lambder 3.3.3 → 3.4.2

package/Readme.md

@@ -275,6 +275,35 @@ lambder
 
 See [docs/DYNAMODB_SETUP.md](docs/DYNAMODB_SETUP.md) for detailed setup instructions.
 
+#### Keeping session data fresh (`dataRefresh`)
+
+Session data often caches values derived from external state: roles, permissions, feature flags. Opt in to `dataRefresh` to give that data a shelf life. Every session read checks it, and once `ttlSeconds` have passed your `refresh` callback rebuilds the data, which is persisted onto the same session record: same tokens, same cookies, the session itself is untouched. Changes to the source of truth then reach every live session within `ttlSeconds`, with no mass session invalidation.
+
+```typescript
+lambder.enableDdbSession({
+    tableName: "website-session",
+    tableRegion: "us-east-1",
+    sessionSalt: "CHANGE-THIS-TO-A-SECURE-RANDOM-STRING",
+    dataRefresh: {
+        ttlSeconds: 600, // data is renewed at most every 10 minutes
+        refresh: async (session) => {
+            const user = await loadUser(session.data.userId);
+            if (!user || user.disabled) return null; // null ends the session
+            return buildSessionData(user);
+        },
+    },
+});
+```
+
+Semantics:
+
+- The callback must be a pure derivation of external state: concurrent reads may run it in parallel, last write wins.
+- Returning `null` deletes the session; the request is answered as session-expired.
+- Thrown errors fail the request as a `LambderSessionDataRefreshError` and leave the session untouched (they are never mistaken for a logout). Catch inside and return `session.data` to explicitly serve stale instead.
+- The renewal write and the sliding-expiration write share a single DynamoDB put when both are due.
+- Records created before `dataRefresh` was enabled renew on their first read.
+- `updateSessionData()` marks data fresh (it was just written deliberately); `regenerateSession()` carries the old freshness stamp over.
+
 #### Session Controller
 
 Access the session controller with `lambder.getSessionController(ctx)`:
@@ -285,8 +314,10 @@ Access the session controller with `lambder.getSessionController(ctx)`:
 | `fetchSession()` | Fetch & validate existing session (throws if not found) |
 | `fetchSessionIfExists()` | Returns session or null |
 | `updateSessionData(newData)` | Update session data in DDB |
+| `refreshSessionData()` | Run the `dataRefresh` callback now, regardless of TTL |
 | `endSession()` | End session, delete from DDB |
 | `endSessionAll()` | End all sessions for this sessionKey (all devices) |
+| `deleteSessionAllByKey(sessionKey)` | Delete all sessions of any sessionKey (e.g. "log user X out everywhere") |
 | `regenerateSession()` | Regenerate token (use after password change) |
 
 ### Type-Safe Templating (html / xml)

package/dist/Lambder.d.ts

@@ -5,6 +5,7 @@ import LambderResponseBuilder from "./LambderResponseBuilder.js";
 import { LambderResponse, type LambderHttpResponse } from "./LambderResponse.js";
 import { type ConditionFunction, type LambderRouteMatcher, type PathParamsOf } from "./LambderRouting.js";
 import { type LambderCorsConfig } from "./LambderCors.js";
+import { type LambderSessionDataRefreshConfig } from "./LambderSessionManager.js";
 import LambderSessionController, { type LambderSessionCookieOptions } from "./LambderSessionController.js";
 import { type LambderPublicFilesOptions } from "./LambderPublicFiles.js";
 import type { MergeContract } from "./LambderApiContract.js";
@@ -123,7 +124,7 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
     private sessionCsrfCookieKey;
     constructor(options?: LambderConstructorOptions);
     enableCors(config: boolean | LambderCorsConfig): this;
-    enableDdbSession({ tableName, tableRegion, sessionSalt, enableSlidingExpiration, slidingWriteIntervalSeconds, cookie, partitionKey, sortKey, }: {
+    enableDdbSession({ tableName, tableRegion, sessionSalt, enableSlidingExpiration, slidingWriteIntervalSeconds, cookie, partitionKey, sortKey, dataRefresh, }: {
         tableName: string;
         tableRegion: string;
         sessionSalt: string;
@@ -134,6 +135,15 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
         cookie?: LambderSessionCookieOptions;
         partitionKey?: string;
         sortKey?: string;
+        /**
+         * Opt-in freshness for session.data derived from external state
+         * (roles, permissions, feature flags...). Every session read
+         * renews data past its ttlSeconds via your refresh callback,
+         * persisting in place on the same record: same tokens, same
+         * cookies. Return null from refresh to end the session. See
+         * LambderSessionDataRefreshConfig for the exact semantics.
+         */
+        dataRefresh?: LambderSessionDataRefreshConfig<TSessionData>;
     }): this;
     setSessionCookieKey(sessionTokenCookieKey: string, sessionCsrfCookieKey: string): this;
     setRouteFallbackHandler(routeFallbackHandler: FallbackHandlerFunction): this;

