lambder 7.3.1 → 8.0.2

package/dist/shared/wire/LambderCallOptions.js

@@ -1,17 +1,15 @@
 /**
- * The per-call options both callers take, the contract-driven typing of a
- * call's arguments, and the runtime merge of guard inputs, shared by the
- * browser caller (LambderCaller) and the server-side invoke caller
- * (LambderInvokeCaller). Both speak the same envelope to the same kind of
- * contract, so what an API demands of its caller (a guardInput-mode guard's
- * value, say) is decided here once and the two callers cannot drift on it.
- * Pure types and one dependency-free function, so the browser entry resolves
- * it.
+ * The per-call options, the contract-driven typing of a call's arguments, and
+ * the runtime merge of guard inputs, shared by the browser caller
+ * (LambderCaller) and the server-side invoke caller (LambderInvokeCaller).
+ * Both speak the same envelope to the same kind of contract, so what an API
+ * demands of its caller (a guardInput-mode guard's value, say) is decided
+ * here once and the two cannot drift. Pure types and one dependency-free
+ * function, so the browser entry resolves it.
  */
 /**
  * Provider values underneath, per-call values on top; undefined when neither
- * side supplied any. Synchronous on purpose: a caller awaits its provider
- * only when it has one, so a call without a provider still issues its
- * request in the same tick it was made.
+ * side supplied any. Synchronous so a call without a provider still issues
+ * its request in the same tick it was made.
  */
 export const mergeGuardInputs = (provided, perCall) => provided !== undefined || perCall !== undefined ? { ...provided, ...perCall } : undefined;

package/dist/shared/wire/LambderCompressionCodec.d.ts

@@ -4,32 +4,28 @@
  * Five things compress: sessions, LambderDdbCache and LambderDdbIdempotencyStore
  * (Brotli at rest in DynamoDB), HTTP responses (Brotli or gzip, negotiated)
  * and request payloads (gzip from a browser, whose CompressionStream offers
- * nothing else; Brotli from a Node caller). They all compress text, so TEXT
- * mode throughout, and they all restore it the same way: the compressed
- * bytes beside the text's original UTF-8 byte length. The one restore
- * without a declared length is a compressed HTTP answer read by
- * LambderInvokeCaller, which passes a ceiling instead; both restores take
- * either bound. That answer is also the one restore whose bytes may not be
- * text at all, so the restore comes in two: restoreBytes returns the buffer
- * and restoreText decodes it.
+ * nothing else; Brotli from a Node caller). All compress text, so TEXT mode
+ * throughout, and all restore from the compressed bytes plus the text's
+ * original UTF-8 byte length. The exception is a compressed HTTP answer read
+ * by LambderInvokeCaller: it has no declared length, so it passes a ceiling
+ * instead, and its bytes may not be text, hence restoreBytes beside
+ * restoreText. Both restores take either bound.
  *
  * That length is the safety mechanism, not bookkeeping. It bounds the
  * decompression, so a body that would expand without limit is cut off
  * rather than allocated, and the restored length must match it exactly, so
  * a truncated or tampered input fails instead of decoding to something
- * merely plausible. Every caller gets that guarantee from this one
- * implementation: a bug fixed here is fixed for records at rest and for
- * untrusted request bodies alike.
+ * merely plausible. Records at rest and untrusted request bodies share this
+ * one implementation of it.
  *
  * zlib is loaded lazily through LambderNodeModules, so a module importing this
  * one can still sit in a frontend bundle's import graph via the package
  * root. Compressing needs zlib and is server-side; restoring runs anywhere,
- * through zlib where it exists and through the web DecompressionStream
- * otherwise, so the API core can restore a gzipped request payload in a
- * browser (the mock runtime) under the same bound. The option that decides
- * WHETHER to compress, and the encoding vocabulary, live in
- * LambderCompressionOption, which stays free of zlib entirely so the browser
- * entry can resolve it.
+ * through zlib or else the web DecompressionStream, so the mock runtime can
+ * restore a gzipped request payload in a browser under the same bound.
+ * Whether to compress, and the encoding vocabulary, live in
+ * LambderCompressionOption, which stays free of zlib so the browser entry can
+ * resolve it.
  */
 import type { LambderEncoding } from "./LambderCompressionOption.js";
 /** Why a bounded restore failed, for callers that answer rather than throw. */
@@ -53,7 +49,9 @@ export declare class LambderCompressionError extends Error {
 }
 /**
  * Compresses text. `quality` is the Brotli quality (0-11) and is ignored by
- * gzip, which has no comparable knob worth exposing.
+ * gzip, which has no comparable knob worth exposing. The result may be a view
+ * onto zlib's larger output chunk: a caller that keeps it for long copies it
+ * first (the DynamoDB cache's memory layer does).
  */
 export declare const compressText: (input: Buffer, encoding: LambderEncoding, quality: number) => Promise<Buffer>;
 /**
@@ -70,27 +68,24 @@ export type LambderRestoreBound = {
 };
 /**
  * Restores the original bytes from compressed bytes under a bound. With
- * `declaredBytes` (records at rest, request payloads) the length both bounds
- * the decompression and verifies it, so a body that would expand without
- * limit is cut off rather than allocated, and a truncated or tampered input
- * fails instead of decoding to something merely plausible. With `maxBytes`
- * only the ceiling holds; truncation and corruption are what zlib's
- * stream-end check and gzip's CRC catch. Throws LambderCompressionError on
- * anything it cannot vouch for. A nonsense ceiling is the caller's
- * configuration error and throws a plain Error.
+ * `declaredBytes` (records at rest, request payloads) the length both caps
+ * the decompression and verifies its result. With `maxBytes` only the
+ * ceiling holds; zlib's stream-end check and gzip's CRC catch truncation and
+ * corruption. Throws LambderCompressionError on anything it cannot vouch
+ * for; a nonsense ceiling is the caller's configuration error and throws a
+ * plain Error.
  *
  * This is the restore for bytes that are not text: a compressed binary
  * answer (a wasm module, an image a route forced compression on) read by
- * LambderInvokeCaller. Text callers use restoreText, which is this plus the
- * UTF-8 decode; going through a string would replace every byte that is not
- * valid UTF-8 and hand back a body that is silently not what was sent.
+ * LambderInvokeCaller. Text callers use restoreText; decoding binary through
+ * a string would replace every invalid UTF-8 byte and silently hand back a
+ * different body.
  */
 export declare const restoreBytes: (compressed: Uint8Array, encoding: LambderEncoding, bound: LambderRestoreBound) => Promise<Uint8Array>;
 /**
- * Restores text: restoreBytes plus the UTF-8 decode. What every text caller
- * uses (sessions, the DynamoDB stores, request payloads). The declared byte
- * length a `declaredBytes` bound carries is the text's UTF-8 byte length,
- * which is the restored buffer's length, so the verification is the same one
- * either way.
+ * Restores text: restoreBytes plus the UTF-8 decode, for every text caller
+ * (sessions, the DynamoDB stores, request payloads). A `declaredBytes` bound
+ * is the text's UTF-8 byte length, which is the restored buffer's length, so
+ * the verification is the same.
  */
 export declare const restoreText: (compressed: Uint8Array, encoding: LambderEncoding, bound: LambderRestoreBound) => Promise<string>;

package/dist/shared/wire/LambderCompressionCodec.js

@@ -4,32 +4,28 @@
  * Five things compress: sessions, LambderDdbCache and LambderDdbIdempotencyStore
  * (Brotli at rest in DynamoDB), HTTP responses (Brotli or gzip, negotiated)
  * and request payloads (gzip from a browser, whose CompressionStream offers
- * nothing else; Brotli from a Node caller). They all compress text, so TEXT
- * mode throughout, and they all restore it the same way: the compressed
- * bytes beside the text's original UTF-8 byte length. The one restore
- * without a declared length is a compressed HTTP answer read by
- * LambderInvokeCaller, which passes a ceiling instead; both restores take
- * either bound. That answer is also the one restore whose bytes may not be
- * text at all, so the restore comes in two: restoreBytes returns the buffer
- * and restoreText decodes it.
+ * nothing else; Brotli from a Node caller). All compress text, so TEXT mode
+ * throughout, and all restore from the compressed bytes plus the text's
+ * original UTF-8 byte length. The exception is a compressed HTTP answer read
+ * by LambderInvokeCaller: it has no declared length, so it passes a ceiling
+ * instead, and its bytes may not be text, hence restoreBytes beside
+ * restoreText. Both restores take either bound.
  *
  * That length is the safety mechanism, not bookkeeping. It bounds the
  * decompression, so a body that would expand without limit is cut off
  * rather than allocated, and the restored length must match it exactly, so
  * a truncated or tampered input fails instead of decoding to something
- * merely plausible. Every caller gets that guarantee from this one
- * implementation: a bug fixed here is fixed for records at rest and for
- * untrusted request bodies alike.
+ * merely plausible. Records at rest and untrusted request bodies share this
+ * one implementation of it.
  *
  * zlib is loaded lazily through LambderNodeModules, so a module importing this
  * one can still sit in a frontend bundle's import graph via the package
  * root. Compressing needs zlib and is server-side; restoring runs anywhere,
- * through zlib where it exists and through the web DecompressionStream
- * otherwise, so the API core can restore a gzipped request payload in a
- * browser (the mock runtime) under the same bound. The option that decides
- * WHETHER to compress, and the encoding vocabulary, live in
- * LambderCompressionOption, which stays free of zlib entirely so the browser
- * entry can resolve it.
+ * through zlib or else the web DecompressionStream, so the mock runtime can
+ * restore a gzipped request payload in a browser under the same bound.
+ * Whether to compress, and the encoding vocabulary, live in
+ * LambderCompressionOption, which stays free of zlib so the browser entry can
+ * resolve it.
  */
 import { getZlib } from "../util/LambderNodeModules.js";
 import { assertPositiveInteger } from "../util/LambderOptionChecks.js";
@@ -56,8 +52,8 @@ export class LambderCompressionError extends Error {
     }
 }
 // Not a LambderCompressionError: nothing was wrong with the bytes, so there
-// is no restore `reason` to report. Callers that map reasons fall through to
-// their generic failure, which is the honest answer here.
+// is no restore `reason`. Callers that map reasons fall through to their
+// generic failure, which is the honest answer here.
 const requireZlib = async () => {
     const zlib = await getZlib();
     if (!zlib)
@@ -66,7 +62,9 @@ const requireZlib = async () => {
 };
 /**
  * Compresses text. `quality` is the Brotli quality (0-11) and is ignored by
- * gzip, which has no comparable knob worth exposing.
+ * gzip, which has no comparable knob worth exposing. The result may be a view
+ * onto zlib's larger output chunk: a caller that keeps it for long copies it
+ * first (the DynamoDB cache's memory layer does).
  */
 export const compressText = async (input, encoding, quality) => {
     const zlib = await requireZlib();
@@ -90,20 +88,18 @@ export const compressText = async (input, encoding, quality) => {
 };
 /**
  * Restores the original bytes from compressed bytes under a bound. With
- * `declaredBytes` (records at rest, request payloads) the length both bounds
- * the decompression and verifies it, so a body that would expand without
- * limit is cut off rather than allocated, and a truncated or tampered input
- * fails instead of decoding to something merely plausible. With `maxBytes`
- * only the ceiling holds; truncation and corruption are what zlib's
- * stream-end check and gzip's CRC catch. Throws LambderCompressionError on
- * anything it cannot vouch for. A nonsense ceiling is the caller's
- * configuration error and throws a plain Error.
+ * `declaredBytes` (records at rest, request payloads) the length both caps
+ * the decompression and verifies its result. With `maxBytes` only the
+ * ceiling holds; zlib's stream-end check and gzip's CRC catch truncation and
+ * corruption. Throws LambderCompressionError on anything it cannot vouch
+ * for; a nonsense ceiling is the caller's configuration error and throws a
+ * plain Error.
  *
  * This is the restore for bytes that are not text: a compressed binary
  * answer (a wasm module, an image a route forced compression on) read by
- * LambderInvokeCaller. Text callers use restoreText, which is this plus the
- * UTF-8 decode; going through a string would replace every byte that is not
- * valid UTF-8 and hand back a body that is silently not what was sent.
+ * LambderInvokeCaller. Text callers use restoreText; decoding binary through
+ * a string would replace every invalid UTF-8 byte and silently hand back a
+ * different body.
  */
 export const restoreBytes = async (compressed, encoding, bound) => {
     const verified = "declaredBytes" in bound;
@@ -134,11 +130,10 @@ export const restoreBytes = async (compressed, encoding, bound) => {
     return output;
 };
 /**
- * Restores text: restoreBytes plus the UTF-8 decode. What every text caller
- * uses (sessions, the DynamoDB stores, request payloads). The declared byte
- * length a `declaredBytes` bound carries is the text's UTF-8 byte length,
- * which is the restored buffer's length, so the verification is the same one
- * either way.
+ * Restores text: restoreBytes plus the UTF-8 decode, for every text caller
+ * (sessions, the DynamoDB stores, request payloads). A `declaredBytes` bound
+ * is the text's UTF-8 byte length, which is the restored buffer's length, so
+ * the verification is the same.
  */
 export const restoreText = async (compressed, encoding, bound) => new TextDecoder().decode(await restoreBytes(compressed, encoding, bound));
 /** zlib reads any Uint8Array in place; maxOutputLength is the bound, so it stops rather than allocating past it. */

package/dist/shared/wire/LambderCompressionOption.d.ts

@@ -2,19 +2,19 @@
  * The compression option every part of Lambder speaks, and the one function
  * that resolves it.
  *
- * Five places compress something: sessions, LambderDdbCache and
+ * Five places compress: sessions, LambderDdbCache and
  * LambderDdbIdempotencyStore (Brotli at rest in DynamoDB), HTTP responses
- * (Brotli/gzip on the wire) and request payloads (gzip on the wire). They
- * differ in what they can be tuned with, so each declares its own settings
- * type, but they share one vocabulary and one resolution: `true` is on with
- * that site's defaults, `false` is off, an object overrides individual
- * fields, and `minBytes` is always the size from which a value is
- * compressed (0: always). Resolved settings are `null` when off, so every
- * consumer holds `Settings | null` and reads `minBytes` the same way.
+ * (Brotli/gzip on the wire) and request payloads (gzip on the wire). Each
+ * declares its own settings type, since they tune differently, but all
+ * share one vocabulary and one resolution: `true` is on with that site's
+ * defaults, `false` is off, an object overrides individual fields, and
+ * `minBytes` is always the size from which a value is compressed (0:
+ * always). Resolved settings are `null` when off, so every consumer holds
+ * `Settings | null` and reads `minBytes` the same way.
  *
  * Nothing here touches zlib, so the browser entry can resolve the caller's
  * option without pulling Node built-ins into the bundle; the compression
- * primitives themselves live in LambderCompressionCodec, which does load zlib.
+ * primitives live in LambderCompressionCodec, which does load zlib.
  */
 /** Algorithms Lambder can produce. Brotli at rest and preferred on responses; gzip everywhere a browser has to do the compressing. */
 export declare const LAMBDER_ENCODINGS: readonly ["br", "gzip"];

package/dist/shared/wire/LambderCompressionOption.js

@@ -2,19 +2,19 @@
  * The compression option every part of Lambder speaks, and the one function
  * that resolves it.
  *
- * Five places compress something: sessions, LambderDdbCache and
+ * Five places compress: sessions, LambderDdbCache and
  * LambderDdbIdempotencyStore (Brotli at rest in DynamoDB), HTTP responses
- * (Brotli/gzip on the wire) and request payloads (gzip on the wire). They
- * differ in what they can be tuned with, so each declares its own settings
- * type, but they share one vocabulary and one resolution: `true` is on with
- * that site's defaults, `false` is off, an object overrides individual
- * fields, and `minBytes` is always the size from which a value is
- * compressed (0: always). Resolved settings are `null` when off, so every
- * consumer holds `Settings | null` and reads `minBytes` the same way.
+ * (Brotli/gzip on the wire) and request payloads (gzip on the wire). Each
+ * declares its own settings type, since they tune differently, but all
+ * share one vocabulary and one resolution: `true` is on with that site's
+ * defaults, `false` is off, an object overrides individual fields, and
+ * `minBytes` is always the size from which a value is compressed (0:
+ * always). Resolved settings are `null` when off, so every consumer holds
+ * `Settings | null` and reads `minBytes` the same way.
  *
  * Nothing here touches zlib, so the browser entry can resolve the caller's
  * option without pulling Node built-ins into the bundle; the compression
- * primitives themselves live in LambderCompressionCodec, which does load zlib.
+ * primitives live in LambderCompressionCodec, which does load zlib.
  */
 import { assertNonNegativeInteger } from "../util/LambderOptionChecks.js";
 /** Algorithms Lambder can produce. Brotli at rest and preferred on responses; gzip everywhere a browser has to do the compressing. */

package/dist/shared/wire/LambderCrashDetail.d.ts

@@ -1,16 +1,14 @@
 /**
  * A crash, described for a caller that is allowed to see it.
  *
- * A global error handler decides what a failed request learns about the
- * failure. A browser gets a generic message; a trusted caller (another
- * lambda invoking this one, a developer holding a debug cookie) can be
- * handed the whole thing: the error's name, message and stack, its cause
- * chain, and where it happened, so the caller can store it in its own
- * error log and point at the right CloudWatch stream. The envelope carries
- * it in the `crash` field beside errorMessage; LambderInvokeCaller reads it
- * back and rebuilds an Error from it as the `cause` of the error it throws,
- * so an error reporter that walks causes sees the callee's stack without
- * being taught anything.
+ * A global error handler decides what a failed request learns. A browser
+ * gets a generic message; a trusted caller (another lambda invoking this
+ * one, a developer holding a debug cookie) can get the error's name, message,
+ * stack, cause chain and where it happened, to store in its own error log
+ * and find the right CloudWatch stream. The envelope carries it in `crash`
+ * beside errorMessage; LambderInvokeCaller rebuilds an Error from it as the
+ * `cause` of the error it throws, so a reporter that walks causes sees the
+ * callee's stack unaided.
  *
  * Dependency-free and isomorphic: the type is part of the envelope both
  * entries export, and describeCrash needs nothing from Node.
@@ -49,10 +47,9 @@ export declare const errorFromCrashDetail: (crash: LambderCrashDetail) => Error;
 /**
  * A thrown value as an Error, so a reporter or a `cause` chain always holds
  * one. An Error passes through; anything else becomes an Error whose message
- * describes the value the way describeCrash does, JSON where String() cannot
- * (a null-prototype object or a throwing toString must not make the
- * coercion itself throw). One implementation, rather than
- * `err instanceof Error ? err : new Error(...)` spelled at every site with a
- * fallback of its own.
+ * describes the value as describeCrash does, JSON before String() (a
+ * null-prototype object or a throwing toString must not make the coercion
+ * itself throw). Use it instead of spelling
+ * `err instanceof Error ? err : new Error(...)` with a fallback per site.
  */
 export declare const coerceToError: (value: unknown, fallbackMessage?: string) => Error;

package/dist/shared/wire/LambderCrashDetail.js

@@ -1,16 +1,14 @@
 /**
  * A crash, described for a caller that is allowed to see it.
  *
- * A global error handler decides what a failed request learns about the
- * failure. A browser gets a generic message; a trusted caller (another
- * lambda invoking this one, a developer holding a debug cookie) can be
- * handed the whole thing: the error's name, message and stack, its cause
- * chain, and where it happened, so the caller can store it in its own
- * error log and point at the right CloudWatch stream. The envelope carries
- * it in the `crash` field beside errorMessage; LambderInvokeCaller reads it
- * back and rebuilds an Error from it as the `cause` of the error it throws,
- * so an error reporter that walks causes sees the callee's stack without
- * being taught anything.
+ * A global error handler decides what a failed request learns. A browser
+ * gets a generic message; a trusted caller (another lambda invoking this
+ * one, a developer holding a debug cookie) can get the error's name, message,
+ * stack, cause chain and where it happened, to store in its own error log
+ * and find the right CloudWatch stream. The envelope carries it in `crash`
+ * beside errorMessage; LambderInvokeCaller rebuilds an Error from it as the
+ * `cause` of the error it throws, so a reporter that walks causes sees the
+ * callee's stack unaided.
  *
  * Dependency-free and isomorphic: the type is part of the envelope both
  * entries export, and describeCrash needs nothing from Node.
@@ -79,11 +77,10 @@ export const errorFromCrashDetail = (crash) => {
 /**
  * A thrown value as an Error, so a reporter or a `cause` chain always holds
  * one. An Error passes through; anything else becomes an Error whose message
- * describes the value the way describeCrash does, JSON where String() cannot
- * (a null-prototype object or a throwing toString must not make the
- * coercion itself throw). One implementation, rather than
- * `err instanceof Error ? err : new Error(...)` spelled at every site with a
- * fallback of its own.
+ * describes the value as describeCrash does, JSON before String() (a
+ * null-prototype object or a throwing toString must not make the coercion
+ * itself throw). Use it instead of spelling
+ * `err instanceof Error ? err : new Error(...)` with a fallback per site.
  */
 export const coerceToError = (value, fallbackMessage = "Unknown error") => {
     if (value instanceof Error)

package/dist/shared/wire/LambderDefaultApiPath.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The path a Lambder server takes API calls on unless the app names its own
+ * (`apiPath` at create()). One definition, in shared, so every place that
+ * defaults it reads the same value.
+ */
+export declare const DEFAULT_API_PATH = "/api";

package/dist/shared/wire/LambderDefaultApiPath.js

@@ -0,0 +1,6 @@
+/**
+ * The path a Lambder server takes API calls on unless the app names its own
+ * (`apiPath` at create()). One definition, in shared, so every place that
+ * defaults it reads the same value.
+ */
+export const DEFAULT_API_PATH = "/api";

package/dist/shared/wire/LambderHttpStatus.d.ts

@@ -1,12 +1,11 @@
 /**
  * The HTTP status codes a Lambder response may carry.
  *
- * In `shared/` rather than beside LambderResponse because it is HTTP
- * vocabulary with no relationship to the server's response class, and the
- * places that need it include ones a browser bundle reaches
- * (LambderApiRefusal, the mock's contract types). Importing it from `core/`
- * pulled `core/LambderResponse.ts` into the type graph of `lambder/client`,
- * and with it `aws-lambda`, so a browser-only consumer needed
- * `@types/aws-lambda` resolvable to typecheck a status union.
+ * In `shared/` rather than beside LambderResponse: it is HTTP vocabulary, and
+ * code a browser bundle reaches needs it (LambderApiRefusal, the mock's
+ * contract types). Importing it from `core/` would pull
+ * `core/LambderResponse.ts`, and with it `aws-lambda`, into the type graph of
+ * `lambder/client`, so a browser-only consumer would need `@types/aws-lambda`
+ * to typecheck a status union.
  */
 export type LambderHttpStatusCode = 100 | 101 | 200 | 201 | 202 | 203 | 204 | 206 | 300 | 301 | 302 | 303 | 304 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 408 | 409 | 410 | 412 | 413 | 415 | 416 | 418 | 422 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504;

package/dist/shared/wire/LambderIdempotencyKeyScope.d.ts

@@ -0,0 +1,89 @@
+/**
+ * What a key scope reads from an attempt's outcome. Both callers' outcomes
+ * carry these fields, so the one rule below serves the browser caller and
+ * the invoke caller alike.
+ */
+export type LambderIdempotentAttemptOutcome = {
+    ok: boolean;
+    reason?: string;
+    status?: number;
+    errorMessage?: {
+        code?: string;
+    };
+};
+/** One call's key, and what tells its scope how the call ended. */
+export type LambderIdempotentAttempt = {
+    /** The key this attempt sends; undefined for a call that sends none. */
+    readonly key: string | undefined;
+    /** Tells the scope the attempt's outcome, once it is known. Only the first call counts. */
+    settle(outcome: LambderIdempotentAttemptOutcome): void;
+};
+/** The outcome of an attempt that ended before anything was sent: it tried nothing. */
+export declare const IDEMPOTENT_ATTEMPT_NOT_SENT: LambderIdempotentAttemptOutcome;
+/**
+ * Generate an idempotency key for one logical operation. Create it when the
+ * operation begins (a form opens, a draft starts), send the same key on every
+ * attempt of that operation, and generate a new one after a confirmed
+ * success; createIdempotencyKeyScope() does that bookkeeping itself. Uses
+ * crypto.randomUUID when available, else a v4 UUID from getRandomValues,
+ * because randomUUID only exists in secure contexts (plain-http LAN device
+ * testing lacks it).
+ *
+ * A runtime with neither throws rather than using Math.random: the key
+ * scopes the replay record for a logged-out client, so a guessable one hands
+ * that client's stored response to whoever guesses it.
+ */
+export declare const createIdempotencyKey: () => string;
+/**
+ * One logical operation's rotating idempotency key, from
+ * createIdempotencyKeyScope(). Every attempt of the operation
+ * sends the current key, and the scope moves to a new key once an answer
+ * settles the operation:
+ *
+ * - A success settles it, and so does a key refused as reused for another
+ *   request, since that key can never carry this one.
+ * - A refusal of this request (a rejected input, not authorized, an
+ *   errorMessage) settles it, unless another attempt under the same key is
+ *   still in flight or went unanswered. That attempt may run or have run the
+ *   operation, and guards, validation and rate limits refuse before the
+ *   replay record is claimed, so the refusal of a retry or a double-tap says
+ *   nothing about it. Keeping the key lets the next attempt replay the
+ *   original's answer rather than run again.
+ * - A rate limit, an expired session, a stale version, and an attempt that
+ *   ended before anything was sent keep the key.
+ * - Anything that is not an answer (a network failure, a timeout, a 5xx, a
+ *   crash) keeps the key and marks it as possibly used, and so does a
+ *   duplicate of an original still in flight, unless the scope has another
+ *   attempt of its own still waiting for its answer (a double-tap): that
+ *   attempt is the original, and its answer settles the key, a refusal
+ *   included.
+ *
+ * An answer to a key the scope has already moved past changes nothing: a
+ * slow original answering after the person moved on must not rotate away
+ * the key their current attempt is using.
+ */
+export declare class LambderIdempotencyKeyScope {
+    #private;
+    /** The key for the operation currently in progress. */
+    get current(): string;
+    /** Moves on to a new operation by hand, for a caller that settles operations itself. Returns the new key. */
+    rotate(): string;
+}
+/**
+ * A self-rotating idempotency key for a component or form that performs the
+ * same logical operation repeatedly. Pass the scope itself as the call's
+ * `idempotencyKey`, on LambderCaller or LambderInvokeCaller: every attempt of
+ * one operation (a retry after a dropped connection, a double-tap) sends its
+ * current key, so the server collapses them, and the caller rotates it once
+ * an answer settles the operation (a success, or a refusal of this request),
+ * so the next attempt, a corrected form included, is a new operation.
+ * LambderIdempotencyKeyScope says which answers settle it.
+ *
+ * ```typescript
+ * const submitKey = createIdempotencyKeyScope();
+ * await caller.api("order.create", payload, { idempotencyKey: submitKey });
+ * ```
+ */
+export declare const createIdempotencyKeyScope: () => LambderIdempotencyKeyScope;
+/** The attempt a call makes with its idempotencyKey option: a scope's current key, or a plain key with nothing to settle. */
+export declare const beginIdempotentAttempt: (option: string | LambderIdempotencyKeyScope | undefined) => LambderIdempotentAttempt;