lambder 13.0.1 → 14.1.1

package/dist/build/writeApiGuardParams.js

@@ -1,32 +1,128 @@
 import { existsSync, readFileSync } from "fs";
 import { resolve } from "path";
-import { apiGuardParam } from "../shared/wire/LambderApiOptionEntries.js";
-import { headerLinesOf, loadApiOptionEntries, nameChangesOf, readGeneratedTable, settleGeneratedFile, tableStatementLines, } from "./generatedTables.js";
+import { apiGuardParam, apiGuardParamExportName } from "../shared/wire/LambderApiOptionEntries.js";
+import { headerLinesOf, loadApiOptionEntries, nameChangesOf, settleGeneratedFile, } from "./generatedTables.js";
 /*
- * One guard's parameters as a generated module a browser may carry: for each
- * API that declares the guard, the parameter it gives it, and nothing else
- * about any API.
+ * One guard's parameters as a generated module a browser may carry: one
+ * export per API that declares the guard, holding the parameter it gives it,
+ * and nothing else about any API.
  *
  * The file writeApiOptions writes holds every declaration, because a mock
  * and a test need every declaration. A screen that decides whether to offer
  * a control by the permission an endpoint's guard asks needs one guard's
- * parameter, and a browser that imports the whole table as a value carries
- * every API name, every mode and every guard's parameter, a reviewer's
- * reason beside an open endpoint included. This is the least that screen
- * needs: the names of the APIs behind the guard (which the client calls, so
- * its own code names them already) and what each asks.
+ * parameter, for the endpoints it gates on. A table of them would still hand
+ * every page that imports it the name of every API behind the guard and what
+ * each asks, whichever of them its screens use. One export per API lets the
+ * bundler keep exactly the ones the client imports, and keep no name at all:
+ * the API's name sits in the export's type and doc comment, which a build
+ * strips, and in its identifier, which a minifier renames.
+ *
+ * Each export is tagged with its API's name and the guard's
+ * (LambderApiGuardParam), in types alone. A client function typed to the
+ * tagged parameters takes only generated ones, so a hand-written literal,
+ * which would restate the server's declaration and could drift from it, does
+ * not compile.
  */
-const TABLE_NAME = "guardParams";
+/** The tag type every export is asserted to, imported from the client entry, which is safe in a browser. */
+const TAG_TYPE = "LambderApiGuardParam";
 const defaultHeader = (guard) => [
     "Generated by writeApiGuardParams() from lambder/build. Do not edit.",
     "",
     `The parameter each API the server guards with "${guard}" gives that guard,`,
-    "and nothing else about any API: what a client decides with it, without",
-    "carrying the server's other declarations.",
+    "one export per API and nothing else about any API: a client imports the",
+    "ones its screens gate on, and its bundle carries those alone.",
 ].join("\n");
 /**
- * Writes one guard's parameters as a module of plain data, or checks the one
- * on disk, and says which APIs moved.
+ * A plain-data value as the type `as const` gives it: its literals, readonly
+ * all the way down. What each export is asserted to beside its tag, so the
+ * tagged type keeps the literal the API declared.
+ */
+const constTypeOf = (value) => {
+    if (Array.isArray(value))
+        return `readonly [${value.map(constTypeOf).join(", ")}]`;
+    if (value !== null && typeof value === "object") {
+        const members = Object.entries(value).map(([key, member]) => `readonly ${JSON.stringify(key)}: ${constTypeOf(member)}`);
+        return members.length ? `{ ${members.join("; ")} }` : "{}";
+    }
+    return JSON.stringify(value);
+};
+/**
+ * One API's export as written, less the statement's semicolon: `export const
+ * <name> = <JSON> as const as LambderApiGuardParam<"<api>", "<guard>", <type>>`.
+ * A check renders each export it reads back again and compares the two, so
+ * the identifier a client imports, the guard and the literal type are held
+ * to what this writer would write, not only the value.
+ */
+const exportLineOf = (name, param, guard) => `export const ${apiGuardParamExportName(name)} = ${JSON.stringify(param)} as const as ${TAG_TYPE}<${JSON.stringify(name)}, ${JSON.stringify(guard)}, ${constTypeOf(param)}>`;
+/** The start of one export, far enough to read back its parameter's JSON and its API's name. */
+const EXPORT_LINE = new RegExp(`^export const [A-Za-z_$][\\w$]* = (.+) as const as ${TAG_TYPE}<("(?:[^"\\\\]|\\\\.)*"), `);
+/** The tag's import, in whatever spacing and quotes a formatter gives it, since no `// prettier-ignore` sits above it. */
+const IMPORT_LINE = new RegExp(`^import type \\{\\s*${TAG_TYPE}\\s*\\} from (["'])lambder/client\\1;?$`);
+/** The empty module of a guard no API declares, however a formatter spaces it. */
+const EMPTY_EXPORT_LINE = /^export \{\s*\};?$/;
+/**
+ * The parameters a file already holds, by API name, or null for a file that
+ * does not hold them as written. As written means the tag's import and one
+ * export per API, each the line exportLineOf renders for its API and value,
+ * or the empty module alone for a guard no API declares. Anything else makes
+ * it null: another statement, an export renamed by hand or written for
+ * another guard, an API exported twice, a missing import, a file with no
+ * statement at all. Comments, blank lines, re-indentation, line endings and
+ * the semicolons change nothing.
+ */
+const readGuardParams = (contents, guard) => {
+    const params = {};
+    let imported = false;
+    let empty = false;
+    for (const line of contents.split(/\r?\n/).map((text) => text.trim())) {
+        if (line === "" || line.startsWith("//") || line.startsWith("/*") || line.startsWith("*"))
+            continue;
+        if (IMPORT_LINE.test(line)) {
+            imported = true;
+            continue;
+        }
+        if (EMPTY_EXPORT_LINE.test(line)) {
+            empty = true;
+            continue;
+        }
+        const match = EXPORT_LINE.exec(line);
+        if (!match)
+            return null;
+        try {
+            const param = JSON.parse(match[1]);
+            const name = JSON.parse(match[2]);
+            if (typeof name !== "string" || Object.prototype.hasOwnProperty.call(params, name))
+                return null;
+            if (line.replace(/;$/, "") !== exportLineOf(name, param, guard))
+                return null;
+            params[name] = param;
+        }
+        catch {
+            return null;
+        }
+    }
+    const held = Object.keys(params).length > 0 ? imported && !empty : empty && !imported;
+    return held ? params : null;
+};
+/** The file's statements after its header: the tag's import and one export per API, or an empty export for a guard no API declares. */
+const statementLinesOf = (params, guard, semicolon) => {
+    const names = Object.keys(params);
+    if (names.length === 0)
+        return [`export {}${semicolon}`];
+    return [
+        `import type { ${TAG_TYPE} } from "lambder/client"${semicolon}`,
+        ...names.flatMap((name) => [
+            "",
+            `/** What ${name} gives the "${guard}" guard. */`,
+            // Keeps a formatter off the JSON a check reads back.
+            "// prettier-ignore",
+            `${exportLineOf(name, params[name], guard)}${semicolon}`,
+        ]),
+    ];
+};
+/**
+ * Writes one guard's parameters as a module of one export per API, or checks
+ * the one on disk, and says which APIs moved.
  *
  * ```ts
  * import { writeApiGuardParams } from "lambder/build";
@@ -40,11 +136,12 @@ const defaultHeader = (guard) => [
  * });
  * ```
  *
- * The module exports `guardParams`, `as const`, so a client reads its types
- * straight off it: `keyof typeof guardParams` is the APIs behind the guard,
- * and `(typeof guardParams)[K]` the literal API K declared, `true` for a
- * guard named without a parameter (the string and list forms). A parameter
- * that is not plain data fails the write, as it does for writeApiOptions.
+ * API `orders.list` exports `ordersListGuardParam`: the literal it declared,
+ * `true` for a guard named without a parameter (the string and list forms),
+ * typed LambderApiGuardParam<"orders.list", "store", literal>. Two APIs whose
+ * names export under one identifier fail the write, and so does a parameter
+ * that is not plain data, as it does for writeApiOptions, or that is null,
+ * which no tag can carry.
  */
 export const writeApiGuardParams = async (options) => {
     const file = resolve(options.file);
@@ -54,30 +151,37 @@ export const writeApiGuardParams = async (options) => {
         throw new Error(`writeApiGuardParams: the server declares no guard "${options.guard}" (it declares ${declared.length ? declared.map((name) => `"${name}"`).join(", ") : "none"}).`);
     }
     const params = {};
+    const exportedBy = new Map();
     for (const name of Object.keys(entries.apis).sort()) {
         const param = apiGuardParam(entries.apis, name, options.guard);
-        if (param !== undefined)
-            params[name] = param;
+        if (param === undefined)
+            continue;
+        if (param === null) {
+            throw new Error(`writeApiGuardParams: "${name}" gives the "${options.guard}" guard null, which an export cannot carry with its tag; give the guard another value.`);
+        }
+        const exportName = apiGuardParamExportName(name);
+        const taken = exportedBy.get(exportName);
+        if (taken !== undefined) {
+            throw new Error(`writeApiGuardParams: "${taken}" and "${name}" would both export ${exportName}; rename one of them.`);
+        }
+        exportedBy.set(exportName, name);
+        params[name] = param;
     }
     const previousText = existsSync(file) ? readFileSync(file, "utf8") : null;
-    const previous = previousText === null ? null : readGeneratedTable(previousText, TABLE_NAME);
+    const previous = previousText === null ? null : readGuardParams(previousText, options.guard);
     const changes = nameChangesOf(params, previous ?? {});
     const count = Object.keys(params).length;
+    const semicolon = options.semicolons === false ? "" : ";";
     const settled = settleGeneratedFile({
         name: options.file, file, check: options.check, previousText, readBack: previous !== null,
-        tables: [{ name: TABLE_NAME, count, changes }],
+        tables: [{ name: `${options.guard} params`, count, changes }],
         held: `${count} APIs guarded by "${options.guard}"`,
-        tablesNoun: "the table",
+        tablesNoun: "the parameters",
         unmovedLine: "no parameters changed",
         render: () => [
             ...headerLinesOf(options.header ?? defaultHeader(options.guard)),
             "",
-            ...tableStatementLines({
-                name: TABLE_NAME,
-                doc: `The parameter each API guarded by "${options.guard}" gives it: the value as declared, or true for the guard named without one.`,
-                value: params,
-                semicolon: options.semicolons === false ? "" : ";",
-            }),
+            ...statementLinesOf(params, options.guard, semicolon),
             "",
         ].join("\n"),
     });

package/dist/build.d.ts

@@ -5,8 +5,9 @@
  * ships: the signature file both sides read, the declared options as plain
  * data, and one guard's parameters as the least a browser needs of them, all
  * from the app's own instance; and the contract a client compiles against,
- * from the server's sources; and generateApiFiles, every one of them for
- * every app a script names, in one call. Node-only and imported by nothing else
+ * from the server's sources; generateApiFiles, every one of them for
+ * every app a script names, in one call; and checkApiRefusals, every
+ * refusal a handler can reach held to the codes it may send. Node-only and imported by nothing else
  * in the package, so no deployment or bundle carries it.
  */
 export { writeApiSignatures } from "./build/writeApiSignatures.js";
@@ -18,6 +19,8 @@ export type { LambderApiOptionsFileOptions, LambderApiOptionsFileResult, } from
 export { writeApiGuardParams } from "./build/writeApiGuardParams.js";
 export type { LambderApiGuardParamsFileOptions, LambderApiGuardParamsFileResult, } from "./build/writeApiGuardParams.js";
 export type { LambderApiOptionsSource, LambderNameChanges } from "./build/generatedTables.js";
+export { checkApiRefusals } from "./build/checkApiRefusals.js";
+export type { LambderApiRefusalCheckOptions, LambderApiRefusalCheckResult, LambderRefusalCheckFinding, } from "./build/checkApiRefusals.js";
 export { generateApiFiles } from "./build/generateApiFiles.js";
 export type { LambderApiFilesConfig, LambderApiFilesApp, LambderApiFilesResult } from "./build/generateApiFiles.js";
 export type { LambderModuleLocation } from "./build/moduleLocation.js";

package/dist/build.js

@@ -5,12 +5,14 @@
  * ships: the signature file both sides read, the declared options as plain
  * data, and one guard's parameters as the least a browser needs of them, all
  * from the app's own instance; and the contract a client compiles against,
- * from the server's sources; and generateApiFiles, every one of them for
- * every app a script names, in one call. Node-only and imported by nothing else
+ * from the server's sources; generateApiFiles, every one of them for
+ * every app a script names, in one call; and checkApiRefusals, every
+ * refusal a handler can reach held to the codes it may send. Node-only and imported by nothing else
  * in the package, so no deployment or bundle carries it.
  */
 export { writeApiSignatures } from "./build/writeApiSignatures.js";
 export { writeApiContract } from "./build/writeApiContract.js";
 export { writeApiOptions } from "./build/writeApiOptions.js";
 export { writeApiGuardParams } from "./build/writeApiGuardParams.js";
+export { checkApiRefusals } from "./build/checkApiRefusals.js";
 export { generateApiFiles } from "./build/generateApiFiles.js";

package/dist/client.d.ts

@@ -29,8 +29,8 @@ export { LambderApiRefusal, isLambderApiRefusal, isLambderRefusalCode, refuse, r
 export type { LambderApiRefusalOptions, LambderRefusalMessage, LambderPlainRefusalMessage, LambderUncheckedRefusalMessage, LambderRefusalCode, LambderRefuseOptions, LambderDeclaredRefuseOptions, LambderDeclaredRefuse, } from "./shared/wire/LambderApiRefusal.js";
 export { isObjectPayload } from "./shared/wire/LambderObjectPayload.js";
 export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiSuccessEnvelope, LambderApiRefusalEnvelope, LambderRefusalEnvelopeFields, LambderApiRefusalConfig, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractKeysWithGuard, LambderJsonOf, LambderContractRefusalsOf, LambderContractRefusalMessage, LambderContractRefusals, LambderContractAnyRefusalMessage, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractRateLimitNames, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";
-export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";
-export type { LambderApiOptionEntries, LambderApiOptionEntry, LambderRateLimitPolicyEntry, LambderGuardDeclarationEntry, LambderApisWithGuard, LambderApisGuardedBy, LambderApisWithMode, LambderGuardParamOf, } from "./shared/wire/LambderApiOptionEntries.js";
+export { apiGuardParam, apiGuardParamExportName } from "./shared/wire/LambderApiOptionEntries.js";
+export type { LambderApiOptionEntries, LambderApiOptionEntry, LambderRateLimitPolicyEntry, LambderGuardDeclarationEntry, LambderApisWithGuard, LambderApisGuardedBy, LambderApisWithMode, LambderGuardParamOf, LambderApiGuardParam, } from "./shared/wire/LambderApiOptionEntries.js";
 export { describeCrash, errorFromCrashDetail } from "./shared/wire/LambderCrashDetail.js";
 export type { LambderCrashDetail, LambderCrashCause } from "./shared/wire/LambderCrashDetail.js";
 export { compressPayloadGzip, isRequestCompressionAvailable, COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BR_FIELD, COMPRESSED_PAYLOAD_BYTES_FIELD, DEFAULT_REQUEST_COMPRESSION_SETTINGS, } from "./shared/wire/LambderRequestPayload.js";

package/dist/client.js

@@ -28,7 +28,7 @@ export { LambderApiRefusal, isLambderApiRefusal, isLambderRefusalCode, refuse, r
 export { isObjectPayload } from "./shared/wire/LambderObjectPayload.js";
 // The server's declared options as plain data (the generated options module's
 // entry types) and the readers a client derives its own facts from.
-export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";
+export { apiGuardParam, apiGuardParamExportName } from "./shared/wire/LambderApiOptionEntries.js";
 // A crash described for a caller allowed to see it (the envelope's `crash` field; pure, no Node built-ins).
 export { describeCrash, errorFromCrashDetail } from "./shared/wire/LambderCrashDetail.js";
 // Request payload compression (browser-safe: gzip via CompressionStream, no Node built-ins).

package/dist/core/Lambder.d.ts

@@ -560,11 +560,12 @@ export default class Lambder<TApp extends LambderAppTypes = LambderPlainAppTypes
     private runApi;
     /**
      * A thrown LambderApiRefusal (from a hook, say) as the structured API
-     * envelope: the core's one mapping, after the same check the pipeline
-     * applies, against the endpoint the call names, its lazy group loaded if
-     * the refusal came before the call reached it. A name no API is
-     * registered under declares no code, so only an uncoded or a framework
-     * refusal goes out for it.
+     * envelope: the pipeline's own answer to a refusal (answerRefusal), so
+     * it is checked against the endpoint the call names, its lazy group
+     * loaded if the refusal came before the call reached it, and one saying
+     * the session is over ends it. A name no API is registered under
+     * declares no code, so only an uncoded or a framework refusal goes out
+     * for it.
      */
     private apiErrorResponse;
 }

package/dist/core/Lambder.js

@@ -13,12 +13,12 @@ import { LambderFiles } from "./LambderFiles.js";
 import { isLambderApiRefusal } from "../shared/wire/LambderApiRefusal.js";
 import { LambderApiPipeline } from "../api/LambderApiPipeline.js";
 import { LAMBDER_BACKEND_SWAP, LAMBDER_CRASH_WATCH } from "../shared/util/LambderTestingDoors.js";
-import { checkedRefusal, declaredRefusalVocabulary, readRefusalVocabulary, resolveAllowedRefusals, toRefusalCodes, } from "../api/LambderApiRefusals.js";
+import { declaredRefusalVocabulary, readRefusalVocabulary, resolveAllowedRefusals, toRefusalCodes, } from "../api/LambderApiRefusals.js";
 import { refuse } from "../shared/wire/LambderApiRefusal.js";
 import { apiSignatureOf } from "../api/LambderApiSignature.js";
 import { apiNameKeyOf } from "../shared/wire/LambderApiSignatureMap.js";
 import { assertPlainData } from "../shared/util/assertPlainData.js";
-import { apiNotFoundAnswer, envelopeAnswer, refusalAnswer, sessionExpiredAnswer, successEnvelope, versionExpiredAnswer, } from "../api/LambderApiEnvelope.js";
+import { apiNotFoundAnswer, envelopeAnswer, sessionExpiredAnswer, successEnvelope, versionExpiredAnswer, } from "../api/LambderApiEnvelope.js";
 import { describePayloadKind, isObjectPayload } from "../shared/wire/LambderObjectPayload.js";
 import { LambderApiOutputValidationError } from "../api/LambderApiOutputValidationError.js";
 import { toGuardEntries } from "../api/LambderApiGuards.js";
@@ -1275,16 +1275,17 @@ export default class Lambder {
     }
     /**
      * A thrown LambderApiRefusal (from a hook, say) as the structured API
-     * envelope: the core's one mapping, after the same check the pipeline
-     * applies, against the endpoint the call names, its lazy group loaded if
-     * the refusal came before the call reached it. A name no API is
-     * registered under declares no code, so only an uncoded or a framework
-     * refusal goes out for it.
+     * envelope: the pipeline's own answer to a refusal (answerRefusal), so
+     * it is checked against the endpoint the call names, its lazy group
+     * loaded if the refusal came before the call reached it, and one saying
+     * the session is over ends it. A name no API is registered under
+     * declares no code, so only an uncoded or a framework refusal goes out
+     * for it.
      */
     async apiErrorResponse(err, ctx) {
         const apiName = ctx.apiName ?? "";
-        const refusal = checkedRefusal(apiName, (await this.registeredDefinitionOf(apiName))?.refusals ?? NO_DECLARED_REFUSALS, err);
-        return responseFromAnswer(refusalAnswer(refusal, this.apiVersion, ctx.logList));
+        const refusals = (await this.registeredDefinitionOf(apiName))?.refusals ?? NO_DECLARED_REFUSALS;
+        return responseFromAnswer(await this.pipeline.answerRefusal(apiName, refusals, err, ctx));
     }
 }
 /** The init bound to one vocabulary (or none): the policy builders, refuse and create() that share it. */

package/dist/index.d.ts

@@ -140,8 +140,8 @@ export type { LambderRateLimitKeyBuilder } from "./api/LambderApiRateLimits.js";
 export type { LambderContextRateLimit, LambderContextRateLimitCheck, LambderRateLimitCheckResult, LambderChargeablePolicyNames, LambderChargeKeyArgs, LambderRateLimitKeyFn, LambderRateLimitPer, LambderRateLimitBudget, LambderRateLimitChargeAt, LambderApiRateLimitPolicyConfig, LambderApiRateLimitsConfig, LambderAllowedPolicyNames, LambderPolicyNamesInputLacks, LambderRateLimitOption, } from "./api/LambderApiRateLimits.js";
 export type { LambderApiIdempotencyConfig } from "./api/LambderApiIdempotency.js";
 export type { LambderGuardsOptionValue, LambderRateLimitMessage, LambderRateLimitOverride, LambderRateLimitOptionValue, LambderRefusalsOptionValue, LambderApiIdempotencyOption, } from "./shared/wire/LambderApiOptionValues.js";
-export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";
-export type { LambderApiOptionEntries, LambderApiOptionEntry, LambderRateLimitPolicyEntry, LambderGuardDeclarationEntry, LambderApisWithGuard, LambderApisGuardedBy, LambderApisWithMode, LambderGuardParamOf, } from "./shared/wire/LambderApiOptionEntries.js";
+export { apiGuardParam, apiGuardParamExportName } from "./shared/wire/LambderApiOptionEntries.js";
+export type { LambderApiOptionEntries, LambderApiOptionEntry, LambderRateLimitPolicyEntry, LambderGuardDeclarationEntry, LambderApisWithGuard, LambderApisGuardedBy, LambderApisWithMode, LambderGuardParamOf, LambderApiGuardParam, } from "./shared/wire/LambderApiOptionEntries.js";
 export { createLambderI18n } from "./shared/LambderI18n.js";
 export type { LambderLanguageMeta, LambderI18nConfig, LambderI18nInstance, LambderI18nTranslator, LambderI18nExtractParams, LambderI18nDictionaryLoader, LambderI18nCodes, LambderI18nKeys, LambderI18nTranslatorFor, } from "./shared/LambderI18n.js";
 export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiSuccessEnvelope, LambderApiRefusalEnvelope, LambderRefusalEnvelopeFields, LambderApiRefusalConfig, LambderContractEntry, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractKeysWithGuard, LambderJsonOf, LambderContractRefusalsOf, LambderContractRefusalMessage, LambderContractRefusals, LambderContractAnyRefusalMessage, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractRateLimitNames, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";

package/dist/index.js

@@ -97,7 +97,7 @@ export { LambderApiRefusalValidationError } from "./api/LambderApiRefusals.js";
 export { lambderRateLimitKeyBuilder, rateLimitRefusal, DEFAULT_RATE_LIMIT_REFUSAL } from "./api/LambderApiRateLimits.js";
 // The declared options as plain data: what apiOptionEntries() reports and
 // writeApiOptions writes, and the readers over the generated tables.
-export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";
+export { apiGuardParam, apiGuardParamExportName } from "./shared/wire/LambderApiOptionEntries.js";
 // Typed translations (standalone, isomorphic)
 export { createLambderI18n } from "./shared/LambderI18n.js";
 export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";

package/dist/shared/wire/LambderApiOptionEntries.d.ts

@@ -153,3 +153,27 @@ export type LambderGuardParamOf<TEntry, N extends string> = TEntry extends {
  * reads instead of the source.
  */
 export declare const apiGuardParam: <TOptions extends Record<string, LambderApiOptionEntry>, K extends keyof TOptions & string, N extends string>(options: TOptions, name: K, guard: N) => LambderGuardParamOf<TOptions[K], N>;
+/**
+ * The identifier writeApiGuardParams exports an API's parameter under: its
+ * group, its action capitalized, then `GuardParam` (`orders.list` exports
+ * `ordersListGuardParam`). What code that reads a generated module by API
+ * name (a test comparing it with the server) looks each export up by.
+ */
+export declare const apiGuardParamExportName: (apiName: string) => string;
+/** The key a generated guard parameter's tag sits under: declared and never created, so it exists in types alone. */
+declare const API_GUARD_PARAM_TAG: unique symbol;
+/**
+ * One API's parameter for one guard, as writeApiGuardParams exports it: the
+ * value TParam as declared (`true` for a guard named without one), tagged
+ * with the API's name and the guard's. The tag exists in types alone, so the
+ * names reach no bundle. A function typed to a guard's tagged parameters
+ * takes only generated ones: a hand-written literal, which would restate the
+ * server's declaration and could drift from it, does not compile.
+ */
+export type LambderApiGuardParam<TApi extends string, TGuard extends string, TParam> = TParam & {
+    readonly [API_GUARD_PARAM_TAG]: {
+        readonly api: TApi;
+        readonly guard: TGuard;
+    };
+};
+export {};

package/dist/shared/wire/LambderApiOptionEntries.js

@@ -15,6 +15,7 @@
  * (when a guard runs, what a budget spans, when a custom key is charged) are
  * declared here too and re-exported by the engines that read them.
  */
+import { splitApiName } from "./LambderApiNames.js";
 /**
  * The parameter an API's guards option gives guard N, read off a generated
  * `apiOptions` table with the type the table pins: the literal a permission
@@ -33,3 +34,15 @@ export const apiGuardParam = (options, name, guard) => {
         param = guards[guard];
     return param;
 };
+/**
+ * The identifier writeApiGuardParams exports an API's parameter under: its
+ * group, its action capitalized, then `GuardParam` (`orders.list` exports
+ * `ordersListGuardParam`). What code that reads a generated module by API
+ * name (a test comparing it with the server) looks each export up by.
+ */
+export const apiGuardParamExportName = (apiName) => {
+    const parts = splitApiName(apiName);
+    if (!parts)
+        throw new Error(`Lambder: "${apiName}" is not an endpoint name, so its guard parameter has no export name.`);
+    return `${parts.group}${parts.action[0].toUpperCase()}${parts.action.slice(1)}GuardParam`;
+};

package/dist/shared/wire/LambderApiRefusal.d.ts

@@ -10,7 +10,7 @@ export type LambderApiRefusalOptions = {
     refusal?: LambderUncheckedRefusalMessage | string;
     /** Sets the envelope's `notAuthorized` flag (routed to the caller's notAuthorizedHandler). */
     notAuthorized?: boolean;
-    /** Sets the envelope's `sessionExpired` flag (the caller clears session cookies and calls sessionExpiredHandler). */
+    /** Sets the envelope's `sessionExpired` flag (the caller clears session cookies and calls sessionExpiredHandler); on an API call, the server also ends the session the call held. */
     sessionExpired?: boolean;
     /**
      * HTTP status of the refusal response. Default 200: the envelope is the
@@ -178,7 +178,7 @@ export type LambderRefuseOptions = {
     title?: string;
     /** Sets the envelope's notAuthorized flag (routed to the caller's notAuthorizedHandler). A declared code's flag is its declaration's, and a refusal with such a code that sets it here is a crash. */
     notAuthorized?: boolean;
-    /** Sets the envelope's sessionExpired flag. Not for a refusal with a declared code, whose flags are its declaration's. */
+    /** Sets the envelope's sessionExpired flag, and the server ends the session the call held. Not for a refusal with a declared code, whose flags are its declaration's. */
     sessionExpired?: boolean;
     /** HTTP status of the refusal. Default 200; avoid 5xx (caller treats as crash) and 422 (reserved for validation). A declared code's status is its declaration's, and a refusal with such a code that sets one here is a crash. */
     statusCode?: LambderHttpStatusCode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "13.0.1",
+  "version": "14.1.1",
   "sideEffects": false,
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [