lambder 6.0.2 → 7.0.1

package/dist/shared/contracts/LambderIdempotencyStore.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The idempotency vocabulary every part of Lambder shares: what a stored
+ * answer looks like, what claiming a scope reports, and the four methods the
+ * idempotency engine asks of a store.
+ *
+ * Kept apart from the engine for the same reason LambderRateLimiter is:
+ * a store implements this and nothing else, and importing it from the engine
+ * would pull the engine (and through it the refusal machinery) into every
+ * store's import graph. Pure and dependency-free, so the mock runtime and the
+ * browser entry can resolve it.
+ */
+/** A stored answer: what a completed record replays. */
+export type LambderIdempotencyDoneRecord = {
+    statusCode: number;
+    /** Response headers stored with the record (normalized multi-value map). */
+    headers: Record<string, string[]>;
+    body: string;
+};
+export type LambderIdempotencyBeginResult = {
+    state: "new";
+    ownerToken: string;
+} | {
+    state: "pending";
+} | ({
+    state: "done";
+} & LambderIdempotencyDoneRecord);
+/**
+ * What the idempotency engine asks of a store: one record per scope, claimed
+ * atomically, settled by the claim's owner. LambderDdbIdempotencyStore and
+ * LambderMemoryIdempotencyStore implement it; an app may bring its own.
+ *
+ * The rules an implementation has to keep are the ones tests/store-conformance
+ * asserts against every implementation, and the three that are easy to get
+ * wrong are worth naming here.
+ *
+ * A read hands back a COPY of the record, never the stored object, because a
+ * caller applies its own headers onto what it gets back.
+ *
+ * A write takes a copy too: complete() must not keep the caller's record or
+ * its headers map, because that object goes on being used after the call
+ * returns (the pipeline writes the call's own headers into it on the way
+ * out). A store that retained it would let one request's Set-Cookie become
+ * part of the stored answer and replay to everybody else. A store that goes
+ * over the wire gets this for free, since serializing IS the copy; one that
+ * keeps the record in the process has to make it.
+ *
+ * Size decides before ownership does, so an answer too big to store reports
+ * "too-large" even when the claim has meanwhile been lost. The engine
+ * releases the claim either way, so the order only shows in which reason it
+ * is told, but an implementation that inverted it would disagree with every
+ * other one.
+ */
+export interface LambderIdempotencyStore {
+    /** The stored answer when a completed, unexpired record exists, null otherwise (absent, pending, or expired). */
+    peek(scopeKey: string): Promise<LambderIdempotencyDoneRecord | null>;
+    /** Claims the scope: "new" with the ownerToken to settle with, "pending" when another request owns it, "done" with the answer to replay. */
+    begin(scopeKey: string, options: {
+        pendingTtlSeconds: number;
+    }): Promise<LambderIdempotencyBeginResult>;
+    /** Stores the answer over the claim: "stored", "too-large" (nothing written; release the claim), or "lost" (the claim expired and a retry took the scope). */
+    complete(scopeKey: string, ownerToken: string, record: LambderIdempotencyDoneRecord & {
+        ttlSeconds: number;
+    }): Promise<"stored" | "too-large" | "lost">;
+    /** Releases the claim without storing; a lost claim makes this a silent no-op. */
+    abandon(scopeKey: string, ownerToken: string): Promise<void>;
+}

package/dist/shared/contracts/LambderIdempotencyStore.js

@@ -0,0 +1,12 @@
+/**
+ * The idempotency vocabulary every part of Lambder shares: what a stored
+ * answer looks like, what claiming a scope reports, and the four methods the
+ * idempotency engine asks of a store.
+ *
+ * Kept apart from the engine for the same reason LambderRateLimiter is:
+ * a store implements this and nothing else, and importing it from the engine
+ * would pull the engine (and through it the refusal machinery) into every
+ * store's import graph. Pure and dependency-free, so the mock runtime and the
+ * browser entry can resolve it.
+ */
+export {};

package/dist/shared/contracts/LambderRateLimiter.d.ts

@@ -0,0 +1,71 @@
+/**
+ * The rate-limit vocabulary every part of Lambder shares: the fixed windows a
+ * policy may cap, the policy shape, what an exceeded check reports, and the
+ * one method the rate-limit engine asks of a limiter.
+ *
+ * Kept apart from the DynamoDB limiter on purpose. The engine needs only this
+ * table, and importing it from the store would pull the DynamoDB SDK loader
+ * into the engine's import graph, which is what kept the policy layer from
+ * running anywhere but inside a Lambda. Pure and dependency-free, so the
+ * mock runtime and the browser entry can resolve it.
+ */
+/**
+ * The fixed windows a policy may cap, smallest first (the evaluation order),
+ * with their length. The policy type derives from this table, so the two can
+ * never drift.
+ */
+export declare const RATE_LIMIT_WINDOWS: readonly [{
+    readonly key: "perMin";
+    readonly seconds: 60;
+}, {
+    readonly key: "per10Min";
+    readonly seconds: number;
+}, {
+    readonly key: "perHour";
+    readonly seconds: number;
+}, {
+    readonly key: "perDay";
+    readonly seconds: number;
+}, {
+    readonly key: "perWeek";
+    readonly seconds: number;
+}, {
+    readonly key: "perMonth";
+    readonly seconds: number;
+}];
+export type LambderRateLimitWindow = (typeof RATE_LIMIT_WINDOWS)[number]["key"];
+/** Per-window caps. A window that is absent or 0 is not enforced. */
+export type LambderRateLimitPolicy = Partial<Record<LambderRateLimitWindow, number>>;
+/**
+ * The window that refused: which one, its limit, and the epoch second at
+ * which that fixed window resets (Retry-After derives from it).
+ */
+export type LambderRateLimitExceeded = {
+    window: LambderRateLimitWindow;
+    limit: number;
+    resetAt: number;
+};
+/** `false` when allowed, otherwise the window whose limit was hit. */
+export type LambderRateLimitResult = false | LambderRateLimitExceeded;
+/**
+ * What the rate-limit engine asks of a limiter: count one attempt against
+ * every window the policy caps and say whether any of them is over. The
+ * DynamoDB limiter and the in-memory one implement it; an app may bring its
+ * own (Redis, a database) by implementing this one method.
+ *
+ * The engine validates a policy before it ever reaches here, so every capped
+ * window arrives as a non-negative whole number and a limiter never has to
+ * invent an answer for a nonsense one. A caller reaching isRateLimited
+ * directly owes the same precondition: the two shipped implementations
+ * disagree on a negative cap (one refuses the first attempt, the other allows
+ * it) because neither was ever meant to be asked.
+ *
+ * The tracker key is bounded there too: the variable half of it (a custom
+ * key handler's return, a session key) is replaced by its own sha256 past
+ * 1024 UTF-8 bytes, so an implementation with a key limit of its own never
+ * meets a key it has to refuse. That matters because a limiter's refusal is a
+ * throw, and a throw is what failOpen swallows into no limit at all.
+ */
+export interface LambderRateLimiter {
+    isRateLimited(trackerKey: string, policy: LambderRateLimitPolicy): Promise<LambderRateLimitResult>;
+}

package/dist/shared/contracts/LambderRateLimiter.js

@@ -0,0 +1,24 @@
+/**
+ * The rate-limit vocabulary every part of Lambder shares: the fixed windows a
+ * policy may cap, the policy shape, what an exceeded check reports, and the
+ * one method the rate-limit engine asks of a limiter.
+ *
+ * Kept apart from the DynamoDB limiter on purpose. The engine needs only this
+ * table, and importing it from the store would pull the DynamoDB SDK loader
+ * into the engine's import graph, which is what kept the policy layer from
+ * running anywhere but inside a Lambda. Pure and dependency-free, so the
+ * mock runtime and the browser entry can resolve it.
+ */
+/**
+ * The fixed windows a policy may cap, smallest first (the evaluation order),
+ * with their length. The policy type derives from this table, so the two can
+ * never drift.
+ */
+export const RATE_LIMIT_WINDOWS = [
+    { key: "perMin", seconds: 60 },
+    { key: "per10Min", seconds: 10 * 60 },
+    { key: "perHour", seconds: 60 * 60 },
+    { key: "perDay", seconds: 24 * 60 * 60 },
+    { key: "perWeek", seconds: 7 * 24 * 60 * 60 },
+    { key: "perMonth", seconds: 30 * 24 * 60 * 60 },
+];

package/dist/shared/contracts/LambderSessionStore.d.ts

@@ -0,0 +1,72 @@
+/**
+ * What a session is at rest, and what the session manager asks of the place
+ * it rests in.
+ *
+ * The manager owns the model (token format, hashing, expiry, sliding
+ * writes, dataRefresh, regeneration); a store owns nothing but the five
+ * operations below, keyed by the two hashes. LambderDdbSessionStore is the
+ * DynamoDB implementation and LambderMemorySessionStore the in-memory one;
+ * an app may bring its own (Redis, a database) by implementing this
+ * interface. Records written by one store read back through another with
+ * the same shape, because the shape is the manager's, not the store's.
+ */
+/**
+ * A session record. The two hashes are the record's identity: the partition
+ * is a salted hash of the app's sessionKey (a user id, say) and the sort key
+ * is a hash of the bearer secret the client holds. The raw secrets are never
+ * stored, so a read of the store yields no usable credentials.
+ */
+export type LambderSessionRecord<SessionData = unknown> = {
+    /** Salted sha256 of the sessionKey: the partition every session of one subject shares. */
+    sessionKeyHash: string;
+    /** sha256 of the sort-key secret the client's session cookie carries. */
+    secretHash: string;
+    /** sha256 of the raw CSRF token the client's csrf cookie carries. */
+    csrfTokenHash: string;
+    /** The app's own key for the subject (a user id), as given to createSession. */
+    sessionKey: string;
+    data: SessionData;
+    /** Epoch seconds. */
+    createdAt: number;
+    expiresAt: number;
+    lastAccessedAt: number;
+    ttlInSeconds: number;
+    /**
+     * When `data` must be renewed via the dataRefresh callback (epoch seconds).
+     * Only present when dataRefresh is configured; independent of the
+     * session's own expiresAt.
+     */
+    dataExpiresAt?: number;
+};
+export interface LambderSessionStore<SessionData = unknown> {
+    /**
+     * Whether records live only for as long as this process does. The session
+     * manager reads it to refuse a non-cryptographic LambderSessionCrypto
+     * over a store that outlives the process: hashing that is not hashing is
+     * survivable in memory for a development run and never survivable at
+     * rest, where the records would be usable credentials.
+     */
+    readonly isMemoryOnly: boolean;
+    /**
+     * The record under the two hashes, or null. A failing read throws; the
+     * manager wraps it as a LambderSessionReadError.
+     *
+     * A store MAY hand back a record that is past its expiresAt: a DynamoDB
+     * TTL deletes within days rather than at the second, and an implementation
+     * over a plain table has nothing that sweeps at all. Expiry is the
+     * manager's to enforce, and it does, on every read. A store that drops
+     * expired records itself is doing housekeeping, not policy.
+     */
+    get(sessionKeyHash: string, secretHash: string): Promise<LambderSessionRecord<SessionData> | null>;
+    /** Writes the record, replacing any under the same hashes. */
+    put(record: LambderSessionRecord<SessionData>): Promise<void>;
+    delete(sessionKeyHash: string, secretHash: string): Promise<void>;
+    /** Every secretHash stored under the partition: the sessions of one subject. */
+    listSecretHashes(sessionKeyHash: string): Promise<string[]>;
+    /**
+     * Stamps dataExpiresAt on one record, only if it still exists: neither
+     * resurrects a session deleted in between nor overwrites a concurrent
+     * write. A record that no longer exists is skipped silently.
+     */
+    markDataExpired(sessionKeyHash: string, secretHash: string, at: number): Promise<void>;
+}

package/dist/shared/contracts/LambderSessionStore.js

@@ -0,0 +1,13 @@
+/**
+ * What a session is at rest, and what the session manager asks of the place
+ * it rests in.
+ *
+ * The manager owns the model (token format, hashing, expiry, sliding
+ * writes, dataRefresh, regeneration); a store owns nothing but the five
+ * operations below, keyed by the two hashes. LambderDdbSessionStore is the
+ * DynamoDB implementation and LambderMemorySessionStore the in-memory one;
+ * an app may bring its own (Redis, a database) by implementing this
+ * interface. Records written by one store read back through another with
+ * the same shape, because the shape is the manager's, not the store's.
+ */
+export {};

package/dist/shared/transport/LambderApiTransport.d.ts

@@ -0,0 +1,139 @@
+import type { LambderApiHttpAnswer } from "../wire/LambderApiOutcome.js";
+import type { LambderCompressedGzipPayload, LambderCompressedBrotliPayload } from "../wire/LambderRequestPayload.js";
+/**
+ * What LambderCaller hands its transport: the envelope fields of one call
+ * plus what a transport may need beside them. Cookies and the client IP are
+ * for transports that build the request themselves (in-process, mock); the
+ * browser's fetch attaches its own cookies and ignores both.
+ */
+export type LambderApiTransportRequest = {
+    apiPath: string;
+    apiName: string;
+    version?: string;
+    /** The CSRF token the caller read from its cookie; "" when it holds none. */
+    token: string;
+    /**
+     * The cookie name the caller reads that token from. A transport that
+     * fills the token in itself (the cookie-jar decorator, where there is no
+     * document to read) needs the same name, and taking it from the caller is
+     * what keeps the two from being configured apart.
+     */
+    csrfCookieKey?: string;
+    siteHost: string;
+    /** The payload, when it goes plainly. */
+    payload?: unknown;
+    /** The compressed pair, when it goes compressed instead of `payload`. */
+    compressed?: LambderCompressedGzipPayload | LambderCompressedBrotliPayload;
+    guardInputs?: Record<string, unknown>;
+    idempotencyKey?: string;
+    headers?: Record<string, string>;
+    /** Cookie header pairs, `name=value`. */
+    cookies?: string[];
+    clientIp?: string;
+    signal?: AbortSignal;
+};
+/**
+ * Why a transport could not deliver a call. `network` is the default reading
+ * of a rejection: nothing came back. `protocol` says the call reached the
+ * callee and no answer came of it, either because what came back was not one
+ * or because the callee threw instead of answering, which is a server or
+ * wiring fault and should not be reported to a developer as flaky
+ * connectivity. `timeout` belongs to the caller, which knows whether its own
+ * abort fired.
+ */
+export type LambderTransportFailureReason = "network" | "protocol";
+/**
+ * A transport saying why it failed, instead of leaving the caller to assume.
+ * Thrown by a transport; the caller reads `reason` and keeps `cause`, so the
+ * thing that actually went wrong survives the trip.
+ */
+export declare class LambderTransportFailure extends Error {
+    readonly isLambderTransportFailure: true;
+    readonly reason: LambderTransportFailureReason;
+    constructor(reason: LambderTransportFailureReason, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Brand-based type guard, so a duplicate install of the package still matches. */
+export declare const isLambderTransportFailure: (err: unknown) => err is LambderTransportFailure;
+/**
+ * Delivers one call and hands back the answer in the accessor form
+ * resolveApiOutcome() reads. What a transport owes its caller, since nothing
+ * but this contract stands between a call and a wrong outcome:
+ *
+ * - **Any HTTP status is an answer.** A 4xx or 5xx resolves, status and body
+ *   included, because resolveApiOutcome() is the one place that reads what a
+ *   status means. A transport that rejects on a status throws away the
+ *   envelope a refusal, a validation failure or a crash arrived in.
+ * - **A rejection is a transport failure.** The caller reports it as
+ *   `network` unless the transport threw a LambderTransportFailure naming
+ *   another reason, or `timeout` when the caller's own abort fired. That is
+ *   the channel for the real cause too: a LambderTransportFailure keeps it as
+ *   `cause`, where the caller's `outcome.error` carries it.
+ * - **`request.signal` must be honoured**, by rejecting as soon as it aborts.
+ *   It is the only thing that makes the caller's `timeoutMs` and its per-call
+ *   `signal` mean anything: a transport that ignores it leaves a call waiting
+ *   for as long as the callee takes, whatever the caller asked for. Work
+ *   already begun need not be cancellable (an in-process handler is not); the
+ *   obligation is to stop waiting, not to stop the callee.
+ * - **Timeouts and retries belong to the caller.** A transport starts no
+ *   clock of its own and retries nothing, so one call is one delivery
+ *   attempt and an idempotency key means what it says.
+ *
+ * Four transports ship: fetch (lambderFetchTransport, the browser default),
+ * an in-process Lambder handler (lambderHandlerTransport, for tests), the
+ * mock runtime (LambderMockApp.transport), and a cookie-jar decorator over
+ * any of them (lambderCookieJarTransport).
+ */
+export type LambderApiTransport = (request: LambderApiTransportRequest) => Promise<LambderApiHttpAnswer>;
+/**
+ * The fields of the request envelope, in the order they go on the wire: the
+ * one statement of what a call sends, for every sender there is.
+ *
+ * Two senders write it. A transport hands the payload over as a value
+ * (buildTransportEnvelope, below); LambderInvokeCaller has already serialized
+ * its payload to decide whether to compress it, and splices that JSON onto the
+ * end rather than parsing and stringifying it a second time
+ * (buildEnvelopeJson, in invoke/LambderLambdaEvent.ts). The splice sits on top
+ * of this function precisely so that a new envelope field cannot be added to
+ * one sender and missed by the other, which nothing on the wire would catch.
+ */
+export declare const buildEnvelopeFields: (fields: {
+    apiName: string;
+    version?: string;
+    /** The CSRF token, as the envelope names it. */
+    token: string;
+    siteHost: string;
+    /**
+     * The plain payload's slot: `{ payload }` from a sender holding the value,
+     * and nothing from one that splices its own JSON in afterwards. A
+     * compressed payload replaces it.
+     */
+    payloadSlot?: {
+        payload: unknown;
+    };
+    compressed?: LambderCompressedGzipPayload | LambderCompressedBrotliPayload | null;
+    guardInputs?: Record<string, unknown>;
+    idempotencyKey?: string;
+}) => Record<string, unknown>;
+/**
+ * The body envelope every transport posts, as a plain object: the same
+ * fields whichever transport carries them, so the server and the mock
+ * runtime read one shape.
+ */
+export declare const buildTransportEnvelope: (request: LambderApiTransportRequest) => Record<string, unknown>;
+/**
+ * Where a call is actually going, read off its apiPath: an absolute one names
+ * the host and the scheme the request reaches, a relative one only its path.
+ * Both the cookie-jar decorator (a cookie's scope is the host and path of the
+ * request, not of the page) and the in-process handler transport (whose event
+ * needs a path, not a URL, or no route matches) split it this way.
+ */
+type LambderApiPathTarget = {
+    host?: string;
+    path: string;
+    /** Whether the target speaks https; undefined when the apiPath names no scheme. */
+    secure?: boolean;
+};
+export declare const resolveApiPathTarget: (apiPath: string) => LambderApiPathTarget;
+export {};

package/dist/shared/transport/LambderApiTransport.js

@@ -0,0 +1,65 @@
+/**
+ * A transport saying why it failed, instead of leaving the caller to assume.
+ * Thrown by a transport; the caller reads `reason` and keeps `cause`, so the
+ * thing that actually went wrong survives the trip.
+ */
+export class LambderTransportFailure extends Error {
+    isLambderTransportFailure = true;
+    reason;
+    constructor(reason, message, options = {}) {
+        super(message, options.cause !== undefined ? { cause: options.cause } : undefined);
+        this.name = "LambderTransportFailure";
+        this.reason = reason;
+    }
+}
+/** Brand-based type guard, so a duplicate install of the package still matches. */
+export const isLambderTransportFailure = (err) => err instanceof Error && err.isLambderTransportFailure === true;
+/**
+ * The fields of the request envelope, in the order they go on the wire: the
+ * one statement of what a call sends, for every sender there is.
+ *
+ * Two senders write it. A transport hands the payload over as a value
+ * (buildTransportEnvelope, below); LambderInvokeCaller has already serialized
+ * its payload to decide whether to compress it, and splices that JSON onto the
+ * end rather than parsing and stringifying it a second time
+ * (buildEnvelopeJson, in invoke/LambderLambdaEvent.ts). The splice sits on top
+ * of this function precisely so that a new envelope field cannot be added to
+ * one sender and missed by the other, which nothing on the wire would catch.
+ */
+export const buildEnvelopeFields = (fields) => ({
+    apiName: fields.apiName,
+    version: fields.version,
+    token: fields.token,
+    siteHost: fields.siteHost,
+    ...(fields.compressed ?? fields.payloadSlot ?? {}),
+    ...(fields.guardInputs !== undefined ? { guardInputs: fields.guardInputs } : {}),
+    ...(fields.idempotencyKey !== undefined ? { idempotencyKey: fields.idempotencyKey } : {}),
+});
+/**
+ * The body envelope every transport posts, as a plain object: the same
+ * fields whichever transport carries them, so the server and the mock
+ * runtime read one shape.
+ */
+export const buildTransportEnvelope = (request) => buildEnvelopeFields({
+    apiName: request.apiName,
+    version: request.version,
+    token: request.token,
+    siteHost: request.siteHost,
+    payloadSlot: { payload: request.payload },
+    compressed: request.compressed,
+    guardInputs: request.guardInputs,
+    idempotencyKey: request.idempotencyKey,
+});
+export const resolveApiPathTarget = (apiPath) => {
+    // Only an absolute URL carries a host. Parsing "/api" would need a base,
+    // and inventing one invents a host to go with it.
+    if (!/^https?:\/\//i.test(apiPath))
+        return { path: apiPath };
+    try {
+        const url = new URL(apiPath);
+        return { host: url.hostname, path: url.pathname, secure: url.protocol === "https:" };
+    }
+    catch {
+        return { path: apiPath };
+    }
+};

package/dist/shared/transport/LambderCookieJar.d.ts

@@ -0,0 +1,121 @@
+/**
+ * The cookie jar a transport carries (LambderCookieJar), and the Set-Cookie
+ * parsing behind it. tough-cookie is reached from this module and no other, so
+ * a bundle that never carries a jar drops it.
+ */
+/** A cookie as the jar holds it. Epoch milliseconds for `expires`, and `host` set only for a host-only cookie. */
+export type LambderStoredCookie = {
+    name: string;
+    value: string;
+    /** The Domain attribute, without its leading dot; undefined for a host-only cookie. */
+    domain: string | undefined;
+    /** The host that set it, when it carried no Domain. Absent when the jar never learned a host. */
+    host?: string;
+    path: string;
+    /** Epoch milliseconds; undefined for a browser-session cookie. */
+    expires: number | undefined;
+    httpOnly: boolean;
+    /** Withheld from a target known to be plain http; a target of unknown scheme (in-process, mock) still carries it. */
+    secure: boolean;
+};
+/** Where a call is going, as far as a cookie's scope is concerned. An absent field is one the caller could not know, and matches anything. */
+type LambderCookieTarget = {
+    host?: string;
+    path?: string;
+    /** False only for a target known to speak plain http, which neither accepts a Secure cookie nor sends one. */
+    secure?: boolean;
+};
+/**
+ * One Set-Cookie header value, read the way a browser reads it. `requestPath`
+ * is the path the answer came from, which decides the default Path. Returns
+ * null for a header no browser would keep.
+ */
+export declare const parseSetCookie: (header: string, now: number, requestPath?: string) => LambderStoredCookie | null;
+/**
+ * A browser's cookie storage, for transports that have no browser: the
+ * in-process handler transport in a Node test, and the mock runtime's direct
+ * transport. It stores what an answer's Set-Cookie headers set, honours their
+ * expiry and deletion, and hands back the Cookie pairs the next request should
+ * carry. One jar is one browser; two jars are two.
+ *
+ * The rules themselves are tough-cookie's, which is the reference
+ * implementation of RFC 6265 and carries the public suffix list: domain and
+ * path matching, default-path, Max-Age against Expires, Secure, HttpOnly, and
+ * the __Host-/__Secure- prefixes. That list is the part worth importing rather
+ * than writing. A hand-rolled check can tell that `Domain=com` is a registry
+ * suffix by counting labels, and cannot tell that `co.uk` is one, so a
+ * hand-rolled jar either trusts `Domain=co.uk` or bans every two-label domain.
+ *
+ * What stays Lambder's is the shape of the questions a transport asks: whole
+ * Set-Cookie header lists in (storeSetCookies), `name=value` pairs out
+ * (cookiePairs), and a target given as a host and path rather than a URL,
+ * since a transport that never speaks HTTP has no URL to give. A field the
+ * caller omits is one it could not know, and an unknown field matches
+ * anything: a jar pointed at a single host is the ordinary case, and refusing
+ * to answer it until it can name that host would make the common setup the
+ * awkward one.
+ *
+ * SameSite is stored but never consulted. It answers "did another site
+ * initiate this", and a transport call has no initiating site: every call here
+ * is same-site by construction.
+ */
+export declare class LambderCookieJar {
+    private readonly jar;
+    private readonly now;
+    private readonly host;
+    /** `host` is the host this jar is the browser of: the sender of every answer and the target of every request that names none. */
+    constructor(options?: {
+        now?: () => number;
+        host?: string;
+    });
+    /** The host a call is about, or the stand-in when neither the call nor the jar names one. */
+    private hostFor;
+    /**
+     * Applies Set-Cookie header values as a browser would: stores, replaces,
+     * and deletes on an expiry in the past. `request` says where the answer
+     * came from. Its `host` is the sending host, which every Domain is checked
+     * against, and its `path` is the default Path of a cookie that names none.
+     *
+     * A Domain the sender is not under does not narrow a cookie, it voids it
+     * (RFC 6265 section 5.3 step 6), and so does a Domain that is a public
+     * suffix. Both are how evil.example.com would otherwise plant a cookie
+     * that bank.example.com is handed on the next call.
+     */
+    storeSetCookies(headers: readonly string[], request?: LambderCookieTarget): void;
+    /** Every live cookie. */
+    list(): LambderStoredCookie[];
+    /**
+     * The Cookie header pairs the next request carries, as `name=value`, in
+     * the order RFC 6265 section 5.4 puts them in: the longest Path first,
+     * and among equal paths the one set first. Servers that read only the
+     * first value of a repeated name depend on that order, and so does any
+     * test reasoning about which of two same-named cookies wins.
+     *
+     * Only the cookies whose scope covers the target travel. A field the
+     * target leaves out is one the caller could not know, and matches
+     * anything: a caller that cannot name its own host still gets the cookies
+     * of the one host its jar talks to.
+     */
+    cookiePairs(target?: LambderCookieTarget): string[];
+    /**
+     * One cookie's value as a page's script would read it: HttpOnly cookies
+     * are invisible unless asked for, which is how the transport fills in the
+     * CSRF token the caller would have read from document.cookie.
+     */
+    get(name: string, options?: {
+        includeHttpOnly?: boolean;
+    } & LambderCookieTarget): string | undefined;
+    /**
+     * The live cookies whose scope reaches this target, in RFC 6265 send
+     * order. Delegated to tough-cookie whenever the target names a host,
+     * which is the case worth getting exactly right; an unnamed host falls
+     * back to every cookie the jar holds, filtered by the rules that do not
+     * need one and ordered by the same rule.
+     */
+    private matchingCookies;
+    /** Number of live cookies. */
+    get size(): number;
+    /** Forgets every cookie: the browser's storage cleared. */
+    clear(): void;
+}
+export {};