lambder 3.2.6 → 3.3.1

package/dist/Lambder.d.ts

@@ -27,8 +27,11 @@ export type LambderIndexHtmlOptions = {
     /** Methods that reach the index handler. Default: ["GET", "HEAD"]. */
     methods?: string[];
     /**
-     * Skip paths whose last segment has an extension (missing assets by this
-     * point; a 200 HTML shell would be a soft-404). Default: true.
+     * Skip paths whose last segment contains a dot, treating them as missing
+     * assets rather than app routes. Default: false — real files have already
+     * been served by servePublicFiles at this point, and plenty of app routes
+     * carry dots (JWTs, coordinates, domain names, version numbers). Turn it
+     * on to get 404s instead of a 200 shell for missing-asset requests.
      */
     skipFilePaths?: boolean;
     /** 301-redirect trailing-slash paths to the canonical no-slash URL. Default: false. */
@@ -127,7 +130,7 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
         enableSlidingExpiration?: boolean;
         /** Min seconds between sliding-expiration writes. Default: max(60, 5% of TTL). */
         slidingWriteIntervalSeconds?: number;
-        /** Session cookie attributes, e.g. { domain: ".example.com" } for cross-subdomain sessions. */
+        /** Session cookie attributes, e.g. { domain: ".example.com" } for cross-subdomain sessions. `domain` may be a (hostname) => string function for multi-domain deployments. */
         cookie?: LambderSessionCookieOptions;
         partitionKey?: string;
         sortKey?: string;
@@ -150,11 +153,12 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
     servePublicFiles(options?: LambderPublicFilesOptions): this;
     /**
      * Serve the app shell for page requests that nothing else handled. Runs
-     * after servePublicFiles in the fallback chain, gated by a built-in
-     * filter: only configured methods (default GET/HEAD) and, by default, only
-     * paths that do not look like files. Gated-out requests fall through to
-     * setRouteFallbackHandler. Without a handler, publicPath/index.html is
-     * served via res.templateFile (markers optional) with no-cache.
+     * after servePublicFiles in the fallback chain, so real files are already
+     * gone; everything left is an app route (option `skipFilePaths` opts back
+     * into 404ing dotted paths). Only configured methods reach it, default
+     * GET/HEAD. Gated-out requests fall through to setRouteFallbackHandler.
+     * Without a handler, publicPath/index.html is served via res.templateFile
+     * (markers optional) with no-cache.
      */
     serveIndexHtml(handler?: FallbackHandlerFunction, options?: LambderIndexHtmlOptions): this;
     /** Apply the serveIndexHtml gates; null means fall through. */

package/dist/Lambder.js

@@ -121,11 +121,12 @@ export default class Lambder {
     }
     /**
      * Serve the app shell for page requests that nothing else handled. Runs
-     * after servePublicFiles in the fallback chain, gated by a built-in
-     * filter: only configured methods (default GET/HEAD) and, by default, only
-     * paths that do not look like files. Gated-out requests fall through to
-     * setRouteFallbackHandler. Without a handler, publicPath/index.html is
-     * served via res.templateFile (markers optional) with no-cache.
+     * after servePublicFiles in the fallback chain, so real files are already
+     * gone; everything left is an app route (option `skipFilePaths` opts back
+     * into 404ing dotted paths). Only configured methods reach it, default
+     * GET/HEAD. Gated-out requests fall through to setRouteFallbackHandler.
+     * Without a handler, publicPath/index.html is served via res.templateFile
+     * (markers optional) with no-cache.
      */
     serveIndexHtml(handler, options = {}) {
         this.indexHtmlConfig = { handler: handler ?? null, options };
@@ -139,7 +140,7 @@ export default class Lambder {
         const methods = (options.methods ?? ["GET", "HEAD"]).map((m) => m.toUpperCase());
         if (!methods.includes(ctx.method.toUpperCase()))
             return null;
-        if ((options.skipFilePaths ?? true) && (ctx.path.split("/").pop() ?? "").includes("."))
+        if ((options.skipFilePaths ?? false) && (ctx.path.split("/").pop() ?? "").includes("."))
             return null;
         if (options.redirectTrailingSlash && ctx.path.length > 1 && ctx.path.endsWith("/")) {
             const target = ctx.path.replace(/\/+$/, "") || "/";

package/dist/LambderCaller.d.ts

@@ -41,7 +41,8 @@ export default class LambderCaller<TContract extends ApiContractShape = any> {
     private fetchEndedHandler?;
     private sessionTokenCookieKey;
     private sessionCsrfCookieKey;
-    constructor({ apiPath, apiVersion, isCorsEnabled, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, apiInputValidationErrorHandler, }: {
+    private sessionCookieDomain?;
+    constructor({ apiPath, apiVersion, isCorsEnabled, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, apiInputValidationErrorHandler, sessionCookieDomain, }: {
         apiPath: string;
         apiVersion?: string;
         isCorsEnabled: boolean;
@@ -54,8 +55,11 @@ export default class LambderCaller<TContract extends ApiContractShape = any> {
         fetchStartedHandler?: FetchStartEventHandler;
         fetchEndedHandler?: FetchEndEventHandler;
         apiInputValidationErrorHandler?: ValidationErrorHandler;
+        /** Must mirror the server's session cookie Domain, otherwise expired cookies cannot be cleared. */
+        sessionCookieDomain?: string | ((hostname: string) => string | undefined | null);
     });
     setSessionCookieKey(sessionTokenCookieKey: string, sessionCsrfCookieKey: string): void;
+    private clearSessionCookies;
     apiRaw<TApiName extends keyof TContract & string = string, TOutput = TApiName extends keyof TContract ? TContract[TApiName]['output'] : any>(apiName: TApiName, payload?: TApiName extends keyof TContract ? TContract[TApiName]['input'] : any, options?: {
         headers?: Record<string, any>;
         versionExpiredHandler?: VoidFunction;

package/dist/LambderCaller.js

@@ -16,10 +16,12 @@ export default class LambderCaller {
     fetchEndedHandler;
     sessionTokenCookieKey = "LMDRSESSIONTKID";
     sessionCsrfCookieKey = "LMDRSESSIONCSTK";
-    constructor({ apiPath, apiVersion, isCorsEnabled = false, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, apiInputValidationErrorHandler, }) {
+    sessionCookieDomain;
+    constructor({ apiPath, apiVersion, isCorsEnabled = false, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, apiInputValidationErrorHandler, sessionCookieDomain, }) {
         this.apiPath = apiPath ?? "/api";
         this.apiVersion = apiVersion;
         this.isCorsEnabled = isCorsEnabled;
+        this.sessionCookieDomain = sessionCookieDomain;
         this.versionExpiredHandler = versionExpiredHandler;
         this.sessionExpiredHandler = sessionExpiredHandler;
         this.messageHandler = messageHandler;
@@ -35,6 +37,17 @@ export default class LambderCaller {
         this.sessionTokenCookieKey = sessionTokenCookieKey;
         this.sessionCsrfCookieKey = sessionCsrfCookieKey;
     }
+    clearSessionCookies() {
+        const domainOption = this.sessionCookieDomain;
+        const hostname = typeof window !== "undefined" ? window.location.hostname : "";
+        const resolvedDomain = typeof domainOption === "function" ? domainOption(hostname) : domainOption;
+        for (const key of [this.sessionTokenCookieKey, this.sessionCsrfCookieKey]) {
+            // Host-only and domain-scoped cookies are distinct entries; clear both.
+            Cookies.remove(key);
+            if (resolvedDomain)
+                Cookies.remove(key, { domain: resolvedDomain, path: "/" });
+        }
+    }
     async apiRaw(apiName, payload, options) {
         const headers = options?.headers;
         const fetchTracker = { apiName, done: false, fetchEndCalled: false };
@@ -102,8 +115,7 @@ export default class LambderCaller {
                 return null;
             }
             if (data && data.sessionExpired) {
-                Cookies.set(this.sessionTokenCookieKey, '', { expires: -1 });
-                Cookies.set(this.sessionCsrfCookieKey, '', { expires: -1 });
+                this.clearSessionCookies();
                 if (this.sessionExpiredHandler) {
                     await this.sessionExpiredHandler();
                 }

package/dist/LambderSessionController.d.ts

@@ -2,8 +2,12 @@ import { LambderRenderContext, LambderSessionRenderContext } from "./LambderCont
 import type LambderSessionManager from "./LambderSessionManager.js";
 import type { LambderSessionContext } from "./LambderSessionManager.js";
 export type LambderSessionCookieOptions = {
-    /** e.g. ".example.com" to share sessions across subdomains. */
-    domain?: string;
+    /**
+     * e.g. ".example.com" to share sessions across subdomains. Pass a function to
+     * derive it from the request hostname when one deployment serves several
+     * apex domains; return undefined for a host-only cookie.
+     */
+    domain?: string | ((hostname: string) => string | undefined | null);
     path?: string;
     sameSite?: "Strict" | "Lax" | "None";
     secure?: boolean;

package/dist/LambderSessionController.js

@@ -14,11 +14,14 @@ export default class LambderSessionController {
     ;
     buildCookie(key, value, expiresAtMs, httpOnly) {
         const { domain, path = "/", sameSite = "Lax", secure = true } = this.cookieOptions;
+        // Host header can carry a port; browsers match the Domain attribute on hostname only.
+        const hostname = (this.ctx.host || "").split(":")[0];
+        const resolvedDomain = typeof domain === "function" ? domain(hostname) : domain;
         const parts = [
             `${key}=${value}`,
             `Expires=${new Date(expiresAtMs).toUTCString()}`,
             `Path=${path}`,
-            ...(domain ? [`Domain=${domain}`] : []),
+            ...(resolvedDomain ? [`Domain=${resolvedDomain}`] : []),
             ...(httpOnly ? ["HttpOnly"] : []),
             `SameSite=${sameSite}`,
             ...(secure ? ["Secure"] : []),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "3.2.6",
+  "version": "3.3.1",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",