lambder 12.0.1 → 14.0.1

package/dist/build/writeApiGuardParams.js

@@ -1,32 +1,128 @@
 import { existsSync, readFileSync } from "fs";
 import { resolve } from "path";
-import { apiGuardParam } from "../shared/wire/LambderApiOptionEntries.js";
-import { headerLinesOf, loadApiOptionEntries, nameChangesOf, readGeneratedTable, settleGeneratedFile, tableStatementLines, } from "./generatedTables.js";
+import { apiGuardParam, apiGuardParamExportName } from "../shared/wire/LambderApiOptionEntries.js";
+import { headerLinesOf, loadApiOptionEntries, nameChangesOf, settleGeneratedFile, } from "./generatedTables.js";
 /*
- * One guard's parameters as a generated module a browser may carry: for each
- * API that declares the guard, the parameter it gives it, and nothing else
- * about any API.
+ * One guard's parameters as a generated module a browser may carry: one
+ * export per API that declares the guard, holding the parameter it gives it,
+ * and nothing else about any API.
  *
  * The file writeApiOptions writes holds every declaration, because a mock
  * and a test need every declaration. A screen that decides whether to offer
  * a control by the permission an endpoint's guard asks needs one guard's
- * parameter, and a browser that imports the whole table as a value carries
- * every API name, every mode and every guard's parameter, a reviewer's
- * reason beside an open endpoint included. This is the least that screen
- * needs: the names of the APIs behind the guard (which the client calls, so
- * its own code names them already) and what each asks.
+ * parameter, for the endpoints it gates on. A table of them would still hand
+ * every page that imports it the name of every API behind the guard and what
+ * each asks, whichever of them its screens use. One export per API lets the
+ * bundler keep exactly the ones the client imports, and keep no name at all:
+ * the API's name sits in the export's type and doc comment, which a build
+ * strips, and in its identifier, which a minifier renames.
+ *
+ * Each export is tagged with its API's name and the guard's
+ * (LambderApiGuardParam), in types alone. A client function typed to the
+ * tagged parameters takes only generated ones, so a hand-written literal,
+ * which would restate the server's declaration and could drift from it, does
+ * not compile.
  */
-const TABLE_NAME = "guardParams";
+/** The tag type every export is asserted to, imported from the client entry, which is safe in a browser. */
+const TAG_TYPE = "LambderApiGuardParam";
 const defaultHeader = (guard) => [
     "Generated by writeApiGuardParams() from lambder/build. Do not edit.",
     "",
     `The parameter each API the server guards with "${guard}" gives that guard,`,
-    "and nothing else about any API: what a client decides with it, without",
-    "carrying the server's other declarations.",
+    "one export per API and nothing else about any API: a client imports the",
+    "ones its screens gate on, and its bundle carries those alone.",
 ].join("\n");
 /**
- * Writes one guard's parameters as a module of plain data, or checks the one
- * on disk, and says which APIs moved.
+ * A plain-data value as the type `as const` gives it: its literals, readonly
+ * all the way down. What each export is asserted to beside its tag, so the
+ * tagged type keeps the literal the API declared.
+ */
+const constTypeOf = (value) => {
+    if (Array.isArray(value))
+        return `readonly [${value.map(constTypeOf).join(", ")}]`;
+    if (value !== null && typeof value === "object") {
+        const members = Object.entries(value).map(([key, member]) => `readonly ${JSON.stringify(key)}: ${constTypeOf(member)}`);
+        return members.length ? `{ ${members.join("; ")} }` : "{}";
+    }
+    return JSON.stringify(value);
+};
+/**
+ * One API's export as written, less the statement's semicolon: `export const
+ * <name> = <JSON> as const as LambderApiGuardParam<"<api>", "<guard>", <type>>`.
+ * A check renders each export it reads back again and compares the two, so
+ * the identifier a client imports, the guard and the literal type are held
+ * to what this writer would write, not only the value.
+ */
+const exportLineOf = (name, param, guard) => `export const ${apiGuardParamExportName(name)} = ${JSON.stringify(param)} as const as ${TAG_TYPE}<${JSON.stringify(name)}, ${JSON.stringify(guard)}, ${constTypeOf(param)}>`;
+/** The start of one export, far enough to read back its parameter's JSON and its API's name. */
+const EXPORT_LINE = new RegExp(`^export const [A-Za-z_$][\\w$]* = (.+) as const as ${TAG_TYPE}<("(?:[^"\\\\]|\\\\.)*"), `);
+/** The tag's import, in whatever spacing and quotes a formatter gives it, since no `// prettier-ignore` sits above it. */
+const IMPORT_LINE = new RegExp(`^import type \\{\\s*${TAG_TYPE}\\s*\\} from (["'])lambder/client\\1;?$`);
+/** The empty module of a guard no API declares, however a formatter spaces it. */
+const EMPTY_EXPORT_LINE = /^export \{\s*\};?$/;
+/**
+ * The parameters a file already holds, by API name, or null for a file that
+ * does not hold them as written. As written means the tag's import and one
+ * export per API, each the line exportLineOf renders for its API and value,
+ * or the empty module alone for a guard no API declares. Anything else makes
+ * it null: another statement, an export renamed by hand or written for
+ * another guard, an API exported twice, a missing import, a file with no
+ * statement at all. Comments, blank lines, re-indentation, line endings and
+ * the semicolons change nothing.
+ */
+const readGuardParams = (contents, guard) => {
+    const params = {};
+    let imported = false;
+    let empty = false;
+    for (const line of contents.split(/\r?\n/).map((text) => text.trim())) {
+        if (line === "" || line.startsWith("//") || line.startsWith("/*") || line.startsWith("*"))
+            continue;
+        if (IMPORT_LINE.test(line)) {
+            imported = true;
+            continue;
+        }
+        if (EMPTY_EXPORT_LINE.test(line)) {
+            empty = true;
+            continue;
+        }
+        const match = EXPORT_LINE.exec(line);
+        if (!match)
+            return null;
+        try {
+            const param = JSON.parse(match[1]);
+            const name = JSON.parse(match[2]);
+            if (typeof name !== "string" || Object.prototype.hasOwnProperty.call(params, name))
+                return null;
+            if (line.replace(/;$/, "") !== exportLineOf(name, param, guard))
+                return null;
+            params[name] = param;
+        }
+        catch {
+            return null;
+        }
+    }
+    const held = Object.keys(params).length > 0 ? imported && !empty : empty && !imported;
+    return held ? params : null;
+};
+/** The file's statements after its header: the tag's import and one export per API, or an empty export for a guard no API declares. */
+const statementLinesOf = (params, guard, semicolon) => {
+    const names = Object.keys(params);
+    if (names.length === 0)
+        return [`export {}${semicolon}`];
+    return [
+        `import type { ${TAG_TYPE} } from "lambder/client"${semicolon}`,
+        ...names.flatMap((name) => [
+            "",
+            `/** What ${name} gives the "${guard}" guard. */`,
+            // Keeps a formatter off the JSON a check reads back.
+            "// prettier-ignore",
+            `${exportLineOf(name, params[name], guard)}${semicolon}`,
+        ]),
+    ];
+};
+/**
+ * Writes one guard's parameters as a module of one export per API, or checks
+ * the one on disk, and says which APIs moved.
  *
  * ```ts
  * import { writeApiGuardParams } from "lambder/build";
@@ -40,11 +136,12 @@ const defaultHeader = (guard) => [
  * });
  * ```
  *
- * The module exports `guardParams`, `as const`, so a client reads its types
- * straight off it: `keyof typeof guardParams` is the APIs behind the guard,
- * and `(typeof guardParams)[K]` the literal API K declared, `true` for a
- * guard named without a parameter (the string and list forms). A parameter
- * that is not plain data fails the write, as it does for writeApiOptions.
+ * API `orders.list` exports `ordersListGuardParam`: the literal it declared,
+ * `true` for a guard named without a parameter (the string and list forms),
+ * typed LambderApiGuardParam<"orders.list", "store", literal>. Two APIs whose
+ * names export under one identifier fail the write, and so does a parameter
+ * that is not plain data, as it does for writeApiOptions, or that is null,
+ * which no tag can carry.
  */
 export const writeApiGuardParams = async (options) => {
     const file = resolve(options.file);
@@ -54,30 +151,37 @@ export const writeApiGuardParams = async (options) => {
         throw new Error(`writeApiGuardParams: the server declares no guard "${options.guard}" (it declares ${declared.length ? declared.map((name) => `"${name}"`).join(", ") : "none"}).`);
     }
     const params = {};
+    const exportedBy = new Map();
     for (const name of Object.keys(entries.apis).sort()) {
         const param = apiGuardParam(entries.apis, name, options.guard);
-        if (param !== undefined)
-            params[name] = param;
+        if (param === undefined)
+            continue;
+        if (param === null) {
+            throw new Error(`writeApiGuardParams: "${name}" gives the "${options.guard}" guard null, which an export cannot carry with its tag; give the guard another value.`);
+        }
+        const exportName = apiGuardParamExportName(name);
+        const taken = exportedBy.get(exportName);
+        if (taken !== undefined) {
+            throw new Error(`writeApiGuardParams: "${taken}" and "${name}" would both export ${exportName}; rename one of them.`);
+        }
+        exportedBy.set(exportName, name);
+        params[name] = param;
     }
     const previousText = existsSync(file) ? readFileSync(file, "utf8") : null;
-    const previous = previousText === null ? null : readGeneratedTable(previousText, TABLE_NAME);
+    const previous = previousText === null ? null : readGuardParams(previousText, options.guard);
     const changes = nameChangesOf(params, previous ?? {});
     const count = Object.keys(params).length;
+    const semicolon = options.semicolons === false ? "" : ";";
     const settled = settleGeneratedFile({
         name: options.file, file, check: options.check, previousText, readBack: previous !== null,
-        tables: [{ name: TABLE_NAME, count, changes }],
+        tables: [{ name: `${options.guard} params`, count, changes }],
         held: `${count} APIs guarded by "${options.guard}"`,
-        tablesNoun: "the table",
+        tablesNoun: "the parameters",
         unmovedLine: "no parameters changed",
         render: () => [
             ...headerLinesOf(options.header ?? defaultHeader(options.guard)),
             "",
-            ...tableStatementLines({
-                name: TABLE_NAME,
-                doc: `The parameter each API guarded by "${options.guard}" gives it: the value as declared, or true for the guard named without one.`,
-                value: params,
-                semicolon: options.semicolons === false ? "" : ";",
-            }),
+            ...statementLinesOf(params, options.guard, semicolon),
             "",
         ].join("\n"),
     });

package/dist/build.d.ts

@@ -5,7 +5,8 @@
  * ships: the signature file both sides read, the declared options as plain
  * data, and one guard's parameters as the least a browser needs of them, all
  * from the app's own instance; and the contract a client compiles against,
- * from the server's sources. Node-only and imported by nothing else
+ * from the server's sources; and generateApiFiles, every one of them for
+ * every app a script names, in one call. Node-only and imported by nothing else
  * in the package, so no deployment or bundle carries it.
  */
 export { writeApiSignatures } from "./build/writeApiSignatures.js";
@@ -17,4 +18,6 @@ export type { LambderApiOptionsFileOptions, LambderApiOptionsFileResult, } from
 export { writeApiGuardParams } from "./build/writeApiGuardParams.js";
 export type { LambderApiGuardParamsFileOptions, LambderApiGuardParamsFileResult, } from "./build/writeApiGuardParams.js";
 export type { LambderApiOptionsSource, LambderNameChanges } from "./build/generatedTables.js";
+export { generateApiFiles } from "./build/generateApiFiles.js";
+export type { LambderApiFilesConfig, LambderApiFilesApp, LambderApiFilesResult } from "./build/generateApiFiles.js";
 export type { LambderModuleLocation } from "./build/moduleLocation.js";

package/dist/build.js

@@ -5,10 +5,12 @@
  * ships: the signature file both sides read, the declared options as plain
  * data, and one guard's parameters as the least a browser needs of them, all
  * from the app's own instance; and the contract a client compiles against,
- * from the server's sources. Node-only and imported by nothing else
+ * from the server's sources; and generateApiFiles, every one of them for
+ * every app a script names, in one call. Node-only and imported by nothing else
  * in the package, so no deployment or bundle carries it.
  */
 export { writeApiSignatures } from "./build/writeApiSignatures.js";
 export { writeApiContract } from "./build/writeApiContract.js";
 export { writeApiOptions } from "./build/writeApiOptions.js";
 export { writeApiGuardParams } from "./build/writeApiGuardParams.js";
+export { generateApiFiles } from "./build/generateApiFiles.js";

package/dist/client.d.ts

@@ -29,8 +29,8 @@ export { LambderApiRefusal, isLambderApiRefusal, isLambderRefusalCode, refuse, r
 export type { LambderApiRefusalOptions, LambderRefusalMessage, LambderPlainRefusalMessage, LambderUncheckedRefusalMessage, LambderRefusalCode, LambderRefuseOptions, LambderDeclaredRefuseOptions, LambderDeclaredRefuse, } from "./shared/wire/LambderApiRefusal.js";
 export { isObjectPayload } from "./shared/wire/LambderObjectPayload.js";
 export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiSuccessEnvelope, LambderApiRefusalEnvelope, LambderRefusalEnvelopeFields, LambderApiRefusalConfig, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractKeysWithGuard, LambderJsonOf, LambderContractRefusalsOf, LambderContractRefusalMessage, LambderContractRefusals, LambderContractAnyRefusalMessage, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractRateLimitNames, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";
-export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";
-export type { LambderApiOptionEntries, LambderApiOptionEntry, LambderRateLimitPolicyEntry, LambderGuardDeclarationEntry, LambderApisWithGuard, LambderApisGuardedBy, LambderApisWithMode, LambderGuardParamOf, } from "./shared/wire/LambderApiOptionEntries.js";
+export { apiGuardParam, apiGuardParamExportName } from "./shared/wire/LambderApiOptionEntries.js";
+export type { LambderApiOptionEntries, LambderApiOptionEntry, LambderRateLimitPolicyEntry, LambderGuardDeclarationEntry, LambderApisWithGuard, LambderApisGuardedBy, LambderApisWithMode, LambderGuardParamOf, LambderApiGuardParam, } from "./shared/wire/LambderApiOptionEntries.js";
 export { describeCrash, errorFromCrashDetail } from "./shared/wire/LambderCrashDetail.js";
 export type { LambderCrashDetail, LambderCrashCause } from "./shared/wire/LambderCrashDetail.js";
 export { compressPayloadGzip, isRequestCompressionAvailable, COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BR_FIELD, COMPRESSED_PAYLOAD_BYTES_FIELD, DEFAULT_REQUEST_COMPRESSION_SETTINGS, } from "./shared/wire/LambderRequestPayload.js";

package/dist/client.js

@@ -28,7 +28,7 @@ export { LambderApiRefusal, isLambderApiRefusal, isLambderRefusalCode, refuse, r
 export { isObjectPayload } from "./shared/wire/LambderObjectPayload.js";
 // The server's declared options as plain data (the generated options module's
 // entry types) and the readers a client derives its own facts from.
-export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";
+export { apiGuardParam, apiGuardParamExportName } from "./shared/wire/LambderApiOptionEntries.js";
 // A crash described for a caller allowed to see it (the envelope's `crash` field; pure, no Node built-ins).
 export { describeCrash, errorFromCrashDetail } from "./shared/wire/LambderCrashDetail.js";
 // Request payload compression (browser-safe: gzip via CompressionStream, no Node built-ins).

package/dist/core/Lambder.d.ts

@@ -12,7 +12,7 @@ import { LambderFiles } from "./LambderFiles.js";
 import { type LambderPipelineBackends, type LambderPipelineBackendSwap } from "../api/LambderApiPipeline.js";
 import type { LambderFileSource } from "../shared/contracts/LambderFileSource.js";
 import { LAMBDER_BACKEND_SWAP, LAMBDER_CRASH_WATCH } from "../shared/util/LambderTestingDoors.js";
-import { type LambderWireRefusalsOf, type LambderHandlerRefusalsOf, type LambderRefusalNamesIn, type LambderRefusalsOption, type LambderRefusalVocabulary, type LambderRefusalVocabularyChecks } from "../api/LambderApiRefusals.js";
+import { type LambderWireRefusalsOf, type LambderHandlerRefusalsOf, type LambderRefusalNamesIn, type LambderRefusalsOption, type LambderRefusalVocabularyOption, type LambderRefusalVocabularyOptionChecks, type LambderMergedRefusalVocabulary } from "../api/LambderApiRefusals.js";
 import { type LambderDeclaredRefuse } from "../shared/wire/LambderApiRefusal.js";
 import { type LambderApiSignatureEntry } from "../api/LambderApiSignature.js";
 import { type LambderApiSignatureMap } from "../shared/wire/LambderApiSignatureMap.js";
@@ -25,10 +25,13 @@ import type { LambderContractEntry, LambderJsonOf } from "../shared/wire/Lambder
 import { type LambderActionNamesCheck, type LambderApiDeclaration, type LambderApiDeclarations, type LambderApiGroup, type LambderApiModeOf, type LambderAppTypes, type LambderContractOfGroups, type LambderGroupNameCheck, type LambderGroupPartsCheck, type LambderMergedParts, type LambderLazyApiGroup, type LambderPlainAppTypes, type LambderPublicSessionPolicyCheck, type LambderRegisteredGroupsCheck, type LambderRegistrableApiGroup, type LambderSessionModeCheck } from "../api/LambderApiDeclarations.js";
 import { type LambderHttpEvent, type LambderRenderContext, type LambderSessionRenderContext } from "./LambderContext.js";
 import type { LambderReadonlyDeep, MaybePromise } from "../shared/util/LambderTypeUtilities.js";
+import { type LambderCallSummary } from "./LambderCallSummary.js";
 import { type LambderMergedNamedMaps, type LambderNamedMapsOption, type LambderRouteHandler, type LambderInputValidationHandler, type LambderFallbackHandler, type LambderGlobalErrorHandler, type LambderAfterRenderHook, type LambderBeforeRenderHook, type LambderFallbackHook, type LambderActionTools, type LambderCreateOptions, type LambderGivenOption, type LambderHandler, type LambderNestedOptionChecks, type LambderObjectOutputCheck, type LambderPayloadSliceCheck, type LambderRequirableGuardsField, type LambderSessionEnabledInstance, type LambderSessionRouteHandler } from "./LambderCreateOptions.js";
 /** Everything `lambder/testing` may put under a built instance: the pipeline's stores, and the source its files are read from. */
 export type LambderInstanceBackends = LambderPipelineBackends & {
     fileSource?: LambderFileSource;
+    /** Where call summaries go instead of the app's own callSummary; null writes none. */
+    callSummary?: ((summary: LambderCallSummary) => void) | null;
 };
 /** What the instance had a place for; see LambderPipelineBackendSwap. `files` is false on an instance created without the files option. */
 export type LambderInstanceBackendSwap = LambderPipelineBackendSwap & {
@@ -146,6 +149,9 @@ export default class Lambder<TApp extends LambderAppTypes = LambderPlainAppTypes
     private readonly contextTools;
     private readonly trustedClientIpHeaders;
     private readonly trustedHostHeaders;
+    private readonly originProof;
+    /** Where each API call's summary goes (the callSummary option); null writes none. Replaceable through the backend swap alone. */
+    private callSummaryWriter;
     constructor(given?: LambderCreateOptions<TApp["session"]>);
     setRouteFallbackHandler(routeFallbackHandler: LambderFallbackHandler): this;
     setApiFallbackHandler(apiFallbackHandler: LambderFallbackHandler): this;
@@ -445,7 +451,15 @@ export default class Lambder<TApp extends LambderAppTypes = LambderPlainAppTypes
      */
     private isCorsPreflight;
     private resolveRequest;
+    /**
+     * One HTTP invocation, from the event to the finalized response, under
+     * an invocation record of its own (see LambderInvocationScope): what an
+     * API call's summary line is written from once the response is final.
+     */
     render(event: LambderHttpEvent, lambdaContext: Context): Promise<LambderHttpResponse>;
+    private renderRequest;
+    /** What createContext reads this instance's requests with. */
+    private contextOptions;
     /**
      * A thrown value that is an answer rather than a crash, as the response;
      * anything else is rethrown to the crash path.
@@ -470,6 +484,12 @@ export default class Lambder<TApp extends LambderAppTypes = LambderPlainAppTypes
      * failed too.
      */
     private answerCrash;
+    /**
+     * The summary line of an API call, once its response is final: nothing
+     * for an invocation that served no API call. A writer that throws costs
+     * the call its line and nothing else.
+     */
+    private writeCallSummary;
     /**
      * An answer to a crash, carrying what the call wrote and its CORS headers.
      * As on the success path, headers belong to the call: a call that wrote a
@@ -500,6 +520,7 @@ export default class Lambder<TApp extends LambderAppTypes = LambderPlainAppTypes
      * so Lambda's retries and dead-letter queues still see the failure.
      */
     renderEvent(event: unknown, lambdaContext: Context): Promise<unknown>;
+    private renderEventAction;
     /**
      * The answer for a rejected input: the app's
      * setApiInputValidationErrorHandler when set, otherwise the standard 422
@@ -596,7 +617,10 @@ export declare const initLambder: <TSessionData = any>() => {
      * Declares the app's refusal vocabulary: every code once, with the schema
      * of its data (`{ data: schema }`) or none (`{}`), the status every
      * refusal with it leaves with (`status`, 200 by default) and whether it
-     * sets the notAuthorized flag (`notAuthorized: true`). Returns the init
+     * sets the notAuthorized flag (`notAuthorized: true`). One map of codes,
+     * or a list of them, as guards and rate-limit policies are declared, so
+     * each part of an app declares its own codes; a code two maps declare is
+     * refused, at compile time and at the call. Returns the init
      * bound to it: its guard() types ctx.refuse to a guard's refusals and
      * refuses a guard naming a code outside the vocabulary, its refuse is
      * typed to the whole vocabulary, and its create() hands the vocabulary to
@@ -604,7 +628,7 @@ export declare const initLambder: <TSessionData = any>() => {
      * handler, a guard or a helper is a crash rather than an answer, so every
      * "no" a client reads names a code.
      */
-    declareRefusals<const TRefusals extends LambderRefusalVocabulary, const TRequireCodes extends boolean = false>(refusals: TRefusals & LambderRefusalVocabularyChecks<TRefusals>, options?: {
+    declareRefusals<const TRefusals extends LambderRefusalVocabularyOption, const TRequireCodes extends boolean = false>(refusals: TRefusals & LambderRefusalVocabularyOptionChecks<TRefusals>, options?: {
         requireCodes?: TRequireCodes;
     }): {
         /**
@@ -615,8 +639,8 @@ export declare const initLambder: <TSessionData = any>() => {
          * refuse(). Inside an API handler ctx.refuse is narrower, that
          * endpoint's codes alone.
          */
-        refuse: LambderDeclaredRefuse<LambderHandlerRefusalsOf<TRefusals, keyof TRefusals & string>, TRequireCodes>;
-        create<const TOptions extends LambderInitCreateOptions<TSessionData>>(options: TOptions & Record<Exclude<keyof TOptions, "session" | "guards" | "idempotency" | "apiVersion" | "cors" | "apiPath" | "apiSignatures" | "trustedClientIpHeaders" | "trustedHostHeaders" | "files" | "etag" | "rateLimits" | "minApiVersion" | "compression" | "maxResponseBytes" | "maxRequestPayloadBytes" | "requireApiGuards" | "crashes">, never> & LambderNestedOptionChecks<TSessionData, TOptions, TRefusals>): Lambder<{
+        refuse: LambderDeclaredRefuse<LambderHandlerRefusalsOf<LambderMergedRefusalVocabulary<TRefusals>, keyof LambderMergedRefusalVocabulary<TRefusals> & string>, TRequireCodes>;
+        create<const TOptions extends LambderInitCreateOptions<TSessionData>>(options: TOptions & Record<Exclude<keyof TOptions, "session" | "guards" | "idempotency" | "apiVersion" | "cors" | "apiPath" | "apiSignatures" | "trustedClientIpHeaders" | "trustedHostHeaders" | "originProof" | "files" | "etag" | "rateLimits" | "minApiVersion" | "compression" | "maxResponseBytes" | "maxRequestPayloadBytes" | "callSummary" | "requireApiGuards" | "crashes">, never> & LambderNestedOptionChecks<TSessionData, TOptions, LambderMergedRefusalVocabulary<TRefusals>>): Lambder<{
             session: TSessionData;
             policies: TOptions["rateLimits"] extends {
                 policies: infer TPolicies;
@@ -625,10 +649,10 @@ export declare const initLambder: <TSessionData = any>() => {
             idempotency: TOptions["idempotency"] extends LambderApiIdempotencyConfig ? true : false;
             guardsRequired: [LambderGivenOption<TOptions, "requireApiGuards">] extends [false | undefined] ? false : true;
             sessions: [LambderGivenOption<TOptions, "session">] extends [undefined] ? false : true;
-            refusals: TRefusals;
+            refusals: LambderMergedRefusalVocabulary<TRefusals>;
             refusalCodesRequired: TRequireCodes;
         }, {}>;
-        guard: import("../api/LambderApiGuards.js").LambderGuardBuilder<LambderRenderContext<any, Record<string, string>, {}, TSessionData>, LambderSessionRenderContext<any, TSessionData>, TRefusals, TRequireCodes>;
+        guard: import("../api/LambderApiGuards.js").LambderGuardBuilder<LambderRenderContext<any, Record<string, string>, {}, TSessionData>, LambderSessionRenderContext<any, TSessionData>, LambderMergedRefusalVocabulary<TRefusals>, TRequireCodes>;
         rateLimitKey: import("../api/LambderApiRateLimits.js").LambderRateLimitKeyBuilder<LambderRenderContext<any, Record<string, string>, {}, TSessionData>>;
     };
     /**
@@ -651,7 +675,7 @@ export declare const initLambder: <TSessionData = any>() => {
         code?: undefined;
         data?: undefined;
     }) | undefined) => never;
-    create<const TOptions extends LambderInitCreateOptions<TSessionData>>(options: TOptions & Record<Exclude<keyof TOptions, "session" | "guards" | "idempotency" | "apiVersion" | "cors" | "apiPath" | "apiSignatures" | "trustedClientIpHeaders" | "trustedHostHeaders" | "files" | "etag" | "rateLimits" | "minApiVersion" | "compression" | "maxResponseBytes" | "maxRequestPayloadBytes" | "requireApiGuards" | "crashes">, never> & LambderNestedOptionChecks<TSessionData, TOptions, {}>): Lambder<{
+    create<const TOptions extends LambderInitCreateOptions<TSessionData>>(options: TOptions & Record<Exclude<keyof TOptions, "session" | "guards" | "idempotency" | "apiVersion" | "cors" | "apiPath" | "apiSignatures" | "trustedClientIpHeaders" | "trustedHostHeaders" | "originProof" | "files" | "etag" | "rateLimits" | "minApiVersion" | "compression" | "maxResponseBytes" | "maxRequestPayloadBytes" | "callSummary" | "requireApiGuards" | "crashes">, never> & LambderNestedOptionChecks<TSessionData, TOptions, {}>): Lambder<{
         session: TSessionData;
         policies: TOptions["rateLimits"] extends {
             policies: infer TPolicies;