lambder 6.0.1 → 7.0.1

package/dist/mock/LambderMockBrowserCookies.d.ts

@@ -0,0 +1,55 @@
+import { type LambderCookieJar } from "../shared/transport/LambderCookieJar.js";
+/**
+ * Where the runtime's cookies live outside its own answers: the jars it built
+ * for itself, and the copies it planted in the page's own cookie storage.
+ *
+ * The fourth of LambderMockApp's collaborators, and the same argument as the
+ * other three: it owns state nothing else touches and meets the runtime at two
+ * calls (a transport's answer coming back, and reset()). It is the piece with
+ * an outside dependency, `document`, so keeping it here is also what keeps the
+ * app free of browser conditionals.
+ *
+ * Both the direct transport's "document" mode and the MSW adapter come through
+ * one instance, so there is one mirror implementation and one record of what
+ * was planted. They carried a copy each before: the MSW copy dropped `Secure`
+ * on a page that is not a secure context and the transport's did not, so on
+ * plain http (device testing on a LAN address) the browser silently refused
+ * the CSRF cookie and every session call failed its CSRF check with nothing in
+ * any log to say why.
+ */
+export declare class LambderMockBrowserCookies {
+    /** The jars transport() and the adapters built for themselves, which reset() is therefore free to empty. */
+    private readonly ownedJars;
+    /** What was mirrored into document.cookie, so reset() can expire exactly those. */
+    private readonly mirroredCookies;
+    /**
+     * Takes a jar built for the runtime as the runtime's own, so reset()
+     * empties it with the rest. A jar the app passed in stays the app's, the
+     * way an app-supplied session store does: the runtime did not create it and
+     * does not know what else holds it.
+     */
+    adoptJar(jar: LambderCookieJar): void;
+    /**
+     * Mirrors an answer's non-HttpOnly cookies into document.cookie and
+     * remembers them for reset().
+     *
+     * HttpOnly cookies are skipped exactly as a real browser skips them, the
+     * jar being the store no script can reach. `Secure` is dropped where the
+     * page is not a secure context, because the browser would refuse the write
+     * and development over plain http on a LAN address has to keep working. A
+     * `__Host-` or `__Secure-` cookie name is then discarded by the browser
+     * for breaking its own prefix rule, which is correct: such a name cannot
+     * work on plain http at all, and localhost is a secure context.
+     */
+    mirrorSetCookies(setCookies: readonly string[]): void;
+    /**
+     * Empties the jars the runtime owns and expires what it mirrored, which is
+     * what clearing the page's cookie storage would do.
+     *
+     * As much a part of a rewind as the session store is: emptying the store
+     * while a jar still holds the token for one of its sessions leaves the next
+     * call carrying a session that no longer exists, which reads as signed in
+     * until the answer says sessionExpired.
+     */
+    reset(): void;
+}

package/dist/mock/LambderMockBrowserCookies.js

@@ -0,0 +1,76 @@
+import { parseSetCookie } from "../shared/transport/LambderCookieJar.js";
+/**
+ * Where the runtime's cookies live outside its own answers: the jars it built
+ * for itself, and the copies it planted in the page's own cookie storage.
+ *
+ * The fourth of LambderMockApp's collaborators, and the same argument as the
+ * other three: it owns state nothing else touches and meets the runtime at two
+ * calls (a transport's answer coming back, and reset()). It is the piece with
+ * an outside dependency, `document`, so keeping it here is also what keeps the
+ * app free of browser conditionals.
+ *
+ * Both the direct transport's "document" mode and the MSW adapter come through
+ * one instance, so there is one mirror implementation and one record of what
+ * was planted. They carried a copy each before: the MSW copy dropped `Secure`
+ * on a page that is not a secure context and the transport's did not, so on
+ * plain http (device testing on a LAN address) the browser silently refused
+ * the CSRF cookie and every session call failed its CSRF check with nothing in
+ * any log to say why.
+ */
+export class LambderMockBrowserCookies {
+    /** The jars transport() and the adapters built for themselves, which reset() is therefore free to empty. */
+    ownedJars = new Set();
+    /** What was mirrored into document.cookie, so reset() can expire exactly those. */
+    mirroredCookies = new Map();
+    /**
+     * Takes a jar built for the runtime as the runtime's own, so reset()
+     * empties it with the rest. A jar the app passed in stays the app's, the
+     * way an app-supplied session store does: the runtime did not create it and
+     * does not know what else holds it.
+     */
+    adoptJar(jar) {
+        this.ownedJars.add(jar);
+    }
+    /**
+     * Mirrors an answer's non-HttpOnly cookies into document.cookie and
+     * remembers them for reset().
+     *
+     * HttpOnly cookies are skipped exactly as a real browser skips them, the
+     * jar being the store no script can reach. `Secure` is dropped where the
+     * page is not a secure context, because the browser would refuse the write
+     * and development over plain http on a LAN address has to keep working. A
+     * `__Host-` or `__Secure-` cookie name is then discarded by the browser
+     * for breaking its own prefix rule, which is correct: such a name cannot
+     * work on plain http at all, and localhost is a secure context.
+     */
+    mirrorSetCookies(setCookies) {
+        if (typeof document === "undefined")
+            return;
+        const secureContext = typeof globalThis.isSecureContext === "boolean" ? globalThis.isSecureContext : true;
+        for (const header of setCookies) {
+            const cookie = parseSetCookie(header, Date.now());
+            if (!cookie || cookie.httpOnly)
+                continue;
+            document.cookie = secureContext ? header : header.replace(/;\s*Secure\b/i, "");
+            this.mirroredCookies.set(`${cookie.name}|${cookie.path}`, { name: cookie.name, path: cookie.path });
+        }
+    }
+    /**
+     * Empties the jars the runtime owns and expires what it mirrored, which is
+     * what clearing the page's cookie storage would do.
+     *
+     * As much a part of a rewind as the session store is: emptying the store
+     * while a jar still holds the token for one of its sessions leaves the next
+     * call carrying a session that no longer exists, which reads as signed in
+     * until the answer says sessionExpired.
+     */
+    reset() {
+        for (const jar of this.ownedJars)
+            jar.clear();
+        if (typeof document !== "undefined") {
+            for (const cookie of this.mirroredCookies.values())
+                document.cookie = `${cookie.name}=; Path=${cookie.path}; Max-Age=0`;
+        }
+        this.mirroredCookies.clear();
+    }
+}

package/dist/mock/LambderMockCallRecorder.d.ts

@@ -0,0 +1,85 @@
+import type { LambderApiAnswer } from "../api/LambderApiAnswer.js";
+import type { LambderApiMode } from "../shared/wire/LambderApiContract.js";
+import type { LambderMockCallEvent, LambderMockCallRecord, LambderMockListener, LambderMockOutcome } from "./LambderMockTypes.js";
+/** What every record of one call repeats: who called what, and when it started. */
+export type LambderMockCallFacts = {
+    id: number;
+    apiName: string;
+    /** The endpoint's mode from the registry; null for a name the registry does not know. */
+    mode: LambderApiMode | null;
+    /** When the call started, which is what its duration is measured from. */
+    startedAt: number;
+    /**
+     * The call's request, read when the call settles rather than copied when it
+     * starts. The pipeline rewrites the payload as the call goes: a compressed
+     * one is restored before anything reads it, and an endpoint with an input
+     * schema replaces it with the parsed value. Copied up front, the log kept
+     * the wire fields, so the compressed calls a developer opens a panel for
+     * were the ones logged as `undefined`.
+     */
+    request: {
+        payload: unknown;
+        guardInputs: Record<string, unknown> | undefined;
+    };
+};
+/** How a call ended, as the runtime saw it happen. */
+type LambderMockCallEnding = {
+    /** The answer the caller receives; null when there is none: a rejected transport, or a passthrough. */
+    answer: LambderApiAnswer | null;
+    /** The outcome where the runtime already knows it (injected, replayed, passthrough); read off the answer otherwise, and required when there is no answer to read. */
+    outcome?: LambderMockOutcome;
+    guardsRun: readonly string[];
+    /** The crash, or the transport failure. */
+    error?: Error;
+};
+/**
+ * What the runtime lets someone watch: the keyed subscriptions every call is
+ * emitted to, and the bounded log of completed calls.
+ *
+ * One of the four pieces of state LambderMockApp holds that nothing else
+ * touches.
+ * `subscribe` and `calls` stay on the app as one-line delegations, because
+ * they are the surface a dev panel reads.
+ *
+ * Ending a call is `settle`, one call for the whole of it: classification,
+ * redaction, the event and the log row. A record literal built at each of the
+ * three exits instead would drift between them, which is exactly what a log
+ * is read to rule out.
+ *
+ * `calls` hands out copies down to the values, so a reader that sorts
+ * guardsRun or deletes a header is not editing what the next reader sees, and
+ * the caller is free to edit what it got. The Error is the exception, passed
+ * by reference: a clone of it would no longer be the class a test asserts on,
+ * and an Error carries nothing worth protecting.
+ */
+export declare class LambderMockCallRecorder {
+    private readonly listeners;
+    /** Listeners that threw, skipped until they subscribe again or the runtime resets. */
+    private readonly mutedListeners;
+    private readonly callLog;
+    private readonly callLogSize;
+    private callSequence;
+    constructor(options: {
+        callLogSize: number;
+    });
+    /** The id of the next call, which numbers its request and response events alike. */
+    nextCallId(): number;
+    subscribe(key: string, listener: LambderMockListener): () => void;
+    /** The completed calls, oldest first, bounded by callLogSize. */
+    get calls(): readonly LambderMockCallRecord[];
+    emit(event: LambderMockCallEvent): void;
+    /**
+     * Ends one call: reads how it went, redacts what a log has no business
+     * keeping, and emits the response event and the log row from one object,
+     * so the two cannot say different things about the same call.
+     *
+     * The event and the row carry copies of their own, so a listener that
+     * edits the event it was handed is not editing the row the log keeps; the
+     * row is copied again on the way in and on the way out.
+     */
+    settle(facts: LambderMockCallFacts, ending: LambderMockCallEnding): void;
+    private push;
+    /** Empties the log and its numbering, and unmutes listeners; the subscriptions themselves survive. */
+    reset(): void;
+}
+export {};

package/dist/mock/LambderMockCallRecorder.js

@@ -0,0 +1,183 @@
+import { LAMBDER_REFUSAL_CODES } from "../shared/wire/LambderApiRefusal.js";
+/**
+ * Set-Cookie values are redacted in the log: the name stays so a reader can
+ * see that a session cookie was written, the value goes, because a live
+ * session token in a panel a developer renders and a test snapshots is no
+ * place to keep it.
+ */
+const loggedHeaders = (headers) => {
+    const copy = {};
+    for (const [key, values] of Object.entries(headers)) {
+        copy[key] = key.toLowerCase() === "set-cookie"
+            ? values.map((header) => header.replace(/^([^=;]+)=[^;]*/, "$1=[redacted]"))
+            : [...values];
+    }
+    return copy;
+};
+/**
+ * A logged value copied, so a reader that reaches into a record cannot edit
+ * what the next reader sees. structuredClone is the platform's deep copy and
+ * everything logged arrived as JSON; a value it refuses (a function on the
+ * payload of a hand-built request) is handed over as it is rather than
+ * failing the read.
+ */
+const cloneLoggedValue = (value) => {
+    if (value === null || typeof value !== "object")
+        return value;
+    try {
+        return structuredClone(value);
+    }
+    catch {
+        return value;
+    }
+};
+/** The envelope an answer carries, when it carries one. */
+const envelopeOf = (answer) => {
+    if (answer.isBodyBase64)
+        return null;
+    try {
+        const parsed = JSON.parse(answer.body);
+        return parsed !== null && typeof parsed === "object" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+};
+/** How an answer reads, in the runtime's vocabulary. */
+const classifyAnswer = (answer, envelope) => {
+    if (answer.statusCode >= 500)
+        return "crash";
+    if (answer.statusCode === 422)
+        return "validation";
+    if (!envelope)
+        return "ok";
+    if (envelope.versionExpired)
+        return "versionExpired";
+    if (envelope.sessionExpired)
+        return "sessionExpired";
+    if (envelope.notAuthorized)
+        return "notAuthorized";
+    const code = envelope.errorMessage?.code;
+    if (code === LAMBDER_REFUSAL_CODES.rateLimited)
+        return "rateLimited";
+    if (code === LAMBDER_REFUSAL_CODES.notMocked)
+        return "notMocked";
+    if (code === LAMBDER_REFUSAL_CODES.apiNotFound)
+        return "unknownApi";
+    if (envelope.errorMessage)
+        return "refusal";
+    return "ok";
+};
+/**
+ * What the runtime lets someone watch: the keyed subscriptions every call is
+ * emitted to, and the bounded log of completed calls.
+ *
+ * One of the four pieces of state LambderMockApp holds that nothing else
+ * touches.
+ * `subscribe` and `calls` stay on the app as one-line delegations, because
+ * they are the surface a dev panel reads.
+ *
+ * Ending a call is `settle`, one call for the whole of it: classification,
+ * redaction, the event and the log row. A record literal built at each of the
+ * three exits instead would drift between them, which is exactly what a log
+ * is read to rule out.
+ *
+ * `calls` hands out copies down to the values, so a reader that sorts
+ * guardsRun or deletes a header is not editing what the next reader sees, and
+ * the caller is free to edit what it got. The Error is the exception, passed
+ * by reference: a clone of it would no longer be the class a test asserts on,
+ * and an Error carries nothing worth protecting.
+ */
+export class LambderMockCallRecorder {
+    listeners = new Map();
+    /** Listeners that threw, skipped until they subscribe again or the runtime resets. */
+    mutedListeners = new Set();
+    callLog = [];
+    callLogSize;
+    callSequence = 0;
+    constructor(options) {
+        this.callLogSize = options.callLogSize;
+    }
+    /** The id of the next call, which numbers its request and response events alike. */
+    nextCallId() { return ++this.callSequence; }
+    subscribe(key, listener) {
+        this.listeners.set(key, listener);
+        // Subscribing again is how a muted listener comes back: a hot reload
+        // replaces the broken panel with the fixed one under the same key.
+        this.mutedListeners.delete(key);
+        return () => { if (this.listeners.get(key) === listener)
+            this.listeners.delete(key); };
+    }
+    /** The completed calls, oldest first, bounded by callLogSize. */
+    get calls() {
+        return this.callLog.map((record) => ({
+            ...record,
+            headers: cloneLoggedValue(record.headers),
+            guardsRun: [...record.guardsRun],
+            envelope: cloneLoggedValue(record.envelope),
+            payload: cloneLoggedValue(record.payload),
+            guardInputs: cloneLoggedValue(record.guardInputs),
+        }));
+    }
+    emit(event) {
+        for (const [key, listener] of this.listeners) {
+            if (this.mutedListeners.has(key))
+                continue;
+            try {
+                listener(event);
+            }
+            catch (err) {
+                // Muted, not merely reported once: a listener that throws on
+                // one event throws on the next, so leaving it in the loop
+                // costs every remaining call a thrown error and a swallowed
+                // one, for a listener that is already known to be broken.
+                this.mutedListeners.add(key);
+                console.error(`[lambder mock] listener "${key}" threw and is muted until it subscribes again or the mock is reset`, err);
+            }
+        }
+    }
+    /**
+     * Ends one call: reads how it went, redacts what a log has no business
+     * keeping, and emits the response event and the log row from one object,
+     * so the two cannot say different things about the same call.
+     *
+     * The event and the row carry copies of their own, so a listener that
+     * edits the event it was handed is not editing the row the log keeps; the
+     * row is copied again on the way in and on the way out.
+     */
+    settle(facts, ending) {
+        const answer = ending.answer;
+        const envelope = answer ? envelopeOf(answer) : null;
+        const settledAt = Date.now();
+        const event = {
+            phase: "response",
+            id: facts.id, apiName: facts.apiName, mode: facts.mode,
+            durationMs: settledAt - facts.startedAt,
+            statusCode: answer?.statusCode ?? null,
+            headers: answer ? loggedHeaders(answer.headers) : {},
+            envelope,
+            outcome: ending.outcome ?? (answer ? classifyAnswer(answer, envelope) : "crash"),
+            guardsRun: [...ending.guardsRun],
+            ...(ending.error ? { error: ending.error } : {}),
+            at: settledAt,
+        };
+        this.emit(event);
+        this.push({ ...event, guardsRun: [...ending.guardsRun], payload: facts.request.payload, guardInputs: facts.request.guardInputs });
+    }
+    push(record) {
+        this.callLog.push({
+            ...record,
+            headers: cloneLoggedValue(record.headers),
+            envelope: cloneLoggedValue(record.envelope),
+            guardsRun: [...record.guardsRun],
+        });
+        if (this.callLog.length > this.callLogSize)
+            this.callLog.splice(0, this.callLog.length - this.callLogSize);
+    }
+    /** Empties the log and its numbering, and unmutes listeners; the subscriptions themselves survive. */
+    reset() {
+        this.callLog.length = 0;
+        this.callSequence = 0;
+        this.mutedListeners.clear();
+    }
+}

package/dist/mock/LambderMockCreateOptions.d.ts

@@ -0,0 +1,161 @@
+import type { LambderContractGuardNames } from "../shared/wire/LambderApiContract.js";
+import type { LambderApiGuard } from "../api/LambderApiGuards.js";
+import type { LambderApiRateLimitPolicyConfig } from "../api/LambderApiRateLimits.js";
+import type { LambderApiRequest } from "../api/LambderApiRequest.js";
+import type { LambderApiTransport } from "../shared/transport/LambderApiTransport.js";
+import type { LambderCookieJar } from "../shared/transport/LambderCookieJar.js";
+import type { LambderIdempotencyStore } from "../shared/contracts/LambderIdempotencyStore.js";
+import type { LambderRateLimiter } from "../shared/contracts/LambderRateLimiter.js";
+import type { LambderSessionStore } from "../shared/contracts/LambderSessionStore.js";
+import type { LambderSessionDataRefreshConfig } from "../session/LambderSessionManager.js";
+import type { LambderSessionCookieOptions } from "../session/LambderSessionController.js";
+import type { LambderSessionCrypto } from "../session/LambderSessionCrypto.js";
+import type { LambderMockCallContext, LambderMockGuards, LambderMockLatency, LambderMockRateLimitPolicies, LambderMockSessionCallContext, LambderMockSurplusKeys } from "./LambderMockTypes.js";
+export type LambderMockSessionsOptions<S> = {
+    /** Where the mock's sessions rest. Default: a fresh LambderMemorySessionStore. */
+    store?: LambderSessionStore<S>;
+    /** Default: "lambder-mock". */
+    sessionSalt?: string;
+    /** TTL of sessions signIn() creates, in seconds. Default: 30 days. */
+    ttlSeconds?: number;
+    /** Hashing and randomness. Default: WebCrypto where the runtime offers it, the plain stand-in over a memory-only store otherwise. */
+    crypto?: LambderSessionCrypto;
+    dataRefresh?: LambderSessionDataRefreshConfig<S>;
+    enableSlidingExpiration?: boolean;
+    slidingWriteIntervalSeconds?: number;
+    tokenCookieKey?: string;
+    csrfCookieKey?: string;
+    cookieOptions?: LambderSessionCookieOptions;
+};
+/**
+ * Idempotency in the mock: the same engine the server runs, over a memory
+ * store unless one is given, and carrying every knob the server's own option
+ * carries.
+ *
+ * `callerIdentity` and `defaultPendingTtlSeconds` are here because a mock
+ * that cannot express them answers differently from the server on exactly the
+ * calls idempotency exists for: without an identity a public endpoint's stored
+ * answer replays to whoever presents the key, so a mock replayed where the
+ * server, configured with one, misses.
+ */
+export type LambderMockIdempotencyOptions<S = any> = {
+    /** Seconds a stored answer replays for. Default: 86400 (24h). Per-endpoint override: `idempotency: { ttlSeconds }`. */
+    defaultTtlSeconds?: number;
+    /** Seconds a claim stays pending before a retry may take the scope. Default: 300. Per-endpoint override: `idempotency: { pendingTtlSeconds }`. */
+    defaultPendingTtlSeconds?: number;
+    /** Run the handler when the store errors, instead of failing the call. Default: true. */
+    failOpen?: boolean;
+    /** Where replay records rest. Default: a fresh LambderMemoryIdempotencyStore. */
+    store?: LambderIdempotencyStore;
+    /**
+     * Who a call is acting as, for scoping a PUBLIC endpoint's stored answer;
+     * session endpoints already scope per session. The server's option word
+     * for word (see LambderApiIdempotencyConfig), bound to the mock's own call
+     * context, because that is the context the engine hands it here.
+     *
+     * Without the session, as on the server: this runs on public endpoints
+     * alone, where the session is always null, so offering it would be
+     * offering a field that answers nothing.
+     */
+    callerIdentity?: (ctx: Omit<LambderMockCallContext<S>, "session">, request: LambderApiRequest) => string | null | Promise<string | null>;
+};
+/**
+ * The rate limits option: the policies endpoints may restate, the limiter
+ * they are counted on, and what happens when that limiter throws.
+ *
+ * `failOpen` is the server's own option (see LambderApiRateLimitsConfig) and
+ * is here for the reason the idempotency option's twin is: with a limiter of
+ * the app's own that fails, a mock that cannot express it always lets the
+ * call through, so it answers 200 where a server configured to refuse answers
+ * 429.
+ */
+type LambderMockRateLimitsOptions<S, P extends LambderMockRateLimitPolicies<S>> = {
+    policies: P & {
+        [N in keyof P]: LambderMockSurplusKeys<P[N], LambderApiRateLimitPolicyConfig<LambderMockCallContext<S>>>;
+    };
+    /** Where attempts are counted. Default: a fresh LambderMemoryRateLimiter. */
+    limiter?: LambderRateLimiter;
+    /** Let a call through when the limiter throws, instead of refusing it. Default: true. */
+    failOpen?: boolean;
+};
+/**
+ * The guards option: required whenever the contract declares any guard name,
+ * omittable only for a contract that declares none.
+ *
+ * The same reasoning the entry's own guards field carries: a guard the mock
+ * does not declare cannot run, and a call the server answers notAuthorized
+ * then answers 200 here. Optional, it was the droppable half of exactly the
+ * check it exists for.
+ */
+type LambderMockGuardsOption<C, S, G> = [
+    LambderContractGuardNames<C>
+] extends [never] ? {
+    guards?: G & LambderMockGuards<C, S> & LambderMockGuardShapes<S, G>;
+} : {
+    guards: G & LambderMockGuards<C, S> & LambderMockGuardShapes<S, G>;
+};
+/** Each guard checked for surplus keys, so `sesion: true` on an inline guard is an error at the key rather than a guard that silently runs as public. */
+type LambderMockGuardShapes<S, G> = {
+    [N in keyof G]: LambderMockSurplusKeys<G[N], LambderApiGuard<any, any, any, LambderMockCallContext<S>, LambderMockSessionCallContext<S>>>;
+};
+export type LambderMockAppOptions<C, S, G, P extends LambderMockRateLimitPolicies<S> = LambderMockRateLimitPolicies<S>, I extends boolean | LambderMockIdempotencyOptions<S> = boolean | LambderMockIdempotencyOptions<S>> = LambderMockGuardsOption<C, S, G> & {
+    /** Enables the version gate: a call naming another version answers versionExpired, exactly as the server would. */
+    apiVersion?: string;
+    /** Artificial latency per call; off by default. */
+    latency?: LambderMockLatency;
+    /** Sessions over the memory store: `true` for the defaults, or the options. Off by default: session endpoints then fail at registration. */
+    sessions?: boolean | LambderMockSessionsOptions<S>;
+    /** The rate-limit policies endpoints may restate, over a memory limiter unless one is given. Off by default. */
+    rateLimits?: LambderMockRateLimitsOptions<S, P>;
+    /** Idempotency over a memory store: `true` for the defaults, or the options. Off by default. */
+    idempotency?: I & LambderMockSurplusKeys<I, LambderMockIdempotencyOptions<S>>;
+    /**
+     * The host the runtime's cookies belong to: what signIn plants them
+     * under, what the direct transport's jar scopes them by, what the MSW
+     * adapter's jar scopes them by, and what a transport request naming no
+     * siteHost is read as arriving at. Default: the page's own host, or
+     * "localhost" outside a browser.
+     *
+     * One host per app, because a jar checks a cookie's scope the way a
+     * browser does: planted at "localhost" and read back on
+     * "transit.localhost:5173", the session cookie is simply not sent, and
+     * every session call in a browser served from anything but plain
+     * localhost answered sessionExpired.
+     */
+    cookieHost?: string;
+    /** Ceiling on what a compressed request payload may restore to. Default: 20,000,000. */
+    maxRequestPayloadBytes?: number;
+    /**
+     * The client IP a transport request carrying none is read as. Default:
+     * the loopback address. A transport may name its own, which is how a test
+     * drives a `per: "ip"` rate limit from two clients.
+     */
+    defaultClientIp?: string;
+    /** How many completed calls `calls` keeps. Default: 200. */
+    callLogSize?: number;
+    /**
+     * Answer a handler that threw with the message it threw, rather than the
+     * server's "Internal server error." Default: true, because a mock runtime
+     * is a development tool and the thrown message is the thing worth seeing.
+     * Set false to get the production shape.
+     */
+    revealHandlerErrors?: boolean;
+    /** Called at the end of reset(), so the app can rewind its own data. */
+    onReset?: () => void;
+};
+/** How the mock transport carries cookies: a fresh memory jar (default), a jar of yours, the memory jar mirrored into document.cookie, or none. */
+export type LambderMockTransportOptions = {
+    cookies?: LambderCookieJar | "memory" | "document" | false;
+    /** The client IP its calls arrive from; defaults to the app's defaultClientIp. One transport is one client. */
+    clientIp?: string;
+};
+/**
+ * The mock's transport with the jar it carries hanging off it: an ordinary
+ * LambderApiTransport wherever one is expected, and reachable where a test
+ * needs the jar transport() built for itself (to read a cookie, or to clear
+ * it). Null when the transport carries no cookies.
+ */
+export type LambderMockTransport = LambderApiTransport & {
+    readonly cookieJar: LambderCookieJar | null;
+};
+export {};

package/dist/mock/LambderMockCreateOptions.js

@@ -0,0 +1,9 @@
+/*
+ * What a mock runtime is configured with, and the shapes of what a mock
+ * transport takes.
+ *
+ * Everything create() takes lives here, beside the rules that decide which
+ * keys it accepts (the guards option and the surplus-key checks under it),
+ * exactly as core/LambderCreateOptions.ts holds the server's.
+ */
+export {};

package/dist/mock/LambderMockEntryRegistry.d.ts

@@ -0,0 +1,52 @@
+import type { LambderMockEntry, LambderMockOverride, LambderMockRestEntry } from "./LambderMockTypes.js";
+/**
+ * Which mock answers an endpoint: the registered entries, and the overrides
+ * standing over them.
+ *
+ * One of the four pieces of state LambderMockApp holds that nothing else
+ * touches; it meets the rest of the runtime at one call, the lookup a request
+ * makes. The app keeps the whole caller-facing surface (register,
+ * registerPartial, override, restoreOverrides, registeredNames) as
+ * delegations, because that surface is contract-typed and the checks that
+ * make it safe are compile-time; what lives here is the bookkeeping.
+ *
+ * Generic over the contract only so the entries keep their type through the
+ * map; the registry itself never reads one.
+ */
+export declare class LambderMockEntryRegistry<C> {
+    private readonly entries;
+    /**
+     * The overrides standing over one endpoint, innermost last. A stack
+     * rather than one slot because overrides nest: an override a describe
+     * scopes and one an it scopes are both live, and restoring the inner one
+     * has to uncover the outer rather than the registry.
+     */
+    private readonly overrideStacks;
+    /** The reason register() was given a rest entry with; null while it was given none. */
+    private restReason;
+    /**
+     * What a call to an endpoint no slice registered is refused with, or null
+     * when no rest entry was registered. A registration like any other, so
+     * reset() keeps it.
+     */
+    get restNotMockedReason(): string | null;
+    /**
+     * Adds every entry of every slice, and the rest entry where one is among
+     * them. Slices are staged and committed together, so a slice that fails a
+     * check leaves nothing behind: a caller that catches the error and retries
+     * sees the problem it is fixing rather than a duplicate-name error from
+     * its own first attempt. The rest entry is staged with them, for the same
+     * reason.
+     */
+    addSlices(slices: readonly (Record<string, LambderMockEntry<C, any>> | LambderMockRestEntry)[]): void;
+    /** The registered entry for a name, before any override; null when there is none. */
+    registered(apiName: string): LambderMockEntry<C, any> | null;
+    /** Stacks an override over a registered entry and hands back its removal. */
+    pushOverride(name: string, entry: LambderMockEntry<C, any>): LambderMockOverride;
+    /** Puts every overridden handler back, however deeply they were stacked. */
+    restoreOverrides(): void;
+    /** The registered endpoint names. */
+    get names(): string[];
+    /** What answers this call: the innermost override, else the registered entry. */
+    entryFor(apiName: string): LambderMockEntry<C, any> | null;
+}