@relyio/sdk 0.18.0 → 0.20.0

package/dist/{define-content-type-fb-WCD5e.d.ts → define-content-type-CVLUusfx.d.ts}

@@ -1711,6 +1711,7 @@ interface components {
                  * @description - `ACCESS_DENIED`: The credential is valid, but its subject may not do this here. Fix: Use a key or a Role that grants this action on this resource, or ask an Owner to grant it; `details.rule` names the rule that refused.
                  *     - `AI_UNAVAILABLE_IN_REGION`: The Project's data region promises residency, and no AI processes inside that region yet. Fix: Run AI work on a Project in another region; no Plan, credential or retry changes this one.
                  *     - `CONTENT_INVALID`: The content does not satisfy the schema of the type it was written to. Fix: Correct each field `details.issues` names so it matches the schema, then write it again.
+                 *     - `END_USER_TOKEN_INVALID`: The key was accepted, but the End user's token in `X-RelyIO-End-User` was not: it is not the Environment's identity source's, that Environment has none, or the call needs one and carried none. Fix: Read `details.reason`, then send a current token from the identity source this Environment connects — or connect one — or, where none is needed, send the request without the header.
                  *     - `FUNCTION_CONTAINERS_BUSY`: The project is running as many Function runs in Containers at once as its plan includes, so this one was not started. Fix: Call again after the seconds the `Retry-After` header names, or start the run from a schedule or an Automation step, which waits for a free Container.
                  *     - `FUNCTION_RUN_FAILED`: The Function ran and ended without an answer: its code threw, or it was ended at a limit; `details.runId` names the run. Fix: Read the run's record and console output by `details.runId`, fix the Function, and call it again.
                  *     - `FUNCTION_RUN_TIMED_OUT`: The Function ran longer than a caller waits, five minutes; it goes on to its own limit, and `details.runId` names the run. Fix: Read the run's record by `details.runId` for how it ended, and move work that long to a schedule or an Automation step.
@@ -1725,7 +1726,7 @@ interface components {
                  *     - `PLAN_DOWNGRADE_BLOCKED`: The Organization keeps more than the target Plan allows, so it cannot move to it. Fix: Reduce each Stock Limit `details.stockLimits` lists to within the target Plan, then retry the change.
                  *     - `PLAN_FEATURE_UNAVAILABLE`: The Organization's Plan does not include the feature this request uses. Fix: Move the Organization to a Plan that includes `details.feature`, or leave the feature out of the request.
                  *     - `PROJECT_IN_ANOTHER_CELL`: The request reached a region that does not hold the Project it names. Fix: Send the same request to the region `details.region` names; retrying it here will not succeed.
-                 *     - `PUBLISHABLE_KEY_REFUSED`: A publishable key reaches no Record and runs no Function: a browser reads none of an app's data. Fix: Call Records and Functions from your server with a secret key; a publishable key reads only published content.
+                 *     - `PUBLISHABLE_KEY_REFUSED`: A publishable key writes a Record only for a signed-in End user, runs only a Function that declares `endUsers`, and uploads no Record's File: a browser with no End user's token writes nothing. Fix: Send the End user's token in `X-RelyIO-End-User` to write a Record as its type's Policy allows; declare `endUsers` on a Function a browser calls; run any other Function and upload Files from your server with a secret key.
                  *     - `RATE_LIMIT_EXCEEDED`: Too many requests arrived within the current rate-limit window. Fix: Wait the seconds the `Retry-After` header names before retrying, and spread requests out.
                  *     - `READ_ONLY_KEY`: The key may read but not write. Fix: Send the write with a key that may write, and keep the read-only key for reads.
                  *     - `REQUEST_INVALID`: The request is malformed: a path parameter, query parameter, header or body field the route cannot accept. Fix: Correct each field `details.issues` names, by its path and message, and send the request again.
@@ -1740,7 +1741,7 @@ interface components {
                  *     - `USER_NOT_PROVISIONED`: The session is valid, but the User's account is still being set up after sign-up. Fix: Keep the session and retry after the seconds the `Retry-After` header names.
                  * @enum {string}
                  */
-                code: 'ACCESS_DENIED' | 'AI_UNAVAILABLE_IN_REGION' | 'CONTENT_INVALID' | 'FUNCTION_CONTAINERS_BUSY' | 'FUNCTION_RUN_FAILED' | 'FUNCTION_RUN_TIMED_OUT' | 'INTERNAL_ERROR' | 'INVALID_API_KEY' | 'METHOD_NOT_ALLOWED' | 'MISSING_API_KEY' | 'ORGANIZATION_BEING_DELETED' | 'ORGANIZATION_DELETE_BLOCKED' | 'ORGANIZATION_IN_ANOTHER_CELL' | 'PAYLOAD_TOO_LARGE' | 'PLAN_DOWNGRADE_BLOCKED' | 'PLAN_FEATURE_UNAVAILABLE' | 'PROJECT_IN_ANOTHER_CELL' | 'PUBLISHABLE_KEY_REFUSED' | 'RATE_LIMIT_EXCEEDED' | 'READ_ONLY_KEY' | 'REQUEST_INVALID' | 'REQUEST_TIMEOUT' | 'RESOURCE_CONFLICT' | 'RESOURCE_EXPIRED' | 'RESOURCE_NOT_FOUND' | 'REVERIFICATION_REQUIRED' | 'SERVICE_INDETERMINATE' | 'TRANSACTION_ROLLED_BACK' | 'USAGE_QUOTA_EXCEEDED' | 'USER_NOT_PROVISIONED';
+                code: 'ACCESS_DENIED' | 'AI_UNAVAILABLE_IN_REGION' | 'CONTENT_INVALID' | 'END_USER_TOKEN_INVALID' | 'FUNCTION_CONTAINERS_BUSY' | 'FUNCTION_RUN_FAILED' | 'FUNCTION_RUN_TIMED_OUT' | 'INTERNAL_ERROR' | 'INVALID_API_KEY' | 'METHOD_NOT_ALLOWED' | 'MISSING_API_KEY' | 'ORGANIZATION_BEING_DELETED' | 'ORGANIZATION_DELETE_BLOCKED' | 'ORGANIZATION_IN_ANOTHER_CELL' | 'PAYLOAD_TOO_LARGE' | 'PLAN_DOWNGRADE_BLOCKED' | 'PLAN_FEATURE_UNAVAILABLE' | 'PROJECT_IN_ANOTHER_CELL' | 'PUBLISHABLE_KEY_REFUSED' | 'RATE_LIMIT_EXCEEDED' | 'READ_ONLY_KEY' | 'REQUEST_INVALID' | 'REQUEST_TIMEOUT' | 'RESOURCE_CONFLICT' | 'RESOURCE_EXPIRED' | 'RESOURCE_NOT_FOUND' | 'REVERIFICATION_REQUIRED' | 'SERVICE_INDETERMINATE' | 'TRANSACTION_ROLLED_BACK' | 'USAGE_QUOTA_EXCEEDED' | 'USER_NOT_PROVISIONED';
                 messages: string[];
                 details?: {
                     [key: string]: unknown;
@@ -2154,8 +2155,8 @@ interface components {
             facts: {
                 /** @description The unique set whose values are held: one field declared `unique: true`, or a set the Record type declares in `unique`, in declared order. */
                 fields: string[];
-                /** @description The Record holding them, `rec_…`. */
-                recordId: string;
+                /** @description The Record holding them, `rec_…`. Absent for an End user’s write: the holder may be a Record their read Policy hides from them. */
+                recordId?: string;
                 /** @description In a batch (`POST /v1/records/batch`), the index from 0 of the operation refused. Absent outside one. */
                 operation?: number;
             };
@@ -2178,7 +2179,7 @@ interface components {
                 /**
                  * @description - `ACCESS_DENIED`: The credential is valid, but its subject may not do this here. Fix: Use a key or a Role that grants this action on this resource, or ask an Owner to grant it; `details.rule` names the rule that refused.
                  *     - `PLAN_FEATURE_UNAVAILABLE`: The Organization's Plan does not include the feature this request uses. Fix: Move the Organization to a Plan that includes `details.feature`, or leave the feature out of the request.
-                 *     - `PUBLISHABLE_KEY_REFUSED`: A publishable key reaches no Record and runs no Function: a browser reads none of an app's data. Fix: Call Records and Functions from your server with a secret key; a publishable key reads only published content.
+                 *     - `PUBLISHABLE_KEY_REFUSED`: A publishable key writes a Record only for a signed-in End user, runs only a Function that declares `endUsers`, and uploads no Record's File: a browser with no End user's token writes nothing. Fix: Send the End user's token in `X-RelyIO-End-User` to write a Record as its type's Policy allows; declare `endUsers` on a Function a browser calls; run any other Function and upload Files from your server with a secret key.
                  *     - `READ_ONLY_KEY`: The key may read but not write. Fix: Send the write with a key that may write, and keep the read-only key for reads.
                  *     - `USAGE_QUOTA_EXCEEDED`: The Organization has used all of this period's allowance for `details.meter`. Fix: Wait for the next billing period, or raise the allowance by moving to a larger Plan.
                  * @enum {string}
@@ -2190,22 +2191,6 @@ interface components {
                 };
             };
         };
-        RefusalAccessDeniedOrPlanFeatureUnavailableOrPublishableKeyRefusedOrUsageQuotaExceeded: {
-            error: {
-                /**
-                 * @description - `ACCESS_DENIED`: The credential is valid, but its subject may not do this here. Fix: Use a key or a Role that grants this action on this resource, or ask an Owner to grant it; `details.rule` names the rule that refused.
-                 *     - `PLAN_FEATURE_UNAVAILABLE`: The Organization's Plan does not include the feature this request uses. Fix: Move the Organization to a Plan that includes `details.feature`, or leave the feature out of the request.
-                 *     - `PUBLISHABLE_KEY_REFUSED`: A publishable key reaches no Record and runs no Function: a browser reads none of an app's data. Fix: Call Records and Functions from your server with a secret key; a publishable key reads only published content.
-                 *     - `USAGE_QUOTA_EXCEEDED`: The Organization has used all of this period's allowance for `details.meter`. Fix: Wait for the next billing period, or raise the allowance by moving to a larger Plan.
-                 * @enum {string}
-                 */
-                code: 'ACCESS_DENIED' | 'PLAN_FEATURE_UNAVAILABLE' | 'PUBLISHABLE_KEY_REFUSED' | 'USAGE_QUOTA_EXCEEDED';
-                messages: string[];
-                details?: {
-                    [key: string]: unknown;
-                };
-            };
-        };
         RefusalAccessDeniedOrPlanFeatureUnavailableOrReadOnlyKeyOrUsageQuotaExceeded: {
             error: {
                 /**
@@ -2265,6 +2250,34 @@ interface components {
                 };
             };
         };
+        RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey: {
+            error: {
+                /**
+                 * @description - `END_USER_TOKEN_INVALID`: The key was accepted, but the End user's token in `X-RelyIO-End-User` was not: it is not the Environment's identity source's, that Environment has none, or the call needs one and carried none. Fix: Read `details.reason`, then send a current token from the identity source this Environment connects — or connect one — or, where none is needed, send the request without the header.
+                 * @enum {string}
+                 */
+                code: 'END_USER_TOKEN_INVALID';
+                messages: string[];
+                details: {
+                    /**
+                     * @description `missing`: the call needs an End user's token and carried none. `no-identity-source`: the Environment has no identity Extension connected. The rest are the token itself: not a token, an algorithm other than RS256 or ES256, another issuer, a key the issuer does not publish, a signature that does not verify, another audience, past its expiry, before its start, or naming no subject.
+                     * @enum {string}
+                     */
+                    reason: 'bad-signature' | 'expired' | 'malformed' | 'missing' | 'missing-subject' | 'no-identity-source' | 'not-yet-valid' | 'unknown-key' | 'unsupported-algorithm' | 'wrong-audience' | 'wrong-issuer';
+                };
+            } | {
+                /**
+                 * @description - `INVALID_API_KEY`: The credential was read but is not accepted: it is malformed, expired, revoked, unknown, or a kind this route does not take. Fix: Read `details.reason`, then send a current credential of the kind the route takes, creating a new key if this one was revoked or expired.
+                 *     - `MISSING_API_KEY`: The request carried no credential, or one that did not authenticate. Fix: Send a credential with the request: an API key in the `X-API-Key` header, or the bearer token the route takes.
+                 * @enum {string}
+                 */
+                code: 'INVALID_API_KEY' | 'MISSING_API_KEY';
+                messages: string[];
+                details?: {
+                    [key: string]: unknown;
+                };
+            };
+        };
         RefusalFunctionContainersBusy: {
             error: {
                 /**
@@ -2332,20 +2345,6 @@ interface components {
                 };
             };
         };
-        RefusalInvalidApiKeyOrMissingApiKey: {
-            error: {
-                /**
-                 * @description - `INVALID_API_KEY`: The credential was read but is not accepted: it is malformed, expired, revoked, unknown, or a kind this route does not take. Fix: Read `details.reason`, then send a current credential of the kind the route takes, creating a new key if this one was revoked or expired.
-                 *     - `MISSING_API_KEY`: The request carried no credential, or one that did not authenticate. Fix: Send a credential with the request: an API key in the `X-API-Key` header, or the bearer token the route takes.
-                 * @enum {string}
-                 */
-                code: 'INVALID_API_KEY' | 'MISSING_API_KEY';
-                messages: string[];
-                details?: {
-                    [key: string]: unknown;
-                };
-            };
-        };
         RefusalProjectInAnotherCell: {
             error: {
                 /**
@@ -3060,6 +3059,7 @@ interface components {
                  * @description - `ACCESS_DENIED`: The credential is valid, but its subject may not do this here. Fix: Use a key or a Role that grants this action on this resource, or ask an Owner to grant it; `details.rule` names the rule that refused.
                  *     - `AI_UNAVAILABLE_IN_REGION`: The Project's data region promises residency, and no AI processes inside that region yet. Fix: Run AI work on a Project in another region; no Plan, credential or retry changes this one.
                  *     - `CONTENT_INVALID`: The content does not satisfy the schema of the type it was written to. Fix: Correct each field `details.issues` names so it matches the schema, then write it again.
+                 *     - `END_USER_TOKEN_INVALID`: The key was accepted, but the End user's token in `X-RelyIO-End-User` was not: it is not the Environment's identity source's, that Environment has none, or the call needs one and carried none. Fix: Read `details.reason`, then send a current token from the identity source this Environment connects — or connect one — or, where none is needed, send the request without the header.
                  *     - `FUNCTION_CONTAINERS_BUSY`: The project is running as many Function runs in Containers at once as its plan includes, so this one was not started. Fix: Call again after the seconds the `Retry-After` header names, or start the run from a schedule or an Automation step, which waits for a free Container.
                  *     - `FUNCTION_RUN_FAILED`: The Function ran and ended without an answer: its code threw, or it was ended at a limit; `details.runId` names the run. Fix: Read the run's record and console output by `details.runId`, fix the Function, and call it again.
                  *     - `FUNCTION_RUN_TIMED_OUT`: The Function ran longer than a caller waits, five minutes; it goes on to its own limit, and `details.runId` names the run. Fix: Read the run's record by `details.runId` for how it ended, and move work that long to a schedule or an Automation step.
@@ -3074,7 +3074,7 @@ interface components {
                  *     - `PLAN_DOWNGRADE_BLOCKED`: The Organization keeps more than the target Plan allows, so it cannot move to it. Fix: Reduce each Stock Limit `details.stockLimits` lists to within the target Plan, then retry the change.
                  *     - `PLAN_FEATURE_UNAVAILABLE`: The Organization's Plan does not include the feature this request uses. Fix: Move the Organization to a Plan that includes `details.feature`, or leave the feature out of the request.
                  *     - `PROJECT_IN_ANOTHER_CELL`: The request reached a region that does not hold the Project it names. Fix: Send the same request to the region `details.region` names; retrying it here will not succeed.
-                 *     - `PUBLISHABLE_KEY_REFUSED`: A publishable key reaches no Record and runs no Function: a browser reads none of an app's data. Fix: Call Records and Functions from your server with a secret key; a publishable key reads only published content.
+                 *     - `PUBLISHABLE_KEY_REFUSED`: A publishable key writes a Record only for a signed-in End user, runs only a Function that declares `endUsers`, and uploads no Record's File: a browser with no End user's token writes nothing. Fix: Send the End user's token in `X-RelyIO-End-User` to write a Record as its type's Policy allows; declare `endUsers` on a Function a browser calls; run any other Function and upload Files from your server with a secret key.
                  *     - `RATE_LIMIT_EXCEEDED`: Too many requests arrived within the current rate-limit window. Fix: Wait the seconds the `Retry-After` header names before retrying, and spread requests out.
                  *     - `READ_ONLY_KEY`: The key may read but not write. Fix: Send the write with a key that may write, and keep the read-only key for reads.
                  *     - `REQUEST_INVALID`: The request is malformed: a path parameter, query parameter, header or body field the route cannot accept. Fix: Correct each field `details.issues` names, by its path and message, and send the request again.
@@ -3089,7 +3089,7 @@ interface components {
                  *     - `USER_NOT_PROVISIONED`: The session is valid, but the User's account is still being set up after sign-up. Fix: Keep the session and retry after the seconds the `Retry-After` header names.
                  * @enum {string}
                  */
-                code: 'ACCESS_DENIED' | 'AI_UNAVAILABLE_IN_REGION' | 'CONTENT_INVALID' | 'FUNCTION_CONTAINERS_BUSY' | 'FUNCTION_RUN_FAILED' | 'FUNCTION_RUN_TIMED_OUT' | 'INTERNAL_ERROR' | 'INVALID_API_KEY' | 'METHOD_NOT_ALLOWED' | 'MISSING_API_KEY' | 'ORGANIZATION_BEING_DELETED' | 'ORGANIZATION_DELETE_BLOCKED' | 'ORGANIZATION_IN_ANOTHER_CELL' | 'PAYLOAD_TOO_LARGE' | 'PLAN_DOWNGRADE_BLOCKED' | 'PLAN_FEATURE_UNAVAILABLE' | 'PROJECT_IN_ANOTHER_CELL' | 'PUBLISHABLE_KEY_REFUSED' | 'RATE_LIMIT_EXCEEDED' | 'READ_ONLY_KEY' | 'REQUEST_INVALID' | 'REQUEST_TIMEOUT' | 'RESOURCE_CONFLICT' | 'RESOURCE_EXPIRED' | 'RESOURCE_NOT_FOUND' | 'REVERIFICATION_REQUIRED' | 'SERVICE_INDETERMINATE' | 'TRANSACTION_ROLLED_BACK' | 'USAGE_QUOTA_EXCEEDED' | 'USER_NOT_PROVISIONED';
+                code: 'ACCESS_DENIED' | 'AI_UNAVAILABLE_IN_REGION' | 'CONTENT_INVALID' | 'END_USER_TOKEN_INVALID' | 'FUNCTION_CONTAINERS_BUSY' | 'FUNCTION_RUN_FAILED' | 'FUNCTION_RUN_TIMED_OUT' | 'INTERNAL_ERROR' | 'INVALID_API_KEY' | 'METHOD_NOT_ALLOWED' | 'MISSING_API_KEY' | 'ORGANIZATION_BEING_DELETED' | 'ORGANIZATION_DELETE_BLOCKED' | 'ORGANIZATION_IN_ANOTHER_CELL' | 'PAYLOAD_TOO_LARGE' | 'PLAN_DOWNGRADE_BLOCKED' | 'PLAN_FEATURE_UNAVAILABLE' | 'PROJECT_IN_ANOTHER_CELL' | 'PUBLISHABLE_KEY_REFUSED' | 'RATE_LIMIT_EXCEEDED' | 'READ_ONLY_KEY' | 'REQUEST_INVALID' | 'REQUEST_TIMEOUT' | 'RESOURCE_CONFLICT' | 'RESOURCE_EXPIRED' | 'RESOURCE_NOT_FOUND' | 'REVERIFICATION_REQUIRED' | 'SERVICE_INDETERMINATE' | 'TRANSACTION_ROLLED_BACK' | 'USAGE_QUOTA_EXCEEDED' | 'USER_NOT_PROVISIONED';
                 messages: string[];
                 details?: {
                     [key: string]: unknown;
@@ -4700,13 +4700,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -4798,13 +4798,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -4931,13 +4931,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -5027,13 +5027,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -5145,13 +5145,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -5284,13 +5284,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -5384,13 +5384,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -5480,13 +5480,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -5596,13 +5596,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -5712,13 +5712,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -5828,13 +5828,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -5944,13 +5944,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -6060,13 +6060,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -6176,13 +6176,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -6292,13 +6292,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -6408,13 +6408,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -6531,13 +6531,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -6632,13 +6632,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -6752,13 +6752,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -6853,13 +6853,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -6954,13 +6954,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -7066,13 +7066,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -7201,13 +7201,13 @@ interface operations {
                     };
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                     'text/event-stream': {
                         /** @enum {string} */
                         type: 'change' | 'complete' | 'error' | 'heartbeat';