package/dist/Lambder.js

@@ -71,12 +71,13 @@ export default class Lambder {
         this.corsConfig = config === true ? {} : (config === false ? null : config);
         return this;
     }
-    enableDdbSession({ tableName, tableRegion, sessionSalt, enableSlidingExpiration, slidingWriteIntervalSeconds, cookie, partitionKey, sortKey, }) {
+    enableDdbSession({ tableName, tableRegion, sessionSalt, enableSlidingExpiration, slidingWriteIntervalSeconds, cookie, partitionKey, sortKey, dataRefresh, }) {
         this.lambderSessionManager = new LambderSessionManager({
             tableName, tableRegion,
             partitionKey: partitionKey ?? "pk",
             sortKey: sortKey ?? "sk",
             sessionSalt, enableSlidingExpiration, slidingWriteIntervalSeconds,
+            dataRefresh,
         });
         this.sessionCookieOptions = cookie ?? {};
         return this;

package/dist/LambderSessionController.d.ts

@@ -1,6 +1,6 @@
 import { LambderRenderContext, LambderSessionRenderContext } from "./LambderContext.js";
 import type LambderSessionManager from "./LambderSessionManager.js";
-import type { LambderSessionContext } from "./LambderSessionManager.js";
+import { type LambderSessionContext } from "./LambderSessionManager.js";
 export type LambderSessionCookieOptions = {
     /**
      * e.g. ".example.com" to share sessions across subdomains. Pass a function to
@@ -32,9 +32,22 @@ export default class LambderSessionController<TSessionData = any> {
     createSession(sessionKey: string, data?: TSessionData, ttlInSeconds?: number): Promise<LambderSessionContext<TSessionData>>;
     regenerateSession(): Promise<LambderSessionContext<TSessionData>>;
     fetchSession(): Promise<LambderSessionContext<TSessionData>>;
-    fetchSessionIfExists(): Promise<LambderSessionContext | null>;
+    fetchSessionIfExists(): Promise<LambderSessionContext<TSessionData> | null>;
     isSessionValid(session: any): boolean;
     updateSessionData(newData: any): Promise<LambderSessionContext>;
+    /**
+     * Force-runs the dataRefresh callback now (see enableDdbSession) and
+     * persists the result onto the current session. Returns the updated
+     * session, or null when the callback ended it: the record is deleted and
+     * the session cookies are cleared.
+     */
+    refreshSessionData(): Promise<LambderSessionContext<TSessionData> | null>;
+    /**
+     * Deletes every session of the given sessionKey (e.g. a user id): "log
+     * this subject out everywhere". Unlike endSessionAll it needs no fetched
+     * session and touches no cookies, so it works on any subject.
+     */
+    deleteSessionAllByKey(sessionKey: string): Promise<void>;
     endSession(): Promise<void>;
     endSessionAll(): Promise<void>;
 }

package/dist/LambderSessionController.js

@@ -1,3 +1,4 @@
+import { LambderSessionDataRefreshError } from "./LambderSessionManager.js";
 export default class LambderSessionController {
     lambderSessionManager;
     sessionTokenCookieKey;
@@ -90,6 +91,10 @@ export default class LambderSessionController {
             return await this.fetchSession();
         }
         catch (err) {
+            // Missing or invalid sessions become null, but a failing
+            // dataRefresh callback must not masquerade as a logout.
+            if (err instanceof LambderSessionDataRefreshError)
+                throw err;
             return null;
         }
     }
@@ -113,6 +118,34 @@ export default class LambderSessionController {
         return this.ctx.session;
     }
     ;
+    /**
+     * Force-runs the dataRefresh callback now (see enableDdbSession) and
+     * persists the result onto the current session. Returns the updated
+     * session, or null when the callback ended it: the record is deleted and
+     * the session cookies are cleared.
+     */
+    async refreshSessionData() {
+        if (!this.ctx.session)
+            throw new Error("Session not found.");
+        const refreshed = await this.lambderSessionManager.refreshSessionData(this.ctx.session);
+        if (!refreshed) {
+            this.clearSessionCookies();
+            this.ctx.session = null;
+            return null;
+        }
+        this.ctx.session = refreshed;
+        return this.ctx.session;
+    }
+    ;
+    /**
+     * Deletes every session of the given sessionKey (e.g. a user id): "log
+     * this subject out everywhere". Unlike endSessionAll it needs no fetched
+     * session and touches no cookies, so it works on any subject.
+     */
+    async deleteSessionAllByKey(sessionKey) {
+        await this.lambderSessionManager.deleteSessionAllByKey(sessionKey);
+    }
+    ;
     async endSession() {
         if (!this.ctx.session)
             throw new Error("Session not found.");

package/dist/LambderSessionManager.d.ts

@@ -8,7 +8,43 @@ export type LambderSessionContext<SessionData = any> = {
     expiresAt: number;
     lastAccessedAt: number;
     ttlInSeconds: number;
+    /**
+     * When `data` must be renewed via the dataRefresh callback (epoch seconds).
+     * Only present when dataRefresh is configured; independent of the
+     * session's own expiresAt.
+     */
+    dataExpiresAt?: number;
 };
+/**
+ * Opt-in freshness for session.data that is derived from external state
+ * (roles, permissions, feature flags...). When configured, every session read
+ * checks dataExpiresAt and calls `refresh` past it, persisting the result
+ * onto the same session record: same tokens, same cookies, the session
+ * itself is untouched. The refresh write and the sliding-expiration write
+ * share a single DynamoDB put when both are due.
+ */
+export type LambderSessionDataRefreshConfig<SessionData = any> = {
+    /** Seconds session.data stays valid before refresh() runs on read. */
+    ttlSeconds: number;
+    /**
+     * Rebuild session.data from its source of truth. Must be a pure
+     * derivation (concurrent reads may run it in parallel; last write wins).
+     * Return null to end the session: the record is deleted and the read
+     * reports no session. Thrown errors fail the read as a
+     * LambderSessionDataRefreshError and leave the session untouched; catch
+     * inside and return session.data to explicitly serve stale instead.
+     */
+    refresh: (session: LambderSessionContext<SessionData>) => Promise<SessionData | null>;
+};
+/**
+ * Wraps errors thrown by the dataRefresh callback so they stay
+ * distinguishable from "no session": fetchSessionIfExists() swallows missing
+ * or invalid sessions but rethrows this, otherwise a transient failure in
+ * the refresh source would masquerade as a logout.
+ */
+export declare class LambderSessionDataRefreshError extends Error {
+    constructor(cause: unknown);
+}
 export default class LambderSessionManager {
     private tableName;
     private sessionSalt;
@@ -17,7 +53,8 @@ export default class LambderSessionManager {
     private ddbDocumentClient;
     private enableSlidingExpiration;
     private slidingWriteIntervalSeconds;
-    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, enableSlidingExpiration, slidingWriteIntervalSeconds, }: {
+    private dataRefresh;
+    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, enableSlidingExpiration, slidingWriteIntervalSeconds, dataRefresh, }: {
         tableName: string;
         tableRegion: string;
         partitionKey: string;
@@ -25,6 +62,7 @@ export default class LambderSessionManager {
         sessionSalt: string;
         enableSlidingExpiration?: boolean;
         slidingWriteIntervalSeconds?: number;
+        dataRefresh?: LambderSessionDataRefreshConfig;
     });
     private sessionUserKeyHasher;
     private constantTimeCompare;
@@ -33,11 +71,27 @@ export default class LambderSessionManager {
     private ddbDeleteItem;
     private ddbQueryAllByPartitionKey;
     private ddbDeleteAllByPartitionKey;
-    createSession(sessionKey: string, data?: any, ttlInSeconds?: number): Promise<LambderSessionContext>;
+    createSession(sessionKey: string, data?: any, ttlInSeconds?: number, options?: {
+        /** Carries an existing data freshness stamp over (used by regenerateSession). */
+        dataExpiresAt?: number;
+    }): Promise<LambderSessionContext>;
     updateSessionData(session: LambderSessionContext, newData?: any): Promise<LambderSessionContext>;
     getSession(sessionToken: string): Promise<LambderSessionContext | null>;
+    /**
+     * Runs the dataRefresh callback now, regardless of dataExpiresAt, and
+     * persists the result onto the same record. Returns the updated session,
+     * or null when the callback ended it (the record is deleted). Requires
+     * dataRefresh to be configured.
+     */
+    refreshSessionData(session: LambderSessionContext): Promise<LambderSessionContext | null>;
     isSessionValid(session: any, sessionToken: any, csrfToken: any, skipCsrfTokenCheck?: boolean): boolean;
     deleteSession(session: Record<string, any>): Promise<boolean>;
     deleteSessionAll(session: Record<string, any>): Promise<boolean>;
+    /**
+     * Deletes every session created for the given sessionKey (e.g. a user
+     * id): "log this subject out everywhere", without needing a fetched
+     * session record.
+     */
+    deleteSessionAllByKey(sessionKey: string): Promise<boolean>;
     regenerateSession(session: LambderSessionContext): Promise<LambderSessionContext>;
 }

