lambder 6.0.1 → 7.0.1

package/dist/client/LambderMSW.js

@@ -1,121 +0,0 @@
-import { COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BYTES_FIELD, decompressPayloadGzip } from '../shared/LambderRequestPayload.js';
-export default class LambderMSW {
-    apiPath;
-    apiVersion;
-    http;
-    HttpResponse;
-    constructor({ apiPath, apiVersion, msw, }) {
-        this.apiPath = apiPath;
-        this.apiVersion = apiVersion;
-        if (!msw?.http || !msw?.HttpResponse) {
-            throw new Error('LambderMSW requires the msw module: new LambderMSW({ apiPath, msw: await import("msw") }). Install it with: npm install msw --save-dev');
-        }
-        this.http = msw.http;
-        this.HttpResponse = msw.HttpResponse;
-    }
-    /**
-     * Mock an API endpoint with MSW
-     * @param apiName - The name of the API to mock
-     * @param handler - Function that returns the mock payload
-     * @param options - Additional response options (session expired, version expired, etc.)
-     *
-     * Note: TypeScript will check that the return type is assignable to the output type,
-     * but due to structural typing, extra properties are allowed. Enable strict checks
-     * in your tsconfig.json with "noUncheckedIndexedAccess" and "exactOptionalPropertyTypes"
-     * for better type safety.
-     */
-    mockApi(apiName, handler, options) {
-        return this.http.post(this.apiPath, async ({ request }) => {
-            let body;
-            try {
-                const clonedRequest = request.clone();
-                body = await clonedRequest.json();
-            }
-            catch (parseErr) {
-                // If JSON parsing fails, return undefined to let other handlers try
-                console.warn("LambderMSW: Failed to parse request body as JSON");
-                return;
-            }
-            // Check if body is valid and has apiName
-            if (!body || typeof body.apiName !== 'string') {
-                return;
-            }
-            if (body.apiName !== apiName) {
-                return;
-            }
-            // A caller with requestCompression on sends the payload gzipped;
-            // mock handlers still receive the payload itself, and the wire
-            // fields are consumed the way the server consumes them.
-            if (typeof body[COMPRESSED_PAYLOAD_GZ_FIELD] === 'string') {
-                try {
-                    body.payload = await decompressPayloadGzip(body[COMPRESSED_PAYLOAD_GZ_FIELD]);
-                }
-                catch {
-                    console.warn("LambderMSW: Failed to decompress the request payload");
-                    return;
-                }
-                delete body[COMPRESSED_PAYLOAD_GZ_FIELD];
-                delete body[COMPRESSED_PAYLOAD_BYTES_FIELD];
-            }
-            try {
-                // Add artificial delay if specified
-                if (options?.delay) {
-                    await new Promise(resolve => setTimeout(resolve, options.delay));
-                }
-                // Call the handler with the payload from the request
-                const payload = await handler(body.payload);
-                const response = {
-                    apiVersion: this.apiVersion,
-                    payload,
-                    ...(options?.versionExpired ? { versionExpired: options.versionExpired } : {}),
-                    ...(options?.sessionExpired ? { sessionExpired: options.sessionExpired } : {}),
-                    ...(options?.notAuthorized ? { notAuthorized: options.notAuthorized } : {}),
-                    ...(options?.message ? { message: options.message } : {}),
-                    ...(options?.errorMessage ? { errorMessage: options.errorMessage } : {}),
-                    ...(options?.logList?.length ? { logList: options.logList } : {}),
-                };
-                return this.HttpResponse.json(response);
-            }
-            catch (err) {
-                // Only handle errors that occur during handler execution for matched APIs
-                console.error("Error in LambderMSW handler for", apiName, ":", err);
-                const errorResponse = {
-                    apiVersion: this.apiVersion,
-                    payload: null,
-                    errorMessage: err.message || "Unknown error",
-                };
-                return this.HttpResponse.json(errorResponse, { status: 500 });
-            }
-        });
-    }
-    /**
-     * Mock an API endpoint that returns a session expired error
-     */
-    mockSessionExpired(apiName) {
-        return this.mockApi(apiName, async () => null, { sessionExpired: true });
-    }
-    /**
-     * Mock an API endpoint that returns a version expired error
-     */
-    mockVersionExpired(apiName) {
-        return this.mockApi(apiName, async () => null, { versionExpired: true });
-    }
-    /**
-     * Mock an API endpoint that returns a not authorized error
-     */
-    mockNotAuthorized(apiName) {
-        return this.mockApi(apiName, async () => null, { notAuthorized: true });
-    }
-    /**
-     * Mock an API endpoint that returns an error message
-     */
-    mockError(apiName, errorMessage) {
-        return this.mockApi(apiName, async () => null, { errorMessage });
-    }
-    /**
-     * Mock an API endpoint with a custom message
-     */
-    mockWithMessage(apiName, handler, message) {
-        return this.mockApi(apiName, handler, { message });
-    }
-}

package/dist/policies/LambderApiGuards.d.ts

@@ -1,256 +0,0 @@
-import type { z } from "zod";
-import type { LambderRenderContext, LambderSessionRenderContext } from "../core/LambderContext.js";
-import type LambderResolver from "../core/LambderResolver.js";
-import type { LambderResponse } from "../core/LambderResponse.js";
-/**
- * A named guard, run before the API's own input validation. Three input
- * modes:
- *
- * - `apiInput`: the guard checks fields of the API's OWN payload. The slice
- *   is validated against the raw payload before `handler` runs and handed to
- *   it typed. The API's input schema stays the owner of those fields:
- *   declaring the guard on an API whose schema does not carry them is a
- *   compile error.
- * - `guardInput`: the guard has its own value the client sends SEPARATELY,
- *   outside the API payload, via the caller's options.guardInputs[name].
- *   The requirement lands on the API's contract (`guardInputs`), so the
- *   typed caller refuses to compile a call that does not send it. The API
- *   payload and handler never see the value.
- * - neither: the guard reads only the context.
- *
- * Orthogonally, a guard may also:
- *
- * - declare `session: true`: the guard needs ctx.session, so it is only
- *   declarable on addSessionApi (compile error and startup assert on public
- *   APIs) and its handler receives the session-typed context.
- * - take a PARAMETER: annotate a 4th handler argument
- *   (`(ctx, payload, res, param: YourType) => ...`) and APIs pass the value
- *   in their declaration: `guards: { yourGuard: paramValue }`. The value is
- *   trusted registration-time code (never client data), typed per guard.
- * - RETURN a value: whatever the handler returns (awaited) is attached to
- *   the API handler's context as `ctx.guardData[guardName]`, fully typed.
- *   Guards that return nothing never appear in guardData.
- *
- * A validation failure answers like the API's own input validation (the
- * app's setApiInputValidationErrorHandler when set, else the standard 422),
- * and the handler refuses by throwing (typically refuse()/LambderApiError).
- * Build with lambderGuard() so the handler's payload/ctx/param types line up.
- */
-export type LambderApiGuard<TInput extends z.ZodType = z.ZodType, TParam = any, TOutput = any> = {
-    apiInput: TInput;
-    guardInput?: undefined;
-    session?: boolean;
-    handler: (ctx: any, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-} | {
-    guardInput: TInput;
-    apiInput?: undefined;
-    session?: boolean;
-    handler: (ctx: any, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-} | {
-    apiInput?: undefined;
-    guardInput?: undefined;
-    session?: boolean;
-    handler: (ctx: any, payload: undefined, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-};
-type GuardCtx = LambderRenderContext;
-type GuardSessionCtx = LambderSessionRenderContext<any, any>;
-/**
- * Builder that ties the handler's payload, context, param, and output types
- * together inside one literal. Returns the exact shape so type extraction
- * (mode, session, param, output) works downstream. The param type is
- * inferred from the handler's 4th argument annotation; the output from its
- * return type.
- */
-export declare function lambderGuard<TInput extends z.ZodType, TParam = undefined, TOutput = void>(guard: {
-    apiInput: TInput;
-    session: true;
-    handler: (ctx: GuardSessionCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-}): {
-    apiInput: TInput;
-    guardInput?: undefined;
-    session: true;
-    handler: (ctx: GuardSessionCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-};
-export declare function lambderGuard<TInput extends z.ZodType, TParam = undefined, TOutput = void>(guard: {
-    apiInput: TInput;
-    handler: (ctx: GuardCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-}): {
-    apiInput: TInput;
-    guardInput?: undefined;
-    session?: undefined;
-    handler: (ctx: GuardCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-};
-export declare function lambderGuard<TInput extends z.ZodType, TParam = undefined, TOutput = void>(guard: {
-    guardInput: TInput;
-    session: true;
-    handler: (ctx: GuardSessionCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-}): {
-    guardInput: TInput;
-    apiInput?: undefined;
-    session: true;
-    handler: (ctx: GuardSessionCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-};
-export declare function lambderGuard<TInput extends z.ZodType, TParam = undefined, TOutput = void>(guard: {
-    guardInput: TInput;
-    handler: (ctx: GuardCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-}): {
-    guardInput: TInput;
-    apiInput?: undefined;
-    session?: undefined;
-    handler: (ctx: GuardCtx, payload: z.output<TInput>, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-};
-export declare function lambderGuard<TParam = undefined, TOutput = void>(guard: {
-    session: true;
-    handler: (ctx: GuardSessionCtx, payload: undefined, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-}): {
-    apiInput?: undefined;
-    guardInput?: undefined;
-    session: true;
-    handler: (ctx: GuardSessionCtx, payload: undefined, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-};
-export declare function lambderGuard<TParam = undefined, TOutput = void>(guard: {
-    handler: (ctx: GuardCtx, payload: undefined, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-}): {
-    apiInput?: undefined;
-    guardInput?: undefined;
-    session?: undefined;
-    handler: (ctx: GuardCtx, payload: undefined, res: LambderResolver, param: TParam) => TOutput | Promise<TOutput>;
-};
-/** The param type a guard's handler declares as its 4th argument; undefined for paramless guards. */
-type LambderGuardParamOf<G> = G extends {
-    handler: (...args: infer A) => any;
-} ? (A extends [any, any, any, infer P, ...any[]] ? P : undefined) : undefined;
-/** What a guard's handler returns (awaited); void for check-only guards. */
-type LambderGuardOutputOf<G> = G extends {
-    handler: (...args: any[]) => infer R;
-} ? Awaited<R> : never;
-/** Per-guard metadata carried on the Lambder instance: input mode, session requirement, param type, output type. */
-export type LambderGuardMeta<G> = (G extends {
-    apiInput: infer S extends z.ZodType;
-} ? {
-    apiInput: z.output<S>;
-} : G extends {
-    guardInput: infer S extends z.ZodType;
-} ? {
-    guardInput: z.output<S>;
-} : {}) & (G extends {
-    session: true;
-} ? {
-    session: true;
-} : {}) & {
-    param: LambderGuardParamOf<G>;
-    output: LambderGuardOutputOf<G>;
-};
-export type LambderGuardMetaMap<TGuards> = {
-    [K in keyof TGuards]: LambderGuardMeta<TGuards[K]>;
-};
-/** Guard names referenced by a guards option, whichever of its three forms is used. */
-type NamesIn<TOpt> = TOpt extends string ? TOpt : TOpt extends readonly (infer N extends string)[] ? N : TOpt extends object ? keyof TOpt & string : never;
-type LambderGuardNameIfPayloadOk<TGuards, K extends keyof TGuards, TPayload> = TGuards[K] extends {
-    apiInput: infer R;
-} ? (TPayload extends R ? K : never) : K;
-/**
- * Guard names an API may declare: apiInput-mode guards only when the API's
- * payload carries their fields, session guards only on session APIs.
- */
-export type LambderAllowedGuardNames<TGuards, TPayload, TIncludeSession extends boolean = true> = {
-    [K in keyof TGuards]: TGuards[K] extends {
-        session: true;
-    } ? (TIncludeSession extends true ? LambderGuardNameIfPayloadOk<TGuards, K, TPayload> : never) : LambderGuardNameIfPayloadOk<TGuards, K, TPayload>;
-}[keyof TGuards] & string;
-/** The allowed guard names whose handler takes no param (usable in the string/array forms). */
-export type LambderParamlessGuardNames<TGuards, TPayload, TIncludeSession extends boolean> = {
-    [K in LambderAllowedGuardNames<TGuards, TPayload, TIncludeSession> & keyof TGuards]: TGuards[K] extends {
-        param: undefined;
-    } ? K & string : never;
-}[LambderAllowedGuardNames<TGuards, TPayload, TIncludeSession> & keyof TGuards];
-/** The map form's full shape: every declarable guard name, each carrying its own param type. */
-type LambderGuardsMap<TGuards, TPayload, TIncludeSession extends boolean> = {
-    readonly [K in LambderAllowedGuardNames<TGuards, TPayload, TIncludeSession> & keyof TGuards]?: TGuards[K] extends {
-        param: undefined;
-    } ? true : TGuards[K] extends {
-        param: infer P;
-    } ? P : true;
-};
-/**
- * The map form with AT LEAST ONE entry: the union, over every declarable
- * name, of "this one required and the rest optional".
- *
- * An all-optional map is inhabited by `{}`, which would let `guards: {}`
- * satisfy requireSessionApiGuards / requirePublicApiGuards at the type level
- * while declaring no guard at all: the option is present, so the required-field
- * check passes, and it normalizes to zero entries, so nothing runs. Requiring
- * the chosen key also rejects `{ theGuard: undefined }`, which an optional
- * property accepts and which would otherwise reach the guard's handler with an
- * undefined param.
- */
-type LambderNonEmptyGuardsMap<TGuards, TPayload, TIncludeSession extends boolean, TMap = LambderGuardsMap<TGuards, TPayload, TIncludeSession>> = {
-    [K in keyof TMap]-?: Required<Pick<TMap, K>> & Omit<TMap, K>;
-}[keyof TMap];
-/**
- * The per-API `guards` option: one paramless guard name, a non-empty ordered
- * list of paramless names, or a non-empty object map that can carry each
- * guard's param (`true` enables a paramless guard). Map entries run in
- * insertion order.
- *
- * Every form is non-empty by construction, so declaring the option is always
- * declaring a guard. See LambderNonEmptyGuardsMap.
- */
-export type LambderGuardsOption<TGuards, TPayload, TIncludeSession extends boolean> = LambderParamlessGuardNames<TGuards, TPayload, TIncludeSession> | readonly [
-    LambderParamlessGuardNames<TGuards, TPayload, TIncludeSession>,
-    ...LambderParamlessGuardNames<TGuards, TPayload, TIncludeSession>[]
-] | LambderNonEmptyGuardsMap<TGuards, TPayload, TIncludeSession>;
-/**
- * The typed ctx.guardData an API's handler sees: declared guards that return
- * a value, keyed by name. Check-only (void) guards never appear.
- */
-export type LambderGuardDataOf<TGuards, TOpt> = {
-    [K in NamesIn<TOpt> & keyof TGuards as [
-        TGuards[K] extends {
-            output: infer O;
-        } ? O : never
-    ] extends [void] ? never : K & string]: TGuards[K] extends {
-        output: infer O;
-    } ? O : never;
-};
-type GuardInputsEntries<TGuards, TOpt> = {
-    [K in Extract<NamesIn<TOpt>, keyof TGuards> as TGuards[K] extends {
-        guardInput: any;
-    } ? K : never]: TGuards[K] extends {
-        guardInput: infer V;
-    } ? V : never;
-};
-/** The guardInputs map an API's contract requires clients to send; never when no declared guard uses guardInput mode. */
-export type LambderGuardInputsOf<TGuards, TOpt> = keyof GuardInputsEntries<TGuards, TOpt> extends never ? never : GuardInputsEntries<TGuards, TOpt>;
-/** The guards option's runtime shape: a name, ordered names, or a name-to-param map. */
-export type LambderGuardsOptionValue = string | readonly string[] | Readonly<Record<string, unknown>>;
-/**
- * How a rejected input answers. Lambder binds this to its own decision
- * (setApiInputValidationErrorHandler when set, else the standard 422 body),
- * so the API's schema and every preflight slice refuse with one shape.
- */
-export type LambderInputValidationRefusal = (ctx: LambderRenderContext, resolver: LambderResolver, zodError: z.ZodError) => Promise<LambderResponse>;
-/**
- * Validate a preflight input slice (an apiInput slice of the raw payload, or
- * a guardInput value from the raw guardInputs map). Runs before the API's
- * own validation; a failure throws the response `onInvalid` decides, the
- * same one regular input validation answers. Shared with the rate-limit
- * engine's apiInput-keyed policies.
- */
-export declare const parsePreflightSlice: (input: z.ZodType, value: unknown, ctx: LambderRenderContext, resolver: LambderResolver, onInvalid: LambderInputValidationRefusal) => Promise<unknown>;
-/**
- * Runtime side of the guards subsystem: holds the defined guards, asserts
- * API registrations against them at startup, and executes an API's declared
- * guards during preflight. Composed into LambderApiPolicyEngine.
- */
-export declare class LambderApiGuardsEngine {
-    private readonly onInvalidInput;
-    private guards;
-    constructor(onInvalidInput: LambderInputValidationRefusal);
-    addGuards(guards: Record<string, LambderApiGuard<any, any, any>>): void;
-    /** Startup validation of one API registration's guards option. */
-    assertRegistration(apiName: string, mode: "public" | "session", guardsOption?: LambderGuardsOptionValue): void;
-    /** Run the API's guards in declared order. Refusals throw; outputs land on ctx.guardData. */
-    run(ctx: LambderRenderContext, resolver: LambderResolver, guardsOption?: LambderGuardsOptionValue): Promise<void>;
-}
-export {};

package/dist/policies/LambderApiGuards.js

@@ -1,94 +0,0 @@
-export function lambderGuard(guard) { return guard; }
-/** Normalize the three guards-option forms into ordered { name, param } entries. */
-const toGuardEntries = (value) => {
-    if (value === undefined)
-        return [];
-    if (typeof value === "string")
-        return [{ name: value, param: undefined }];
-    if (Array.isArray(value))
-        return value.map((name) => ({ name: String(name), param: undefined }));
-    // Object form: insertion order, params passed verbatim (paramless guards
-    // are declared with `true` and their handlers take no param argument).
-    return Object.entries(value).map(([name, param]) => ({ name, param }));
-};
-/**
- * Validate a preflight input slice (an apiInput slice of the raw payload, or
- * a guardInput value from the raw guardInputs map). Runs before the API's
- * own validation; a failure throws the response `onInvalid` decides, the
- * same one regular input validation answers. Shared with the rate-limit
- * engine's apiInput-keyed policies.
- */
-export const parsePreflightSlice = async (input, value, ctx, resolver, onInvalid) => {
-    const parsed = input.safeParse(value);
-    if (!parsed.success)
-        throw await onInvalid(ctx, resolver, parsed.error);
-    return parsed.data;
-};
-/**
- * Runtime side of the guards subsystem: holds the defined guards, asserts
- * API registrations against them at startup, and executes an API's declared
- * guards during preflight. Composed into LambderApiPolicyEngine.
- */
-export class LambderApiGuardsEngine {
-    onInvalidInput;
-    guards = {};
-    constructor(onInvalidInput) {
-        this.onInvalidInput = onInvalidInput;
-    }
-    addGuards(guards) {
-        for (const [name, guardDef] of Object.entries(guards)) {
-            if (this.guards[name])
-                throw new Error(`Lambder: guard "${name}" is already defined.`);
-            if (typeof guardDef?.handler !== "function")
-                throw new Error(`Lambder: guard "${name}" has no handler function.`);
-            if (guardDef.apiInput && guardDef.guardInput)
-                throw new Error(`Lambder: guard "${name}" declares both apiInput and guardInput; pick one.`);
-            this.guards[name] = guardDef;
-        }
-    }
-    /** Startup validation of one API registration's guards option. */
-    assertRegistration(apiName, mode, guardsOption) {
-        const entries = toGuardEntries(guardsOption);
-        // The runtime half of LambderNonEmptyGuardsMap. `guards: {}` and
-        // `guards: []` are present-but-empty: they satisfy the require*ApiGuards
-        // field check while running nothing, which is the one shape that turns a
-        // mandatory authorization declaration back into an optional one. The type
-        // rejects both; a plain-JS caller, a cast, or a spread that happened to
-        // produce an empty object lands here instead.
-        if (guardsOption !== undefined && entries.length === 0) {
-            throw new Error(`Lambder: API "${apiName}" declares an empty guards option, which authorizes nothing. ` +
-                `Name the guard that authorizes it, or omit the option entirely.`);
-        }
-        for (const { name } of entries) {
-            const guardDef = this.guards[name];
-            if (!guardDef) {
-                throw new Error(`Lambder: API "${apiName}" references unknown guard "${name}". Declare it in the guards option at creation.`);
-            }
-            if (guardDef.session && mode !== "session") {
-                throw new Error(`Lambder: API "${apiName}" uses guard "${name}" (session: true), which requires addSessionApi.`);
-            }
-        }
-    }
-    /** Run the API's guards in declared order. Refusals throw; outputs land on ctx.guardData. */
-    async run(ctx, resolver, guardsOption) {
-        for (const { name, param } of toGuardEntries(guardsOption)) {
-            const guardDef = this.guards[name];
-            if (!guardDef)
-                throw new Error(`Lambder: guard "${name}" is not configured.`);
-            const post = ctx.post;
-            let payload;
-            if (guardDef.apiInput) {
-                payload = await parsePreflightSlice(guardDef.apiInput, post?.payload, ctx, resolver, this.onInvalidInput);
-            }
-            else if (guardDef.guardInput) {
-                payload = await parsePreflightSlice(guardDef.guardInput, post?.guardInputs?.[name], ctx, resolver, this.onInvalidInput);
-            }
-            // A guard's return value becomes the handler's typed
-            // ctx.guardData[name]; check-only guards return undefined.
-            const output = await guardDef.handler(ctx, payload, resolver, param);
-            if (output !== undefined) {
-                ctx.guardData[name] = output;
-            }
-        }
-    }
-}

package/dist/policies/LambderApiIdempotency.d.ts

@@ -1,58 +0,0 @@
-import type { LambderRenderContext } from "../core/LambderContext.js";
-import type { LambderDdbIdempotency } from "../stores/LambderDdbIdempotency.js";
-import { LambderResponse } from "../core/LambderResponse.js";
-export type LambderApiIdempotencyConfig = {
-    /** Your idempotency store instance; may share the rate limiter's table (distinct key prefix). */
-    store: LambderDdbIdempotency;
-    /** Seconds a stored response replays for. Default: 86400 (24h). Per-API override: idempotency: { ttlSeconds }. */
-    defaultTtlSeconds?: number;
-    /** Skip idempotency (execute normally) when DynamoDB errors, instead of failing the request. Default: true. */
-    failOpen?: boolean;
-};
-/**
- * Runtime side of the idempotency subsystem: claims a per-operation scope
- * around handler execution, replays stored responses, and settles claims.
- * Composed into LambderApiPolicyEngine.
- */
-export declare class LambderApiIdempotencyEngine {
-    private store;
-    private defaultTtlSeconds;
-    private failOpen;
-    configure(config: LambderApiIdempotencyConfig): void;
-    /** True once the idempotency option was configured; registration asserts check it. */
-    get isConfigured(): boolean;
-    /**
-     * The request's idempotencyKey: null when absent, the key when valid, a
-     * 400 refusal when malformed. The minimum length matters for security:
-     * see IDEMPOTENCY_MIN_KEY_LENGTH.
-     */
-    private readKey;
-    /**
-     * The record's scope. Session APIs scope per session, so even a leaked
-     * key cannot cross users. Public APIs scope by the key alone: the key is
-     * required to be long (and documented to be random), and identity proxies
-     * like the client IP are deliberately NOT part of the scope, because the
-     * retry idempotency exists for (a timeout followed by a network change)
-     * frequently arrives from a different IP.
-     */
-    private scopeOf;
-    /**
-     * Replay fast path, run BEFORE rate limits and guards: a completed record
-     * answers with its stored response so a legitimate retry neither burns
-     * rate-limit quota nor re-runs guards (the original already passed them,
-     * and no handler executes). Misses fall through to the normal pipeline;
-     * store errors follow the failOpen setting.
-     */
-    findReplay(apiName: string, ctx: LambderRenderContext): Promise<LambderResponse | null>;
-    /**
-     * Idempotency wrapper around validation-passed handler execution. Without
-     * a client idempotencyKey the handler just runs; with one, the scope
-     * (identity + api + key) is claimed atomically: duplicates of an
-     * in-flight original refuse with 409, replays of a completed one return
-     * the stored response verbatim, and a crashed original releases its claim
-     * so a retry actually retries.
-     */
-    withIdempotency(apiName: string, ctx: LambderRenderContext, config: boolean | {
-        ttlSeconds?: number;
-    }, exec: () => Promise<LambderResponse>): Promise<LambderResponse>;
-}