lambder 10.0.1 → 10.1.1

package/CHANGELOG.md

@@ -9,6 +9,37 @@ sit on its first published patch, and later patches list only what they changed.
 Releases up to 3.2.6 carry git tags; the ones after it were published without
 one, so versions are not cross-linked to tag comparisons here.
 
+## [10.1.1] - 2026-09-28
+
+A minor for an app made of parts. Each part can declare its own guards and
+rate-limit policies beside the APIs that use them, and the instance composes
+the maps at creation.
+
+### Added
+
+- **`guards` and `rateLimits.policies` take a list of maps** as well as one
+  map. The instance declares every name in the list, so an API names a guard
+  or a policy from any map as it would from the only one, and
+  `apiSignatures()` and `apiOptionEntries()` read the merged map. A name two
+  maps declare is a compile error on the list, whose message names it, and a
+  throw at creation, where a spread would have let one replace the other
+  without a word. Every map of a list is held to the same surplus-key and
+  refusal-code checks as a lone map. The mock runtime's `create()` still
+  takes one map of each.
+
+## [10.0.2] - 2026-09-28
+
+### Fixed
+
+- **A guard an init's `guard()` builds inside a map held to `LambderApiGuard`**
+  (`{ ... } satisfies Record<string, LambderApiGuard<any, any, any>>`, the
+  shape an app's guards file takes) did not compile when it named no
+  `refusals`: the map's contextual type widened the guard's refusals to
+  `readonly string[]`, which the vocabulary check read as codes it does not
+  hold, so every such guard was asked for a `refusals` option. The refusals in
+  a built guard's type are no longer an inference site, so a guard that names
+  none declares none wherever it is built.
+
 ## [10.0.1] - 2026-09-28
 
 A major that makes both sides of an API answer exact. A success is only ever

package/dist/api/LambderApiGuards.d.ts

@@ -168,7 +168,7 @@ export type LambderGuardBuilder<TCtx, TSessionCtx, TVocabulary = never, TCodesRe
         session: true;
         handler: (ctx: TSessionCtx & LambderGuardRefuse<TVocabulary, TRefusals, TCodesRequired>, payload: z.output<TInput>, param: TParam) => TOutput | Promise<TOutput>;
     } & LambderGuardPlacement & LambderGuardRefusals<TRefusals> & LambderGuardRefusalsKnownIn<TVocabulary, TRefusals> & LambderGuardAnswerCheck<TOutput>): LambderGuardOf<TOutput, {
-        refusals?: TRefusals;
+        refusals?: NoInfer<TRefusals>;
         apiInput: TInput;
         guardInput?: undefined;
         session: true;
@@ -178,7 +178,7 @@ export type LambderGuardBuilder<TCtx, TSessionCtx, TVocabulary = never, TCodesRe
         apiInput: TInput;
         handler: (ctx: TCtx & LambderGuardRefuse<TVocabulary, TRefusals, TCodesRequired>, payload: z.output<TInput>, param: TParam) => TOutput | Promise<TOutput>;
     } & LambderGuardPlacement & LambderGuardRefusals<TRefusals> & LambderGuardRefusalsKnownIn<TVocabulary, TRefusals> & LambderGuardAnswerCheck<TOutput>): LambderGuardOf<TOutput, {
-        refusals?: TRefusals;
+        refusals?: NoInfer<TRefusals>;
         apiInput: TInput;
         guardInput?: undefined;
         session?: undefined;
@@ -189,7 +189,7 @@ export type LambderGuardBuilder<TCtx, TSessionCtx, TVocabulary = never, TCodesRe
         session: true;
         handler: (ctx: TSessionCtx & LambderGuardRefuse<TVocabulary, TRefusals, TCodesRequired>, payload: z.output<TInput>, param: TParam) => TOutput | Promise<TOutput>;
     } & LambderGuardPlacement & LambderGuardRefusals<TRefusals> & LambderGuardRefusalsKnownIn<TVocabulary, TRefusals> & LambderGuardAnswerCheck<TOutput>): LambderGuardOf<TOutput, {
-        refusals?: TRefusals;
+        refusals?: NoInfer<TRefusals>;
         guardInput: TInput;
         apiInput?: undefined;
         session: true;
@@ -199,7 +199,7 @@ export type LambderGuardBuilder<TCtx, TSessionCtx, TVocabulary = never, TCodesRe
         guardInput: TInput;
         handler: (ctx: TCtx & LambderGuardRefuse<TVocabulary, TRefusals, TCodesRequired>, payload: z.output<TInput>, param: TParam) => TOutput | Promise<TOutput>;
     } & LambderGuardPlacement & LambderGuardRefusals<TRefusals> & LambderGuardRefusalsKnownIn<TVocabulary, TRefusals> & LambderGuardAnswerCheck<TOutput>): LambderGuardOf<TOutput, {
-        refusals?: TRefusals;
+        refusals?: NoInfer<TRefusals>;
         guardInput: TInput;
         apiInput?: undefined;
         session?: undefined;
@@ -209,7 +209,7 @@ export type LambderGuardBuilder<TCtx, TSessionCtx, TVocabulary = never, TCodesRe
         session: true;
         handler: (ctx: TSessionCtx & LambderGuardRefuse<TVocabulary, TRefusals, TCodesRequired>, payload: undefined, param: TParam) => TOutput | Promise<TOutput>;
     } & LambderGuardPlacement & LambderGuardRefusals<TRefusals> & LambderGuardRefusalsKnownIn<TVocabulary, TRefusals> & LambderGuardAnswerCheck<TOutput>): LambderGuardOf<TOutput, {
-        refusals?: TRefusals;
+        refusals?: NoInfer<TRefusals>;
         apiInput?: undefined;
         guardInput?: undefined;
         session: true;
@@ -218,7 +218,7 @@ export type LambderGuardBuilder<TCtx, TSessionCtx, TVocabulary = never, TCodesRe
     <TParam = undefined, TOutput = void, const TRefusals extends readonly string[] = readonly []>(guard: {
         handler: (ctx: TCtx & LambderGuardRefuse<TVocabulary, TRefusals, TCodesRequired>, payload: undefined, param: TParam) => TOutput | Promise<TOutput>;
     } & LambderGuardPlacement & LambderGuardRefusals<TRefusals> & LambderGuardRefusalsKnownIn<TVocabulary, TRefusals> & LambderGuardAnswerCheck<TOutput>): LambderGuardOf<TOutput, {
-        refusals?: TRefusals;
+        refusals?: NoInfer<TRefusals>;
         apiInput?: undefined;
         guardInput?: undefined;
         session?: undefined;

package/dist/core/Lambder.d.ts

@@ -24,7 +24,7 @@ import type { LambderApiIdempotencyConfig } from "../api/LambderApiIdempotency.j
 import type { LambderContractEntry, LambderJsonOf, LambderMergeContract } from "../shared/wire/LambderApiContract.js";
 import { type LambderHttpEvent, type LambderRenderContext, type LambderSessionRenderContext } from "./LambderContext.js";
 import type { LambderReadonlyDeep, MaybePromise } from "../shared/util/LambderTypeUtilities.js";
-import { type LambderRouteHandler, type LambderInputValidationHandler, type LambderFallbackHandler, type LambderGlobalErrorHandler, type LambderAfterRenderHook, type LambderBeforeRenderHook, type LambderFallbackHook, type LambderActionTools, type LambderCreateOptions, type LambderGivenOption, type LambderHandler, type LambderNestedOptionChecks, type LambderObjectOutputCheck, type LambderRequirableGuardsField, type LambderSessionEnabledInstance, type LambderSessionRouteHandler } from "./LambderCreateOptions.js";
+import { type LambderMergedNamedMaps, type LambderNamedMapsOption, type LambderRouteHandler, type LambderInputValidationHandler, type LambderFallbackHandler, type LambderGlobalErrorHandler, type LambderAfterRenderHook, type LambderBeforeRenderHook, type LambderFallbackHook, type LambderActionTools, type LambderCreateOptions, type LambderGivenOption, type LambderHandler, type LambderNestedOptionChecks, type LambderObjectOutputCheck, type LambderRequirableGuardsField, type LambderSessionEnabledInstance, type LambderSessionRouteHandler } from "./LambderCreateOptions.js";
 /** Everything `lambder/testing` may put under a built instance: the pipeline's stores, and the source its files are read from. */
 export type LambderInstanceBackends = LambderPipelineBackends & {
     fileSource?: LambderFileSource;
@@ -96,7 +96,7 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
     private readonly pipeline;
     /** Every registered API by name: the duplicate-name check, and what apiSignatures() digests. */
     private readonly apiDefinitions;
-    /** The guards map given at creation, kept for apiSignatures(): a guard's schema is part of the signature of every endpoint declaring it. */
+    /** The guards given at creation, merged into one map, kept for apiSignatures(): a guard's schema is part of the signature of every endpoint declaring it. */
     private readonly guards;
     /** The rate-limit policies given at creation, kept for apiOptionEntries(), which records each one less its key handler. */
     private readonly rateLimitPolicies;
@@ -129,7 +129,7 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
     private readonly trustedClientIpHeaders;
     private readonly trustedHostHeaders;
     private requirePublicApiGuards;
-    constructor(options?: LambderCreateOptions<TSessionData>);
+    constructor(given?: LambderCreateOptions<TSessionData>);
     setRouteFallbackHandler(routeFallbackHandler: LambderFallbackHandler): this;
     setApiFallbackHandler(apiFallbackHandler: LambderFallbackHandler): this;
     setApiInputValidationErrorHandler(apiInputValidationErrorHandler: LambderInputValidationHandler): this;
@@ -518,9 +518,9 @@ export declare const initLambder: <TSessionData = any>() => {
          * endpoint's codes alone.
          */
         refuse: LambderDeclaredRefuse<LambderHandlerRefusalsOf<TRefusals, keyof TRefusals & string>, TRequireCodes>;
-        create<const TOptions extends LambderInitCreateOptions<TSessionData>>(options: TOptions & Record<Exclude<keyof TOptions, "session" | "guards" | "idempotency" | "apiVersion" | "cors" | "apiPath" | "apiSignatures" | "trustedClientIpHeaders" | "trustedHostHeaders" | "files" | "etag" | "minApiVersion" | "compression" | "maxResponseBytes" | "maxRequestPayloadBytes" | "rateLimits" | "requireSessionApiGuards" | "requirePublicApiGuards" | "crashes">, never> & LambderNestedOptionChecks<TSessionData, TOptions, TRefusals>): Lambder<TSessionData, {}, TOptions["rateLimits"] extends {
-            policies: infer TPolicies extends Record<string, LambderApiRateLimitPolicyConfig>;
-        } ? TPolicies : {}, TOptions["guards"] extends Record<string, LambderApiGuard<any, any, any>> ? LambderGuardMetaMap<TOptions["guards"]> : {}, TOptions["idempotency"] extends LambderApiIdempotencyConfig ? true : false, [LambderGivenOption<TOptions, "requireSessionApiGuards">] extends [false | undefined] ? false : true, [LambderGivenOption<TOptions, "requirePublicApiGuards">] extends [false | undefined] ? false : true, [LambderGivenOption<TOptions, "session">] extends [undefined] ? false : true, TRefusals, TRequireCodes>;
+        create<const TOptions extends LambderInitCreateOptions<TSessionData>>(options: TOptions & Record<Exclude<keyof TOptions, "session" | "guards" | "idempotency" | "apiVersion" | "cors" | "apiPath" | "apiSignatures" | "trustedClientIpHeaders" | "trustedHostHeaders" | "files" | "etag" | "rateLimits" | "minApiVersion" | "compression" | "maxResponseBytes" | "maxRequestPayloadBytes" | "requireSessionApiGuards" | "requirePublicApiGuards" | "crashes">, never> & LambderNestedOptionChecks<TSessionData, TOptions, TRefusals>): Lambder<TSessionData, {}, TOptions["rateLimits"] extends {
+            policies: infer TPolicies;
+        } ? LambderMergedNamedMaps<TPolicies> extends infer TMerged extends Record<string, LambderApiRateLimitPolicyConfig> ? TMerged : {} : {}, TOptions["guards"] extends LambderNamedMapsOption<Record<string, LambderApiGuard<any, any, any>>> ? LambderGuardMetaMap<LambderMergedNamedMaps<TOptions["guards"]>> : {}, TOptions["idempotency"] extends LambderApiIdempotencyConfig ? true : false, [LambderGivenOption<TOptions, "requireSessionApiGuards">] extends [false | undefined] ? false : true, [LambderGivenOption<TOptions, "requirePublicApiGuards">] extends [false | undefined] ? false : true, [LambderGivenOption<TOptions, "session">] extends [undefined] ? false : true, TRefusals, TRequireCodes>;
         guard: import("../api/LambderApiGuards.js").LambderGuardBuilder<LambderRenderContext<any, Record<string, string>, {}, TSessionData>, LambderSessionRenderContext<any, TSessionData>, TRefusals, TRequireCodes>;
         rateLimitKey: import("../api/LambderApiRateLimits.js").LambderRateLimitKeyBuilder<LambderRenderContext<any, Record<string, string>, {}, TSessionData>>;
     };
@@ -544,9 +544,9 @@ export declare const initLambder: <TSessionData = any>() => {
         code?: undefined;
         data?: undefined;
     }) | undefined) => never;
-    create<const TOptions extends LambderInitCreateOptions<TSessionData>>(options: TOptions & Record<Exclude<keyof TOptions, "session" | "guards" | "idempotency" | "apiVersion" | "cors" | "apiPath" | "apiSignatures" | "trustedClientIpHeaders" | "trustedHostHeaders" | "files" | "etag" | "minApiVersion" | "compression" | "maxResponseBytes" | "maxRequestPayloadBytes" | "rateLimits" | "requireSessionApiGuards" | "requirePublicApiGuards" | "crashes">, never> & LambderNestedOptionChecks<TSessionData, TOptions, {}>): Lambder<TSessionData, {}, TOptions["rateLimits"] extends {
-        policies: infer TPolicies extends Record<string, LambderApiRateLimitPolicyConfig>;
-    } ? TPolicies : {}, TOptions["guards"] extends Record<string, LambderApiGuard<any, any, any>> ? LambderGuardMetaMap<TOptions["guards"]> : {}, TOptions["idempotency"] extends LambderApiIdempotencyConfig ? true : false, [LambderGivenOption<TOptions, "requireSessionApiGuards">] extends [false | undefined] ? false : true, [LambderGivenOption<TOptions, "requirePublicApiGuards">] extends [false | undefined] ? false : true, [LambderGivenOption<TOptions, "session">] extends [undefined] ? false : true, {}, false>;
+    create<const TOptions extends LambderInitCreateOptions<TSessionData>>(options: TOptions & Record<Exclude<keyof TOptions, "session" | "guards" | "idempotency" | "apiVersion" | "cors" | "apiPath" | "apiSignatures" | "trustedClientIpHeaders" | "trustedHostHeaders" | "files" | "etag" | "rateLimits" | "minApiVersion" | "compression" | "maxResponseBytes" | "maxRequestPayloadBytes" | "requireSessionApiGuards" | "requirePublicApiGuards" | "crashes">, never> & LambderNestedOptionChecks<TSessionData, TOptions, {}>): Lambder<TSessionData, {}, TOptions["rateLimits"] extends {
+        policies: infer TPolicies;
+    } ? LambderMergedNamedMaps<TPolicies> extends infer TMerged extends Record<string, LambderApiRateLimitPolicyConfig> ? TMerged : {} : {}, TOptions["guards"] extends LambderNamedMapsOption<Record<string, LambderApiGuard<any, any, any>>> ? LambderGuardMetaMap<LambderMergedNamedMaps<TOptions["guards"]>> : {}, TOptions["idempotency"] extends LambderApiIdempotencyConfig ? true : false, [LambderGivenOption<TOptions, "requireSessionApiGuards">] extends [false | undefined] ? false : true, [LambderGivenOption<TOptions, "requirePublicApiGuards">] extends [false | undefined] ? false : true, [LambderGivenOption<TOptions, "session">] extends [undefined] ? false : true, {}, false>;
     guard: import("../api/LambderApiGuards.js").LambderGuardBuilder<LambderRenderContext<any, Record<string, string>, {}, TSessionData>, LambderSessionRenderContext<any, TSessionData>, {}, false>;
     rateLimitKey: import("../api/LambderApiRateLimits.js").LambderRateLimitKeyBuilder<LambderRenderContext<any, Record<string, string>, {}, TSessionData>>;
 };

package/dist/core/Lambder.js

@@ -27,7 +27,7 @@ import { COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BR_FIELD, COMPRESSED_PA
 import { coerceToError } from "../shared/wire/LambderCrashDetail.js";
 import { LambderCrashHandling } from "./LambderCrashHandling.js";
 import { policyBuildersFor } from "./LambderPolicyBuilders.js";
-import { assertCreateOptions, } from "./LambderCreateOptions.js";
+import { assertCreateOptions, mergeNamedMaps, } from "./LambderCreateOptions.js";
 /** The refusals of a name no API is registered under: no code, and none required. */
 const NO_DECLARED_REFUSALS = { codes: new Map(), codeRequired: false };
 /**
@@ -88,7 +88,7 @@ export default class Lambder {
     pipeline;
     /** Every registered API by name: the duplicate-name check, and what apiSignatures() digests. */
     apiDefinitions = new Map();
-    /** The guards map given at creation, kept for apiSignatures(): a guard's schema is part of the signature of every endpoint declaring it. */
+    /** The guards given at creation, merged into one map, kept for apiSignatures(): a guard's schema is part of the signature of every endpoint declaring it. */
     guards;
     /** The rate-limit policies given at creation, kept for apiOptionEntries(), which records each one less its key handler. */
     rateLimitPolicies;
@@ -121,7 +121,15 @@ export default class Lambder {
     trustedClientIpHeaders;
     trustedHostHeaders;
     requirePublicApiGuards;
-    constructor(options = {}) {
+    constructor(given = {}) {
+        // The guards and the rate-limit policies as one map each, whether
+        // they were given as one or as a list; a name two maps declare
+        // throws here.
+        const options = {
+            ...given,
+            guards: given.guards && mergeNamedMaps(given.guards, "guard"),
+            rateLimits: given.rateLimits && { ...given.rateLimits, policies: mergeNamedMaps(given.rateLimits.policies, "rate-limit policy") },
+        };
         assertCreateOptions(options);
         this.files = options.files ? new LambderFiles(options.files) : null;
         this.apiPath = options.apiPath ?? DEFAULT_API_PATH;

package/dist/core/LambderCreateOptions.d.ts

@@ -112,6 +112,26 @@ export type LambderHandler = {
     (event: LambderHttpEvent, context: Context): Promise<LambderHttpResponse>;
     (event: unknown, context: Context): Promise<unknown>;
 };
+/**
+ * One map of named declarations, or a list of them. An app made of parts,
+ * each declaring its own guards or rate-limit policies beside its APIs, hands
+ * create() the list, and the instance declares every name in it. A name two
+ * maps declare is refused rather than one quietly replacing the other.
+ */
+export type LambderNamedMapsOption<TMap> = TMap | readonly TMap[];
+/** The one map a named-maps option declares: a list's members intersected, a lone map as it is. */
+export type LambderMergedNamedMaps<T> = T extends readonly [] ? {} : T extends readonly [infer TFirst, ...infer TRest] ? TFirst & LambderMergedNamedMaps<TRest> : T extends readonly (infer TMember)[] ? TMember : T;
+/** The names a list declares in more than one of its maps: never for a lone map, or for a list whose members are not known one by one. */
+type LambderRepeatedNames<T, TSeen extends PropertyKey = never> = T extends readonly [infer TFirst, ...infer TRest] ? (keyof TFirst & TSeen) | LambderRepeatedNames<TRest, TSeen | keyof TFirst> : never;
+/** Intersected onto a list: a name declared in two of its maps is a compile error, and the property name is the message. */
+type LambderNoRepeatedNames<T> = [LambderRepeatedNames<T>] extends [never] ? unknown : {
+    readonly "lambder: a name is declared in more than one of these maps. Declare each guard and each rate-limit policy once.": LambderRepeatedNames<T>;
+};
+/**
+ * A named-maps option as one map: a lone map as it is, a list merged in
+ * order. A name declared in two maps of the list is refused.
+ */
+export declare const mergeNamedMaps: <TMap extends Record<string, unknown>>(option: LambderNamedMapsOption<TMap>, what: "guard" | "rate-limit policy") => TMap;
 /** Session configuration (the `session` option of create/new): where sessions rest, and how their cookies are scoped. */
 export type LambderSessionOptions<TSessionData = any> = {
     /**
@@ -147,6 +167,20 @@ export type LambderSessionOptions<TSessionData = any> = {
     /** Hashing and randomness for the session tokens. Default: WebCrypto. */
     crypto?: LambderSessionCrypto;
 };
+/** One map of the server's guards, each pinned to the render contexts of the app's session type. */
+export type LambderGuardsMap<TSessionData = any> = Record<string, LambderApiGuard<any, any, any, LambderRenderContext<any, Record<string, string>, {}, TSessionData>, LambderSessionRenderContext<any, TSessionData>>>;
+/** One map of the server's rate-limit policies. */
+export type LambderRateLimitPoliciesMap = Record<string, LambderApiRateLimitPolicyConfig<LambderRenderContext>>;
+/** The `rateLimits` option of create(): the engine's config, with `policies` as one map or a list of maps. */
+export type LambderCreateRateLimitsOption = Omit<LambderApiRateLimitsConfig<LambderRateLimitPoliciesMap>, "policies"> & {
+    /** Named policies referenced (typed) from addApi/addSessionApi: one map, or a list of maps merged in order. */
+    policies: LambderNamedMapsOption<LambderRateLimitPoliciesMap>;
+};
+/** The options as the instance holds them: the guards and the rate-limit policies merged into one map each. */
+export type LambderMergedCreateOptions<TSessionData = any> = Omit<LambderCreateOptions<TSessionData>, "guards" | "rateLimits"> & {
+    guards?: LambderGuardsMap<TSessionData>;
+    rateLimits?: LambderApiRateLimitsConfig<LambderRateLimitPoliciesMap>;
+};
 /**
  * Everything an instance is configured with, in ONE declaration: base
  * serving options plus the type-affecting policy layer (rate limits, guards,
@@ -244,16 +278,22 @@ export type LambderCreateOptions<TSessionData = any> = {
     cors?: boolean | LambderCorsConfig;
     /** Sessions over a store of your choosing; required for addSessionApi/addSessionRoute. */
     session?: LambderSessionOptions<TSessionData>;
-    /** Declarative per-API rate limiting: your limiter plus named policies APIs reference (typed) via the `rateLimit` option. */
-    rateLimits?: LambderApiRateLimitsConfig<Record<string, LambderApiRateLimitPolicyConfig<LambderRenderContext>>>;
+    /**
+     * Declarative per-API rate limiting: your limiter plus named policies APIs
+     * reference (typed) via the `rateLimit` option. `policies` is one map, or
+     * a list of maps (one per part of the app) that the instance merges.
+     */
+    rateLimits?: LambderCreateRateLimitsOption;
     /**
      * Named guards APIs reference (typed) via the `guards` option; build each
      * with `initLambder<SessionData>().guard()`, whose handlers see the app's
      * session type, or lambderGuard(). Pinned to the render contexts, so a
      * guard built for another adapter, or for another session type, is
      * rejected here rather than reading fields that are not on its context.
+     * One map, or a list of maps (one per part of the app) that the instance
+     * merges.
      */
-    guards?: Record<string, LambderApiGuard<any, any, any, LambderRenderContext<any, Record<string, string>, {}, TSessionData>, LambderSessionRenderContext<any, TSessionData>>>;
+    guards?: LambderNamedMapsOption<LambderGuardsMap<TSessionData>>;
     /**
      * The app's refusal vocabulary: every code an API or a guard may refuse
      * with, each declared once with the schema of its data (`{ data: schema }`
@@ -386,6 +426,22 @@ type LambderGuardRefusalsKnown<TGuard, TRefusals> = TGuard extends {
 } ? NonNullable<TNamed> extends readonly (infer TCode extends string)[] ? string extends TCode ? unknown : [Exclude<TCode, keyof NonNullable<TRefusals> & string>] extends [never] ? unknown : {
     refusals: readonly (keyof NonNullable<TRefusals> & string)[];
 } : unknown : unknown;
+/** Every policy in a map, or in each map of a list, held to the policy shape, its message included; a list also declares no name twice. */
+type LambderRateLimitPolicyChecks<TPolicies> = TPolicies extends readonly unknown[] ? {
+    [TIndex in keyof TPolicies]: LambderRateLimitPolicyChecks<TPolicies[TIndex]>;
+} & LambderNoRepeatedNames<TPolicies> : {
+    [TPolicy in keyof TPolicies]: LambderNoExtraKeys<TPolicies[TPolicy], LambderApiRateLimitPolicyConfig<LambderRenderContext>> & (TPolicies[TPolicy] extends {
+        refusal: infer TMessage;
+    } ? {
+        refusal?: LambderNoExtraKeys<TMessage, LambderRateLimitMessage>;
+    } : unknown);
+};
+/** Every guard in a map, or in each map of a list, held to the guard shape and its refusals to the vocabulary; a list also declares no name twice. */
+type LambderGuardChecks<TSessionData, TGuards, TRefusals> = TGuards extends readonly unknown[] ? {
+    [TIndex in keyof TGuards]: LambderGuardChecks<TSessionData, TGuards[TIndex], TRefusals>;
+} & LambderNoRepeatedNames<TGuards> : {
+    [TGuard in keyof TGuards]: LambderNoExtraKeys<TGuards[TGuard], LambderGuardsMap<TSessionData>[string]> & LambderGuardRefusalsKnown<TGuards[TGuard], TRefusals>;
+};
 /**
  * The surplus-key rule one level down, over the option objects a typo is
  * worst on. Excess-property checking is off for the WHOLE literal under
@@ -405,17 +461,9 @@ export type LambderNestedOptionChecks<TSessionData, TOptions extends LambderCrea
     idempotency?: LambderNoExtraKeys<NonNullable<TOptions["idempotency"]>, LambderOptionShape<TSessionData, "idempotency">>;
     crashes?: LambderNoExtraKeys<NonNullable<TOptions["crashes"]>, LambderOptionShape<TSessionData, "crashes">>;
     rateLimits?: LambderNoExtraKeys<NonNullable<TOptions["rateLimits"]>, LambderOptionShape<TSessionData, "rateLimits">> & {
-        policies?: {
-            [TPolicy in keyof NonNullable<TOptions["rateLimits"]>["policies"]]: LambderNoExtraKeys<NonNullable<TOptions["rateLimits"]>["policies"][TPolicy], LambderApiRateLimitPolicyConfig<LambderRenderContext>> & (NonNullable<TOptions["rateLimits"]>["policies"][TPolicy] extends {
-                refusal: infer TMessage;
-            } ? {
-                refusal?: LambderNoExtraKeys<TMessage, LambderRateLimitMessage>;
-            } : unknown);
-        };
-    };
-    guards?: {
-        [TGuard in keyof NonNullable<TOptions["guards"]>]: LambderNoExtraKeys<NonNullable<TOptions["guards"]>[TGuard], LambderOptionShape<TSessionData, "guards">[string]> & LambderGuardRefusalsKnown<NonNullable<TOptions["guards"]>[TGuard], TRefusals>;
+        policies?: LambderRateLimitPolicyChecks<NonNullable<TOptions["rateLimits"]>["policies"]>;
     };
+    guards?: LambderGuardChecks<TSessionData, NonNullable<TOptions["guards"]>, TRefusals>;
     files?: TOptions["files"] extends {
         source: unknown;
     } ? LambderNoExtraKeys<TOptions["files"], Extract<LambderFilesOption, {
@@ -430,4 +478,4 @@ export type LambderNestedOptionChecks<TSessionData, TOptions extends LambderCrea
  * every API call (an apiPath with no leading slash) or a 500 on every
  * response (maxResponseBytes: 0) that an app discovers in production.
  */
-export declare const assertCreateOptions: (options: LambderCreateOptions<any>) => void;
+export declare const assertCreateOptions: (options: LambderMergedCreateOptions<any>) => void;

package/dist/core/LambderCreateOptions.js

@@ -1,5 +1,23 @@
 import { assertRefusalCodesDeclared, readRefusalVocabulary } from "../api/LambderApiRefusals.js";
 import { assertPositiveInteger } from "../shared/util/LambderOptionChecks.js";
+/**
+ * A named-maps option as one map: a lone map as it is, a list merged in
+ * order. A name declared in two maps of the list is refused.
+ */
+export const mergeNamedMaps = (option, what) => {
+    if (!Array.isArray(option))
+        return option;
+    const merged = {};
+    for (const map of option) {
+        for (const [name, declaration] of Object.entries(map)) {
+            if (Object.prototype.hasOwnProperty.call(merged, name)) {
+                throw new Error(`Lambder: the ${what} "${name}" is declared in two of the maps given to create(). Declare each name once.`);
+            }
+            merged[name] = declaration;
+        }
+    }
+    return merged;
+};
 /**
  * Everything create() refuses before an instance exists, in one place: a
  * value that cannot work is a startup error naming the option, not a 404 on

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "10.0.1",
+  "version": "10.1.1",
   "sideEffects": false,
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [