@relyio/sdk 0.18.0 → 0.20.0

package/dist/{chunk-ZHTJ7GXH.js → chunk-L42C4G2S.js}

@@ -1,7 +1,7 @@
 import { isBrowser } from './chunk-NJQK5STK.js';
-import { parseDevEnv, DEV_CONTEXT_DIR, DEV_CONTEXT_FILENAME, parseDevContextFile } from './chunk-W2A4OTCI.js';
+import { parseDevEnv, DEV_CONTEXT_DIR, DEV_CONTEXT_FILENAME, parseDevContextFile } from './chunk-EQUZNVAR.js';
 import { UNKNOWN_PREVIEW_RECHECK_MS, previewAtRequest } from './chunk-HDHBYYEY.js';
-import { VISITOR_CLOSE_CODES, HEADER_RETRY_AFTER, HEADER_IDEMPOTENCY_KEY, entityTag, HEADER_IF_MATCH, FRESH_PARAMETER, VISITOR_KEEPALIVE, parseVisitorFrame, VISITOR_FRAMES, VISITOR_POLL_INTERVAL_MS, VISITOR_CLOSE_RETRY, readVisitorPollAnswer, VISITOR_POLL_RETRY, VISITOR_LIVE_PATH, VISITOR_QUERY, previewDatasetSlug } from './chunk-EDE2H37D.js';
+import { HEADER_END_USER, VISITOR_CLOSE_CODES, HEADER_RETRY_AFTER, END_USER_TOKEN_REFUSAL_REASONS, HEADER_IDEMPOTENCY_KEY, entityTag, HEADER_IF_MATCH, FRESH_PARAMETER, VISITOR_KEEPALIVE, parseVisitorFrame, VISITOR_FRAMES, VISITOR_POLL_INTERVAL_MS, VISITOR_CLOSE_RETRY, readVisitorPollAnswer, VISITOR_POLL_RETRY, VISITOR_LIVE_PATH, VISITOR_QUERY, previewDatasetSlug } from './chunk-OUR7OUUZ.js';
 import { __name, __publicField } from './chunk-DI6KFDBO.js';
 
 /* RelyIO SDK - Built with ❤️ by the RelyIO Team */
@@ -169,13 +169,13 @@ var _ReadOnlyKeyError = class _ReadOnlyKeyError extends SDKError {
 __name(_ReadOnlyKeyError, "ReadOnlyKeyError");
 var ReadOnlyKeyError = _ReadOnlyKeyError;
 var _PublishableKeyRefusedError = class _PublishableKeyRefusedError extends SDKError {
-  constructor(message = "A publishable key cannot read or write Records or run Functions", context) {
+  constructor(message = "A publishable key writes a Record only for a signed-in End user", context) {
     super(message, 403, void 0, context);
     __publicField(this, "code", "PUBLISHABLE_KEY_REFUSED");
     __publicField(this, "retryable", false);
   }
   getUserMessage() {
-    return "A publishable key cannot reach Records or Functions. Call them from your server with a secret key.";
+    return "A publishable key writes a Record only with a signed-in End user's token, and runs only a Function declaring endUsers. Send the End user's token, declare endUsers on the Function, or call it from your server with a secret key.";
   }
 };
 __name(_PublishableKeyRefusedError, "PublishableKeyRefusedError");
@@ -392,6 +392,19 @@ var _InvalidApiKeyError = class _InvalidApiKeyError extends SDKError {
 };
 __name(_InvalidApiKeyError, "InvalidApiKeyError");
 var InvalidApiKeyError = _InvalidApiKeyError;
+var _EndUserTokenInvalidError = class _EndUserTokenInvalidError extends SDKError {
+  constructor(message, reason, context) {
+    super(message, 401, void 0, context);
+    this.reason = reason;
+    __publicField(this, "code", "END_USER_TOKEN_INVALID");
+    __publicField(this, "retryable", false);
+  }
+  getUserMessage() {
+    return "Your session is not valid. Please sign in again.";
+  }
+};
+__name(_EndUserTokenInvalidError, "EndUserTokenInvalidError");
+var EndUserTokenInvalidError = _EndUserTokenInvalidError;
 
 // src/errors/network-errors.ts
 var _NetworkError = class _NetworkError extends SDKError {
@@ -593,6 +606,9 @@ var _ErrorMapper = class _ErrorMapper {
       case "INVALID_API_KEY": {
         return new InvalidApiKeyError(message, void 0, context);
       }
+      case "END_USER_TOKEN_INVALID": {
+        return new EndUserTokenInvalidError(message, endUserTokenReasonOf(refusal), context);
+      }
       case "ACCESS_DENIED": {
         return new AuthorizationError(message, 403, void 0, context);
       }
@@ -800,6 +816,15 @@ function violationsOf(refusal) {
   }));
 }
 __name(violationsOf, "violationsOf");
+function endUserTokenReasonOf(refusal) {
+  const reason = detailString(refusal, "reason");
+  return isEndUserTokenReason(reason) ? reason : void 0;
+}
+__name(endUserTokenReasonOf, "endUserTokenReasonOf");
+function isEndUserTokenReason(value) {
+  return value !== void 0 && END_USER_TOKEN_REFUSAL_REASONS.includes(value);
+}
+__name(isEndUserTokenReason, "isEndUserTokenReason");
 
 // src/http/api-routes.ts
 function fillPath(template, params) {
@@ -1172,22 +1197,33 @@ var _HttpClient = class _HttpClient {
    * constructor accepts one so that a module-scope client can be evaluated by a
    * build that holds no key (REL-1120) — and so does one whose `setApiKey` was
    * given none.
+   *
+   * The End user's token is asked for once, after the key is known to be there and before the first
+   * attempt — of `getToken`, the nearest view's function, or the configuration's — so every retry
+   * of one call sends the token its first attempt sent. See `RelyIOConfig.getToken`.
    */
-  async request(config) {
+  async request(config, getToken) {
     if (this.view !== void 0) {
-      return this.view.client.request({
-        ...config,
-        headers: layerHeaders(this.view.headers, config.headers)
-      });
+      return this.view.client.request(
+        { ...config, headers: layerHeaders(this.view.headers, config.headers) },
+        getToken ?? this.view.getToken
+      );
     }
     if (config.timeout !== void 0) assertRequestTimeout(config.timeout);
     const mergedConfig = this.mergeRequestConfig(config);
-    if (presentKey(headerValue(mergedConfig.headers, API_KEY_HEADER)) === void 0) {
+    if (presentCredential(headerValue(mergedConfig.headers, API_KEY_HEADER)) === void 0) {
       throw new MissingApiKeyError(
         "`apiKey` is missing: this client holds no API key, so the request was not sent. Pass `apiKey` to createClient \u2014 the documented setup reads it from RELYIO_API_KEY.",
         { url: mergedConfig.url, method: mergedConfig.method, sent: false }
       );
     }
+    const tokenSource = getToken ?? this.connection.config.getToken;
+    if (tokenSource !== void 0) {
+      const token = presentCredential(await tokenSource());
+      mergedConfig.headers = layerHeaders(mergedConfig.headers ?? {}, {
+        [END_USER_HEADER]: token ?? null
+      });
+    }
     this.log("debug", "Making request", {
       method: mergedConfig.method,
       url: mergedConfig.url
@@ -1231,7 +1267,7 @@ var _HttpClient = class _HttpClient {
         });
         if (preview !== void 0 && answersUnknownDataset(sdkError, preview)) {
           rememberUnknownPreview(preview);
-          return this.request(config);
+          return this.request(config, getToken);
         }
         this.log("error", "Request failed after all retries", {
           error: sdkError.toJSON(),
@@ -1452,10 +1488,17 @@ var _ControlledHttpClient = class _ControlledHttpClient extends HttpClient {
    * retries and `fetch` are this client's as they are when each request is sent, so a later
    * `configure()` or `setApiKey()` on this client reaches the view, and one on the view reaches
    * this client. `client.with({ dataset })` is one (REL-2417).
