lambder 2.0.18 → 3.0.0

package/dist/LambderResponseBuilder.js

@@ -1,205 +1,174 @@
 import mimeTypeResolver from "mime-types";
 import { getFS, getPath } from "./node-polyfills.js";
-const convertToMultiHeader = (headers) => Object.fromEntries(Object.entries(headers || {}).map(([k, v]) => [k, Array.isArray(v) ? v : [v]]));
-const CORS_HEADERS = convertToMultiHeader({
-    "Access-Control-Allow-Credentials": "true",
-    "Access-Control-Allow-Headers": "Origin, X-Requested-With, Content-Type, Accept",
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "OPTIONS,POST",
-});
+import { LambderResponse } from "./LambderResponse.js";
+import { LambderTemplatingEngine } from "./LambderTemplatingEngine.js";
+// Compiled templates survive across requests (builder instances are per-request).
+const templateFileCache = new Map();
 export default class LambderResponseBuilder {
-    isCorsEnabled;
     publicPath;
     apiVersion;
-    lambderUtils;
     ctx;
-    constructor({ isCorsEnabled, publicPath, apiVersion, lambderUtils, ctx }) {
-        this.isCorsEnabled = isCorsEnabled;
+    constructor({ publicPath, apiVersion, ctx }) {
         this.publicPath = publicPath;
         this.apiVersion = apiVersion ?? null;
-        this.lambderUtils = lambderUtils;
         this.ctx = ctx;
     }
     ;
-    async readPublicFileSync(filePath) {
-        const fs = await getFS();
-        const path = await getPath();
-        if (!fs || !path) {
-            throw new Error("File system operations are not available in browser environment");
-        }
-        const publicPath = path.resolve(this.publicPath);
-        const normalizedFilePath = filePath.startsWith('/') ? filePath.slice(1) : filePath;
-        const absolutePath = path.resolve(publicPath, normalizedFilePath);
-        if (!absolutePath.startsWith(publicPath)) {
-            return "forbidden-public-path";
+    buildResponse(statusCode, contentType, body, options, defaults) {
+        const response = new LambderResponse({
+            statusCode: options?.statusCode ?? statusCode,
+            headers: contentType ? { "Content-Type": contentType } : {},
+            body,
+            compress: options?.compress ?? defaults?.compress ?? "auto",
+            etag: options?.etag ?? defaults?.etag ?? "auto",
+        });
+        if (options?.headers) {
+            for (const [key, value] of Object.entries(options.headers))
+                response.setHeader(key, value);
         }
-        return await fs.promises.readFile(absolutePath);
+        if (options?.cacheControl)
+            response.setHeader("Cache-Control", options.cacheControl);
+        return response;
     }
-    ;
-    async checkPublicFileExist(filePath) {
+    async resolvePublicFilePath(filePath) {
         const fs = await getFS();
         const path = await getPath();
-        if (!fs || !path) {
-            return false;
-        }
+        if (!fs || !path)
+            return null;
         const publicPath = path.resolve(this.publicPath);
         const normalizedFilePath = filePath.startsWith('/') ? filePath.slice(1) : filePath;
         const absolutePath = path.resolve(publicPath, normalizedFilePath);
-        if (!absolutePath.startsWith(publicPath)) {
-            return false;
-        }
+        if (absolutePath !== publicPath && !absolutePath.startsWith(publicPath + path.sep))
+            return null;
         try {
             const stat = await fs.promises.stat(absolutePath);
-            return stat.isFile();
+            return stat.isFile() ? absolutePath : null;
         }
         catch {
-            return false;
+            return null;
         }
     }
     ;
     addHeader(key, value) {
         if (!this.ctx)
             throw new Error(".addHeader function is not available within this hook");
-        else {
-            this.ctx._otherInternal.addHeaderFnAccumulator.push({ key, value });
-        }
+        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key, value });
     }
     ;
     setHeader(key, value) {
         if (!this.ctx)
             throw new Error(".setHeader function is not available within this hook");
-        else {
-            this.ctx._otherInternal.addHeaderFnAccumulator = this.ctx._otherInternal.addHeaderFnAccumulator
-                .filter((header) => header.key !== key);
-            this.ctx._otherInternal.setHeaderFnAccumulator.push({ key, value });
-        }
+        this.ctx._otherInternal.addHeaderFnAccumulator = this.ctx._otherInternal.addHeaderFnAccumulator
+            .filter((header) => header.key !== key);
+        this.ctx._otherInternal.setHeaderFnAccumulator.push({ key, value });
     }
     ;
     logToApiResponse(input) {
         if (!this.ctx)
-            throw new Error(".logToResponse function is not available within this hook");
-        else {
-            this.ctx._otherInternal.logToApiResponseAccumulator.push(input);
-        }
+            throw new Error(".logToApiResponse function is not available within this hook");
+        this.ctx._otherInternal.logToApiResponseAccumulator.push(input);
+    }
+    ;
+    raw(init) {
+        return new LambderResponse({
+            statusCode: init.statusCode,
+            headers: init.headers ?? init.multiValueHeaders,
+            body: init.body,
+            isBodyBase64: init.isBase64Encoded ?? false,
+            compress: init.compress ?? (init.isBase64Encoded ? false : "auto"),
+            etag: init.etag ?? "auto",
+        });
     }
     ;
-    raw(param) {
-        return param;
+    json(data, options) {
+        return this.buildResponse(200, "application/json; charset=utf-8", JSON.stringify(data), options);
     }
-    ;
-    json(data, headers) {
-        return this.raw({
-            statusCode: 200,
-            multiValueHeaders: {
-                "Content-Type": ["application/json; charset=utf-8"],
-                ...(this.isCorsEnabled ? CORS_HEADERS : {}),
-                ...convertToMultiHeader(headers)
-            },
-            body: JSON.stringify(data),
-        });
+    text(data, options) {
+        return this.buildResponse(200, "text/plain; charset=utf-8", data, options);
     }
-    xml(data) {
-        return this.raw({
-            statusCode: 200,
-            isBase64Encoded: true,
-            multiValueHeaders: { "Content-Type": ["application/xml; charset=utf-8"] },
-            body: Buffer.from(data).toString("base64"),
-        });
+    xml(data, options) {
+        return this.buildResponse(200, "application/xml; charset=utf-8", String(data), options);
     }
     ;
-    html(data, headers) {
-        return this.raw({
-            statusCode: 200,
-            isBase64Encoded: true,
-            multiValueHeaders: { "Content-Type": ["text/html; charset=utf-8"], ...convertToMultiHeader(headers) },
-            body: Buffer.from(data).toString("base64"),
-        });
+    html(data, options) {
+        return this.buildResponse(200, "text/html; charset=utf-8", String(data), options);
     }
     ;
-    redirect(url, statusCode = 302, headers) {
-        return this.raw({
-            statusCode: statusCode,
-            multiValueHeaders: { "Location": [url], ...convertToMultiHeader(headers) },
-            body: null
-        });
+    status(statusCode, body, options) {
+        return this.buildResponse(statusCode, "text/html; charset=utf-8", body ?? "", options);
     }
     ;
-    status404(data, headers) {
-        return this.raw({
-            statusCode: 404,
-            isBase64Encoded: true,
-            multiValueHeaders: { "Content-Type": ["text/html; charset=utf-8"], ...convertToMultiHeader(headers) },
-            body: Buffer.from(data).toString("base64"),
-        });
+    status404(data, options) {
+        return this.buildResponse(404, "text/html; charset=utf-8", data, options);
     }
     ;
-    versionExpired(headers) {
-        return this.api(null, { versionExpired: true }, headers);
+    redirect(url, statusCode = 302, options) {
+        const response = this.buildResponse(statusCode, null, null, options);
+        response.setHeader("Location", url);
+        return response;
     }
     ;
-    cors() {
-        return this.raw({
-            statusCode: 200,
-            multiValueHeaders: this.isCorsEnabled ? CORS_HEADERS : {},
-            body: JSON.stringify(""),
-        });
+    versionExpired(options) {
+        return this.api(null, { versionExpired: true }, options);
     }
     ;
-    fileBase64(fileBase64, mimeType, headers) {
-        return this.raw({
-            statusCode: 200,
-            isBase64Encoded: true,
-            multiValueHeaders: { "Content-Type": [mimeType || "application/octet-stream"], ...convertToMultiHeader(headers) },
+    fileBase64(fileBase64, mimeType, options) {
+        const response = new LambderResponse({
+            statusCode: options?.statusCode ?? 200,
+            headers: { "Content-Type": mimeType || "application/octet-stream" },
             body: fileBase64,
+            isBodyBase64: true,
+            compress: false,
+            etag: options?.etag ?? "auto",
         });
+        if (options?.headers) {
+            for (const [key, value] of Object.entries(options.headers))
+                response.setHeader(key, value);
+        }
+        if (options?.cacheControl)
+            response.setHeader("Cache-Control", options.cacheControl);
+        return response;
     }
     ;
-    async file(filePath, headers, fallbackFilePath) {
-        const doesFileExist = await this.checkPublicFileExist(filePath);
-        if (!doesFileExist) {
-            if (fallbackFilePath) {
-                const doesFallbackExist = await this.checkPublicFileExist(fallbackFilePath);
-                if (doesFallbackExist) {
-                    return await this.file(fallbackFilePath, headers);
-                }
-            }
-            return this.json({ error: "File not found: " + filePath });
+    async file(filePath, options) {
+        let resolvedPath = await this.resolvePublicFilePath(filePath);
+        let effectivePath = filePath;
+        if (!resolvedPath && options?.fallback) {
+            resolvedPath = await this.resolvePublicFilePath(options.fallback);
+            effectivePath = options.fallback;
         }
-        const mimeType = mimeTypeResolver.lookup(filePath);
-        const body = await this.readPublicFileSync(filePath);
-        if (body === "forbidden-public-path") {
-            throw new Error("Forbidden public path: " + filePath);
+        if (!resolvedPath) {
+            return this.status404("File not found", { etag: false });
         }
-        const bodyBuffer = Buffer.isBuffer(body) ? body : Buffer.from(body);
-        const bodyBase64 = bodyBuffer.toString("base64");
-        console.log("bodyBase64.length", bodyBase64.length);
-        return this.fileBase64(bodyBase64, mimeType || "application/octet-stream", headers);
-    }
-    ;
-    async ejsTemplate(template, pageData, headers) {
-        const renderedResult = await this.lambderUtils.renderEjs(template, pageData);
-        return this.raw({
-            statusCode: 200,
-            isBase64Encoded: true,
-            multiValueHeaders: { "Content-Type": ["text/html; charset=utf-8"], ...convertToMultiHeader(headers) },
-            body: Buffer.from(renderedResult).toString("base64"),
-        });
-    }
-    ;
-    async ejsFile(filePath, pageData, headers) {
-        const renderedResult = await this.lambderUtils.renderEjsFile(filePath, pageData);
-        return this.raw({
-            statusCode: 200,
-            isBase64Encoded: true,
-            multiValueHeaders: { "Content-Type": ["text/html; charset=utf-8"], ...convertToMultiHeader(headers) },
-            body: Buffer.from(renderedResult).toString("base64"),
-        });
+        const fs = await getFS();
+        if (!fs)
+            return this.status404("File not found", { etag: false });
+        const body = await fs.promises.readFile(resolvedPath);
+        const mimeType = mimeTypeResolver.lookup(effectivePath) || "application/octet-stream";
+        return this.buildResponse(200, mimeType, body, options);
+    }
+    ;
+    /**
+     * Render an HTML file under publicPath through LambderTemplatingEngine
+     * (comment-based slots/conditionals) and return it as an HTML response.
+     * The compiled template is cached across warm invocations; a missing file
+     * throws (it is a server-side configuration error, not a client 404).
+     * Set htmlVirtualSlots to expose "title"/"head" slots on marker-less files.
+     */
+    async templateFile(filePath, data, options) {
+        const resolvedPath = await this.resolvePublicFilePath(filePath);
+        if (!resolvedPath)
+            throw new Error(`templateFile: file not found under publicPath: ${filePath}`);
+        const cacheKey = `${resolvedPath}|${options?.htmlVirtualSlots ? "v" : ""}`;
+        let template = templateFileCache.get(cacheKey);
+        if (!template) {
+            template = await LambderTemplatingEngine.fromFile(resolvedPath, { htmlVirtualSlots: options?.htmlVirtualSlots });
+            templateFileCache.set(cacheKey, template);
+        }
+        return this.buildResponse(200, "text/html; charset=utf-8", template.render(data), options);
     }
     ;
-    api(payload, { versionExpired, sessionExpired, notAuthorized, message, errorMessage, logList, } = {
-        versionExpired: undefined, sessionExpired: undefined, notAuthorized: undefined,
-        message: null, errorMessage: null, logList: undefined
-    }, headers) {
+    api(payload, { versionExpired, sessionExpired, notAuthorized, message, errorMessage, logList, } = {}, options) {
         const finalLogList = logList || this.ctx?._otherInternal?.logToApiResponseAccumulator;
         return this.json({
             apiVersion: this.apiVersion,
@@ -210,34 +179,12 @@ export default class LambderResponseBuilder {
             ...(message ? { message } : {}),
             ...(errorMessage ? { errorMessage } : {}),
             ...(finalLogList?.length ? { logList: finalLogList } : {}),
-        }, headers);
+        }, options);
     }
     ;
-    apiBinary(payload, { versionExpired, sessionExpired, notAuthorized, message, errorMessage, logList, } = {
-        versionExpired: undefined, sessionExpired: undefined, notAuthorized: undefined,
-        message: null, errorMessage: null, logList: undefined
-    }, headers) {
-        const finalLogList = logList || this.ctx?._otherInternal?.logToApiResponseAccumulator;
-        const result = {
-            apiVersion: this.apiVersion,
-            payload,
-            ...(versionExpired ? { versionExpired } : {}),
-            ...(sessionExpired ? { sessionExpired } : {}),
-            ...(notAuthorized ? { notAuthorized } : {}),
-            ...(message ? { message } : {}),
-            ...(errorMessage ? { errorMessage } : {}),
-            ...(finalLogList?.length ? { logList: finalLogList } : {}),
-        };
-        return this.raw({
-            statusCode: 200,
-            isBase64Encoded: true,
-            multiValueHeaders: {
-                "Content-Type": ["application/lambder-json-stream"],
-                "Content-Encoding": ["gzip"],
-                ...convertToMultiHeader(headers)
-            },
-            body: Buffer.from(JSON.stringify(result)).toString("base64"),
-        });
+    /** Same as api() but forces gzip compression of the response body. */
+    apiBinary(payload, config = {}, options) {
+        return this.api(payload, config, { ...options, compress: true });
     }
     ;
 }

package/dist/LambderRouting.d.ts

@@ -0,0 +1,23 @@
+import type { LambderRenderContext } from "./LambderContext.js";
+type Path = `/${string}`;
+type CutAt<S extends string, D extends string> = S extends `${infer Head}${D}${string}` ? Head : S;
+type ParamNameFrom<S extends string> = CutAt<CutAt<CutAt<CutAt<CutAt<CutAt<CutAt<S, "/">, ".">, "(">, "?">, "+">, "*">, "-">;
+type PathParamNames<T extends string> = T extends `${string}:${infer Rest}` ? (ParamNameFrom<Rest> extends "" ? never : ParamNameFrom<Rest>) | PathParamNames<Rest> : never;
+export type PathParamsOf<T extends string> = string extends T ? Record<string, string> : T extends `${string}(${string}` ? Record<string, string> : [PathParamNames<T>] extends [never] ? Record<string, string> : {
+    [K in PathParamNames<T>]: string;
+};
+export type ConditionFunction = (ctx: LambderRenderContext) => boolean;
+/** Structured route matcher: all provided fields must match. */
+export type LambderRouteMatcher = {
+    path?: Path | RegExp;
+    host?: string | RegExp;
+    /** One or more HTTP methods; HEAD requests also match GET routes. */
+    method?: string | string[];
+    condition?: ConditionFunction;
+};
+export type RouteCondition = Path | RegExp | ConditionFunction | LambderRouteMatcher;
+/** Returns matched path params, or false when the route doesn't match. */
+export type CompiledMatcher = (ctx: LambderRenderContext) => false | Record<string, string>;
+/** Compile a route condition once at registration time. */
+export declare const compileRouteMatcher: (condition: RouteCondition) => CompiledMatcher;
+export {};

package/dist/LambderRouting.js

@@ -0,0 +1,67 @@
+import { match as pathToRegexpMatch } from "path-to-regexp";
+const compilePathMatcher = (path) => {
+    if (typeof path === "string") {
+        const matchFn = pathToRegexpMatch(path, { decode: decodeURIComponent });
+        return (requestPath) => {
+            const result = matchFn(requestPath);
+            if (!result)
+                return false;
+            const params = {};
+            for (const [key, value] of Object.entries(result.params ?? {})) {
+                params[key] = Array.isArray(value) ? value.join("/") : String(value);
+            }
+            return params;
+        };
+    }
+    return (requestPath) => {
+        const matched = requestPath.match(path);
+        if (!matched)
+            return false;
+        if (matched.groups)
+            return { ...matched.groups };
+        const params = {};
+        matched.forEach((value, index) => {
+            if (value !== undefined)
+                params[String(index)] = value;
+        });
+        return params;
+    };
+};
+/** Compile a route condition once at registration time. */
+export const compileRouteMatcher = (condition) => {
+    if (typeof condition === "string" || condition instanceof RegExp) {
+        const pathMatcher = compilePathMatcher(condition);
+        return (ctx) => pathMatcher(ctx.path);
+    }
+    if (typeof condition === "function") {
+        return (ctx) => condition(ctx) ? {} : false;
+    }
+    const matcher = condition;
+    const pathMatcher = matcher.path !== undefined ? compilePathMatcher(matcher.path) : null;
+    const methods = matcher.method !== undefined
+        ? new Set((Array.isArray(matcher.method) ? matcher.method : [matcher.method]).map((m) => m.toUpperCase()))
+        : null;
+    return (ctx) => {
+        if (methods) {
+            let requestMethod = ctx.method.toUpperCase();
+            if (requestMethod === "HEAD" && !methods.has("HEAD"))
+                requestMethod = "GET";
+            if (!methods.has(requestMethod))
+                return false;
+        }
+        if (matcher.host !== undefined) {
+            if (typeof matcher.host === "string") {
+                if (ctx.host.toLowerCase() !== matcher.host.toLowerCase())
+                    return false;
+            }
+            else if (!matcher.host.test(ctx.host)) {
+                return false;
+            }
+        }
+        if (matcher.condition && !matcher.condition(ctx))
+            return false;
+        if (pathMatcher)
+            return pathMatcher(ctx.path);
+        return {};
+    };
+};

package/dist/LambderSessionController.d.ts

@@ -1,17 +1,29 @@
 import { LambderRenderContext, LambderSessionRenderContext } from "./LambderContext.js";
 import type LambderSessionManager from "./LambderSessionManager.js";
 import type { LambderSessionContext } from "./LambderSessionManager.js";
+export type LambderSessionCookieOptions = {
+    /** e.g. ".example.com" to share sessions across subdomains. */
+    domain?: string;
+    path?: string;
+    sameSite?: "Strict" | "Lax" | "None";
+    secure?: boolean;
+};
 export default class LambderSessionController<TSessionData = any> {
     lambderSessionManager: LambderSessionManager;
     sessionTokenCookieKey: string;
     sessionCsrfCookieKey: string;
+    cookieOptions: LambderSessionCookieOptions;
     ctx: LambderRenderContext<any> | LambderSessionRenderContext<any, TSessionData>;
-    constructor({ lambderSessionManager, sessionTokenCookieKey, sessionCsrfCookieKey, ctx, }: {
+    constructor({ lambderSessionManager, sessionTokenCookieKey, sessionCsrfCookieKey, cookieOptions, ctx, }: {
         lambderSessionManager: LambderSessionManager;
         sessionTokenCookieKey: string;
         sessionCsrfCookieKey: string;
+        cookieOptions?: LambderSessionCookieOptions;
         ctx: LambderRenderContext<any> | LambderSessionRenderContext<any, TSessionData>;
     });
+    private buildCookie;
+    private setSessionCookies;
+    private clearSessionCookies;
     private areRequestSessionTokensValid;
     createSession(sessionKey: string, data?: TSessionData, ttlInSeconds?: number): Promise<LambderSessionContext<TSessionData>>;
     regenerateSession(): Promise<LambderSessionContext<TSessionData>>;

package/dist/LambderSessionController.js

@@ -2,17 +2,44 @@ export default class LambderSessionController {
     lambderSessionManager;
     sessionTokenCookieKey;
     sessionCsrfCookieKey;
+    cookieOptions;
     ctx; // Internal context with mutable session property
-    constructor({ lambderSessionManager, sessionTokenCookieKey, sessionCsrfCookieKey, ctx, }) {
+    constructor({ lambderSessionManager, sessionTokenCookieKey, sessionCsrfCookieKey, cookieOptions, ctx, }) {
         this.lambderSessionManager = lambderSessionManager;
         this.sessionTokenCookieKey = sessionTokenCookieKey;
         this.sessionCsrfCookieKey = sessionCsrfCookieKey;
+        this.cookieOptions = cookieOptions ?? {};
         this.ctx = ctx;
     }
     ;
+    buildCookie(key, value, expiresAtMs, httpOnly) {
+        const { domain, path = "/", sameSite = "Lax", secure = true } = this.cookieOptions;
+        const parts = [
+            `${key}=${value}`,
+            `Expires=${new Date(expiresAtMs).toUTCString()}`,
+            `Path=${path}`,
+            ...(domain ? [`Domain=${domain}`] : []),
+            ...(httpOnly ? ["HttpOnly"] : []),
+            `SameSite=${sameSite}`,
+            ...(secure ? ["Secure"] : []),
+        ];
+        return parts.join("; ");
+    }
+    ;
+    setSessionCookies(session) {
+        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: this.buildCookie(this.sessionTokenCookieKey, session.sessionToken, session.expiresAt * 1000, true) });
+        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: this.buildCookie(this.sessionCsrfCookieKey, session.csrfToken, session.expiresAt * 1000, false) });
+    }
+    ;
+    clearSessionCookies() {
+        const expired = Date.now() - 100000;
+        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: this.buildCookie(this.sessionTokenCookieKey, "0", expired, true) });
+        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: this.buildCookie(this.sessionCsrfCookieKey, "0", expired, false) });
+    }
+    ;
     areRequestSessionTokensValid() {
         const sessionToken = this.ctx.cookie?.[this.sessionTokenCookieKey];
-        const isSessionTokenValid = sessionToken && sessionToken?.split(":")?.length === 2;
+        const isSessionTokenValid = !!sessionToken && sessionToken.split(":").length === 2;
         if (this.ctx._otherInternal.isApiCall) {
             const csrfToken = this.ctx.post?.token;
             const isCsrfTokenValid = typeof csrfToken === "string" && csrfToken.length > 0;
@@ -25,8 +52,7 @@ export default class LambderSessionController {
     ;
     async createSession(sessionKey, data, ttlInSeconds) {
         const session = await this.lambderSessionManager.createSession(sessionKey, data, ttlInSeconds);
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=${session.sessionToken}; Expires=${new Date(session.expiresAt * 1000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionCsrfCookieKey}=${session.csrfToken}; Expires=${new Date(session.expiresAt * 1000).toUTCString()}; Path=/; SameSite=Lax; Secure` });
+        this.setSessionCookies(session);
         this.ctx.session = session;
         return this.ctx.session;
     }
@@ -35,8 +61,7 @@ export default class LambderSessionController {
         if (!this.ctx.session)
             throw new Error("Session not found.");
         const newSession = await this.lambderSessionManager.regenerateSession(this.ctx.session);
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=${newSession.sessionToken}; Expires=${new Date(newSession.expiresAt * 1000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionCsrfCookieKey}=${newSession.csrfToken}; Expires=${new Date(newSession.expiresAt * 1000).toUTCString()}; Path=/; SameSite=Lax; Secure` });
+        this.setSessionCookies(newSession);
         this.ctx.session = newSession;
         return this.ctx.session;
     }
@@ -89,8 +114,7 @@ export default class LambderSessionController {
         if (!this.ctx.session)
             throw new Error("Session not found.");
         await this.lambderSessionManager.deleteSession(this.ctx.session);
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionCsrfCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; SameSite=Lax; Secure` });
+        this.clearSessionCookies();
         this.ctx.session = null;
     }
     ;
@@ -98,8 +122,7 @@ export default class LambderSessionController {
         if (!this.ctx.session)
             throw new Error("Session not found.");
         await this.lambderSessionManager.deleteSessionAll(this.ctx.session);
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionTokenCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; HttpOnly; SameSite=Lax; Secure` });
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key: "Set-Cookie", value: `${this.sessionCsrfCookieKey}=0; Expires=${new Date(Date.now() - 100000).toUTCString()}; Path=/; SameSite=Lax; Secure` });
+        this.clearSessionCookies();
         this.ctx.session = null;
     }
     ;

package/dist/LambderSessionManager.d.ts

@@ -16,13 +16,15 @@ export default class LambderSessionManager {
     private sortKey;
     private ddbDocumentClient;
     private enableSlidingExpiration;
-    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, enableSlidingExpiration, }: {
+    private slidingWriteIntervalSeconds;
+    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, enableSlidingExpiration, slidingWriteIntervalSeconds, }: {
         tableName: string;
         tableRegion: string;
         partitionKey: string;
         sortKey: string;
         sessionSalt: string;
         enableSlidingExpiration?: boolean;
+        slidingWriteIntervalSeconds?: number;
     });
     private sessionUserKeyHasher;
     private constantTimeCompare;

package/dist/LambderSessionManager.js

@@ -8,12 +8,14 @@ export default class LambderSessionManager {
     sortKey;
     ddbDocumentClient;
     enableSlidingExpiration;
-    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, enableSlidingExpiration = true, }) {
+    slidingWriteIntervalSeconds;
+    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, enableSlidingExpiration = true, slidingWriteIntervalSeconds, }) {
         this.tableName = tableName;
         this.sessionSalt = sessionSalt;
         this.partitionKey = partitionKey;
         this.sortKey = sortKey;
         this.enableSlidingExpiration = enableSlidingExpiration;
+        this.slidingWriteIntervalSeconds = slidingWriteIntervalSeconds ?? null;
         const ddbClient = new DynamoDBClient({ region: tableRegion });
         this.ddbDocumentClient = DynamoDBDocumentClient.from(ddbClient);
     }
@@ -124,12 +126,19 @@ export default class LambderSessionManager {
                 return null;
             if (!session.expiresAt || session.expiresAt < Date.now() / 1000)
                 return null;
-            // Update last accessed time if sliding expiration is enabled
+            // Update last accessed time if sliding expiration is enabled.
+            // Throttled: skip the DynamoDB write when the session was refreshed
+            // recently, to avoid a write on every request.
             if (this.enableSlidingExpiration) {
-                session.lastAccessedAt = Math.floor(Date.now() / 1000);
-                session.expiresAt = session.lastAccessedAt + session.ttlInSeconds;
-                // Wait for the update to ensure it persists before Lambda freezes
-                await this.ddbPutItem(session).catch(() => { });
+                const now = Math.floor(Date.now() / 1000);
+                const minInterval = this.slidingWriteIntervalSeconds
+                    ?? Math.max(60, Math.floor((session.ttlInSeconds || 0) * 0.05));
+                if (now - (session.lastAccessedAt || 0) >= minInterval) {
+                    session.lastAccessedAt = now;
+                    session.expiresAt = now + session.ttlInSeconds;
+                    // Wait for the update to ensure it persists before Lambda freezes
+                    await this.ddbPutItem(session).catch(() => { });
+                }
             }
             return session;
         }