@relyio/sdk 0.18.0 → 0.20.0

package/dist/extensions/index.js

@@ -1,6 +1,6 @@
-import { extensionTrigger } from '../chunk-R6E4HE7R.js';
-import '../chunk-W7JFHSFM.js';
-import { EXTENSION_SURFACES } from '../chunk-EDE2H37D.js';
+import { extensionTrigger } from '../chunk-W2GRVXDG.js';
+import { keyedField } from '../chunk-PZCDJFMA.js';
+import { contributedFieldKindName, CONTRIBUTED_FIELD_KIND_OPTION, EXTENSION_SURFACES } from '../chunk-OUR7OUUZ.js';
 import { __name } from '../chunk-DI6KFDBO.js';
 
 /* RelyIO SDK - Built with ❤️ by the RelyIO Team */
@@ -8,6 +8,18 @@ import { __name } from '../chunk-DI6KFDBO.js';
 // src/extensions/index.ts
 var DECLARED = "declared";
 var SURFACES = EXTENSION_SURFACES;
+function fieldKindBuilder(slug, name, kind) {
+  return (options = {}) => {
+    const ui = options.ui;
+    const widget = typeof ui === "object" && ui !== null ? ui : {};
+    return keyedField("reference", {
+      ...options,
+      to: kind.base.to,
+      ui: { ...widget, [CONTRIBUTED_FIELD_KIND_OPTION]: contributedFieldKindName(slug, name) }
+    });
+  };
+}
+__name(fieldKindBuilder, "fieldKindBuilder");
 function handleOf(slug) {
   const surface = SURFACES[slug];
   if (surface === void 0) {
@@ -27,7 +39,15 @@ function handleOf(slug) {
         name,
         (options) => extensionTrigger(slug, trigger, options)
       ])
-    )
+    ),
+    ...Object.fromEntries(
+      Object.entries(surface.fieldKinds).map(([name, kind]) => [
+        name,
+        fieldKindBuilder(slug, name, kind)
+      ])
+    ),
+    // Its Managed Record types, by name: `clerk.user` is `'clerkUser'` (REL-3863)
+    ...surface.recordTypes
   };
 }
 __name(handleOf, "handleOf");

package/dist/functions/index.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
-var chunkZAMAR3X2_cjs = require('../chunk-ZAMAR3X2.cjs');
+var chunk5F3YYPLZ_cjs = require('../chunk-5F3YYPLZ.cjs');
+require('../chunk-UO2QRYKV.cjs');
 var chunkL6DXCKVQ_cjs = require('../chunk-L6DXCKVQ.cjs');
 
 /* RelyIO SDK - Built with ❤️ by the RelyIO Team */
@@ -30,8 +31,8 @@ function defineFunction(config) {
     runtime: config.runtime ?? "isolate",
     ...config.container === void 0 ? {} : { container: { size: config.container.size } },
     ...config.limits === void 0 ? {} : { limits: { ...config.limits } },
-    input: chunkZAMAR3X2_cjs.compileKeyedMembers(config.input ?? {}),
-    ...config.output === void 0 ? {} : { output: chunkZAMAR3X2_cjs.compileKeyedMembers(config.output) },
+    input: chunk5F3YYPLZ_cjs.compileKeyedMembers(config.input ?? {}),
+    ...config.output === void 0 ? {} : { output: chunk5F3YYPLZ_cjs.compileKeyedMembers(config.output) },
     records: { read: [...config.records?.read ?? []], write: [...config.records?.write ?? []] },
     content: config.content ?? "none",
     network: (config.network ?? []).map((host) => ({ ...host })),
@@ -43,6 +44,8 @@ function defineFunction(config) {
     ),
     // Absent when it declares none, so a Function declaring none hashes as it did before
     ...actions.length === 0 ? {} : { actions },
+    // Absent when undeclared, so a Function declaring none hashes as it did before
+    ...config.endUsers === void 0 ? {} : { endUsers: config.endUsers },
     ...config.route === void 0 ? {} : { route: config.route },
     ...config.tool === void 0 ? {} : { tool: { description: config.tool.description } },
     ...config.schedule === void 0 ? {} : { schedule: { ...config.schedule } }
@@ -57,7 +60,7 @@ chunkL6DXCKVQ_cjs.__name(isFunctionDefinition, "isFunctionDefinition");
 
 Object.defineProperty(exports, "fields", {
   enumerable: true,
-  get: function () { return chunkZAMAR3X2_cjs.fields; }
+  get: function () { return chunk5F3YYPLZ_cjs.fields; }
 });
 exports.defineFunction = defineFunction;
 exports.isActionRefused = isActionRefused;

package/dist/functions/index.d.cts

@@ -1,6 +1,4 @@
-export { f as FunctionActionHandle, e as FunctionActionReach, A as FunctionActionRefused, z as FunctionActions, t as FunctionBatchRefused, s as FunctionBatchResult, C as FunctionCapabilities, G as FunctionConfig, a as FunctionContainerSize, y as FunctionContent, o as FunctionCounterMove, l as FunctionDeclaration, H as FunctionDefinition, b as FunctionDuration, k as FunctionFieldDeclaration, n as FunctionFile, I as FunctionInputOf, d as FunctionNetworkHost, J as FunctionOutputOf, r as FunctionRecordBatch, p as FunctionRecordReader, m as FunctionRecordTypeName, q as FunctionRecordWriter, v as FunctionRecords, D as FunctionResponse, h as FunctionRoute, c as FunctionRouteMethod, x as FunctionRunInfo, F as FunctionRuntime, j as FunctionSchedule, g as FunctionSecretDeclaration, i as FunctionTool, w as FunctionWayIn, K as defineFunction, B as isActionRefused, u as isBatchRefused, L as isFunctionDefinition, E as respond } from '../automations/index.cjs';
-import '../register-BYCs0FpF.cjs';
-import '../define-schema-DZhtvLiK.cjs';
-import '../define-content-type-NEQDrvdq.cjs';
+export { b7 as FunctionActionHandle, b6 as FunctionActionReach, bv as FunctionActionRefused, bu as FunctionActions, bl as FunctionBatchRefused, bk as FunctionBatchResult, bx as FunctionCapabilities, bA as FunctionConfig, b2 as FunctionContainerSize, bt as FunctionContent, bg as FunctionCounterMove, bd as FunctionDeclaration, bB as FunctionDefinition, b3 as FunctionDuration, br as FunctionEndUser, bq as FunctionEndUserClaims, bp as FunctionEndUsers, bc as FunctionFieldDeclaration, F as FunctionFieldValues, bf as FunctionFile, bC as FunctionInputOf, b5 as FunctionNetworkHost, bD as FunctionOutputOf, bj as FunctionRecordBatch, bh as FunctionRecordReader, be as FunctionRecordTypeName, bi as FunctionRecordWriter, bn as FunctionRecords, by as FunctionResponse, b9 as FunctionRoute, b4 as FunctionRouteMethod, bs as FunctionRunInfo, b1 as FunctionRuntime, bb as FunctionSchedule, b8 as FunctionSecretDeclaration, ba as FunctionTool, bo as FunctionWayIn, bE as defineFunction, bw as isActionRefused, bm as isBatchRefused, bF as isFunctionDefinition, bz as respond } from '../index-DImzg3ew.cjs';
 export { fields } from '../schema/index.cjs';
+import '../define-content-type-C2HnCYYX.cjs';
 import '../rich-text.d-BWc-5gX1.cjs';

package/dist/functions/index.d.ts

@@ -1,6 +1,4 @@
-export { f as FunctionActionHandle, e as FunctionActionReach, A as FunctionActionRefused, z as FunctionActions, t as FunctionBatchRefused, s as FunctionBatchResult, C as FunctionCapabilities, G as FunctionConfig, a as FunctionContainerSize, y as FunctionContent, o as FunctionCounterMove, l as FunctionDeclaration, H as FunctionDefinition, b as FunctionDuration, k as FunctionFieldDeclaration, n as FunctionFile, I as FunctionInputOf, d as FunctionNetworkHost, J as FunctionOutputOf, r as FunctionRecordBatch, p as FunctionRecordReader, m as FunctionRecordTypeName, q as FunctionRecordWriter, v as FunctionRecords, D as FunctionResponse, h as FunctionRoute, c as FunctionRouteMethod, x as FunctionRunInfo, F as FunctionRuntime, j as FunctionSchedule, g as FunctionSecretDeclaration, i as FunctionTool, w as FunctionWayIn, K as defineFunction, B as isActionRefused, u as isBatchRefused, L as isFunctionDefinition, E as respond } from '../automations/index.js';
-import '../register-B53i97A9.js';
-import '../define-schema-Dlwh6l_J.js';
-import '../define-content-type-fb-WCD5e.js';
+export { b7 as FunctionActionHandle, b6 as FunctionActionReach, bv as FunctionActionRefused, bu as FunctionActions, bl as FunctionBatchRefused, bk as FunctionBatchResult, bx as FunctionCapabilities, bA as FunctionConfig, b2 as FunctionContainerSize, bt as FunctionContent, bg as FunctionCounterMove, bd as FunctionDeclaration, bB as FunctionDefinition, b3 as FunctionDuration, br as FunctionEndUser, bq as FunctionEndUserClaims, bp as FunctionEndUsers, bc as FunctionFieldDeclaration, F as FunctionFieldValues, bf as FunctionFile, bC as FunctionInputOf, b5 as FunctionNetworkHost, bD as FunctionOutputOf, bj as FunctionRecordBatch, bh as FunctionRecordReader, be as FunctionRecordTypeName, bi as FunctionRecordWriter, bn as FunctionRecords, by as FunctionResponse, b9 as FunctionRoute, b4 as FunctionRouteMethod, bs as FunctionRunInfo, b1 as FunctionRuntime, bb as FunctionSchedule, b8 as FunctionSecretDeclaration, ba as FunctionTool, bo as FunctionWayIn, bE as defineFunction, bw as isActionRefused, bm as isBatchRefused, bF as isFunctionDefinition, bz as respond } from '../index-D1fiaQlK.js';
 export { fields } from '../schema/index.js';
+import '../define-content-type-CVLUusfx.js';
 import '../rich-text.d-BWc-5gX1.js';

package/dist/functions/index.js

@@ -1,5 +1,6 @@
-import { compileKeyedMembers } from '../chunk-W7JFHSFM.js';
-export { fields } from '../chunk-W7JFHSFM.js';
+import { compileKeyedMembers } from '../chunk-PZCDJFMA.js';
+export { fields } from '../chunk-PZCDJFMA.js';
+import '../chunk-OUR7OUUZ.js';
 import { __name } from '../chunk-DI6KFDBO.js';
 
 /* RelyIO SDK - Built with ❤️ by the RelyIO Team */
@@ -42,6 +43,8 @@ function defineFunction(config) {
     ),
     // Absent when it declares none, so a Function declaring none hashes as it did before
     ...actions.length === 0 ? {} : { actions },
+    // Absent when undeclared, so a Function declaring none hashes as it did before
+    ...config.endUsers === void 0 ? {} : { endUsers: config.endUsers },
     ...config.route === void 0 ? {} : { route: config.route },
     ...config.tool === void 0 ? {} : { tool: { description: config.tool.description } },
     ...config.schedule === void 0 ? {} : { schedule: { ...config.schedule } }

package/dist/{index-DwHcL6x5.d.cts → index-BLVNMYUU.d.cts}

@@ -1,6 +1,6 @@
-import { e as ApiPath, f as ApiMethod, Q as QueryOf, W as Wire, H as HttpClient, A as AnySchemaDefinition, l as RecordsClient, B as BaseRecord, y as RecordBatchOperation, C as RecordBatchOptions, b as RecordBatchResult, R as RegisteredSchema } from './register-BYCs0FpF.cjs';
-import { aU as EntryMetadata, ax as Reading, cQ as BaseContent, at as CheckedIncludes, dp as ReadWhere, cV as WhereClause, cw as components, ay as ReadWith, d4 as UpdateInput, aB as UntypedReading, c_ as RevisedContent, cY as CreateInput, cZ as CreatedContent, d3 as ContentVersionRow, d2 as ContentVersion, d1 as RestoredContent, cJ as SDKError, dl as BaseValidationError, dk as ValidationViolation, ba as AssetServedBlocks, dq as CheckedInclude, cU as WhereFieldCondition, cO as AssetFileBlock, cR as BaseSingleton, c$ as WrittenSingleton, cS as BaseSettingsGroup, d0 as WrittenSettingsGroup, aV as InferContentType, av as ContentReading, a$ as InferSingleton, cF as paths, cK as RelyIOConfig, b8 as InferAssetType, as as AssetReading, aA as SingletonReading, b4 as InferSettingsGroup, az as SettingsReading, cL as RelyIOConfigUpdate, cH as MergedRelyIOConfig } from './define-content-type-NEQDrvdq.cjs';
-import { a as SchemaContentTypeNames, l as SchemaEntryOf, c as SchemaLocaleCodes, h as SchemaSingletonNames, v as AggregateBlock, _ as QueryParameterValue, F as FullTextSearch, i as SchemaQueryNames, Z as InferQueryParams, $ as AnyQueryParameters, S as SchemaRecordTypeNames, I as InferRecordType, R as RecordWriteFieldsOf, d as RecordUpdateFieldsOf, k as SchemaAssetTypeNames, j as SchemaSettingsGroupNames } from './define-schema-DZhtvLiK.cjs';
+import { b as ApiPath, c as ApiMethod, Q as QueryOf, W as Wire, H as HttpClient, F as FunctionFieldValues, R as Register, A as AnySchemaDefinition, h as RecordsClient, B as BaseRecord, v as RecordBatchOperation, x as RecordBatchOptions, y as RecordBatchResult, a as RegisteredSchema } from './index-DImzg3ew.cjs';
+import { bi as EntryMetadata, aZ as Reading, da as BaseContent, aV as CheckedIncludes, dL as ReadWhere, df as WhereClause, ap as components, a_ as ReadWith, dr as UpdateInput, b1 as UntypedReading, dk as RevisedContent, di as CreateInput, dj as CreatedContent, dq as ContentVersionRow, dp as ContentVersion, dn as RestoredContent, d3 as SDKError, dI as BaseValidationError, dH as ValidationViolation, bw as AssetServedBlocks, dM as CheckedInclude, de as WhereFieldCondition, d8 as AssetFileBlock, db as BaseSingleton, dl as WrittenSingleton, dc as BaseSettingsGroup, dm as WrittenSettingsGroup, s as KeyedMembers, aB as InferContentType, aX as ContentReading, bn as InferSingleton, cW as paths, d4 as RelyIOConfig, bu as InferAssetType, aU as AssetReading, b0 as SingletonReading, br as InferSettingsGroup, a$ as SettingsReading, d5 as RelyIOConfigUpdate, cY as MergedRelyIOConfig } from './define-content-type-C2HnCYYX.cjs';
+import { SchemaContentTypeNames, SchemaEntryOf, SchemaLocaleCodes, SchemaSingletonNames, AggregateBlock, QueryParameterValue, FullTextSearch, SchemaQueryNames, InferQueryParams, AnyQueryParameters, SchemaRecordTypeNames, InferRecordType, RecordWriteFieldsOf, RecordUpdateFieldsOf, SchemaAssetTypeNames, SchemaSettingsGroupNames } from './schema/index.cjs';
 import { DevUnreadableReason } from './dev-handshake/index.cjs';
 
 /**
@@ -65,70 +65,6 @@ type ActiveSandbox = Extract<SandboxState, {
     state: 'active';
 }>;
 
-/**
- * API4's two request headers, as the SDK's writes send them.
- *
- * `Idempotency-Key` is an option on every write whose route declares it (`idempotencyKey`), and the
- * SDK mints one when none is given. `If-Match` is never an option: a checked write builds it from
- * the entry it was read as (`versionCheckOf`), from the `_metadata` every read carries in its body
- * whether or not the edge cache served it (REL-2418). The SDK does not read the separate
- * `X-Entity-Tag` header, which the edge removes from what it stores; the API keeps sending it for
- * callers using plain HTTP (REL-2427). A batch operation carries its check in its own body, as
- * `ifMatch` (`batch/batch-operations.ts`, REL-2421).
- */
-interface RetryableWriteOptions {
-    /**
-     * A key that makes a retry of **this** write safe.
-     *
-     * A replay inside the service's window returns the original outcome rather
-     * than applying twice. The service derives that response from committed state
-     * pinned to the recorded version — it does not store bytes — so a replay after
-     * the version has been pruned is refused `RESOURCE_EXPIRED` rather than
-     * answered from a stale copy.
-     *
-     * **The SDK mints one when you do not.** It used to be caller-supplied and
-     * nothing else, which meant the default write carried no key while the retry
-     * loop replayed it anyway — the one mechanism that makes a replay safe was
-     * optional on the one path that needed it. Supply your own to make a key
-     * outlive the process: a job that may be restarted wants a key derived from
-     * the work, not one minted per call.
-     */
-    idempotencyKey?: string;
-}
-/**
- * An entry a read handed back, as much of it as a version check needs: its `_metadata`'s id, the
- * locale it was read in and the two counters it was read at (REL-2418).
- *
- * Every read carries these in its body, whether origin or the edge cache served it — the edge
- * removes only the separate `X-Entity-Tag` header from what it stores, so a check taken from that
- * header vanished after a cached read. A `Pick` of the document's `EntryMetadata`, so a counter the
- * API stops reporting stops compiling here.
- */
-interface ReadEntry {
-    readonly _metadata: Pick<EntryMetadata, 'id' | 'locale' | 'version' | 'sharedVersion'>;
-}
-/**
- * The version check a write takes from the entry it was read as: the entry's id, the locale it was
- * read in — which the write addresses, so a read negotiated from `Accept-Language` is written back
- * to that locale — and the `If-Match` tag over its two counters, spelled as the API mints it.
- */
-declare function versionCheckOf(entry: ReadEntry): {
-    id: string;
-    locale: string;
-    ifMatch: string;
-};
-
-/**
- * The client's locale as a sub-client holds it: a function it asks on every call, or a locale fixed
- * when it was built.
- *
- * `TypedRelyIOClient` hands every sub-client and builder a function over the configuration it holds,
- * so one taken before `updateConfig({ locale })` sends the locale the client holds when the call is
- * made, and none once `updateConfig({ locale: null })` has cleared it (REL-1453). A string is a locale
- * fixed at construction — a handle built directly, as the tests build one — and stays what it was.
- */
-type ClientLocale = string | (() => string | undefined);
-
 /**
  * Site-visitor live, declared once for everyone who speaks it (`live-layer-spec.md` decisions 15, 19
  * and 20; phase LV5): the wire a visitor's browser meets at `live.relyio.com`, and the two internal
@@ -229,6 +165,70 @@ type VisitorResyncReason = VisitorLedgerResyncReason | 'too-far-behind';
  */
 type VisitorRetry = 'stop' | 'retry' | 'back-off';
 
+/**
+ * API4's two request headers, as the SDK's writes send them.
+ *
+ * `Idempotency-Key` is an option on every write whose route declares it (`idempotencyKey`), and the
+ * SDK mints one when none is given. `If-Match` is never an option: a checked write builds it from
+ * the entry it was read as (`versionCheckOf`), from the `_metadata` every read carries in its body
+ * whether or not the edge cache served it (REL-2418). The SDK does not read the separate
+ * `X-Entity-Tag` header, which the edge removes from what it stores; the API keeps sending it for
+ * callers using plain HTTP (REL-2427). A batch operation carries its check in its own body, as
+ * `ifMatch` (`batch/batch-operations.ts`, REL-2421).
+ */
+interface RetryableWriteOptions {
+    /**
+     * A key that makes a retry of **this** write safe.
+     *
+     * A replay inside the service's window returns the original outcome rather
+     * than applying twice. The service derives that response from committed state
+     * pinned to the recorded version — it does not store bytes — so a replay after
+     * the version has been pruned is refused `RESOURCE_EXPIRED` rather than
+     * answered from a stale copy.
+     *
+     * **The SDK mints one when you do not.** It used to be caller-supplied and
+     * nothing else, which meant the default write carried no key while the retry
+     * loop replayed it anyway — the one mechanism that makes a replay safe was
+     * optional on the one path that needed it. Supply your own to make a key
+     * outlive the process: a job that may be restarted wants a key derived from
+     * the work, not one minted per call.
+     */
+    idempotencyKey?: string;
+}
+/**
+ * An entry a read handed back, as much of it as a version check needs: its `_metadata`'s id, the
+ * locale it was read in and the two counters it was read at (REL-2418).
+ *
+ * Every read carries these in its body, whether origin or the edge cache served it — the edge
+ * removes only the separate `X-Entity-Tag` header from what it stores, so a check taken from that
+ * header vanished after a cached read. A `Pick` of the document's `EntryMetadata`, so a counter the
+ * API stops reporting stops compiling here.
+ */
+interface ReadEntry {
+    readonly _metadata: Pick<EntryMetadata, 'id' | 'locale' | 'version' | 'sharedVersion'>;
+}
+/**
+ * The version check a write takes from the entry it was read as: the entry's id, the locale it was
+ * read in — which the write addresses, so a read negotiated from `Accept-Language` is written back
+ * to that locale — and the `If-Match` tag over its two counters, spelled as the API mints it.
+ */
+declare function versionCheckOf(entry: ReadEntry): {
+    id: string;
+    locale: string;
+    ifMatch: string;
+};
+
+/**
+ * The client's locale as a sub-client holds it: a function it asks on every call, or a locale fixed
+ * when it was built.
+ *
+ * `TypedRelyIOClient` hands every sub-client and builder a function over the configuration it holds,
+ * so one taken before `updateConfig({ locale })` sends the locale the client holds when the call is
+ * made, and none once `updateConfig({ locale: null })` has cleared it (REL-1453). A string is a locale
+ * fixed at construction — a handle built directly, as the tests build one — and stays what it was.
+ */
+type ClientLocale = string | (() => string | undefined);
+
 /**
  * Two read terms every read that takes them writes the same way: the children an entry embeds,
  * and the refusal of a condition on `_metadata`. Here once, for the list and entry reads
@@ -803,7 +803,7 @@ declare class FileValidationError extends BaseValidationError {
 }
 /** Constraints `validateFile` checks a file against (subset of the schema upload gate). */
 interface FileValidationConstraints {
-    /** Allowed MIME types (exact match). */
+    /** Allowed MIME types: exact (`image/png`) or a wildcard pattern (`image/*`), as a schema declares them. */
     allowedMimeTypes?: string[];
     /** Max size in bytes. */
     maxSizeBytes?: number;
@@ -1479,9 +1479,11 @@ declare class SettingsClient<T = BaseSettingsGroup, R extends Reading = UntypedR
  * runs the Function `checkout` that the key's Branch runs, on the key's Dataset, and answers its
  * output.
  *
- * Call it from your server with a secret key: a publishable key is refused
- * (`PublishableKeyRefusedError`), and a read-only key runs only a Function whose reach writes
- * nothing (`ReadOnlyKeyError`). A run whose code threw or was ended at a limit throws
+ * Call it from your server with a secret key. A publishable key calls only a Function declaring
+ * `endUsers` (spec 4, REL-3892) — with a signed-in End user's token (`getToken`) when it says
+ * `'required'` — and is refused any other (`PublishableKeyRefusedError`); a read-only secret key
+ * runs only a Function whose reach writes nothing (`ReadOnlyKeyError`). A call carrying an End
+ * user's token hands the run `run.endUser`, whatever the key. A run whose code threw or was ended at a limit throws
  * `FunctionRunFailedError`, and one that outlived the service's five-minute wait
  * `FunctionRunTimedOutError` — each naming the run (`runId`), whose record and console output Manage
  * serves. A call is never retried: a Function may write, and a second call would be a second run.
@@ -1502,15 +1504,56 @@ interface FunctionCallOptions {
      */
     idempotencyKey?: string;
 }
-/** One Function, called: its input, as its input Fields declare it, and its output. */
+/** One Function, called, before `Register` names the project's Functions: any input, any answer. */
 type FunctionCall = (input?: Record<string, unknown>, options?: FunctionCallOptions) => Promise<unknown>;
 /**
- * `relyio.functions`: every Function the key's Branch runs, by name. A name the Branch does not run
- * is refused by the service (`ResourceNotFoundError`), not here.
+ * One Function's input and output Fields, as the generated `schema.ts` registers them (REL-4059): the
+ * keyed record its file declares under `input`, and under `output` when it declares one.
  */
-type FunctionsAccessor = {
+interface RegisteredFunctionFields {
+    readonly input: KeyedMembers;
+    readonly output?: KeyedMembers;
+}
+/** What a registered Function's call answers: its output's values, or what its run returned when it declares none. */
+type OutputOf<F extends RegisteredFunctionFields> = F extends {
+    readonly output: infer O extends KeyedMembers;
+} ? FunctionFieldValues<O> : unknown;
+/**
+ * What a registered Function's call takes: its input Fields' values. A Function declaring no input
+ * field takes none — `{}` would take any key, since an empty object type has no excess-property check.
+ */
+type InputOf<F extends RegisteredFunctionFields> = [keyof FunctionFieldValues<F['input']>] extends [
+    never
+] ? {
+    readonly [field: string]: never;
+} : FunctionFieldValues<F['input']>;
+/**
+ * One registered Function, called: its input as its input Fields declare them — required when a
+ * field of it is, so a missing, misnamed or mistyped field is a type error — and its output.
+ */
+type TypedFunctionCall<F extends RegisteredFunctionFields> = {} extends InputOf<F> ? (input?: InputOf<F>, options?: FunctionCallOptions) => Promise<OutputOf<F>> : (input: InputOf<F>, options?: FunctionCallOptions) => Promise<OutputOf<F>>;
+/**
+ * `relyio.functions` over a project's Functions: exactly those registered, each typed by its Fields,
+ * or any name before `relyio generate-types` registered any. Generic on purpose, as
+ * `FunctionRecordTypeName` is: written over `Register` directly, the conditional can be resolved
+ * before the program's augmentation is in view.
+ */
+type FunctionsAccessorOf<R> = R extends {
+    readonly functions: infer F extends {
+        readonly [name: string]: RegisteredFunctionFields;
+    };
+} ? {
+    readonly [N in keyof F]: TypedFunctionCall<F[N]>;
+} : {
     readonly [name: string]: FunctionCall;
 };
+/**
+ * `relyio.functions`: every Function the key's Branch runs, by name. Once `relyio generate-types`
+ * has registered the project's Functions (`Register`'s `functions`), only those names are on it and
+ * each call is typed by its input and output Fields; before, any name, untyped. A name the Branch
+ * does not run is refused by the service (`ResourceNotFoundError`), not here.
+ */
+type FunctionsAccessor = FunctionsAccessorOf<Register>;
 
 /**
  * What the search family's routes answer, read from the committed document, and what a search over
@@ -2430,11 +2473,19 @@ interface DeployedContentType {
 }
 /**
  * The defaults `client.with()` gives the client it makes (REL-2417, Q9): the locale and the dataset
- * its reads and writes are in unless a call names its own. A locale is one the schema declares.
+ * its reads and writes are in unless a call names its own, and the End user's token function its
+ * requests ask in place of the parent's (REL-3882). A locale is one the schema declares.
  */
 interface ClientDefaults<TSchema extends AnySchemaDefinition | undefined = undefined> {
     readonly locale?: LocaleCodeOf<TSchema>;
     readonly dataset?: string;
+    /**
+     * The signed-in End user's token, asked for on every request this client sends — and every
+     * request of a client `with()` makes from it that names none — in place of the parent's
+     * `getToken`. `@relyio/react`'s provider hands it Clerk's `useAuth().getToken`. See
+     * `RelyIOConfig.getToken`.
+     */
+    readonly getToken?: () => Promise<string | null>;
 }
 /** The locale codes a client's reads may name: the schema's, or any where no schema types it. */
 type LocaleCodeOf<TSchema extends AnySchemaDefinition | undefined> = TSchema extends AnySchemaDefinition ? SchemaLocaleCodes<TSchema> : string;
@@ -2509,7 +2560,10 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * `createClient()` made, which reads its own.
      */
     private parent;
-    /** What `with()` gave this client over its parent's: the locale and dataset it names, and no other. */
+    /**
+     * What `with()` gave this client over its parent's: the locale, dataset and End user's token
+     * function it names, and no other.
+     */
     private defaults;
     /** The live edge's poll client id: chosen once, when first needed, and kept for this client's life. */
     private _liveClientId;
@@ -2565,7 +2619,9 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * all or none (REL-3774).
      *
      * A Record is an app's data, written by your server with a secret key and live the moment it
-     * lands; a publishable key is refused on every Record route (`PUBLISHABLE_KEY_REFUSED`).
+     * lands. A publishable key reads the Records a Record type's read Policy grants it (spec 4,
+     * REL-3883), and writes them only for the End user whose token it carries, as the type's write
+     * Policy allows (REL-3884); with no token it writes nothing (`PUBLISHABLE_KEY_REFUSED`).
      *
      * @example
      * ```typescript
@@ -2585,9 +2641,13 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * `FunctionRunFailedError` and one past five minutes `FunctionRunTimedOutError`, each naming the
      * run. Never retried: a Function may write.
      *
+     * Once `relyio generate-types` has run, its `schema.ts` registers each Function's input and output
+     * Fields (REL-4059): only the project's Functions are named here, and each call takes and answers
+     * what its Fields declare, so a misnamed or mistyped input field is a type error.
+     *
      * @example
      * ```typescript
-     * const { orderId } = (await relyio.functions.checkout({ cartId })) as { orderId: string }
+     * const { orderId } = await relyio.functions.checkout({ cartId })
      * ```
      */
     readonly functions: FunctionsAccessor;
@@ -2935,6 +2995,9 @@ declare class TypedRelyIOClient<TSchema extends AnySchemaDefinition | undefined
      * const { data } = await staging.content('post').list({ limit: 10 })
      *
      * const french = relyio.with({ locale: 'fr-FR' }) // ← autocompletes the schema's locales
+     *
+     * // Every request this one sends carries the signed-in End user's token (REL-3882)
+     * const visitor = relyio.with({ getToken: () => session.getToken() })
      * ```
      */
     with(defaults: ClientDefaults<TSchema>): TypedRelyIOClient<TSchema>;

package/dist/{index-C4LqrNd1.d.ts → index-BY1xU93u.d.ts}

@@ -1,5 +1,5 @@
 import { k as RichTextHeading, b as RichTextValue, y as RichTextTable, h as RichTextCodeGroup, e as RichTextBlock, l as RichTextInline, t as RichTextNode, w as RichTextSpan, r as RichTextMark, A as AnyRichTextEntryLink, c as RichTextShapeValue } from './rich-text.d-BWc-5gX1.js';
-import { cQ as BaseContent } from './define-content-type-fb-WCD5e.js';
+import { da as BaseContent } from './define-content-type-CVLUusfx.js';
 
 /**
  * The DOM↔field binding contract, as the one pure helper that emits it.

package/dist/{index-Dnmt_UOo.d.cts → index-Cmup6HJY.d.cts}

@@ -1,5 +1,5 @@
 import { k as RichTextHeading, b as RichTextValue, y as RichTextTable, h as RichTextCodeGroup, e as RichTextBlock, l as RichTextInline, t as RichTextNode, w as RichTextSpan, r as RichTextMark, A as AnyRichTextEntryLink, c as RichTextShapeValue } from './rich-text.d-BWc-5gX1.cjs';
-import { cQ as BaseContent } from './define-content-type-NEQDrvdq.cjs';
+import { da as BaseContent } from './define-content-type-C2HnCYYX.cjs';
 
 /**
  * The DOM↔field binding contract, as the one pure helper that emits it.