lambder 5.0.0 → 5.1.3

package/README.md

@@ -53,8 +53,9 @@ const company = await caller.api("getCompany", { slug: "acme" });
   cookies, and a guard against Lambda's response size cap.
 - **Hooks and actions.** Lifecycle hooks, plus `addAction()` for the non-HTTP
   invocations (EventBridge, SQS, custom events) the same function receives.
-- **Frontend hosting.** Serve a build from a folder, S3 or R2, with an app
-  shell rendered through a build-pipeline-safe template engine.
+- **Frontend hosting.** Serve a build from a folder, S3, R2 or any HTTP
+  origin, with an app shell rendered through a build-pipeline-safe template
+  engine.
 - **Runs anywhere Lambda does.** API Gateway REST APIs (payload v1), HTTP APIs
   (payload v2) and Lambda Function URLs; the payload format is detected per
   event.

package/dist/core/Lambder.d.ts

@@ -297,7 +297,7 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
     addSessionRoute<TPath extends Path>(condition: TPath, actionFn: (ctx: LambderSessionRenderContext<any, TSessionData, PathParamsOf<TPath>>, resolver: LambderResolver) => MaybePromise<LambderResponse>): this;
     addSessionRoute(condition: RegExp | ConditionFunction | LambderRouteMatcher, actionFn: SessionActionFunction<TSessionData>): this;
     use<_TNewContract extends Record<string, any>>(plugin: (lambder: Lambder<TSessionData, _TContract, any, any, any, any, any>) => Lambder<TSessionData, _TNewContract, any, any, any, any, any>): Lambder<TSessionData, _TNewContract extends _TContract ? _TNewContract : (_TContract & _TNewContract), _TRateLimitPolicies, _TGuards, _TIdempotencyEnabled, _TSessionGuardsRequired, _TPublicGuardsRequired>;
-    addApi<TName extends string, TInput extends z.ZodTypeAny, TOutput extends z.ZodTypeAny, const TRateOpt extends LambderRateLimitOption<_TRateLimitPolicies, z.infer<TInput>, false> = never, const TGuardsOpt extends LambderGuardsOption<_TGuards, z.infer<TInput>, false> = never>(name: TName, schema: {
+    addApi<TName extends string, TInput extends z.ZodType, TOutput extends z.ZodType, const TRateOpt extends LambderRateLimitOption<_TRateLimitPolicies, z.infer<TInput>, false> = never, const TGuardsOpt extends LambderGuardsOption<_TGuards, z.infer<TInput>, false> = never>(name: TName, schema: {
         input: TInput;
         output: TOutput;
     } & {
@@ -308,7 +308,7 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
             ttlSeconds?: number;
         }) : never;
     } & LambderRequirableGuardsField<_TPublicGuardsRequired, TGuardsOpt>, handler: (ctx: LambderRenderContext<z.infer<TInput>, Record<string, string>, LambderGuardDataOf<_TGuards, TGuardsOpt>>, resolver: LambderResolver<z.infer<TOutput>>) => MaybePromise<LambderResponse>): Lambder<TSessionData, MergeContract<_TContract, TName, z.infer<TInput>, z.infer<TOutput>, LambderGuardInputsOf<_TGuards, TGuardsOpt>, TGuardsOpt>, _TRateLimitPolicies, _TGuards, _TIdempotencyEnabled, _TSessionGuardsRequired, _TPublicGuardsRequired>;
-    addSessionApi<TName extends string, TInput extends z.ZodTypeAny, TOutput extends z.ZodTypeAny, const TRateOpt extends LambderRateLimitOption<_TRateLimitPolicies, z.infer<TInput>, true> = never, const TGuardsOpt extends LambderGuardsOption<_TGuards, z.infer<TInput>, true> = never>(name: TName, schema: {
+    addSessionApi<TName extends string, TInput extends z.ZodType, TOutput extends z.ZodType, const TRateOpt extends LambderRateLimitOption<_TRateLimitPolicies, z.infer<TInput>, true> = never, const TGuardsOpt extends LambderGuardsOption<_TGuards, z.infer<TInput>, true> = never>(name: TName, schema: {
         input: TInput;
         output: TOutput;
     } & {

package/dist/core/LambderFiles.d.ts

@@ -9,9 +9,10 @@ export type LambderFile = {
  * servePublicFiles, serveIndexHtml, res.file and res.templateFile alike,
  * through the instance's one reader (LambderFiles). Implement `read` over
  * any backing store: LambderLocalFileSource (a folder), LambderS3FileSource
- * (S3, or R2 and other S3-compatible stores), or your own. The reader does
- * the rest for every source: traversal check, memory cache, mime fallback
- * from the extension.
+ * (S3, or R2 and other S3-compatible stores), LambderHttpFileSource (any
+ * origin serving files by path), or your own. The reader does the rest for
+ * every source: traversal check, memory cache, mime fallback from the
+ * extension.
  */
 export interface LambderFileSource {
     /**
@@ -48,6 +49,12 @@ export declare class LambderLocalFileSource implements LambderFileSource {
     });
     read(relativePath: string): Promise<LambderFile | null>;
 }
+/**
+ * A file a remote store returned: the store's Content-Type unless it is a
+ * generic octet-stream, in which case the extension decides, as for local
+ * files.
+ */
+export declare const remoteStoreFile: (body: Buffer, contentType: string | null | undefined) => LambderFile;
 /**
  * The path a source is asked for: leading slash stripped, traversal
  * rejected; null for a path that names no file (empty, or a directory).

package/dist/core/LambderFiles.js

@@ -27,6 +27,12 @@ export class LambderLocalFileSource {
         return { body: await fs.promises.readFile(absolute) };
     }
 }
+/**
+ * A file a remote store returned: the store's Content-Type unless it is a
+ * generic octet-stream, in which case the extension decides, as for local
+ * files.
+ */
+export const remoteStoreFile = (body, contentType) => contentType && !contentType.endsWith("octet-stream") ? { body, mimeType: contentType } : { body };
 /**
  * The path a source is asked for: leading slash stripped, traversal
  * rejected; null for a path that names no file (empty, or a directory).

package/dist/index.d.ts

@@ -21,6 +21,8 @@ export { LambderFiles, LambderLocalFileSource } from "./core/LambderFiles.js";
 export type { LambderFileSource, LambderFile, LambderFilesOption, LambderFileMemoryCacheOption, LambderReadFile } from "./core/LambderFiles.js";
 export { LambderS3FileSource } from "./stores/LambderS3FileSource.js";
 export type { LambderS3FileSourceOptions } from "./stores/LambderS3FileSource.js";
+export { LambderHttpFileSource } from "./stores/LambderHttpFileSource.js";
+export type { LambderHttpFileSourceOptions } from "./stores/LambderHttpFileSource.js";
 export type { LambderSessionCookieOptions } from "./session/LambderSessionController.js";
 export type { LambderSessionContext, LambderCreatedSession, LambderSessionDataRefreshConfig } from "./session/LambderSessionManager.js";
 export { resolveCompressionOption, LAMBDER_ENCODINGS } from "./shared/LambderCompressionOption.js";

package/dist/index.js

@@ -18,6 +18,7 @@ export { LambderTemplatingEngine } from "./core/LambderTemplatingEngine.js";
 export { LambderPublicFilesHandler } from "./core/LambderPublicFiles.js";
 export { LambderFiles, LambderLocalFileSource } from "./core/LambderFiles.js";
 export { LambderS3FileSource } from "./stores/LambderS3FileSource.js";
+export { LambderHttpFileSource } from "./stores/LambderHttpFileSource.js";
 // Compression: the option every site shares, and the one codec behind them all.
 export { resolveCompressionOption, LAMBDER_ENCODINGS } from "./shared/LambderCompressionOption.js";
 // Brotli/gzip plus the bounded, length-verified restore every compressed

package/dist/policies/LambderApiGuards.d.ts

@@ -36,7 +36,7 @@ import type { LambderResponse } from "../core/LambderResponse.js";
  * and the handler refuses by throwing (typically refuse()/LambderApiError).
  * Build with lambderGuard() so the handler's payload/ctx/param types line up.
  */
-export type LambderApiGuard<TInput extends z.ZodTypeAny = z.ZodTypeAny, TParam = any, TOutput = any> = {
+export type LambderApiGuard<TInput extends z.ZodType = z.ZodType, TParam = any, TOutput = any> = {
     apiInput: TInput;
     guardInput?: undefined;
     session?: boolean;
@@ -61,7 +61,7 @@ type GuardSessionCtx = LambderSessionRenderContext<any, any>;
  * inferred from the handler's 4th argument annotation; the output from its
  * return type.
  */
-export declare function lambderGuard<TInput extends z.ZodTypeAny, TParam = undefined, TOutput = void>(guard: {
+export declare function lambderGuard<TInput extends z.ZodType, TParam = undefined, TOutput = void>(guard: {
     apiInput: TInput;
     session: true;
     handler: (ctx: GuardSessionCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
@@ -71,7 +71,7 @@ export declare function lambderGuard<TInput extends z.ZodTypeAny, TParam = undef
     session: true;
     handler: (ctx: GuardSessionCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
 };
-export declare function lambderGuard<TInput extends z.ZodTypeAny, TParam = undefined, TOutput = void>(guard: {
+export declare function lambderGuard<TInput extends z.ZodType, TParam = undefined, TOutput = void>(guard: {
     apiInput: TInput;
     handler: (ctx: GuardCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
 }): {
@@ -80,7 +80,7 @@ export declare function lambderGuard<TInput extends z.ZodTypeAny, TParam = undef
     session?: undefined;
     handler: (ctx: GuardCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
 };
-export declare function lambderGuard<TInput extends z.ZodTypeAny, TParam = undefined, TOutput = void>(guard: {
+export declare function lambderGuard<TInput extends z.ZodType, TParam = undefined, TOutput = void>(guard: {
     guardInput: TInput;
     session: true;
     handler: (ctx: GuardSessionCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
@@ -90,7 +90,7 @@ export declare function lambderGuard<TInput extends z.ZodTypeAny, TParam = undef
     session: true;
     handler: (ctx: GuardSessionCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
 };
-export declare function lambderGuard<TInput extends z.ZodTypeAny, TParam = undefined, TOutput = void>(guard: {
+export declare function lambderGuard<TInput extends z.ZodType, TParam = undefined, TOutput = void>(guard: {
     guardInput: TInput;
     handler: (ctx: GuardCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
 }): {
@@ -126,11 +126,11 @@ type LambderGuardOutputOf<G> = G extends {
 } ? Awaited<R> : never;
 /** Per-guard metadata carried on the Lambder instance: input mode, session requirement, param type, output type. */
 export type LambderGuardMeta<G> = (G extends {
-    apiInput: infer S extends z.ZodTypeAny;
+    apiInput: infer S extends z.ZodType;
 } ? {
     apiInput: z.output<S>;
 } : G extends {
-    guardInput: infer S extends z.ZodTypeAny;
+    guardInput: infer S extends z.ZodType;
 } ? {
     guardInput: z.output<S>;
 } : {}) & (G extends {
@@ -237,7 +237,7 @@ export type LambderInputValidationRefusal = (ctx: LambderRenderContext, resolver
  * same one regular input validation answers. Shared with the rate-limit
  * engine's apiInput-keyed policies.
  */
-export declare const parsePreflightSlice: (input: z.ZodTypeAny, value: unknown, ctx: LambderRenderContext, resolver: LambderResolver, onInvalid: LambderInputValidationRefusal) => Promise<unknown>;
+export declare const parsePreflightSlice: (input: z.ZodType, value: unknown, ctx: LambderRenderContext, resolver: LambderResolver, onInvalid: LambderInputValidationRefusal) => Promise<unknown>;
 /**
  * Runtime side of the guards subsystem: holds the defined guards, asserts
  * API registrations against them at startup, and executes an API's declared

package/dist/policies/LambderApiRateLimits.d.ts

@@ -14,7 +14,7 @@ import { type LambderInputValidationRefusal } from "./LambderApiGuards.js";
  * stays the single owner of the field. Build with lambderRateLimitKey() so
  * the handler's payload type follows `apiInput`.
  */
-export type LambderRateLimitKeyFn<TInput extends z.ZodTypeAny = z.ZodTypeAny> = {
+export type LambderRateLimitKeyFn<TInput extends z.ZodType = z.ZodType> = {
     apiInput: TInput;
     handler: (ctx: LambderRenderContext, payload: z.output<TInput>) => string | Promise<string>;
 } | {
@@ -26,7 +26,7 @@ export type LambderRateLimitKeyFn<TInput extends z.ZodTypeAny = z.ZodTypeAny> =
  * inside one literal. Returns the exact union member so type extraction can
  * see the schema.
  */
-export declare function lambderRateLimitKey<TInput extends z.ZodTypeAny>(key: {
+export declare function lambderRateLimitKey<TInput extends z.ZodType>(key: {
     apiInput: TInput;
     handler: (ctx: LambderRenderContext, payload: z.output<TInput>) => string | Promise<string>;
 }): {
@@ -78,7 +78,7 @@ export type LambderAllowedPolicyNames<TPolicies, TPayload, TIncludeSession exten
         per: "session";
     } ? (TIncludeSession extends true ? K : never) : TPolicies[K] extends {
         per: {
-            apiInput: infer S extends z.ZodTypeAny;
+            apiInput: infer S extends z.ZodType;
         };
     } ? (TPayload extends z.output<S> ? K : never) : K;
 }[keyof TPolicies] & string;

package/dist/stores/LambderHttpFileSource.d.ts

@@ -0,0 +1,31 @@
+import { type LambderFile, type LambderFileSource } from "../core/LambderFiles.js";
+export type LambderHttpFileSourceOptions = {
+    /**
+     * The folder URL relative paths resolve under: "https://assets.example.com/v42/".
+     * It names a folder, so a missing trailing slash is added.
+     */
+    baseUrl: string;
+    /** Sent with every read, e.g. an Authorization header for a private origin or a User-Agent a firewall allows. */
+    headers?: Record<string, string>;
+    /** How long one read may take before it fails. Default: 10000. */
+    timeoutMs?: number;
+};
+/**
+ * Files over HTTP(S) from any origin that serves them by path: a CDN, a
+ * public bucket's own domain (a Cloudflare R2 custom domain, an S3 website
+ * endpoint) or another server. Reads with the runtime's fetch, so it needs
+ * no SDK, and no credentials for a public origin; reads come out of the
+ * origin's edge cache. Each path segment is percent-encoded, so a relative
+ * path names the same object it would as an S3 key. A 404 or 410 reads as
+ * null and the request falls through; any other failed status, a network
+ * error or a timeout propagates as an error. The response's Content-Type is
+ * used unless it is a generic octet-stream, in which case the extension
+ * decides, as for local files.
+ */
+export declare class LambderHttpFileSource implements LambderFileSource {
+    private readonly baseUrl;
+    private readonly headers;
+    private readonly timeoutMs;
+    constructor({ baseUrl, headers, timeoutMs }: LambderHttpFileSourceOptions);
+    read(relativePath: string): Promise<LambderFile | null>;
+}

package/dist/stores/LambderHttpFileSource.js

@@ -0,0 +1,46 @@
+import { remoteStoreFile } from "../core/LambderFiles.js";
+const DEFAULT_TIMEOUT_MS = 10_000;
+/**
+ * Files over HTTP(S) from any origin that serves them by path: a CDN, a
+ * public bucket's own domain (a Cloudflare R2 custom domain, an S3 website
+ * endpoint) or another server. Reads with the runtime's fetch, so it needs
+ * no SDK, and no credentials for a public origin; reads come out of the
+ * origin's edge cache. Each path segment is percent-encoded, so a relative
+ * path names the same object it would as an S3 key. A 404 or 410 reads as
+ * null and the request falls through; any other failed status, a network
+ * error or a timeout propagates as an error. The response's Content-Type is
+ * used unless it is a generic octet-stream, in which case the extension
+ * decides, as for local files.
+ */
+export class LambderHttpFileSource {
+    baseUrl;
+    headers;
+    timeoutMs;
+    constructor({ baseUrl, headers = {}, timeoutMs = DEFAULT_TIMEOUT_MS }) {
+        let url;
+        try {
+            url = new URL(baseUrl);
+        }
+        catch {
+            throw new Error(`baseUrl must be an absolute http(s) URL: ${baseUrl}`);
+        }
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            throw new Error(`baseUrl must be an absolute http(s) URL: ${baseUrl}`);
+        if (!url.pathname.endsWith("/"))
+            url.pathname += "/";
+        this.baseUrl = url;
+        this.headers = headers;
+        this.timeoutMs = timeoutMs;
+    }
+    async read(relativePath) {
+        const url = new URL(relativePath.split("/").map(encodeURIComponent).join("/"), this.baseUrl);
+        const response = await fetch(url, { headers: this.headers, signal: AbortSignal.timeout(this.timeoutMs) });
+        if (!response.ok) {
+            await response.body?.cancel();
+            if (response.status === 404 || response.status === 410)
+                return null;
+            throw new Error(`LambderHttpFileSource: ${response.status} ${response.statusText} reading ${url}`);
+        }
+        return remoteStoreFile(Buffer.from(await response.arrayBuffer()), response.headers.get("content-type"));
+    }
+}

package/dist/stores/LambderS3FileSource.d.ts

@@ -1,5 +1,5 @@
 import type { S3Client, S3ClientConfig } from "@aws-sdk/client-s3";
-import type { LambderFile, LambderFileSource } from "../core/LambderFiles.js";
+import { type LambderFile, type LambderFileSource } from "../core/LambderFiles.js";
 export type LambderS3FileSourceOptions = {
     bucket: string;
     /** Literal key prefix the relative path is appended to, so include the trailing slash: "web/v42/". Default: none. */

package/dist/stores/LambderS3FileSource.js

@@ -1,3 +1,4 @@
+import { remoteStoreFile } from "../core/LambderFiles.js";
 /**
  * Files from an S3 bucket, or any S3-compatible store such as Cloudflare
  * R2 (pass its endpoint in clientConfig). Needs @aws-sdk/client-s3, an
@@ -46,8 +47,6 @@ export class LambderS3FileSource {
         }
         if (!output.Body)
             return null;
-        const body = Buffer.from(await output.Body.transformToByteArray());
-        const contentType = output.ContentType;
-        return contentType && !contentType.endsWith("octet-stream") ? { body, mimeType: contentType } : { body };
+        return remoteStoreFile(Buffer.from(await output.Body.transformToByteArray()), output.ContentType);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "5.0.0",
+  "version": "5.1.3",
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [
     "lambda",
@@ -90,7 +90,7 @@
     "@aws-sdk/client-s3": "^3.574.0",
     "@aws-sdk/lib-dynamodb": "^3.574.0",
     "msw": "^2.0.0",
-    "zod": "^4.1.12"
+    "zod": "^4.6.2"
   },
   "peerDependenciesMeta": {
     "@aws-sdk/client-dynamodb": {
@@ -125,6 +125,6 @@
     "eslint": "^8.57.0",
     "typescript": "^5.9.3",
     "vitest": "^3.2.4",
-    "zod": "^4.1.12"
+    "zod": "^4.6.2"
   }
 }