lambder 15.0.1 → 15.0.2

package/CHANGELOG.md

@@ -9,6 +9,28 @@ sit on its first published patch, and later patches list only what they changed.
 Releases up to 3.2.6 carry git tags; the ones after it were published without
 one, so versions are not cross-linked to tag comparisons here.
 
+## [15.0.2] - 2026-10-02
+
+A patch: two fixes for apps with a large contract.
+
+### Fixed
+
+- **Reading a failure compiles for a contract of hundreds of refusal codes.**
+  `failure.reason`, `failure.refusal`, `outcome.ok` and every other read of a
+  `LambderApiFailure` or `LambderApiOutcome` over a contract's refusal
+  messages failed with TS2590 ("union type too complex to represent") once
+  the vocabulary held a few hundred codes, and so did a `LambderCaller` whose
+  `fetchEndedHandler` or `errorHandler` read its argument: the refusal arm
+  declared its message both on the fields every failure shares and on the arm
+  itself, and a read of the intersection crossed the message union with
+  itself. Each arm now declares it once. The types describe the same values.
+- **`checkApiRefusals` no longer reports a mock guard's unused codes.** A mock
+  guard declares exactly its server guard's codes, which `create()` holds it
+  to against `guardDeclarations`, so one that raises fewer (a captcha stand-in
+  letting every token through) got an `unused` finding it could not act on.
+  Its codes are still checked the other way: one it raises and may not send
+  is `undeclared`.
+
 ## [15.0.1] - 2026-10-02
 
 A major. Fixes for crashes, misconfigurations that passed silently, and places

package/dist/build/checkApiRefusals.d.ts

@@ -16,7 +16,7 @@ export type LambderRefusalCheckFinding = {
     at: string;
     /**
      * - `undeclared`: a code the handler can reach that it may not send.
-     * - `unused`: a code the handler's own `refusals` option names that nothing it reaches raises.
+     * - `unused`: a code the handler's own `refusals` option names that nothing it reaches raises. Never a mock guard's, whose codes are its server guard's.
      * - `uncoded`: a refusal with no code it can reach, where codes are required.
      * - `unreadable`: a refusal it can reach whose code is not a string literal type.
      * - `untraced`: a handler handed a typed refuse whose function cannot be

package/dist/build/checkApiRefusals.js

@@ -67,6 +67,24 @@ export const checkApiRefusals = async (options) => {
             return true;
         return isInside(path, lambderRoot) && !isInside(path, resolve(lambderRoot, "tests")) && !parts.slice(lambderRoot.split(sep).length).includes("node_modules");
     };
+    /**
+     * Whether a registration is a mock guard: `guard` read off a mock init,
+     * whose builder Lambder declares in its mock entry, where a server init's
+     * is declared in its own.
+     */
+    const isMockGuard = (call, registration) => {
+        if (registration !== "guard" || !ts.isPropertyAccessExpression(call.expression))
+            return false;
+        const declaration = checker.getSymbolAtLocation(call.expression.name)?.declarations?.[0];
+        if (!declaration || !isLambderDeclaration(declaration))
+            return false;
+        const path = realPathOf(ts, declaration.getSourceFile().fileName);
+        const parts = path.split(sep);
+        const packageAt = parts.findIndex((part, index) => part === "lambder" && parts[index - 1] === "node_modules");
+        // The path inside the package: dist/mock/... installed, src/mock/... over its own sources.
+        const inside = packageAt >= 0 ? parts.slice(packageAt + 1) : relative(lambderRoot, path).split(sep);
+        return inside[1] === "mock";
+    };
     const where = (node) => {
         const sourceFile = node.getSourceFile();
         const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
@@ -390,6 +408,12 @@ export const checkApiRefusals = async (options) => {
                 findings.push({ handler: name, at, problem: "unreadable", raisedAt: raise.at });
             }
         }
+        // A mock guard declares its server guard's codes, which create() holds
+        // it to against guardDeclarations. Standing in for that guard it may
+        // raise fewer of them, which only lets more through, so a code it
+        // never raises is no declaration to trim.
+        if (isMockGuard(call, registration))
+            return;
         for (const code of ownRefusalsOf(optionsNode) ?? []) {
             if (!reached.has(code))
                 findings.push({ handler: name, at, problem: "unused", code });

package/dist/shared/wire/LambderApiOutcome.d.ts

@@ -42,13 +42,17 @@ export type LambderApiSuccessOutcome<T> = {
  * message the endpoint can answer with (LambderContractRefusalMessage), on
  * every arm: a refusal flagged notAuthorized arrives as that reason and still
  * carries its message.
+ *
+ * The message is declared once per arm, never here and again on the arm that
+ * requires it: an intersection reading `refusal` from both would intersect
+ * TMessage with itself, a union of every code a contract declares crossed
+ * with itself, which for a contract of a few hundred codes is past what the
+ * compiler can represent (TS2590 on any read of a failure).
  */
-type LambderApiFailureFields<TMessage extends LambderUncheckedRefusalMessage> = {
+type LambderApiFailureFields = {
     ok: false;
     /** HTTP status, when a response was received. */
     status?: number;
-    /** The envelope's refusal, when the server provided one: always the message object, a plain string having been read as one (refusalMessageOf). */
-    refusal?: TMessage;
     /** Seconds to wait before retrying, from the response's Retry-After header (rate-limit refusals send it, and so may a 503). */
     retryAfterSeconds?: number;
     /**
@@ -69,21 +73,26 @@ type LambderApiFailureFields<TMessage extends LambderUncheckedRefusalMessage> =
  * `response` when the server answered with Lambder's own envelope, which is
  * how a crash detail and a logList arrive with it.
  */
-export type LambderApiCallFailure<TMessage extends LambderUncheckedRefusalMessage = LambderUncheckedRefusalMessage> = LambderApiFailureFields<TMessage> & {
+export type LambderApiCallFailure<TMessage extends LambderUncheckedRefusalMessage = LambderUncheckedRefusalMessage> = LambderApiFailureFields & {
     reason: 'network' | 'timeout' | 'aborted' | 'server' | 'unknown';
+    /** The envelope's refusal, when the server provided one: always the message object, a plain string having been read as one (refusalMessageOf). */
+    refusal?: TMessage;
     error: Error;
     response?: LambderApiRefusalEnvelope;
 };
 /** HTTP 422: the server rejected the input against the API's schema. Always carries the issues. */
-export type LambderApiValidationFailure<TMessage extends LambderUncheckedRefusalMessage = LambderUncheckedRefusalMessage> = LambderApiFailureFields<TMessage> & {
+export type LambderApiValidationFailure<TMessage extends LambderUncheckedRefusalMessage = LambderUncheckedRefusalMessage> = LambderApiFailureFields & {
     reason: 'validation';
+    /** As on a call failure. */
+    refusal?: TMessage;
     zodError: LambderValidationError;
 };
 /** The server answered, and the envelope itself says the call is refused. Always carries that envelope, and a `refusal` failure always carries the refusal. */
-export type LambderApiEnvelopeFailure<TMessage extends LambderUncheckedRefusalMessage = LambderUncheckedRefusalMessage> = LambderApiFailureFields<TMessage> & {
+export type LambderApiEnvelopeFailure<TMessage extends LambderUncheckedRefusalMessage = LambderUncheckedRefusalMessage> = LambderApiFailureFields & {
     response: LambderApiRefusalEnvelope;
 } & ({
-    reason: 'versionExpired' | 'sessionExpired' | 'notAuthorized';
+    reason: 'versionExpired' | 'sessionExpired' | 'notAuthorized'; /** As on a call failure. */
+    refusal?: TMessage;
 } | {
     reason: 'refusal';
     refusal: TMessage;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "15.0.1",
+  "version": "15.0.2",
   "sideEffects": false,
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [