: true,
-  get: function () { return chunkZAMAR3X2_cjs.fields; }
+  get: function () { return chunk5F3YYPLZ_cjs.fields; }
 });
 exports.defineFunction = defineFunction;
 exports.isActionRefused = isActionRefused;

package/dist/functions/index.d.cts

@@ -1,6 +1,6 @@
-export { f as FunctionActionHandle, e as FunctionActionReach, A as FunctionActionRefused, z as FunctionActions, t as FunctionBatchRefused, s as FunctionBatchResult, C as FunctionCapabilities, G as FunctionConfig, a as FunctionContainerSize, y as FunctionContent, o as FunctionCounterMove, l as FunctionDeclaration, H as FunctionDefinition, b as FunctionDuration, k as FunctionFieldDeclaration, n as FunctionFile, I as FunctionInputOf, d as FunctionNetworkHost, J as FunctionOutputOf, r as FunctionRecordBatch, p as FunctionRecordReader, m as FunctionRecordTypeName, q as FunctionRecordWriter, v as FunctionRecords, D as FunctionResponse, h as FunctionRoute, c as FunctionRouteMethod, x as FunctionRunInfo, F as FunctionRuntime, j as FunctionSchedule, g as FunctionSecretDeclaration, i as FunctionTool, w as FunctionWayIn, K as defineFunction, B as isActionRefused, u as isBatchRefused, L as isFunctionDefinition, E as respond } from '../automations/index.cjs';
-import '../register-BYCs0FpF.cjs';
-import '../define-schema-DZhtvLiK.cjs';
-import '../define-content-type-NEQDrvdq.cjs';
+export { r as FunctionActionHandle, q as FunctionActionReach, T as FunctionActionRefused, S as FunctionActions, J as FunctionBatchRefused, I as FunctionBatchResult, V as FunctionCapabilities, Y as FunctionConfig, m as FunctionContainerSize, R as FunctionContent, A as FunctionCounterMove, x as FunctionDeclaration, Z as FunctionDefinition, n as FunctionDuration, P as FunctionEndUser, O as FunctionEndUserClaims, N as FunctionEndUsers, w as FunctionFieldDeclaration, z as FunctionFile, _ as FunctionInputOf, p as FunctionNetworkHost, $ as FunctionOutputOf, G as FunctionRecordBatch, B as FunctionRecordReader, y as FunctionRecordTypeName, D as FunctionRecordWriter, L as FunctionRecords, W as FunctionResponse, t as FunctionRoute, o as FunctionRouteMethod, Q as FunctionRunInfo, F as FunctionRuntime, v as FunctionSchedule, s as FunctionSecretDeclaration, u as FunctionTool, M as FunctionWayIn, a0 as defineFunction, U as isActionRefused, K as isBatchRefused, a1 as isFunctionDefinition, X as respond } from '../automations/index.cjs';
+import '../register-DeMsaurp.cjs';
+import '../define-schema-BPlZl4a2.cjs';
+import '../define-content-type-BZ6X8GvL.cjs';
 export { fields } from '../schema/index.cjs';
 import '../rich-text.d-BWc-5gX1.cjs';

package/dist/functions/index.d.ts

@@ -1,6 +1,6 @@
-export { f as FunctionActionHandle, e as FunctionActionReach, A as FunctionActionRefused, z as FunctionActions, t as FunctionBatchRefused, s as FunctionBatchResult, C as FunctionCapabilities, G as FunctionConfig, a as FunctionContainerSize, y as FunctionContent, o as FunctionCounterMove, l as FunctionDeclaration, H as FunctionDefinition, b as FunctionDuration, k as FunctionFieldDeclaration, n as FunctionFile, I as FunctionInputOf, d as FunctionNetworkHost, J as FunctionOutputOf, r as FunctionRecordBatch, p as FunctionRecordReader, m as FunctionRecordTypeName, q as FunctionRecordWriter, v as FunctionRecords, D as FunctionResponse, h as FunctionRoute, c as FunctionRouteMethod, x as FunctionRunInfo, F as FunctionRuntime, j as FunctionSchedule, g as FunctionSecretDeclaration, i as FunctionTool, w as FunctionWayIn, K as defineFunction, B as isActionRefused, u as isBatchRefused, L as isFunctionDefinition, E as respond } from '../automations/index.js';
-import '../register-B53i97A9.js';
-import '../define-schema-Dlwh6l_J.js';
-import '../define-content-type-fb-WCD5e.js';
+export { r as FunctionActionHandle, q as FunctionActionReach, T as FunctionActionRefused, S as FunctionActions, J as FunctionBatchRefused, I as FunctionBatchResult, V as FunctionCapabilities, Y as FunctionConfig, m as FunctionContainerSize, R as FunctionContent, A as FunctionCounterMove, x as FunctionDeclaration, Z as FunctionDefinition, n as FunctionDuration, P as FunctionEndUser, O as FunctionEndUserClaims, N as FunctionEndUsers, w as FunctionFieldDeclaration, z as FunctionFile, _ as FunctionInputOf, p as FunctionNetworkHost, $ as FunctionOutputOf, G as FunctionRecordBatch, B as FunctionRecordReader, y as FunctionRecordTypeName, D as FunctionRecordWriter, L as FunctionRecords, W as FunctionResponse, t as FunctionRoute, o as FunctionRouteMethod, Q as FunctionRunInfo, F as FunctionRuntime, v as FunctionSchedule, s as FunctionSecretDeclaration, u as FunctionTool, M as FunctionWayIn, a0 as defineFunction, U as isActionRefused, K as isBatchRefused, a1 as isFunctionDefinition, X as respond } from '../automations/index.js';
+import '../register-BiMQKVp-.js';
+import '../define-schema-CK7TtYot.js';
+import '../define-content-type-C12jh8cY.js';
 export { fields } from '../schema/index.js';
 import '../rich-text.d-BWc-5gX1.js';

package/dist/functions/index.js

@@ -1,5 +1,6 @@
-import { compileKeyedMembers } from '../chunk-W7JFHSFM.js';
-export { fields } from '../chunk-W7JFHSFM.js';
+import { compileKeyedMembers } from '../chunk-PZCDJFMA.js';
+export { fields } from '../chunk-PZCDJFMA.js';
+import '../chunk-T7LGREB3.js';
 import { __name } from '../chunk-DI6KFDBO.js';
 
 /* RelyIO SDK - Built with ❤️ by the RelyIO Team */
@@ -42,6 +43,8 @@ function defineFunction(config) {
     ),
     // Absent when it declares none, so a Function declaring none hashes as it did before
     ...actions.length === 0 ? {} : { actions },
+    // Absent when undeclared, so a Function declaring none hashes as it did before
+    ...config.endUsers === void 0 ? {} : { endUsers: config.endUsers },
     ...config.route === void 0 ? {} : { route: config.route },
     ...config.tool === void 0 ? {} : { tool: { description: config.tool.description } },
     ...config.schedule === void 0 ? {} : { schedule: { ...config.schedule } }

package/dist/{index-M3luH06A.d.ts → index-BxNnlc5D.d.ts}

@@ -1,6 +1,6 @@
-import { e as ApiPath, f as ApiMethod, Q as QueryOf, W as Wire, H as HttpClient, A as AnySchemaDefinition, l as RecordsClient, B as BaseRecord, y as RecordBatchOperation, C as RecordBatchOptions, b as RecordBatchResult, R as RegisteredSchema } from './register-B53i97A9.js';
-import { aU as EntryMetadata, ax as Reading, cQ as BaseContent, at as CheckedIncludes, dp as ReadWhere, cV as WhereClause, cw as components, ay as ReadWith, d4 as UpdateInput, aB as UntypedReading, c_ as RevisedContent, cY as CreateInput, cZ as CreatedContent, d3 as ContentVersionRow, d2 as ContentVersion, d1 as RestoredContent, cJ as SDKError, dl as BaseValidationError, dk as ValidationViolation, ba as AssetServedBlocks, dq as CheckedInclude, cU as WhereFieldCondition, cO as AssetFileBlock, cR as BaseSingleton, c$ as WrittenSingleton, cS as BaseSettingsGroup, d0 as WrittenSettingsGroup, aV as InferContentType, av as ContentReading, a$ as InferSingleton, cF as paths, cK as RelyIOConfig, b8 as InferAssetType, as as AssetReading, aA as SingletonReading, b4 as InferSettingsGroup, az as SettingsReading, cL as RelyIOConfigUpdate, cH as MergedRelyIOConfig } from './define-content-type-fb-WCD5e.js';
-import { a as SchemaContentTypeNames, l as SchemaEntryOf, c as SchemaLocaleCodes, h as SchemaSingletonNames, v as AggregateBlock, _ as QueryParameterValue, F as FullTextSearch, i as SchemaQueryNames, Z as InferQueryParams, $ as AnyQueryParameters, S as SchemaRecordTypeNames, I as InferRecordType, R as RecordWriteFieldsOf, d as RecordUpdateFieldsOf, k as SchemaAssetTypeNames, j as SchemaSettingsGroupNames } from './define-schema-Dlwh6l_J.js';
+import { e as ApiPath, f as ApiMethod, Q as QueryOf, W as Wire, H as HttpClient, A as AnySchemaDefinition, l as RecordsClient, B as BaseRecord, y as RecordBatchOperation, C as RecordBatchOptions, b as RecordBatchResult, R as RegisteredSchema } from './register-BiMQKVp-.js';
+import { aW as EntryMetadata, ay as Reading, da as BaseContent, au as CheckedIncludes, dL as ReadWhere, df as WhereClause, cR as components, az as ReadWith, dr as UpdateInput, aC as UntypedReading, dk as RevisedContent, di as CreateInput, dj as CreatedContent, dq as ContentVersionRow, dp as ContentVersion, dn as RestoredContent, d3 as SDKError, dI as BaseValidationError, dH as ValidationViolation, bc as AssetServedBlocks, dM as CheckedInclude, de as WhereFieldCondition, d8 as AssetFileBlock, db as BaseSingleton, dl as WrittenSingleton, dc as BaseSettingsGroup, dm as WrittenSettingsGroup, aX as InferContentType, aw as ContentReading, b1 as InferSingleton, c$ as paths, d4 as RelyIOConfig, ba as InferAssetType, at as AssetReading, aB as SingletonReading, b6 as InferSettingsGroup, aA as SettingsReading, d5 as RelyIOConfigUpdate, d1 as MergedRelyIOConfig } from './define-content-type-C12jh8cY.js';
+import { b as SchemaContentTypeNames, k as SchemaEntryOf, f as SchemaLocaleCodes, c as SchemaSingletonNames, y as AggregateBlock, a5 as QueryParameterValue, w as FullTextSearch, e as SchemaQueryNames, a4 as InferQueryParams, a6 as AnyQueryParameters, i as SchemaRecordTypeNames, I as InferRecordType, r as RecordWriteFieldsOf, q as RecordUpdateFieldsOf, h as SchemaAssetTypeNames, g as SchemaSettingsGroupNames } from './define-schema-CK7TtYot.js';
 import { DevUnreadableReason } from './dev-handshake/index.js';
 
 /**
@@ -65,70 +65,6 @@ type ActiveSandbox = Extract<SandboxState, {
     state: 'active';
 }>;
 
-/**
- * API4's two request headers, as the SDK's writes send them.
- *
- * `Idempotency-Key` is an option on every write whose route declares it (`idempotencyKey`), and the
- * SDK mints one when none is given. `If-Match` is never an option: a checked write builds it from
- * the entry it was read as (`versionCheckOf`), from the `_metadata` every read carries in its body
- * whether or not the edge cache served it (REL-2418). The SDK does not read the separate
- * `X-Entity-Tag` header, which the edge removes from what it stores; the API keeps sending it for
- * callers using plain HTTP (REL-2427). A batch operation carries its check in its own body, as
- * `ifMatch` (`batch/batch-operations.ts`, REL-2421).
- */
-interface RetryableWriteOptions {
-    /**
-     * A key that makes a retry of **this** write safe.
-     *
-     * A replay inside the service's window returns the original outcome rather
-     * than applying twice. The service derives that response from committed state
-     * pinned to the recorded version — it does not store bytes — so a replay after
-     * the version has been pruned is refused `RESOURCE_EXPIRED` rather than
-     * answered from a stale copy.
-     *
-     * **The SDK mints one when you do not.** It used to be caller-supplied and
-     * nothing else, which meant the default write carried no key while the retry
-     * loop replayed it anyway — the one mechanism that makes a replay safe was
-     * optional on the one path that needed it. Supply your own to make a key
-     * outlive the process: a job that may be restarted wants a key derived from
-     * the work, not one minted per call.
-     */
-    idempotencyKey?: string;
-}
-/**
- * An entry a read handed back, as much of it as a version check needs: its `_metadata`'s id, the
- * locale it was read in and the two counters it was read at (REL-2418).
- *
- * Every read carries these in its body, whether origin or the edge cache served it — the edge
- * removes only the separate `X-Entity-Tag` header from what it stores, so a check taken from that
- * header vanished after a cached read. A `Pick` of the document's `EntryMetadata`, so a counter the
- * API stops reporting stops compiling here.
- */
-interface ReadEntry {
-    readonly _metadata: Pick<EntryMetadata, 'id' | 'locale' | 'version' | 'sharedVersion'>;
-}
-/**
- * The version check a write takes from the entry it was read as: the entry's id, the locale it was
- * read in — which the write addresses, so a read negotiated from `Accept-Language` is written back
- * to that locale — and the `If-Match` tag over its two counters, spelled as the API mints it.
- */
-declare function versionCheckOf(entry: ReadEntry): {
-    id: string;
-    locale: string;
-    ifMatch: string;
-};
-
-/**
- * The client's locale as a sub-client holds it: a function it asks on every call, or a locale fixed
- * when it was built.
- *
- * `TypedRelyIOClient` hands every sub-client and builder a function over the configuration it holds,
- * so one taken before `updateConfig({ locale })` sends the locale the client holds when the call is
- * made, and none once `updateConfig({ locale: null })` has cleared it (REL-1453). A string is a locale
- * fixed at construction — a handle built directly, as the tests build one — and stays what it was.
- */
-type ClientLocale = string | (() => string | undefined);
-
 /**
  * Site-visitor live, declared once for everyone who speaks it (`live-layer-spec.md` decisions 15, 19
  * and 20; phase LV5): the wire a visitor's browser meets at `live.relyio.com`, and the two internal
@@ -229,6 +165,70 @@ type VisitorResyncReason = VisitorLedgerResyncReason | 'too-far-behind';
  */
 type VisitorRetry = 'stop' | 'retry' | 'back-off';
 
+/**
+ * API4's two request headers, as the SDK's writes send them.
+ *
+ * `Idempotency-Key` is an option on every write whose route declares it (`idempotencyKey`), and the
+ * SDK mints one when none is given. `If-Match` is never an option: a checked write builds it from
+ * the entry it was read as (`versionCheckOf`), from the `_metadata` every read carries in its body
+ * whether or not the edge cache served it (REL-2418). The SDK does not read the separate
+ * `X-Entity-Tag` header, which the edge removes from what it stores; the API keeps sending it for
+ * callers using plain HTTP (REL-2427). A batch operation carries its check in its own body, as
+ * `ifMatch` (`batch/batch-operations.ts`, REL-2421).
+ */
+interface RetryableWriteOptions {
+    /**
+     * A key that makes a retry of **this** write safe.
+     *
+     * A replay inside the service's window returns the original outcome rather
+     * than applying twice. The service derives that response from committed state
+     * pinned to the recorded version — it does not store bytes — so a replay after
+     * the version has been pruned is refused `RESOURCE_EXPIRED` rather than
+     * answered from a stale copy.
+     *
+     * **The SDK mints one when you do not.** It used to be caller-supplied and
+     * nothing else, which meant the default write carried no key while the retry
+     * loop replayed it anyway — the one mechanism that makes a replay safe was
+     * optional on the one path that needed it. Supply your own to make a key
+     * outlive the process: a job that may be restarted wants a key derived from
+     * the work, not one minted per call.
+     */
+    idempotencyKey?: string;
+}
+/**
+ * An entry a read handed back, as much of it as a version check needs: its `_metadata`'s id, the
+ * locale it was read in and the two counters it was read at (REL-2418).
+ *
+ * Every read carries these in its body, whether origin or the edge cache served it — the edge
+ * removes only the separate `X-Entity-Tag` header from what it stores, so a check taken from that
+ * header vanished after a cached read. A `Pick` of the document's `EntryMetadata`, so a counter the
+ * API stops reporting stops compiling here.
+ */
+interface ReadEntry {
+    readonly _metadata: Pick<EntryMetadata, 'id' | 'locale' | 'version' | 'sharedVersion'>;
+}
+/**
+ * The version check a write takes from the entry it was read as: the entry's id, the locale it was
+ * read in — which the write addresses, so a read negotiated from `Accept-Language` is written back
+ * to that locale — and the `If-Match` tag over its two counters, spelled as the API mints it.
+ */
+declare function versionCheckOf(entry: ReadEntry): {
+    id: string;
+    locale: string;
+    ifMatch: string;
+};
+
+/**
+ * The client's locale as a sub-client holds it: a function it asks on every call, or a locale fixed
+ * when it was built.
+ *
+ * `TypedRelyIOClient` hands every sub-client and builder a function over the configuration it holds,
+ * so one taken before `updateConfig({ locale })` sends the locale the client holds when the call is
+ * made, and none once `updateConfig({ locale: null })` has cleared it (REL-1453). A string is a locale
+ * fixed at construction — a handle built directly, as the tests build one — and stays what it was.
+ */
+type ClientLocale = string | (() => string | undefined);
+
 /**
  * Two read terms every read that takes them writes the same way: the children an entry embeds,
  * and the refusal of a condition on `_metadata`. Here once, for the list and entry reads
@@ -1479,9 +1479,11 @@ declare class SettingsClient<T = BaseSettingsGroup, R extends Reading = UntypedR
  * runs the Function `checkout` that the key's Branch runs, on the key's Dataset, and answers its
  * output.
  *
- * Call it from your server with a secret key: a publishable key is refused
- * (`PublishableKeyRefusedError`), and a read-only key runs only a Function whose reach writes
- * nothing (`ReadOnlyKeyError`). A run whose code threw or was ended at a limit throws
+ * Call it from your server with a secret key. A publishable key calls only a Function declaring
+ * `endUsers` (spec 4, REL-3892) — with a signed-in End user's token (`getToken`) when it says
+ * `'required'` — and is refused any other (`PublishableKeyRefusedError`); a read-only secret key
+ * runs only a Function whose reach writes nothing (`ReadOnlyKeyError`). A call carrying an End
+ * user's token hands the run `run.endUser`, whatever the key. A run whose code threw or was ended at a limit throws
  * `FunctionRunFailedError`, and one that outlived the service's five-minute wait
  * `FunctionRunTimedOutError` — each naming the run (`runId`), whose record and console output Manage
  * serves. A call is never retried: a Function may write, and a second call would be a second run.
@@ -2430,11 +2432,19 @@ interface DeployedContentType {
 }
 /**
  * The defaults `client.with()` gives the client it makes (REL-2417, Q9): the locale and the dataset
- * its reads and writes are in unless a call names its own. A locale is one the schema declares.
+ * its reads and writes are in unless a call names its own, and the End user's token function its
+ * requests ask in place of the parent's (REL-3882). A locale is one the schema declares.
  */
 interface ClientDefaults<TSchema extends AnySchemaDefinition | undefined = undefined> {
     readonly locale?: LocaleCodeOf<TSchema>;
     readonly dataset?: string;
+    /**
+     * The signed-in End user's token, asked for on every request this client sends — and every
+     * request of a client `with()` makes from it that names none — in place of the parent's
+     * `getToken`. `@relyio/react`'s provider hands it Clerk's `useAuth().getToken`. See
+     * `RelyIOConfig.getToken`.
+     */
+    readonly getToken?: () => Promise<string | null>;
 }
 /** The locale codes a client's reads may name: the schema's, or any where no schema types it. */
 type LocaleCodeOf<TSchema extends AnySchemaDefinition | undefined> = TSchema extends AnySchemaDefinition ? SchemaLocaleCodes<TSchema> : string;
@@ -2509,7 +2519,10 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * `createClient()` made, which reads its own.
      */
     private parent;
-    /** What `with()` gave this client over its parent's: the locale and dataset it names, and no other. */
+    /**
+     * What `with()` gave this client over its parent's: the locale, dataset and End user's token
+     * function it names, and no other.
+     */
     private defaults;
     /** The live edge's poll client id: chosen once, when first needed, and kept for this client's life. */
     private _liveClientId;
@@ -2565,7 +2578,9 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * all or none (REL-3774).
      *
      * A Record is an app's data, written by your server with a secret key and live the moment it
-     * lands; a publishable key is refused on every Record route (`PUBLISHABLE_KEY_REFUSED`).
+     * lands. A publishable key reads the Records a Record type's read Policy grants it (spec 4,
+     * REL-3883), and writes them only for the End user whose token it carries, as the type's write
+     * Policy allows (REL-3884); with no token it writes nothing (`PUBLISHABLE_KEY_REFUSED`).
      *
      * @example
      * ```typescript
@@ -2935,6 +2950,9 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * const { data } = await staging.content('post').list({ limit: 10 })
      *
      * const french = relyio.with({ locale: 'fr-FR' }) // ← autocompletes the schema's locales
+     *
+     * // Every request this one sends carries the signed-in End user's token (REL-3882)
+     * const visitor = relyio.with({ getToken: () => session.getToken() })
      * ```
      */
     with(defaults: ClientDefaults<TSchema>): TypedRelyIOClient<TSchema>;

package/dist/{index-C4LqrNd1.d.ts → index-C-MymZTe.d.ts}

@@ -1,5 +1,5 @@
 import { k as RichTextHeading, b as RichTextValue, y as RichTextTable, h as RichTextCodeGroup, e as RichTextBlock, l as RichTextInline, t as RichTextNode, w as RichTextSpan, r as RichTextMark, A as AnyRichTextEntryLink, c as RichTextShapeValue } from './rich-text.d-BWc-5gX1.js';
-import { cQ as BaseContent } from './define-content-type-fb-WCD5e.js';
+import { da as BaseContent } from './define-content-type-C12jh8cY.js';
 
 /**
  * The DOM↔field binding contract, as the one pure helper that emits it.

package/dist/{index-DwHcL6x5.d.cts → index-D5jyIeQ5.d.cts}

@@ -1,6 +1,6 @@
-import { e as ApiPath, f as ApiMethod, Q as QueryOf, W as Wire, H as HttpClient, A as AnySchemaDefinition, l as RecordsClient, B as BaseRecord, y as RecordBatchOperation, C as RecordBatchOptions, b as RecordBatchResult, R as RegisteredSchema } from './register-BYCs0FpF.cjs';
-import { aU as EntryMetadata, ax as Reading, cQ as BaseContent, at as CheckedIncludes, dp as ReadWhere, cV as WhereClause, cw as components, ay as ReadWith, d4 as UpdateInput, aB as UntypedReading, c_ as RevisedContent, cY as CreateInput, cZ as CreatedContent, d3 as ContentVersionRow, d2 as ContentVersion, d1 as RestoredContent, cJ as SDKError, dl as BaseValidationError, dk as ValidationViolation, ba as AssetServedBlocks, dq as CheckedInclude, cU as WhereFieldCondition, cO as AssetFileBlock, cR as BaseSingleton, c$ as WrittenSingleton, cS as BaseSettingsGroup, d0 as WrittenSettingsGroup, aV as InferContentType, av as ContentReading, a$ as InferSingleton, cF as paths, cK as RelyIOConfig, b8 as InferAssetType, as as AssetReading, aA as SingletonReading, b4 as InferSettingsGroup, az as SettingsReading, cL as RelyIOConfigUpdate, cH as MergedRelyIOConfig } from './define-content-type-NEQDrvdq.cjs';
-import { a as SchemaContentTypeNames, l as SchemaEntryOf, c as SchemaLocaleCodes, h as SchemaSingletonNames, v as AggregateBlock, _ as QueryParameterValue, F as FullTextSearch, i as SchemaQueryNames, Z as InferQueryParams, $ as AnyQueryParameters, S as SchemaRecordTypeNames, I as InferRecordType, R as RecordWriteFieldsOf, d as RecordUpdateFieldsOf, k as SchemaAssetTypeNames, j as SchemaSettingsGroupNames } from './define-schema-DZhtvLiK.cjs';
+import { e as ApiPath, f as ApiMethod, Q as QueryOf, W as Wire, H as HttpClient, A as AnySchemaDefinition, l as RecordsClient, B as BaseRecord, y as RecordBatchOperation, C as RecordBatchOptions, b as RecordBatchResult, R as RegisteredSchema } from './register-DeMsaurp.cjs';
+import { aW as EntryMetadata, ay as Reading, da as BaseContent, au as CheckedIncludes, dL as ReadWhere, df as WhereClause, cR as components, az as ReadWith, dr as UpdateInput, aC as UntypedReading, dk as RevisedContent, di as CreateInput, dj as CreatedContent, dq as ContentVersionRow, dp as ContentVersion, dn as RestoredContent, d3 as SDKError, dI as BaseValidationError, dH as ValidationViolation, bc as AssetServedBlocks, dM as CheckedInclude, de as WhereFieldCondition, d8 as AssetFileBlock, db as BaseSingleton, dl as WrittenSingleton, dc as BaseSettingsGroup, dm as WrittenSettingsGroup, aX as InferContentType, aw as ContentReading, b1 as InferSingleton, c$ as paths, d4 as RelyIOConfig, ba as InferAssetType, at as AssetReading, aB as SingletonReading, b6 as InferSettingsGroup, aA as SettingsReading, d5 as RelyIOConfigUpdate, d1 as MergedRelyIOConfig } from './define-content-type-BZ6X8GvL.cjs';
+import { b as SchemaContentTypeNames, k as SchemaEntryOf, f as SchemaLocaleCodes, c as SchemaSingletonNames, y as AggregateBlock, a5 as QueryParameterValue, w as FullTextSearch, e as SchemaQueryNames, a4 as InferQueryParams, a6 as AnyQueryParameters, i as SchemaRecordTypeNames, I as InferRecordType, r as RecordWriteFieldsOf, q as RecordUpdateFieldsOf, h as SchemaAssetTypeNames, g as SchemaSettingsGroupNames } from './define-schema-BPlZl4a2.cjs';
 import { DevUnreadableReason } from './dev-handshake/index.cjs';
 
 /**
@@ -65,70 +65,6 @@ type ActiveSandbox = Extract<SandboxState, {
     state: 'active';
 }>;
 
-/**
- * API4's two request headers, as the SDK's writes send them.
- *
- * `Idempotency-Key` is an option on every write whose route declares it (`idempotencyKey`), and the
- * SDK mints one when none is given. `If-Match` is never an option: a checked write builds it from
- * the entry it was read as (`versionCheckOf`), from the `_metadata` every read carries in its body
- * whether or not the edge cache served it (REL-2418). The SDK does not read the separate
- * `X-Entity-Tag` header, which the edge removes from what it stores; the API keeps sending it for
- * callers using plain HTTP (REL-2427). A batch operation carries its check in its own body, as
- * `ifMatch` (`batch/batch-operations.ts`, REL-2421).
- */
-interface RetryableWriteOptions {
-    /**
-     * A key that makes a retry of **this** write safe.
-     *
-     * A replay inside the service's window returns the original outcome rather
-     * than applying twice. The service derives that response from committed state
-     * pinned to the recorded version — it does not store bytes — so a replay after
-     * the version has been pruned is refused `RESOURCE_EXPIRED` rather than
-     * answered from a stale copy.
-     *
-     * **The SDK mints one when you do not.** It used to be caller-supplied and
-     * nothing else, which meant the default write carried no key while the retry
-     * loop replayed it anyway — the one mechanism that makes a replay safe was
-     * optional on the one path that needed it. Supply your own to make a key
-     * outlive the process: a job that may be restarted wants a key derived from
-     * the work, not one minted per call.
-     */
-    idempotencyKey?: string;
-}
-/**
- * An entry a read handed back, as much of it as a version check needs: its `_metadata`'s id, the
- * locale it was read in and the two counters it was read at (REL-2418).
- *
- * Every read carries these in its body, whether origin or the edge cache served it — the edge
- * removes only the separate `X-Entity-Tag` header from what it stores, so a check taken from that
- * header vanished after a cached read. A `Pick` of the document's `EntryMetadata`, so a counter the
- * API stops reporting stops compiling here.
- */
-interface ReadEntry {
-    readonly _metadata: Pick<EntryMetadata, 'id' | 'locale' | 'version' | 'sharedVersion'>;
-}
-/**
- * The version check a write takes from the entry it was read as: the entry's id, the locale it was
- * read in — which the write addresses, so a read negotiated from `Accept-Language` is written back
- * to that locale — and the `If-Match` tag over its two counters, spelled as the API mints it.
- */
-declare function versionCheckOf(entry: ReadEntry): {
-    id: string;
-    locale: string;
-    ifMatch: string;
-};
-
-/**
- * The client's locale as a sub-client holds it: a function it asks on every call, or a locale fixed
- * when it was built.
- *
- * `TypedRelyIOClient` hands every sub-client and builder a function over the configuration it holds,
- * so one taken before `updateConfig({ locale })` sends the locale the client holds when the call is
- * made, and none once `updateConfig({ locale: null })` has cleared it (REL-1453). A string is a locale
- * fixed at construction — a handle built directly, as the tests build one — and stays what it was.
- */
-type ClientLocale = string | (() => string | undefined);
-
 /**
  * Site-visitor live, declared once for everyone who speaks it (`live-layer-spec.md` decisions 15, 19
  * and 20; phase LV5): the wire a visitor's browser meets at `live.relyio.com`, and the two internal
@@ -229,6 +165,70 @@ type VisitorResyncReason = VisitorLedgerResyncReason | 'too-far-behind';
  */
 type VisitorRetry = 'stop' | 'retry' | 'back-off';
 
+/**
+ * API4's two request headers, as the SDK's writes send them.
+ *
+ * `Idempotency-Key` is an option on every write whose route declares it (`idempotencyKey`), and the
+ * SDK mints one when none is given. `If-Match` is never an option: a checked write builds it from
+ * the entry it was read as (`versionCheckOf`), from the `_metadata` every read carries in its body
+ * whether or not the edge cache served it (REL-2418). The SDK does not read the separate
+ * `X-Entity-Tag` header, which the edge removes from what it stores; the API keeps sending it for
+ * callers using plain HTTP (REL-2427). A batch operation carries its check in its own body, as
+ * `ifMatch` (`batch/batch-operations.ts`, REL-2421).
+ */
+interface RetryableWriteOptions {
+    /**
+     * A key that makes a retry of **this** write safe.
+     *
+     * A replay inside the service's window returns the original outcome rather
+     * than applying twice. The service derives that response from committed state
+     * pinned to the recorded version — it does not store bytes — so a replay after
+     * the version has been pruned is refused `RESOURCE_EXPIRED` rather than
+     * answered from a stale copy.
+     *
+     * **The SDK mints one when you do not.** It used to be caller-supplied and
+     * nothing else, which meant the default write carried no key while the retry
+     * loop replayed it anyway — the one mechanism that makes a replay safe was
+     * optional on the one path that needed it. Supply your own to make a key
+     * outlive the process: a job that may be restarted wants a key derived from
+     * the work, not one minted per call.
+     */
+    idempotencyKey?: string;
+}
+/**
+ * An entry a read handed back, as much of it as a version check needs: its `_metadata`'s id, the
+ * locale it was read in and the two counters it was read at (REL-2418).
+ *
+ * Every read carries these in its body, whether origin or the edge cache served it — the edge
+ * removes only the separate `X-Entity-Tag` header from what it stores, so a check taken from that
+ * header vanished after a cached read. A `Pick` of the document's `EntryMetadata`, so a counter the
+ * API stops reporting stops compiling here.
+ */
+interface ReadEntry {
+    readonly _metadata: Pick<EntryMetadata, 'id' | 'locale' | 'version' | 'sharedVersion'>;
+}
+/**
+ * The version check a write takes from the entry it was read as: the entry's id, the locale it was
+ * read in — which the write addresses, so a read negotiated from `Accept-Language` is written back
+ * to that locale — and the `If-Match` tag over its two counters, spelled as the API mints it.
+ */
+declare function versionCheckOf(entry: ReadEntry): {
+    id: string;
+    locale: string;
+    ifMatch: string;
+};
+
+/**
+ * The client's locale as a sub-client holds it: a function it asks on every call, or a locale fixed
+ * when it was built.
+ *
+ * `TypedRelyIOClient` hands every sub-client and builder a function over the configuration it holds,
+ * so one taken before `updateConfig({ locale })` sends the locale the client holds when the call is
+ * made, and none once `updateConfig({ locale: null })` has cleared it (REL-1453). A string is a locale
+ * fixed at construction — a handle built directly, as the tests build one — and stays what it was.
+ */
+type ClientLocale = string | (() => string | undefined);
+
 /**
  * Two read terms every read that takes them writes the same way: the children an entry embeds,
  * and the refusal of a condition on `_metadata`. Here once, for the list and entry reads
@@ -1479,9 +1479,11 @@ declare class SettingsClient<T = BaseSettingsGroup, R extends Reading = UntypedR
  * runs the Function `checkout` that the key's Branch runs, on the key's Dataset, and answers its
  * output.
  *
- * Call it from your server with a secret key: a publishable key is refused
- * (`PublishableKeyRefusedError`), and a read-only key runs only a Function whose reach writes
- * nothing (`ReadOnlyKeyError`). A run whose code threw or was ended at a limit throws
+ * Call it from your server with a secret key. A publishable key calls only a Function declaring
+ * `endUsers` (spec 4, REL-3892) — with a signed-in End user's token (`getToken`) when it says
+ * `'required'` — and is refused any other (`PublishableKeyRefusedError`); a read-only secret key
+ * runs only a Function whose reach writes nothing (`ReadOnlyKeyError`). A call carrying an End
+ * user's token hands the run `run.endUser`, whatever the key. A run whose code threw or was ended at a limit throws
  * `FunctionRunFailedError`, and one that outlived the service's five-minute wait
  * `FunctionRunTimedOutError` — each naming the run (`runId`), whose record and console output Manage
  * serves. A call is never retried: a Function may write, and a second call would be a second run.
@@ -2430,11 +2432,19 @@ interface DeployedContentType {
 }
 /**
  * The defaults `client.with()` gives the client it makes (REL-2417, Q9): the locale and the dataset
- * its reads and writes are in unless a call names its own. A locale is one the schema declares.
+ * its reads and writes are in unless a call names its own, and the End user's token function its
+ * requests ask in place of the parent's (REL-3882). A locale is one the schema declares.
  */
 interface ClientDefaults<TSchema extends AnySchemaDefinition | undefined = undefined> {
     readonly locale?: LocaleCodeOf<TSchema>;
     readonly dataset?: string;
+    /**
+     * The signed-in End user's token, asked for on every request this client sends — and every
+     * request of a client `with()` makes from it that names none — in place of the parent's
+     * `getToken`. `@relyio/react`'s provider hands it Clerk's `useAuth().getToken`. See
+     * `RelyIOConfig.getToken`.
+     */
+    readonly getToken?: () => Promise<string | null>;
 }
 /** The locale codes a client's reads may name: the schema's, or any where no schema types it. */
 type LocaleCodeOf<TSchema extends AnySchemaDefinition | undefined> = TSchema extends AnySchemaDefinition ? SchemaLocaleCodes<TSchema> : string;
@@ -2509,7 +2519,10 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * `createClient()` made, which reads its own.
      */
     private parent;
-    /** What `with()` gave this client over its parent's: the locale and dataset it names, and no other. */
+    /**
+     * What `with()` gave this client over its parent's: the locale, dataset and End user's token
+     * function it names, and no other.
+     */
     private defaults;
     /** The live edge's poll client id: chosen once, when first needed, and kept for this client's life. */
     private _liveClientId;
@@ -2565,7 +2578,9 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * all or none (REL-3774).
      *
      * A Record is an app's data, written by your server with a secret key and live the moment it
-     * lands; a publishable key is refused on every Record route (`PUBLISHABLE_KEY_REFUSED`).
+     * lands. A publishable key reads the Records a Record type's read Policy grants it (spec 4,
+     * REL-3883), and writes them only for the End user whose token it carries, as the type's write
+     * Policy allows (REL-3884); with no token it writes nothing (`PUBLISHABLE_KEY_REFUSED`).
      *
      * @example
      * ```typescript
@@ -2935,6 +2950,9 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * const { data } = await staging.content('post').list({ limit: 10 })
      *
      * const french = relyio.with({ locale: 'fr-FR' }) // ← autocompletes the schema's locales
+     *
+     * // Every request this one sends carries the signed-in End user's token (REL-3882)
+     * const visitor = relyio.with({ getToken: () => session.getToken() })
      * ```
      */
     with(defaults: ClientDefaults<TSchema>): TypedRelyIOClient<TSchema>;

package/dist/{index-Dnmt_UOo.d.cts → index-DN0l8RHw.d.cts}

@@ -1,5 +1,5 @@
 import { k as RichTextHeading, b as RichTextValue, y as RichTextTable, h as RichTextCodeGroup, e as RichTextBlock, l as RichTextInline, t as RichTextNode, w as RichTextSpan, r as RichTextMark, A as AnyRichTextEntryLink, c as RichTextShapeValue } from './rich-text.d-BWc-5gX1.cjs';
-import { cQ as BaseContent } from './define-content-type-NEQDrvdq.cjs';
+import { da as BaseContent } from './define-content-type-BZ6X8GvL.cjs';
 
 /**
  * The DOM↔field binding contract, as the one pure helper that emits it.