lambder 11.0.1 → 12.0.1

package/dist/api/LambderApiRateLimits.js

@@ -209,7 +209,7 @@ export class LambderApiRateLimitsEngine {
                 throw new Error(`Lambder: API "${apiName}" references rate-limit policy "${name}", which declares no per: its key is the one a handler passes to ctx.rateLimit("${name}", key), so the request alone cannot be counted against it.`);
             }
             if (policy.per === "session" && mode !== "session") {
-                throw new Error(`Lambder: API "${apiName}" uses rate-limit policy "${name}" (per "session"), which requires addSessionApi.`);
+                throw new Error(`Lambder: API "${apiName}" uses rate-limit policy "${name}" (per "session"), which counts per session, and none of its guards needs a session.`);
             }
             if (override)
                 assertWindowLimits(`API "${apiName}" override of rate-limit policy "${name}"`, override);

package/dist/api/LambderApiRequest.d.ts

@@ -18,7 +18,15 @@ export declare const lowercaseHeaderNames: (headers: Record<string, string | und
  * transport request, and from here on nothing in the pipeline knows which.
  */
 export type LambderApiRequest = {
+    /** The endpoint called: `group.action`, read off the path the call was posted to (`{apiPath}/{group}/{action}`). */
     apiName: string;
+    /**
+     * Set on a call posted to apiPath itself with the endpoint named in the
+     * body, the way callers did before endpoints had paths: such a caller is a
+     * page loaded from an older build, and it is answered that its version
+     * expired, which reloads it.
+     */
+    retiredPath?: true;
     /** The caller's apiVersion, informational; null when it sent none. */
     version: string | null;
     /** The signature the caller carries for this endpoint (see LambderApiSignatureMap), for the signature gate; null when it sent none. */
@@ -79,13 +87,14 @@ export type LambderApiRequestInfo = {
  */
 export declare const isApiCallContentType: (lowercasedHeaders: Record<string, string | undefined>) => boolean;
 /**
- * Reads the posted envelope into a request. Null when the body carries no
- * apiName, which is how the server tells an API call from a route with a
- * JSON body. Everything is taken as posted: a malformed idempotencyKey or
- * guardInputs value is the engines' to refuse, with the client-facing
- * message they already give.
+ * Reads the posted envelope of a call to `apiName` into a request; the name
+ * comes from where the call was posted, never from the body. Everything is
+ * taken as posted: a malformed idempotencyKey or guardInputs value is the
+ * engines' to refuse, with the client-facing message they already give.
  */
-export declare const readApiEnvelope: (post: Record<string, unknown> | null | undefined, info: LambderApiRequestInfo) => LambderApiRequest | null;
+export declare const readApiEnvelope: (post: Record<string, unknown> | null | undefined, info: LambderApiRequestInfo, apiName: string, flags?: {
+    retiredPath?: true;
+}) => LambderApiRequest;
 /** Outcome of restoring a compressed request payload; the message is client-facing. */
 export type LambderRestorePayloadResult = {
     ok: true;

package/dist/api/LambderApiRequest.js

@@ -43,20 +43,19 @@ export const lowercaseHeaderNames = (headers) => {
  */
 export const isApiCallContentType = (lowercasedHeaders) => (lowercasedHeaders["content-type"] ?? "").split(";")[0].trim().toLowerCase() === "application/json";
 /**
- * Reads the posted envelope into a request. Null when the body carries no
- * apiName, which is how the server tells an API call from a route with a
- * JSON body. Everything is taken as posted: a malformed idempotencyKey or
- * guardInputs value is the engines' to refuse, with the client-facing
- * message they already give.
+ * Reads the posted envelope of a call to `apiName` into a request; the name
+ * comes from where the call was posted, never from the body. Everything is
+ * taken as posted: a malformed idempotencyKey or guardInputs value is the
+ * engines' to refuse, with the client-facing message they already give.
  */
-export const readApiEnvelope = (post, info) => {
-    if (!post || typeof post.apiName !== "string" || !post.apiName)
-        return null;
+export const readApiEnvelope = (post, info, apiName, flags = {}) => {
+    post ??= {};
     const hasGzip = post[COMPRESSED_PAYLOAD_GZ_FIELD] !== undefined;
     const hasBrotli = post[COMPRESSED_PAYLOAD_BR_FIELD] !== undefined;
     const guardInputs = post.guardInputs;
     return {
-        apiName: post.apiName,
+        apiName,
+        ...(flags.retiredPath ? { retiredPath: true } : {}),
         version: typeof post.version === "string" ? post.version : null,
         signature: typeof post.signature === "string" ? post.signature : null,
         token: typeof post.token === "string" ? post.token : "",

package/dist/build/generatedTables.d.ts

@@ -2,7 +2,8 @@ import type { LambderApiOptionEntries } from "../shared/wire/LambderApiOptionEnt
 import { type LambderModuleLocation } from "./moduleLocation.js";
 /** What the generators read the options from: a Lambder instance, or anything else that reports them the same way. */
 export type LambderApiOptionsSource = {
-    apiOptionEntries(): LambderApiOptionEntries;
+    /** Asynchronous, since a Lambder instance loads its lazy groups before it can report every endpoint. */
+    apiOptionEntries(): Promise<LambderApiOptionEntries> | LambderApiOptionEntries;
 };
 /** Which names of one table moved: entries that changed, entries the file did not have, entries the file had and the instance no longer reports. */
 export type LambderNameChanges = {

package/dist/build/generatedTables.js

@@ -16,7 +16,7 @@ export const loadApiOptionEntries = async (location, generator) => {
     if (typeof source?.apiOptionEntries !== "function") {
         throw new Error(`${moduleUrl} has no export "${exportName}" that reports API options: name the export holding the instance in exportName`);
     }
-    return source.apiOptionEntries();
+    return await source.apiOptionEntries();
 };
 /** One table of a generated file, read back as data, or null for a file that does not hold it as written. */
 export const readGeneratedTable = (contents, exportName) => {

package/dist/client/LambderCaller.d.ts

@@ -5,6 +5,7 @@ import { type LambderApiOutcome, type LambderValidationError } from '../shared/w
 import { type LambderCallArgs, type LambderContractOutputOf, type LambderGuardInputsProviderOption, type LambderSharedCallOptions } from '../shared/wire/LambderCallOptions.js';
 import { type LambderApiTransport } from '../shared/transport/LambderApiTransport.js';
 import { type LambderApiSignatureMap } from '../shared/wire/LambderApiSignatureMap.js';
+import { type LambderContractActionOf, type LambderContractGroupsOf, type LambderContractNamesInGroup } from '../shared/wire/LambderApiGroupCalls.js';
 export type { LambderApiOutcome, LambderApiFailureReason, LambderValidationError } from '../shared/wire/LambderApiOutcome.js';
 export type { LambderProvidedGuardInputs, LambderGuardInputsProvider } from '../shared/wire/LambderCallOptions.js';
 /** A handler told that something happened, with nothing to hand it. */
@@ -110,40 +111,23 @@ type LambderCallerBaseOptions<TMessage extends LambderUncheckedRefusalMessage =
 /** Constructor options: the base options plus guardInputsProvider, mandatory once TProvided names guards. */
 export type LambderCallerOptions<TContract, TProvided extends string = never> = LambderCallerBaseOptions<LambderContractAnyRefusalMessage<TContract>> & LambderGuardInputsProviderOption<TContract, TProvided>;
 /**
+ * The caller itself, before the groups: what LambderCaller is, less the
+ * endpoints it reaches by group (LambderCallerGroupCalls), which the
+ * constructor adds.
+ *
  * @typeParam TContract - The API contract, for typed names, payloads and guard inputs.
  * @typeParam TProvidedGuards - Guard names guardInputsProvider covers; those APIs' options argument becomes optional.
  */
-export default class LambderCaller<TContract extends LambderApiContractShape = any, TProvidedGuards extends string = never> {
-    private apiPath;
-    private apiVersion?;
-    private apiSignatures?;
-    private timeoutMs?;
+declare class LambderCallerCore<TContract extends LambderApiContractShape = any, TProvidedGuards extends string = never> {
+    #private;
     /** The calls currently in flight, in the order they started. */
     fetchTrackerList: FetchTracker[];
     /** Whether any call is in flight. Derived from the list, so the two cannot drift apart. */
     get isLoading(): boolean;
-    private versionExpiredHandler?;
-    private sessionExpiredHandler?;
-    private refusalHandler?;
-    private notAuthorizedHandler?;
-    private errorHandler?;
-    private apiInputValidationErrorHandler?;
-    private logListHandler?;
-    private fetchStartedHandler?;
-    private fetchEndedHandler?;
-    private guardInputsProvider?;
-    private sessionTokenCookieKey;
-    private sessionCsrfCookieKey;
-    private sessionCookieDomain?;
-    private requestCompression;
-    private transport;
     constructor(options: LambderCallerOptions<TContract, TProvidedGuards>);
     setSessionCookieKey(sessionTokenCookieKey: string, sessionCsrfCookieKey: string): void;
     /** Replaces how calls reach the server: a mock runtime, an in-process handler, a decorated transport. */
     setTransport(transport: LambderApiTransport): this;
-    private clearSessionCookies;
-    /** One call, one outcome. Never throws; every failure path resolves to { ok: false }. */
-    private dispatch;
     /**
      * Full-fidelity call: resolves to a discriminated LambderApiOutcome
      * instead of collapsing every failure to undefined. Never throws. A
@@ -164,3 +148,32 @@ export default class LambderCaller<TContract extends LambderApiContractShape = a
      */
     api<TApiName extends keyof TContract & string = string>(apiName: TApiName, ...rest: LambderCallArgs<TContract, TApiName, TProvidedGuards, LambderCallOptions<LambderContractRefusalMessage<TContract, TApiName>>>): Promise<LambderContractOutputOf<TContract, TApiName> | undefined>;
 }
+/**
+ * One endpoint as a caller hands it out on its group: called, it is `api`
+ * for that endpoint (the output, or undefined on a failure); `.outcome` is
+ * `apiOutcome` (the full outcome, never throwing).
+ */
+export type LambderCallerEndpoint<TContract, TName extends keyof TContract & string, TProvidedGuards extends string> = {
+    (...args: LambderCallArgs<TContract, TName, TProvidedGuards, LambderCallOptions<LambderContractRefusalMessage<TContract, TName>>>): Promise<LambderContractOutputOf<TContract, TName> | undefined>;
+    outcome(...args: LambderCallArgs<TContract, TName, TProvidedGuards, LambderCallOptions<LambderContractRefusalMessage<TContract, TName>>>): Promise<LambderApiOutcome<LambderContractOutputOf<TContract, TName>, LambderContractRefusalMessage<TContract, TName>>>;
+};
+/** Every endpoint of a contract, by group: `caller.orders.place(input)`. */
+export type LambderCallerGroupCalls<TContract, TProvidedGuards extends string> = {
+    readonly [TGroup in LambderContractGroupsOf<TContract>]: {
+        readonly [TName in LambderContractNamesInGroup<TContract, TGroup> as LambderContractActionOf<TName>]: LambderCallerEndpoint<TContract, TName, TProvidedGuards>;
+    };
+};
+/**
+ * A typed client of a Lambder app: `caller.orders.place(input)` for the
+ * endpoint `orders.place`, `caller.orders.place.outcome(input)` for its full
+ * outcome, and `caller.api("orders.place", input)` for code that has the
+ * name as a value.
+ */
+type LambderCaller<TContract extends LambderApiContractShape = any, TProvidedGuards extends string = never> = LambderCallerCore<TContract, TProvidedGuards> & LambderCallerGroupCalls<TContract, TProvidedGuards>;
+/** The caller's own members, without the groups: what a wrapper of a caller (the test visitor) types its `api` and `apiOutcome` by. */
+export type LambderCallerMembers<TContract extends LambderApiContractShape = any, TProvidedGuards extends string = never> = LambderCallerCore<TContract, TProvidedGuards>;
+declare const LambderCaller: {
+    new <TContract extends LambderApiContractShape = any, TProvidedGuards extends string = never>(options: LambderCallerOptions<TContract, TProvidedGuards>): LambderCaller<TContract, TProvidedGuards>;
+    readonly prototype: LambderCallerCore<any, any>;
+};
+export default LambderCaller;

package/dist/client/LambderCaller.js

@@ -11,6 +11,8 @@ import { DEFAULT_SESSION_TOKEN_COOKIE_KEY, DEFAULT_SESSION_CSRF_COOKIE_KEY } fro
 import { readApiSignature } from '../shared/wire/LambderApiSignatureMap.js';
 import { LambderReloadLoopBreaker, RELOAD_LOOP_WINDOW_MS } from './LambderReloadLoopBreaker.js';
 import { lambderFetchTransport } from './lambderFetchTransport.js';
+import { withApiGroupCalls } from '../shared/wire/LambderApiGroupCalls.js';
+import { splitApiName } from '../shared/wire/LambderApiNames.js';
 /**
  * What keeps a stale bundle from reloading itself forever (see the class):
  * one for the page, shared by every caller it builds, since a reload is the
@@ -19,74 +21,82 @@ import { lambderFetchTransport } from './lambderFetchTransport.js';
  */
 const pageReloadLoopBreaker = new LambderReloadLoopBreaker();
 /**
+ * The caller itself, before the groups: what LambderCaller is, less the
+ * endpoints it reaches by group (LambderCallerGroupCalls), which the
+ * constructor adds.
+ *
  * @typeParam TContract - The API contract, for typed names, payloads and guard inputs.
  * @typeParam TProvidedGuards - Guard names guardInputsProvider covers; those APIs' options argument becomes optional.
  */
-export default class LambderCaller {
-    apiPath;
-    apiVersion;
-    apiSignatures;
-    timeoutMs;
+class LambderCallerCore {
+    #apiPath;
+    #apiVersion;
+    #apiSignatures;
+    #timeoutMs;
     /** The calls currently in flight, in the order they started. */
     fetchTrackerList = [];
     /** Whether any call is in flight. Derived from the list, so the two cannot drift apart. */
     get isLoading() { return this.fetchTrackerList.length > 0; }
-    versionExpiredHandler;
-    sessionExpiredHandler;
+    #versionExpiredHandler;
+    #sessionExpiredHandler;
     // Hears every endpoint's refusals, so held at the widest message: the
     // constructor option types it to the contract's codes, and dispatch,
     // generic over one endpoint's message, hands it one of those.
-    refusalHandler;
-    notAuthorizedHandler;
-    errorHandler;
-    apiInputValidationErrorHandler;
-    logListHandler;
-    fetchStartedHandler;
-    fetchEndedHandler;
-    guardInputsProvider;
-    sessionTokenCookieKey = DEFAULT_SESSION_TOKEN_COOKIE_KEY;
-    sessionCsrfCookieKey = DEFAULT_SESSION_CSRF_COOKIE_KEY;
-    sessionCookieDomain;
-    requestCompression;
-    transport;
+    #refusalHandler;
+    #notAuthorizedHandler;
+    #errorHandler;
+    #apiInputValidationErrorHandler;
+    #logListHandler;
+    #fetchStartedHandler;
+    #fetchEndedHandler;
+    #guardInputsProvider;
+    #sessionTokenCookieKey = DEFAULT_SESSION_TOKEN_COOKIE_KEY;
+    #sessionCsrfCookieKey = DEFAULT_SESSION_CSRF_COOKIE_KEY;
+    #sessionCookieDomain;
+    #requestCompression;
+    #transport;
     constructor(options) {
         // The conditional provider option is resolved per instantiation;
         // inside the class it is read through the plain shape.
         const { apiPath, apiVersion, apiSignatures, isCorsEnabled, timeoutMs, versionExpiredHandler, sessionExpiredHandler, refusalHandler, notAuthorizedHandler, errorHandler, logListHandler, fetchStartedHandler, fetchEndedHandler, apiInputValidationErrorHandler, sessionCookieDomain, requestCompression, guardInputsProvider, transport, } = options;
-        this.apiPath = apiPath;
-        this.apiVersion = apiVersion;
-        this.apiSignatures = apiSignatures;
-        this.timeoutMs = timeoutMs;
-        this.sessionCookieDomain = sessionCookieDomain;
+        this.#apiPath = apiPath;
+        this.#apiVersion = apiVersion;
+        this.#apiSignatures = apiSignatures;
+        this.#timeoutMs = timeoutMs;
+        this.#sessionCookieDomain = sessionCookieDomain;
         // `?? false`: unlike the at-rest stores, this one is off unless asked for.
-        this.requestCompression = resolveCompressionOption(requestCompression ?? false, DEFAULT_REQUEST_COMPRESSION_SETTINGS);
-        this.transport = transport ?? lambderFetchTransport({ cors: isCorsEnabled });
-        this.versionExpiredHandler = versionExpiredHandler;
-        this.sessionExpiredHandler = sessionExpiredHandler;
-        this.refusalHandler = refusalHandler;
-        this.notAuthorizedHandler = notAuthorizedHandler;
-        this.errorHandler = errorHandler;
-        this.apiInputValidationErrorHandler = apiInputValidationErrorHandler;
-        this.logListHandler = logListHandler;
-        this.fetchStartedHandler = fetchStartedHandler;
-        this.fetchEndedHandler = fetchEndedHandler;
-        this.guardInputsProvider = guardInputsProvider;
+        this.#requestCompression = resolveCompressionOption(requestCompression ?? false, DEFAULT_REQUEST_COMPRESSION_SETTINGS);
+        this.#transport = transport ?? lambderFetchTransport({ cors: isCorsEnabled });
+        this.#versionExpiredHandler = versionExpiredHandler;
+        this.#sessionExpiredHandler = sessionExpiredHandler;
+        this.#refusalHandler = refusalHandler;
+        this.#notAuthorizedHandler = notAuthorizedHandler;
+        this.#errorHandler = errorHandler;
+        this.#apiInputValidationErrorHandler = apiInputValidationErrorHandler;
+        this.#logListHandler = logListHandler;
+        this.#fetchStartedHandler = fetchStartedHandler;
+        this.#fetchEndedHandler = fetchEndedHandler;
+        this.#guardInputsProvider = guardInputsProvider;
+        // Each group of the contract, as a property: caller.orders.place(input)
+        // is caller.api("orders.place", input), and .outcome the apiOutcome.
+        const byName = this;
+        return withApiGroupCalls(this, (apiName, args) => byName.api(apiName, ...args), (apiName, args) => byName.apiOutcome(apiName, ...args));
     }
     ;
     setSessionCookieKey(sessionTokenCookieKey, sessionCsrfCookieKey) {
-        this.sessionTokenCookieKey = sessionTokenCookieKey;
-        this.sessionCsrfCookieKey = sessionCsrfCookieKey;
+        this.#sessionTokenCookieKey = sessionTokenCookieKey;
+        this.#sessionCsrfCookieKey = sessionCsrfCookieKey;
     }
     /** Replaces how calls reach the server: a mock runtime, an in-process handler, a decorated transport. */
     setTransport(transport) {
-        this.transport = transport;
+        this.#transport = transport;
         return this;
     }
-    clearSessionCookies() {
-        const domainOption = this.sessionCookieDomain;
+    #clearSessionCookies() {
+        const domainOption = this.#sessionCookieDomain;
         const hostname = globalThis.location?.hostname ?? "";
         const resolvedDomain = typeof domainOption === "function" ? domainOption(hostname) : domainOption;
-        for (const key of [this.sessionTokenCookieKey, this.sessionCsrfCookieKey]) {
+        for (const key of [this.#sessionTokenCookieKey, this.#sessionCsrfCookieKey]) {
             // Host-only and domain-scoped cookies are distinct entries; clear both.
             // Only the CSRF cookie is reachable from here: the token cookie is
             // HttpOnly, so its removal is the server's (a Set-Cookie on the
@@ -97,17 +107,17 @@ export default class LambderCaller {
         }
     }
     /** One call, one outcome. Never throws; every failure path resolves to { ok: false }. */
-    async dispatch(apiName, payload, options) {
+    async #dispatch(apiName, payload, options) {
         // Per-call overrides win over the constructor handlers.
-        const versionExpiredHandler = options?.versionExpiredHandler ?? this.versionExpiredHandler;
-        const sessionExpiredHandler = options?.sessionExpiredHandler ?? this.sessionExpiredHandler;
-        const refusalHandler = options?.refusalHandler ?? this.refusalHandler;
-        const notAuthorizedHandler = options?.notAuthorizedHandler ?? this.notAuthorizedHandler;
-        const errorHandler = options?.errorHandler ?? this.errorHandler;
-        const apiInputValidationErrorHandler = options?.apiInputValidationErrorHandler ?? this.apiInputValidationErrorHandler;
-        const logListHandler = options?.logListHandler ?? this.logListHandler;
-        const fetchStartedHandler = options?.fetchStartedHandler ?? this.fetchStartedHandler;
-        const fetchEndedHandler = options?.fetchEndedHandler ?? this.fetchEndedHandler;
+        const versionExpiredHandler = options?.versionExpiredHandler ?? this.#versionExpiredHandler;
+        const sessionExpiredHandler = options?.sessionExpiredHandler ?? this.#sessionExpiredHandler;
+        const refusalHandler = options?.refusalHandler ?? this.#refusalHandler;
+        const notAuthorizedHandler = options?.notAuthorizedHandler ?? this.#notAuthorizedHandler;
+        const errorHandler = options?.errorHandler ?? this.#errorHandler;
+        const apiInputValidationErrorHandler = options?.apiInputValidationErrorHandler ?? this.#apiInputValidationErrorHandler;
+        const logListHandler = options?.logListHandler ?? this.#logListHandler;
+        const fetchStartedHandler = options?.fetchStartedHandler ?? this.#fetchStartedHandler;
+        const fetchEndedHandler = options?.fetchEndedHandler ?? this.#fetchEndedHandler;
         const headers = options?.headers;
         const fetchTracker = { apiName };
         // A key scope sends its current key and is told how the attempt
@@ -147,7 +157,7 @@ export default class LambderCaller {
         };
         // Timeout and abort wiring, shared with LambderInvokeCaller so the two
         // cannot drift on what a late or abandoned call means.
-        const abort = createCallAbort({ timeoutMs: options?.timeoutMs ?? this.timeoutMs, signal: options?.signal });
+        const abort = createCallAbort({ timeoutMs: options?.timeoutMs ?? this.#timeoutMs, signal: options?.signal });
         const signal = abort.signal;
         /** Reports a call that was given up on, or null while it still stands. */
         const abandonedOutcome = async (stage) => {
@@ -161,21 +171,30 @@ export default class LambderCaller {
             return outcome;
         };
         try {
+            // A name that is not group.action names no endpoint and no path:
+            // a caller's mistake, reported as one before anything is sent,
+            // rather than as the network failure its transport would throw.
+            if (!splitApiName(apiName)) {
+                idempotentAttempt.settle(IDEMPOTENT_ATTEMPT_NOT_SENT);
+                const error = new Error(`Lambder: "${apiName}" is not an endpoint name. An endpoint is named group.action, both identifiers.`);
+                await reportError(error);
+                return { ok: false, reason: 'unknown', error };
+            }
             this.fetchTrackerList.push(fetchTracker);
             if (fetchStartedHandler)
                 await fetchStartedHandler({
                     fetchParams: { apiName, payload, headers, },
                     activeFetchList: [...this.fetchTrackerList],
                 });
-            const version = this.apiVersion;
+            const version = this.#apiVersion;
             // The server's signature for this endpoint, when this build
             // carries the map. A name the map lacks fails the call here, as a
             // provider that threw would: the map predates the endpoint.
-            const signature = this.apiSignatures ? await readApiSignature(this.apiSignatures, apiName) : undefined;
+            const signature = this.#apiSignatures ? await readApiSignature(this.#apiSignatures, apiName) : undefined;
             const siteHost = globalThis.location?.hostname ?? "";
             // Provider values underneath, per-call values on top.
-            const providedGuardInputs = this.guardInputsProvider
-                ? await this.guardInputsProvider(apiName)
+            const providedGuardInputs = this.#guardInputsProvider
+                ? await this.#guardInputsProvider(apiName)
                 : undefined;
             const guardInputs = mergeGuardInputs(providedGuardInputs, options?.guardInputs);
             // Compressed when enabled and the payload's JSON reaches the
@@ -183,7 +202,7 @@ export default class LambderCaller {
             // without CompressionStream always sends the payload plainly.
             // Nothing here runs (the extra stringify included) unless
             // compression is actually a possibility for this call.
-            const compressionMinBytes = resolveRequestCompressionMinBytes(options?.compressRequest, this.requestCompression);
+            const compressionMinBytes = resolveRequestCompressionMinBytes(options?.compressRequest, this.#requestCompression);
             const compressedPayload = compressionMinBytes !== null && payload !== undefined && isRequestCompressionAvailable()
                 ? await compressPayloadGzip(JSON.stringify(payload), compressionMinBytes)
                 : null;
@@ -199,15 +218,15 @@ export default class LambderCaller {
             // cookie with the old token. js-cookie reads nothing without a
             // document: the token is "" then, and a transport that carries a
             // cookie jar fills it in from there.
-            const token = Cookies.get(this.sessionCsrfCookieKey) || "";
+            const token = Cookies.get(this.#sessionCsrfCookieKey) || "";
             let answer;
             try {
                 sent = true;
-                answer = await this.transport({
-                    apiPath: this.apiPath,
+                answer = await this.#transport({
+                    apiPath: this.#apiPath,
                     apiName, version, token, siteHost,
                     ...(signature !== undefined ? { signature } : {}),
-                    csrfCookieKey: this.sessionCsrfCookieKey,
+                    csrfCookieKey: this.#sessionCsrfCookieKey,
                     ...(compressedPayload ? { compressed: compressedPayload } : { payload }),
                     ...(guardInputs !== undefined ? { guardInputs } : {}),
                     ...(idempotencyKey !== undefined ? { idempotencyKey } : {}),
@@ -307,10 +326,10 @@ export default class LambderCaller {
                 // token it posted and the one it holds, since the page's
                 // cookie is not where that session lives.
                 const postedToken = answer.csrfTokens?.posted ?? token;
-                const heldToken = answer.csrfTokens ? answer.csrfTokens.held() : Cookies.get(this.sessionCsrfCookieKey) || "";
+                const heldToken = answer.csrfTokens ? answer.csrfTokens.held() : Cookies.get(this.#sessionCsrfCookieKey) || "";
                 if (heldToken !== "" && heldToken !== postedToken)
                     return outcome;
-                this.clearSessionCookies();
+                this.#clearSessionCookies();
                 if (sessionExpiredHandler) {
                     await sessionExpiredHandler();
                 }
@@ -372,7 +391,7 @@ export default class LambderCaller {
         // elements read as unknown from inside; the contract shaped them on
         // the way in, which is where the guarantee belongs.
         const [payload, options] = rest;
-        return await this.dispatch(apiName, payload, options);
+        return await this.#dispatch(apiName, payload, options);
     }
     ;
     /**
@@ -384,7 +403,9 @@ export default class LambderCaller {
      */
     async api(apiName, ...rest) {
         const [payload, options] = rest;
-        const outcome = await this.dispatch(apiName, payload, options);
+        const outcome = await this.#dispatch(apiName, payload, options);
         return outcome.ok ? outcome.payload : undefined;
     }
 }
+const LambderCaller = LambderCallerCore;
+export default LambderCaller;

package/dist/client/lambderFetchTransport.js

@@ -1,4 +1,5 @@
 import { buildTransportEnvelope, LambderTransportFailure } from "../shared/transport/LambderApiTransport.js";
+import { apiCallPath } from "../shared/wire/LambderApiNames.js";
 /**
  * fetch, with a clearer error for one failure. Outside a page a relative
  * apiPath has nothing to resolve against, so fetch rejects with a URL parse
@@ -51,7 +52,7 @@ export const lambderFetchTransport = (options = {}) => async (request) => {
     // ("text/plain, application/json") rather than give way to it.
     const owned = new Set(['content-type', ...(request.cookies?.length ? ['cookie'] : [])]);
     const callerHeaders = Object.fromEntries(Object.entries(request.headers ?? {}).filter(([name]) => !owned.has(name.toLowerCase())));
-    const response = await fetchOrExplain(request.apiPath, {
+    const response = await fetchOrExplain(apiCallPath(request.apiPath, request.apiName), {
         method: 'POST', cache: 'no-cache',
         // Cross-origin API hosts need CORS mode and included credentials.
         mode: cors ? 'cors' : 'same-origin',

package/dist/client.d.ts

@@ -20,7 +20,9 @@ export type { LambderApiSignatureMap } from "./shared/wire/LambderApiSignatureMa
 export { RELOAD_LOOP_WINDOW_MS } from "./client/LambderReloadLoopBreaker.js";
 export { compareDottedVersions, isDottedVersion } from "./shared/wire/LambderVersionOrder.js";
 export type { LambderApiAnswerOutcome, LambderApiSuccessOutcome, LambderApiCallFailure, LambderApiValidationFailure, LambderApiEnvelopeFailure, LambderApiHttpAnswer, } from "./shared/wire/LambderApiOutcome.js";
-export type { LambderApiOutcome, LambderApiFailureReason, LambderValidationError, LambderCallOptions, LambderCallerOptions, LambderGuardInputsProvider, LambderProvidedGuardInputs, LambderLogListHandler, } from "./client/LambderCaller.js";
+export type { LambderApiOutcome, LambderApiFailureReason, LambderValidationError, LambderCallOptions, LambderCallerOptions, LambderGuardInputsProvider, LambderProvidedGuardInputs, LambderLogListHandler, LambderCallerEndpoint, LambderCallerGroupCalls, LambderCallerMembers, } from "./client/LambderCaller.js";
+export { apiCallPath, splitApiName, LAMBDER_RESERVED_GROUP_NAMES, LAMBDER_RESERVED_ACTION_NAMES } from "./shared/wire/LambderApiNames.js";
+export type { LambderContractGroupsOf, LambderContractNamesInGroup, LambderContractActionOf } from "./shared/wire/LambderApiGroupCalls.js";
 export { createIdempotencyKey, createIdempotencyKeyScope } from "./shared/wire/LambderIdempotencyKeyScope.js";
 export type { LambderIdempotencyKeyScope } from "./shared/wire/LambderIdempotencyKeyScope.js";
 export { LambderApiRefusal, isLambderApiRefusal, isLambderRefusalCode, refuse, refusalMessageOf, LAMBDER_REFUSAL_CODES } from "./shared/wire/LambderApiRefusal.js";

package/dist/client.js

@@ -19,6 +19,8 @@ export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";
 export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignatureMap.js";
 export { RELOAD_LOOP_WINDOW_MS } from "./client/LambderReloadLoopBreaker.js";
 export { compareDottedVersions, isDottedVersion } from "./shared/wire/LambderVersionOrder.js";
+// How an endpoint is named, and where a call to it goes.
+export { apiCallPath, splitApiName, LAMBDER_RESERVED_GROUP_NAMES, LAMBDER_RESERVED_ACTION_NAMES } from "./shared/wire/LambderApiNames.js";
 export { createIdempotencyKey, createIdempotencyKeyScope } from "./shared/wire/LambderIdempotencyKeyScope.js";
 // Typed API refusals (isomorphic: shared code may throw them from anywhere;
 // in the browser they are plain Errors).