lambder 10.2.1 → 11.0.1

package/CHANGELOG.md

@@ -9,6 +9,58 @@ sit on its first published patch, and later patches list only what they changed.
 Releases up to 3.2.6 carry git tags; the ones after it were published without
 one, so versions are not cross-linked to tag comparisons here.
 
+## [11.0.1] - 2026-09-29
+
+A major for an app with many APIs: what one API costs the type checker no
+longer grows with the app's keyed guards and rate-limit policies. The same
+declarations compile and the same ones fail, and nothing changes at runtime.
+It is a major because the exported option types no longer take the API's
+input.
+
+### Changed (breaking)
+
+- **`LambderGuardsOption`, `LambderRateLimitOption`, `LambderAllowedGuardNames`,
+  `LambderParamlessGuardNames` and `LambderAllowedPolicyNames` no longer take
+  a payload.** They name what an instance lets one kind of API declare
+  (session guards and session-keyed policies only on session APIs) and depend
+  on the instance alone. Whether an API's input carries the fields an apiInput
+  guard or an apiInput-keyed policy reads is asked separately, of the names
+  the API declared, by `LambderGuardNamesInputLacks` and
+  `LambderPolicyNamesInputLacks`.
+  - To move: drop the payload argument (`LambderGuardsOption<Guards, true>`
+    for `LambderGuardsOption<Guards, Payload, true>`), and where you relied on
+    the payload filter, ask the new types of the names you declared.
+
+### Changed
+
+- **An API's `guards` and `rateLimit` options are held to its input once the
+  input is known.** Their constraints used to read the API's own input type,
+  so for every API the compiler rebuilt the names it may declare, over every
+  guard and policy the instance holds, while that input was still being
+  inferred. The work grew with an app's APIs times its apiInput guards and
+  apiInput-keyed policies, exponentially in the worst case: 25 APIs
+  registered in one chain, each declaring one of 10 apiInput guards, took
+  12.6 million type instantiations. The constraints now depend on the
+  instance alone, and `LambderPayloadSliceCheck`, intersected onto the
+  options, refuses an apiInput guard or policy whose fields the input does
+  not carry. The same 25 APIs now take 45 thousand, about what they cost on
+  guards that read no input.
+- **Where the error shows.** A guard or policy the input cannot carry is
+  refused on the `guards` or `rateLimit` value rather than on the name inside
+  it, and the message names the guards or policies at fault ("lambder: these
+  guards read fields this API's input does not carry"). Completion inside
+  those options offers every declared name.
+
+### Added
+
+- **`LambderGuardNamesInputLacks` and `LambderPolicyNamesInputLacks`**: the
+  apiInput guards, and the apiInput-keyed policies, among some names whose
+  fields an input does not carry. The input is compared whole, so a union
+  input carries a slice only when every member does.
+- **A type-cost test** (`tests/api/api-policy-type-cost.test.ts`): forty APIs
+  compiled on an instance whose ten guards and ten policies read the input,
+  and on one whose same-named ones do not, must cost about the same.
+
 ## [10.2.1] - 2026-09-29
 
 A minor for an app that keeps its cache in its own storage. It writes a few

package/dist/api/LambderApiGuards.d.ts

@@ -272,33 +272,40 @@ export type LambderGuardMetaMap<TGuards> = {
     [K in keyof TGuards]: LambderGuardMeta<TGuards[K]>;
 };
 /**
- * The guard name when the API's payload carries the guard's apiInput slice.
- * The payload is compared whole, not member by member: a bare `TPayload
- * extends R` would distribute over a union input, so a slice one member
- * carries would be allowed on an API whose other members lack it, and every
- * request of those members would be refused by the slice's parse.
+ * Guard names an API may declare: every guard the instance holds, session
+ * guards only on session APIs. Whether the API's input carries the fields an
+ * apiInput guard reads is asked of the names it declared, once that input is
+ * known, by LambderGuardNamesInputLacks.
  */
-type LambderGuardNameIfPayloadOk<TGuards, K extends keyof TGuards, TPayload> = TGuards[K] extends {
-    apiInput: infer R;
-} ? ([TPayload] extends [R] ? K : never) : K;
-/**
- * Guard names an API may declare: apiInput-mode guards only when the API's
- * payload carries their fields, session guards only on session APIs.
- */
-export type LambderAllowedGuardNames<TGuards, TPayload, TIncludeSession extends boolean = true> = {
+export type LambderAllowedGuardNames<TGuards, TIncludeSession extends boolean = true> = {
     [K in keyof TGuards]: TGuards[K] extends {
         session: true;
-    } ? (TIncludeSession extends true ? LambderGuardNameIfPayloadOk<TGuards, K, TPayload> : never) : LambderGuardNameIfPayloadOk<TGuards, K, TPayload>;
+    } ? (TIncludeSession extends true ? K : never) : K;
 }[keyof TGuards] & string;
+/**
+ * The apiInput guards among `TNames` whose fields the API's payload does not
+ * carry. addApi and addSessionApi ask this once the API's input is known, of
+ * the names its guards option holds; see LambderPayloadSliceCheck.
+ *
+ * The payload is compared whole, not member by member: a bare `TPayload
+ * extends R` would distribute over a union input, so a slice one member
+ * carries would pass on an API whose other members lack it, and every
+ * request of those members would be refused by the slice's parse.
+ */
+export type LambderGuardNamesInputLacks<TGuards, TNames, TPayload> = {
+    [K in TNames & keyof TGuards]: TGuards[K] extends {
+        apiInput: infer R;
+    } ? ([TPayload] extends [R] ? never : K) : never;
+}[TNames & keyof TGuards] & string;
 /** The allowed guard names whose handler takes no param (usable in the string/array forms). */
-export type LambderParamlessGuardNames<TGuards, TPayload, TIncludeSession extends boolean> = {
-    [K in LambderAllowedGuardNames<TGuards, TPayload, TIncludeSession> & keyof TGuards]: TGuards[K] extends {
+export type LambderParamlessGuardNames<TGuards, TIncludeSession extends boolean> = {
+    [K in LambderAllowedGuardNames<TGuards, TIncludeSession> & keyof TGuards]: TGuards[K] extends {
         param: undefined;
     } ? K & string : never;
-}[LambderAllowedGuardNames<TGuards, TPayload, TIncludeSession> & keyof TGuards];
+}[LambderAllowedGuardNames<TGuards, TIncludeSession> & keyof TGuards];
 /** The map form's full shape: every declarable guard name, each carrying its own param type. */
-type LambderGuardsMap<TGuards, TPayload, TIncludeSession extends boolean> = {
-    readonly [K in LambderAllowedGuardNames<TGuards, TPayload, TIncludeSession> & keyof TGuards]?: TGuards[K] extends {
+type LambderGuardsMap<TGuards, TIncludeSession extends boolean> = {
+    readonly [K in LambderAllowedGuardNames<TGuards, TIncludeSession> & keyof TGuards]?: TGuards[K] extends {
         param: undefined;
     } ? true : TGuards[K] extends {
         param: infer P;
@@ -312,11 +319,15 @@ type LambderGuardsMap<TGuards, TPayload, TIncludeSession extends boolean> = {
  *
  * Every form is non-empty by construction, so declaring the option is always
  * declaring a guard. See LambderNonEmptyOptionMap.
+ *
+ * It depends on the instance alone, never on the API's input, so the
+ * compiler builds it once per instance rather than once per API; see
+ * LambderPayloadSliceCheck for why, and for where the input is asked.
  */
-export type LambderGuardsOption<TGuards, TPayload, TIncludeSession extends boolean> = LambderParamlessGuardNames<TGuards, TPayload, TIncludeSession> | readonly [
-    LambderParamlessGuardNames<TGuards, TPayload, TIncludeSession>,
-    ...LambderParamlessGuardNames<TGuards, TPayload, TIncludeSession>[]
-] | LambderNonEmptyOptionMap<LambderGuardsMap<TGuards, TPayload, TIncludeSession>>;
+export type LambderGuardsOption<TGuards, TIncludeSession extends boolean> = LambderParamlessGuardNames<TGuards, TIncludeSession> | readonly [
+    LambderParamlessGuardNames<TGuards, TIncludeSession>,
+    ...LambderParamlessGuardNames<TGuards, TIncludeSession>[]
+] | LambderNonEmptyOptionMap<LambderGuardsMap<TGuards, TIncludeSession>>;
 /**
  * The typed ctx.guardData an API's handler sees: declared guards that return
  * a value, keyed by name. Check-only (void) guards never appear.