@@ -7359,13 +7359,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, PUBLISHABLE_KEY_REFUSED, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -7465,13 +7465,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -7562,13 +7562,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -7662,13 +7662,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -7759,13 +7759,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -7858,13 +7858,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -7957,13 +7957,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -8052,13 +8052,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -8158,13 +8158,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -8271,13 +8271,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -8389,13 +8389,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -8517,22 +8517,22 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
-            /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, PUBLISHABLE_KEY_REFUSED, USAGE_QUOTA_EXCEEDED */
+            /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
             403: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalAccessDeniedOrPlanFeatureUnavailableOrPublishableKeyRefusedOrUsageQuotaExceeded'];
+                    'application/json': components['schemas']['RefusalAccessDeniedOrPlanFeatureUnavailableOrUsageQuotaExceeded'];
                 };
             };
             /** @description RESOURCE_NOT_FOUND */
@@ -8613,13 +8613,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, PUBLISHABLE_KEY_REFUSED, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -8726,22 +8726,22 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
-            /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, PUBLISHABLE_KEY_REFUSED, USAGE_QUOTA_EXCEEDED */
+            /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
             403: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalAccessDeniedOrPlanFeatureUnavailableOrPublishableKeyRefusedOrUsageQuotaExceeded'];
+                    'application/json': components['schemas']['RefusalAccessDeniedOrPlanFeatureUnavailableOrUsageQuotaExceeded'];
                 };
             };
             /** @description RESOURCE_NOT_FOUND */
@@ -8819,13 +8819,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, PUBLISHABLE_KEY_REFUSED, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -8927,13 +8927,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, PUBLISHABLE_KEY_REFUSED, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -9032,13 +9032,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, PUBLISHABLE_KEY_REFUSED, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -9128,13 +9128,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, PUBLISHABLE_KEY_REFUSED, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -9240,13 +9240,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -9343,13 +9343,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -9446,13 +9446,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -9551,13 +9551,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -9659,13 +9659,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -9758,13 +9758,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -9873,13 +9873,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -9977,13 +9977,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -10096,13 +10096,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -10196,13 +10196,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -10304,13 +10304,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -10403,13 +10403,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalContentInvalidOrRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, READ_ONLY_KEY, USAGE_QUOTA_EXCEEDED */
@@ -10518,13 +10518,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -10619,13 +10619,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -10719,13 +10719,13 @@ interface operations {
                     'application/json': components['schemas']['RefusalRequestInvalid'];
                 };
             };
-            /** @description INVALID_API_KEY, MISSING_API_KEY */
+            /** @description END_USER_TOKEN_INVALID, INVALID_API_KEY, MISSING_API_KEY */
             401: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['RefusalInvalidApiKeyOrMissingApiKey'];
+                    'application/json': components['schemas']['RefusalEndUserTokenInvalidOrInvalidApiKeyOrMissingApiKey'];
                 };
             };
             /** @description ACCESS_DENIED, PLAN_FEATURE_UNAVAILABLE, USAGE_QUOTA_EXCEEDED */
@@ -10871,6 +10871,31 @@ interface RelyIOConfig {
      * })
      */
     fetch?: typeof globalThis.fetch;
+    /**
+     * The signed-in End user's token, asked for on every request (spec 4). Hand the client your
+     * identity provider's token function once — Clerk's `getToken`, or your own — and each request
+     * the client sends calls it then and sends what it answers as `X-RelyIO-End-User`, beside the key.
+     * The Content API verifies the token against the Environment's identity source and answers as that
+     * End user; a token it cannot verify is refused `END_USER_TOKEN_INVALID` (401).
+     *
+     * - `null` — or an empty or blank string — is a visitor who is not signed in: no header is sent,
+     *   and the request is the key's alone. An End-user header given in `headers` is not sent either.
+     * - It is asked once per call, before the first attempt: every retry of that call sends the token
+     *   the first attempt sent.
+     * - A function that throws sends nothing: the call rejects with its error, never as the key alone.
+     *
+     * It works with a publishable key in a browser and with a secret key on a server, where it is the
+     * request's own token function (Clerk's `auth().getToken`). A response to a request that carries a
+     * token is that person's: the API marks it `private, no-store`, and no shared cache keeps it.
+     * `liveChanges()` sends no token: the live edge follows published changes for every visitor alike.
+     *
+     * @example
+     * const relyio = createClient({
+     *   apiKey: 'rly_pub_…',
+     *   getToken: () => window.Clerk?.session?.getToken() ?? Promise.resolve(null),
+     * })
+     */
+    getToken?: () => Promise<string | null>;
     /**
      * RelyIO's live edge, which `liveChanges()` — and `<RelyIOProvider live>` from `@relyio/react`
      * with a publishable key — follows a dataset's published changes at. An `https:` or `wss:` URL
@@ -11083,8 +11108,9 @@ type WithDefaults<T, NoDefault extends keyof T = never> = Required<Omit<T, NoDef
  * `fetch` and `webSocket` among them: absent means the runtime's own, and that is read per request
  * or per connection rather than captured here. `liveUrl` too: absent is derived from `baseUrl` when
  * the live transport opens, where RelyIO's own API names its edge, and is otherwise no address.
+ * `getToken` too: absent is a client that sends no End user's token.
  */
-type UndefaultedOption = 'apiKey' | 'dataset' | 'locale' | 'dev' | 'fetch' | 'liveUrl' | 'webSocket';
+type UndefaultedOption = 'apiKey' | 'dataset' | 'locale' | 'dev' | 'fetch' | 'getToken' | 'liveUrl' | 'webSocket';
 /** The options that are themselves bags of options, each merged field by field. */
 type OptionBag = 'browser' | 'cache' | 'debug';
 /**
@@ -11111,6 +11137,121 @@ type ConfigDefaults = WithDefaults<Omit<RelyIOConfig, UndefaultedOption | Option
 /** The configuration a client runs on: each option the caller gave, and its default where not. */
 type MergedRelyIOConfig = ConfigDefaults & Pick<RelyIOConfig, UndefaultedOption>;
 
+/**
+ * A condition tree — the list grammar's operators combined with `and`, `or` and `not` over named
+ * roots — and the one check every evaluator runs before it answers one (REL-3879).
+ *
+ * One language for three askers: an End user's Policy (spec 4, ADR 0027), over `owner`, `claims.*`
+ * and the item's fields (`record.*` / `entry.*`); an Automation's If step and its trigger's `where`
+ * (spec 3), over the event and earlier steps' outputs. A tree is plain data (ADR 0021): the builder
+ * below returns the very object a deployed Automation or Policy stores, so the plan can diff it and
+ * no customer code runs to decide it.
+ *
+ * A test names a **root** and a path under it. A root is either the item a read is about, which the
+ * database half compiles against stored documents, or a value its caller **supplies** — a token's
+ * Claims, an event, a step's output. Which roots exist is the caller's to say; a tree naming one it
+ * does not supply is refused by name ({@link ConditionRefusedError}), never answered as false,
+ * because a misspelt root that quietly fails every test reads exactly like a rule that holds of
+ * nobody.
+ *
+ * What an operator *means* is not here, as for the list module's own conditions: the in-memory
+ * evaluator (`evaluateConditionTree`) and the database half read `@relyio/queries`' catalog rows,
+ * whose two faces `catalog-parity.mongo.test.ts` holds to one answer. An absent value is absent and
+ * is never defaulted, so a test answers it as Mongo answers a missing field: `eq`, `in`, `gt`,
+ * `exists` are false; `ne`, `nin`, `isEmpty`, `notContains` are true.
+ */
+/**
+ * The operators a condition tree may test with: the list grammar's, less the ones that need a fact
+ * a value bag does not carry — a clock (`inTheLast`, `inTheNext`) or the form a path stores its date
+ * in (`isBefore`, `isAfter`, `isOn`, `isBetween`) — and the case-sensitivity spellings of the REST
+ * dialect. A date is compared as the text or number it is.
+ */
+declare const CONDITION_OPERATORS: readonly ["eq", "ne", "gt", "gte", "lt", "lte", "in", "nin", "exists", "isNull", "isEmpty", "hasValue", "contains", "notContains", "between"];
+type ConditionOperator = (typeof CONDITION_OPERATORS)[number];
+/** One value a test compares with. */
+type ConditionScalar = string | number | boolean;
+/** What a test is answered with, by the argument its operator takes. */
+type ConditionArgument = ConditionScalar | readonly ConditionScalar[] | {
+    readonly from: string | number;
+    readonly to: string | number;
+};
+/** One test: a path under a root, an operator, and the operator's argument. */
+type ConditionTest = {
+    readonly root: string;
+    readonly path: readonly string[];
+    readonly operator: ConditionOperator;
+    readonly value?: ConditionArgument;
+};
+/** Tests combined. An empty `and` holds; an empty `or` does not. */
+type ConditionTree = ConditionTest | {
+    readonly and: readonly ConditionTree[];
+} | {
+    readonly or: readonly ConditionTree[];
+} | {
+    readonly not: ConditionTree;
+};
+/** Every test holds. */
+declare function and(...conditions: readonly ConditionTree[]): ConditionTree;
+/** Some test holds. */
+declare function or(...conditions: readonly ConditionTree[]): ConditionTree;
+/** The test does not hold. */
+declare function not(condition: ConditionTree): ConditionTree;
+/** A list is compared by its members, as Mongo compares an array field. */
+type MemberOf<T> = T extends ReadonlyArray<infer Member> ? Member : T;
+/** The values a path holding `T` is compared with: any scalar where its shape is not known. */
+type ComparedWith<T> = unknown extends T ? ConditionScalar : MemberOf<NonNullable<T>> extends infer Member ? Member extends ConditionScalar ? Member : never : never;
+/** What a path offers: one method per condition operator. */
+interface ConditionTests<T = unknown> {
+    eq(value: ComparedWith<T>): ConditionTest;
+    ne(value: ComparedWith<T>): ConditionTest;
+    gt(value: ComparedWith<T> & (string | number)): ConditionTest;
+    gte(value: ComparedWith<T> & (string | number)): ConditionTest;
+    lt(value: ComparedWith<T> & (string | number)): ConditionTest;
+    lte(value: ComparedWith<T> & (string | number)): ConditionTest;
+    in(values: ReadonlyArray<ComparedWith<T>>): ConditionTest;
+    nin(values: ReadonlyArray<ComparedWith<T>>): ConditionTest;
+    /** Present (the default) or absent. */
+    exists(present?: boolean): ConditionTest;
+    /** Absent or `null` (the default), or neither. */
+    isNull(nullish?: boolean): ConditionTest;
+    /** Absent, `null`, the empty string or the empty list. */
+    isEmpty(): ConditionTest;
+    /** None of {@link isEmpty}'s four. */
+    hasValue(): ConditionTest;
+    /** Holds the text, any case. */
+    contains(text: string): ConditionTest;
+    notContains(text: string): ConditionTest;
+    /** Both ends inclusive. */
+    between(range: {
+        readonly from: ComparedWith<T> & (string | number);
+        readonly to: ComparedWith<T> & (string | number);
+    }): ConditionTest;
+}
+/**
+ * The paths under a path whose shape is not known: any name. An interface, so it may name itself.
+ * It is an index signature, so a project with `noUncheckedIndexedAccess` reads each step as possibly
+ * undefined — a customer's roots are typed (codegen's Claims and fields, a step's output fields).
+ */
+interface OpenConditionChildren {
+    readonly [key: string]: ConditionPath;
+}
+type ChildrenOf<T> = unknown extends T ? OpenConditionChildren : NonNullable<T> extends readonly unknown[] ? unknown : NonNullable<T> extends object ? {
+    readonly [K in keyof NonNullable<T> & string]-?: ConditionPath<NonNullable<T>[K]>;
+} : unknown;
+/**
+ * A path under a root: its tests, and the paths under it. Typed from `T` where the caller knows the
+ * shape — codegen's Claims, a step's output fields — and open where it does not.
+ *
+ * A field named like a test (`eq`, `in`) is reached with {@link conditionRoot}'s path argument.
+ */
+type ConditionPath<T = unknown> = ConditionTests<T> & ChildrenOf<T>;
+/**
+ * A root to write tests against: `conditionRoot('claims').plan.eq('paid')` is
+ * `{ root: 'claims', path: ['plan'], operator: 'eq', value: 'paid' }`. `path` starts it deeper,
+ * which is also how a segment named like a test is reached.
+ */
+declare function conditionRoot<T = unknown>(root: string, path?: readonly string[]): ConditionPath<T>;
+
 /**
  * Each field kind, declared once, with every facet the other packages decide by it — P0's field
  * contract (REL-1783 declared it, REL-1788 made it the only list; `docs/design/structured-fields/README.md`,
@@ -11158,7 +11299,7 @@ type MergedRelyIOConfig = ConfigDefaults & Pick<RelyIOConfig, UndefaultedOption>
  * Every field kind, in the order the schema language has always listed them. The one definition of
  * the union in `@relyio/schema`: `FIELD_TYPES` in `types/base/constants.ts` is this tuple.
  */
-declare const FIELD_KINDS: readonly ['shortText', 'longText', 'richText', 'table', 'code', 'email', 'url', 'slug', 'integer', 'decimal', 'counter', 'sequence', 'boolean', 'enum', 'date', 'dateTime', 'reference', 'tags', 'list', 'object', 'json', 'file'];
+declare const FIELD_KINDS: readonly ['shortText', 'longText', 'richText', 'table', 'code', 'email', 'url', 'slug', 'integer', 'decimal', 'counter', 'sequence', 'owner', 'boolean', 'enum', 'date', 'dateTime', 'reference', 'tags', 'list', 'object', 'json', 'file'];
 /** A field kind: what a field's `type` names. The declaration is keyed by it and by nothing else. */
 type FieldKind = (typeof FIELD_KINDS)[number];
 /**
@@ -11480,6 +11621,8 @@ interface FieldDefinition$1<TId extends string = string, TType extends string =
     fallback?: unknown;
     /** Whether this field is deprecated */
     deprecated?: boolean;
+    /** A Private field: never served to a publishable key or an End user (spec 4) */
+    private?: boolean;
 }
 /**
  * Any field definition - used in arrays where we need to preserve specific field types
@@ -11623,6 +11766,15 @@ interface SequenceConfig {
     /** Text before the number, up to 32 characters without whitespace. */
     prefix?: string;
 }
+/**
+ * An Owner field's config (spec 4, REL-3883): whether every Record names its owner, and whether an
+ * End user owns at most one Record of the type. No `defaultValue`: an owner is the asking End user,
+ * or the one your server or a Function names.
+ */
+interface OwnerConfig {
+    required?: boolean;
+    unique?: boolean;
+}
 interface DecimalConfig extends BaseFieldConfig {
     min?: number;
     max?: number;
@@ -11902,6 +12054,12 @@ interface KeyedFieldOptions<TLocalized extends Localized = Localized> {
     fallback?: unknown;
     /** Whether this Field is deprecated */
     deprecated?: boolean;
+    /**
+     * A Private Field: served to your server with a secret key and to your Functions, never to a
+     * publishable key or an End user — who cannot filter, sort, facet, search or include by it either.
+     * A quiz's correct answer. On a content type's or a Record type's own Fields only.
+     */
+    private?: boolean;
 }
 /** The key a keyed Field's type keeps its config under. Types only. */
 declare const configAs: unique symbol;
@@ -12083,6 +12241,13 @@ declare function counter<TRequired extends boolean = false>(options?: KeyedOptio
  * @example fields.sequence({ prefix: 'ORD-' })
  */
 declare function sequence(options?: KeyedOptions<SequenceConfig, Localized<never>>): KeyedField<'sequence', SequenceConfig, never, never>;
+/**
+ * Owner field (spec 4, REL-3883): the End user a Record belongs to, stored as their subject — the id
+ * their identity source's token names them by. A Record type whose `endUsers.read` is `'owner'` lets
+ * each End user read only the Records they own. At most one per Record type, at its top level.
+ * @example fields.owner()
+ */
+declare function owner<TRequired extends boolean = false>(options?: KeyedOptions<OwnerConfig & RequiredAs<TRequired>, Localized<never>>): KeyedField<'owner', OwnerConfig & RequiredAs<TRequired>, never, never>;
 /**
  * Decimal field with precision
  * @example fields.decimal({ decimalPlaces: 2, min: 0 })
@@ -12175,6 +12340,964 @@ declare function json<TSchema extends JsonSchema = never, TRequired extends bool
  */
 declare function file<TRequired extends boolean = false>(options: KeyedOptions<FileConfig & RequiredAs<TRequired>, Localized<never>>): KeyedField<'file', FileConfig & RequiredAs<TRequired>, never, never>;
 
+/**
+ * ## What a Project's code may name of each Extension (spec 3, REL-3846; ADR 0019)
+ *
+ * `relyio/extensions.ts` names the Extensions a Project uses and their settings, and an Automation
+ * names an Extension's Trigger in its `on` and its Actions in `step.action` — each through a typed
+ * handle `@relyio/sdk/extensions` gives. That handle is typed by what is declared here: each
+ * Extension's **settings** (set once per Project, never a secret), its **Actions** (input, output and
+ * the sample result Preview hands on) and its **Triggers** (the payload the receiver keeps).
+ *
+ * Declared once, and here, because the SDK may import `@relyio/api-contract` and may not import
+ * `@relyio/events`, whose Extension catalog owns every Extension (the customer fence,
+ * `CUSTOMER_LAYER_CHOKEPOINT`). The catalog reads these same values — its settings point and its
+ * Triggers' payload fields are these arrays — and `@relyio/events`' `extension-surfaces.test.ts`
+ * holds every name here to a declared one of the catalog.
+ *
+ * One entry per Extension a Project may declare: GitHub's Connection is the Project's binding, made
+ * by installing the App and never declared in `relyio/extensions.ts`, so it has none. An Extension's
+ * Actions an Automation may name are its step Actions; a built-in-only one (a deploy hook) is never
+ * one of them.
+ */
+/**
+ * One setting an Extension declares: text — starting with `prefix` when it must (Slack's channel,
+ * `#`), at most `maxLength` characters — or one of `options`. Never sensitive: a credential is a
+ * Connection's field, held per Environment and sealed.
+ */
+type ExtensionSettingField = (ExtensionSettingFieldBase & {
+    readonly type: 'text';
+    readonly prefix?: string;
+    readonly maxLength: number;
+}) | (ExtensionSettingFieldBase & {
+    readonly type: 'select';
+    readonly options: readonly string[];
+});
+interface ExtensionSettingFieldBase {
+    readonly key: string;
+    readonly label: string;
+    readonly required: boolean;
+    readonly helpText?: string;
+}
+/**
+ * One value an Action takes or answers, or a Trigger's payload holds: a dot-separated path, its
+ * JSON type, and whether it is always there. The shape of the catalog's `TriggerPayloadField`.
+ */
+interface ExtensionValueField {
+    readonly path: string;
+    readonly type: 'string' | 'number' | 'boolean' | 'object' | 'array';
+    readonly required: boolean;
+    /**
+     * For an `object` whose keys are the third party's customer's own — Stripe's `metadata` — what
+     * every value is: `string`, so `metadata.orderId` reads as text though no key of it is declared.
+     * Absent, an object's undeclared keys are untyped. The receiver refuses an object whose values
+     * are not all of it.
+     */
+    readonly values?: 'string';
+}
+/**
+ * What an action field's value is: `text` a string, `url` an absolute `http(s)` URL, `number` a
+ * finite number, `boolean`, `json` any JSON value, `headers` an object of string values, `files` a
+ * list of Files a Record holds (spec 1's File, REL-3824), each as a run's event carries it —
+ * `{ id, name, size, type }`, never its object key.
+ *
+ * A `files` field is an input field only. The events worker's send point reads each File itself,
+ * from the run's Dataset, before the Extension's handler sees the step (REL-3854): a Recorded send
+ * is handed each File's name, size and type, a send its bytes too, so no customer code and no tasks
+ * worker handles a byte.
+ */
+declare const ACTION_FIELD_TYPES: readonly ['text', 'url', 'number', 'boolean', 'json', 'headers', 'files'];
+type ActionFieldType = (typeof ACTION_FIELD_TYPES)[number];
+/** One field an action step takes or answers. */
+interface ActionField {
+    readonly key: string;
+    readonly type: ActionFieldType;
+    readonly required: boolean;
+    readonly description: string;
+    /**
+     * The Extension's setting (its Settings point, `relyio/extensions.ts`) an input field takes when
+     * the step gives none — Resend's `from` (REL-3854). Such a field is optional on the step and still
+     * needed by the send: with neither the step's value nor the setting, the send point refuses it by
+     * name. An input field only, naming a setting the Extension declares (`extensionCatalogProblems`).
+     */
+    readonly setting?: string;
+    /**
+     * On a `files` field, and required there: the most bytes its Files may hold together, which the
+     * send point refuses past before it reads any of them — the third party's own limit (Resend's 40 MB
+     * an email once encoded). Never on another type (`extensionCatalogProblems`).
+     */
+    readonly maxBytes?: number;
+}
+/**
+ * An action as an Automation step calls it, through the events worker's one send point
+ * (`POST /internal/actions`, ADR 0026; REL-3849) — the catalog's `ActionDefinition.step`:
+ *
+ * - `input` — the fields the step hands it, checked before anything is sent;
+ * - `output` — the fields its result carries, which the steps after it read under
+ *   `<step>.output`; a result that breaks them fails the step;
+ * - `sample` — the result a **Recorded** send hands on (spec 0's Preview rule): a Preview branch
+ *   with no Preview Connection of the Extension sends nothing, and the steps after it still run on
+ *   this. It satisfies `output` (`extensionCatalogProblems`). Declared by the Extension, never
+ *   overridden by a step;
+ * - `idempotencyHeader` — the request header the third party dedupes on, which carries
+ *   `<runId>:<step>`; `null` when it has none, and then a send whose outcome is unknown is never
+ *   sent again.
+ */
+interface ActionStep {
+    readonly input: readonly ActionField[];
+    readonly output: readonly ActionField[];
+    readonly sample: Readonly<Record<string, unknown>>;
+    readonly idempotencyHeader: string | null;
+}
+/**
+ * An Action an Automation step may name, under the name its handle gives it (`postMessage`): its
+ * slug in the Extension catalog, which the step stores, and its `step` — the very value the
+ * catalog's `ActionDefinition.step` is, so the handle's input and output are the send point's.
+ */
+interface ExtensionActionSurface {
+    readonly action: string;
+    readonly step: ActionStep;
+}
+/** A Trigger an Automation may start on, under the name its handle gives it (`deploymentSucceeded`). */
+interface ExtensionTriggerSurface {
+    /** The Trigger's slug in the Extension catalog, which the trigger stores (`trigger`). */
+    readonly trigger: string;
+    /** What the run reads under `event.payload`: the Trigger's payload fields. */
+    readonly payload: readonly ExtensionValueField[];
+}
+/**
+ * A contributed field kind's base kind (spec 4, REL-3894; ADR 0019's Field kinds point): a reference
+ * to one of its Extension's Managed Record types. The schema, reads, writes and Policies treat the
+ * field exactly as this reference — nothing new is stored, read or enforced.
+ */
+interface ContributedFieldKindBase {
+    readonly type: 'reference';
+    /** The Managed Record type it references, one its Extension contributes (`clerkUser`). */
+    readonly to: string;
+}
+/**
+ * What a contributed field kind's picker reads of the Records it offers: fields of its base kind's
+ * Record type. The Studio's picker searches `search` and shows each Record by `title`, `description`
+ * and `image`, so a person picks a user by name or email rather than pasting an id.
+ */
+interface ContributedFieldKindPicker {
+    /** The fields a Search matches: a Record is offered when any of them contains the text. */
+    readonly search: readonly string[];
+    /** The fields a row's title is, joined by a space, in order; an empty one is left out. */
+    readonly title: readonly string[];
+    /** The field shown under the title, or `null` for none. */
+    readonly description: string | null;
+    /** The field holding the address of the image shown beside the row, or `null` for none. */
+    readonly image: string | null;
+}
+/**
+ * A field kind an Extension contributes (spec 4, REL-3894): a base kind plus picker metadata. A
+ * Project's code declares it through the Extension's handle (`clerk.userRef()`), which writes a
+ * field of the base kind marked with the kind's name ({@link CONTRIBUTED_FIELD_KIND_OPTION}).
+ */
+interface ExtensionFieldKindSurface {
+    readonly base: ContributedFieldKindBase;
+    readonly picker: ContributedFieldKindPicker;
+}
+/** What a Project's code may name of one Extension. */
+interface ExtensionSurface {
+    readonly settings: readonly ExtensionSettingField[];
+    readonly actions: Readonly<Record<string, ExtensionActionSurface>>;
+    readonly triggers: Readonly<Record<string, ExtensionTriggerSurface>>;
+    /** Its contributed field kinds, by the name its handle gives them (`userRef`). */
+    readonly fieldKinds: Readonly<Record<string, ExtensionFieldKindSurface>>;
+    /**
+     * The Managed Record types it contributes (spec 4, REL-3888), by the name its handle gives them:
+     * `clerk.user` is `'clerkUser'`, so code names the type through the handle (REL-3863).
+     */
+    readonly recordTypes: Readonly<Record<string, string>>;
+}
+/**
+ * Every Extension a Project may declare in `relyio/extensions.ts`, by slug. An Extension's step
+ * Action is declared here and its catalog entry's `step` is this value (the webhook's `post`), and so
+ * is each Trigger's payload: one declaration types the SDK's handle and is what the catalog delivers.
+ * Resend's `send` (REL-3854) and Slack's `postMessage` (REL-3855) join the same way Stripe's
+ * Triggers (REL-3853) did; `@relyio/events`' `extension-surfaces.test.ts` fails on a step Action declared in the
+ * catalog and not here.
+ */
+declare const EXTENSION_SURFACES: {
+    readonly webhook: {
+        readonly settings: readonly [];
+        readonly actions: {
+            readonly post: {
+                readonly action: 'post';
+                readonly step: {
+                    readonly input: readonly [{
+                        readonly key: 'url';
+                        readonly type: 'url';
+                        readonly required: true;
+                        readonly description: 'Where to POST: an http(s) URL.';
+                    }, {
+                        readonly key: 'headers';
+                        readonly type: 'headers';
+                        readonly required: false;
+                        readonly description: 'Request headers, sent after the Connection’s custom headers. The headers RelyIO signs with are its own.';
+                    }, {
+                        readonly key: 'body';
+                        readonly type: 'json';
+                        readonly required: false;
+                        readonly description: 'The JSON body. Absent, the body is `null`.';
+                    }];
+                    readonly output: readonly [{
+                        readonly key: 'status';
+                        readonly type: 'number';
+                        readonly required: true;
+                        readonly description: 'The HTTP status the receiver answered.';
+                    }, {
+                        readonly key: 'body';
+                        readonly type: 'text';
+                        readonly required: false;
+                        readonly description: 'The first kilobyte of the receiver’s answer, as text.';
+                    }];
+                    readonly sample: {
+                        readonly status: 200;
+                        readonly body: '';
+                    };
+                    readonly idempotencyHeader: "x-relyio-event-id";
+                };
+            };
+        };
+        readonly triggers: {};
+        readonly fieldKinds: {};
+        readonly recordTypes: {};
+    };
+    readonly vercel: {
+        readonly settings: readonly [];
+        readonly actions: {};
+        readonly triggers: {
+            readonly deploymentSucceeded: {
+                readonly trigger: "deployment.succeeded";
+                readonly payload: readonly [{
+                    readonly path: 'payload.deployment.id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'payload.deployment.url';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'payload.deployment.meta.githubCommitSha';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'payload.deployment.meta.githubCommitRef';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'payload.project.id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'payload.target';
+                    readonly type: 'string';
+                    readonly required: false;
+                }];
+            };
+        };
+        readonly fieldKinds: {};
+        readonly recordTypes: {};
+    };
+    readonly netlify: {
+        readonly settings: readonly [];
+        readonly actions: {};
+        readonly triggers: {
+            readonly deploymentSucceeded: {
+                readonly trigger: "deployment.succeeded";
+                readonly payload: readonly [{
+                    readonly path: 'id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'site_id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'state';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'context';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'branch';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'commit_ref';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'deploy_ssl_url';
+                    readonly type: 'string';
+                    readonly required: false;
+                }];
+            };
+        };
+        readonly fieldKinds: {};
+        readonly recordTypes: {};
+    };
+    readonly stripe: {
+        readonly settings: readonly [];
+        readonly actions: {};
+        readonly triggers: {
+            readonly paymentIntentSucceeded: {
+                readonly trigger: 'payment_intent.succeeded';
+                readonly payload: readonly [{
+                    readonly path: 'id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'type';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'created';
+                    readonly type: 'number';
+                    readonly required: true;
+                }, {
+                    readonly path: 'livemode';
+                    readonly type: 'boolean';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.object';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.metadata';
+                    readonly type: 'object';
+                    readonly required: false;
+                    readonly values: 'string';
+                }, {
+                    readonly path: 'data.object.amount';
+                    readonly type: 'number';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.amount_received';
+                    readonly type: 'number';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.currency';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.status';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.customer';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.latest_charge';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.receipt_email';
+                    readonly type: 'string';
+                    readonly required: false;
+                }];
+            };
+            readonly paymentIntentPaymentFailed: {
+                readonly trigger: 'payment_intent.payment_failed';
+                readonly payload: readonly [{
+                    readonly path: 'id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'type';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'created';
+                    readonly type: 'number';
+                    readonly required: true;
+                }, {
+                    readonly path: 'livemode';
+                    readonly type: 'boolean';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.object';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.metadata';
+                    readonly type: 'object';
+                    readonly required: false;
+                    readonly values: 'string';
+                }, {
+                    readonly path: 'data.object.amount';
+                    readonly type: 'number';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.currency';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.status';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.customer';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.last_payment_error.code';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.last_payment_error.message';
+                    readonly type: 'string';
+                    readonly required: false;
+                }];
+            };
+            readonly checkoutSessionCompleted: {
+                readonly trigger: 'checkout.session.completed';
+                readonly payload: readonly [{
+                    readonly path: 'id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'type';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'created';
+                    readonly type: 'number';
+                    readonly required: true;
+                }, {
+                    readonly path: 'livemode';
+                    readonly type: 'boolean';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.object';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.metadata';
+                    readonly type: 'object';
+                    readonly required: false;
+                    readonly values: 'string';
+                }, {
+                    readonly path: 'data.object.mode';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.payment_status';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.amount_total';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.currency';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.payment_intent';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.customer';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.customer_details.email';
+                    readonly type: 'string';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.client_reference_id';
+                    readonly type: 'string';
+                    readonly required: false;
+                }];
+            };
+            readonly chargeRefunded: {
+                readonly trigger: 'charge.refunded';
+                readonly payload: readonly [{
+                    readonly path: 'id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'type';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'created';
+                    readonly type: 'number';
+                    readonly required: true;
+                }, {
+                    readonly path: 'livemode';
+                    readonly type: 'boolean';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.object';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.metadata';
+                    readonly type: 'object';
+                    readonly required: false;
+                    readonly values: 'string';
+                }, {
+                    readonly path: 'data.object.amount';
+                    readonly type: 'number';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.amount_refunded';
+                    readonly type: 'number';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.currency';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.refunded';
+                    readonly type: 'boolean';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.payment_intent';
+                    readonly type: 'string';
+                    readonly required: false;
+                }];
+            };
+            readonly customerSubscriptionCreated: {
+                readonly trigger: 'customer.subscription.created';
+                readonly payload: readonly [{
+                    readonly path: 'id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'type';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'created';
+                    readonly type: 'number';
+                    readonly required: true;
+                }, {
+                    readonly path: 'livemode';
+                    readonly type: 'boolean';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.object';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.metadata';
+                    readonly type: 'object';
+                    readonly required: false;
+                    readonly values: 'string';
+                }, {
+                    readonly path: 'data.object.status';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.customer';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.cancel_at_period_end';
+                    readonly type: 'boolean';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.cancel_at';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.canceled_at';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.ended_at';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.start_date';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.trial_end';
+                    readonly type: 'number';
+                    readonly required: false;
+                }];
+            };
+            readonly customerSubscriptionUpdated: {
+                readonly trigger: 'customer.subscription.updated';
+                readonly payload: readonly [{
+                    readonly path: 'id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'type';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'created';
+                    readonly type: 'number';
+                    readonly required: true;
+                }, {
+                    readonly path: 'livemode';
+                    readonly type: 'boolean';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.object';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.metadata';
+                    readonly type: 'object';
+                    readonly required: false;
+                    readonly values: 'string';
+                }, {
+                    readonly path: 'data.object.status';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.customer';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.cancel_at_period_end';
+                    readonly type: 'boolean';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.cancel_at';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.canceled_at';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.ended_at';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.start_date';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.trial_end';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.previous_attributes.status';
+                    readonly type: 'string';
+                    readonly required: false;
+                }];
+            };
+            readonly customerSubscriptionDeleted: {
+                readonly trigger: 'customer.subscription.deleted';
+                readonly payload: readonly [{
+                    readonly path: 'id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'type';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'created';
+                    readonly type: 'number';
+                    readonly required: true;
+                }, {
+                    readonly path: 'livemode';
+                    readonly type: 'boolean';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.id';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.object';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.metadata';
+                    readonly type: 'object';
+                    readonly required: false;
+                    readonly values: 'string';
+                }, {
+                    readonly path: 'data.object.status';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.customer';
+                    readonly type: 'string';
+                    readonly required: true;
+                }, {
+                    readonly path: 'data.object.cancel_at_period_end';
+                    readonly type: 'boolean';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.cancel_at';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.canceled_at';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.ended_at';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.start_date';
+                    readonly type: 'number';
+                    readonly required: false;
+                }, {
+                    readonly path: 'data.object.trial_end';
+                    readonly type: 'number';
+                    readonly required: false;
+                }];
+            };
+        };
+        readonly fieldKinds: {};
+        readonly recordTypes: {};
+    };
+    readonly slack: {
+        readonly settings: readonly [{
+            readonly key: 'defaultChannel';
+            readonly label: 'Default channel';
+            readonly type: 'text';
+            readonly prefix: '#';
+            readonly maxLength: 80;
+            readonly required: false;
+            readonly helpText: 'The channel a message goes to when its step names none: #orders.';
+        }];
+        readonly actions: {
+            readonly postMessage: {
+                readonly action: 'postMessage';
+                readonly step: {
+                    readonly input: readonly [{
+                        readonly key: 'channel';
+                        readonly type: 'text';
+                        readonly required: false;
+                        readonly setting: 'defaultChannel';
+                        readonly description: 'The channel to post to, by name (#orders-review) or id. Absent, the defaultChannel setting.';
+                    }, {
+                        readonly key: 'text';
+                        readonly type: 'text';
+                        readonly required: true;
+                        readonly description: 'The message, in Slack’s mrkdwn; also the notification text when blocks are sent.';
+                    }, {
+                        readonly key: 'blocks';
+                        readonly type: 'json';
+                        readonly required: false;
+                        readonly description: 'Block Kit blocks to post instead of plain text.';
+                    }];
+                    readonly output: readonly [{
+                        readonly key: 'ts';
+                        readonly type: 'text';
+                        readonly required: true;
+                        readonly description: 'The posted message’s timestamp, Slack’s id for it in its channel.';
+                    }, {
+                        readonly key: 'channel';
+                        readonly type: 'text';
+                        readonly required: true;
+                        readonly description: 'The channel the message was posted to, as Slack answered it.';
+                    }];
+                    readonly sample: {
+                        readonly ts: 'sample';
+                        readonly channel: 'sample';
+                    };
+                    readonly idempotencyHeader: null;
+                };
+            };
+        };
+        readonly triggers: {};
+        readonly fieldKinds: {};
+        readonly recordTypes: {};
+    };
+    readonly resend: {
+        readonly settings: readonly [{
+            readonly key: 'from';
+            readonly label: 'From';
+            readonly type: 'text';
+            readonly maxLength: 320;
+            readonly required: false;
+            readonly helpText: 'Who an email is from when its step names no sender: an address on a domain verified in Resend, such as Acme <orders@acme.shop>.';
+        }];
+        readonly actions: {
+            readonly send: {
+                readonly action: 'send';
+                readonly step: {
+                    readonly input: readonly [{
+                        readonly key: 'to';
+                        readonly type: 'text';
+                        readonly required: true;
+                        readonly description: 'Who the email is to: an address, or several separated by commas.';
+                    }, {
+                        readonly key: 'subject';
+                        readonly type: 'text';
+                        readonly required: true;
+                        readonly description: 'The subject line.';
+                    }, {
+                        readonly key: 'html';
+                        readonly type: 'text';
+                        readonly required: false;
+                        readonly description: 'The body as HTML. `html` or `text` is required, or both.';
+                    }, {
+                        readonly key: 'text';
+                        readonly type: 'text';
+                        readonly required: false;
+                        readonly description: 'The body as plain text. `html` or `text` is required, or both.';
+                    }, {
+                        readonly key: 'from';
+                        readonly type: 'text';
+                        readonly required: false;
+                        readonly setting: 'from';
+                        readonly description: 'Who the email is from: an address on a domain verified in Resend. Absent, the Project’s `from` setting; with neither, the send is refused.';
+                    }, {
+                        readonly key: 'attachments';
+                        readonly type: 'files';
+                        readonly required: false;
+                        readonly maxBytes: number;
+                        readonly description: 'Files a Record of the run’s Dataset holds (`event.record.invoice`), attached under their names. The send point reads their bytes.';
+                    }];
+                    readonly output: readonly [{
+                        readonly key: 'id';
+                        readonly type: 'text';
+                        readonly required: true;
+                        readonly description: 'The id Resend gave the email.';
+                    }];
+                    readonly sample: {
+                        readonly id: 'resend-sample';
+                    };
+                    readonly idempotencyHeader: "Idempotency-Key";
+                };
+            };
+        };
+        readonly triggers: {};
+        readonly fieldKinds: {};
+        readonly recordTypes: {};
+    };
+    /**
+     * The plain OIDC identity source (spec 4, REL-3880): any issuer that publishes a discovery
+     * document — Auth0, Supabase Auth, an own one. Its Connection, per Environment, holds the issuer
+     * and the audience; it has no Action and no Trigger. Its one setting is the Claims the Project
+     * relies on ({@link IDENTITY_CLAIMS_SETTING}).
+     */
+    readonly oidc: {
+        readonly settings: readonly [{
+            readonly key: "claims";
+            readonly label: 'Claims';
+            readonly type: 'text';
+            readonly maxLength: 512;
+            readonly required: false;
+            readonly helpText: 'The Claims your Policies read off an End user’s token, by name, separated by commas: `plan, role`. A Claim not named here is never read; one named and missing from a token is absent.';
+        }];
+        readonly actions: {};
+        readonly triggers: {};
+        readonly fieldKinds: {};
+        readonly recordTypes: {};
+    };
+    /**
+     * Clerk as an identity source (spec 4, REL-3881): its Connection, per Environment, holds the
+     * instance's publishable key — which encodes the Frontend API, and so the issuer — its secret key,
+     * its webhook signing secret and the origins its tokens may be minted for. Its one setting so far
+     * is the Claims the Project relies on, as `oidc`'s; its Triggers come with its users (spec 4, E3).
+     *
+     * Its Action, `updateUserMetadata` (REL-3893), merges `publicMetadata` into a Clerk user's public
+     * metadata with the Connection's secret key — the newsletter's `syncPlan` sets `{ plan: 'paid' }` —
+     * and a session token carries it once the customer adds the Claim to Clerk's session token
+     * (`"plan": "{{user.public_metadata.plan}}"`, the Clerk Extension's guide).
+     */
+    readonly clerk: {
+        readonly settings: readonly [{
+            readonly key: "claims";
+            readonly label: 'Claims';
+            readonly type: 'text';
+            readonly maxLength: 512;
+            readonly required: false;
+            readonly helpText: 'The Claims your Policies read off an End user’s token, by name, separated by commas: `plan, role`. A Claim not named here is never read; one named and missing from a token is absent.';
+        }];
+        readonly actions: {
+            readonly updateUserMetadata: {
+                readonly action: 'updateUserMetadata';
+                readonly step: {
+                    readonly input: readonly [{
+                        readonly key: 'userId';
+                        readonly type: 'text';
+                        readonly required: true;
+                        readonly description: 'The Clerk user’s id, `user_…`: a token’s `sub`.';
+                    }, {
+                        readonly key: 'publicMetadata';
+                        readonly type: 'json';
+                        readonly required: true;
+                        readonly description: 'An object merged into the user’s public metadata: each key given replaces theirs, a nested object is merged, and a key set to `null` is removed. Keys not given are kept.';
+                    }];
+                    readonly output: readonly [{
+                        readonly key: 'id';
+                        readonly type: 'text';
+                        readonly required: true;
+                        readonly description: 'The id of the user Clerk updated.';
+                    }];
+                    readonly sample: {
+                        readonly id: 'user_sample';
+                    };
+                    readonly idempotencyHeader: null;
+                };
+            };
+        };
+        readonly triggers: {};
+        /**
+         * Its one field kind (REL-3894): `clerk.userRef()`, a reference to `clerkUser` that the Studio
+         * picks by name or email rather than by pasting an id.
+         */
+        readonly fieldKinds: {
+            readonly userRef: {
+                readonly base: {
+                    readonly type: 'reference';
+                    readonly to: 'clerkUser';
+                };
+                readonly picker: {
+                    readonly search: readonly ["email", "firstName", "lastName"];
+                    readonly title: readonly ["firstName", "lastName"];
+                    readonly description: 'email';
+                    readonly image: 'imageUrl';
+                };
+            };
+        };
+        /** Its Managed user type (REL-3888): `clerk.user`, the Record kept for each Clerk user. */
+        readonly recordTypes: {
+            readonly user: 'clerkUser';
+        };
+    };
+};
+/** The Extensions a Project may declare, and what its code may name of each. */
+type ExtensionSurfaces = typeof EXTENSION_SURFACES;
+
 /**
  * Locale definition for multi-language support
  *
@@ -13798,6 +14921,7 @@ type FiltersByValue = OverEveryFieldKind<{
     counter: true;
     decimal: true;
     sequence: true;
+    owner: true;
     boolean: true;
     enum: true;
     date: true;
@@ -14115,6 +15239,8 @@ type FieldValueByType<C, S extends Context, K extends string, I extends string,
     decimal: number;
     /** The number RelyIO gave the Record, with its prefix: `ORD-12` (REL-3781). */
     sequence: string;
+    /** The End user the Record belongs to: their subject, as their token names them (REL-3883). */
+    owner: string;
     boolean: boolean;
     enum: EnumValue<C>;
     /** `YYYY-MM-DD`. */
@@ -14414,6 +15540,21 @@ type ReferenceTargetsIn<C> = C extends {
 } ? EachOf<T> : never;
 /** The types a Field points at: a reference's `to`, rich text's `links.to`. */
 type TargetsOf<F> = F extends unknown ? ReferenceTargetsIn<ConfigOf<F>> | LinkTargetsIn<ConfigOf<F>> : never;
+/**
+ * The Managed Record types a contributed field kind's base references (spec 4, REL-3894): `clerkUser`
+ * for `clerk.userRef()`. No `relyio/schema.ts` declares one — deploy adds it to the schema of a
+ * Project whose `relyio/extensions.ts` uses its Extension, and refuses a reference to it otherwise —
+ * so a Record type's reference may name it.
+ */
+type ContributedRecordType = {
+    readonly [S in keyof ExtensionSurfaces]: {
+        readonly [K in keyof ExtensionSurfaces[S]['fieldKinds']]: ExtensionSurfaces[S]['fieldKinds'][K] extends {
+            readonly base: {
+                readonly to: infer To extends string;
+            };
+        } ? To : never;
+    }[keyof ExtensionSurfaces[S]['fieldKinds']];
+}[keyof ExtensionSurfaces];
 /**
  * The keys a section of the schema declares, as names to check against: `string` where the type
  * cannot see them (a `Record<string, …>`), and none for the `Record<string, never>` `defineSchema`
@@ -14957,6 +16098,31 @@ interface KeyedContentTypeConfig<R extends KeyedMembers = KeyedMembers, TStage e
      * read returns it under, beside the fields: `rating: rollup.average('review', 'rating')`
      */
     rollups?: TRollups;
+    /**
+     * Gated content (spec 4, REL-3886): which entries the End users of your app, and anonymous
+     * visitors, read whole — `when`, a condition over `entry.*` and `claims.*` — and the fields every
+     * other one of them gets, `otherwise`, served with `_gated: true`. A secret key with no End user's
+     * token reads every entry whole. Left out, the type is not Gated.
+     *
+     * @example
+     * endUsers: {
+     *   read: {
+     *     when: or(conditionRoot('entry').audience.eq('everyone'), conditionRoot('claims').plan.eq('paid')),
+     *     otherwise: ['title', 'excerpt', 'author'],
+     *   },
+     * }
+     */
+    endUsers?: ContentTypeEndUsers<DisplayFieldOf<R>>;
+}
+/**
+ * A content type's End-user Policy (spec 4, REL-3886): its Gated read. `otherwise` names the type's
+ * own fields — never a Private one — and `when` tests shared, non-Private fields and Claims.
+ */
+interface ContentTypeEndUsers<TField extends string = string> {
+    readonly read?: {
+        readonly when: ConditionTree;
+        readonly otherwise: readonly TField[];
+    };
 }
 /**
  * Content type definition - preserves field types for inference
@@ -14982,6 +16148,8 @@ interface ContentTypeDefinition<TFields extends readonly FieldMember[] = readonl
     readonly rollups?: readonly StoredRollup[];
     /** The keyed rollups' types, which a read's values are inferred from. Types only: never written. */
     readonly __rollups?: TRollups;
+    /** Its Gated read (REL-3886), as deploy stores it */
+    readonly endUsers?: ContentTypeEndUsers;
 }
 /**
  * Define a content type with type-safe fields
@@ -15072,4 +16240,4 @@ type RollupsOf<T> = T extends {
     readonly __rollups?: infer R;
 } ? unknown extends R ? unknown : RollupValues<NonNullable<R>> : unknown;
 
-export { type WidgetOptions as $, type AIConfig as A, type BaseFieldConfig as B, type CodeConfig as C, type DeclaredFields as D, type EmailConfig as E, type FieldValues as F, type ReferenceConfig as G, type RequirementRule as H, type IntegerConfig as I, type JsonConfig as J, type KeyedMembers as K, type ListConfig as L, type RichTextConfig as M, type NeverUniqueFieldConfig as N, type ObjectConfig as O, type RichTextLinks as P, type RuleCondition as Q, type ReadOnlyRule as R, type RuleConditions as S, type SequenceConfig as T, type ShortTextConfig as U, type SlugConfig as V, type TableConfig as W, type TagsConfig as X, type UrlConfig as Y, type ValidationRule$1 as Z, type VisibilityRule as _, type KeyedMembersOf as a, type InferSingleton as a$, boolean as a0, code as a1, counter as a2, date as a3, dateTime as a4, decimal as a5, email as a6, enumField as a7, file as a8, integer as a9, type SingletonReading as aA, type UntypedReading as aB, defineLocale as aC, isLocaleDefinition as aD, getLocaleCodes as aE, findDefaultLocale as aF, getActiveLocales as aG, buildFallbackChain as aH, type TextDirection as aI, type LocaleOptions as aJ, type LocaleDefinition as aK, defineContentType as aL, fieldset as aM, type Fieldset as aN, type DeclaredFieldset as aO, type AnyDeclaredFieldset as aP, type KeyedFieldsetConfig as aQ, type FieldMember as aR, type KeyedContentTypeConfig as aS, type ContentTypeDefinition as aT, type EntryMetadata as aU, type InferContentType as aV, type LocalePublicationFields as aW, defineSingleton as aX, type KeyedSingletonConfig as aY, type SingletonContentTypeDefinition as aZ, type SingletonMetadata as a_, json as aa, list as ab, longText as ac, object as ad, reference as ae, richText as af, sequence as ag, shortText as ah, slug as ai, table as aj, tags as ak, url as al, type FieldSchemaContext as am, type FieldValue as an, type UnresolvedEntry as ao, type Keyed as ap, type BlockOf as aq, type ShapeValue as ar, type AssetReading as as, type CheckedIncludes as at, type CheckInclude as au, type ContentReading as av, type IncludablePaths as aw, type Reading as ax, type ReadWith as ay, type SettingsReading as az, type FileUpload as b, isFinalWorkflowStage as b$, defineSettingsGroup as b0, type KeyedSettingsGroupConfig as b1, type SettingsGroupDefinition as b2, type SettingsGroupMetadata as b3, type InferSettingsGroup as b4, defineAssetType as b5, type KeyedAssetTypeConfig as b6, type AssetTypeDefinition as b7, type InferAssetType as b8, type InferAssetEntry as b9, type RollupsOf as bA, defineRole as bB, isRoleDefinition as bC, isBuiltInRole as bD, getBuiltInRoleActions as bE, BUILT_IN_ROLES as bF, ROLE_ACTIONS as bG, BUILT_IN_ROLE_ACTIONS as bH, type BuiltInRole as bI, type RoleAction as bJ, type ResourcePermission as bK, type FieldVisibility as bL, type RoleConfig as bM, type RoleDefinition as bN, type KeyedRoleConfig as bO, type KeyedRoleDefinition as bP, type KeyedRoles as bQ, type KeyedRolesAsList as bR, defineWorkflow as bS, defineWorkflowStage as bT, defineContentTypeWorkflow as bU, isWorkflowDefinition as bV, isWorkflowStageDefinition as bW, getWorkflowStageIds as bX, findWorkflowStage as bY, getNextWorkflowStage as bZ, getFirstWorkflowStage as b_, type AssetServedBlocks as ba, type ImageKindConfig as bb, type VideoKindConfig as bc, type FileKindConfig as bd, type ImageTransform as be, type ImageFitMode as bf, type ImageOutputFormat as bg, type ImageUploadConfig as bh, type ImageSourceConfig as bi, type ImageExifConfig as bj, type VariantDefinition as bk, type VideoUploadConfig as bl, type VideoPosterConfig as bm, type VideoCaptionsConfig as bn, type VideoDownloadConfig as bo, type VideoWatermarkConfig as bp, type FileUploadConfig as bq, type FileScanConfig as br, rollup as bs, type KeyedRollups as bt, type RollupDefinition as bu, type RollupKind as bv, type RollupOptions as bw, type RollupValues as bx, type RollupWhereValue as by, type StoredRollup as bz, type AnyFieldDefinition as c, type WrittenSingleton as c$, type WorkflowEscalation as c0, type WorkflowAutoAssign as c1, type WorkflowStageConfig as c2, type WorkflowStageDefinition as c3, type WorkflowDefinition as c4, type ContentTypeWorkflowConfig as c5, type KeyedWorkflowConfig as c6, type KeyedWorkflowStageConfig as c7, type KeyedWorkflowStageDefinition as c8, type KeyedWorkflowStages as c9, type CheckedWorkflow as cA, type CheckedSection as cB, type KeysDeclared as cC, type LocaleCodesOf as cD, type StagesDeclared as cE, type paths as cF, type RetryConfig as cG, type MergedRelyIOConfig as cH, type ApiResponse as cI, SDKError as cJ, type RelyIOConfig as cK, type RelyIOConfigUpdate as cL, type LiveWebSocket as cM, type LiveWebSocketConstructor as cN, type AssetFileBlock as cO, type AssetUrls as cP, type BaseContent as cQ, type BaseSingleton as cR, type BaseSettingsGroup as cS, type WhereScalar as cT, type WhereFieldCondition as cU, type WhereClause as cV, type WhereOperator as cW, type DateOnlyOperator as cX, type CreateInput as cY, type CreatedContent as cZ, type RevisedContent as c_, defineView as ca, type ViewScopeConfig as cb, type ContentTypeScopeConfig as cc, type ContentTypesScopeConfig as cd, type EntryTypeScopeConfig as ce, type AllScopeConfig as cf, type ViewFilterOperator as cg, type ViewFilterValue as ch, type ViewFilterRelativeDate as ci, type ViewFilterCondition as cj, type ViewFilter as ck, type ViewConfig as cl, type ViewDefinition as cm, type KeyedViewConfig as cn, type KeyedViewDefinition as co, type KeyedViews as cp, type KeyedViewsAsList as cq, type InferJsonSchema as cr, type JsonFieldValue as cs, type JsonSchema as ct, type JsonValue as cu, type RecordFile as cv, type components as cw, type DisplayFieldOf as cx, type CheckedLocales as cy, type CheckedRoles as cz, type AnyKeyedField as d, type WrittenSettingsGroup as d0, type RestoredContent as d1, type ContentVersion as d2, type ContentVersionRow as d3, type UpdateInput as d4, type SingletonContent as d5, type CustomQuery as d6, type ContentTypeSchema as d7, type ValidationRule as d8, type FieldOptions as d9, type RealtimeEventType as da, type RealtimeEvent as db, type SubscriptionOptions as dc, type PerformanceMetrics as dd, type CacheConfig as de, type DebugConfig as df, type RequestConfig as dg, type CacheStrategy as dh, type LogLevel as di, type Environment as dj, type ValidationViolation as dk, BaseValidationError as dl, ValidationError as dm, InvalidPayloadError as dn, type ReadWhere as dp, type CheckedInclude as dq, type FieldDefinition as dr, type AssetAIConfig as e, type BooleanConfig as f, type CounterConfig as g, type DateConfig as h, type DateTimeConfig as i, type DecimalConfig as j, type EnumConfig as k, type FieldAIConfig as l, type FieldDefinition$1 as m, type FieldRule as n, type FieldType as o, type FieldUIConfig as p, type FileConfig as q, type KeyedEnumConfig as r, type KeyedField as s, type KeyedFieldOptions as t, type KeyedFields as u, type KeyedFieldsOf as v, type LocalizationConfig as w, type Localized as x, type LocalizedDetails as y, type LongTextConfig as z };
+export { boolean as $, type AIConfig as A, type BaseFieldConfig as B, type ConditionTree as C, type DateConfig as D, type EmailConfig as E, type FieldAIConfig as F, type RequirementRule as G, type RichTextConfig as H, type IntegerConfig as I, type JsonConfig as J, type KeyedEnumConfig as K, type ListConfig as L, type RichTextLinks as M, type NeverUniqueFieldConfig as N, type ObjectConfig as O, type RuleCondition as P, type RuleConditions as Q, type ReadOnlyRule as R, type SequenceConfig as S, type ShortTextConfig as T, type SlugConfig as U, type TableConfig as V, type TagsConfig as W, type UrlConfig as X, type ValidationRule$1 as Y, type VisibilityRule as Z, type WidgetOptions as _, type AnyFieldDefinition as a, type SettingsReading as a$, code as a0, counter as a1, date as a2, dateTime as a3, decimal as a4, email as a5, enumField as a6, file as a7, integer as a8, json as a9, type AssetTypeDefinition as aA, type InferContentType as aB, type KeyedRoles as aC, type KeyedViews as aD, type CheckedLocales as aE, type CheckedRoles as aF, type CheckedWorkflow as aG, type CheckedSection as aH, type KeysDeclared as aI, type ContributedRecordType as aJ, type LocaleCodesOf as aK, type StagesDeclared as aL, type KeyedRolesAsList as aM, type KeyedViewsAsList as aN, type FieldSchemaContext as aO, type FieldValue as aP, type UnresolvedEntry as aQ, type Keyed as aR, type BlockOf as aS, type ShapeValue as aT, type AssetReading as aU, type CheckedIncludes as aV, type CheckInclude as aW, type ContentReading as aX, type IncludablePaths as aY, type Reading as aZ, type ReadWith as a_, list as aa, longText as ab, object as ac, owner as ad, reference as ae, richText as af, sequence as ag, shortText as ah, slug as ai, table as aj, tags as ak, url as al, type FieldMember as am, type FieldValues as an, type DeclaredFields as ao, type components as ap, type RecordFile as aq, type FileUpload as ar, type DisplayFieldOf as as, type ContentTypeDefinition as at, type SingletonContentTypeDefinition as au, type SettingsGroupDefinition as av, type LocaleDefinition as aw, type RoleDefinition as ax, type WorkflowDefinition as ay, type ViewDefinition as az, type AnyKeyedField as b, BUILT_IN_ROLES as b$, type SingletonReading as b0, type UntypedReading as b1, defineLocale as b2, isLocaleDefinition as b3, getLocaleCodes as b4, findDefaultLocale as b5, getActiveLocales as b6, buildFallbackChain as b7, type TextDirection as b8, type LocaleOptions as b9, type ImageTransform as bA, type ImageFitMode as bB, type ImageOutputFormat as bC, type ImageUploadConfig as bD, type ImageSourceConfig as bE, type ImageExifConfig as bF, type VariantDefinition as bG, type VideoUploadConfig as bH, type VideoPosterConfig as bI, type VideoCaptionsConfig as bJ, type VideoDownloadConfig as bK, type VideoWatermarkConfig as bL, type FileUploadConfig as bM, type FileScanConfig as bN, rollup as bO, type KeyedRollups as bP, type RollupDefinition as bQ, type RollupKind as bR, type RollupOptions as bS, type RollupValues as bT, type RollupWhereValue as bU, type StoredRollup as bV, type RollupsOf as bW, defineRole as bX, isRoleDefinition as bY, isBuiltInRole as bZ, getBuiltInRoleActions as b_, defineContentType as ba, fieldset as bb, type Fieldset as bc, type DeclaredFieldset as bd, type AnyDeclaredFieldset as be, type KeyedFieldsetConfig as bf, type KeyedContentTypeConfig as bg, type ContentTypeEndUsers as bh, type EntryMetadata as bi, type LocalePublicationFields as bj, defineSingleton as bk, type KeyedSingletonConfig as bl, type SingletonMetadata as bm, type InferSingleton as bn, defineSettingsGroup as bo, type KeyedSettingsGroupConfig as bp, type SettingsGroupMetadata as bq, type InferSettingsGroup as br, defineAssetType as bs, type KeyedAssetTypeConfig as bt, type InferAssetType as bu, type InferAssetEntry as bv, type AssetServedBlocks as bw, type ImageKindConfig as bx, type VideoKindConfig as by, type FileKindConfig as bz, type AssetAIConfig as c, type ExtensionSettingField as c$, ROLE_ACTIONS as c0, BUILT_IN_ROLE_ACTIONS as c1, type BuiltInRole as c2, type RoleAction as c3, type ResourcePermission as c4, type FieldVisibility as c5, type RoleConfig as c6, type KeyedRoleConfig as c7, type KeyedRoleDefinition as c8, defineWorkflow as c9, type ViewFilterRelativeDate as cA, type ViewFilterCondition as cB, type ViewFilter as cC, type ViewConfig as cD, type KeyedViewConfig as cE, type KeyedViewDefinition as cF, type InferJsonSchema as cG, type JsonFieldValue as cH, type JsonSchema as cI, type JsonValue as cJ, and as cK, conditionRoot as cL, not as cM, or as cN, CONDITION_OPERATORS as cO, type ConditionArgument as cP, type ConditionOperator as cQ, type ConditionPath as cR, type ConditionScalar as cS, type ConditionTest as cT, type ConditionTests as cU, type OpenConditionChildren as cV, type paths as cW, type RetryConfig as cX, type MergedRelyIOConfig as cY, type ApiResponse as cZ, type ExtensionSurfaces as c_, defineWorkflowStage as ca, defineContentTypeWorkflow as cb, isWorkflowDefinition as cc, isWorkflowStageDefinition as cd, getWorkflowStageIds as ce, findWorkflowStage as cf, getNextWorkflowStage as cg, getFirstWorkflowStage as ch, isFinalWorkflowStage as ci, type WorkflowEscalation as cj, type WorkflowAutoAssign as ck, type WorkflowStageConfig as cl, type WorkflowStageDefinition as cm, type ContentTypeWorkflowConfig as cn, type KeyedWorkflowConfig as co, type KeyedWorkflowStageConfig as cp, type KeyedWorkflowStageDefinition as cq, type KeyedWorkflowStages as cr, defineView as cs, type ViewScopeConfig as ct, type ContentTypeScopeConfig as cu, type ContentTypesScopeConfig as cv, type EntryTypeScopeConfig as cw, type AllScopeConfig as cx, type ViewFilterOperator as cy, type ViewFilterValue as cz, type BooleanConfig as d, type ExtensionSurface as d0, type ActionField as d1, type ExtensionValueField as d2, SDKError as d3, type RelyIOConfig as d4, type RelyIOConfigUpdate as d5, type LiveWebSocket as d6, type LiveWebSocketConstructor as d7, type AssetFileBlock as d8, type AssetUrls as d9, type PerformanceMetrics as dA, type CacheConfig as dB, type DebugConfig as dC, type RequestConfig as dD, type CacheStrategy as dE, type LogLevel as dF, type Environment as dG, type ValidationViolation as dH, BaseValidationError as dI, ValidationError as dJ, InvalidPayloadError as dK, type ReadWhere as dL, type CheckedInclude as dM, type FieldDefinition as dN, type BaseContent as da, type BaseSingleton as db, type BaseSettingsGroup as dc, type WhereScalar as dd, type WhereFieldCondition as de, type WhereClause as df, type WhereOperator as dg, type DateOnlyOperator as dh, type CreateInput as di, type CreatedContent as dj, type RevisedContent as dk, type WrittenSingleton as dl, type WrittenSettingsGroup as dm, type RestoredContent as dn, type ContentVersion as dp, type ContentVersionRow as dq, type UpdateInput as dr, type SingletonContent as ds, type CustomQuery as dt, type ContentTypeSchema as du, type ValidationRule as dv, type FieldOptions as dw, type RealtimeEventType as dx, type RealtimeEvent as dy, type SubscriptionOptions as dz, type CodeConfig as e, type CounterConfig as f, type DateTimeConfig as g, type DecimalConfig as h, type EnumConfig as i, type FieldDefinition$1 as j, type FieldRule as k, type FieldType as l, type FieldUIConfig as m, type FileConfig as n, type KeyedField as o, type KeyedFieldOptions as p, type KeyedFields as q, type KeyedFieldsOf as r, type KeyedMembers as s, type KeyedMembersOf as t, type LocalizationConfig as u, type Localized as v, type LocalizedDetails as w, type LongTextConfig as x, type OwnerConfig as y, type ReferenceConfig as z };