lambder 14.1.1 → 15.0.2

package/dist/core/LambderTemplatingEngine.js

@@ -292,9 +292,18 @@ const collectNames = (nodes, slots, conditions) => {
         }
     }
 };
+/** A name list in an error message: quoted and comma-separated, or "none". */
+const listNames = (names) => names.length === 0 ? "none" : names.map((name) => JSON.stringify(name)).join(", ");
+/**
+ * A comment-only HTML template, compiled once. TNames is the caller's
+ * statement of its slot and condition names, which types render()'s data;
+ * left out, any name compiles, and render() checks every key either way.
+ */
 export class LambderTemplatingEngine {
     nodes;
-    /** Slot names discovered at compile time (dynamic typing surface). */
+    /** Every slot and condition name: what a data key has to be one of. */
+    names;
+    /** Slot names discovered at compile time. */
     slotNames;
     /** Condition names discovered at compile time. */
     conditionNames;
@@ -306,6 +315,7 @@ export class LambderTemplatingEngine {
         collectNames(this.nodes, slots, conditions);
         this.slotNames = [...slots];
         this.conditionNames = [...conditions];
+        this.names = new Set([...slots, ...conditions]);
     }
     /** Read and parse a template file (compile once, render many times). */
     static async fromFile(filePath, options = {}) {
@@ -317,10 +327,20 @@ export class LambderTemplatingEngine {
     }
     /** True when the template declares `name` as a slot or condition. */
     has(name) {
-        return this.slotNames.includes(name) || this.conditionNames.includes(name);
+        return this.names.has(name);
     }
-    /** Render with escaped-by-default data; unknown keys ignored, omitted slots keep defaults. */
+    /**
+     * Render with escaped-by-default data; omitted slots keep their defaults.
+     * Throws for a key the template has no slot or condition for, naming it
+     * and the template's names.
+     */
     render(data = {}) {
+        const unknownKeys = Object.keys(data).filter((key) => !this.names.has(key));
+        if (unknownKeys.length > 0) {
+            throw new Error(`LambderTemplatingEngine: the data carries ${listNames(unknownKeys)}, which the template has no slot or condition for, ` +
+                `so ${unknownKeys.length === 1 ? "its value" : "their values"} would be dropped. Its slots: ${listNames(this.slotNames)}; ` +
+                `its conditions: ${listNames(this.conditionNames)}.`);
+        }
         const output = { html: "", firstDataIndex: -1 };
         renderNodes(this.nodes, data, output);
         return output.html;

package/dist/index.d.ts

@@ -18,7 +18,7 @@ export { LambderCookieJar, parseSetCookie } from "./shared/transport/LambderCook
 export { LambderExpiringMap, LambderExpiringMapFullError } from "./shared/util/LambderExpiringMap.js";
 export { LambderBackoffTimer } from "./shared/util/LambderBackoffTimer.js";
 export type { LambderBackoffTimerOptions } from "./shared/util/LambderBackoffTimer.js";
-export { LambderSignedClaims, keyedDigest, randomSecret } from "./shared/util/LambderSignedClaims.js";
+export { LambderSignedClaims, keyedDigest, randomSecret, randomCode } from "./shared/util/LambderSignedClaims.js";
 export type { LambderSignedClaimsOptions } from "./shared/util/LambderSignedClaims.js";
 export { constantTimeEquals } from "./shared/util/LambderTextDigest.js";
 export type { LambderStoredCookie } from "./shared/transport/LambderCookieJar.js";
@@ -28,7 +28,7 @@ export { synthesizeLambdaHttpEvent, decodeLambdaHttpResult, localLambdaContext,
 export type { LambderSynthesizedRequest, LambderLambdaHttpResult, LambderInvokeSession } from "./invoke/LambderLambdaEvent.js";
 export { LambderApiPipeline } from "./api/LambderApiPipeline.js";
 export type { LambderApiPipelineOptions, LambderApiSessionsConfig, LambderApiInputRefusal, LambderApiRunResult, LambderApiExec } from "./api/LambderApiPipeline.js";
-export { readApiEnvelope, restoreCompressedPayload } from "./api/LambderApiRequest.js";
+export { readApiEnvelope, readApiEnvelopeText, restoreCompressedPayload } from "./api/LambderApiRequest.js";
 export type { LambderApiRequest, LambderApiRequestInfo, LambderCompressedPayloadFields, LambderRestorePayloadResult } from "./api/LambderApiRequest.js";
 export { toHttpAnswer } from "./api/LambderApiAnswer.js";
 export type { LambderApiAnswer } from "./api/LambderApiAnswer.js";
@@ -54,7 +54,7 @@ export type { LambderInvokeCallerOptions, LambderInvokeCallOptions, LambderInvok
 export { describeCrash, errorFromCrashDetail } from "./shared/wire/LambderCrashDetail.js";
 export type { LambderCrashDetail, LambderCrashCause } from "./shared/wire/LambderCrashDetail.js";
 export { LambderApiRefusal, isLambderApiRefusal, isLambderRefusalCode, refuse, refusalMessageOf, LAMBDER_REFUSAL_CODES } from "./shared/wire/LambderApiRefusal.js";
-export type { LambderApiRefusalOptions, LambderRefusalMessage, LambderPlainRefusalMessage, LambderUncheckedRefusalMessage, LambderRefusalCode, LambderRefuseOptions, LambderDeclaredRefuseOptions, LambderDeclaredRefuse, } from "./shared/wire/LambderApiRefusal.js";
+export type { LambderApiRefusalOptions, LambderRefusalMessage, LambderPlainRefusalMessage, LambderRateLimitRefusalData, LambderUncheckedRefusalMessage, LambderRefusalCode, LambderRefuseOptions, LambderDeclaredRefuseOptions, LambderDeclaredRefuse, } from "./shared/wire/LambderApiRefusal.js";
 export { isObjectPayload } from "./shared/wire/LambderObjectPayload.js";
 export { default as LambderResponseBuilder } from "./core/LambderResponseBuilder.js";
 export { default as LambderResolver } from "./core/LambderResolver.js";
@@ -69,12 +69,12 @@ export { LambderWebCrypto, LambderPlainSessionCrypto, isWebCryptoAvailable } fro
 export type { LambderSessionCrypto } from "./session/LambderSessionCrypto.js";
 export { LambderDdbSessionStore } from "./stores/LambderDdbSessionStore.js";
 export type { LambderDdbSessionStoreOptions } from "./stores/LambderDdbSessionStore.js";
-export { LambderResponse, finalizeResponse, answerFromResponse, responseFromAnswer, type LambderHttpResponse, type LambderHeadersInput, type LambderFinalizeOptions, type LambderResponseCompressionSettings, type LambderResponseCompressionOption, } from "./core/LambderResponse.js";
+export { LambderResponse, type LambderHttpResponse, type LambderHeadersInput, type LambderResponseCompressionSettings, type LambderResponseCompressionOption, } from "./core/LambderResponse.js";
 export type { LambderHttpStatusCode, LambderRefusalStatusCode } from "./shared/wire/LambderHttpStatus.js";
-export { html, xml, raw, jsonScript, escapeHtml, renderHtmlValue, LambderSafeHtml, type LambderHtmlValue } from "./shared/LambderHtml.js";
+export { html, xml, raw, jsonScript, escapeHtml, renderHtmlValue, LambderSafeHtml, type LambderHtmlValue, type LambderJsonScriptOptions } from "./shared/LambderHtml.js";
 export { LambderTemplatingEngine } from "./core/LambderTemplatingEngine.js";
 export type { LambderTemplateData, LambderTemplatingEngineOptions } from "./core/LambderTemplatingEngine.js";
-export type { LambderResponseOptions, LambderRawResponseInit, } from "./core/LambderResponseBuilder.js";
+export type { LambderResponseOptions, LambderRawResponseInit, LambderTemplateFileOptions, } from "./core/LambderResponseBuilder.js";
 export type { LambderRouteMatcher, LambderRouteConditionFn, LambderRouteCondition, LambderPathParamsOf, LambderRoutePath } from "./core/LambderRouting.js";
 export type { LambderCorsConfig } from "./core/LambderCors.js";
 export type { LambderCreateOptions, LambderSessionOptions, LambderActionTools, LambderHandler, } from "./core/LambderCreateOptions.js";
@@ -107,9 +107,9 @@ export { compressText, restoreBytes, restoreText, LambderCompressionError, LAMBD
 export type { LambderRestoreFailure, LambderRestoreBound } from "./shared/wire/LambderCompressionCodec.js";
 export { LambderSessionDataRefreshError, LambderSessionReadError } from "./session/LambderSessionManager.js";
 export { LambderSessionNotFoundError, LambderSessionAmbiguousError } from "./session/LambderSessionController.js";
-export type { LambderCache, LambderCacheKey, LambderCacheSetOptions, LambderCacheListOptions } from "./shared/contracts/LambderCache.js";
+export type { LambderCache, LambderCacheKey, LambderCacheSetOptions, LambderCacheGetOrSetOptions, LambderCacheListOptions, } from "./shared/contracts/LambderCache.js";
 export { LambderDdbCache } from "./stores/LambderDdbCache.js";
-export type { LambderDdbCacheOptions, LambderDdbCacheGetOrSetOptions, } from "./stores/LambderDdbCache.js";
+export type { LambderDdbCacheOptions } from "./stores/LambderDdbCache.js";
 export { LambderMemoryCache } from "./stores/LambderMemoryCache.js";
 export type { LambderMemoryCacheOptions } from "./stores/LambderMemoryCache.js";
 export { LambderStorageBackedCache } from "./stores/LambderStorageBackedCache.js";
@@ -120,6 +120,8 @@ export type { LambderRateLimiter, LambderRateLimitWindow, LambderRateLimitPolicy
 export { LambderDdbRateLimiter } from "./stores/LambderDdbRateLimiter.js";
 export type { LambderDdbRateLimiterOptions } from "./stores/LambderDdbRateLimiter.js";
 export { LambderMemoryRateLimiter } from "./stores/LambderMemoryRateLimiter.js";
+export { LambderPasswordHasher } from "./secrets/LambderPasswordHasher.js";
+export type { LambderPasswordHasherOptions } from "./secrets/LambderPasswordHasher.js";
 export { LambderOneShotSecrets } from "./secrets/LambderOneShotSecrets.js";
 export type { LambderOneShotSecretKind, LambderOneShotSecretsOptions, LambderOneShotIssueResult, LambderOneShotRedeemResult, LambderOneShotCodeKindNames, LambderOneShotTokenKindNames, } from "./secrets/LambderOneShotSecrets.js";
 export type { LambderOneShotSecretStore, LambderOneShotSecretRecord, LambderOneShotSecretDraft, LambderOneShotSecretShape, LambderOneShotIssueOutcome, } from "./shared/contracts/LambderOneShotSecretStore.js";
@@ -140,16 +142,17 @@ export type { LambderRateLimitKeyBuilder } from "./api/LambderApiRateLimits.js";
 export type { LambderContextRateLimit, LambderContextRateLimitCheck, LambderRateLimitCheckResult, LambderChargeablePolicyNames, LambderChargeKeyArgs, LambderRateLimitKeyFn, LambderRateLimitPer, LambderRateLimitBudget, LambderRateLimitChargeAt, LambderApiRateLimitPolicyConfig, LambderApiRateLimitsConfig, LambderAllowedPolicyNames, LambderPolicyNamesInputLacks, LambderRateLimitOption, } from "./api/LambderApiRateLimits.js";
 export type { LambderApiIdempotencyConfig } from "./api/LambderApiIdempotency.js";
 export type { LambderGuardsOptionValue, LambderRateLimitMessage, LambderRateLimitOverride, LambderRateLimitOptionValue, LambderRefusalsOptionValue, LambderApiIdempotencyOption, } from "./shared/wire/LambderApiOptionValues.js";
-export { apiGuardParam, apiGuardParamExportName } from "./shared/wire/LambderApiOptionEntries.js";
+export { apiGuardParam, apiGuardParamExportName, apisWithGuard } from "./shared/wire/LambderApiOptionEntries.js";
 export type { LambderApiOptionEntries, LambderApiOptionEntry, LambderRateLimitPolicyEntry, LambderGuardDeclarationEntry, LambderApisWithGuard, LambderApisGuardedBy, LambderApisWithMode, LambderGuardParamOf, LambderApiGuardParam, } from "./shared/wire/LambderApiOptionEntries.js";
 export { createLambderI18n } from "./shared/LambderI18n.js";
-export type { LambderLanguageMeta, LambderI18nConfig, LambderI18nInstance, LambderI18nTranslator, LambderI18nExtractParams, LambderI18nDictionaryLoader, LambderI18nCodes, LambderI18nKeys, LambderI18nTranslatorFor, } from "./shared/LambderI18n.js";
+export type { LambderLanguageMeta, LambderI18nConfig, LambderI18nInstance, LambderI18nReadonlyInstance, LambderI18nTranslator, LambderI18nExtractParams, LambderI18nDictionaryLoader, LambderI18nDictionaryEntry, LambderI18nPluralEntry, LambderI18nPluralCategory, LambderI18nCodes, LambderI18nKeys, LambderI18nTranslatorFor, } from "./shared/LambderI18n.js";
 export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiSuccessEnvelope, LambderApiRefusalEnvelope, LambderRefusalEnvelopeFields, LambderApiRefusalConfig, LambderContractEntry, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractKeysWithGuard, LambderJsonOf, LambderContractRefusalsOf, LambderContractRefusalMessage, LambderContractRefusals, LambderContractAnyRefusalMessage, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractRateLimitNames, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";
 export type { LambderRenderContext, LambderSessionRenderContext, LambderHttpEvent, LambderHttpEventFormat } from "./core/LambderContext.js";
-export type { LambderApiAnswerOutcome, LambderApiSuccessOutcome, LambderApiCallFailure, LambderApiValidationFailure, LambderApiEnvelopeFailure, LambderApiHttpAnswer, } from "./shared/wire/LambderApiOutcome.js";
+export type { LambderRenderContextOf, LambderSessionRenderContextOf } from "./core/LambderContext.js";
+export type { LambderApiAnswerOutcome, LambderApiSuccessOutcome, LambderApiFailure, LambderApiCallFailure, LambderApiValidationFailure, LambderApiEnvelopeFailure, LambderApiHttpAnswer, } from "./shared/wire/LambderApiOutcome.js";
 export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";
 export { createContext, isV2HttpEvent } from "./core/LambderContext.js";
-export type { LambderContextOptions, LambderOriginProof } from "./core/LambderContext.js";
+export type { LambderContextOptions, LambderOriginProof, LambderRequestArrival } from "./core/LambderContext.js";
 export type { LambderCallSummary, LambderCallSummaryOption } from "./core/LambderCallSummary.js";
 export type { LambderCallOutcome, LambderCallOutcomeHint } from "./shared/wire/LambderCallOutcome.js";
 export { COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BR_FIELD, COMPRESSED_PAYLOAD_BYTES_FIELD, DEFAULT_REQUEST_COMPRESSION_SETTINGS, DEFAULT_MAX_RESTORED_PAYLOAD_BYTES, DEFAULT_INVOKE_REQUEST_COMPRESSION_SETTINGS, compressPayloadBrotli, } from "./shared/wire/LambderRequestPayload.js";

package/dist/index.js

@@ -13,14 +13,14 @@ export { LambderCookieJar, parseSetCookie } from "./shared/transport/LambderCook
 export { LambderExpiringMap, LambderExpiringMapFullError } from "./shared/util/LambderExpiringMap.js";
 // Waiting longer after each failure, once: what the upload runner and an app's own retrying code climb.
 export { LambderBackoffTimer } from "./shared/util/LambderBackoffTimer.js";
-// Signed claims tokens, and the keyed digest and random secret for the secrets an app stores.
-export { LambderSignedClaims, keyedDigest, randomSecret } from "./shared/util/LambderSignedClaims.js";
+// Signed claims tokens, and the keyed digest, random secret and random code for the secrets an app stores.
+export { LambderSignedClaims, keyedDigest, randomSecret, randomCode } from "./shared/util/LambderSignedClaims.js";
 export { constantTimeEquals } from "./shared/util/LambderTextDigest.js";
 export { lambderHandlerTransport } from "./invoke/lambderHandlerTransport.js";
 export { synthesizeLambdaHttpEvent, decodeLambdaHttpResult, localLambdaContext, LAMBDER_INVOKE_HEADER, LAMBDER_INVOKED_BY_HEADER, LAMBDER_PARENT_REQUEST_HEADER, LAMBDER_INVOKE_PROTOCOL, } from "./invoke/LambderLambdaEvent.js";
 // The API core: the request, answer, envelope and pipeline both the server and the mock runtime run
 export { LambderApiPipeline } from "./api/LambderApiPipeline.js";
-export { readApiEnvelope, restoreCompressedPayload } from "./api/LambderApiRequest.js";
+export { readApiEnvelope, readApiEnvelopeText, restoreCompressedPayload } from "./api/LambderApiRequest.js";
 export { toHttpAnswer } from "./api/LambderApiAnswer.js";
 export { LambderAnswerHeaders, getAnswerHeader, setAnswerHeader, addAnswerHeader } from "./shared/wire/LambderAnswerHeaders.js";
 export { createApiCallContext } from "./api/LambderApiCallContext.js";
@@ -50,7 +50,7 @@ export { LambderMemorySessionStore } from "./stores/LambderMemorySessionStore.js
 export { LambderWebCrypto, LambderPlainSessionCrypto, isWebCryptoAvailable } from "./session/LambderSessionCrypto.js";
 export { LambderDdbSessionStore } from "./stores/LambderDdbSessionStore.js";
 // Response model
-export { LambderResponse, finalizeResponse, answerFromResponse, responseFromAnswer, } from "./core/LambderResponse.js";
+export { LambderResponse, } from "./core/LambderResponse.js";
 // Type-safe templating (tagged templates with auto-escaping)
 export { html, xml, raw, jsonScript, escapeHtml, renderHtmlValue, LambderSafeHtml } from "./shared/LambderHtml.js";
 // Comment-based HTML templating engine (build-pipeline-safe slots and conditionals, standalone)
@@ -81,6 +81,8 @@ export { LambderStorageBackedCache } from "./stores/LambderStorageBackedCache.js
 export { RATE_LIMIT_WINDOWS } from "./shared/contracts/LambderRateLimiter.js";
 export { LambderDdbRateLimiter } from "./stores/LambderDdbRateLimiter.js";
 export { LambderMemoryRateLimiter } from "./stores/LambderMemoryRateLimiter.js";
+// Passwords at rest: argon2id PHC strings through node:crypto
+export { LambderPasswordHasher } from "./secrets/LambderPasswordHasher.js";
 // One-shot secrets: codes and tokens handed out once and taken back once, the
 // store interface they live in, and the DynamoDB and in-memory stores
 export { LambderOneShotSecrets } from "./secrets/LambderOneShotSecrets.js";
@@ -97,7 +99,7 @@ export { LambderApiRefusalValidationError } from "./api/LambderApiRefusals.js";
 export { lambderRateLimitKeyBuilder, rateLimitRefusal, DEFAULT_RATE_LIMIT_REFUSAL } from "./api/LambderApiRateLimits.js";
 // The declared options as plain data: what apiOptionEntries() reports and
 // writeApiOptions writes, and the readers over the generated tables.
-export { apiGuardParam, apiGuardParamExportName } from "./shared/wire/LambderApiOptionEntries.js";
+export { apiGuardParam, apiGuardParamExportName, apisWithGuard } from "./shared/wire/LambderApiOptionEntries.js";
 // Typed translations (standalone, isomorphic)
 export { createLambderI18n } from "./shared/LambderI18n.js";
 export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";

package/dist/invoke/LambderInvokeCaller.d.ts

@@ -27,6 +27,7 @@ import { type LambderApiSignatureMap } from "../shared/wire/LambderApiSignatureM
 import type { LambdaClient, LambdaClientConfig } from "@aws-sdk/client-lambda";
 import type { LambderApiContractShape, LambderContractRefusalMessage } from "../shared/wire/LambderApiContract.js";
 import { type LambderCallArgs, type LambderContractOutputOf, type LambderGuardInputsProviderOption, type LambderSharedCallOptions } from "../shared/wire/LambderCallOptions.js";
+import { LAMBDER_BACKEND_SWAP } from "../shared/util/LambderTestingDoors.js";
 import { type LambderCompressionOption } from "../shared/wire/LambderCompressionOption.js";
 import { type LambderInvokeSession, type LambderLambdaHttpResult } from "./LambderLambdaEvent.js";
 /**
@@ -57,7 +58,11 @@ export type LambderInvokeLogListHandler = (apiName: string, logList: unknown[])
 export type LambderInvokeCallCheck = (name: string, info: {
     functionName: string;
 }) => void;
-/** The onFailure option: every failed call, once, awaited before api() throws or apiOutcome() returns. */
+/**
+ * The onFailure option: every failed call, once, awaited before api() throws
+ * or apiOutcome() returns, but for a call its own signal aborted, which is the
+ * calling code's choice rather than a failure to report.
+ */
 export type LambderInvokeFailureHandler = (failure: LambderInvokeFailure, info: {
     apiName: string;
     functionName: string;
@@ -120,8 +125,11 @@ type LambderInvokeCallerBaseOptions = {
     /**
      * Called and awaited for every failed call before api() throws or
      * apiOutcome() returns, so failures are reported in one place, before the
-     * lambda answers. A throw inside it is logged and otherwise ignored, so
-     * apiOutcome() never throws.
+     * lambda answers. A call its own signal aborted is not told: the calling
+     * code gave it up. A throw inside it is logged and otherwise ignored, so
+     * apiOutcome() never throws. The error of a failure it took is marked as
+     * reported, so the instance's crash reporting does not report it again
+     * when api() throws it up through a handler.
      */
     onFailure?: LambderInvokeFailureHandler;
     /**
@@ -183,6 +191,19 @@ export type LambderInvokeEventInit = {
 declare class LambderInvokeCallerCore<TContract extends LambderApiContractShape = any, TProvidedGuards extends string = never> {
     #private;
     constructor(options: LambderInvokeCallerOptions<TContract, TProvidedGuards>);
+    /**
+     * Points this caller, in place of the Lambda SDK, at what
+     * `lambder/testing` answers its function with: a mock app the test
+     * supplied for it, or a transport that fails every call naming the
+     * function. Keyed by a symbol no entry point exports; see
+     * registerSwappableInstance.
+     */
+    [LAMBDER_BACKEND_SWAP](twins: {
+        invokeTransport(callee: {
+            functionName: string;
+            apiPath: string;
+        }): LambderInvokeTransport;
+    }): void;
     /**
      * The event api() would send for this call, with a plain payload. For
      * tests and boot checks that hand a built package an event file.
@@ -238,7 +259,7 @@ export type LambderInvokeGroupCalls<TContract, TProvidedGuards extends string> =
     };
 };
 /**
- * A typed client of another Lambder function, over a direct Lambda invoke:
+ * A typed client of another Lambder function, over a Lambda invoke:
  * `caller.email.send(input)` for the callee's endpoint `email.send`,
  * `.outcome(input)` for its outcome, and `caller.api("email.send", input)`
  * for code that has the name as a value.

package/dist/invoke/LambderInvokeCaller.js

@@ -29,8 +29,11 @@ import { resolveApiOutcome } from "../shared/wire/LambderApiOutcome.js";
 import { mergeGuardInputs, } from "../shared/wire/LambderCallOptions.js";
 import { beginIdempotentAttempt, IDEMPOTENT_ATTEMPT_NOT_SENT } from "../shared/wire/LambderIdempotencyKeyScope.js";
 import { createCallAbort, stopWaitingWhenAborted } from "../shared/util/LambderCallAbort.js";
+import { markErrorReported } from "../shared/util/LambderErrorReportMark.js";
 import { coerceToError, errorFromCrashDetail } from "../shared/wire/LambderCrashDetail.js";
 import { assertPositiveInteger } from "../shared/util/LambderOptionChecks.js";
+import { LAMBDER_BACKEND_SWAP } from "../shared/util/LambderTestingDoors.js";
+import { registerSwappableInstance } from "../shared/util/LambderSwappableInstances.js";
 import { resolveCompressionOption } from "../shared/wire/LambderCompressionOption.js";
 import { DEFAULT_INVOKE_REQUEST_COMPRESSION_SETTINGS, DEFAULT_MAX_RESTORED_PAYLOAD_BYTES, compressPayloadBrotli, resolveRequestCompressionMinBytes, } from "../shared/wire/LambderRequestPayload.js";
 import { DEFAULT_API_PATH } from "../shared/wire/LambderDefaultApiPath.js";
@@ -63,6 +66,7 @@ class LambderInvokeCallerCore {
     #beforeCall;
     #guardInputsProvider;
     #sessionTokenCookieKey;
+    /** The transport given, or the Lambda SDK; `lambder/testing` replaces the SDK's through the swap door below. */
     #transport;
     #clientConfig;
     #client;
@@ -88,12 +92,26 @@ class LambderInvokeCallerCore {
         this.#guardInputsProvider = guardInputsProvider;
         this.#sessionTokenCookieKey = sessionTokenCookieKey ?? DEFAULT_SESSION_TOKEN_COOKIE_KEY;
         this.#transport = transport ?? ((_event, { eventJson, signal }) => this.#invokeThroughSdk(eventJson, signal));
+        // A caller given a transport reaches what the transport reaches, which
+        // its author chose; only the SDK path is the test kit's to replace.
+        if (!transport)
+            registerSwappableInstance(this);
         // Each group of the callee's contract, as a property:
         // caller.email.send(input) is caller.api("email.send", input), and
         // .outcome the apiOutcome.
         const byName = this;
         return withApiGroupCalls(this, (apiName, args) => byName.api(apiName, ...args), (apiName, args) => byName.apiOutcome(apiName, ...args));
     }
+    /**
+     * Points this caller, in place of the Lambda SDK, at what
+     * `lambder/testing` answers its function with: a mock app the test
+     * supplied for it, or a transport that fails every call naming the
+     * function. Keyed by a symbol no entry point exports; see
+     * registerSwappableInstance.
+     */
+    [LAMBDER_BACKEND_SWAP](twins) {
+        this.#transport = twins.invokeTransport({ functionName: this.#functionName, apiPath: this.#apiPath });
+    }
     /**
      * The event api() would send for this call, with a plain payload. For
      * tests and boot checks that hand a built package an event file.
@@ -184,7 +202,12 @@ class LambderInvokeCallerCore {
         }
         return { functionError: output.FunctionError ?? null, result };
     }
-    /** Delivers one event, serialized exactly once; an event over the invoke cap, a rejected transport, or one that answered after the call was given up on, is a failure. */
+    /**
+     * Delivers one event, serialized exactly once; an event over the invoke
+     * cap, a rejected transport, or one that answered after the call was given
+     * up on, is a failure. `reachedTransport` says whether the transport was
+     * handed the event, since only then may the callee have run.
+     */
     async #deliverEvent(event, eventJson, options) {
         // Measured here so every path that delivers an event is capped: an
         // oversized event would otherwise come back as the SDK's
@@ -192,7 +215,7 @@ class LambderInvokeCallerCore {
         // names neither the size nor the cap.
         const bytes = Buffer.byteLength(eventJson, "utf8");
         if (bytes > LAMBDER_INVOKE_MAX_EVENT_BYTES) {
-            return { failed: {
+            return { reachedTransport: false, failed: {
                     reason: 'payloadTooLarge', bytes,
                     detail: `the event is ${bytes} bytes, over the ${LAMBDER_INVOKE_MAX_EVENT_BYTES} byte invoke cap`,
                 } };
@@ -206,21 +229,22 @@ class LambderInvokeCallerCore {
             // and not every transport meets it.
             const refused = abort.abortFailure("beforeSending");
             if (refused)
-                return { failed: { reason: refused.reason, cause: refused.error, detail: refused.error.message } };
+                return { reachedTransport: false, failed: { reason: refused.reason, cause: refused.error, detail: refused.error.message } };
             const sent = await this.#transport(event, { functionName: this.#functionName, eventJson, signal: abort.signal });
             // An answer that arrives after the abort is not a success: a
             // transport that ignores the signal resolves late, and trusting it
             // would hand the call site data it had already abandoned.
             const late = abort.abortFailure("afterAnswering");
             if (late)
-                return { failed: { reason: late.reason, cause: late.error, detail: late.error.message } };
+                return { reachedTransport: true, failed: { reason: late.reason, cause: late.error, detail: late.error.message } };
             return { sent };
         }
         catch (err) {
             const cause = coerceToError(err, "the invoke failed");
-            // The caller's own timeout wins, since only the caller knows about
-            // it; otherwise the rejection says what it was.
-            return { failed: { reason: abort.timedOut() ? 'timeout' : classifyDeliveryFailure(cause), cause } };
+            // The caller's own abort wins, timeout or signal, since only the
+            // caller knows which aborted the call; otherwise the rejection
+            // says what it was.
+            return { reachedTransport: true, failed: { reason: abort.abortReason() ?? classifyDeliveryFailure(cause), cause } };
         }
         finally {
             abort.detach();
@@ -267,11 +291,18 @@ class LambderInvokeCallerCore {
             ...(init.response !== undefined ? { response: init.response } : {}),
         };
         error.outcome = failure;
-        if (this.#onFailure) {
+        // The calling code aborted this call itself, so there is nothing to
+        // report: the error still reaches whoever reads the outcome.
+        if (this.#onFailure && failure.reason !== 'aborted') {
             // A reporting hook that breaks must not turn apiOutcome() into a
             // throwing call, nor replace the failure it was told about.
             try {
                 await this.#onFailure(failure, { apiName, functionName: this.#functionName });
+                // Reported now, so the crash reporting a thrown api() reaches
+                // skips it rather than recording the one failure twice. Only
+                // once the hook returned: one that threw may have reported
+                // nothing, and a duplicate is better than a loss.
+                markErrorReported(error);
             }
             catch (err) {
                 console.error(`[lambder invoke] onFailure threw for ${this.#functionName} ${apiName}`, err);
@@ -368,8 +399,15 @@ class LambderInvokeCallerCore {
             return await this.#failureOutcome(apiName, { reason: 'unknown', cause: coerceToError(err, "the call could not be built") });
         }
         const delivery = await this.#deliverEvent(event, eventJson, options);
-        if ("failed" in delivery)
+        if ("failed" in delivery) {
+            // An event the transport was never handed did not use the key,
+            // whatever the failure reads as (an abort reads as aborted or
+            // timeout): the same as the browser caller's failure before
+            // sending.
+            if (!delivery.reachedTransport)
+                idempotentAttempt.settle(IDEMPOTENT_ATTEMPT_NOT_SENT);
             return await this.#failureOutcome(apiName, delivery.failed);
+        }
         if (delivery.sent.functionError) {
             return await this.#failureOutcome(apiName, { reason: 'crash', functionError: parseFunctionError(delivery.sent.result) });
         }

package/dist/invoke/LambderInvokeOutcome.d.ts

@@ -69,14 +69,15 @@ export type LambderInvokeEnvelopeFailure<TMessage extends LambderUncheckedRefusa
     refusal: TMessage;
 });
 /**
- * Nothing usable came back: the invoke never arrived or was given up on, the
- * Lambda service answered instead of the callee, the callee answered 5xx, or
- * something around the call threw. A 5xx carries `response` when the callee
- * answered with Lambder's own envelope, which is how a crash detail and a
- * logList arrive with it.
+ * Nothing usable came back: the invoke never arrived or was given up on (by
+ * its timeout, or by the calling code through its signal), the Lambda service
+ * answered instead of the callee, the callee answered 5xx, or something
+ * around the call threw. A 5xx carries `response` when the callee answered
+ * with Lambder's own envelope, which is how a crash detail and a logList
+ * arrive with it.
  */
 export type LambderInvokeDeliveryFailure<TMessage extends LambderUncheckedRefusalMessage = LambderUncheckedRefusalMessage> = LambderInvokeFailureFields<TMessage> & {
-    reason: 'network' | 'timeout' | 'server' | 'protocol' | 'unknown';
+    reason: 'network' | 'timeout' | 'aborted' | 'server' | 'protocol' | 'unknown';
     response?: LambderApiRefusalEnvelope;
     /** The callee's crash detail, when its global error handler sent one (the envelope's `crash` field). */
     crash?: LambderCrashDetail;

package/dist/mock/LambderMockAdapterDoor.d.ts

@@ -0,0 +1,40 @@
+import type { LambderApiRequest } from "../api/LambderApiRequest.js";
+/**
+ * The key of the door the mock's own adapters open on a LambderMockApp: what
+ * an adapter asks of the runtime and tells it beyond handing it a call.
+ *
+ * A symbol rather than named members, and exported by no entry point: the
+ * package's exports map is what a consumer can import, so only an adapter of
+ * the package's own (the MSW handler) can name the key, and nothing on the
+ * app's typed surface offers an app the adapter's bookkeeping as an API.
+ */
+export declare const LAMBDER_MOCK_ADAPTER_DOOR: unique symbol;
+/** What a LambderMockApp answers to LAMBDER_MOCK_ADAPTER_DOOR. */
+export type LambderMockAdapterDoor = {
+    /**
+     * Whether a call to this name would be answered from the registry, which
+     * is what an adapter asks before passing one on. Asked once per request,
+     * so not a list to scan.
+     *
+     * True for every name once a rest entry is registered, since it answers
+     * whatever nothing else claimed. That makes a rest entry and the MSW
+     * adapter's `onUnmocked: "passthrough"` alternatives rather than layers:
+     * with one registered, nothing is handed on to the network.
+     */
+    hasRegisteredEntry(apiName: string): boolean;
+    /**
+     * Records a call the adapter handed on instead of answering: the MSW
+     * adapter's passthrough. Without it a name the registry does not know
+     * leaves no trace at all, and a mistyped endpoint reaches the real
+     * network with nothing in the call log or on the subscription to say so,
+     * which is the one failure the log exists to make visible.
+     */
+    notePassthrough(request: LambderApiRequest): void;
+    /**
+     * Mirrors an answer's non-HttpOnly cookies into document.cookie and
+     * remembers them, so reset() expires them again. The direct transport's
+     * "document" mode and the MSW adapter both come through the runtime's one
+     * mirror, so there is one record of what was planted.
+     */
+    mirrorCookiesIntoDocument(setCookies: readonly string[]): void;
+};

package/dist/mock/LambderMockAdapterDoor.js

@@ -0,0 +1,10 @@
+/**
+ * The key of the door the mock's own adapters open on a LambderMockApp: what
+ * an adapter asks of the runtime and tells it beyond handing it a call.
+ *
+ * A symbol rather than named members, and exported by no entry point: the
+ * package's exports map is what a consumer can import, so only an adapter of
+ * the package's own (the MSW handler) can name the key, and nothing on the
+ * app's typed surface offers an app the adapter's bookkeeping as an API.
+ */
+export const LAMBDER_MOCK_ADAPTER_DOOR = Symbol("lambder.mockAdapterDoor");

package/dist/mock/LambderMockApiSchemas.d.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+import { type LambderApiSchemaEntries } from "../shared/wire/LambderApiSchemaEntries.js";
+/**
+ * The generated `apiSchemas` table, as the schemas the mock validates every
+ * call's input with and parses every answer through.
+ */
+export declare class LambderMockApiSchemas {
+    private readonly table;
+    private readonly rebuilt;
+    constructor(table: LambderApiSchemaEntries);
+    /**
+     * The schema an entry's input is validated with, as the pipeline takes it
+     * at registration: lazy, so it is rebuilt on the first call that reaches
+     * it. A name the table does not hold throws here, when the entry is
+     * registered, rather than on its first call.
+     */
+    inputOf(apiName: string): z.ZodType;
+    /**
+     * An answer a handler returned, parsed through the server's output schema
+     * as the server parses its own: what the schema does not declare dropped,
+     * its defaults filled. What it rejects, or a parse that throws, is the
+     * handler breaking its contract, the error the server crashes with.
+     */
+    parseOutput(apiName: string, returned: unknown): unknown;
+    private assertHeld;
+    /** One of an API's schemas, rebuilt the first time it is asked for and kept. */
+    private rebuiltSchema;
+}