package/dist/api/LambderApiRateLimits.d.ts

@@ -147,22 +147,35 @@ export type LambderApiRateLimitsConfig<TPolicies extends Record<string, LambderA
 type LambderPolicyPerOf<TPolicy> = "per" extends keyof TPolicy ? TPolicy["per" & keyof TPolicy] : undefined;
 /**
  * Policy names an API may reference: session-keyed policies only on session
- * APIs, apiInput-keyed policies only when the API's payload carries the
- * key's fields, and never a policy without `per`, whose key only the code
- * that charges it knows. A policy whose type does not settle its `per` is
- * allowed here and checked at registration.
- *
- * The payload is compared whole, as the guards' check does it: a union input
- * one of whose members lacks the key's fields does not carry them, and every
- * request of that member would be refused by the key slice's parse.
+ * APIs, and never a policy without `per`, whose key only the code that
+ * charges it knows. A policy whose type does not settle its `per` is allowed
+ * here and checked at registration. Whether the API's input carries the
+ * fields an apiInput-keyed policy reads is asked of the names it declared,
+ * once that input is known, by LambderPolicyNamesInputLacks.
  */
-export type LambderAllowedPolicyNames<TPolicies, TPayload, TIncludeSession extends boolean> = {
+export type LambderAllowedPolicyNames<TPolicies, TIncludeSession extends boolean> = {
     [K in keyof TPolicies]: [
         LambderPolicyPerOf<TPolicies[K]>
-    ] extends [undefined] ? never : [LambderPolicyPerOf<TPolicies[K]>] extends ["session"] ? (TIncludeSession extends true ? K : never) : [LambderPolicyPerOf<TPolicies[K]>] extends [{
-        apiInput: infer S extends z.ZodType;
-    }] ? ([TPayload] extends [z.input<S>] ? K : never) : K;
+    ] extends [undefined] ? never : [LambderPolicyPerOf<TPolicies[K]>] extends ["session"] ? (TIncludeSession extends true ? K : never) : K;
 }[keyof TPolicies] & string;
+/**
+ * The apiInput-keyed policies among `TNames` whose key fields the API's
+ * payload does not carry. addApi and addSessionApi ask this once the API's
+ * input is known, of the names its rateLimit option holds; see
+ * LambderPayloadSliceCheck.
+ *
+ * The payload is compared whole, as LambderGuardNamesInputLacks compares it:
+ * a union input one of whose members lacks the key's fields does not carry
+ * them, and every request of that member would be refused by the key
+ * slice's parse.
+ */
+export type LambderPolicyNamesInputLacks<TPolicies, TNames, TPayload> = {
+    [K in TNames & keyof TPolicies]: [
+        LambderPolicyPerOf<TPolicies[K]>
+    ] extends [{
+        apiInput: infer S extends z.ZodType;
+    }] ? ([TPayload] extends [z.input<S>] ? never : K) : never;
+}[TNames & keyof TPolicies] & string;
 /**
  * Policy names a handler may charge itself: every policy except one keyed by
  * a `{ apiInput?, handler }` key, which derives its key from an API's payload
@@ -222,8 +235,8 @@ type LambderRateLimitOverrideFor<TPolicy> = TPolicy extends {
     budget: "perPolicy";
 } ? Pick<LambderRateLimitOverride, "refusal"> : LambderRateLimitOverride;
 /** The map form's full shape: every referable policy name, each carrying its own override. */
-type LambderRateLimitMap<TPolicies, TPayload, TIncludeSession extends boolean> = {
-    readonly [K in LambderAllowedPolicyNames<TPolicies, TPayload, TIncludeSession> & keyof TPolicies]?: true | LambderRateLimitOverrideFor<TPolicies[K]>;
+type LambderRateLimitMap<TPolicies, TIncludeSession extends boolean> = {
+    readonly [K in LambderAllowedPolicyNames<TPolicies, TIncludeSession> & keyof TPolicies]?: true | LambderRateLimitOverrideFor<TPolicies[K]>;
 };
 /**
  * The per-API `rateLimit` option: one policy name, a non-empty ordered list
@@ -234,11 +247,14 @@ type LambderRateLimitMap<TPolicies, TPayload, TIncludeSession extends boolean> =
  * Every form is non-empty by construction (LambderNonEmptyOptionMap, as the
  * guards option uses), since `rateLimit: {}`, `rateLimit: []` and
  * `rateLimit: { policy: undefined }` would announce a limit and enforce none.
+ *
+ * It depends on the instance alone, never on the API's input, as
+ * LambderGuardsOption does; see LambderPayloadSliceCheck.
  */
-export type LambderRateLimitOption<TPolicies, TPayload, TIncludeSession extends boolean> = LambderAllowedPolicyNames<TPolicies, TPayload, TIncludeSession> | readonly [
-    LambderAllowedPolicyNames<TPolicies, TPayload, TIncludeSession>,
-    ...LambderAllowedPolicyNames<TPolicies, TPayload, TIncludeSession>[]
-] | LambderNonEmptyOptionMap<LambderRateLimitMap<TPolicies, TPayload, TIncludeSession>>;
+export type LambderRateLimitOption<TPolicies, TIncludeSession extends boolean> = LambderAllowedPolicyNames<TPolicies, TIncludeSession> | readonly [
+    LambderAllowedPolicyNames<TPolicies, TIncludeSession>,
+    ...LambderAllowedPolicyNames<TPolicies, TIncludeSession>[]
+] | LambderNonEmptyOptionMap<LambderRateLimitMap<TPolicies, TIncludeSession>>;
 /**
  * When in a call a policy is checked.
  *

package/dist/core/Lambder.d.ts

@@ -24,7 +24,7 @@ import type { LambderApiIdempotencyConfig } from "../api/LambderApiIdempotency.j
 import type { LambderContractEntry, LambderJsonOf, LambderMergeContract } from "../shared/wire/LambderApiContract.js";
 import { type LambderHttpEvent, type LambderRenderContext, type LambderSessionRenderContext } from "./LambderContext.js";
 import type { LambderReadonlyDeep, MaybePromise } from "../shared/util/LambderTypeUtilities.js";
-import { type LambderMergedNamedMaps, type LambderNamedMapsOption, type LambderRouteHandler, type LambderInputValidationHandler, type LambderFallbackHandler, type LambderGlobalErrorHandler, type LambderAfterRenderHook, type LambderBeforeRenderHook, type LambderFallbackHook, type LambderActionTools, type LambderCreateOptions, type LambderGivenOption, type LambderHandler, type LambderNestedOptionChecks, type LambderObjectOutputCheck, type LambderRequirableGuardsField, type LambderSessionEnabledInstance, type LambderSessionRouteHandler } from "./LambderCreateOptions.js";
+import { type LambderMergedNamedMaps, type LambderNamedMapsOption, type LambderRouteHandler, type LambderInputValidationHandler, type LambderFallbackHandler, type LambderGlobalErrorHandler, type LambderAfterRenderHook, type LambderBeforeRenderHook, type LambderFallbackHook, type LambderActionTools, type LambderCreateOptions, type LambderGivenOption, type LambderHandler, type LambderNestedOptionChecks, type LambderObjectOutputCheck, type LambderPayloadSliceCheck, type LambderRequirableGuardsField, type LambderSessionEnabledInstance, type LambderSessionRouteHandler } from "./LambderCreateOptions.js";
 /** Everything `lambder/testing` may put under a built instance: the pipeline's stores, and the source its files are read from. */
 export type LambderInstanceBackends = LambderPipelineBackends & {
     fileSource?: LambderFileSource;
@@ -167,7 +167,7 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
     addRoute(condition: RegExp | LambderRouteConditionFn | LambderRouteMatcher, actionFn: LambderRouteHandler): this;
     addSessionRoute<TPath extends LambderRoutePath>(condition: TPath, actionFn: ((ctx: LambderSessionRenderContext<any, TSessionData, LambderPathParamsOf<TPath>, {}, _TRateLimitPolicies>, resolver: LambderResolver) => MaybePromise<LambderResponse>) & LambderSessionEnabledInstance<_TSessionsEnabled>): this;
     addSessionRoute(condition: RegExp | LambderRouteConditionFn | LambderRouteMatcher, actionFn: LambderSessionRouteHandler<TSessionData> & LambderSessionEnabledInstance<_TSessionsEnabled>): this;
-    addApi<TName extends string, TInput extends z.ZodType, TOutput extends z.ZodType, const TAnswer extends LambderReadonlyDeep<z.input<TOutput>>, const TRateOpt extends LambderRateLimitOption<_TRateLimitPolicies, z.input<TInput>, false> = never, const TGuardsOpt extends LambderGuardsOption<_TGuards, z.input<TInput>, false> = never, const TIdempotencyOpt extends LambderApiIdempotencyOption = never, const TRefusalsOpt extends LambderRefusalsOption<_TRefusals> = never>(name: TName, schema: {
+    addApi<TName extends string, TInput extends z.ZodType, TOutput extends z.ZodType, const TAnswer extends LambderReadonlyDeep<z.input<TOutput>>, const TRateOpt extends LambderRateLimitOption<_TRateLimitPolicies, false> = never, const TGuardsOpt extends LambderGuardsOption<_TGuards, false> = never, const TIdempotencyOpt extends LambderApiIdempotencyOption = never, const TRefusalsOpt extends LambderRefusalsOption<_TRefusals> = never>(name: TName, schema: {
         input: TInput;
         output: TOutput;
     } & {
@@ -189,12 +189,12 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