package/dist/LambderSessionManager.js

@@ -1,6 +1,18 @@
 import crypto from "crypto";
 import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
 import { DynamoDBDocumentClient, QueryCommand, DeleteCommand, PutCommand, GetCommand } from "@aws-sdk/lib-dynamodb";
+/**
+ * Wraps errors thrown by the dataRefresh callback so they stay
+ * distinguishable from "no session": fetchSessionIfExists() swallows missing
+ * or invalid sessions but rethrows this, otherwise a transient failure in
+ * the refresh source would masquerade as a logout.
+ */
+export class LambderSessionDataRefreshError extends Error {
+    constructor(cause) {
+        super(`Session dataRefresh failed: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+        this.name = "LambderSessionDataRefreshError";
+    }
+}
 export default class LambderSessionManager {
     tableName;
     sessionSalt;
@@ -9,13 +21,15 @@ export default class LambderSessionManager {
     ddbDocumentClient;
     enableSlidingExpiration;
     slidingWriteIntervalSeconds;
-    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, enableSlidingExpiration = true, slidingWriteIntervalSeconds, }) {
+    dataRefresh;
+    constructor({ tableName, tableRegion, partitionKey, sortKey, sessionSalt, enableSlidingExpiration = true, slidingWriteIntervalSeconds, dataRefresh, }) {
         this.tableName = tableName;
         this.sessionSalt = sessionSalt;
         this.partitionKey = partitionKey;
         this.sortKey = sortKey;
         this.enableSlidingExpiration = enableSlidingExpiration;
         this.slidingWriteIntervalSeconds = slidingWriteIntervalSeconds ?? null;
+        this.dataRefresh = dataRefresh ?? null;
         const ddbClient = new DynamoDBClient({ region: tableRegion });
         this.ddbDocumentClient = DynamoDBDocumentClient.from(ddbClient);
     }
@@ -74,7 +88,7 @@ export default class LambderSessionManager {
             }));
         }
     }
-    async createSession(sessionKey, data = {}, ttlInSeconds = 30 * 24 * 60 * 60) {
+    async createSession(sessionKey, data = {}, ttlInSeconds = 30 * 24 * 60 * 60, options) {
         const sessionKeyHash = this.sessionUserKeyHasher(sessionKey);
         const sessionSortKey = crypto.randomBytes(32).toString("hex");
         const sessionToken = `${sessionKeyHash}:${sessionSortKey}`;
@@ -87,7 +101,8 @@ export default class LambderSessionManager {
             [this.sortKey]: sessionSortKey,
             sessionToken, csrfToken,
             sessionKey, data,
-            createdAt, lastAccessedAt, expiresAt, ttlInSeconds
+            createdAt, lastAccessedAt, expiresAt, ttlInSeconds,
+            ...(this.dataRefresh ? { dataExpiresAt: options?.dataExpiresAt ?? (createdAt + this.dataRefresh.ttlSeconds) } : {}),
         };
         await this.ddbPutItem(session);
         return session;
@@ -97,6 +112,10 @@ export default class LambderSessionManager {
             throw new Error("Invalid session");
         session.data = newData;
         session.lastAccessedAt = Math.floor(Date.now() / 1000);
+        // Explicitly written data is fresh by definition.
+        if (this.dataRefresh) {
+            session.dataExpiresAt = session.lastAccessedAt + this.dataRefresh.ttlSeconds;
+        }
         // Update expiration if sliding expiration is enabled
         if (this.enableSlidingExpiration) {
             session.expiresAt = session.lastAccessedAt + session.ttlInSeconds;
@@ -108,43 +127,105 @@ export default class LambderSessionManager {
         const [sessionKeyHash, sessionSortKey] = sessionToken.split(":");
         if (!sessionKeyHash || !sessionSortKey)
             return null;
+        let session;
         try {
-            let session = await this.ddbGetItem({
+            session = await this.ddbGetItem({
                 [this.partitionKey]: sessionKeyHash,
                 [this.sortKey]: sessionSortKey
             });
-            // Use constant error response to prevent timing attacks
-            if (!session)
-                return null;
-            if (!session.sessionToken || !this.constantTimeCompare(session.sessionToken, sessionToken))
-                return null;
-            if (!session.csrfToken)
-                return null;
-            if (!session.sessionKey)
-                return null;
-            if (!session.createdAt)
-                return null;
-            if (!session.expiresAt || session.expiresAt < Date.now() / 1000)
+        }
+        catch (err) {
+            return null;
+        }
+        // Use constant error response to prevent timing attacks
+        if (!session)
+            return null;
+        if (!session.sessionToken || !this.constantTimeCompare(session.sessionToken, sessionToken))
+            return null;
+        if (!session.csrfToken)
+            return null;
+        if (!session.sessionKey)
+            return null;
+        if (!session.createdAt)
+            return null;
+        if (!session.expiresAt || session.expiresAt < Date.now() / 1000)
+            return null;
+        const now = Math.floor(Date.now() / 1000);
+        let needsWrite = false;
+        // Renew session.data once its shelf life has passed (opt-in
+        // dataRefresh). Records from before the feature was enabled have no
+        // dataExpiresAt, so they renew on first read.
+        if (this.dataRefresh && (session.dataExpiresAt ?? 0) <= now) {
+            let newData;
+            try {
+                newData = await this.dataRefresh.refresh(session);
+            }
+            catch (err) {
+                // A failing refresh must fail this read, not masquerade as a
+                // missing session or silently serve stale data.
+                throw new LambderSessionDataRefreshError(err);
+            }
+            if (newData === null) {
+                await this.deleteSession(session);
                 return null;
-            // Update last accessed time if sliding expiration is enabled.
-            // Throttled: skip the DynamoDB write when the session was refreshed
-            // recently, to avoid a write on every request.
-            if (this.enableSlidingExpiration) {
-                const now = Math.floor(Date.now() / 1000);
-                const minInterval = this.slidingWriteIntervalSeconds
-                    ?? Math.max(60, Math.floor((session.ttlInSeconds || 0) * 0.05));
-                if (now - (session.lastAccessedAt || 0) >= minInterval) {
-                    session.lastAccessedAt = now;
-                    session.expiresAt = now + session.ttlInSeconds;
-                    // Wait for the update to ensure it persists before Lambda freezes
-                    await this.ddbPutItem(session).catch(() => { });
-                }
             }
-            return session;
+            session.data = newData;
+            session.dataExpiresAt = now + this.dataRefresh.ttlSeconds;
+            needsWrite = true;
+        }
+        // Update last accessed time if sliding expiration is enabled.
+        // Throttled: skip the DynamoDB write when the session was refreshed
+        // recently, to avoid a write on every request. A due data renewal
+        // above forces the write anyway, so both updates share one put.
+        if (this.enableSlidingExpiration) {
+            const minInterval = this.slidingWriteIntervalSeconds
+                ?? Math.max(60, Math.floor((session.ttlInSeconds || 0) * 0.05));
+            if (needsWrite || now - (session.lastAccessedAt || 0) >= minInterval) {
+                session.lastAccessedAt = now;
+                session.expiresAt = now + session.ttlInSeconds;
+                needsWrite = true;
+            }
+        }
+        if (needsWrite) {
+            // Wait for the update to ensure it persists before Lambda freezes.
+            // A failed put is not fatal: the data served is fresh, and an
+            // unpersisted renewal simply runs again on the next read.
+            await this.ddbPutItem(session).catch(() => { });
+        }
+        return session;
+    }
+    ;
+    /**
+     * Runs the dataRefresh callback now, regardless of dataExpiresAt, and
+     * persists the result onto the same record. Returns the updated session,
+     * or null when the callback ended it (the record is deleted). Requires
+     * dataRefresh to be configured.
+     */
+    async refreshSessionData(session) {
+        if (!this.dataRefresh)
+            throw new Error("dataRefresh is not configured. Pass dataRefresh to enableDdbSession(...) to enable.");
+        if (!session)
+            throw new Error("Invalid session");
+        let newData;
+        try {
+            newData = await this.dataRefresh.refresh(session);
         }
         catch (err) {
+            throw new LambderSessionDataRefreshError(err);
+        }
+        if (newData === null) {
+            await this.deleteSession(session);
             return null;
         }
+        const now = Math.floor(Date.now() / 1000);
+        session.data = newData;
+        session.dataExpiresAt = now + this.dataRefresh.ttlSeconds;
+        session.lastAccessedAt = now;
+        if (this.enableSlidingExpiration) {
+            session.expiresAt = now + session.ttlInSeconds;
+        }
+        await this.ddbPutItem(session);
+        return session;
     }
     ;
     isSessionValid(session, sessionToken, csrfToken, skipCsrfTokenCheck = false) {
@@ -183,13 +264,25 @@ export default class LambderSessionManager {
         return true;
     }
     ;
+    /**
+     * Deletes every session created for the given sessionKey (e.g. a user
+     * id): "log this subject out everywhere", without needing a fetched
+     * session record.
+     */
+    async deleteSessionAllByKey(sessionKey) {
+        await this.ddbDeleteAllByPartitionKey(this.sessionUserKeyHasher(sessionKey));
+        return true;
+    }
+    ;
     async regenerateSession(session) {
         if (!session)
             throw new Error("Invalid session");
         // Delete old session
         await this.deleteSession(session);
-        // Create new session with same sessionKey and data but new tokens
-        return await this.createSession(session.sessionKey, session.data, session.ttlInSeconds);
+        // Create new session with same sessionKey and data but new tokens.
+        // The data freshness stamp carries over: rotating tokens must not
+        // extend how long dataRefresh-managed data may stay unrenewed.
+        return await this.createSession(session.sessionKey, session.data, session.ttlInSeconds, session.dataExpiresAt !== undefined ? { dataExpiresAt: session.dataExpiresAt } : undefined);
     }
 }
 ;

package/dist/index.d.ts

@@ -16,7 +16,8 @@ export type { LambderRouteMatcher, LambderCorsConfig, LambderConstructorOptions,
 export { LambderPublicFilesHandler } from "./LambderPublicFiles.js";
 export type { LambderPublicFilesOptions } from "./LambderPublicFiles.js";
 export type { LambderSessionCookieOptions } from "./LambderSessionController.js";
-export type { LambderSessionContext } from "./LambderSessionManager.js";
+export type { LambderSessionContext, LambderSessionDataRefreshConfig } from "./LambderSessionManager.js";
+export { LambderSessionDataRefreshError } from "./LambderSessionManager.js";
 export { LambderDdbCache } from "./LambderDdbCache.js";
 export type { LambderDdbCacheOptions, LambderDdbCacheSetOptions, LambderDdbCacheGetOrSetOptions, } from "./LambderDdbCache.js";
 export { LambderDdbRateLimiter } from "./LambderDdbRateLimiter.js";

package/dist/index.js

@@ -14,6 +14,7 @@ export { html, xml, raw, jsonScript, escapeHtml, renderHtmlValue, LambderSafeHtm
 export { LambderTemplatingEngine } from "./LambderTemplatingEngine.js";
 // Public file serving
 export { LambderPublicFilesHandler } from "./LambderPublicFiles.js";
+export { LambderSessionDataRefreshError } from "./LambderSessionManager.js";
 // DynamoDB-backed compressed cache (standalone, server-only)
 export { LambderDdbCache } from "./LambderDdbCache.js";
 // DynamoDB-backed fixed-window rate limiter (standalone, server-only)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "3.3.3",
+  "version": "3.4.2",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",