lambder 1.0.127 → 1.0.129

package/OUTPUT_TYPE_ENFORCEMENT_SUMMARY.md

@@ -0,0 +1,90 @@
+# Output Type Enforcement - Implementation Summary
+
+## Problem
+The type system was only enforcing input types for `ctx.apiPayload`, but not enforcing that the output returned by `resolver.api()` matched the contract's output type.
+
+## Solution
+Made the following components generic to propagate type information:
+
+### 1. LambderResponseBuilder
+- Added generic parameter: `LambderResponseBuilder<TContract extends ApiContractShape = any>`
+- The `api()` method now uses the generic type for type checking
+
+### 2. LambderResolver
+- Added generic parameters: `LambderResolver<TContract extends ApiContractShape = any, TApiName extends keyof TContract & string = any>`
+- Overrides the `api()` method to enforce output type: `api(payload: ApiOutput<TContract, TApiName> | null, ...)`
+- The `die.api()` method also enforces the output type through the interface
+
+### 3. Lambder addApi/addSessionApi
+- Updated type signatures to pass `LambderResolver<TContract, TApiName>` to the action function
+- Now both methods enforce:
+  - ✅ Input type via `ctx.apiPayload: TContract[TApiName]['input']`
+  - ✅ Output type via `resolver.api(payload: TContract[TApiName]['output'] | null)`
+
+## Type Flow
+```
+Contract Definition
+    ↓
+Lambder<TContract>
+    ↓
+addApi<TApiName>(apiName, actionFn)
+    ↓
+actionFn(ctx: LambderRenderContext<Input>, resolver: LambderResolver<TContract, TApiName>)
+    ↓
+resolver.api(payload: Output | null)
+    ↓
+Type validation at compile time!
+```
+
+## What's Enforced Now
+
+### Input Types (already working)
+```typescript
+lambder.addApi('getUserById', async (ctx, resolver) => {
+    ctx.apiPayload.userId; // ✅ TypeScript knows this is string
+});
+```
+
+### Output Types (NEW!)
+```typescript
+lambder.addApi('getUserById', async (ctx, resolver) => {
+    const user = { id: "123", name: "John", age: 30 };
+    return resolver.api(user); // ✅ TypeScript validates user matches User type
+    
+    // return resolver.api("wrong"); // ❌ TypeScript error!
+});
+```
+
+## Features
+- ✅ Works with `resolver.api()`
+- ✅ Works with `resolver.die.api()`
+- ✅ Works with `addApi()`
+- ✅ Works with `addSessionApi()`
+- ✅ Supports nullable outputs (`output: User | null`)
+- ✅ Supports complex nested types
+- ✅ Supports arrays
+- ✅ Supports primitive types
+- ✅ Zero runtime overhead - all validation is at compile time
+- ✅ Backward compatible - untyped APIs still work
+
+## Files Changed
+1. `src/LambderResponseBuilder.ts` - Made generic, imported ApiContractShape
+2. `src/LambderResolver.ts` - Made generic, added typed `api()` override
+3. `src/Lambder.ts` - Updated addApi/addSessionApi type signatures
+4. `docs/TYPE_SAFE_QUICK_START.md` - Updated documentation with output type examples
+
+## Examples Created
+1. `examples/test-output-type-enforcement.ts` - Unit test for type enforcement
+2. `examples/output-type-enforcement-example.ts` - Comprehensive demonstration
+
+## Testing
+All existing examples and tests compile without errors:
+- ✅ `examples/simplified-typed-api-example.ts`
+- ✅ `tests/type-safety.test.ts`
+- ✅ No TypeScript compilation errors in project
+
+## Backward Compatibility
+The changes are fully backward compatible:
+- Untyped usage still works: `new Lambder({ ... })` without generic
+- Typed usage is opt-in: `new Lambder<MyContract>({ ... })`
+- Existing code continues to work unchanged

package/dist/Lambder.d.ts

@@ -66,10 +66,11 @@ export default class Lambder<TContract extends ApiContractShape = any> {
         apiVersion?: string;
     });
     enableCors(isCorsEnabled: boolean): void;
-    enableDdbSession({ tableName, tableRegion, sessionSalt }: {
+    enableDdbSession({ tableName, tableRegion, sessionSalt, enableSlidingExpiration }: {
         tableName: string;
         tableRegion: string;
         sessionSalt: string;
+        enableSlidingExpiration?: boolean;
     }, { partitionKey, sortKey }?: {
         partitionKey: string;
         sortKey: string;
@@ -88,17 +89,17 @@ export default class Lambder<TContract extends ApiContractShape = any> {
     addRoute(condition: Path | ConditionFunction | RegExp, actionFn: ActionFunction): void;
     addSessionRoute(condition: Path | ConditionFunction | RegExp, actionFn: ActionFunction): void;
     addApi(apiName: ConditionFunction | RegExp, actionFn: ActionFunction): void;
-    addApi<TApiName extends keyof TContract & string>(apiName: TApiName, actionFn: (ctx: LambderRenderContext<TContract[TApiName]['input']>, resolver: LambderResolver) => LambderResolverResponse | Promise<LambderResolverResponse>): void;
+    addApi<TApiName extends keyof TContract & string>(apiName: TApiName, actionFn: (ctx: LambderRenderContext<TContract[TApiName]['input']>, resolver: LambderResolver<TContract, TApiName>) => LambderResolverResponse | Promise<LambderResolverResponse>): void;
     addApi(apiName: string, actionFn: ActionFunction): void;
     addSessionApi(apiName: ConditionFunction | RegExp, actionFn: ActionFunction): void;
-    addSessionApi<TApiName extends keyof TContract & string>(apiName: TApiName, actionFn: (ctx: LambderRenderContext<TContract[TApiName]['input']>, resolver: LambderResolver) => LambderResolverResponse | Promise<LambderResolverResponse>): void;
+    addSessionApi<TApiName extends keyof TContract & string>(apiName: TApiName, actionFn: (ctx: LambderRenderContext<TContract[TApiName]['input']>, resolver: LambderResolver<TContract, TApiName>) => LambderResolverResponse | Promise<LambderResolverResponse>): void;
     addSessionApi(apiName: string, actionFn: ActionFunction): void;
     addHook(hookEvent: 'created', hookFn: HookCreatedFunction, priority?: number): Promise<void>;
     addHook(hookEvent: 'beforeRender', hookFn: HookBeforeRenderFunction, priority?: number): Promise<void>;
     addHook(hookEvent: 'afterRender', hookFn: HookAfterRenderFunction, priority?: number): Promise<void>;
     addHook(hookEvent: 'fallback', hookFn: HookFallbackFunction, priority?: number): Promise<void>;
     getSessionController(ctx: LambderRenderContext<any>): LambderSessionController;
-    getResponseBuilder(): LambderResponseBuilder;
+    getResponseBuilder(): LambderResponseBuilder<any>;
     private getResolver;
     render(event: APIGatewayProxyEvent, lambdaContext: Context): Promise<LambderResolverResponse>;
 }

package/dist/Lambder.js

@@ -75,9 +75,9 @@ export default class Lambder {
     enableCors(isCorsEnabled) {
         this.isCorsEnabled = isCorsEnabled;
     }
-    enableDdbSession({ tableName, tableRegion, sessionSalt }, { partitionKey, sortKey } = { partitionKey: "pk", sortKey: "sk" }) {
+    enableDdbSession({ tableName, tableRegion, sessionSalt, enableSlidingExpiration }, { partitionKey, sortKey } = { partitionKey: "pk", sortKey: "sk" }) {
         this.lambderSessionManager = new LambderSessionManager({
-            tableName, tableRegion, partitionKey, sortKey, sessionSalt
+            tableName, tableRegion, partitionKey, sortKey, sessionSalt, enableSlidingExpiration
         });
     }
     setSessionCookieKey(sessionTokenCookieKey, sessionCsrfCookieKey) {

package/dist/LambderResolver.d.ts

@@ -1,25 +1,26 @@
 import type { LambderRenderContext } from "./Lambder.js";
 import LambderResponseBuilder, { LambderResolverResponse } from "./LambderResponseBuilder.js";
 import LambderUtils from "./LambderUtils.js";
+import type { ApiContractShape, ApiOutput } from "./LambderApiContract.js";
 type MethodType<T, M extends keyof T> = T[M] extends (...args: any[]) => any ? T[M] : never;
-interface DieResolverMethods {
-    raw: MethodType<LambderResponseBuilder, 'raw'>;
-    json: MethodType<LambderResponseBuilder, 'json'>;
-    xml: MethodType<LambderResponseBuilder, 'xml'>;
-    html: MethodType<LambderResponseBuilder, 'html'>;
-    status301: MethodType<LambderResponseBuilder, 'status301'>;
-    status404: MethodType<LambderResponseBuilder, 'status404'>;
-    cors: MethodType<LambderResponseBuilder, 'cors'>;
-    fileBase64: MethodType<LambderResponseBuilder, 'fileBase64'>;
-    file: MethodType<LambderResponseBuilder, 'file'>;
-    ejsFile: MethodType<LambderResponseBuilder, 'ejsFile'>;
-    ejsTemplate: MethodType<LambderResponseBuilder, 'ejsTemplate'>;
-    api: MethodType<LambderResponseBuilder, 'api'>;
+interface DieResolverMethods<TContract extends ApiContractShape, TApiName extends keyof TContract & string> {
+    raw: MethodType<LambderResponseBuilder<TContract>, 'raw'>;
+    json: MethodType<LambderResponseBuilder<TContract>, 'json'>;
+    xml: MethodType<LambderResponseBuilder<TContract>, 'xml'>;
+    html: MethodType<LambderResponseBuilder<TContract>, 'html'>;
+    status301: MethodType<LambderResponseBuilder<TContract>, 'status301'>;
+    status404: MethodType<LambderResponseBuilder<TContract>, 'status404'>;
+    cors: MethodType<LambderResponseBuilder<TContract>, 'cors'>;
+    fileBase64: MethodType<LambderResponseBuilder<TContract>, 'fileBase64'>;
+    file: MethodType<LambderResponseBuilder<TContract>, 'file'>;
+    ejsFile: MethodType<LambderResponseBuilder<TContract>, 'ejsFile'>;
+    ejsTemplate: MethodType<LambderResponseBuilder<TContract>, 'ejsTemplate'>;
+    api: (payload: ApiOutput<TContract, TApiName> | null, config?: Parameters<LambderResponseBuilder<TContract>['api']>[1], headers?: Parameters<LambderResponseBuilder<TContract>['api']>[2]) => LambderResolverResponse;
 }
-export default class LambderResolver extends LambderResponseBuilder {
+export default class LambderResolver<TContract extends ApiContractShape = any, TApiName extends keyof TContract & string = any> extends LambderResponseBuilder<TContract> {
     resolve: (response: LambderResolverResponse) => void;
     reject: (err: Error) => void;
-    die: DieResolverMethods;
+    die: DieResolverMethods<TContract, TApiName>;
     constructor({ isCorsEnabled, publicPath, apiVersion, lambderUtils, ctx, resolve, reject }: {
         isCorsEnabled: boolean;
         publicPath: string;
@@ -29,6 +30,7 @@ export default class LambderResolver extends LambderResponseBuilder {
         resolve: (response: LambderResolverResponse) => void;
         reject: (err: Error) => void;
     });
+    api(payload: ApiOutput<TContract, TApiName> | null, config?: Parameters<LambderResponseBuilder<TContract>['api']>[1], headers?: Parameters<LambderResponseBuilder<TContract>['api']>[2]): LambderResolverResponse;
     private autoResolve;
     private autoResolvePromise;
 }

package/dist/LambderResolver.js

@@ -22,6 +22,10 @@ export default class LambderResolver extends LambderResponseBuilder {
             api: this.autoResolve(this.api),
         };
     }
+    // Override api method with proper typing
+    api(payload, config, headers) {
+        return super.api(payload, config, headers);
+    }
     autoResolve(method) {
         return (...args) => {
             const result = method.apply(this, args);

package/dist/LambderResponseBuilder.d.ts

@@ -1,5 +1,6 @@
 import LambderUtils from "./LambderUtils.js";
 import { LambderRenderContext } from "./Lambder.js";
+import type { ApiContractShape } from "./LambderApiContract.js";
 export type LambderResolverResponse = {
     statusCode: number;
     multiValueHeaders?: Record<string, string[]>;
@@ -17,7 +18,7 @@ export type LambderApiResponseConfig = {
 export type LambderApiResponse<T> = LambderApiResponseConfig & {
     payload?: T | null;
 };
-export default class LambderResponseBuilder {
+export default class LambderResponseBuilder<TContract extends ApiContractShape = any> {
     private isCorsEnabled;
     private publicPath;
     private apiVersion;

package/dist/LambderSessionController.d.ts

@@ -14,6 +14,7 @@ export default class LambderSessionController {
     });
     private areRequestSessionTokensValid;
     createSession(sessionKey: string, data?: any, ttlInSeconds?: number): Promise<LambderSessionContext>;
+    regenerateSession(): Promise<LambderSessionContext>;
     fetchSession(): Promise<LambderSessionContext>;
     fetchSessionIfExists(): Promise<LambderSessionContext | null>;
     isSessionValid(session: any): boolean;

package/dist/LambderSessionController.js

@@ -31,6 +31,16 @@ export default class LambderSessionController {
         return this.ctx.session;
     }
     ;
+    async regenerateSession() {
+        if (!this.ctx.session)
+            throw new Error("Session not found.");
+        const newSession = await this.lambderSessionManager.regenerateSession(this.ctx.session);
+        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=${newSession.sessionToken}; Expires=${new Date(newSession.expiresAt * 1000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
+        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionCsrfCookieKey}=${newSession.csrfToken}; Expires=${new Date(newSession.expiresAt * 1000).toUTCString()}; Path=/; SameSite=Lax; Secure` });
+        this.ctx.session = newSession;
+        return this.ctx.session;
+    }
+    ;
     async fetchSession() {
         if (!this.areRequestSessionTokensValid()) {
             throw new Error("Session tokens are invalid");

package/dist/LambderSessionManager.d.ts

@@ -6,6 +6,7 @@ export type LambderSessionContext = {
     data: any;
     createdAt: number;
     expiresAt: number;
+    lastAccessedAt: number;
     ttlInSeconds: number;
 };
 export default class LambderSessionManager {
@@ -14,14 +15,17 @@ export default class LambderSessionManager {
     private partitionKey;
     private sortKey;
     private ddbDocumentClient;
-    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, }: {
+    private enableSlidingExpiration;
+    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, enableSlidingExpiration, }: {
         tableName: string;
         tableRegion: string;
         partitionKey: string;
         sortKey: string;
         sessionSalt: string;
+        enableSlidingExpiration?: boolean;
     });
     private sessionUserKeyHasher;
+    private constantTimeCompare;
     private ddbGetItem;
     private ddbPutItem;
     private ddbDeleteItem;
@@ -33,4 +37,5 @@ export default class LambderSessionManager {
     isSessionValid(session: any, sessionToken: any, csrfToken: any, skipCsrfTokenCheck?: boolean): boolean;
     deleteSession(session: Record<string, any>): Promise<boolean>;
     deleteSessionAll(session: Record<string, any>): Promise<boolean>;
+    regenerateSession(session: LambderSessionContext): Promise<LambderSessionContext>;
 }

package/dist/LambderSessionManager.js

@@ -7,11 +7,13 @@ export default class LambderSessionManager {
     partitionKey;
     sortKey;
     ddbDocumentClient;
-    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, }) {
+    enableSlidingExpiration;
+    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, enableSlidingExpiration = true, }) {
         this.tableName = tableName;
         this.sessionSalt = sessionSalt;
         this.partitionKey = partitionKey;
         this.sortKey = sortKey;
+        this.enableSlidingExpiration = enableSlidingExpiration;
         const ddbClient = new DynamoDBClient({ region: tableRegion });
         this.ddbDocumentClient = DynamoDBDocumentClient.from(ddbClient);
     }
@@ -20,6 +22,13 @@ export default class LambderSessionManager {
             .update(`${password}${this.sessionSalt}`)
             .digest("hex");
     }
+    constantTimeCompare(a, b) {
+        if (a.length !== b.length)
+            return false;
+        const bufferA = Buffer.from(a, 'utf8');
+        const bufferB = Buffer.from(b, 'utf8');
+        return crypto.timingSafeEqual(new Uint8Array(bufferA), new Uint8Array(bufferB));
+    }
     async ddbGetItem(key) {
         const response = await this.ddbDocumentClient.send(new GetCommand({ TableName: this.tableName, Key: key, ConsistentRead: true }));
         if (response.Item)
@@ -67,15 +76,16 @@ export default class LambderSessionManager {
         const sessionKeyHash = this.sessionUserKeyHasher(sessionKey);
         const sessionSortKey = crypto.randomBytes(32).toString("hex");
         const sessionToken = `${sessionKeyHash}:${sessionSortKey}`;
-        const csrfToken = crypto.randomBytes(8).toString("hex");
+        const csrfToken = crypto.randomBytes(32).toString("hex");
         const createdAt = Math.floor(Date.now() / 1000);
+        const lastAccessedAt = createdAt;
         const expiresAt = Number(createdAt) + Number(ttlInSeconds);
         const session = {
             [this.partitionKey]: sessionKeyHash,
             [this.sortKey]: sessionSortKey,
             sessionToken, csrfToken,
             sessionKey, data,
-            createdAt, expiresAt, ttlInSeconds
+            createdAt, lastAccessedAt, expiresAt, ttlInSeconds
         };
         await this.ddbPutItem(session);
         return session;
@@ -84,6 +94,11 @@ export default class LambderSessionManager {
         if (!session)
             throw new Error("Invalid session");
         session.data = newData;
+        session.lastAccessedAt = Math.floor(Date.now() / 1000);
+        // Update expiration if sliding expiration is enabled
+        if (this.enableSlidingExpiration) {
+            session.expiresAt = session.lastAccessedAt + session.ttlInSeconds;
+        }
         await this.ddbPutItem(session);
         return session;
     }
@@ -96,18 +111,26 @@ export default class LambderSessionManager {
                 [this.partitionKey]: sessionKeyHash,
                 [this.sortKey]: sessionSortKey
             });
+            // Use constant error response to prevent timing attacks
             if (!session)
-                throw new Error("Session not found");
-            if (!session.sessionToken || session.sessionToken !== sessionToken)
-                throw new Error("Not found: session.sessionToken");
+                return null;
+            if (!session.sessionToken || !this.constantTimeCompare(session.sessionToken, sessionToken))
+                return null;
             if (!session.csrfToken)
-                throw new Error("Not found: session.csrfToken");
+                return null;
             if (!session.sessionKey)
-                throw new Error("Not found: session.sessionKey");
+                return null;
             if (!session.createdAt)
-                throw new Error("Not found: session.createdAt");
+                return null;
             if (!session.expiresAt || session.expiresAt < Date.now() / 1000)
-                throw new Error("Not found: session.expiresAt");
+                return null;
+            // Update last accessed time if sliding expiration is enabled
+            if (this.enableSlidingExpiration) {
+                session.lastAccessedAt = Math.floor(Date.now() / 1000);
+                session.expiresAt = session.lastAccessedAt + session.ttlInSeconds;
+                // Fire and forget - don't wait for the update
+                this.ddbPutItem(session).catch(() => { });
+            }
             return session;
         }
         catch (err) {
@@ -120,7 +143,7 @@ export default class LambderSessionManager {
             return false;
         if (!sessionToken || typeof sessionToken !== "string")
             return false;
-        if (session.sessionToken !== sessionToken)
+        if (!this.constantTimeCompare(session.sessionToken, sessionToken))
             return false;
         if (!session.csrfToken)
             return false;
@@ -133,7 +156,7 @@ export default class LambderSessionManager {
         if (!skipCsrfTokenCheck) {
             if (!csrfToken || typeof csrfToken !== "string")
                 return false;
-            if (session.csrfToken !== csrfToken)
+            if (!this.constantTimeCompare(session.csrfToken, csrfToken))
                 return false;
         }
         return true;
@@ -151,5 +174,13 @@ export default class LambderSessionManager {
         return true;
     }
     ;
+    async regenerateSession(session) {
+        if (!session)
+            throw new Error("Invalid session");
+        // Delete old session
+        await this.deleteSession(session);
+        // Create new session with same sessionKey and data but new tokens
+        return await this.createSession(session.sessionKey, session.data, session.ttlInSeconds);
+    }
 }
 ;

package/dist/index.d.ts

@@ -4,4 +4,4 @@ export { default as LambderCaller } from "./LambderCaller.js";
 export { default as LambderResponseBuilder } from "./LambderResponseBuilder.js";
 export { default as LambderResolver } from "./LambderResolver.js";
 export { default as LambderSessionManager } from "./LambderSessionManager.js";
-export { type ApiContract, type ApiInput, type ApiOutput, } from "./LambderApiContract.js";
+export { type ApiContractShape, type ApiContract, type ApiInput, type ApiOutput, } from "./LambderApiContract.js";

package/docs/DYNAMODB_SETUP.md

@@ -0,0 +1,96 @@
+# DynamoDB Session Table Setup Guide
+
+This guide helps you set up a DynamoDB table for Lambder session management with all security features enabled.
+
+## Table Creation
+
+### Using Terraform
+
+```hcl
+resource "aws_dynamodb_table" "lambder_sessions" {
+  name           = "lambder-sessions"
+  billing_mode   = "PAY_PER_REQUEST"
+  hash_key       = "pk"
+  range_key      = "sk"
+
+  attribute {
+    name = "pk"
+    type = "S"
+  }
+
+  attribute {
+    name = "sk"
+    type = "S"
+  }
+
+  ttl {
+    enabled        = true
+    attribute_name = "expiresAt"
+  }
+
+  tags = {
+    Purpose = "Session Management"
+  }
+}
+```
+
+## Enable Time to Live (TTL)
+
+TTL automatically removes expired sessions from DynamoDB, saving storage costs.
+
+### Using AWS Console
+
+1. Go to DynamoDB Console
+2. Select your table (`lambder-sessions`)
+3. Navigate to **Additional settings** tab
+4. Click **Edit** under **Time to Live (TTL)**
+5. Enable TTL
+6. Set **TTL attribute** to: `expiresAt`
+7. Save changes
+
+## IAM Permissions
+
+Your Lambda function needs these permissions:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "dynamodb:GetItem",
+        "dynamodb:PutItem",
+        "dynamodb:DeleteItem",
+        "dynamodb:Query"
+      ],
+      "Resource": [
+        "arn:aws:dynamodb:us-east-1:123456789012:table/lambder-sessions"
+      ]
+    }
+  ]
+}
+```
+
+## Session Data Structure
+
+Each session is stored as:
+
+```json
+{
+  "pk": "hash_of_user_id",
+  "sk": "random_64_char_hex",
+  "sessionToken": "hash_of_user_id:random_64_char_hex",
+  "csrfToken": "random_64_char_hex",
+  "sessionKey": "user_123",
+  "data": {
+    "userId": "user_123",
+    "username": "john_doe",
+    "role": "admin"
+  },
+  "createdAt": 1697712000,
+  "lastAccessedAt": 1697712300,
+  "expiresAt": 1700304000,
+  "ttlInSeconds": 2592000
+}
+```

package/docs/TYPE_SAFE_QUICK_START.md

@@ -26,11 +26,13 @@ const lambder = new Lambder<MyApiContract>({
     apiPath: '/api'
 });
 
-// Now addApi is type-safe!
+// Now addApi is type-safe for both inputs AND outputs!
 lambder.addApi('getUserById', async (ctx, resolver) => {
-    // ctx.apiPayload is automatically typed as { userId: string }
+    // ✅ ctx.apiPayload is automatically typed as { userId: string }
     const user = await db.getUser(ctx.apiPayload.userId);
-    return resolver.api(user);
+    
+    // ✅ resolver.api() enforces the output type (User)
+    return resolver.api(user); // TypeScript checks that user matches User type!
 });
 ```
 
@@ -55,7 +57,8 @@ const user = await caller.api('getUserById', { userId: '123' });
 - ✅ **No wrapper functions needed**
 - ✅ **Use existing `api()` and `addApi()` methods**
 - ✅ **Full autocomplete in IDE**
-- ✅ **Type-safe inputs and outputs**
+- ✅ **Type-safe inputs AND outputs**
+- ✅ **Compile-time validation**
 - ✅ **Backward compatible**
 
 ## Contract Type Format
@@ -94,6 +97,45 @@ login: {
 }
 ```
 
+## Output Type Enforcement
+
+The type system now enforces that `resolver.api()` returns data matching your contract's output type:
+
+```typescript
+type MyContract = ApiContract<{
+    getNumber: { input: void, output: number },
+    getUser: { input: { id: string }, output: User }
+}>;
+
+const lambder = new Lambder<MyContract>({ ... });
+
+// ✅ CORRECT
+lambder.addApi('getNumber', async (ctx, resolver) => {
+    return resolver.api(42); // number - matches output type
+});
+
+// ❌ ERROR: Type 'string' is not assignable to type 'number'
+lambder.addApi('getNumber', async (ctx, resolver) => {
+    return resolver.api("wrong"); // TypeScript error!
+});
+
+// ✅ CORRECT
+lambder.addApi('getUser', async (ctx, resolver) => {
+    return resolver.api({ id: "123", name: "John", ... }); // User object
+});
+
+// ❌ ERROR: Missing required properties
+lambder.addApi('getUser', async (ctx, resolver) => {
+    return resolver.api({ id: "123" }); // TypeScript error - incomplete User!
+});
+```
+
+This works with:
+- `resolver.api()` - typed return value
+- `resolver.die.api()` - typed return value
+- `addApi()` - typed for regular APIs
+- `addSessionApi()` - typed for session APIs
+
 ## Without Type Safety (Still Works!)
 
 Don't want type safety? Just don't pass the generic type:
@@ -118,6 +160,8 @@ See [simplified-typed-api-example.ts](../examples/simplified-typed-api-example.t
 
 - **Contract is just a TypeScript type** - No runtime code!
 - **Zero overhead** - All type checking happens at compile time
+- **Input AND output validation** - Both sides of your API are type-safe
+- **Compile-time safety** - Catch type mismatches before deployment
 - **Opt-in** - Use types when you want them
 - **Simple** - Just pass type to constructor
 - **Autocomplete** - IDE shows available APIs as you type