+   *
+   * `options.getToken` is the End user's token function the view asks in place of this client's,
+   * and of any view it is made from: `client.with({ getToken })` (REL-3882).
    */
-  withHeaders(headers) {
+  withHeaders(headers, options = {}) {
     const view = new _ControlledHttpClient(this.connection.config);
-    view.view = { client: this, headers: { ...headers } };
+    view.view = {
+      client: this,
+      headers: { ...headers },
+      ...options.getToken === void 0 ? {} : { getToken: options.getToken }
+    };
     return view;
   }
   /**
@@ -1477,7 +1520,7 @@ var _ControlledHttpClient = class _ControlledHttpClient extends HttpClient {
    * Replace the key every later request sends as `X-API-Key`, and the `apiKey` the configuration
    * reports.
    *
-   * The key is read the way construction reads it (`presentKey`): an absent, empty or blank key is
+   * The key is read the way construction reads it (`presentCredential`): an absent, empty or blank key is
    * no key, so the header is dropped and the next request is refused with `MissingApiKeyError`
    * before anything is sent. A key header of any other spelling — one given in `headers` — goes
    * too, from the headers sent and from the headers the configuration reports, so the old key is
@@ -1498,7 +1541,7 @@ var _ControlledHttpClient = class _ControlledHttpClient extends HttpClient {
     this.connection = {
       ...this.connection,
       defaultHeaders: layerHeaders(this.connection.defaultHeaders, {
-        [API_KEY_HEADER]: presentKey(apiKey) ?? null
+        [API_KEY_HEADER]: presentCredential(apiKey) ?? null
       })
     };
   }
@@ -1507,6 +1550,7 @@ __name(_ControlledHttpClient, "ControlledHttpClient");
 var ControlledHttpClient = _ControlledHttpClient;
 var API_KEY_HEADER = "X-API-Key";
 var DATASET_HEADER = "X-RelyIO-Dataset";
+var END_USER_HEADER = HEADER_END_USER.name;
 function derivedPreviewIn(headers) {
   const dataset = headerValue(headers, DATASET_HEADER);
   return dataset !== void 0 && isDerivedPreview(dataset) ? dataset : void 0;
@@ -1525,7 +1569,7 @@ function connectionFor(config) {
   const defaultHeaders = layerHeaders(
     layerHeaders({ "Content-Type": "application/json" }, config.headers),
     {
-      [API_KEY_HEADER]: presentKey(config.apiKey),
+      [API_KEY_HEADER]: presentCredential(config.apiKey),
       [DATASET_HEADER]: config.dataset,
       // Only outside a browser, which controls this header. "A browser" is the core's one
       // definition, `isBrowser()` — every environment question in this file asks it.
@@ -1557,10 +1601,10 @@ function layerHeaders(base, over) {
   return layered;
 }
 __name(layerHeaders, "layerHeaders");
-function presentKey(value) {
+function presentCredential(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
-__name(presentKey, "presentKey");
+__name(presentCredential, "presentCredential");
 function credentialsModeFor(includeCredentials) {
   return includeCredentials ? "include" : "same-origin";
 }
@@ -1972,6 +2016,18 @@ var _ContentClient = class _ContentClient extends EntryHandle {
 __name(_ContentClient, "ContentClient");
 var ContentClient = _ContentClient;
 
+// src/errors/mime-matches.ts
+function mimeMatches(fileType, pattern) {
+  const actual = (fileType.split(";")[0] ?? "").trim().toLowerCase();
+  const allowed = (pattern.split(";")[0] ?? "").trim().toLowerCase();
+  if (allowed === "*" || allowed === "*/*") return true;
+  if (allowed === actual) return true;
+  const [allowedType, allowedSubtype] = allowed.split("/");
+  const [actualType] = actual.split("/");
+  return allowedSubtype === "*" && allowedType === actualType;
+}
+__name(mimeMatches, "mimeMatches");
+
 // src/errors/file-errors.ts
 var _FileUploadError = class _FileUploadError extends SDKError {
   constructor(code, message, options = {}) {
@@ -2002,12 +2058,13 @@ var FileValidationError = _FileValidationError;
 function validateFile(file, constraints = {}) {
   const violations = [];
   const { allowedMimeTypes, maxSizeBytes } = constraints;
-  if (allowedMimeTypes && allowedMimeTypes.length > 0 && file.type != null && file.type !== "" && !allowedMimeTypes.includes(file.type)) {
+  const { type } = file;
+  if (allowedMimeTypes && allowedMimeTypes.length > 0 && type != null && type !== "" && !allowedMimeTypes.some((pattern) => mimeMatches(type, pattern))) {
     violations.push({
       field: "file",
       code: "UNSUPPORTED_MIME",
-      message: `Unsupported file type "${file.type}". Allowed: ${allowedMimeTypes.join(", ")}`,
-      value: file.type
+      message: `Unsupported file type "${type}". Allowed: ${allowedMimeTypes.join(", ")}`,
+      value: type
     });
   }
   if (typeof maxSizeBytes === "number" && maxSizeBytes > 0 && typeof file.size === "number" && file.size > maxSizeBytes) {
@@ -2876,7 +2933,8 @@ var _RecordsClient = class _RecordsClient {
    * Store a Record, live the moment it lands. Values that break the Record type's fields are
    * refused with `ValidationError` naming each field, and nothing is stored. Values a unique set of
    * the type claims, held by another Record, are refused with `ResourceConflictError` — its
-   * `blockage` is `{ kind: 'value-taken', facts: { fields, recordId } }` (REL-3782).
+   * `blockage` is `{ kind: 'value-taken', facts: { fields, recordId } }` (REL-3782) — with no
+   * `recordId` for an End user's write, whose read Policy may hide the holder (REL-3863).
    */
   async create(fields, options = {}) {
     return this.httpClient.fetchPayload(
@@ -4117,6 +4175,9 @@ function validateConfig(config) {
   if (config.webSocket != null && typeof config.webSocket !== "function") {
     throw new Error("webSocket must be a WebSocket class");
   }
+  if (config.getToken != null && typeof config.getToken !== "function") {
+    throw new Error("getToken must be a function that answers the End user\u2019s token, or null");
+  }
   if (config.timeout != null) assertRequestTimeout(config.timeout);
   if (config.retryAttempts != null && !(Number.isInteger(config.retryAttempts) && config.retryAttempts >= 1)) {
     throw new Error(
@@ -4245,7 +4306,10 @@ var _TypedRelyIOClient = class _TypedRelyIOClient {
      * `createClient()` made, which reads its own.
      */
     __publicField(this, "parent");
-    /** What `with()` gave this client over its parent's: the locale and dataset it names, and no other. */
+    /**
+     * What `with()` gave this client over its parent's: the locale, dataset and End user's token
+     * function it names, and no other.
+     */
     __publicField(this, "defaults", {});
     /** The live edge's poll client id: chosen once, when first needed, and kept for this client's life. */
     __publicField(this, "_liveClientId");
@@ -4256,7 +4320,9 @@ var _TypedRelyIOClient = class _TypedRelyIOClient {
      * all or none (REL-3774).
      *
      * A Record is an app's data, written by your server with a secret key and live the moment it
-     * lands; a publishable key is refused on every Record route (`PUBLISHABLE_KEY_REFUSED`).
+     * lands. A publishable key reads the Records a Record type's read Policy grants it (spec 4,
+     * REL-3883), and writes them only for the End user whose token it carries, as the type's write
+     * Policy allows (REL-3884); with no token it writes nothing (`PUBLISHABLE_KEY_REFUSED`).
      *
      * @example
      * ```typescript
@@ -4284,9 +4350,13 @@ var _TypedRelyIOClient = class _TypedRelyIOClient {
      * `FunctionRunFailedError` and one past five minutes `FunctionRunTimedOutError`, each naming the
      * run. Never retried: a Function may write.
      *
+     * Once `relyio generate-types` has run, its `schema.ts` registers each Function's input and output
+     * Fields (REL-4059): only the project's Functions are named here, and each call takes and answers
+     * what its Fields declare, so a misnamed or mistyped input field is a type error.
+     *
      * @example
      * ```typescript
-     * const { orderId } = (await relyio.functions.checkout({ cartId })) as { orderId: string }
+     * const { orderId } = await relyio.functions.checkout({ cartId })
      * ```
      */
     // Read when called, never when made: `with()` and `updateConfig()` move `httpClient`
@@ -4740,6 +4810,9 @@ var _TypedRelyIOClient = class _TypedRelyIOClient {
    * const { data } = await staging.content('post').list({ limit: 10 })
    *
    * const french = relyio.with({ locale: 'fr-FR' }) // ← autocompletes the schema's locales
+   *
+   * // Every request this one sends carries the signed-in End user's token (REL-3882)
+   * const visitor = relyio.with({ getToken: () => session.getToken() })
    * ```
    */
   with(defaults) {
@@ -4753,14 +4826,16 @@ var _TypedRelyIOClient = class _TypedRelyIOClient {
   }
   /** Make this client one `with()` made from `parent`: see {@link with}. */
   follow(parent, defaults) {
-    const { locale, dataset } = defaults;
+    const { locale, dataset, getToken } = defaults;
     this.parent = parent;
     this.defaults = {
       ...locale === void 0 ? {} : { locale },
-      ...dataset === void 0 ? {} : { dataset }
+      ...dataset === void 0 ? {} : { dataset },
+      ...getToken === void 0 ? {} : { getToken }
     };
     this.httpClient = parent.httpClient.withHeaders(
-      dataset === void 0 ? {} : { [DATASET_HEADER]: dataset }
+      dataset === void 0 ? {} : { [DATASET_HEADER]: dataset },
+      getToken === void 0 ? {} : { getToken }
     );
   }
   /**
@@ -4811,6 +4886,6 @@ function randomClientId() {
 }
 __name(randomClientId, "randomClientId");
 
-export { AssetClient, AssetFileBuilder, AssetUploadBuilder, AuthorizationError, BaseValidationError, ChangesExpiredError, ConnectionError, ContentClient, DefaultRetryPolicy, ErrorMapper, FileUploadError, FileValidationError, FunctionContainersBusyError, FunctionRunFailedError, FunctionRunTimedOutError, HttpClient, InvalidApiKeyError, InvalidPayloadError, LIVE_KEEPALIVE_INTERVAL_MS, LIVE_SOCKET_OPEN_TIMEOUT_MS, LiveEdgeError, MethodNotAllowedError, MissingApiKeyError, NetworkError, PREVIEW_KEY_PREFIX, PUBLISHABLE_KEY_PREFIX, PayloadTooLargeError, PlanFeatureUnavailableError, PublishableKeyRefusedError, RateLimitError, ReadOnlyKeyError, RecordsClient, ResourceConflictError, ResourceExpiredError, ResourceNotFoundError, SDKError, ServerError, ServiceIndeterminateError, SettingsClient, SingletonClient, TimeoutError, TransactionRolledBackError, TypedRelyIOClient, UnknownContractError, UsageQuotaExceededError, ValidationError, createClient, isAborted, isAssetEntry, isMissingEntry, isPreviewKey, isPublishableKey, isReplaySafe, isResourceNotFound, matchRoute, refusedOperationOf, retryPolicyFor, serviceInstructedDelayMs, sleep, validateFile, versionCheckOf };
-//# sourceMappingURL=chunk-ZHTJ7GXH.js.map
-//# sourceMappingURL=chunk-ZHTJ7GXH.js.map
+export { AssetClient, AssetFileBuilder, AssetUploadBuilder, AuthorizationError, BaseValidationError, ChangesExpiredError, ConnectionError, ContentClient, DefaultRetryPolicy, EndUserTokenInvalidError, ErrorMapper, FileUploadError, FileValidationError, FunctionContainersBusyError, FunctionRunFailedError, FunctionRunTimedOutError, HttpClient, InvalidApiKeyError, InvalidPayloadError, LIVE_KEEPALIVE_INTERVAL_MS, LIVE_SOCKET_OPEN_TIMEOUT_MS, LiveEdgeError, MethodNotAllowedError, MissingApiKeyError, NetworkError, PREVIEW_KEY_PREFIX, PUBLISHABLE_KEY_PREFIX, PayloadTooLargeError, PlanFeatureUnavailableError, PublishableKeyRefusedError, RateLimitError, ReadOnlyKeyError, RecordsClient, ResourceConflictError, ResourceExpiredError, ResourceNotFoundError, SDKError, ServerError, ServiceIndeterminateError, SettingsClient, SingletonClient, TimeoutError, TransactionRolledBackError, TypedRelyIOClient, UnknownContractError, UsageQuotaExceededError, ValidationError, createClient, isAborted, isAssetEntry, isMissingEntry, isPreviewKey, isPublishableKey, isReplaySafe, isResourceNotFound, matchRoute, refusedOperationOf, retryPolicyFor, serviceInstructedDelayMs, sleep, validateFile, versionCheckOf };
+//# sourceMappingURL=chunk-L42C4G2S.js.map
+//# sourceMappingURL=chunk-L42C4G2S.js.map

package/dist/{chunk-EDE2H37D.js → chunk-OUR7OUUZ.js}

@@ -51,6 +51,26 @@ function refuseMismatchedAlternate(route, stream) {
 }
 __name(refuseMismatchedAlternate, "refuseMismatchedAlternate");
 
+// ../../platform/api-contract/dist/chunk-4KRF3DVJ.js
+var HEADER_END_USER = {
+  name: "X-RelyIO-End-User",
+  in: "request",
+  required: false
+};
+var END_USER_TOKEN_REFUSAL_REASONS = [
+  "missing",
+  "no-identity-source",
+  "malformed",
+  "unsupported-algorithm",
+  "wrong-issuer",
+  "unknown-key",
+  "bad-signature",
+  "wrong-audience",
+  "expired",
+  "not-yet-valid",
+  "missing-subject"
+];
+
 // ../../platform/api-contract/dist/index.js
 var HEADER_RETRY_AFTER = { name: "Retry-After" };
 var HEADER_IF_MATCH = {
@@ -398,6 +418,26 @@ var STRIPE_EVENT_FIELDS = [
   { path: "data.object.object", type: "string", required: true },
   { path: "data.object.metadata", type: "object", required: false, values: "string" }
 ];
+var STRIPE_SUBSCRIPTION_FIELDS = [
+  ...STRIPE_EVENT_FIELDS,
+  { path: "data.object.status", type: "string", required: true },
+  { path: "data.object.customer", type: "string", required: true },
+  { path: "data.object.cancel_at_period_end", type: "boolean", required: false },
+  { path: "data.object.cancel_at", type: "number", required: false },
+  { path: "data.object.canceled_at", type: "number", required: false },
+  { path: "data.object.ended_at", type: "number", required: false },
+  { path: "data.object.start_date", type: "number", required: false },
+  { path: "data.object.trial_end", type: "number", required: false }
+];
+var IDENTITY_CLAIMS_SETTING = "claims";
+var IDENTITY_CLAIMS_SETTING_FIELD = {
+  key: IDENTITY_CLAIMS_SETTING,
+  label: "Claims",
+  type: "text",
+  maxLength: 512,
+  required: false,
+  helpText: "The Claims your Policies read off an End user\u2019s token, by name, separated by commas: `plan, role`. A Claim not named here is never read; one named and missing from a token is absent."
+};
 var EXTENSION_SURFACES = {
   webhook: {
     settings: [],
@@ -447,7 +487,9 @@ var EXTENSION_SURFACES = {
         }
       }
     },
-    triggers: {}
+    triggers: {},
+    fieldKinds: {},
+    recordTypes: {}
   },
   vercel: {
     settings: [],
@@ -466,7 +508,9 @@ var EXTENSION_SURFACES = {
           { path: "payload.target", type: "string", required: false }
         ]
       }
-    }
+    },
+    fieldKinds: {},
+    recordTypes: {}
   },
   netlify: {
     settings: [],
@@ -486,11 +530,14 @@ var EXTENSION_SURFACES = {
           { path: "deploy_ssl_url", type: "string", required: false }
         ]
       }
-    }
+    },
+    fieldKinds: {},
+    recordTypes: {}
   },
-  // Triggers only in slice one (spec 3, REL-3853): Stripe tells RelyIO a payment succeeded, failed, a
-  // Checkout completed or a charge was refunded. No Action: checkout keeps calling Stripe from a
-  // Function with its own Secret (spec 2).
+  // Triggers only (spec 3, REL-3853): Stripe tells RelyIO a payment succeeded, failed, a Checkout
+  // completed or a charge was refunded — and, since spec 4 (REL-3893), that a subscription was
+  // created, changed or ended. No Action: checkout keeps calling Stripe from a Function with its own
+  // Secret (spec 2).
   stripe: {
     settings: [],
     actions: {},
@@ -544,8 +591,26 @@ var EXTENSION_SURFACES = {
           { path: "data.object.refunded", type: "boolean", required: true },
           { path: "data.object.payment_intent", type: "string", required: false }
         ]
+      },
+      customerSubscriptionCreated: {
+        trigger: "customer.subscription.created",
+        payload: STRIPE_SUBSCRIPTION_FIELDS
+      },
+      customerSubscriptionUpdated: {
+        trigger: "customer.subscription.updated",
+        payload: [
+          ...STRIPE_SUBSCRIPTION_FIELDS,
+          // The status it had before this change, when the change was to its status
+          { path: "data.previous_attributes.status", type: "string", required: false }
+        ]
+      },
+      customerSubscriptionDeleted: {
+        trigger: "customer.subscription.deleted",
+        payload: STRIPE_SUBSCRIPTION_FIELDS
       }
-    }
+    },
+    fieldKinds: {},
+    recordTypes: {}
   },
   slack: {
     settings: [
@@ -609,7 +674,9 @@ var EXTENSION_SURFACES = {
         }
       }
     },
-    triggers: {}
+    triggers: {},
+    fieldKinds: {},
+    recordTypes: {}
   },
   // Resend (spec 3, REL-3854): an email, its Files attached. The sender is the step's, else the
   // Project's `from`; `html` or `text` is the body, at least one of them.
@@ -677,10 +744,105 @@ var EXTENSION_SURFACES = {
         }
       }
     },
-    triggers: {}
+    triggers: {},
+    fieldKinds: {},
+    recordTypes: {}
+  },
+  /**
+   * The plain OIDC identity source (spec 4, REL-3880): any issuer that publishes a discovery
+   * document — Auth0, Supabase Auth, an own one. Its Connection, per Environment, holds the issuer
+   * and the audience; it has no Action and no Trigger. Its one setting is the Claims the Project
+   * relies on ({@link IDENTITY_CLAIMS_SETTING}).
+   */
+  oidc: {
+    settings: [IDENTITY_CLAIMS_SETTING_FIELD],
+    actions: {},
+    triggers: {},
+    fieldKinds: {},
+    recordTypes: {}
+  },
+  /**
+   * Clerk as an identity source (spec 4, REL-3881): its Connection, per Environment, holds the
+   * instance's publishable key — which encodes the Frontend API, and so the issuer — its secret key,
+   * its webhook signing secret and the origins its tokens may be minted for. Its one setting so far
+   * is the Claims the Project relies on, as `oidc`'s; its Triggers come with its users (spec 4, E3).
+   *
+   * Its Action, `updateUserMetadata` (REL-3893), merges `publicMetadata` into a Clerk user's public
+   * metadata with the Connection's secret key — the newsletter's `syncPlan` sets `{ plan: 'paid' }` —
+   * and a session token carries it once the customer adds the Claim to Clerk's session token
+   * (`"plan": "{{user.public_metadata.plan}}"`, the Clerk Extension's guide).
+   */
+  clerk: {
+    settings: [IDENTITY_CLAIMS_SETTING_FIELD],
+    actions: {
+      updateUserMetadata: {
+        action: "updateUserMetadata",
+        step: {
+          input: [
+            {
+              key: "userId",
+              type: "text",
+              required: true,
+              description: "The Clerk user\u2019s id, `user_\u2026`: a token\u2019s `sub`."
+            },
+            {
+              key: "publicMetadata",
+              type: "json",
+              required: true,
+              description: "An object merged into the user\u2019s public metadata: each key given replaces theirs, a nested object is merged, and a key set to `null` is removed. Keys not given are kept."
+            }
+          ],
+          output: [
+            {
+              key: "id",
+              type: "text",
+              required: true,
+              description: "The id of the user Clerk updated."
+            }
+          ],
+          sample: { id: "user_sample" },
+          // Clerk's Backend API keys nothing to dedupe a request on: an update that succeeded is never
+          // sent again, and one whose outcome is unknown is not either.
+          idempotencyHeader: null
+        }
+      }
+    },
+    triggers: {},
+    /**
+     * Its one field kind (REL-3894): `clerk.userRef()`, a reference to `clerkUser` that the Studio
+     * picks by name or email rather than by pasting an id.
+     */
+    fieldKinds: {
+      userRef: {
+        base: { type: "reference", to: "clerkUser" },
+        picker: {
+          search: ["email", "firstName", "lastName"],
+          title: ["firstName", "lastName"],
+          description: "email",
+          image: "imageUrl"
+        }
+      }
+    },
+    /** Its Managed user type (REL-3888): `clerk.user`, the Record kept for each Clerk user. */
+    recordTypes: { user: "clerkUser" }
   }
 };
+var CONTRIBUTED_FIELD_KIND_OPTION = "fieldKind";
+function contributedFieldKindName(extension, kind) {
+  return `${extension}.${kind}`;
+}
+__name(contributedFieldKindName, "contributedFieldKindName");
+var EXTENSION_BACKFILL_REFUSALS = [
+  "connection-gone",
+  "connection-inactive",
+  "connection-unreadable",
+  "vendor-refused",
+  "vendor-unavailable",
+  "vendor-answer-unreadable",
+  "extension-not-backfilled"
+];
+new Set(EXTENSION_BACKFILL_REFUSALS);
 
-export { EXTENSION_SURFACES, FRESH_PARAMETER, HEADER_IDEMPOTENCY_KEY, HEADER_IF_MATCH, HEADER_RETRY_AFTER, PREVIEW_DATASET_PREFIX, VISITOR_ADMISSION_RETRY_AFTER_SECONDS, VISITOR_CLOSE_CODES, VISITOR_CLOSE_RETRY, VISITOR_FRAMES, VISITOR_KEEPALIVE, VISITOR_LIVE_PATH, VISITOR_POLL_INTERVAL_MS, VISITOR_POLL_RETRY, VISITOR_QUERY, entityTag, parseVisitorFrame, previewDatasetSlug, readVisitorPollAnswer };
-//# sourceMappingURL=chunk-EDE2H37D.js.map
-//# sourceMappingURL=chunk-EDE2H37D.js.map
+export { CONTRIBUTED_FIELD_KIND_OPTION, END_USER_TOKEN_REFUSAL_REASONS, EXTENSION_SURFACES, FRESH_PARAMETER, HEADER_END_USER, HEADER_IDEMPOTENCY_KEY, HEADER_IF_MATCH, HEADER_RETRY_AFTER, PREVIEW_DATASET_PREFIX, VISITOR_ADMISSION_RETRY_AFTER_SECONDS, VISITOR_CLOSE_CODES, VISITOR_CLOSE_RETRY, VISITOR_FRAMES, VISITOR_KEEPALIVE, VISITOR_LIVE_PATH, VISITOR_POLL_INTERVAL_MS, VISITOR_POLL_RETRY, VISITOR_QUERY, contributedFieldKindName, entityTag, parseVisitorFrame, previewDatasetSlug, readVisitorPollAnswer };
+//# sourceMappingURL=chunk-OUR7OUUZ.js.map
+//# sourceMappingURL=chunk-OUR7OUUZ.js.map