          * both ends. A transport setting of this server's, not part of the API's contract.
          */
         compress?: boolean | "auto";
-    } & LambderRequirableGuardsField<_TPublicGuardsRequired, TGuardsOpt> & LambderObjectOutputCheck<TOutput>, 
+    } & LambderRequirableGuardsField<_TPublicGuardsRequired, TGuardsOpt> & LambderObjectOutputCheck<TOutput> & LambderPayloadSliceCheck<_TGuards, _TRateLimitPolicies, TGuardsOpt, TRateOpt, z.input<TInput>>, 
     /** Answers the call by returning its output (parsed through `output` before it is sent), or refuses it with ctx.refuse() or refuse(). */
     handler: (ctx: LambderRenderContext<z.infer<TInput>, Record<string, string>, LambderGuardDataOf<_TGuards, TGuardsOpt>, TSessionData, _TRateLimitPolicies> & {
         refuse: LambderDeclaredRefuse<LambderHandlerRefusalsOf<_TRefusals, LambderApiRefusalCodes<_TRefusals, _TGuards, TRefusalsOpt, TGuardsOpt>>, _TRefusalCodesRequired>;
     }) => MaybePromise<TAnswer>): Lambder<TSessionData, LambderMergeContract<_TContract, TName, LambderContractEntry<z.input<TInput>, LambderJsonOf<z.output<TOutput>>, "public", LambderGuardInputsOf<_TGuards, TGuardsOpt>, TGuardsOpt, TRateOpt, TIdempotencyOpt, LambderWireRefusalsOf<_TRefusals, LambderApiRefusalCodes<_TRefusals, _TGuards, TRefusalsOpt, TGuardsOpt>>>>, _TRateLimitPolicies, _TGuards, _TIdempotencyEnabled, _TSessionGuardsRequired, _TPublicGuardsRequired, _TSessionsEnabled, _TRefusals, _TRefusalCodesRequired>;
-    addSessionApi<TName extends string, TInput extends z.ZodType, TOutput extends z.ZodType, const TAnswer extends LambderReadonlyDeep<z.input<TOutput>>, const TRateOpt extends LambderRateLimitOption<_TRateLimitPolicies, z.input<TInput>, true> = never, const TGuardsOpt extends LambderGuardsOption<_TGuards, z.input<TInput>, true> = never, const TIdempotencyOpt extends LambderApiIdempotencyOption = never, const TRefusalsOpt extends LambderRefusalsOption<_TRefusals> = never>(name: TName, schema: {
+    addSessionApi<TName extends string, TInput extends z.ZodType, TOutput extends z.ZodType, const TAnswer extends LambderReadonlyDeep<z.input<TOutput>>, const TRateOpt extends LambderRateLimitOption<_TRateLimitPolicies, true> = never, const TGuardsOpt extends LambderGuardsOption<_TGuards, true> = never, const TIdempotencyOpt extends LambderApiIdempotencyOption = never, const TRefusalsOpt extends LambderRefusalsOption<_TRefusals> = never>(name: TName, schema: {
         input: TInput;
         output: TOutput;
     } & {
@@ -216,7 +216,7 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
          * both ends. A transport setting of this server's, not part of the API's contract.
          */
         compress?: boolean | "auto";
-    } & LambderRequirableGuardsField<_TSessionGuardsRequired, TGuardsOpt> & LambderSessionEnabledInstance<_TSessionsEnabled> & LambderObjectOutputCheck<TOutput>, 
+    } & LambderRequirableGuardsField<_TSessionGuardsRequired, TGuardsOpt> & LambderSessionEnabledInstance<_TSessionsEnabled> & LambderObjectOutputCheck<TOutput> & LambderPayloadSliceCheck<_TGuards, _TRateLimitPolicies, TGuardsOpt, TRateOpt, z.input<TInput>>, 
     /** Answers the call by returning its output (parsed through `output` before it is sent), or refuses it with ctx.refuse() or refuse(). */
     handler: (ctx: LambderSessionRenderContext<z.infer<TInput>, TSessionData, Record<string, string>, LambderGuardDataOf<_TGuards, TGuardsOpt>, _TRateLimitPolicies> & {
         refuse: LambderDeclaredRefuse<LambderHandlerRefusalsOf<_TRefusals, LambderApiRefusalCodes<_TRefusals, _TGuards, TRefusalsOpt, TGuardsOpt>>, _TRefusalCodesRequired>;

package/dist/core/LambderCreateOptions.d.ts

@@ -11,12 +11,12 @@ import type { LambderSessionDataRefreshConfig } from "../session/LambderSessionM
 import type { LambderSessionStore } from "../shared/contracts/LambderSessionStore.js";
 import type { LambderSessionCookieOptions } from "../session/LambderSessionController.js";
 import type { LambderSessionCrypto } from "../session/LambderSessionCrypto.js";
-import type { LambderApiGuard } from "../api/LambderApiGuards.js";
-import type { LambderApiRateLimitPolicyConfig, LambderApiRateLimitsConfig } from "../api/LambderApiRateLimits.js";
+import type { LambderApiGuard, LambderGuardNamesInputLacks } from "../api/LambderApiGuards.js";
+import type { LambderApiRateLimitPolicyConfig, LambderApiRateLimitsConfig, LambderPolicyNamesInputLacks } from "../api/LambderApiRateLimits.js";
 import type { LambderApiIdempotencyConfig } from "../api/LambderApiIdempotency.js";
 import { type LambderRefusalVocabulary } from "../api/LambderApiRefusals.js";
 import type { LambderNoExtraKeys } from "../shared/util/LambderTypeUtilities.js";
-import type { LambderJsonOf } from "../shared/wire/LambderApiContract.js";
+import type { LambderGuardNamesIn, LambderJsonOf } from "../shared/wire/LambderApiContract.js";
 import type { LambderRateLimitMessage } from "../shared/wire/LambderApiOptionValues.js";
 import type { MaybePromise } from "../shared/util/LambderTypeUtilities.js";
 export type LambderRouteHandler = (ctx: LambderRenderContext, resolver: LambderResolver) => MaybePromise<LambderResponse>;
@@ -385,6 +385,31 @@ type LambderObjectOutputRefusal = {
         readonly "lambder: an API answers with an object or an array. One with nothing to answer declares output: z.object({}) and returns {}.": never;
     };
 };
+/**
+ * An API's guards and rate limits held to its input once the input is known.
+ * Intersected onto an API's options: a guard or a policy that reads fields
+ * the input does not carry is refused on the option that names it, the
+ * property name is the message and its value the names at fault.
+ *
+ * The options' own constraints admit every name the instance declares, and
+ * the input is asked about here instead, on purpose. A constraint that reads
+ * the API's input is rebuilt for every API while that input is still being
+ * inferred, over every name the instance declares, so the compiler's work
+ * grows with an app's APIs times its keyed guards and policies, exponentially
+ * in the worst case. Here the question is asked once per API, of the names
+ * that API declared.
+ */
+export type LambderPayloadSliceCheck<TGuards, TPolicies, TGuardsOpt, TRateOpt, TPayload> = LambderGuardsSliceCheck<LambderGuardNamesInputLacks<TGuards, LambderGuardNamesIn<TGuardsOpt>, TPayload>> & LambderRateLimitSliceCheck<LambderPolicyNamesInputLacks<TPolicies, LambderGuardNamesIn<TRateOpt>, TPayload>>;
+type LambderGuardsSliceCheck<TLacking> = [TLacking] extends [never] ? unknown : {
+    guards: {
+        readonly "lambder: these guards read fields this API's input does not carry": TLacking;
+    };
+};
+type LambderRateLimitSliceCheck<TLacking> = [TLacking] extends [never] ? unknown : {
+    rateLimit: {
+        readonly "lambder: these rate limits are keyed by fields this API's input does not carry": TLacking;
+    };
+};
 /**
  * The `guards` field of an API's options: optional by default, required once
  * create() received the require*ApiGuards flag for that kind of API, so that

package/dist/index.d.ts

@@ -128,12 +128,12 @@ export type { LambderDdbIdempotencyStoreOptions } from "./stores/LambderDdbIdemp
 export { LambderMemoryIdempotencyStore } from "./stores/LambderMemoryIdempotencyStore.js";
 export { lambderGuard, lambderRateLimitKey } from "./core/LambderPolicyBuilders.js";
 export { lambderGuardBuilder } from "./api/LambderApiGuards.js";
-export type { LambderGuardBuilder, LambderApiGuard, LambderGuardMeta, LambderGuardMetaMap, LambderGuardRunAt, LambderAllowedGuardNames, LambderParamlessGuardNames, LambderGuardsOption, LambderGuardDataOf, LambderGuardInputsOf, LambderGuardRefusals, LambderGuardRefusalNamesOf, } from "./api/LambderApiGuards.js";
+export type { LambderGuardBuilder, LambderApiGuard, LambderGuardMeta, LambderGuardMetaMap, LambderGuardRunAt, LambderAllowedGuardNames, LambderGuardNamesInputLacks, LambderParamlessGuardNames, LambderGuardsOption, LambderGuardDataOf, LambderGuardInputsOf, LambderGuardRefusals, LambderGuardRefusalNamesOf, } from "./api/LambderApiGuards.js";
 export { LambderApiRefusalValidationError } from "./api/LambderApiRefusals.js";
 export type { LambderRefusalDeclaration, LambderRefusalVocabulary, LambderApiAllowedRefusal, LambderApiAllowedRefusals, LambderEndpointRefusals, LambderRefusalsOption, LambderRefusalNamesIn, LambderHandlerRefusalsOf, LambderWireRefusalsOf, } from "./api/LambderApiRefusals.js";
 export { lambderRateLimitKeyBuilder, rateLimitRefusal, DEFAULT_RATE_LIMIT_REFUSAL } from "./api/LambderApiRateLimits.js";
 export type { LambderRateLimitKeyBuilder } from "./api/LambderApiRateLimits.js";
-export type { LambderContextRateLimit, LambderContextRateLimitCheck, LambderRateLimitCheckResult, LambderChargeablePolicyNames, LambderChargeKeyArgs, LambderRateLimitKeyFn, LambderRateLimitPer, LambderRateLimitBudget, LambderRateLimitChargeAt, LambderApiRateLimitPolicyConfig, LambderApiRateLimitsConfig, LambderAllowedPolicyNames, LambderRateLimitOption, } from "./api/LambderApiRateLimits.js";
+export type { LambderContextRateLimit, LambderContextRateLimitCheck, LambderRateLimitCheckResult, LambderChargeablePolicyNames, LambderChargeKeyArgs, LambderRateLimitKeyFn, LambderRateLimitPer, LambderRateLimitBudget, LambderRateLimitChargeAt, LambderApiRateLimitPolicyConfig, LambderApiRateLimitsConfig, LambderAllowedPolicyNames, LambderPolicyNamesInputLacks, LambderRateLimitOption, } from "./api/LambderApiRateLimits.js";
 export type { LambderApiIdempotencyConfig } from "./api/LambderApiIdempotency.js";
 export type { LambderGuardsOptionValue, LambderRateLimitMessage, LambderRateLimitOverride, LambderRateLimitOptionValue, LambderRefusalsOptionValue, LambderApiIdempotencyOption, } from "./shared/wire/LambderApiOptionValues.js";
 export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "10.2.1",
+  "version": "11.0.1",
   "sideEffects": false,
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [