lambder 6.0.2 → 7.0.1

package/dist/index.d.ts

@@ -1,56 +1,109 @@
 import Lambder from './core/Lambder.js';
 export default Lambder;
 export { initLambder } from './core/Lambder.js';
+export type { LambderCreatedHook } from './core/Lambder.js';
 export { default as LambderCaller } from "./client/LambderCaller.js";
-export type { LambderApiOutcome, LambderApiFailureReason, LambderValidationError, LambderCallOptions, LambderCallerOptions, LambderGuardInputsProvider, LambderProvidedGuardInputs, LambderIdempotencyKeyScope } from "./client/LambderCaller.js";
-export { default as LambderInvokeCaller, LambderInvokeError, isLambderInvokeError, compressPayloadBrotli, LAMBDER_INVOKE_HEADER, LAMBDER_INVOKED_BY_HEADER, LAMBDER_INVOKE_PROTOCOL, LAMBDER_INVOKE_MAX_EVENT_BYTES, DEFAULT_INVOKE_REQUEST_COMPRESSION_SETTINGS, } from "./invoke/LambderInvokeCaller.js";
-export type { LambderInvokeOutcome, LambderInvokeFailure, LambderInvokeFailureReason, LambderInvokeFunctionError, LambderInvokeCallerOptions, LambderInvokeCallOptions, LambderInvokeFailureHandler, LambderInvokeLogListHandler, LambderInvokeSession, LambderInvokeTransport, LambderInvokeTransportResult, LambderInvokeHttpResult, LambderInvokeRequestInit, LambderInvokeEventInit, } from "./invoke/LambderInvokeCaller.js";
-export { describeCrash, errorFromCrashDetail } from "./shared/LambderCrashDetail.js";
-export type { LambderCrashDetail, LambderCrashCause } from "./shared/LambderCrashDetail.js";
-export { LambderApiError, isLambderApiError, refuse, LAMBDER_REFUSAL_CODES } from "./shared/LambderApiError.js";
-export type { LambderApiErrorOptions, LambderRefusalMessage, LambderRefusalCode, LambderRefuseOptions } from "./shared/LambderApiError.js";
+export type { LambderApiOutcome, LambderApiFailureReason, LambderValidationError, LambderCallOptions, LambderCallerOptions, LambderGuardInputsProvider, LambderProvidedGuardInputs, LambderIdempotencyKeyScope, LambderLogListHandler } from "./client/LambderCaller.js";
+export { lambderFetchTransport } from "./client/lambderFetchTransport.js";
+export { buildTransportEnvelope, LambderTransportFailure, isLambderTransportFailure } from "./shared/transport/LambderApiTransport.js";
+export { lambderCookieJarTransport } from "./shared/transport/lambderCookieJarTransport.js";
+export type { LambderApiTransport, LambderApiTransportRequest, LambderTransportFailureReason } from "./shared/transport/LambderApiTransport.js";
+export { LambderCookieJar, parseSetCookie } from "./shared/transport/LambderCookieJar.js";
+export { LambderExpiringMap, LambderExpiringMapFullError } from "./shared/util/LambderExpiringMap.js";
+export type { LambderStoredCookie } from "./shared/transport/LambderCookieJar.js";
+export { lambderHandlerTransport } from "./invoke/lambderHandlerTransport.js";
+export type { LambderHandlerTransportOptions } from "./invoke/lambderHandlerTransport.js";
+export { synthesizeLambdaHttpEvent, decodeLambdaHttpResult, localLambdaContext, LAMBDER_INVOKE_HEADER, LAMBDER_INVOKED_BY_HEADER, LAMBDER_INVOKE_PROTOCOL, } from "./invoke/LambderLambdaEvent.js";
+export type { LambderSynthesizedRequest, LambderLambdaHttpResult, LambderInvokeSession } from "./invoke/LambderLambdaEvent.js";
+export { LambderApiPipeline } from "./api/LambderApiPipeline.js";
+export type { LambderApiPipelineOptions, LambderApiSessionsConfig, LambderApiInputRefusal, LambderApiRunResult, LambderApiExec } from "./api/LambderApiPipeline.js";
+export { readApiEnvelope, restoreCompressedPayload } from "./api/LambderApiRequest.js";
+export type { LambderApiRequest, LambderApiRequestInfo, LambderCompressedPayloadFields, LambderRestorePayloadResult } from "./api/LambderApiRequest.js";
+export { toHttpAnswer } from "./api/LambderApiAnswer.js";
+export type { LambderApiAnswer } from "./api/LambderApiAnswer.js";
+export { LambderAnswerHeaders, getAnswerHeader, setAnswerHeader, addAnswerHeader } from "./shared/wire/LambderAnswerHeaders.js";
+export { createApiCallContext } from "./api/LambderApiCallContext.js";
+export type { LambderApiCallContext, LambderApiCallTrace } from "./api/LambderApiCallContext.js";
+export type { LambderApiDefinition } from "./api/LambderApiDefinition.js";
+export { buildApiEnvelope, envelopeAnswer, refusalAnswer, validationAnswer, apiNotFoundAnswer, sessionExpiredAnswer, versionExpiredAnswer, invalidPayloadAnswer, crashAnswer, API_ANSWER_CONTENT_TYPE, } from "./api/LambderApiEnvelope.js";
+export type { LambderApiEnvelopeConfig, LambderValidationAnswerBody } from "./api/LambderApiEnvelope.js";
+export { LambderApiValidationRefusal, isLambderApiValidationRefusal } from "./api/LambderApiValidationRefusal.js";
+export { LambderInvokeError, isLambderInvokeError } from "./invoke/LambderInvokeOutcome.js";
+export type { LambderInvokeOutcome, LambderInvokeFailure, LambderInvokeValidationFailure, LambderInvokeCrashFailure, LambderInvokePayloadTooLargeFailure, LambderInvokeEnvelopeFailure, LambderInvokeDeliveryFailure, LambderInvokeFailureReason, LambderInvokeFunctionError, } from "./invoke/LambderInvokeOutcome.js";
+export { default as LambderInvokeCaller, LAMBDER_INVOKE_MAX_EVENT_BYTES, } from "./invoke/LambderInvokeCaller.js";
+export type { LambderInvokeCallerOptions, LambderInvokeCallOptions, LambderInvokeFailureHandler, LambderInvokeLogListHandler, LambderInvokeTransport, LambderInvokeTransportResult, LambderInvokeRequestInit, LambderInvokeEventInit, } from "./invoke/LambderInvokeCaller.js";
+export { describeCrash, errorFromCrashDetail } from "./shared/wire/LambderCrashDetail.js";
+export type { LambderCrashDetail, LambderCrashCause } from "./shared/wire/LambderCrashDetail.js";
+export { LambderApiRefusal, isLambderApiRefusal, refuse, LAMBDER_REFUSAL_CODES } from "./shared/wire/LambderApiRefusal.js";
+export type { LambderApiRefusalOptions, LambderRefusalMessage, LambderAppRefusalMessage, LambderRefusalCode, LambderRefuseOptions } from "./shared/wire/LambderApiRefusal.js";
 export { default as LambderResponseBuilder } from "./core/LambderResponseBuilder.js";
 export { default as LambderResolver } from "./core/LambderResolver.js";
 export { default as LambderSessionManager } from "./session/LambderSessionManager.js";
+export type { LambderSessionManagerOptions } from "./session/LambderSessionManager.js";
 export { default as LambderSessionController } from "./session/LambderSessionController.js";
-export { LambderResponse, finalizeResponse, acceptsEncoding, type HttpStatusCode, type LambderHttpResponse, type LambderHttpEventFormat, type LambderHeadersInput, type LambderFinalizeOptions, type LambderResponseCompressionSettings, type LambderResponseCompressionOption, } from "./core/LambderResponse.js";
+export { DEFAULT_SESSION_TOKEN_COOKIE_KEY, DEFAULT_SESSION_CSRF_COOKIE_KEY } from "./shared/wire/LambderSessionCookieNames.js";
+export type { LambderSessionControllerOptions, LambderSessionRequestInfo } from "./session/LambderSessionController.js";
+export type { LambderSessionStore, LambderSessionRecord } from "./shared/contracts/LambderSessionStore.js";
+export { LambderMemorySessionStore } from "./stores/LambderMemorySessionStore.js";
+export { LambderWebCrypto, LambderPlainSessionCrypto, isWebCryptoAvailable } from "./session/LambderSessionCrypto.js";
+export type { LambderSessionCrypto } from "./session/LambderSessionCrypto.js";
+export { LambderDdbSessionStore } from "./stores/LambderDdbSessionStore.js";
+export type { LambderDdbSessionStoreOptions } from "./stores/LambderDdbSessionStore.js";
+export { LambderResponse, finalizeResponse, answerFromResponse, responseFromAnswer, type LambderHttpResponse, type LambderHeadersInput, type LambderFinalizeOptions, type LambderResponseCompressionSettings, type LambderResponseCompressionOption, } from "./core/LambderResponse.js";
+export type { LambderHttpStatusCode } from "./shared/wire/LambderHttpStatus.js";
 export { html, xml, raw, jsonScript, escapeHtml, renderHtmlValue, LambderSafeHtml, type LambderHtmlValue } from "./shared/LambderHtml.js";
 export { LambderTemplatingEngine } from "./core/LambderTemplatingEngine.js";
 export type { LambderTemplateData, LambderTemplatingEngineOptions } from "./core/LambderTemplatingEngine.js";
-export type { LambderResponseOptions, LambderRawResponseInit, LambderApiAnswer, } from "./core/LambderResponseBuilder.js";
-export type { LambderRouteMatcher, LambderCorsConfig, LambderCreateOptions, LambderSessionOptions, ConditionFunction, RouteCondition, PathParamsOf, LambderActionTools, LambderHandler, LambderIndexHtmlOptions, } from "./core/Lambder.js";
-export { LambderPublicFilesHandler } from "./core/LambderPublicFiles.js";
+export type { LambderResponseOptions, LambderRawResponseInit, LambderResolverApiMethod, } from "./core/LambderResponseBuilder.js";
+export type { LambderRouteMatcher, LambderRouteConditionFn, LambderRouteCondition, LambderPathParamsOf, LambderRoutePath } from "./core/LambderRouting.js";
+export type { LambderCorsConfig } from "./core/LambderCors.js";
+export type { LambderCreateOptions, LambderSessionOptions, LambderActionTools, LambderHandler, } from "./core/LambderCreateOptions.js";
+export type { LambderIndexHtmlOptions } from "./core/LambderIndexHtml.js";
+export type { LambderRouteHandler, LambderSessionRouteHandler, LambderActionHandler, LambderActionFilter, LambderHookEvent, LambderBeforeRenderHook, LambderAfterRenderHook, LambderFallbackHook, LambderGlobalErrorHandler, LambderFallbackHandler, LambderInputValidationHandler, } from "./core/LambderCreateOptions.js";
 export type { LambderPublicFilesOptions } from "./core/LambderPublicFiles.js";
-export { LambderFiles, LambderLocalFileSource } from "./core/LambderFiles.js";
-export type { LambderFileSource, LambderFile, LambderFilesOption, LambderFileMemoryCacheOption, LambderReadFile } from "./core/LambderFiles.js";
+export { LambderFiles } from "./core/LambderFiles.js";
+export type { LambderFilesOption, LambderFileMemoryCacheOption, LambderReadFile } from "./core/LambderFiles.js";
+export { LambderLocalFileSource } from "./stores/LambderLocalFileSource.js";
+export type { LambderFileSource, LambderFile } from "./shared/contracts/LambderFileSource.js";
 export { LambderS3FileSource } from "./stores/LambderS3FileSource.js";
 export type { LambderS3FileSourceOptions } from "./stores/LambderS3FileSource.js";
 export { LambderHttpFileSource } from "./stores/LambderHttpFileSource.js";
 export type { LambderHttpFileSourceOptions } from "./stores/LambderHttpFileSource.js";
 export type { LambderSessionCookieOptions } from "./session/LambderSessionController.js";
-export type { LambderSessionContext, LambderCreatedSession, LambderSessionDataRefreshConfig } from "./session/LambderSessionManager.js";
-export { resolveCompressionOption, LAMBDER_ENCODINGS } from "./shared/LambderCompressionOption.js";
-export type { LambderCompressionOption, LambderCompressionSettings, LambderCompressionSettingsBase, LambderEncoding, } from "./shared/LambderCompressionOption.js";
-export { compressText, restoreBytes, restoreText, LambderCompressionError, LAMBDER_RESTORE_FAILURES, } from "./shared/LambderCompressionCodec.js";
-export type { LambderRestoreFailure, LambderRestoreBound } from "./shared/LambderCompressionCodec.js";
+export type { LambderCreatedSession, LambderSessionDataRefreshConfig } from "./session/LambderSessionManager.js";
+export { resolveCompressionOption, LAMBDER_ENCODINGS } from "./shared/wire/LambderCompressionOption.js";
+export type { LambderCompressionOption, LambderCompressionSettings, LambderCompressionSettingsBase, LambderEncoding, } from "./shared/wire/LambderCompressionOption.js";
+export { compressText, restoreBytes, restoreText, LambderCompressionError, LAMBDER_RESTORE_FAILURES, } from "./shared/wire/LambderCompressionCodec.js";
+export type { LambderRestoreFailure, LambderRestoreBound } from "./shared/wire/LambderCompressionCodec.js";
 export { LambderSessionDataRefreshError, LambderSessionReadError } from "./session/LambderSessionManager.js";
+export { LambderSessionNotFoundError, LambderSessionAmbiguousError } from "./session/LambderSessionController.js";
 export { LambderDdbCache } from "./stores/LambderDdbCache.js";
 export type { LambderCacheKey, LambderDdbCacheOptions, LambderDdbCacheSetOptions, LambderDdbCacheGetOrSetOptions, LambderDdbCacheListOptions, } from "./stores/LambderDdbCache.js";
+export { RATE_LIMIT_WINDOWS } from "./shared/contracts/LambderRateLimiter.js";
+export type { LambderRateLimiter, LambderRateLimitWindow, LambderRateLimitPolicy, LambderRateLimitExceeded, LambderRateLimitResult, } from "./shared/contracts/LambderRateLimiter.js";
 export { LambderDdbRateLimiter } from "./stores/LambderDdbRateLimiter.js";
-export type { LambderDdbRateLimiterOptions, LambderRateLimitWindow, LambderRateLimitPolicy, LambderRateLimitExceeded, LambderRateLimitResult, } from "./stores/LambderDdbRateLimiter.js";
-export { LambderDdbIdempotency } from "./stores/LambderDdbIdempotency.js";
-export type { LambderDdbIdempotencyOptions, LambderIdempotencyBeginResult, LambderIdempotencyDoneRecord, } from "./stores/LambderDdbIdempotency.js";
-export { lambderGuard } from "./policies/LambderApiGuards.js";
-export type { LambderApiGuard, LambderGuardMeta, LambderGuardMetaMap, LambderAllowedGuardNames, LambderParamlessGuardNames, LambderGuardsOption, LambderGuardsOptionValue, LambderGuardDataOf, LambderGuardInputsOf, } from "./policies/LambderApiGuards.js";
-export { lambderRateLimitKey } from "./policies/LambderApiRateLimits.js";
-export type { LambderRateLimitKeyFn, LambderRateLimitPer, LambderRateLimitBudget, LambderApiRateLimitPolicyConfig, LambderApiRateLimitsConfig, LambderAllowedPolicyNames, LambderRateLimitOverride, LambderRateLimitOption, LambderRateLimitOptionValue, } from "./policies/LambderApiRateLimits.js";
-export type { LambderApiIdempotencyConfig } from "./policies/LambderApiIdempotency.js";
+export type { LambderDdbRateLimiterOptions } from "./stores/LambderDdbRateLimiter.js";
+export { LambderMemoryRateLimiter } from "./stores/LambderMemoryRateLimiter.js";
+export type { LambderIdempotencyStore, LambderIdempotencyBeginResult, LambderIdempotencyDoneRecord, } from "./shared/contracts/LambderIdempotencyStore.js";
+export { LambderDdbIdempotencyStore } from "./stores/LambderDdbIdempotencyStore.js";
+export type { LambderDdbIdempotencyStoreOptions } from "./stores/LambderDdbIdempotencyStore.js";
+export { LambderMemoryIdempotencyStore } from "./stores/LambderMemoryIdempotencyStore.js";
+export { lambderGuard, lambderRateLimitKey } from "./core/LambderPolicyBuilders.js";
+export { lambderGuardBuilder } from "./api/LambderApiGuards.js";
+export type { LambderGuardBuilder, LambderApiGuard, LambderGuardMeta, LambderGuardMetaMap, LambderAllowedGuardNames, LambderParamlessGuardNames, LambderGuardsOption, LambderGuardDataOf, LambderGuardInputsOf, } from "./api/LambderApiGuards.js";
+export { lambderRateLimitKeyBuilder, rateLimitRefusal, DEFAULT_RATE_LIMIT_REFUSAL } from "./api/LambderApiRateLimits.js";
+export type { LambderRateLimitKeyBuilder } from "./api/LambderApiRateLimits.js";
+export type { LambderRateLimitKeyFn, LambderRateLimitPer, LambderRateLimitBudget, LambderApiRateLimitPolicyConfig, LambderApiRateLimitsConfig, LambderAllowedPolicyNames, LambderRateLimitOption, } from "./api/LambderApiRateLimits.js";
+export type { LambderApiIdempotencyConfig } from "./api/LambderApiIdempotency.js";
+export type { LambderGuardsOptionValue, LambderRateLimitOverride, LambderRateLimitOptionValue, LambderApiIdempotencyOption, } from "./shared/wire/LambderApiOptionValues.js";
 export { createLambderI18n } from "./shared/LambderI18n.js";
 export type { LambderLanguageMeta, LambderI18nConfig, LambderI18nInstance, LambderI18nTranslator, LambderI18nExtractParams, LambderI18nCodes, LambderI18nKeys, LambderI18nTranslatorFor, } from "./shared/LambderI18n.js";
-export { type ApiContractShape, type LambderApiResponse, type LambderApiResponseConfig, } from "./shared/LambderApiContract.js";
-export type { LambderRenderContext, LambderSessionRenderContext, LambderHttpEvent } from "./core/LambderContext.js";
+export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiResponseConfig, LambderApiNullAnswerConfig, LambderContractEntry, LambderMergeContract, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";
+export type { LambderRenderContext, LambderSessionRenderContext, LambderHttpEvent, LambderHttpEventFormat } from "./core/LambderContext.js";
+export type { LambderApiAnswerOutcome, LambderApiSuccessOutcome, LambderApiCallFailure, LambderApiValidationFailure, LambderApiEnvelopeFailure, LambderApiHttpAnswer, } from "./shared/wire/LambderApiOutcome.js";
+export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";
 export { createContext, isV2HttpEvent } from "./core/LambderContext.js";
-export { COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BR_FIELD, COMPRESSED_PAYLOAD_BYTES_FIELD, DEFAULT_REQUEST_COMPRESSION_SETTINGS, DEFAULT_MAX_RESTORED_PAYLOAD_BYTES, } from "./shared/LambderRequestPayload.js";
-export type { LambderCompressedGzipPayload, LambderCompressedBrotliPayload, LambderRequestCompressionOption, LambderRequestCompressionSettings, } from "./shared/LambderRequestPayload.js";
-export { serializeCookie, serializeClearCookie, resolveCookieDomain } from "./core/LambderCookie.js";
-export type { LambderCookieOptions, LambderClearCookieOptions, LambderCookieDomain } from "./core/LambderCookie.js";
+export { COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BR_FIELD, COMPRESSED_PAYLOAD_BYTES_FIELD, DEFAULT_REQUEST_COMPRESSION_SETTINGS, DEFAULT_MAX_RESTORED_PAYLOAD_BYTES, DEFAULT_INVOKE_REQUEST_COMPRESSION_SETTINGS, compressPayloadBrotli, } from "./shared/wire/LambderRequestPayload.js";
+export type { LambderCompressedGzipPayload, LambderCompressedBrotliPayload, LambderRequestCompressionOption, LambderRequestCompressionSettings, } from "./shared/wire/LambderRequestPayload.js";
+export { serializeCookie, serializeClearCookie, resolveCookieDomain } from "./shared/wire/LambderCookie.js";
+export type { LambderCookieOptions, LambderClearCookieOptions, LambderCookieDomain } from "./shared/wire/LambderCookie.js";

package/dist/index.js

@@ -2,47 +2,75 @@ import Lambder from './core/Lambder.js';
 export default Lambder;
 export { initLambder } from './core/Lambder.js';
 export { default as LambderCaller } from "./client/LambderCaller.js";
+// Transports: how a caller reaches a server (fetch in production, a handler in-process for tests, a cookie jar over either)
+export { lambderFetchTransport } from "./client/lambderFetchTransport.js";
+export { buildTransportEnvelope, LambderTransportFailure, isLambderTransportFailure } from "./shared/transport/LambderApiTransport.js";
+export { lambderCookieJarTransport } from "./shared/transport/lambderCookieJarTransport.js";
+export { LambderCookieJar, parseSetCookie } from "./shared/transport/LambderCookieJar.js";
+export { LambderExpiringMap, LambderExpiringMapFullError } from "./shared/util/LambderExpiringMap.js";
+export { lambderHandlerTransport } from "./invoke/lambderHandlerTransport.js";
+export { synthesizeLambdaHttpEvent, decodeLambdaHttpResult, localLambdaContext, LAMBDER_INVOKE_HEADER, LAMBDER_INVOKED_BY_HEADER, LAMBDER_INVOKE_PROTOCOL, } from "./invoke/LambderLambdaEvent.js";
+// The API core: the request, answer, envelope and pipeline both the server and the mock runtime run
+export { LambderApiPipeline } from "./api/LambderApiPipeline.js";
+export { readApiEnvelope, restoreCompressedPayload } from "./api/LambderApiRequest.js";
+export { toHttpAnswer } from "./api/LambderApiAnswer.js";
+export { LambderAnswerHeaders, getAnswerHeader, setAnswerHeader, addAnswerHeader } from "./shared/wire/LambderAnswerHeaders.js";
+export { createApiCallContext } from "./api/LambderApiCallContext.js";
+export { buildApiEnvelope, envelopeAnswer, refusalAnswer, validationAnswer, apiNotFoundAnswer, sessionExpiredAnswer, versionExpiredAnswer, invalidPayloadAnswer, crashAnswer, API_ANSWER_CONTENT_TYPE, } from "./api/LambderApiEnvelope.js";
+export { LambderApiValidationRefusal, isLambderApiValidationRefusal } from "./api/LambderApiValidationRefusal.js";
 // Calling a Lambder app from another lambda (server-only: the Lambda SDK, zlib)
-export { default as LambderInvokeCaller, LambderInvokeError, isLambderInvokeError, compressPayloadBrotli, LAMBDER_INVOKE_HEADER, LAMBDER_INVOKED_BY_HEADER, LAMBDER_INVOKE_PROTOCOL, LAMBDER_INVOKE_MAX_EVENT_BYTES, DEFAULT_INVOKE_REQUEST_COMPRESSION_SETTINGS, } from "./invoke/LambderInvokeCaller.js";
+export { LambderInvokeError, isLambderInvokeError } from "./invoke/LambderInvokeOutcome.js";
+export { default as LambderInvokeCaller, LAMBDER_INVOKE_MAX_EVENT_BYTES, } from "./invoke/LambderInvokeCaller.js";
 // A crash described for a caller allowed to see it (the envelope's `crash` field)
-export { describeCrash, errorFromCrashDetail } from "./shared/LambderCrashDetail.js";
+export { describeCrash, errorFromCrashDetail } from "./shared/wire/LambderCrashDetail.js";
 // Typed API refusals (isomorphic: shared code may throw them from anywhere)
-export { LambderApiError, isLambderApiError, refuse, LAMBDER_REFUSAL_CODES } from "./shared/LambderApiError.js";
+export { LambderApiRefusal, isLambderApiRefusal, refuse, LAMBDER_REFUSAL_CODES } from "./shared/wire/LambderApiRefusal.js";
 export { default as LambderResponseBuilder } from "./core/LambderResponseBuilder.js";
 export { default as LambderResolver } from "./core/LambderResolver.js";
 export { default as LambderSessionManager } from "./session/LambderSessionManager.js";
 export { default as LambderSessionController } from "./session/LambderSessionController.js";
+export { DEFAULT_SESSION_TOKEN_COOKIE_KEY, DEFAULT_SESSION_CSRF_COOKIE_KEY } from "./shared/wire/LambderSessionCookieNames.js";
+export { LambderMemorySessionStore } from "./stores/LambderMemorySessionStore.js";
+export { LambderWebCrypto, LambderPlainSessionCrypto, isWebCryptoAvailable } from "./session/LambderSessionCrypto.js";
+export { LambderDdbSessionStore } from "./stores/LambderDdbSessionStore.js";
 // Response model
-export { LambderResponse, finalizeResponse, acceptsEncoding, } from "./core/LambderResponse.js";
+export { LambderResponse, finalizeResponse, answerFromResponse, responseFromAnswer, } from "./core/LambderResponse.js";
 // Type-safe templating (tagged templates with auto-escaping)
 export { html, xml, raw, jsonScript, escapeHtml, renderHtmlValue, LambderSafeHtml } from "./shared/LambderHtml.js";
 // Comment-based HTML templating engine (build-pipeline-safe slots and conditionals, standalone)
 export { LambderTemplatingEngine } from "./core/LambderTemplatingEngine.js";
-// Public file serving
-export { LambderPublicFilesHandler } from "./core/LambderPublicFiles.js";
-export { LambderFiles, LambderLocalFileSource } from "./core/LambderFiles.js";
+export { LambderFiles } from "./core/LambderFiles.js";
+export { LambderLocalFileSource } from "./stores/LambderLocalFileSource.js";
 export { LambderS3FileSource } from "./stores/LambderS3FileSource.js";
 export { LambderHttpFileSource } from "./stores/LambderHttpFileSource.js";
 // Compression: the option every site shares, and the one codec behind them all.
-export { resolveCompressionOption, LAMBDER_ENCODINGS } from "./shared/LambderCompressionOption.js";
+export { resolveCompressionOption, LAMBDER_ENCODINGS } from "./shared/wire/LambderCompressionOption.js";
 // Brotli/gzip plus the bounded, length-verified restore every compressed
 // value in Lambder (records at rest, request payloads) goes through.
-export { compressText, restoreBytes, restoreText, LambderCompressionError, LAMBDER_RESTORE_FAILURES, } from "./shared/LambderCompressionCodec.js";
+export { compressText, restoreBytes, restoreText, LambderCompressionError, LAMBDER_RESTORE_FAILURES, } from "./shared/wire/LambderCompressionCodec.js";
 export { LambderSessionDataRefreshError, LambderSessionReadError } from "./session/LambderSessionManager.js";
+export { LambderSessionNotFoundError, LambderSessionAmbiguousError } from "./session/LambderSessionController.js";
 // DynamoDB-backed compressed cache (standalone, server-only)
 export { LambderDdbCache } from "./stores/LambderDdbCache.js";
-// DynamoDB-backed fixed-window rate limiter (standalone, server-only)
+// Fixed-window rate limiting: the shared vocabulary, the DynamoDB limiter and the in-memory one
+export { RATE_LIMIT_WINDOWS } from "./shared/contracts/LambderRateLimiter.js";
 export { LambderDdbRateLimiter } from "./stores/LambderDdbRateLimiter.js";
-// DynamoDB-backed idempotency records (standalone, server-only)
-export { LambderDdbIdempotency } from "./stores/LambderDdbIdempotency.js";
+export { LambderMemoryRateLimiter } from "./stores/LambderMemoryRateLimiter.js";
+export { LambderDdbIdempotencyStore } from "./stores/LambderDdbIdempotencyStore.js";
+export { LambderMemoryIdempotencyStore } from "./stores/LambderMemoryIdempotencyStore.js";
 // Declarative per-API policies: guards
-export { lambderGuard } from "./policies/LambderApiGuards.js";
+export { lambderGuard, lambderRateLimitKey } from "./core/LambderPolicyBuilders.js";
+export { lambderGuardBuilder } from "./api/LambderApiGuards.js";
 // Declarative per-API policies: rate limits
-export { lambderRateLimitKey } from "./policies/LambderApiRateLimits.js";
+export { lambderRateLimitKeyBuilder, rateLimitRefusal, DEFAULT_RATE_LIMIT_REFUSAL } from "./api/LambderApiRateLimits.js";
 // Typed translations (standalone, isomorphic)
 export { createLambderI18n } from "./shared/LambderI18n.js";
+export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";
 export { createContext, isV2HttpEvent } from "./core/LambderContext.js";
 // Request payload compression: the wire format LambderCaller and the server share.
-export { COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BR_FIELD, COMPRESSED_PAYLOAD_BYTES_FIELD, DEFAULT_REQUEST_COMPRESSION_SETTINGS, DEFAULT_MAX_RESTORED_PAYLOAD_BYTES, } from "./shared/LambderRequestPayload.js";
+export { COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BR_FIELD, COMPRESSED_PAYLOAD_BYTES_FIELD, DEFAULT_REQUEST_COMPRESSION_SETTINGS, DEFAULT_MAX_RESTORED_PAYLOAD_BYTES, 
+// The Brotli twin of the browser's compressPayloadGzip, beside it now
+// rather than inside LambderInvokeCaller; the root entry's name is unchanged.
+DEFAULT_INVOKE_REQUEST_COMPRESSION_SETTINGS, compressPayloadBrotli, } from "./shared/wire/LambderRequestPayload.js";
 // Cookies (res.setCookie / res.clearCookie build on these; exported for code holding a LambderResponse)
-export { serializeCookie, serializeClearCookie, resolveCookieDomain } from "./core/LambderCookie.js";
+export { serializeCookie, serializeClearCookie, resolveCookieDomain } from "./shared/wire/LambderCookie.js";

package/dist/invoke/LambderInvokeCaller.d.ts

@@ -21,106 +21,18 @@
  * tests.
  */
 import type { APIGatewayProxyEventV2, Context } from "aws-lambda";
+import { type LambderInvokeFailure, type LambderInvokeOutcome } from "./LambderInvokeOutcome.js";
 import type { LambdaClient, LambdaClientConfig } from "@aws-sdk/client-lambda";
-import type { ApiContractShape, LambderApiResponse } from "../shared/LambderApiContract.js";
-import { type LambderApiFailureReason, type LambderValidationError } from "../shared/LambderApiOutcome.js";
-import { type LambderCallOptionsArg, type LambderGuardInputsProviderOption } from "../shared/LambderCallOptions.js";
-import { type LambderCrashDetail } from "../shared/LambderCrashDetail.js";
-import { type LambderCompressionOption, type LambderCompressionSettings } from "../shared/LambderCompressionOption.js";
-import { type LambderCompressedBrotliPayload } from "../shared/LambderRequestPayload.js";
-/** Marks a synthesized request as an invoke, for guards and hooks that want to tell. Not an authorization. */
-export declare const LAMBDER_INVOKE_HEADER = "x-lambder-invoke";
-/** The invoking function's name, when the caller runs in Lambda; for the callee's logs. */
-export declare const LAMBDER_INVOKED_BY_HEADER = "x-lambder-invoked-by";
-/** The value of the marker header; a future incompatible event shape would bump it. */
-export declare const LAMBDER_INVOKE_PROTOCOL = "1";
+import type { LambderApiContractShape } from "../shared/wire/LambderApiContract.js";
+import { type LambderCallArgs, type LambderContractOutputOf, type LambderGuardInputsProviderOption, type LambderSharedCallOptions } from "../shared/wire/LambderCallOptions.js";
+import { type LambderCompressionOption } from "../shared/wire/LambderCompressionOption.js";
+import { type LambderInvokeSession, type LambderLambdaHttpResult } from "./LambderLambdaEvent.js";
 /**
  * Lambda caps a synchronous invoke's request and its response at about 6MB;
  * the same guard threshold finalizeResponse applies to an answer, applied
  * here to the event before it is sent.
  */
 export declare const LAMBDER_INVOKE_MAX_EVENT_BYTES = 5500000;
-/** Request Brotli when `requestCompression: true`: the HTTP request threshold, at the quality every other Lambder site uses. */
-export declare const DEFAULT_INVOKE_REQUEST_COMPRESSION_SETTINGS: LambderCompressionSettings;
-export type LambderInvokeFailureReason = LambderApiFailureReason | 'crash' | 'protocol' | 'payloadTooLarge';
-/** Lambda's own error payload for a FunctionError invocation. */
-export type LambderInvokeFunctionError = {
-    errorType?: string;
-    errorMessage?: string;
-    trace?: string[];
-};
-export type LambderInvokeFailure = {
-    ok: false;
-    reason: LambderInvokeFailureReason;
-    /** HTTP status, when the callee answered. */
-    status?: number;
-    /** Envelope errorMessage, when the callee provided one. */
-    errorMessage?: any;
-    /** Seconds to wait before retrying, from the answer's Retry-After header. */
-    retryAfterSeconds?: number;
-    /** Always present: the error api() throws for this failure, with the callee's error as its cause when one is known. */
-    error: LambderInvokeError;
-    /** Zod issue detail for 'validation'. */
-    zodError?: LambderValidationError;
-    /** The parsed envelope, when one came back. */
-    response?: LambderApiResponse<any>;
-    /** The callee's crash detail, when its global error handler sent one (the envelope's `crash` field). */
-    crash?: LambderCrashDetail;
-    /** Lambda's error payload for reason 'crash'. */
-    functionError?: LambderInvokeFunctionError;
-    /** The answer's logList; empty when no envelope came back. */
-    logList: unknown[];
-    /** For 'payloadTooLarge': the event's byte size. */
-    bytes?: number;
-};
-export type LambderInvokeOutcome<T> = {
-    ok: true;
-    payload: T;
-    response: LambderApiResponse<T>;
-    logList: unknown[];
-} | LambderInvokeFailure;
-type LambderInvokeErrorInit = {
-    message: string;
-    reason: LambderInvokeFailureReason;
-    apiName: string;
-    functionName: string;
-    status?: number;
-    errorMessage?: any;
-    crash?: LambderCrashDetail;
-    functionError?: LambderInvokeFunctionError;
-    logList: unknown[];
-    zodError?: LambderValidationError;
-    retryAfterSeconds?: number;
-    bytes?: number;
-    cause?: unknown;
-};
-/**
- * What api() throws. Its message names the function, the API and the reason,
- * so an error reporter that fingerprints on the message groups one broken
- * API into one row; its cause is the callee's own error rebuilt from the
- * crash detail (or Lambda's FunctionError, or the SDK's rejection), so a
- * reporter that walks causes stores the callee's stack.
- */
-export declare class LambderInvokeError extends Error {
-    /** Brand for detection across duplicate lambder installs, like LambderApiError. */
-    readonly isLambderInvokeError = true;
-    readonly reason: LambderInvokeFailureReason;
-    readonly apiName: string;
-    readonly functionName: string;
-    readonly status?: number;
-    readonly errorMessage?: any;
-    readonly crash?: LambderCrashDetail;
-    readonly functionError?: LambderInvokeFunctionError;
-    readonly logList: unknown[];
-    readonly zodError?: LambderValidationError;
-    readonly retryAfterSeconds?: number;
-    readonly bytes?: number;
-    /** The full failure outcome; it carries this error and this error carries it. */
-    outcome: LambderInvokeFailure;
-    constructor(init: LambderInvokeErrorInit);
-}
-/** Brand-based type guard (see LambderInvokeError.isLambderInvokeError). */
-export declare const isLambderInvokeError: (err: unknown) => err is LambderInvokeError;
 /** What a transport hands back: Lambda's FunctionError marker (null when the function returned normally) and the parsed JSON it returned. */
 export type LambderInvokeTransportResult = {
     functionError: string | null;
@@ -144,35 +56,39 @@ export type LambderInvokeFailureHandler = (failure: LambderInvokeFailure, info:
     apiName: string;
     functionName: string;
 }) => void | Promise<void>;
-/** A session carried on a user's behalf: the two values a browser holds. */
-export type LambderInvokeSession = {
-    token: string;
-    csrf: string;
-};
-export type LambderInvokeCallOptions = {
-    /** Abort after this many ms; overrides the constructor default. The callee keeps running regardless. */
-    timeoutMs?: number;
-    /** External abort signal, combined with the timeout when both are set. */
-    signal?: AbortSignal;
-    /** Overrides the constructor's requestCompression for this call: false sends the payload plainly, true compresses it regardless of the threshold. Either way it is only sent compressed when that is smaller. */
-    compressRequest?: boolean;
-    /** Forwarded as X-Forwarded-For, so ctx.ip on the callee is the end user's address rather than nothing. */
+/**
+ * Per-call options: the request extras both callers share (see
+ * LambderSharedCallOptions; a timeout here bounds the wait only, since the
+ * callee keeps running regardless) plus the two an invoke has of its own.
+ */
+export type LambderInvokeCallOptions = LambderSharedCallOptions & {
+    /** The address the callee sees as ctx.ip: it becomes the synthesized event's requestContext.http.sourceIp. Empty when the call supplies none. */
     clientIp?: string;
-    /** Extra request headers the callee sees. */
-    headers?: Record<string, string>;
-    /** Values for the API's guardInput-mode guards, keyed by guard name; the contract makes this REQUIRED for APIs that declare such guards, except those a guardInputsProvider covers. */
-    guardInputs?: Record<string, unknown>;
-    /** Replay-protection key for APIs declared idempotent on the callee. Same rules as LambderCaller: unguessable, at least 16 characters, one per logical operation. */
-    idempotencyKey?: string;
     /** A user's session, so a session API on the callee runs on their behalf. */
     session?: LambderInvokeSession;
 };
 type LambderInvokeCallerBaseOptions = {
     /** Function name or ARN. */
     functionName: string;
-    /** A ready client, e.g. one shared with the rest of the app. */
+    /**
+     * A ready client, e.g. one shared with the rest of the app. It keeps
+     * whatever `maxAttempts` it was built with, which is the SDK's own 3
+     * unless the app said otherwise: `clientConfig` below is not consulted
+     * for a client this caller did not create, and a retry at that layer
+     * re-executes a callee whose response was merely lost. Build it with
+     * `{ maxAttempts: 1 }`, or send an `idempotencyKey` and let the callee
+     * settle the repeat.
+     */
     client?: LambdaClient;
-    /** Otherwise the client is created from this on the first call (region, credentials, maxAttempts). */
+    /**
+     * Otherwise the client is created from this on the first call (region,
+     * credentials, maxAttempts). `maxAttempts` defaults to 1 here rather than
+     * to the SDK's 3: a RequestResponse invoke whose response is lost has
+     * already run the callee, so a retry at this layer executes the operation
+     * a second time, and the transport contract says one call is one delivery
+     * attempt. Raise it deliberately if the callee is idempotent, or send an
+     * `idempotencyKey` and let the callee settle it.
+     */
     clientConfig?: LambdaClientConfig;
     /** Must match the callee's apiPath. Default: "/api". */
     apiPath?: string;
@@ -207,15 +123,6 @@ type LambderInvokeCallerBaseOptions = {
 };
 /** Constructor options: the base options plus guardInputsProvider, mandatory once TProvided names guards. */
 export type LambderInvokeCallerOptions<TContract, TProvided extends string = never> = LambderInvokeCallerBaseOptions & LambderGuardInputsProviderOption<TContract, TProvided>;
-/** The decoded HTTP answer of request(): status, lowercased headers, cookies and the body bytes (decompressed when the callee compressed them). */
-export type LambderInvokeHttpResult = {
-    statusCode: number;
-    headers: Record<string, string>;
-    cookies: string[];
-    body: Buffer;
-    text: () => string;
-    json: () => unknown;
-};
 export type LambderInvokeRequestInit = {
     /** Default: GET. */
     method?: string;
@@ -246,18 +153,11 @@ export type LambderInvokeEventInit = {
     session?: LambderInvokeSession;
     sessionTokenCookieKey?: string;
 };
-/**
- * Brotli one payload's JSON for sending, or null when the plain JSON should
- * go instead: the browser's compressPayloadGzip with Brotli, because both
- * ends are Node. The threshold and the only-when-smaller rule are
- * compressPayloadWith's, shared with the gzip side.
- */
-export declare const compressPayloadBrotli: (json: string, minBytes: number, quality: number) => Promise<LambderCompressedBrotliPayload | null>;
 /**
  * @typeParam TContract - The callee's API contract (`typeof lambder.ApiContract`, imported type-only), for typed names, payloads, results and guard inputs.
  * @typeParam TProvidedGuards - Guard names guardInputsProvider covers; those APIs' options argument becomes optional.
  */
-export default class LambderInvokeCaller<TContract extends ApiContractShape = any, TProvidedGuards extends string = never> {
+export default class LambderInvokeCaller<TContract extends LambderApiContractShape = any, TProvidedGuards extends string = never> {
     private readonly functionName;
     private readonly apiPath;
     private readonly apiVersion?;
@@ -283,24 +183,31 @@ export default class LambderInvokeCaller<TContract extends ApiContractShape = an
      * A transport that runs a callee's handler in this process, the way
      * Lambda would: a thrown error becomes a FunctionError payload. For
      * tests that want the real handlers behind the real envelope.
+     *
+     * It honours the signal the way lambderHandlerTransport does, by ending
+     * the wait: a function call in this process cannot be cancelled, so the
+     * handler runs to completion regardless and what a timeout buys is the
+     * caller's answer. Ignoring it made timeoutMs a no-op here.
      */
     static localTransport(handler: (event: APIGatewayProxyEventV2, context: Context) => Promise<unknown>, context?: Partial<Context>): LambderInvokeTransport;
     private loadSdk;
     private invokeThroughSdk;
-    /** Delivers one event, serialized exactly once; a rejected transport is a network or timeout failure. */
-    private deliver;
-    /** The function's answer as an HTTP result; throws when it is not one, or its compressed body cannot be restored. */
-    private decodeHttpResult;
+    /** Delivers one event, serialized exactly once; an event over the invoke cap, a rejected transport, or one that answered after the call was given up on, is a failure. */
+    private deliverEvent;
     /** Builds the failure and its error, reports it once, and hands it back. */
-    private fail;
+    private failureOutcome;
     private surfaceLogs;
     /** One call, one outcome. Never throws; api() is what throws. */
     private dispatch;
     /**
      * Full-fidelity call: resolves to a discriminated LambderInvokeOutcome
      * instead of throwing. Never throws; for sites that degrade gracefully.
+     *
+     * The output is computed from the contract in the return type rather than
+     * taken as a type parameter, so a call site cannot replace it by
+     * annotating what it assigns to.
      */
-    apiOutcome<TApiName extends keyof TContract & string = string, TOutput = TApiName extends keyof TContract ? TContract[TApiName]['output'] : any>(apiName: TApiName, payload?: TApiName extends keyof TContract ? TContract[TApiName]['input'] : any, ...rest: LambderCallOptionsArg<TContract, TApiName, TProvidedGuards, LambderInvokeCallOptions>): Promise<LambderInvokeOutcome<TOutput>>;
+    apiOutcome<TApiName extends keyof TContract & string = string>(apiName: TApiName, ...rest: LambderCallArgs<TContract, TApiName, TProvidedGuards, LambderInvokeCallOptions>): Promise<LambderInvokeOutcome<LambderContractOutputOf<TContract, TApiName>>>;
     /**
      * The declared output, or a thrown LambderInvokeError carrying the
      * outcome. A failed dependency is a failed request: the throw reaches the
@@ -310,13 +217,13 @@ export default class LambderInvokeCaller<TContract extends ApiContractShape = an
      * reason (LambderApiAnswer), so a nullable output is the one place null
      * arrives.
      */
-    api<TApiName extends keyof TContract & string = string, TOutput = TApiName extends keyof TContract ? TContract[TApiName]['output'] : any>(apiName: TApiName, payload?: TApiName extends keyof TContract ? TContract[TApiName]['input'] : any, ...rest: LambderCallOptionsArg<TContract, TApiName, TProvidedGuards, LambderInvokeCallOptions>): Promise<TOutput>;
+    api<TApiName extends keyof TContract & string = string>(apiName: TApiName, ...rest: LambderCallArgs<TContract, TApiName, TProvidedGuards, LambderInvokeCallOptions>): Promise<LambderContractOutputOf<TContract, TApiName>>;
     /**
      * Any route of the callee, untyped: the synthesized request and the
      * decoded answer, whatever its status. Throws a LambderInvokeError only
      * when no HTTP answer came back (a rejected invoke, a FunctionError, a
      * non-HTTP answer); those go through onFailure like an API call's.
      */
-    request(init: LambderInvokeRequestInit): Promise<LambderInvokeHttpResult>;
+    request(init: LambderInvokeRequestInit): Promise<LambderLambdaHttpResult>;
 }
 export {};