lambder 5.0.0 → 5.1.2

package/README.md

@@ -53,8 +53,9 @@ const company = await caller.api("getCompany", { slug: "acme" });
   cookies, and a guard against Lambda's response size cap.
 - **Hooks and actions.** Lifecycle hooks, plus `addAction()` for the non-HTTP
   invocations (EventBridge, SQS, custom events) the same function receives.
-- **Frontend hosting.** Serve a build from a folder, S3 or R2, with an app
-  shell rendered through a build-pipeline-safe template engine.
+- **Frontend hosting.** Serve a build from a folder, S3, R2 or any HTTP
+  origin, with an app shell rendered through a build-pipeline-safe template
+  engine.
 - **Runs anywhere Lambda does.** API Gateway REST APIs (payload v1), HTTP APIs
   (payload v2) and Lambda Function URLs; the payload format is detected per
   event.

package/dist/core/LambderFiles.d.ts

@@ -9,9 +9,10 @@ export type LambderFile = {
  * servePublicFiles, serveIndexHtml, res.file and res.templateFile alike,
  * through the instance's one reader (LambderFiles). Implement `read` over
  * any backing store: LambderLocalFileSource (a folder), LambderS3FileSource
- * (S3, or R2 and other S3-compatible stores), or your own. The reader does
- * the rest for every source: traversal check, memory cache, mime fallback
- * from the extension.
+ * (S3, or R2 and other S3-compatible stores), LambderHttpFileSource (any
+ * origin serving files by path), or your own. The reader does the rest for
+ * every source: traversal check, memory cache, mime fallback from the
+ * extension.
  */
 export interface LambderFileSource {
     /**
@@ -48,6 +49,12 @@ export declare class LambderLocalFileSource implements LambderFileSource {
     });
     read(relativePath: string): Promise<LambderFile | null>;
 }
+/**
+ * A file a remote store returned: the store's Content-Type unless it is a
+ * generic octet-stream, in which case the extension decides, as for local
+ * files.
+ */
+export declare const remoteStoreFile: (body: Buffer, contentType: string | null | undefined) => LambderFile;
 /**
  * The path a source is asked for: leading slash stripped, traversal
  * rejected; null for a path that names no file (empty, or a directory).

package/dist/core/LambderFiles.js

@@ -27,6 +27,12 @@ export class LambderLocalFileSource {
         return { body: await fs.promises.readFile(absolute) };
     }
 }
+/**
+ * A file a remote store returned: the store's Content-Type unless it is a
+ * generic octet-stream, in which case the extension decides, as for local
+ * files.
+ */
+export const remoteStoreFile = (body, contentType) => contentType && !contentType.endsWith("octet-stream") ? { body, mimeType: contentType } : { body };
 /**
  * The path a source is asked for: leading slash stripped, traversal
  * rejected; null for a path that names no file (empty, or a directory).

package/dist/index.d.ts

@@ -21,6 +21,8 @@ export { LambderFiles, LambderLocalFileSource } from "./core/LambderFiles.js";
 export type { LambderFileSource, LambderFile, LambderFilesOption, LambderFileMemoryCacheOption, LambderReadFile } from "./core/LambderFiles.js";
 export { LambderS3FileSource } from "./stores/LambderS3FileSource.js";
 export type { LambderS3FileSourceOptions } from "./stores/LambderS3FileSource.js";
+export { LambderHttpFileSource } from "./stores/LambderHttpFileSource.js";
+export type { LambderHttpFileSourceOptions } from "./stores/LambderHttpFileSource.js";
 export type { LambderSessionCookieOptions } from "./session/LambderSessionController.js";
 export type { LambderSessionContext, LambderCreatedSession, LambderSessionDataRefreshConfig } from "./session/LambderSessionManager.js";
 export { resolveCompressionOption, LAMBDER_ENCODINGS } from "./shared/LambderCompressionOption.js";

package/dist/index.js

@@ -18,6 +18,7 @@ export { LambderTemplatingEngine } from "./core/LambderTemplatingEngine.js";
 export { LambderPublicFilesHandler } from "./core/LambderPublicFiles.js";
 export { LambderFiles, LambderLocalFileSource } from "./core/LambderFiles.js";
 export { LambderS3FileSource } from "./stores/LambderS3FileSource.js";
+export { LambderHttpFileSource } from "./stores/LambderHttpFileSource.js";
 // Compression: the option every site shares, and the one codec behind them all.
 export { resolveCompressionOption, LAMBDER_ENCODINGS } from "./shared/LambderCompressionOption.js";
 // Brotli/gzip plus the bounded, length-verified restore every compressed

package/dist/stores/LambderHttpFileSource.d.ts

@@ -0,0 +1,31 @@
+import { type LambderFile, type LambderFileSource } from "../core/LambderFiles.js";
+export type LambderHttpFileSourceOptions = {
+    /**
+     * The folder URL relative paths resolve under: "https://assets.example.com/v42/".
+     * It names a folder, so a missing trailing slash is added.
+     */
+    baseUrl: string;
+    /** Sent with every read, e.g. an Authorization header for a private origin or a User-Agent a firewall allows. */
+    headers?: Record<string, string>;
+    /** How long one read may take before it fails. Default: 10000. */
+    timeoutMs?: number;
+};
+/**
+ * Files over HTTP(S) from any origin that serves them by path: a CDN, a
+ * public bucket's own domain (a Cloudflare R2 custom domain, an S3 website
+ * endpoint) or another server. Reads with the runtime's fetch, so it needs
+ * no SDK, and no credentials for a public origin; reads come out of the
+ * origin's edge cache. Each path segment is percent-encoded, so a relative
+ * path names the same object it would as an S3 key. A 404 or 410 reads as
+ * null and the request falls through; any other failed status, a network
+ * error or a timeout propagates as an error. The response's Content-Type is
+ * used unless it is a generic octet-stream, in which case the extension
+ * decides, as for local files.
+ */
+export declare class LambderHttpFileSource implements LambderFileSource {
+    private readonly baseUrl;
+    private readonly headers;
+    private readonly timeoutMs;
+    constructor({ baseUrl, headers, timeoutMs }: LambderHttpFileSourceOptions);
+    read(relativePath: string): Promise<LambderFile | null>;
+}

package/dist/stores/LambderHttpFileSource.js

@@ -0,0 +1,46 @@
+import { remoteStoreFile } from "../core/LambderFiles.js";
+const DEFAULT_TIMEOUT_MS = 10_000;
+/**
+ * Files over HTTP(S) from any origin that serves them by path: a CDN, a
+ * public bucket's own domain (a Cloudflare R2 custom domain, an S3 website
+ * endpoint) or another server. Reads with the runtime's fetch, so it needs
+ * no SDK, and no credentials for a public origin; reads come out of the
+ * origin's edge cache. Each path segment is percent-encoded, so a relative
+ * path names the same object it would as an S3 key. A 404 or 410 reads as
+ * null and the request falls through; any other failed status, a network
+ * error or a timeout propagates as an error. The response's Content-Type is
+ * used unless it is a generic octet-stream, in which case the extension
+ * decides, as for local files.
+ */
+export class LambderHttpFileSource {
+    baseUrl;
+    headers;
+    timeoutMs;
+    constructor({ baseUrl, headers = {}, timeoutMs = DEFAULT_TIMEOUT_MS }) {
+        let url;
+        try {
+            url = new URL(baseUrl);
+        }
+        catch {
+            throw new Error(`baseUrl must be an absolute http(s) URL: ${baseUrl}`);
+        }
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            throw new Error(`baseUrl must be an absolute http(s) URL: ${baseUrl}`);
+        if (!url.pathname.endsWith("/"))
+            url.pathname += "/";
+        this.baseUrl = url;
+        this.headers = headers;
+        this.timeoutMs = timeoutMs;
+    }
+    async read(relativePath) {
+        const url = new URL(relativePath.split("/").map(encodeURIComponent).join("/"), this.baseUrl);
+        const response = await fetch(url, { headers: this.headers, signal: AbortSignal.timeout(this.timeoutMs) });
+        if (!response.ok) {
+            await response.body?.cancel();
+            if (response.status === 404 || response.status === 410)
+                return null;
+            throw new Error(`LambderHttpFileSource: ${response.status} ${response.statusText} reading ${url}`);
+        }
+        return remoteStoreFile(Buffer.from(await response.arrayBuffer()), response.headers.get("content-type"));
+    }
+}

package/dist/stores/LambderS3FileSource.d.ts

@@ -1,5 +1,5 @@
 import type { S3Client, S3ClientConfig } from "@aws-sdk/client-s3";
-import type { LambderFile, LambderFileSource } from "../core/LambderFiles.js";
+import { type LambderFile, type LambderFileSource } from "../core/LambderFiles.js";
 export type LambderS3FileSourceOptions = {
     bucket: string;
     /** Literal key prefix the relative path is appended to, so include the trailing slash: "web/v42/". Default: none. */

package/dist/stores/LambderS3FileSource.js

@@ -1,3 +1,4 @@
+import { remoteStoreFile } from "../core/LambderFiles.js";
 /**
  * Files from an S3 bucket, or any S3-compatible store such as Cloudflare
  * R2 (pass its endpoint in clientConfig). Needs @aws-sdk/client-s3, an
@@ -46,8 +47,6 @@ export class LambderS3FileSource {
         }
         if (!output.Body)
             return null;
-        const body = Buffer.from(await output.Body.transformToByteArray());
-        const contentType = output.ContentType;
-        return contentType && !contentType.endsWith("octet-stream") ? { body, mimeType: contentType } : { body };
+        return remoteStoreFile(Buffer.from(await output.Body.transformToByteArray()), output.ContentType);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "5.0.0",
+  "version": "5.1.2",
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [
     "lambda",