lambder 4.3.2 → 4.4.1

package/Readme.md

@@ -2,6 +2,12 @@
 
 Lambder is a highly opinionated dynamic serverless framework designed to facilitate the management and implementation of routes and APIs within AWS Lambda functions, specifically tailored for TypeScript projects. It provides a streamlined approach to handling HTTP requests, managing sessions, and defining API routes, making serverless application development more intuitive and structured.
 
+**New in 4.4:**
+
+- **`guardInputsProvider`** on `LambderCaller`: supply guardInput-mode guard values for every call from one place (the organization the UI is on, a device token) instead of at each call site; per-call `guardInputs` merge on top. Name the covered guards in the caller's second type parameter, `new LambderCaller<Contract, "orgPermission">({ guardInputsProvider, ... })`: calls to APIs whose guardInput guards are all covered no longer require the options argument, uncovered ones (a Turnstile token) still do, and naming guards makes the provider itself mandatory.
+- **Public file sources**: `servePublicFiles({ source })` serves from any `LambderPublicFileSource`: `LambderLocalFileSource` (a folder; the default, over `publicPath`), `LambderS3FileSource` (S3, or Cloudflare R2 and other S3-compatible stores via `clientConfig.endpoint`; `@aws-sdk/client-s3` is an optional peer dependency loaded on first read), or your own `{ read(relativePath) }`. The handler's traversal check, memory cache, mime fallback from the extension, Cache-Control, ETag and compression apply to every source. The `cacheControl` callback receives the relative file path.
+- **`expireSessionDataAllByKey(sessionKey)`** on the session manager and controller: marks the data of every session of a subject stale, so each renews via `dataRefresh` on its next read. The way to apply a role or permission change to a user immediately, without logging them out (`deleteSessionAllByKey`) and without waiting for the data TTL.
+
 **New in 4.3:**
 
 - **Compressed sessions**: `session.data` is stored Brotli-compressed by default, as `dataBr` + `dataBytes` on the record, the same scheme LambderDdbCache and LambderDdbIdempotency use (one shared implementation). A session that caches roles, permissions or product lists shrinks 2-3x and stays within one DynamoDB read unit for longer. `session.compression` is `true` by default (the same as `{ minBytes: 0 }`: every record compressed); `false` turns it off and `{ minBytes }` compresses only from that JSON size. Records written under either setting read back, so it can be switched on or off on a live table.
@@ -160,8 +166,9 @@ lambder
     .addRoute({ path: "/stripe-webhook", method: "POST" }, (ctx, res) => {
         return res.json({ received: true });
     })
-    // Serve real files from publicPath. This is a terminal fallback slot, NOT
-    // a catch-all route, so it can never shadow routes registered after it.
+    // Serve real files (from publicPath by default; see "Public file sources"
+    // below for S3/R2). This is a terminal fallback slot, NOT a catch-all
+    // route, so it can never shadow routes registered after it.
     .servePublicFiles()
     // Serve the app shell for GET/HEAD page requests nothing else handled
     // (see "Hosting a frontend build" below).
@@ -359,6 +366,7 @@ Semantics:
 - The renewal write and the sliding-expiration write share a single DynamoDB put when both are due.
 - Records created before `dataRefresh` was enabled renew on their first read.
 - `updateSessionData()` marks data fresh (it was just written deliberately); `regenerateSession()` carries the old freshness stamp over.
+- `expireSessionDataAllByKey(sessionKey)` stamps every session of a subject stale at once: call it after changing that subject's roles or permissions, and the change applies on their next request instead of within `ttlSeconds`, with no logout. It updates only `dataExpiresAt`, conditionally on the record still existing, so it neither resurrects a deleted session nor clobbers a concurrent write.
 
 #### Session data at rest (`compression`)
 
@@ -389,6 +397,7 @@ Access the session controller with `lambder.getSessionController(ctx)`:
 | `endSession()` | End session, delete from DDB |
 | `endSessionAll()` | End all sessions for this sessionKey (all devices) |
 | `deleteSessionAllByKey(sessionKey)` | Delete all sessions of any sessionKey (e.g. "log user X out everywhere") |
+| `expireSessionDataAllByKey(sessionKey)` | Mark the data of all sessions of a sessionKey stale, so each renews via `dataRefresh` on its next read (no logout) |
 | `regenerateSession()` | Regenerate token (use after password change) |
 
 ### Type-Safe Templating (html / xml)
@@ -432,6 +441,33 @@ const output = template.render({
 
 Lambder has no SPA-specific machinery; hosting a frontend build is a recipe built from three generic primitives: `servePublicFiles()` (terminal slot serving real files: memory-cached, immutable Cache-Control for hashed assets, ETag/gzip, falls through when missing), `serveIndexHtml()` (next fallback slot, GET/HEAD + non-file-path gated) and `res.templateFile()` (render an HTML file through the templating engine, compiled once and cached). **Full guide with the multi-tenant recipe: [docs/TEMPLATING.md](./docs/TEMPLATING.md).**
 
+#### Public file sources
+
+`servePublicFiles` reads through a `LambderPublicFileSource`, an object with one method, `read(relativePath)`, returning `{ body, mimeType? }` or `null` (the request then falls through). The handler does everything else for every source: traversal check, memory cache for warm invocations, mime fallback from the extension, Cache-Control (immutable for content-hashed names), ETag and compression. Built in:
+
+```typescript
+// Default: the publicPath folder bundled with the deployment.
+lambder.servePublicFiles();
+
+// S3. @aws-sdk/client-s3 is an optional peer dependency, loaded on first read.
+lambder.servePublicFiles({
+    source: new LambderS3FileSource({ bucket: "myapp-web", prefix: "v42/", clientConfig: { region: "eu-central-1" } }),
+});
+
+// Cloudflare R2, or any S3-compatible store: point the client at its endpoint.
+lambder.servePublicFiles({
+    source: new LambderS3FileSource({
+        bucket: "myapp-web",
+        clientConfig: { region: "auto", endpoint: "https://<account>.r2.cloudflarestorage.com", credentials: { accessKeyId, secretAccessKey } },
+    }),
+});
+
+// Anything else: implement read().
+lambder.servePublicFiles({ source: { read: async (relativePath) => myStore.get(relativePath) } });
+```
+
+A missing S3 object reads as null; grant `s3:ListBucket` besides `s3:GetObject`, otherwise S3 answers a missing key with AccessDenied, which propagates as an error instead of falling through. The object's Content-Type is used unless it is a generic octet-stream, in which case the extension decides. Lambda's ~6MB response cap still applies to anything proxied this way: redirect large downloads to the bucket or CDN URL instead of serving them.
+
 ```typescript
 // Zero-config single-tenant hosting:
 lambder.servePublicFiles().serveIndexHtml();
@@ -772,7 +808,7 @@ Also available:
 
 - **Timeouts**: pass `timeoutMs` in the constructor for a default (API Gateway caps around 29s, so ~30000 is sensible) and/or per call; timed-out calls abort the fetch and report `reason: 'timeout'`. A per-call `signal` combines with the timeout.
 - **Per-call handler overrides**: every constructor handler (`errorHandler`, `sessionExpiredHandler`, `errorMessageHandler`, ...) can be overridden in the options of a single `api`/`apiOutcome` call.
-- **Guard inputs**: for APIs whose guards run in guardInput mode, pass their values per call as `guardInputs: { <guardName>: value }`; the typed contract makes the options argument (and the correct value shape) mandatory for those APIs.
+- **Guard inputs**: for APIs whose guards run in guardInput mode, pass their values per call as `guardInputs: { <guardName>: value }`; the typed contract makes the options argument (and the correct value shape) mandatory for those APIs. A `guardInputsProvider` on the caller supplies values for every call from one place, keyed by guard name, with per-call `guardInputs` merged on top; name the guards it covers in the caller's second type parameter, `new LambderCaller<Contract, "orgPermission">({ guardInputsProvider: () => ({ orgPermission: { orgSlug } }), ... })`, and calls to APIs whose guardInput guards are all covered take an optional options argument again.
 - **Idempotency keys**: pass `idempotencyKey` per call for APIs declared idempotent on the server (see Declarative API Policies). Generate it once per logical operation with `LambderCaller.createIdempotencyKey()` (safe in insecure contexts where `crypto.randomUUID` is missing) and send the same key on retries; rotate after a confirmed success. `LambderCaller.createIdempotencyKeyScope()` packages that pattern for a component performing one operation repeatedly: read `scope.current` on every attempt, call `scope.rotate()` after a confirmed success. Keys must be unguessable random and 16-200 characters (they scope the replay record for logged-out clients); the server refuses shorter keys with a 400.
 
 ### Benefits

package/dist/client/LambderCaller.d.ts

@@ -5,14 +5,52 @@ type IsAny<T> = 0 extends (1 & T) ? true : false;
 type GuardInputsOf<TEntry> = TEntry extends {
     guardInputs: infer G;
 } ? G : never;
+/** Input type of guard G on one contract entry; never when that API does not declare it. */
+type GuardInputOf<TEntry, G extends string> = GuardInputsOf<TEntry> extends infer I ? (G extends keyof I ? I[G] : never) : never;
+/**
+ * What guardInputsProvider returns: for every provided guard name, the value
+ * the contract's APIs expect for it (a union across APIs when they differ).
+ * Naming a guard no API declares in guardInput mode resolves to never, so a
+ * typo fails the provider's return type instead of going missing at runtime.
+ */
+export type LambderProvidedGuardInputs<TContract, TProvided extends string> = IsAny<TContract> extends true ? Record<TProvided, unknown> : {
+    [G in TProvided]: {
+        [K in keyof TContract]: GuardInputOf<TContract[K], G>;
+    }[keyof TContract];
+};
+/**
+ * Supplies guardInputs for every call from one place (the organization the
+ * UI is on, a device token), keyed by guard name; per-call guardInputs
+ * merge on top. Name the guards it covers in the caller's second type
+ * parameter, `new LambderCaller<Contract, "orgPermission">`, and calls to
+ * APIs whose guardInput guards are all covered no longer require the
+ * options argument. May be async; a throw fails the call as an unknown
+ * error before anything is sent.
+ */
+export type LambderGuardInputsProvider<TContract, TProvided extends string> = (apiName: keyof TContract & string) => LambderProvidedGuardInputs<TContract, TProvided> | Promise<LambderProvidedGuardInputs<TContract, TProvided>>;
+/** Optional until the caller names provided guards: naming them without a provider would send nothing. */
+type GuardInputsProviderOption<TContract, TProvided extends string> = [
+    TProvided
+] extends [never] ? {
+    guardInputsProvider?: LambderGuardInputsProvider<TContract, TProvided>;
+} : {
+    guardInputsProvider: LambderGuardInputsProvider<TContract, TProvided>;
+};
+/** An API's guardInput guards the provider does not cover: those the call must still pass. */
+type RemainingGuardInputs<TEntry, TProvided extends string> = Omit<GuardInputsOf<TEntry>, TProvided>;
 /**
  * The options argument: optional normally, REQUIRED (with guardInputs) when
- * the API's contract declares guardInput-mode guards, so forgetting to send
- * a guard's value is a compile error at the call site.
+ * the API's contract declares guardInput-mode guards the provider does not
+ * cover, so forgetting to send a guard's value is a compile error at the
+ * call site. Provided guards may still be overridden per call.
  */
-type CallOptionsArg<TContract, TApiName> = IsAny<TContract> extends true ? [options?: LambderCallOptions] : TApiName extends keyof TContract ? [GuardInputsOf<TContract[TApiName]>] extends [never] ? [options?: LambderCallOptions] : [options: LambderCallOptions & {
-    guardInputs: GuardInputsOf<TContract[TApiName]>;
-}] : [options?: LambderCallOptions];
+type CallOptionsArg<TContract, TApiName, TProvided extends string> = IsAny<TContract> extends true ? [options?: LambderCallOptions] : TApiName extends keyof TContract ? [GuardInputsOf<TContract[TApiName]>] extends [never] ? [options?: LambderCallOptions] : [keyof RemainingGuardInputs<TContract[TApiName], TProvided>] extends [never] ? [options?: LambderCallOptions & {
+    guardInputs?: Partial<GuardInputsOf<TContract[TApiName]>>;
+}] : [
+    options: LambderCallOptions & {
+        guardInputs: RemainingGuardInputs<TContract[TApiName], TProvided> & Partial<GuardInputsOf<TContract[TApiName]>>;
+    }
+] : [options?: LambderCallOptions];
 type VoidFunction = () => void | Promise<void>;
 type FetchTracker = {
     apiName: string;
@@ -79,7 +117,9 @@ export type LambderCallOptions = {
     /**
      * Values for the API's guardInput-mode guards, keyed by guard name; sent
      * beside the payload and consumed by the guards before validation. The
-     * typed contract makes this REQUIRED for APIs that declare such guards.
+     * typed contract makes this REQUIRED for APIs that declare such guards,
+     * except the guards a guardInputsProvider covers (these merge on top of
+     * the provider's values).
      */
     guardInputs?: Record<string, unknown>;
     /**
@@ -102,7 +142,31 @@ export type LambderCallOptions = {
     fetchStartedHandler?: FetchStartEventHandler;
     fetchEndedHandler?: FetchEndEventHandler;
 };
-export default class LambderCaller<TContract extends ApiContractShape = any> {
+type LambderCallerBaseOptions = {
+    apiPath: string;
+    apiVersion?: string;
+    isCorsEnabled: boolean;
+    /** Default per-request timeout in ms (none unless set; API Gateway caps around 29s, so ~30000 is a sensible value). Overridable per call. */
+    timeoutMs?: number;
+    versionExpiredHandler?: VoidFunction;
+    sessionExpiredHandler?: VoidFunction;
+    messageHandler?: MessageHandler;
+    errorMessageHandler?: MessageHandler;
+    notAuthorizedHandler?: VoidFunction;
+    errorHandler?: ErrorHandler;
+    fetchStartedHandler?: FetchStartEventHandler;
+    fetchEndedHandler?: FetchEndEventHandler;
+    apiInputValidationErrorHandler?: ValidationErrorHandler;
+    /** Must mirror the server's session cookie Domain, otherwise expired cookies cannot be cleared. */
+    sessionCookieDomain?: string | ((hostname: string) => string | undefined | null);
+};
+/** Constructor options: the base options plus guardInputsProvider, mandatory once TProvided names guards. */
+export type LambderCallerOptions<TContract, TProvided extends string = never> = LambderCallerBaseOptions & GuardInputsProviderOption<TContract, TProvided>;
+/**
+ * @typeParam TContract - The API contract, for typed names, payloads and guard inputs.
+ * @typeParam TProvidedGuards - Guard names guardInputsProvider covers; those APIs' options argument becomes optional.
+ */
+export default class LambderCaller<TContract extends ApiContractShape = any, TProvidedGuards extends string = never> {
     private isCorsEnabled;
     private apiPath;
     private apiVersion?;
@@ -118,27 +182,11 @@ export default class LambderCaller<TContract extends ApiContractShape = any> {
     private apiInputValidationErrorHandler?;
     private fetchStartedHandler?;
     private fetchEndedHandler?;
+    private guardInputsProvider?;
     private sessionTokenCookieKey;
     private sessionCsrfCookieKey;
     private sessionCookieDomain?;
-    constructor({ apiPath, apiVersion, isCorsEnabled, timeoutMs, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, apiInputValidationErrorHandler, sessionCookieDomain, }: {
-        apiPath: string;
-        apiVersion?: string;
-        isCorsEnabled: boolean;
-        /** Default per-request timeout in ms (none unless set; API Gateway caps around 29s, so ~30000 is a sensible value). Overridable per call. */
-        timeoutMs?: number;
-        versionExpiredHandler?: VoidFunction;
-        sessionExpiredHandler?: VoidFunction;
-        messageHandler?: MessageHandler;
-        errorMessageHandler?: MessageHandler;
-        notAuthorizedHandler?: VoidFunction;
-        errorHandler?: ErrorHandler;
-        fetchStartedHandler?: FetchStartEventHandler;
-        fetchEndedHandler?: FetchEndEventHandler;
-        apiInputValidationErrorHandler?: ValidationErrorHandler;
-        /** Must mirror the server's session cookie Domain, otherwise expired cookies cannot be cleared. */
-        sessionCookieDomain?: string | ((hostname: string) => string | undefined | null);
-    });
+    constructor(options: LambderCallerOptions<TContract, TProvidedGuards>);
     setSessionCookieKey(sessionTokenCookieKey: string, sessionCsrfCookieKey: string): void;
     /**
      * A self-rotating idempotency key for a component or form that performs
@@ -171,8 +219,8 @@ export default class LambderCaller<TContract extends ApiContractShape = any> {
      * Full-fidelity call: resolves to a discriminated LambderApiOutcome
      * instead of collapsing every failure to null. Never throws.
      */
-    apiOutcome<TApiName extends keyof TContract & string = string, TOutput = TApiName extends keyof TContract ? TContract[TApiName]['output'] : any>(apiName: TApiName, payload?: TApiName extends keyof TContract ? TContract[TApiName]['input'] : any, ...rest: CallOptionsArg<TContract, TApiName>): Promise<LambderApiOutcome<TOutput>>;
+    apiOutcome<TApiName extends keyof TContract & string = string, TOutput = TApiName extends keyof TContract ? TContract[TApiName]['output'] : any>(apiName: TApiName, payload?: TApiName extends keyof TContract ? TContract[TApiName]['input'] : any, ...rest: CallOptionsArg<TContract, TApiName, TProvidedGuards>): Promise<LambderApiOutcome<TOutput>>;
     /** Payload on success, null/undefined otherwise (indistinguishable from a null payload; prefer apiOutcome() when that matters). */
-    api<TApiName extends keyof TContract & string = string, TOutput = TApiName extends keyof TContract ? TContract[TApiName]['output'] : any>(apiName: TApiName, payload?: TApiName extends keyof TContract ? TContract[TApiName]['input'] : any, ...rest: CallOptionsArg<TContract, TApiName>): Promise<TOutput | null | undefined>;
+    api<TApiName extends keyof TContract & string = string, TOutput = TApiName extends keyof TContract ? TContract[TApiName]['output'] : any>(apiName: TApiName, payload?: TApiName extends keyof TContract ? TContract[TApiName]['input'] : any, ...rest: CallOptionsArg<TContract, TApiName, TProvidedGuards>): Promise<TOutput | null | undefined>;
 }
 export {};

package/dist/client/LambderCaller.js

@@ -1,4 +1,8 @@
 import Cookies from 'js-cookie';
+/**
+ * @typeParam TContract - The API contract, for typed names, payloads and guard inputs.
+ * @typeParam TProvidedGuards - Guard names guardInputsProvider covers; those APIs' options argument becomes optional.
+ */
 export default class LambderCaller {
     isCorsEnabled;
     apiPath;
@@ -15,10 +19,14 @@ export default class LambderCaller {
     apiInputValidationErrorHandler;
     fetchStartedHandler;
     fetchEndedHandler;
+    guardInputsProvider;
     sessionTokenCookieKey = "LMDRSESSIONTKID";
     sessionCsrfCookieKey = "LMDRSESSIONCSTK";
     sessionCookieDomain;
-    constructor({ apiPath, apiVersion, isCorsEnabled = false, timeoutMs, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, apiInputValidationErrorHandler, sessionCookieDomain, }) {
+    constructor(options) {
+        // The conditional provider option is resolved per instantiation;
+        // inside the class it is read through the plain shape.
+        const { apiPath, apiVersion, isCorsEnabled = false, timeoutMs, versionExpiredHandler, sessionExpiredHandler, messageHandler, errorMessageHandler, notAuthorizedHandler, errorHandler, fetchStartedHandler, fetchEndedHandler, apiInputValidationErrorHandler, sessionCookieDomain, guardInputsProvider, } = options;
         this.apiPath = apiPath ?? "/api";
         this.apiVersion = apiVersion;
         this.isCorsEnabled = isCorsEnabled;
@@ -33,6 +41,7 @@ export default class LambderCaller {
         this.apiInputValidationErrorHandler = apiInputValidationErrorHandler;
         this.fetchStartedHandler = fetchStartedHandler;
         this.fetchEndedHandler = fetchEndedHandler;
+        this.guardInputsProvider = guardInputsProvider;
     }
     ;
     setSessionCookieKey(sessionTokenCookieKey, sessionCsrfCookieKey) {
@@ -159,6 +168,13 @@ export default class LambderCaller {
             const version = this.apiVersion;
             const token = Cookies.get(this.sessionCsrfCookieKey) || "";
             const siteHost = window.location.hostname;
+            // Provider values underneath, per-call values on top.
+            const providedGuardInputs = this.guardInputsProvider
+                ? await this.guardInputsProvider(apiName)
+                : undefined;
+            const guardInputs = providedGuardInputs !== undefined || options?.guardInputs !== undefined
+                ? { ...providedGuardInputs, ...options?.guardInputs }
+                : undefined;
             let res;
             try {
                 res = await fetch(this.apiPath, {
@@ -170,7 +186,7 @@ export default class LambderCaller {
                     headers: { 'Content-Type': 'application/json', ...(headers || {}) },
                     body: JSON.stringify({
                         apiName, version, token, siteHost, payload,
-                        ...(options?.guardInputs !== undefined ? { guardInputs: options.guardInputs } : {}),
+                        ...(guardInputs !== undefined ? { guardInputs } : {}),
                         ...(options?.idempotencyKey !== undefined ? { idempotencyKey: options.idempotencyKey } : {}),
                     }),
                     ...(signal ? { signal } : {}),

package/dist/client.d.ts

@@ -7,7 +7,7 @@
  * the root entry (`"lambder"`) is the server surface.
  */
 export { default as LambderCaller } from "./client/LambderCaller.js";
-export type { LambderApiOutcome, LambderApiFailureReason, LambderCallOptions, LambderIdempotencyKeyScope, } from "./client/LambderCaller.js";
+export type { LambderApiOutcome, LambderApiFailureReason, LambderCallOptions, LambderCallerOptions, LambderGuardInputsProvider, LambderProvidedGuardInputs, LambderIdempotencyKeyScope, } from "./client/LambderCaller.js";
 export { LambderApiError, isLambderApiError, refuse, LAMBDER_REFUSAL_CODES } from "./shared/LambderApiError.js";
 export type { LambderApiErrorOptions, LambderRefusalMessage, LambderRefusalCode, LambderRefuseOptions } from "./shared/LambderApiError.js";
 export type { ApiContractShape, LambderApiResponse, LambderApiResponseConfig } from "./shared/LambderApiContract.js";

package/dist/core/Lambder.d.ts

@@ -194,11 +194,13 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
     setSessionExpiredRouteHandler(handler: FallbackHandlerFunction): this;
     /**
      * Terminal public-file layer. Runs only when no route matched, so it can
-     * never shadow routes registered after it. Serves real files under
-     * publicPath (traversal-safe, mime-typed, memory-cached, immutable-cache
-     * heuristic for content-hashed assets); when the file does not exist the
-     * request falls through to setRouteFallbackHandler, where the app decides
-     * what remains (e.g. render an app shell with res.templateFile).
+     * never shadow routes registered after it. Serves files from `source`
+     * (default: the publicPath folder; also LambderS3FileSource for S3 and
+     * R2, or any LambderPublicFileSource), traversal-safe, mime-typed,
+     * memory-cached, with the immutable-cache heuristic for content-hashed
+     * assets; when the source has no such file the request falls through to
+     * setRouteFallbackHandler, where the app decides what remains (e.g.
+     * render an app shell with res.templateFile).
      */
     servePublicFiles(options?: LambderPublicFilesOptions): this;
     /**

package/dist/core/Lambder.js

@@ -5,7 +5,7 @@ import { compileRouteMatcher } from "./LambderRouting.js";
 import { applyCorsHeaders } from "./LambderCors.js";
 import LambderSessionManager from "../session/LambderSessionManager.js";
 import LambderSessionController from "../session/LambderSessionController.js";
-import { LambderPublicFilesHandler } from "./LambderPublicFiles.js";
+import { LambderPublicFilesHandler, LambderLocalFileSource } from "./LambderPublicFiles.js";
 import { isLambderApiError, LAMBDER_REFUSAL_CODES } from "../shared/LambderApiError.js";
 import { LambderApiPolicyEngine } from "../policies/LambderApiPolicies.js";
 import { createContext, isV2HttpEvent } from "./LambderContext.js";
@@ -129,14 +129,17 @@ export default class Lambder {
     }
     /**
      * Terminal public-file layer. Runs only when no route matched, so it can
-     * never shadow routes registered after it. Serves real files under
-     * publicPath (traversal-safe, mime-typed, memory-cached, immutable-cache
-     * heuristic for content-hashed assets); when the file does not exist the
-     * request falls through to setRouteFallbackHandler, where the app decides
-     * what remains (e.g. render an app shell with res.templateFile).
+     * never shadow routes registered after it. Serves files from `source`
+     * (default: the publicPath folder; also LambderS3FileSource for S3 and
+     * R2, or any LambderPublicFileSource), traversal-safe, mime-typed,
+     * memory-cached, with the immutable-cache heuristic for content-hashed
+     * assets; when the source has no such file the request falls through to
+     * setRouteFallbackHandler, where the app decides what remains (e.g.
+     * render an app shell with res.templateFile).
      */
     servePublicFiles(options = {}) {
-        this.publicFilesHandler = new LambderPublicFilesHandler(this.publicPath, options);
+        const source = options.source ?? new LambderLocalFileSource({ root: this.publicPath });
+        this.publicFilesHandler = new LambderPublicFilesHandler(source, options);
         return this;
     }
     /**

package/dist/core/LambderPublicFiles.d.ts

@@ -1,14 +1,36 @@
 import type { LambderRenderContext } from "./LambderContext.js";
 import { LambderResponse } from "./LambderResponse.js";
+/** A file a source serves: its bytes, and its mime type when the source knows it (otherwise resolved from the extension). */
+export type LambderPublicFile = {
+    body: Buffer;
+    mimeType?: string;
+};
+/**
+ * Where servePublicFiles gets its files. Implement `read` over any backing
+ * store: LambderLocalFileSource (a folder, the default), LambderS3FileSource
+ * (S3, or R2 and other S3-compatible stores), or your own. The handler does
+ * the rest for every source: traversal check, memory cache, mime fallback
+ * from the extension, Cache-Control, ETag and compression.
+ */
+export interface LambderPublicFileSource {
+    /**
+     * The file at a relative path (no leading slash, no ".." segments: the
+     * handler rejects those before calling), or null when there is no such
+     * file, which lets the request fall through to the route fallback.
+     */
+    read(relativePath: string): Promise<LambderPublicFile | null>;
+}
 export type LambderPublicFilesOptions = {
+    /** Where files come from. Default: LambderLocalFileSource over publicPath. */
+    source?: LambderPublicFileSource;
     /**
-     * Map the request to a file path under publicPath (app-owned logic, e.g.
-     * per-tenant roots: (ctx) => `${brand(ctx.host)}${ctx.path}`). Return
+     * Map the request to a file path (app-owned logic, e.g. per-tenant
+     * roots: (ctx) => `${brand(ctx.host)}${ctx.path}`). Return
      * null/undefined to skip. Default: (ctx) => ctx.path.
      */
     path?: (ctx: LambderRenderContext) => string | null | undefined;
-    /** Cache-Control for served files. Default: "public, max-age=3600". */
-    cacheControl?: string | ((ctx: LambderRenderContext, filePath: string) => string);
+    /** Cache-Control for served files; the function receives the relative file path. Default: "public, max-age=3600". */
+    cacheControl?: string | ((ctx: LambderRenderContext, relativePath: string) => string);
     /** Filenames matching this get immutableCacheControl. Default: content-hash heuristic. Set false to disable. */
     immutablePattern?: RegExp | false;
     /** Default: "public, max-age=31536000, immutable". */
@@ -24,24 +46,34 @@ export type LambderPublicFilesOptions = {
      */
     compress?: boolean | "auto" | ((ctx: LambderRenderContext) => boolean | "auto");
 };
+/**
+ * Files from a folder on the Lambda's filesystem, typically the build output
+ * bundled into the deployment package. Reads stay under root. The default
+ * source of servePublicFiles, over publicPath.
+ */
+export declare class LambderLocalFileSource implements LambderPublicFileSource {
+    private root;
+    constructor({ root }: {
+        root: string;
+    });
+    read(relativePath: string): Promise<LambderPublicFile | null>;
+}
 /**
  * Terminal public-file handler registered via lambder.servePublicFiles().
  * Runs only when no route matched, so it can never shadow routes registered
- * after it. Serves real files under publicPath (traversal-safe, mime-typed,
+ * after it. Serves files from its source (traversal-safe, mime-typed,
  * memory-cached, immutable-cache heuristic for content-hashed assets) and
- * falls through to the route fallback when the file does not exist.
+ * falls through to the route fallback when the source has no such file.
  */
 export declare class LambderPublicFilesHandler {
-    private publicPath;
+    private source;
     private options;
     private fileCache;
     private fileCacheBytes;
-    constructor(publicPath: string, options: LambderPublicFilesOptions);
+    constructor(source: LambderPublicFileSource, options: LambderPublicFilesOptions);
     /** Serve the mapped file, or return null to fall through. */
     handle(ctx: LambderRenderContext): Promise<LambderResponse | null>;
-    /** Join base+target and require the result to stay under base. */
-    private resolveSafe;
-    /** Read a file, caching small files in memory for warm invocations. */
-    private readFileCached;
+    /** Read from the source, caching small files in memory for warm invocations. */
+    private readCached;
     private cacheControlFor;
 }

package/dist/core/LambderPublicFiles.js

@@ -8,36 +8,65 @@ const DEFAULT_IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
 const DEFAULT_CACHE_CONTROL = "public, max-age=3600";
 const DEFAULT_MEMORY_CACHE_MAX_BYTES = 32 * 1024 * 1024;
 const DEFAULT_MEMORY_CACHE_MAX_FILE_BYTES = 2 * 1024 * 1024;
+/**
+ * Files from a folder on the Lambda's filesystem, typically the build output
+ * bundled into the deployment package. Reads stay under root. The default
+ * source of servePublicFiles, over publicPath.
+ */
+export class LambderLocalFileSource {
+    root;
+    constructor({ root }) {
+        this.root = root;
+    }
+    async read(relativePath) {
+        const fs = await getFS();
+        const path = await getPath();
+        if (!fs || !path)
+            throw new Error("LambderLocalFileSource requires a Node.js environment.");
+        const base = path.resolve(this.root);
+        const absolute = path.resolve(base, relativePath);
+        if (absolute !== base && !absolute.startsWith(base + path.sep))
+            return null;
+        const stat = await fs.promises.stat(absolute).catch(() => null);
+        if (!stat?.isFile())
+            return null;
+        return { body: await fs.promises.readFile(absolute) };
+    }
+}
+/** Strip the leading slash and reject traversal; null for a path that names no file (empty, or a directory). */
+const toRelativePath = (target) => {
+    if (target.split("/").some((segment) => segment === ".."))
+        return null;
+    const relative = target.startsWith("/") ? target.slice(1) : target;
+    if (relative === "" || relative.endsWith("/"))
+        return null;
+    return relative;
+};
 /**
  * Terminal public-file handler registered via lambder.servePublicFiles().
  * Runs only when no route matched, so it can never shadow routes registered
- * after it. Serves real files under publicPath (traversal-safe, mime-typed,
+ * after it. Serves files from its source (traversal-safe, mime-typed,
  * memory-cached, immutable-cache heuristic for content-hashed assets) and
- * falls through to the route fallback when the file does not exist.
+ * falls through to the route fallback when the source has no such file.
  */
 export class LambderPublicFilesHandler {
-    publicPath;
+    source;
     options;
     fileCache = new Map();
     fileCacheBytes = 0;
-    constructor(publicPath, options) {
-        this.publicPath = publicPath;
+    constructor(source, options) {
+        this.source = source;
         this.options = options;
     }
     /** Serve the mapped file, or return null to fall through. */
     async handle(ctx) {
-        const fs = await getFS();
-        const path = await getPath();
-        if (!fs || !path)
-            throw new Error("servePublicFiles requires a Node.js environment.");
         const mappedPath = this.options.path ? this.options.path(ctx) : ctx.path;
         if (!mappedPath)
             return null;
-        const publicRoot = path.resolve(this.publicPath);
-        const filePath = this.resolveSafe(path, publicRoot, mappedPath);
-        if (!filePath)
+        const relativePath = toRelativePath(mappedPath);
+        if (relativePath === null)
             return null;
-        const file = await this.readFileCached(fs, filePath);
+        const file = await this.readCached(relativePath);
         if (!file)
             return null;
         const compressOption = this.options.compress;
@@ -46,61 +75,52 @@ export class LambderPublicFilesHandler {
             statusCode: 200,
             headers: {
                 "Content-Type": file.mimeType,
-                "Cache-Control": this.cacheControlFor(ctx, filePath),
+                "Cache-Control": this.cacheControlFor(ctx, relativePath),
             },
             body: file.body,
             compress,
         });
     }
-    /** Join base+target and require the result to stay under base. */
-    resolveSafe(path, base, target) {
-        if (target.split("/").some((segment) => segment === ".."))
-            return null;
-        const normalizedTarget = target.startsWith("/") ? target.slice(1) : target;
-        const absolute = path.resolve(base, normalizedTarget);
-        if (absolute !== base && !absolute.startsWith(base + path.sep))
-            return null;
-        return absolute;
-    }
-    /** Read a file, caching small files in memory for warm invocations. */
-    async readFileCached(fs, filePath) {
-        const cached = this.fileCache.get(filePath);
+    /** Read from the source, caching small files in memory for warm invocations. */
+    async readCached(relativePath) {
+        const cached = this.fileCache.get(relativePath);
         if (cached)
             return cached;
-        const stat = await fs.promises.stat(filePath).catch(() => null);
-        if (!stat?.isFile())
+        const file = await this.source.read(relativePath);
+        if (!file)
             return null;
-        const body = await fs.promises.readFile(filePath);
-        const mimeType = mimeTypeResolver.lookup(filePath) || "application/octet-stream";
-        const entry = { body, mimeType };
+        const entry = {
+            body: file.body,
+            mimeType: file.mimeType || mimeTypeResolver.lookup(relativePath) || "application/octet-stream",
+        };
         const cacheConfig = this.options.memoryCache;
         if (cacheConfig !== false) {
             const maxBytes = cacheConfig?.maxBytes ?? DEFAULT_MEMORY_CACHE_MAX_BYTES;
             const maxFileBytes = cacheConfig?.maxFileBytes ?? DEFAULT_MEMORY_CACHE_MAX_FILE_BYTES;
-            if (body.length <= maxFileBytes) {
+            if (entry.body.length <= maxFileBytes) {
                 // Evict oldest entries until the new file fits the budget.
                 for (const [key, value] of this.fileCache) {
-                    if (this.fileCacheBytes + body.length <= maxBytes)
+                    if (this.fileCacheBytes + entry.body.length <= maxBytes)
                         break;
                     this.fileCache.delete(key);
                     this.fileCacheBytes -= value.body.length;
                 }
-                if (this.fileCacheBytes + body.length <= maxBytes) {
-                    this.fileCache.set(filePath, entry);
-                    this.fileCacheBytes += body.length;
+                if (this.fileCacheBytes + entry.body.length <= maxBytes) {
+                    this.fileCache.set(relativePath, entry);
+                    this.fileCacheBytes += entry.body.length;
                 }
             }
         }
         return entry;
     }
-    cacheControlFor(ctx, filePath) {
+    cacheControlFor(ctx, relativePath) {
         const cacheOption = this.options.cacheControl;
         if (typeof cacheOption === "function")
-            return cacheOption(ctx, filePath);
+            return cacheOption(ctx, relativePath);
         const immutablePattern = this.options.immutablePattern === false
             ? null
             : (this.options.immutablePattern ?? DEFAULT_IMMUTABLE_PATTERN);
-        if (immutablePattern && immutablePattern.test(filePath)) {
+        if (immutablePattern && immutablePattern.test(relativePath)) {
             return this.options.immutableCacheControl ?? DEFAULT_IMMUTABLE_CACHE_CONTROL;
         }
         return cacheOption ?? DEFAULT_CACHE_CONTROL;

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import Lambder from './core/Lambder.js';
 export default Lambder;
 export { initLambder } from './core/Lambder.js';
 export { default as LambderCaller } from "./client/LambderCaller.js";
-export type { LambderApiOutcome, LambderApiFailureReason, LambderCallOptions, LambderIdempotencyKeyScope } from "./client/LambderCaller.js";
+export type { LambderApiOutcome, LambderApiFailureReason, LambderCallOptions, LambderCallerOptions, LambderGuardInputsProvider, LambderProvidedGuardInputs, LambderIdempotencyKeyScope } from "./client/LambderCaller.js";
 export { LambderApiError, isLambderApiError, refuse, LAMBDER_REFUSAL_CODES } from "./shared/LambderApiError.js";
 export type { LambderApiErrorOptions, LambderRefusalMessage, LambderRefusalCode, LambderRefuseOptions } from "./shared/LambderApiError.js";
 export { default as LambderResponseBuilder } from "./core/LambderResponseBuilder.js";
@@ -15,8 +15,10 @@ export { LambderTemplatingEngine } from "./core/LambderTemplatingEngine.js";
 export type { LambderTemplateData, LambderTemplatingEngineOptions } from "./core/LambderTemplatingEngine.js";
 export type { LambderResponseOptions, LambderRawResponseInit, } from "./core/LambderResponseBuilder.js";
 export type { LambderRouteMatcher, LambderCorsConfig, LambderCreateOptions, LambderSessionOptions, ConditionFunction, RouteCondition, PathParamsOf, LambderActionTools, LambderHandler, LambderIndexHtmlOptions, } from "./core/Lambder.js";
-export { LambderPublicFilesHandler } from "./core/LambderPublicFiles.js";
-export type { LambderPublicFilesOptions } from "./core/LambderPublicFiles.js";
+export { LambderPublicFilesHandler, LambderLocalFileSource } from "./core/LambderPublicFiles.js";
+export type { LambderPublicFilesOptions, LambderPublicFileSource, LambderPublicFile } from "./core/LambderPublicFiles.js";
+export { LambderS3FileSource } from "./stores/LambderS3FileSource.js";
+export type { LambderS3FileSourceOptions } from "./stores/LambderS3FileSource.js";
 export type { LambderSessionCookieOptions } from "./session/LambderSessionController.js";
 export type { LambderSessionContext, LambderCreatedSession, LambderSessionDataRefreshConfig } from "./session/LambderSessionManager.js";
 export type { LambderCompressionOption, LambderCompressionConfig } from "./stores/LambderDdbCompression.js";

package/dist/index.js

@@ -15,7 +15,8 @@ export { html, xml, raw, jsonScript, escapeHtml, renderHtmlValue, LambderSafeHtm
 // Comment-based HTML templating engine (build-pipeline-safe slots and conditionals, standalone)
 export { LambderTemplatingEngine } from "./core/LambderTemplatingEngine.js";
 // Public file serving
-export { LambderPublicFilesHandler } from "./core/LambderPublicFiles.js";
+export { LambderPublicFilesHandler, LambderLocalFileSource } from "./core/LambderPublicFiles.js";
+export { LambderS3FileSource } from "./stores/LambderS3FileSource.js";
 export { LambderSessionDataRefreshError, LambderSessionReadError } from "./session/LambderSessionManager.js";
 // DynamoDB-backed compressed cache (standalone, server-only)
 export { LambderDdbCache } from "./stores/LambderDdbCache.js";

package/dist/session/LambderSessionController.d.ts

@@ -49,6 +49,13 @@ export default class LambderSessionController<TSessionData = any> {
      * session and touches no cookies, so it works on any subject.
      */
     deleteSessionAllByKey(sessionKey: string): Promise<void>;
+    /**
+     * Marks the data of every session of the given sessionKey stale, so each
+     * renews via dataRefresh on its next read: the way to apply a change to
+     * a subject's roles or permissions immediately, without logging them
+     * out. Needs no fetched session; requires dataRefresh.
+     */
+    expireSessionDataAllByKey(sessionKey: string): Promise<void>;
     endSession(): Promise<void>;
     endSessionAll(): Promise<void>;
 }

package/dist/session/LambderSessionController.js

@@ -151,6 +151,16 @@ export default class LambderSessionController {
         await this.lambderSessionManager.deleteSessionAllByKey(sessionKey);
     }
     ;
+    /**
+     * Marks the data of every session of the given sessionKey stale, so each
+     * renews via dataRefresh on its next read: the way to apply a change to
+     * a subject's roles or permissions immediately, without logging them
+     * out. Needs no fetched session; requires dataRefresh.
+     */
+    async expireSessionDataAllByKey(sessionKey) {
+        await this.lambderSessionManager.expireSessionDataAllByKey(sessionKey);
+    }
+    ;
     async endSession() {
         if (!this.ctx.session)
             throw new Error("Session not found.");

package/dist/session/LambderSessionManager.d.ts

@@ -111,6 +111,7 @@ export default class LambderSessionManager {
      */
     private ddbPutItem;
     private ddbDeleteItem;
+    /** Sort keys of every session under a partition (the callers only need the keys). */
     private ddbQueryAllByPartitionKey;
     private ddbDeleteAllByPartitionKey;
     createSession(sessionKey: string, data?: any, ttlInSeconds?: number, options?: {
@@ -135,5 +136,15 @@ export default class LambderSessionManager {
      * session record.
      */
     deleteSessionAllByKey(sessionKey: string): Promise<boolean>;
+    /**
+     * Marks the data of every session of the given sessionKey stale, so each
+     * renews via dataRefresh on its next read: "this subject's roles or
+     * permissions changed, apply it now", without logging the subject out
+     * (deleteSessionAllByKey) and without waiting for the data TTL. Stamps
+     * dataExpiresAt only, conditionally on the record still existing, so it
+     * neither resurrects a session deleted in between nor overwrites a
+     * concurrent write. Requires dataRefresh to be configured.
+     */
+    expireSessionDataAllByKey(sessionKey: string): Promise<boolean>;
     regenerateSession(session: LambderSessionContext): Promise<LambderCreatedSession>;
 }

package/dist/session/LambderSessionManager.js

@@ -1,6 +1,6 @@
 import crypto from "crypto";
 import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
-import { DynamoDBDocumentClient, QueryCommand, DeleteCommand, PutCommand, GetCommand } from "@aws-sdk/lib-dynamodb";
+import { DynamoDBDocumentClient, QueryCommand, DeleteCommand, PutCommand, GetCommand, UpdateCommand } from "@aws-sdk/lib-dynamodb";
 import { brotliCompressText, brotliRestoreText, resolveCompressionOption, } from "../stores/LambderDdbCompression.js";
 /**
  * Session compression defaults: every record compressed (see
@@ -108,11 +108,13 @@ export default class LambderSessionManager {
         return await this.ddbDocumentClient.send(new DeleteCommand({ TableName: this.tableName, Key: key, }));
     }
     ;
+    /** Sort keys of every session under a partition (the callers only need the keys). */
     async ddbQueryAllByPartitionKey(partitionValue) {
         const params = {
             TableName: this.tableName,
             KeyConditionExpression: "#pk = :pv",
-            ExpressionAttributeNames: { "#pk": this.partitionKey },
+            ProjectionExpression: "#sk",
+            ExpressionAttributeNames: { "#pk": this.partitionKey, "#sk": this.sortKey },
             ExpressionAttributeValues: { ":pv": partitionValue },
         };
         const queryResults = [];
@@ -341,6 +343,40 @@ export default class LambderSessionManager {
         return true;
     }
     ;
+    /**
+     * Marks the data of every session of the given sessionKey stale, so each
+     * renews via dataRefresh on its next read: "this subject's roles or
+     * permissions changed, apply it now", without logging the subject out
+     * (deleteSessionAllByKey) and without waiting for the data TTL. Stamps
+     * dataExpiresAt only, conditionally on the record still existing, so it
+     * neither resurrects a session deleted in between nor overwrites a
+     * concurrent write. Requires dataRefresh to be configured.
+     */
+    async expireSessionDataAllByKey(sessionKey) {
+        if (!this.dataRefresh)
+            throw new Error("dataRefresh is not configured. Pass session.dataRefresh at creation to enable.");
+        const partitionValue = this.sessionUserKeyHasher(sessionKey);
+        const now = Math.floor(Date.now() / 1000);
+        for (const item of await this.ddbQueryAllByPartitionKey(partitionValue)) {
+            try {
+                await this.ddbDocumentClient.send(new UpdateCommand({
+                    TableName: this.tableName,
+                    Key: { [this.partitionKey]: partitionValue, [this.sortKey]: item[this.sortKey] },
+                    UpdateExpression: "SET #dataExpiresAt = :now",
+                    ConditionExpression: "attribute_exists(#sk)",
+                    ExpressionAttributeNames: { "#dataExpiresAt": "dataExpiresAt", "#sk": this.sortKey },
+                    ExpressionAttributeValues: { ":now": now },
+                }));
+            }
+            catch (err) {
+                // Deleted between the query and the update: nothing left to expire.
+                if (err.name !== "ConditionalCheckFailedException")
+                    throw err;
+            }
+        }
+        return true;
+    }
+    ;
     async regenerateSession(session) {
         if (!session)
             throw new Error("Invalid session");

package/dist/stores/LambderS3FileSource.d.ts

@@ -0,0 +1,35 @@
+import type { S3Client, S3ClientConfig } from "@aws-sdk/client-s3";
+import type { LambderPublicFile, LambderPublicFileSource } from "../core/LambderPublicFiles.js";
+export type LambderS3FileSourceOptions = {
+    bucket: string;
+    /** Literal key prefix the relative path is appended to, so include the trailing slash: "web/v42/". Default: none. */
+    prefix?: string;
+    /** A ready client, e.g. one shared with the rest of the app. */
+    client?: S3Client;
+    /**
+     * Otherwise the client is created from this on first read: `{ region }`
+     * for S3; for Cloudflare R2 or another S3-compatible store,
+     * `{ region: "auto", endpoint, credentials }`.
+     */
+    clientConfig?: S3ClientConfig;
+};
+/**
+ * Files from an S3 bucket, or any S3-compatible store such as Cloudflare
+ * R2 (pass its endpoint in clientConfig). Needs @aws-sdk/client-s3, an
+ * optional peer dependency loaded on first read, so apps that serve from a
+ * folder never load it. A missing object reads as null and the request
+ * falls through; grant s3:ListBucket besides s3:GetObject, otherwise S3
+ * answers a missing key with AccessDenied, which propagates as an error.
+ * An object's Content-Type is used unless it is a generic octet-stream, in
+ * which case the extension decides, as for local files.
+ */
+export declare class LambderS3FileSource implements LambderPublicFileSource {
+    private readonly bucket;
+    private readonly prefix;
+    private readonly clientConfig;
+    private client;
+    private sdk;
+    constructor({ bucket, prefix, client, clientConfig }: LambderS3FileSourceOptions);
+    private loadSdk;
+    read(relativePath: string): Promise<LambderPublicFile | null>;
+}

package/dist/stores/LambderS3FileSource.js

@@ -0,0 +1,53 @@
+/**
+ * Files from an S3 bucket, or any S3-compatible store such as Cloudflare
+ * R2 (pass its endpoint in clientConfig). Needs @aws-sdk/client-s3, an
+ * optional peer dependency loaded on first read, so apps that serve from a
+ * folder never load it. A missing object reads as null and the request
+ * falls through; grant s3:ListBucket besides s3:GetObject, otherwise S3
+ * answers a missing key with AccessDenied, which propagates as an error.
+ * An object's Content-Type is used unless it is a generic octet-stream, in
+ * which case the extension decides, as for local files.
+ */
+export class LambderS3FileSource {
+    bucket;
+    prefix;
+    clientConfig;
+    client;
+    sdk;
+    constructor({ bucket, prefix = "", client, clientConfig }) {
+        if (!bucket.trim())
+            throw new Error("bucket is required");
+        this.bucket = bucket;
+        this.prefix = prefix;
+        this.client = client;
+        this.clientConfig = clientConfig;
+    }
+    loadSdk() {
+        if (!this.sdk) {
+            this.sdk = import("@aws-sdk/client-s3").catch(() => {
+                throw new Error("LambderS3FileSource requires @aws-sdk/client-s3: npm install @aws-sdk/client-s3");
+            });
+        }
+        return this.sdk;
+    }
+    async read(relativePath) {
+        const { S3Client, GetObjectCommand } = await this.loadSdk();
+        if (!this.client)
+            this.client = new S3Client(this.clientConfig ?? {});
+        let output;
+        try {
+            output = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: `${this.prefix}${relativePath}` }));
+        }
+        catch (err) {
+            const name = err.name;
+            if (name === "NoSuchKey" || name === "NotFound")
+                return null;
+            throw err;
+        }
+        if (!output.Body)
+            return null;
+        const body = Buffer.from(await output.Body.transformToByteArray());
+        const contentType = output.ContentType;
+        return contentType && !contentType.endsWith("octet-stream") ? { body, mimeType: contentType } : { body };
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "4.3.2",
+  "version": "4.4.1",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -61,6 +61,7 @@
     "zod": "^4.1.12"
   },
   "peerDependencies": {
+    "@aws-sdk/client-s3": "^3.574.0",
     "msw": "^2.0.0"
   },
   "peerDependenciesMeta": {
@@ -69,6 +70,7 @@
     }
   },
   "devDependencies": {
+    "@aws-sdk/client-s3": "^3.1127.0",
     "@types/aws-lambda": "^8.10.136",
     "@types/cookie": "^0.6.0",
     "@types/js-cookie": "^3.0.6",