lambder 2.0.18 → 3.1.1

package/dist/LambderContext.d.ts

@@ -1,22 +1,33 @@
-import type { APIGatewayProxyEvent, APIGatewayProxyEventHeaders, Context } from "aws-lambda";
+import type { APIGatewayProxyEvent, APIGatewayProxyEventV2, APIGatewayProxyEventHeaders, Context } from "aws-lambda";
 import type { LambderSessionContext } from "./LambderSessionManager.js";
-export type LambderRenderContext<TApiPayload = any> = {
+import type { LambderHttpEventFormat } from "./LambderResponse.js";
+export type LambderHttpEvent = APIGatewayProxyEvent | APIGatewayProxyEventV2;
+/** True for API Gateway HTTP API / Lambda Function URL (payload v2) events. */
+export declare const isV2HttpEvent: (event: unknown) => event is APIGatewayProxyEventV2;
+export type LambderRenderContext<TApiPayload = any, TPathParams extends Record<string, string> = Record<string, string>> = {
     host: string;
     path: string;
-    pathParams: Record<string, any> | null;
+    pathParams: TPathParams;
     method: string;
-    get: Record<string, any>;
+    get: Record<string, string | undefined>;
     post: Record<string, any>;
-    cookie: Record<string, any>;
+    cookie: Record<string, string>;
     session: null;
-    apiName: string;
+    apiName: string | null;
     apiPayload: TApiPayload;
     headers: APIGatewayProxyEventHeaders;
-    event: APIGatewayProxyEvent;
+    /** Decoded request body, exactly as received (e.g. for webhook signature verification). */
+    rawBody: string;
+    /** Client IP: CF-Connecting-IP, then X-Forwarded-For, then the API Gateway source IP. */
+    ip: string;
+    /** Case-insensitive request header lookup. */
+    header: (name: string) => string | undefined;
+    event: LambderHttpEvent;
     lambdaContext: Context;
     _otherInternal: {
         isApiCall: boolean;
         requestVersion: string | null;
+        eventFormat: LambderHttpEventFormat;
         setHeaderFnAccumulator: {
             key: string;
             value: string | string[];
@@ -28,7 +39,7 @@ export type LambderRenderContext<TApiPayload = any> = {
         logToApiResponseAccumulator: any[];
     };
 };
-export type LambderSessionRenderContext<TApiPayload = any, SessionData = any> = Omit<LambderRenderContext<TApiPayload>, 'session'> & {
+export type LambderSessionRenderContext<TApiPayload = any, SessionData = any, TPathParams extends Record<string, string> = Record<string, string>> = Omit<LambderRenderContext<TApiPayload, TPathParams>, 'session'> & {
     session: LambderSessionContext<SessionData>;
 };
-export declare const createContext: (event: APIGatewayProxyEvent, lambdaContext: Context, apiPath: string) => LambderRenderContext<any>;
+export declare const createContext: (event: LambderHttpEvent, lambdaContext: Context, apiPath: string) => LambderRenderContext;

package/dist/LambderContext.js

@@ -1,21 +1,61 @@
 import cookieParser from "cookie";
+/** True for API Gateway HTTP API / Lambda Function URL (payload v2) events. */
+export const isV2HttpEvent = (event) => !!event && typeof event === "object"
+    && event.version === "2.0"
+    && !!event.requestContext?.http;
 export const createContext = (event, lambdaContext, apiPath) => {
-    const host = event.headers.Host || event.headers.host || "";
-    const path = event.path;
-    const pathParams = null;
-    const get = event.queryStringParameters || {};
-    const method = event.httpMethod;
-    const cookie = cookieParser.parse(event.headers.Cookie || event.headers.cookie || "");
-    const headers = event.headers;
-    // Decode body for the post
+    // Normalize the two API Gateway payload formats into one shape.
+    const eventFormat = isV2HttpEvent(event) ? "v2" : "v1";
+    let host;
+    let path;
+    let method;
+    let get;
+    let cookieHeader;
+    let sourceIp;
+    const headers = event.headers ?? {};
+    if (isV2HttpEvent(event)) {
+        host = headers.host || event.requestContext.domainName || "";
+        path = event.rawPath;
+        method = event.requestContext.http.method;
+        get = {};
+        for (const [key, value] of new URLSearchParams(event.rawQueryString ?? "").entries()) {
+            get[key] = value;
+        }
+        cookieHeader = (event.cookies ?? []).join("; ");
+        sourceIp = event.requestContext.http.sourceIp || "";
+    }
+    else {
+        host = headers.Host || headers.host || "";
+        path = event.path;
+        method = event.httpMethod;
+        get = event.queryStringParameters || {};
+        cookieHeader = headers.Cookie || headers.cookie || "";
+        sourceIp = event.requestContext?.identity?.sourceIp || "";
+    }
+    const cookie = cookieParser.parse(cookieHeader);
+    const lowercasedHeaders = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (value !== undefined)
+            lowercasedHeaders[key.toLowerCase()] = value;
+    }
+    const header = (name) => lowercasedHeaders[name.toLowerCase()];
+    const forwardedFor = lowercasedHeaders["x-forwarded-for"];
+    const ip = lowercasedHeaders["cf-connecting-ip"]
+        || (forwardedFor ? (forwardedFor.split(",")[0] ?? "").trim() : "")
+        || sourceIp
+        || "";
+    // Decode body: keep the raw string, then parse as JSON with urlencoded fallback.
+    let rawBody = "";
     let post = {};
     try {
-        const decodedBody = event.isBase64Encoded ? (event.body ? Buffer.from(event.body, "base64").toString() : "{}") : (event.body || "{}");
+        rawBody = event.isBase64Encoded
+            ? (event.body ? Buffer.from(event.body, "base64").toString() : "")
+            : (event.body || "");
         try {
-            post = JSON.parse(decodedBody) || {};
+            post = JSON.parse(rawBody || "{}") || {};
         }
         catch (e) {
-            const params = new URLSearchParams(decodedBody);
+            const params = new URLSearchParams(rawBody);
             post = {};
             for (const [key, value] of params.entries()) {
                 post[key] = value;
@@ -23,19 +63,19 @@ export const createContext = (event, lambdaContext, apiPath) => {
         }
     }
     catch (e) { }
-    // Parse api variables
-    const isApiCall = method === "POST" && apiPath && path === apiPath && post.apiName;
+    const isApiCall = !!(method === "POST" && apiPath && path === apiPath && post.apiName);
     const apiName = isApiCall ? post.apiName : null;
     const apiPayload = isApiCall ? post.payload : null;
-    const requestVersion = isApiCall ? post.version : null;
+    const requestVersion = isApiCall ? (post.version ?? null) : null;
     return {
-        host, path, pathParams, method,
+        host, path, pathParams: {}, method,
         get, post, cookie, event,
         session: null,
         apiName, apiPayload,
-        headers, lambdaContext,
+        headers, rawBody, ip, header,
+        lambdaContext,
         _otherInternal: {
-            isApiCall, requestVersion,
+            isApiCall, requestVersion, eventFormat,
             setHeaderFnAccumulator: [],
             addHeaderFnAccumulator: [],
             logToApiResponseAccumulator: [],

package/dist/LambderCors.d.ts

@@ -0,0 +1,12 @@
+import type { LambderRenderContext } from "./LambderContext.js";
+import type { LambderResponse } from "./LambderResponse.js";
+export type LambderCorsConfig = {
+    /** "*" (default), an allowlist, or a per-request predicate. With credentials, the origin is echoed (never "*"). */
+    origins?: "*" | string[] | ((origin: string, ctx: LambderRenderContext) => boolean);
+    credentials?: boolean;
+    methods?: string[];
+    allowHeaders?: string[];
+    maxAge?: number;
+};
+/** Mutate the response with the CORS headers the config allows for this request. */
+export declare const applyCorsHeaders: (config: LambderCorsConfig | null, ctx: LambderRenderContext, response: LambderResponse, isPreflight: boolean) => void;

package/dist/LambderCors.js

@@ -0,0 +1,30 @@
+/** Mutate the response with the CORS headers the config allows for this request. */
+export const applyCorsHeaders = (config, ctx, response, isPreflight) => {
+    if (!config)
+        return;
+    const origin = ctx.header("origin") ?? "";
+    const origins = config.origins ?? "*";
+    let allowOrigin = null;
+    if (origins === "*") {
+        allowOrigin = config.credentials ? (origin || null) : "*";
+    }
+    else if (Array.isArray(origins)) {
+        allowOrigin = origin && origins.includes(origin) ? origin : null;
+    }
+    else {
+        allowOrigin = origin && origins(origin, ctx) ? origin : null;
+    }
+    if (!allowOrigin)
+        return;
+    response.setHeader("Access-Control-Allow-Origin", allowOrigin);
+    if (allowOrigin !== "*")
+        response.addHeader("Vary", "Origin");
+    if (config.credentials)
+        response.setHeader("Access-Control-Allow-Credentials", "true");
+    if (isPreflight) {
+        response.setHeader("Access-Control-Allow-Methods", (config.methods ?? ["GET", "POST", "OPTIONS"]).join(","));
+        response.setHeader("Access-Control-Allow-Headers", (config.allowHeaders ?? ["Origin", "X-Requested-With", "Content-Type", "Accept"]).join(", "));
+        if (config.maxAge !== undefined)
+            response.setHeader("Access-Control-Max-Age", String(config.maxAge));
+    }
+};

package/dist/LambderDdbCache.d.ts

@@ -0,0 +1,65 @@
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+export interface LambderDdbCacheOptions {
+    tableName: string;
+    region?: string;
+    namespace?: string;
+    defaultTtlSeconds?: number;
+    chunkBytes?: number;
+    compressionQuality?: number;
+    maxValueBytes?: number;
+    memoryMaxBytes?: number;
+    client?: DynamoDBClient;
+}
+export interface LambderDdbCacheSetOptions {
+    ttlSeconds?: number;
+}
+export interface LambderDdbCacheGetOrSetOptions extends LambderDdbCacheSetOptions {
+    leaseSeconds?: number;
+    waitForFillMs?: number;
+}
+/**
+ * Persistent JSON cache backed by DynamoDB.
+ *
+ * Values are Brotli-compressed. Values within the safe DynamoDB item budget are
+ * stored directly in the manifest for a single-request read; larger values are
+ * split into versioned binary chunks. A manifest is written only after every
+ * chunk succeeds, so readers see either the previous complete version or the
+ * new complete version. DynamoDB TTL is cleanup only; every read also checks
+ * expiresAt because TTL deletion can lag.
+ */
+export declare class LambderDdbCache {
+    readonly tableName: string;
+    readonly namespace: string;
+    private readonly client;
+    private readonly defaultTtlSeconds;
+    private readonly chunkBytes;
+    private readonly compressionQuality;
+    private readonly maxValueBytes;
+    private readonly memory;
+    private readonly inFlight;
+    constructor(options: LambderDdbCacheOptions);
+    get<T>(key: string): Promise<T | undefined>;
+    has(key: string): Promise<boolean>;
+    set<T>(key: string, value: T, options?: LambderDdbCacheSetOptions): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    getOrSet<T>(key: string, factory: () => Promise<T>, options?: LambderDdbCacheGetOrSetOptions): Promise<T>;
+    /**
+     * Cache infrastructure is best-effort for getOrSet: read, lease, or write
+     * failures return the loader value. Loader failures still propagate and the
+     * loader is never repeated after it has completed successfully.
+     */
+    private getOrSetFailOpen;
+    private fill;
+    private acquireLease;
+    private releaseLease;
+    private readManifest;
+    private readChunks;
+    private invalidateManifest;
+    private batchWrite;
+    private remember;
+    private normalizeKey;
+    private partitionKey;
+    private chunkSortKey;
+    private nowSeconds;
+    private isConditionalFailure;
+}