lambder 7.2.2 → 7.2.4

package/CHANGELOG.md

@@ -9,6 +9,51 @@ sit on its first published patch, and later patches list only what they changed.
 Releases up to 3.2.6 carry git tags; the ones after it were published without
 one, so versions are not cross-linked to tag comparisons here.
 
+## [7.2.4] - 2026-09-19
+
+### Changed
+
+- **The mock's options are checked against the contract at compile time.**
+  Only the guard map was before, so a mock whose other options no longer fit
+  the contract compiled and then threw when its registry loaded, which in a
+  dev server is a blank page and an error in the browser console. Now each of
+  these is a type error at `create()`:
+  - `rateLimits.policies` leaving out a policy an endpoint references (a
+    policy added on the server and not to the mock);
+  - `sessions`, `idempotency` or `rateLimits` left out (or switched off)
+    while the contract has an endpoint that needs it, the way `guards`
+    already was;
+  - a guard with `session: true`, or a policy keyed `per: "session"`, where a
+    public endpoint names it;
+  - a `perPolicy` budget on a policy whose windows an endpoint overrides.
+
+  Each of these was already refused at registration, so a mock that compiles
+  now behaves as it did. The runtime checks stay for callers the types do not
+  reach.
+
+### Added
+
+- **`LambderContractRateLimitNames<C, M?>`**, from both entries: every
+  rate-limit policy name the contract references, the twin of
+  `LambderContractGuardNames`. Both now take an optional mode to read only the
+  public or only the session endpoints.
+
+## [7.2.3] - 2026-09-19
+
+### Added
+
+- **`extensibleEnum(schema)`**, exported from both entries: marks an enum
+  whose readers tolerate values they were not built with, and the signature
+  digest leaves its values out wherever it is output. A list that grows with
+  the product (roles, permissions, statuses) and rides in a widely returned
+  payload changed the signature of every endpoint returning it, so one new
+  permission reloaded every open tab. With the mark, the list growing or
+  shrinking reloads only the clients of endpoints that take it as input,
+  where its values still count because a removed value is a request the
+  server now refuses. The schema's type and validation are unchanged; the
+  mark is zod metadata, read from zod's shared registry. An unmarked enum
+  digests exactly as before, so upgrading changes no signature.
+
 ## [7.2.2] - 2026-09-18
 
 ### Added

package/dist/api/LambderApiSignature.d.ts

@@ -24,9 +24,11 @@ export type LambderApiSignatureEntry = {
  *
  * The description is hashed as built, descriptions and titles included: a
  * schema is what the server says it is, and a client built against a
- * different one reloads once. What must hold for the digest to mean anything
- * is that a schema is built from static values: one that reads the clock, a
- * random source or the environment at construction digests differently in
- * the generator's process and on the server.
+ * different one reloads once, with one exception the schema declares itself:
+ * the values of an extensibleEnum() in an output (see keepShapeOnly). What
+ * must hold for the digest to mean anything is that a schema is built from
+ * static values: one that reads the clock, a random source or the environment
+ * at construction digests differently in the generator's process and on the
+ * server.
  */
 export declare const apiSignatureOf: (definition: LambderApiDefinition, guards: Record<string, LambderApiGuard<any, any, any>> | undefined) => Promise<string>;

package/dist/api/LambderApiSignature.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { toGuardEntries } from "./LambderApiGuards.js";
-import { API_SIGNATURE_HEX_LENGTH } from "../shared/wire/LambderApiSignature.js";
+import { API_SIGNATURE_HEX_LENGTH, EXTENSIBLE_ENUM_META_KEY } from "../shared/wire/LambderApiSignature.js";
 import { sha256HexOf } from "../shared/util/LambderTextDigest.js";
 /*
  * The digest of an endpoint's client-facing shape, computed once, by the
@@ -30,7 +30,7 @@ const sortKeys = (value) => {
     return sorted;
 };
 /**
- * Two edits to every node zod emits, before it is hashed.
+ * Three edits to every node zod emits, before it is hashed.
  *
  * The `default` keyword goes. Its value is server behaviour, not shape: a
  * client never sends it, and its compiled types do not carry it. And for a
@@ -44,11 +44,24 @@ const sortKeys = (value) => {
  *
  * `required` is sorted. It is a set, and the order fields are declared in is
  * not shape either; left as emitted, reordering two fields forced a reload.
+ *
+ * An enum marked with extensibleEnum() loses its values in an output. Its
+ * clients tolerate a value they do not know, so a response carrying one they
+ * were not built with, or no longer carrying one they were, changes nothing
+ * they can see; the node still says it holds a string. In an input the values
+ * stay, since a value dropped from the list is a request an older client may
+ * still send and the server now refuses. The mark itself goes in both, so
+ * marking an enum changes no input's digest.
  */
-const keepShapeOnly = (node) => {
+const keepShapeOnly = (node, io) => {
     delete node.default;
     if (Array.isArray(node.required))
         node.required.sort();
+    if (node[EXTENSIBLE_ENUM_META_KEY] === true) {
+        delete node[EXTENSIBLE_ENUM_META_KEY];
+        if (io === "output")
+            delete node.enum;
+    }
 };
 /**
  * A schema as JSON Schema, as zod emits it minus what keepShapeOnly removes.
@@ -56,7 +69,7 @@ const keepShapeOnly = (node) => {
  * becomes `{}` rather than throwing, because a digest has to exist for every
  * endpoint; what the digest cannot see is documented with it.
  */
-const jsonSchemaOf = (schema, io) => schema ? z.toJSONSchema(schema, { io, unrepresentable: "any", override: ({ jsonSchema }) => keepShapeOnly(jsonSchema) }) : null;
+const jsonSchemaOf = (schema, io) => schema ? z.toJSONSchema(schema, { io, unrepresentable: "any", override: ({ jsonSchema }) => keepShapeOnly(jsonSchema, io) }) : null;
 const ownGuard = (guards, name) => guards !== undefined && Object.prototype.hasOwnProperty.call(guards, name) ? guards[name] : undefined;
 /**
  * The digest of an endpoint's client-facing shape: its name and mode, its
@@ -69,10 +82,12 @@ const ownGuard = (guards, name) => guards !== undefined && Object.prototype.hasO
  *
  * The description is hashed as built, descriptions and titles included: a
  * schema is what the server says it is, and a client built against a
- * different one reloads once. What must hold for the digest to mean anything
- * is that a schema is built from static values: one that reads the clock, a
- * random source or the environment at construction digests differently in
- * the generator's process and on the server.
+ * different one reloads once, with one exception the schema declares itself:
+ * the values of an extensibleEnum() in an output (see keepShapeOnly). What
+ * must hold for the digest to mean anything is that a schema is built from
+ * static values: one that reads the clock, a random source or the environment
+ * at construction digests differently in the generator's process and on the
+ * server.
  */
 export const apiSignatureOf = async (definition, guards) => {
     const guardShapes = toGuardEntries(definition.guards).map(({ name }) => {

package/dist/client.d.ts

@@ -15,7 +15,7 @@ export type { LambderApiTransport, LambderApiTransportRequest, LambderTransportF
 export { LambderCookieJar, parseSetCookie } from "./shared/transport/LambderCookieJar.js";
 export type { LambderStoredCookie } from "./shared/transport/LambderCookieJar.js";
 export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";
-export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH } from "./shared/wire/LambderApiSignature.js";
+export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignature.js";
 export type { LambderApiSignatureMap } from "./shared/wire/LambderApiSignature.js";
 export { RELOAD_LOOP_WINDOW_MS } from "./client/LambderReloadLoopBreaker.js";
 export { compareDottedVersions, isDottedVersion } from "./shared/wire/LambderVersionOrder.js";
@@ -23,7 +23,7 @@ export type { LambderApiAnswerOutcome, LambderApiSuccessOutcome, LambderApiCallF
 export type { LambderApiOutcome, LambderApiFailureReason, LambderValidationError, LambderCallOptions, LambderCallerOptions, LambderGuardInputsProvider, LambderProvidedGuardInputs, LambderIdempotencyKeyScope, LambderLogListHandler, } from "./client/LambderCaller.js";
 export { LambderApiRefusal, isLambderApiRefusal, refuse, LAMBDER_REFUSAL_CODES } from "./shared/wire/LambderApiRefusal.js";
 export type { LambderApiRefusalOptions, LambderRefusalMessage, LambderAppRefusalMessage, LambderRefusalCode, LambderRefuseOptions } from "./shared/wire/LambderApiRefusal.js";
-export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiResponseConfig, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";
+export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiResponseConfig, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractRateLimitNames, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";
 export { describeCrash, errorFromCrashDetail } from "./shared/wire/LambderCrashDetail.js";
 export type { LambderCrashDetail, LambderCrashCause } from "./shared/wire/LambderCrashDetail.js";
 export { compressPayloadGzip, isRequestCompressionAvailable, COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BR_FIELD, COMPRESSED_PAYLOAD_BYTES_FIELD, DEFAULT_REQUEST_COMPRESSION_SETTINGS, } from "./shared/wire/LambderRequestPayload.js";

package/dist/client.js

@@ -14,8 +14,9 @@ export { buildTransportEnvelope, LambderTransportFailure, isLambderTransportFail
 export { lambderCookieJarTransport } from "./shared/transport/lambderCookieJarTransport.js";
 export { LambderCookieJar, parseSetCookie } from "./shared/transport/LambderCookieJar.js";
 export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";
-// The per-endpoint signature map a build ships with, how a caller reads it, and the reload-loop window.
-export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH } from "./shared/wire/LambderApiSignature.js";
+// The per-endpoint signature map a build ships with, how a caller reads it, the
+// mark a shared schema sets on an enum its readers let grow, and the reload-loop window.
+export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignature.js";
 export { RELOAD_LOOP_WINDOW_MS } from "./client/LambderReloadLoopBreaker.js";
 export { compareDottedVersions, isDottedVersion } from "./shared/wire/LambderVersionOrder.js";
 // Typed API refusals (isomorphic: shared code may throw them from anywhere;

package/dist/index.d.ts

@@ -27,7 +27,7 @@ export type { LambderApiCallContext, LambderApiCallTrace } from "./api/LambderAp
 export type { LambderApiDefinition } from "./api/LambderApiDefinition.js";
 export { apiSignatureOf } from "./api/LambderApiSignature.js";
 export type { LambderApiSignatureEntry } from "./api/LambderApiSignature.js";
-export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH } from "./shared/wire/LambderApiSignature.js";
+export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignature.js";
 export type { LambderApiSignatureMap } from "./shared/wire/LambderApiSignature.js";
 export { RELOAD_LOOP_WINDOW_MS } from "./client/LambderReloadLoopBreaker.js";
 export { compareDottedVersions, isDottedVersion } from "./shared/wire/LambderVersionOrder.js";
@@ -104,7 +104,7 @@ export type { LambderApiIdempotencyConfig } from "./api/LambderApiIdempotency.js
 export type { LambderGuardsOptionValue, LambderRateLimitOverride, LambderRateLimitOptionValue, LambderApiIdempotencyOption, } from "./shared/wire/LambderApiOptionValues.js";
 export { createLambderI18n } from "./shared/LambderI18n.js";
 export type { LambderLanguageMeta, LambderI18nConfig, LambderI18nInstance, LambderI18nTranslator, LambderI18nExtractParams, LambderI18nDictionaryLoader, LambderI18nCodes, LambderI18nKeys, LambderI18nTranslatorFor, } from "./shared/LambderI18n.js";
-export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiResponseConfig, LambderApiNullAnswerConfig, LambderContractEntry, LambderMergeContract, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";
+export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiResponseConfig, LambderApiNullAnswerConfig, LambderContractEntry, LambderMergeContract, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractRateLimitNames, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";
 export type { LambderRenderContext, LambderSessionRenderContext, LambderHttpEvent, LambderHttpEventFormat } from "./core/LambderContext.js";
 export type { LambderApiAnswerOutcome, LambderApiSuccessOutcome, LambderApiCallFailure, LambderApiValidationFailure, LambderApiEnvelopeFailure, LambderApiHttpAnswer, } from "./shared/wire/LambderApiOutcome.js";
 export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";

package/dist/index.js

@@ -18,7 +18,7 @@ export { LambderAnswerHeaders, getAnswerHeader, setAnswerHeader, addAnswerHeader
 export { createApiCallContext } from "./api/LambderApiCallContext.js";
 // Per-endpoint signatures: what a client build ships with, digested from the server's own registrations.
 export { apiSignatureOf } from "./api/LambderApiSignature.js";
-export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH } from "./shared/wire/LambderApiSignature.js";
+export { apiNameKeyOf, lookupApiSignature, readApiSignature, API_SIGNATURE_HEX_LENGTH, extensibleEnum } from "./shared/wire/LambderApiSignature.js";
 export { RELOAD_LOOP_WINDOW_MS } from "./client/LambderReloadLoopBreaker.js";
 export { compareDottedVersions, isDottedVersion } from "./shared/wire/LambderVersionOrder.js";
 export { buildApiEnvelope, envelopeAnswer, refusalAnswer, validationAnswer, apiNotFoundAnswer, sessionExpiredAnswer, versionExpiredAnswer, invalidPayloadAnswer, crashAnswer, API_ANSWER_CONTENT_TYPE, } from "./api/LambderApiEnvelope.js";

package/dist/mock/LambderMockCreateOptions.d.ts

@@ -1,12 +1,12 @@
 import type { LambderApiSignatureMap } from "../shared/wire/LambderApiSignature.js";
-import type { LambderContractGuardNames } from "../shared/wire/LambderApiContract.js";
+import type { LambderContractGuardNames, LambderContractIdempotencyOf, LambderContractKeysWithMode, LambderContractRateLimitNames, LambderContractRateLimitOf } from "../shared/wire/LambderApiContract.js";
 import type { LambderApiGuard } from "../api/LambderApiGuards.js";
 import type { LambderApiRateLimitPolicyConfig } from "../api/LambderApiRateLimits.js";
 import type { LambderApiRequest } from "../api/LambderApiRequest.js";
 import type { LambderApiTransport } from "../shared/transport/LambderApiTransport.js";
 import type { LambderCookieJar } from "../shared/transport/LambderCookieJar.js";
 import type { LambderIdempotencyStore } from "../shared/contracts/LambderIdempotencyStore.js";
-import type { LambderRateLimiter } from "../shared/contracts/LambderRateLimiter.js";
+import type { LambderRateLimiter, LambderRateLimitWindow } from "../shared/contracts/LambderRateLimiter.js";
 import type { LambderSessionStore } from "../shared/contracts/LambderSessionStore.js";
 import type { LambderSessionDataRefreshConfig } from "../session/LambderSessionManager.js";
 import type { LambderSessionCookieOptions } from "../session/LambderSessionController.js";
@@ -60,19 +60,52 @@ export type LambderMockIdempotencyOptions<S = any> = {
      */
     callerIdentity?: (ctx: Omit<LambderMockCallContext<S>, "session">, request: LambderApiRequest) => string | null | Promise<string | null>;
 };
+/** Policy names whose windows some endpoint of the contract overrides, in the map form of its rateLimit option. */
+type LambderContractWindowOverrideNames<C> = {
+    [K in keyof C]: LambderWindowOverrideNamesIn<LambderContractRateLimitOf<C, K>>;
+}[keyof C] & string;
+type LambderWindowOverrideNamesIn<R> = R extends string | readonly string[] ? never : {
+    [N in keyof R]: R[N] extends object ? ([Extract<keyof R[N], LambderRateLimitWindow>] extends [never] ? never : N) : never;
+}[keyof R];
+/** Endpoint names whose idempotency option asks for a store (`false` is an opt-out and asks for none). */
+type LambderContractIdempotentKeys<C> = {
+    [K in keyof C]: [LambderContractIdempotencyOf<C, K>] extends [never] ? never : LambderContractIdempotencyOf<C, K> extends false ? never : K;
+}[keyof C];
 /**
  * The rate limits option: the policies endpoints may restate, the limiter
  * they are counted on, and what happens when that limiter throws.
  *
+ * The policies are held to what the server's own policies were held to when
+ * it registered the same endpoints, because an entry the mock's copy does not
+ * fit cannot be registered, and this makes that an error at the option rather
+ * than a throw when the registry loads. So the map names every policy the
+ * contract references, a policy a public endpoint names is not keyed per
+ * session, and a policy whose windows an endpoint overrides keeps a per-API
+ * budget. Policies the contract does not reference may be added freely.
+ *
  * `failOpen` is the server's own option (see LambderApiRateLimitsConfig) and
  * is here for the reason the idempotency option's twin is: with a limiter of
  * the app's own that fails, a mock that cannot express it always lets the
  * call through, so it answers 200 where a server configured to refuse answers
  * 429.
  */
-type LambderMockRateLimitsOptions<S, P extends LambderMockRateLimitPolicies<S>> = {
+type LambderMockRateLimitsOptions<C, S, P extends LambderMockRateLimitPolicies<S>> = {
     policies: P & {
         [N in keyof P]: LambderMockSurplusKeys<P[N], LambderApiRateLimitPolicyConfig<LambderMockCallContext<S>>>;
+    } & {
+        [N in LambderContractRateLimitNames<C>]: LambderApiRateLimitPolicyConfig<LambderMockCallContext<S>>;
+    } & {
+        [N in keyof P & LambderContractRateLimitNames<C, "public">]: P[N] extends {
+            per: "session";
+        } ? {
+            per: never;
+        } : unknown;
+    } & {
+        [N in keyof P & LambderContractWindowOverrideNames<C>]: P[N] extends {
+            budget: "perPolicy";
+        } ? {
+            budget: never;
+        } : unknown;
     };
     /** Where attempts are counted. Default: a fresh LambderMemoryRateLimiter. */
     limiter?: LambderRateLimiter;
@@ -95,11 +128,45 @@ type LambderMockGuardsOption<C, S, G> = [
 } : {
     guards: G & LambderMockGuards<C, S> & LambderMockGuardShapes<S, G>;
 };
+/**
+ * The sessions, idempotency and rateLimits options: each required whenever
+ * the contract has an endpoint that needs it, for the guards option's reason.
+ * An entry that needs one the mock was created without cannot be registered,
+ * so leaving it out is an error here rather than a throw when the registry
+ * loads.
+ */
+type LambderMockSessionsOption<C, S> = [
+    LambderContractKeysWithMode<C, "session">
+] extends [never] ? {
+    /** Sessions over the memory store: `true` for the defaults, or the options. Off by default. */
+    sessions?: boolean | LambderMockSessionsOptions<S>;
+} : {
+    /** Sessions over the memory store: `true` for the defaults, or the options. Required: the contract has session endpoints. */
+    sessions: true | LambderMockSessionsOptions<S>;
+};
+type LambderMockIdempotencyOption<C, S, I> = [
+    LambderContractIdempotentKeys<C>
+] extends [never] ? {
+    /** Idempotency over a memory store: `true` for the defaults, or the options. Off by default. */
+    idempotency?: I & LambderMockSurplusKeys<I, LambderMockIdempotencyOptions<S>>;
+} : {
+    /** Idempotency over a memory store: `true` for the defaults, or the options. Required: the contract has idempotent endpoints. */
+    idempotency: I & ([I] extends [false] ? never : unknown) & LambderMockSurplusKeys<I, LambderMockIdempotencyOptions<S>>;
+};
+type LambderMockRateLimitsOption<C, S, P extends LambderMockRateLimitPolicies<S>> = [
+    LambderContractRateLimitNames<C>
+] extends [never] ? {
+    /** The rate-limit policies endpoints may restate, over a memory limiter unless one is given. Off by default. */
+    rateLimits?: LambderMockRateLimitsOptions<C, S, P>;
+} : {
+    /** The rate-limit policies endpoints may restate, over a memory limiter unless one is given. Required: the contract references policies. */
+    rateLimits: LambderMockRateLimitsOptions<C, S, P>;
+};
 /** Each guard checked for surplus keys, so `sesion: true` on an inline guard is an error at the key rather than a guard that silently runs as public. */
 type LambderMockGuardShapes<S, G> = {
     [N in keyof G]: LambderMockSurplusKeys<G[N], LambderApiGuard<any, any, any, LambderMockCallContext<S>, LambderMockSessionCallContext<S>>>;
 };
-export type LambderMockAppOptions<C, S, G, P extends LambderMockRateLimitPolicies<S> = LambderMockRateLimitPolicies<S>, I extends boolean | LambderMockIdempotencyOptions<S> = boolean | LambderMockIdempotencyOptions<S>> = LambderMockGuardsOption<C, S, G> & {
+export type LambderMockAppOptions<C, S, G, P extends LambderMockRateLimitPolicies<S> = LambderMockRateLimitPolicies<S>, I extends boolean | LambderMockIdempotencyOptions<S> = boolean | LambderMockIdempotencyOptions<S>> = LambderMockGuardsOption<C, S, G> & LambderMockSessionsOption<C, S> & LambderMockIdempotencyOption<C, S, I> & LambderMockRateLimitsOption<C, S, P> & {
     /** Stamped on every answer's envelope as apiVersion, as the server's option is. */
     apiVersion?: string;
     /** The version floor, as on the server: a call naming a lower `version` answers versionExpired whatever its signature says. */
@@ -108,12 +175,6 @@ export type LambderMockAppOptions<C, S, G, P extends LambderMockRateLimitPolicie
     apiSignatures?: LambderApiSignatureMap;
     /** Artificial latency per call; off by default. */
     latency?: LambderMockLatency;
-    /** Sessions over the memory store: `true` for the defaults, or the options. Off by default: session endpoints then fail at registration. */
-    sessions?: boolean | LambderMockSessionsOptions<S>;
-    /** The rate-limit policies endpoints may restate, over a memory limiter unless one is given. Off by default. */
-    rateLimits?: LambderMockRateLimitsOptions<S, P>;
-    /** Idempotency over a memory store: `true` for the defaults, or the options. Off by default. */
-    idempotency?: I & LambderMockSurplusKeys<I, LambderMockIdempotencyOptions<S>>;
     /**
      * The host the runtime's cookies belong to: what signIn plants them
      * under, what the direct transport's jar scopes them by, what the MSW

package/dist/mock/LambderMockTypes.d.ts

@@ -90,8 +90,10 @@ export type LambderMockContext<C, K extends keyof C, S, G> = Omit<LambderMockCal
  * The guard map a mock app must declare: one guard per name any endpoint of
  * the contract declares, and for every guard the contract knows in
  * guardInput mode, a `guardInput` schema whose output is what the server
- * inferred. A missing name or a schema that parses to something else fails
- * at the `guards` option.
+ * inferred. A guard a public endpoint names may not require a session, since
+ * an entry naming one cannot be registered. A missing name, a schema that
+ * parses to something else, or a session guard where the contract has a
+ * public endpoint fails at the `guards` option.
  */
 export type LambderMockGuards<C, S = any> = {
     [N in LambderContractGuardNames<C>]: LambderApiGuard<any, any, any, LambderMockCallContext<S>, LambderMockSessionCallContext<S>>;
@@ -99,6 +101,10 @@ export type LambderMockGuards<C, S = any> = {
     [N in LambderContractGuardInputNames<C>]: {
         guardInput: z.ZodType<LambderContractGuardInput<C, N>, any>;
     };
+} & {
+    [N in LambderContractGuardNames<C, "public">]: {
+        session?: false;
+    };
 };
 export type LambderMockHandler<C, K extends keyof C, S, G> = (ctx: LambderMockContext<C, K, S, G>) => LambderMockOutputOf<C, K> | Promise<LambderMockOutputOf<C, K>>;
 /**

package/dist/shared/wire/LambderApiContract.d.ts

@@ -99,10 +99,10 @@ export type LambderContractKeysWithMode<C, M extends LambderApiMode> = {
 export type LambderContractGuardsOf<C, K extends keyof C> = C[K] extends {
     guards: infer G;
 } ? G : never;
-/** Every guard name any endpoint of the contract declares. */
-export type LambderContractGuardNames<C> = {
-    [K in keyof C]: LambderGuardNamesIn<LambderContractGuardsOf<C, K>>;
-}[keyof C] & string;
+/** Every guard name any endpoint of the contract declares, or only the endpoints of mode M. */
+export type LambderContractGuardNames<C, M extends LambderApiMode = LambderApiMode> = {
+    [K in LambderContractKeysWithMode<C, M>]: LambderGuardNamesIn<LambderContractGuardsOf<C, K>>;
+}[LambderContractKeysWithMode<C, M>] & string;
 /** The endpoint's guardInputs requirement, or never when its guards take no client input. */
 export type LambderContractGuardInputsOf<C, K extends keyof C> = C[K] extends {
     guardInputs: infer G;
@@ -123,6 +123,10 @@ export type LambderContractGuardInputNames<C> = {
 export type LambderContractRateLimitOf<C, K extends keyof C> = C[K] extends {
     rateLimit: infer R;
 } ? R : never;
+/** Every rate-limit policy name any endpoint of the contract references, or only the endpoints of mode M. The rateLimit option takes the guards option's three forms, so the names come out the same way. */
+export type LambderContractRateLimitNames<C, M extends LambderApiMode = LambderApiMode> = {
+    [K in LambderContractKeysWithMode<C, M>]: LambderGuardNamesIn<LambderContractRateLimitOf<C, K>>;
+}[LambderContractKeysWithMode<C, M>] & string;
 /** The endpoint's idempotency option as written, or never. */
 export type LambderContractIdempotencyOf<C, K extends keyof C> = C[K] extends {
     idempotency: infer I;

package/dist/shared/wire/LambderApiSignature.d.ts

@@ -1,3 +1,4 @@
+import type { z } from "zod";
 /**
  * The per-endpoint signatures a client carries, generated from the server's
  * own registrations (Lambder.apiSignatures()) and shipped with the client
@@ -44,3 +45,39 @@ export declare const lookupApiSignature: (signatures: LambderApiSignatureMap, ap
  * run instead of saying so.
  */
 export declare const readApiSignature: (signatures: LambderApiSignatureMap, apiName: string) => Promise<string>;
+/**
+ * The metadata key extensibleEnum() sets and the digest reads. Namespaced,
+ * because zod writes metadata into the JSON Schema it emits, so the key shows
+ * up in any schema an app converts for itself, where OpenAPI's own
+ * `x-extensible-enum` means something else (the values, in place of `enum`).
+ */
+export declare const EXTENSIBLE_ENUM_META_KEY = "x-lambder-extensible-enum";
+/**
+ * Marks an enum whose clients tolerate a value they were not built with, so
+ * its list of values stays out of the signature of every endpoint that
+ * returns it. Adding a role, a status or a locale to a list that rides in a
+ * widely returned payload (a session, a profile) then reloads only the
+ * clients that send the list back, not every client that reads it.
+ *
+ * Where the enum is input its values still count: a value dropped from the
+ * list is a request an older client may still send and the server now
+ * refuses, so that endpoint's clients must reload. Everything else about the
+ * schema is untouched: its type, its validation on both sides, and what it
+ * is everywhere outside the digest.
+ *
+ * The mark is a promise the schema makes for its readers, and nothing checks
+ * it. A client that switches over every value with no fallback, or indexes a
+ * map by one, renders a value it does not know as nothing, or throws. Mark
+ * only a list every reader handles that way on purpose.
+ *
+ * It is zod metadata (`.meta()`), which zod keeps in one registry on
+ * globalThis, so an enum marked in a shared package is read by the digest
+ * even when the server resolves another copy of zod. A schema derived from a
+ * marked enum by rebuilding it (`z.enum(marked.options)`, `.exclude()`)
+ * carries no mark and counts in full, which costs a reload, never a missed
+ * one.
+ *
+ * @example
+ * export const RoleSchema = extensibleEnum(z.enum(["admin", "member"]));
+ */
+export declare const extensibleEnum: <TSchema extends z.ZodEnum>(schema: TSchema) => TSchema;

package/dist/shared/wire/LambderApiSignature.js

@@ -43,3 +43,39 @@ export const readApiSignature = async (signatures, apiName) => {
     }
     return signature;
 };
+/**
+ * The metadata key extensibleEnum() sets and the digest reads. Namespaced,
+ * because zod writes metadata into the JSON Schema it emits, so the key shows
+ * up in any schema an app converts for itself, where OpenAPI's own
+ * `x-extensible-enum` means something else (the values, in place of `enum`).
+ */
+export const EXTENSIBLE_ENUM_META_KEY = "x-lambder-extensible-enum";
+/**
+ * Marks an enum whose clients tolerate a value they were not built with, so
+ * its list of values stays out of the signature of every endpoint that
+ * returns it. Adding a role, a status or a locale to a list that rides in a
+ * widely returned payload (a session, a profile) then reloads only the
+ * clients that send the list back, not every client that reads it.
+ *
+ * Where the enum is input its values still count: a value dropped from the
+ * list is a request an older client may still send and the server now
+ * refuses, so that endpoint's clients must reload. Everything else about the
+ * schema is untouched: its type, its validation on both sides, and what it
+ * is everywhere outside the digest.
+ *
+ * The mark is a promise the schema makes for its readers, and nothing checks
+ * it. A client that switches over every value with no fallback, or indexes a
+ * map by one, renders a value it does not know as nothing, or throws. Mark
+ * only a list every reader handles that way on purpose.
+ *
+ * It is zod metadata (`.meta()`), which zod keeps in one registry on
+ * globalThis, so an enum marked in a shared package is read by the digest
+ * even when the server resolves another copy of zod. A schema derived from a
+ * marked enum by rebuilding it (`z.enum(marked.options)`, `.exclude()`)
+ * carries no mark and counts in full, which costs a reload, never a missed
+ * one.
+ *
+ * @example
+ * export const RoleSchema = extensibleEnum(z.enum(["admin", "member"]));
+ */
+export const extensibleEnum = (schema) => schema.meta({ [EXTENSIBLE_ENUM_META_KEY]: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "7.2.2",
+  "version": "7.2.4",
   "sideEffects": false,
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [