lambder 8.1.1 → 8.3.1

package/dist/client.d.ts

@@ -26,6 +26,8 @@ export type { LambderIdempotencyKeyScope } from "./shared/wire/LambderIdempotenc
 export { LambderApiRefusal, isLambderApiRefusal, refuse, refusalMessageOf, LAMBDER_REFUSAL_CODES } from "./shared/wire/LambderApiRefusal.js";
 export type { LambderApiRefusalOptions, LambderRefusalMessage, LambderAppRefusalMessage, LambderRefusalCode, LambderRefuseOptions } from "./shared/wire/LambderApiRefusal.js";
 export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiResponseConfig, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractKeysWithGuard, LambderJsonOf, LambderJsonOutputOf, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractRateLimitNames, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";
+export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";
+export type { LambderApiOptionEntries, LambderApiOptionEntry, LambderRateLimitPolicyEntry, LambderGuardDeclarationEntry, LambderApisWithGuard, LambderApisGuardedBy, LambderApisWithMode, LambderGuardParamOf, } from "./shared/wire/LambderApiOptionEntries.js";
 export { describeCrash, errorFromCrashDetail } from "./shared/wire/LambderCrashDetail.js";
 export type { LambderCrashDetail, LambderCrashCause } from "./shared/wire/LambderCrashDetail.js";
 export { compressPayloadGzip, isRequestCompressionAvailable, COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BR_FIELD, COMPRESSED_PAYLOAD_BYTES_FIELD, DEFAULT_REQUEST_COMPRESSION_SETTINGS, } from "./shared/wire/LambderRequestPayload.js";
@@ -36,6 +38,11 @@ export { html, xml, raw, jsonScript, escapeHtml, renderHtmlValue, LambderSafeHtm
 export { createLambderI18n } from "./shared/LambderI18n.js";
 export type { LambderLanguageMeta, LambderI18nConfig, LambderI18nInstance, LambderI18nTranslator, LambderI18nExtractParams, LambderI18nDictionaryLoader, LambderI18nCodes, LambderI18nKeys, LambderI18nTranslatorFor, } from "./shared/LambderI18n.js";
 export type { LambderHttpStatusCode } from "./shared/wire/LambderHttpStatus.js";
+export { LambderBackoffTimer } from "./shared/util/LambderBackoffTimer.js";
+export type { LambderBackoffTimerOptions } from "./shared/util/LambderBackoffTimer.js";
+export { LambderSignedClaims, keyedDigest, randomSecret } from "./shared/util/LambderSignedClaims.js";
+export type { LambderSignedClaimsOptions } from "./shared/util/LambderSignedClaims.js";
+export { constantTimeEquals } from "./shared/util/LambderTextDigest.js";
 export { LambderUploadRunner, LambderUploadError } from "./client/LambderUploadRunner.js";
 export type { LambderUploadRunnerOptions, LambderUploadProgress, LambderUploadPhase, LambderUploadFailureReason } from "./client/LambderUploadRunner.js";
 export { checkUploadRule } from "./shared/contracts/LambderUploadBucket.js";

package/dist/client.js

@@ -23,6 +23,9 @@ export { createIdempotencyKey, createIdempotencyKeyScope } from "./shared/wire/L
 // Typed API refusals (isomorphic: shared code may throw them from anywhere;
 // in the browser they are plain Errors).
 export { LambderApiRefusal, isLambderApiRefusal, refuse, refusalMessageOf, LAMBDER_REFUSAL_CODES } from "./shared/wire/LambderApiRefusal.js";
+// The server's declared options as plain data (the generated options module's
+// entry types) and the readers a client derives its own facts from.
+export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";
 // A crash described for a caller allowed to see it (the envelope's `crash` field; pure, no Node built-ins).
 export { describeCrash, errorFromCrashDetail } from "./shared/wire/LambderCrashDetail.js";
 // Request payload compression (browser-safe: gzip via CompressionStream, no Node built-ins).
@@ -33,6 +36,14 @@ export { resolveCompressionOption } from "./shared/wire/LambderCompressionOption
 export { html, xml, raw, jsonScript, escapeHtml, renderHtmlValue, LambderSafeHtml } from "./shared/LambderHtml.js";
 // Typed translations (standalone, isomorphic)
 export { createLambderI18n } from "./shared/LambderI18n.js";
+// Waiting longer after each failure, once: for a reconnecting client or a
+// screen that has to come back by itself.
+export { LambderBackoffTimer } from "./shared/util/LambderBackoffTimer.js";
+// Signed claims tokens, for the isomorphic code that verifies them where a
+// server's secret is at hand (an edge Worker, a shared backend package);
+// never in a page, which holds no secret to verify with.
+export { LambderSignedClaims, keyedDigest, randomSecret } from "./shared/util/LambderSignedClaims.js";
+export { constantTimeEquals } from "./shared/util/LambderTextDigest.js";
 // Direct uploads: the runner that takes a file from the browser straight to
 // storage, and the vocabulary it shares with the server's bucket.
 export { LambderUploadRunner, LambderUploadError } from "./client/LambderUploadRunner.js";

package/dist/core/Lambder.d.ts

@@ -14,6 +14,7 @@ import type { LambderFileSource } from "../shared/contracts/LambderFileSource.js
 import { LAMBDER_BACKEND_SWAP, LAMBDER_CRASH_WATCH } from "../shared/util/LambderTestingDoors.js";
 import { type LambderApiSignatureEntry } from "../api/LambderApiSignature.js";
 import { type LambderApiSignatureMap } from "../shared/wire/LambderApiSignature.js";
+import type { LambderApiOptionEntries } from "../shared/wire/LambderApiOptionEntries.js";
 import type { LambderApiIdempotencyOption } from "../shared/wire/LambderApiOptionValues.js";
 import type { LambderApiGuard, LambderGuardMetaMap, LambderGuardsOption, LambderGuardDataOf, LambderGuardInputsOf } from "../api/LambderApiGuards.js";
 import type { LambderApiRateLimitPolicyConfig, LambderRateLimitOption } from "../api/LambderApiRateLimits.js";
@@ -91,6 +92,8 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
     private readonly apiDefinitions;
     /** The guards map given at creation, kept for apiSignatures(): a guard's schema is part of the signature of every endpoint declaring it. */
     private readonly guards;
+    /** The rate-limit policies given at creation, kept for apiOptionEntries(), which records each one less its key handler. */
+    private readonly rateLimitPolicies;
     private hookList;
     private createdHooks;
     private initPromise;
@@ -246,6 +249,24 @@ export default class Lambder<TSessionData = any, _TContract extends Record<strin
      * unless the generator writes it there.
      */
     apiSignatureEntries(): Promise<LambderApiSignatureEntry[]>;
+    /**
+     * Every registered API's mode and declared options as plain data, with
+     * the rate-limit policies and guards they name reduced to what is not
+     * code: what writeApiOptions (lambder/build) writes to a module a client,
+     * a mock or a test imports instead of the server. The contract carries
+     * the same options as types; this is the same fact as a value, for code
+     * that decides something at runtime with it.
+     *
+     * Nothing here is a secret or a handler by construction. A guard's
+     * parameter is written as it was declared, so it has to be plain data
+     * (a permission string, a list, a reason); one that is not fails by API
+     * and guard name. A policy's key handler is never written: its `per`
+     * says "custom" and no more. A guard's input schema is never written
+     * either; its declaration says only which of the three input modes it
+     * has. Every table is sorted by name, so the module diffs by endpoint
+     * and never moves when registrations are reordered.
+     */
+    apiOptionEntries(): LambderApiOptionEntries;
     getResponseBuilder(ctx?: LambderRenderContext): LambderResponseBuilder<any>;
     private getResolver;
     getHandler(): LambderHandler;

package/dist/core/Lambder.js

@@ -15,6 +15,7 @@ import { LambderApiPipeline } from "../api/LambderApiPipeline.js";
 import { LAMBDER_BACKEND_SWAP, LAMBDER_CRASH_WATCH } from "../shared/util/LambderTestingDoors.js";
 import { apiSignatureOf } from "../api/LambderApiSignature.js";
 import { apiNameKeyOf } from "../shared/wire/LambderApiSignature.js";
+import { assertPlainData } from "../shared/util/assertPlainData.js";
 import { apiNotFoundAnswer, refusalAnswer, sessionExpiredAnswer, } from "../api/LambderApiEnvelope.js";
 import { bindContextTools, createContext, isV2HttpEvent, } from "./LambderContext.js";
 import { COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BR_FIELD, COMPRESSED_PAYLOAD_BYTES_FIELD } from "../shared/wire/LambderRequestPayload.js";
@@ -80,6 +81,8 @@ export default class Lambder {
     apiDefinitions = new Map();
     /** The guards map given at creation, kept for apiSignatures(): a guard's schema is part of the signature of every endpoint declaring it. */
     guards;
+    /** The rate-limit policies given at creation, kept for apiOptionEntries(), which records each one less its key handler. */
+    rateLimitPolicies;
     hookList = { "beforeRender": [], "afterRender": [], "fallback": [] };
     createdHooks = [];
     initPromise = null;
@@ -122,6 +125,7 @@ export default class Lambder {
         }
         const session = options.session;
         this.guards = options.guards;
+        this.rateLimitPolicies = options.rateLimits?.policies;
         this.pipeline = new LambderApiPipeline({
             apiVersion: this.apiVersion,
             minApiVersion: options.minApiVersion,
@@ -413,6 +417,71 @@ export default class Lambder {
         entries.sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
         return entries;
     }
+    /**
+     * Every registered API's mode and declared options as plain data, with
+     * the rate-limit policies and guards they name reduced to what is not
+     * code: what writeApiOptions (lambder/build) writes to a module a client,
+     * a mock or a test imports instead of the server. The contract carries
+     * the same options as types; this is the same fact as a value, for code
+     * that decides something at runtime with it.
+     *
+     * Nothing here is a secret or a handler by construction. A guard's
+     * parameter is written as it was declared, so it has to be plain data
+     * (a permission string, a list, a reason); one that is not fails by API
+     * and guard name. A policy's key handler is never written: its `per`
+     * says "custom" and no more. A guard's input schema is never written
+     * either; its declaration says only which of the three input modes it
+     * has. Every table is sorted by name, so the module diffs by endpoint
+     * and never moves when registrations are reordered.
+     */
+    apiOptionEntries() {
+        const apis = {};
+        for (const name of [...this.apiDefinitions.keys()].sort()) {
+            const { mode, guards, rateLimit, idempotency } = this.apiDefinitions.get(name);
+            const entry = { mode };
+            if (guards !== undefined) {
+                assertPlainData(guards, `the guards option of API "${name}"`);
+                entry.guards = guards;
+            }
+            if (rateLimit !== undefined) {
+                assertPlainData(rateLimit, `the rateLimit option of API "${name}"`);
+                entry.rateLimit = rateLimit;
+            }
+            if (idempotency !== undefined)
+                entry.idempotency = idempotency;
+            apis[name] = entry;
+        }
+        const rateLimitPolicies = {};
+        for (const name of Object.keys(this.rateLimitPolicies ?? {}).sort()) {
+            const { per, budget, chargeAt, errorMessage, ...windows } = this.rateLimitPolicies[name];
+            const entry = {};
+            for (const [window, limit] of Object.entries(windows)) {
+                if (limit !== undefined)
+                    entry[window] = limit;
+            }
+            if (per !== undefined)
+                entry.per = per === "ip" || per === "session" ? per : "custom";
+            if (budget !== undefined)
+                entry.budget = budget;
+            if (chargeAt !== undefined)
+                entry.chargeAt = chargeAt;
+            if (errorMessage !== undefined) {
+                assertPlainData(errorMessage, `the errorMessage of rate-limit policy "${name}"`);
+                entry.errorMessage = errorMessage;
+            }
+            rateLimitPolicies[name] = entry;
+        }
+        const guards = {};
+        for (const name of Object.keys(this.guards ?? {}).sort()) {
+            const guard = this.guards[name];
+            guards[name] = {
+                input: guard.apiInput ? "apiInput" : guard.guardInput ? "guardInput" : "none",
+                session: guard.session === true,
+                runAt: guard.runAt ?? "beforeInputValidation",
+            };
+        }
+        return { apis, rateLimitPolicies, guards };
+    }
     getResponseBuilder(ctx) {
         return new LambderResponseBuilder({
             files: this.files,

package/dist/index.d.ts

@@ -12,6 +12,11 @@ export { lambderCookieJarTransport } from "./shared/transport/lambderCookieJarTr
 export type { LambderApiTransport, LambderApiTransportRequest, LambderTransportFailureReason } from "./shared/transport/LambderApiTransport.js";
 export { LambderCookieJar, parseSetCookie } from "./shared/transport/LambderCookieJar.js";
 export { LambderExpiringMap, LambderExpiringMapFullError } from "./shared/util/LambderExpiringMap.js";
+export { LambderBackoffTimer } from "./shared/util/LambderBackoffTimer.js";
+export type { LambderBackoffTimerOptions } from "./shared/util/LambderBackoffTimer.js";
+export { LambderSignedClaims, keyedDigest, randomSecret } from "./shared/util/LambderSignedClaims.js";
+export type { LambderSignedClaimsOptions } from "./shared/util/LambderSignedClaims.js";
+export { constantTimeEquals } from "./shared/util/LambderTextDigest.js";
 export type { LambderStoredCookie } from "./shared/transport/LambderCookieJar.js";
 export { lambderHandlerTransport } from "./invoke/lambderHandlerTransport.js";
 export type { LambderHandlerTransportOptions } from "./invoke/lambderHandlerTransport.js";
@@ -106,6 +111,12 @@ export type { LambderRateLimiter, LambderRateLimitWindow, LambderRateLimitPolicy
 export { LambderDdbRateLimiter } from "./stores/LambderDdbRateLimiter.js";
 export type { LambderDdbRateLimiterOptions } from "./stores/LambderDdbRateLimiter.js";
 export { LambderMemoryRateLimiter } from "./stores/LambderMemoryRateLimiter.js";
+export { LambderOneShotSecrets } from "./secrets/LambderOneShotSecrets.js";
+export type { LambderOneShotSecretKind, LambderOneShotSecretsOptions, LambderOneShotIssueResult, LambderOneShotRedeemResult, LambderOneShotCodeKindNames, LambderOneShotTokenKindNames, } from "./secrets/LambderOneShotSecrets.js";
+export type { LambderOneShotSecretStore, LambderOneShotSecretRecord, LambderOneShotSecretDraft, LambderOneShotSecretShape, LambderOneShotIssueOutcome, } from "./shared/contracts/LambderOneShotSecretStore.js";
+export { LambderDdbOneShotSecretStore } from "./stores/LambderDdbOneShotSecretStore.js";
+export type { LambderDdbOneShotSecretStoreOptions } from "./stores/LambderDdbOneShotSecretStore.js";
+export { LambderMemoryOneShotSecretStore } from "./stores/LambderMemoryOneShotSecretStore.js";
 export type { LambderIdempotencyStore, LambderIdempotencyBeginResult, LambderIdempotencyDoneRecord, } from "./shared/contracts/LambderIdempotencyStore.js";
 export { LambderDdbIdempotencyStore } from "./stores/LambderDdbIdempotencyStore.js";
 export type { LambderDdbIdempotencyStoreOptions } from "./stores/LambderDdbIdempotencyStore.js";
@@ -118,6 +129,8 @@ export type { LambderRateLimitKeyBuilder } from "./api/LambderApiRateLimits.js";
 export type { LambderContextRateLimit, LambderContextRateLimitCheck, LambderRateLimitCheckResult, LambderChargeablePolicyNames, LambderChargeKeyArgs, LambderRateLimitKeyFn, LambderRateLimitPer, LambderRateLimitBudget, LambderRateLimitChargeAt, LambderApiRateLimitPolicyConfig, LambderApiRateLimitsConfig, LambderAllowedPolicyNames, LambderRateLimitOption, } from "./api/LambderApiRateLimits.js";
 export type { LambderApiIdempotencyConfig } from "./api/LambderApiIdempotency.js";
 export type { LambderGuardsOptionValue, LambderRateLimitOverride, LambderRateLimitOptionValue, LambderApiIdempotencyOption, } from "./shared/wire/LambderApiOptionValues.js";
+export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";
+export type { LambderApiOptionEntries, LambderApiOptionEntry, LambderRateLimitPolicyEntry, LambderGuardDeclarationEntry, LambderApisWithGuard, LambderApisGuardedBy, LambderApisWithMode, LambderGuardParamOf, } from "./shared/wire/LambderApiOptionEntries.js";
 export { createLambderI18n } from "./shared/LambderI18n.js";
 export type { LambderLanguageMeta, LambderI18nConfig, LambderI18nInstance, LambderI18nTranslator, LambderI18nExtractParams, LambderI18nDictionaryLoader, LambderI18nCodes, LambderI18nKeys, LambderI18nTranslatorFor, } from "./shared/LambderI18n.js";
 export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiResponseConfig, LambderApiNullAnswerConfig, LambderContractEntry, LambderMergeContract, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractKeysWithGuard, LambderJsonOf, LambderJsonOutputOf, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractRateLimitNames, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";

package/dist/index.js

@@ -9,6 +9,11 @@ export { buildTransportEnvelope, LambderTransportFailure, isLambderTransportFail
 export { lambderCookieJarTransport } from "./shared/transport/lambderCookieJarTransport.js";
 export { LambderCookieJar, parseSetCookie } from "./shared/transport/LambderCookieJar.js";
 export { LambderExpiringMap, LambderExpiringMapFullError } from "./shared/util/LambderExpiringMap.js";
+// Waiting longer after each failure, once: what the upload runner and an app's own retrying code climb.
+export { LambderBackoffTimer } from "./shared/util/LambderBackoffTimer.js";
+// Signed claims tokens, and the keyed digest and random secret for the secrets an app stores.
+export { LambderSignedClaims, keyedDigest, randomSecret } from "./shared/util/LambderSignedClaims.js";
+export { constantTimeEquals } from "./shared/util/LambderTextDigest.js";
 export { lambderHandlerTransport } from "./invoke/lambderHandlerTransport.js";
 export { synthesizeLambdaHttpEvent, decodeLambdaHttpResult, localLambdaContext, LAMBDER_INVOKE_HEADER, LAMBDER_INVOKED_BY_HEADER, LAMBDER_INVOKE_PROTOCOL, } from "./invoke/LambderLambdaEvent.js";
 // The API core: the request, answer, envelope and pipeline both the server and the mock runtime run
@@ -71,6 +76,11 @@ export { LambderMemoryCache } from "./stores/LambderMemoryCache.js";
 export { RATE_LIMIT_WINDOWS } from "./shared/contracts/LambderRateLimiter.js";
 export { LambderDdbRateLimiter } from "./stores/LambderDdbRateLimiter.js";
 export { LambderMemoryRateLimiter } from "./stores/LambderMemoryRateLimiter.js";
+// One-shot secrets: codes and tokens handed out once and taken back once, the
+// store interface they live in, and the DynamoDB and in-memory stores
+export { LambderOneShotSecrets } from "./secrets/LambderOneShotSecrets.js";
+export { LambderDdbOneShotSecretStore } from "./stores/LambderDdbOneShotSecretStore.js";
+export { LambderMemoryOneShotSecretStore } from "./stores/LambderMemoryOneShotSecretStore.js";
 export { LambderDdbIdempotencyStore } from "./stores/LambderDdbIdempotencyStore.js";
 export { LambderMemoryIdempotencyStore } from "./stores/LambderMemoryIdempotencyStore.js";
 // Declarative per-API policies: guards
@@ -78,6 +88,9 @@ export { lambderGuard, lambderRateLimitKey } from "./core/LambderPolicyBuilders.
 export { lambderGuardBuilder } from "./api/LambderApiGuards.js";
 // Declarative per-API policies: rate limits
 export { lambderRateLimitKeyBuilder, rateLimitRefusal, DEFAULT_RATE_LIMIT_REFUSAL } from "./api/LambderApiRateLimits.js";
+// The declared options as plain data: what apiOptionEntries() reports and
+// writeApiOptions writes, and the readers over the generated tables.
+export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";
 // Typed translations (standalone, isomorphic)
 export { createLambderI18n } from "./shared/LambderI18n.js";
 export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";

package/dist/mock/LambderMockApp.d.ts

@@ -10,6 +10,7 @@ import { LambderMemoryIdempotencyStore } from "../stores/LambderMemoryIdempotenc
 import { LambderMemorySessionStore } from "../stores/LambderMemorySessionStore.js";
 import LambderSessionManager, { type LambderCreatedSession } from "../session/LambderSessionManager.js";
 import type { LambderMockAppOptions, LambderMockIdempotencyOptions, LambderMockTransport, LambderMockTransportOptions } from "./LambderMockCreateOptions.js";
+import type { LambderApiOptionEntry, LambderGuardDeclarationEntry } from "../shared/wire/LambderApiOptionEntries.js";
 import type { LambderMockCallContext, LambderMockCallRecord, LambderMockEntry, LambderMockEntryInput, LambderMockFailure, LambderMockFailureReason, LambderMockHandler, LambderMockLatency, LambderMockListener, LambderMockPublicNames, LambderMockRateLimitPolicies, LambderMockRegistryCheck, LambderMockRestEntry, LambderMockSessionCallContext, LambderMockSessionNames, LambderMockSlice, LambderMockOverride } from "./LambderMockTypes.js";
 /**
  * The mock runtime: the API core (LambderApiPipeline, the same class the
@@ -23,9 +24,10 @@ import type { LambderMockCallContext, LambderMockCallRecord, LambderMockEntry, L
  *
  * Create one with initLambderMock<Contract, SessionData>().create(...),
  * which fixes the contract and session types first so everything else is
- * inferred from the options.
+ * inferred from the options. `TDerived` is true for a mock created with the
+ * generated `apiOptions` table, whose entries are their handlers alone.
  */
-export declare class LambderMockApp<C extends LambderApiContractShape, S = any, G extends Record<string, LambderApiGuard<any, any, any>> = {}> {
+export declare class LambderMockApp<C extends LambderApiContractShape, S = any, G extends Record<string, LambderApiGuard<any, any, any>> = {}, TDerived extends boolean = false> {
     readonly apiVersion: string | null;
     /** The memory stores, for assertions and reset; null for a subsystem that is off or backed by a store of yours. */
     readonly sessionStore: LambderMemorySessionStore<S> | null;
@@ -61,9 +63,11 @@ export declare class LambderMockApp<C extends LambderApiContractShape, S = any,
     private readonly recorder;
     /** Registered entries and the overrides over them (see LambderMockEntryRegistry). */
     private readonly registry;
+    /** The server's declared options per API, when create() was given the generated table; the entries' declarations come from here. */
+    private readonly apiOptions;
     /** The jars the runtime owns and what it planted in document.cookie (see LambderMockBrowserCookies). */
     private readonly browserCookies;
-    constructor(options: LambderMockAppOptions<C, S, G>);
+    constructor(options: LambderMockAppOptions<C, S, G, LambderMockRateLimitPolicies<S>, boolean | LambderMockIdempotencyOptions<S>, {}, Record<string, LambderApiOptionEntry> | undefined>);
     /**
      * The registration-time checks every entry goes through, mocked or not:
      * the ones the server runs on a definition, and the mock's own "a session
@@ -75,11 +79,21 @@ export declare class LambderMockApp<C extends LambderApiContractShape, S = any,
      * option, for a mistake fixed by one option at create().
      */
     private assertEntryRegistration;
+    /**
+     * The table's entry for an endpoint, when create() was given one: null
+     * without a table, and a throw for a name the table does not hold or an
+     * entry registered under the other mode. The compiler already refuses
+     * both against the contract; this is where a stale table meets a caller
+     * the compiler did not see.
+     */
+    private declaredOptionsOf;
+    /** The mode the apiOptions table gives a name, or null without a table or for a name it does not hold. */
+    private declaredModeOf;
     private buildEntry;
     /** A mock for a public endpoint: a handler, or the handler with the endpoint's declarations restated. */
-    publicApi<K extends LambderMockPublicNames<C>, TInputSchema extends z.ZodType = z.ZodType>(name: K, entry: LambderMockEntryInput<C, K, S, G, TInputSchema>): LambderMockEntry<C, K>;
+    publicApi<K extends LambderMockPublicNames<C>, TInputSchema extends z.ZodType = z.ZodType>(name: K, entry: LambderMockEntryInput<C, K, S, G, TInputSchema, TDerived>): LambderMockEntry<C, K>;
     /** A mock for a session endpoint: the pipeline fetches the session before the handler runs, and refuses without one. */
-    sessionApi<K extends LambderMockSessionNames<C>, TInputSchema extends z.ZodType = z.ZodType>(name: K, entry: LambderMockEntryInput<C, K, S, G, TInputSchema>): LambderMockEntry<C, K>;
+    sessionApi<K extends LambderMockSessionNames<C>, TInputSchema extends z.ZodType = z.ZodType>(name: K, entry: LambderMockEntryInput<C, K, S, G, TInputSchema, TDerived>): LambderMockEntry<C, K>;
     /**
      * A public endpoint deliberately left without a mock; a call answers the
      * notMocked refusal carrying the reason.
@@ -111,13 +125,15 @@ export declare class LambderMockApp<C extends LambderApiContractShape, S = any,
      * still refused, and an entry registered later (registerPartial, or a
      * second register) takes its endpoint back from the rest.
      *
-     * What it cannot do is the session read. The mode of an unregistered name
-     * is not knowable at runtime (the contract is a type), so a call it
-     * answers is processed as public: the protocol's pre-pass still runs, so
-     * a stale client still hears versionExpired, but a signed-out call to an
-     * unmocked session endpoint answers "not mocked" where the server answers
-     * sessionExpired. Declare an endpoint whose signed-out path a test cares
-     * about with sessionNotMocked instead.
+     * The mode of an unregistered name comes from the apiOptions table, when
+     * create() was given one, so an unmocked session endpoint still reads the
+     * session and a signed-out call answers sessionExpired as on the server.
+     * Without the table the mode is not knowable at runtime (the contract is
+     * a type), and a call it answers is processed as public: the protocol's
+     * pre-pass still runs, so a stale client still hears versionExpired, but
+     * a signed-out call to an unmocked session endpoint answers "not mocked"
+     * where the server answers sessionExpired. Declare an endpoint whose
+     * signed-out path a test cares about with sessionNotMocked there.
      */
     restNotMocked(reason: string): LambderMockRestEntry;
     private buildNotMockedEntry;
@@ -165,10 +181,11 @@ export declare class LambderMockApp<C extends LambderApiContractShape, S = any,
     /**
      * The entry that answers a name nothing registered, when register() was
      * given a rest entry: the notMocked refusal carrying its reason, run
-     * through the pipeline as a public endpoint, since the mode of an
-     * unregistered name cannot be recovered at runtime. Everything before
-     * dispatch still runs (the signature gate, the payload restore); the
-     * missing session read is the fidelity limit restNotMocked documents.
+     * through the pipeline under the mode the apiOptions table gives the
+     * name, and as a public endpoint where there is no table to say (the
+     * mode of an unregistered name cannot otherwise be recovered at runtime).
+     * Everything before dispatch still runs (the signature gate, the payload
+     * restore, and for a session endpoint the session read).
      */
     private restNotMockedEntry;
     /** The next call to the endpoint fails this way; several calls queue in order. */
@@ -332,5 +349,5 @@ export declare const initLambderMock: <C extends LambderApiContractShape, S = an
      * dropped. `I` exists for the same reason `P` does, and
      * LambderMockSurplusKeys puts the error back on the key.
      */
-    create<const G extends Record<string, LambderApiGuard<any, any, any, LambderMockCallContext<S>, LambderMockSessionCallContext<S>>> = {}, const P extends LambderMockRateLimitPolicies<S> = {}, I extends boolean | LambderMockIdempotencyOptions<S> = boolean | LambderMockIdempotencyOptions<S>>(options: LambderMockAppOptions<C, S, G, P, I>): LambderMockApp<C, S, G>;
+    create<const G extends Record<string, LambderApiGuard<any, any, any, LambderMockCallContext<S>, LambderMockSessionCallContext<S>>> = {}, const P extends LambderMockRateLimitPolicies<S> = {}, I extends boolean | LambderMockIdempotencyOptions<S> = boolean | LambderMockIdempotencyOptions<S>, const D extends Record<string, LambderGuardDeclarationEntry> = {}, const A extends Record<string, LambderApiOptionEntry> | undefined = undefined>(options: LambderMockAppOptions<C, S, G, P, I, D, A>): LambderMockApp<C, S, G, [A] extends [undefined] ? false : true>;
 };

package/dist/mock/LambderMockApp.js

@@ -47,7 +47,8 @@ const defaultCookieHost = () => globalThis.location?.host || "localhost";
  *
  * Create one with initLambderMock<Contract, SessionData>().create(...),
  * which fixes the contract and session types first so everything else is
- * inferred from the options.
+ * inferred from the options. `TDerived` is true for a mock created with the
+ * generated `apiOptions` table, whose entries are their handlers alone.
  */
 export class LambderMockApp {
     apiVersion;
@@ -85,10 +86,13 @@ export class LambderMockApp {
     recorder;
     /** Registered entries and the overrides over them (see LambderMockEntryRegistry). */
     registry = new LambderMockEntryRegistry();
+    /** The server's declared options per API, when create() was given the generated table; the entries' declarations come from here. */
+    apiOptions;
     /** The jars the runtime owns and what it planted in document.cookie (see LambderMockBrowserCookies). */
     browserCookies = new LambderMockBrowserCookies();
     constructor(options) {
         this.apiVersion = options.apiVersion ?? null;
+        this.apiOptions = options.apiOptions ?? null;
         this.failures = new LambderMockFailureInjector({ apiVersion: this.apiVersion, latency: options.latency ?? 0 });
         this.recorder = new LambderMockCallRecorder({ callLogSize: options.callLogSize ?? DEFAULT_CALL_LOG_SIZE });
         // The loopback address when nothing names a client, as for a request
@@ -196,13 +200,49 @@ export class LambderMockApp {
             throw new Error(`LambderMockApp: session endpoint "${definition.name}" needs the sessions option at creation.`);
         }
     }
+    /**
+     * The table's entry for an endpoint, when create() was given one: null
+     * without a table, and a throw for a name the table does not hold or an
+     * entry registered under the other mode. The compiler already refuses
+     * both against the contract; this is where a stale table meets a caller
+     * the compiler did not see.
+     */
+    declaredOptionsOf(name, mode) {
+        if (!this.apiOptions)
+            return null;
+        const declared = Object.prototype.hasOwnProperty.call(this.apiOptions, name) ? this.apiOptions[name] : undefined;
+        if (!declared) {
+            throw new Error(`LambderMockApp: "${name}" has no entry in the apiOptions table given to create(). The table predates this endpoint: regenerate it with writeApiOptions.`);
+        }
+        if (declared.mode !== mode) {
+            throw new Error(`LambderMockApp: "${name}" is a ${declared.mode} endpoint in the apiOptions table, registered here as a ${mode} one.`);
+        }
+        return declared;
+    }
+    /** The mode the apiOptions table gives a name, or null without a table or for a name it does not hold. */
+    declaredModeOf(name) {
+        if (!this.apiOptions || !Object.prototype.hasOwnProperty.call(this.apiOptions, name))
+            return null;
+        return this.apiOptions[name].mode;
+    }
     buildEntry(name, mode, input) {
         const options = (typeof input === "function" ? { handler: input } : input);
+        const declared = this.declaredOptionsOf(name, mode);
+        if (declared) {
+            // A caller the compiler did not see (a JavaScript slice, a cast)
+            // would otherwise have its restatement silently lose to the table.
+            for (const field of ["guards", "rateLimit", "idempotency"]) {
+                if (options[field] !== undefined) {
+                    throw new Error(`LambderMockApp: "${name}" restates its ${field} option, which the apiOptions table given to create() already declares. Leave it out of the entry.`);
+                }
+            }
+        }
+        const declarations = declared ?? options;
         const definition = {
             name, mode,
-            guards: options.guards,
-            rateLimit: options.rateLimit,
-            idempotency: options.idempotency,
+            guards: declarations.guards,
+            rateLimit: declarations.rateLimit,
+            idempotency: declarations.idempotency,
             // No cast: the entry's schema is a z.ZodType, the same type the
             // definition holds. A structural { safeParse } here would let a
             // validator that is not a zod schema reach the 422 body as
@@ -257,18 +297,21 @@ export class LambderMockApp {
      * still refused, and an entry registered later (registerPartial, or a
      * second register) takes its endpoint back from the rest.
      *
-     * What it cannot do is the session read. The mode of an unregistered name
-     * is not knowable at runtime (the contract is a type), so a call it
-     * answers is processed as public: the protocol's pre-pass still runs, so
-     * a stale client still hears versionExpired, but a signed-out call to an
-     * unmocked session endpoint answers "not mocked" where the server answers
-     * sessionExpired. Declare an endpoint whose signed-out path a test cares
-     * about with sessionNotMocked instead.
+     * The mode of an unregistered name comes from the apiOptions table, when
+     * create() was given one, so an unmocked session endpoint still reads the
+     * session and a signed-out call answers sessionExpired as on the server.
+     * Without the table the mode is not knowable at runtime (the contract is
+     * a type), and a call it answers is processed as public: the protocol's
+     * pre-pass still runs, so a stale client still hears versionExpired, but
+     * a signed-out call to an unmocked session endpoint answers "not mocked"
+     * where the server answers sessionExpired. Declare an endpoint whose
+     * signed-out path a test cares about with sessionNotMocked there.
      */
     restNotMocked(reason) {
         return { restNotMockedReason: reason };
     }
     buildNotMockedEntry(name, mode, reason) {
+        this.declaredOptionsOf(name, mode);
         const definition = { name, mode };
         this.assertEntryRegistration(definition);
         return { name, mode, definition, handler: null, notMockedReason: reason };
@@ -352,16 +395,18 @@ export class LambderMockApp {
     /**
      * The entry that answers a name nothing registered, when register() was
      * given a rest entry: the notMocked refusal carrying its reason, run
-     * through the pipeline as a public endpoint, since the mode of an
-     * unregistered name cannot be recovered at runtime. Everything before
-     * dispatch still runs (the signature gate, the payload restore); the
-     * missing session read is the fidelity limit restNotMocked documents.
+     * through the pipeline under the mode the apiOptions table gives the
+     * name, and as a public endpoint where there is no table to say (the
+     * mode of an unregistered name cannot otherwise be recovered at runtime).
+     * Everything before dispatch still runs (the signature gate, the payload
+     * restore, and for a session endpoint the session read).
      */
     restNotMockedEntry(apiName) {
         const reason = this.registry.restNotMockedReason;
         if (reason === null)
             return null;
-        return { name: apiName, mode: "public", definition: { name: apiName, mode: "public" }, handler: null, notMockedReason: reason };
+        const mode = this.declaredModeOf(apiName) ?? "public";
+        return { name: apiName, mode, definition: { name: apiName, mode }, handler: null, notMockedReason: reason };
     }
     // -----------------------------------------------------------------------
     // Control surface
@@ -581,12 +626,13 @@ export class LambderMockApp {
         const id = this.recorder.nextCallId();
         const registered = this.entryFor(request.apiName);
         // The rest entry answers whatever nothing registered, when register()
-        // was given one. The mode reported stays the registered entry's, so it
-        // is null here exactly as it is for a name the registry does not know:
-        // the rest answer is processed as public, which is a property of the
-        // answer rather than a claim about the endpoint.
+        // was given one. The mode reported is the registered entry's, or the
+        // apiOptions table's for a name it holds, and null otherwise, exactly
+        // as for a name nothing knows: without the table a rest answer is
+        // processed as public, which is a property of the answer rather than
+        // a claim about the endpoint.
         const entry = registered ?? this.restNotMockedEntry(request.apiName);
-        const mode = registered?.mode ?? null;
+        const mode = registered?.mode ?? this.declaredModeOf(request.apiName);
         const facts = this.callFacts(id, request, mode);
         const startedAt = facts.startedAt;
         const ctx = this.createContext(request);

package/dist/mock/LambderMockCreateOptions.d.ts

@@ -3,8 +3,9 @@ import type { LambderApiSignatureMap } from "../shared/wire/LambderApiSignature.
 import type { LambderApiResponseConfig } from "../shared/wire/LambderApiContract.js";
 import type { LambderHttpStatusCode } from "../shared/wire/LambderHttpStatus.js";
 import type { MaybePromise } from "../shared/util/LambderTypeUtilities.js";
-import type { LambderContractGuardNames, LambderContractIdempotencyOf, LambderContractKeysWithMode, LambderContractRateLimitNames, LambderContractRateLimitOf } from "../shared/wire/LambderApiContract.js";
+import type { LambderContractGuardNames, LambderContractIdempotencyOf, LambderContractKeysWithMode, LambderContractMode, LambderContractRateLimitNames, LambderContractRateLimitOf } from "../shared/wire/LambderApiContract.js";
 import type { LambderApiGuard } from "../api/LambderApiGuards.js";
+import type { LambderApiOptionEntry, LambderGuardDeclarationEntry } from "../shared/wire/LambderApiOptionEntries.js";
 import type { LambderApiRateLimitPolicyConfig } from "../api/LambderApiRateLimits.js";
 import type { LambderApiRequest } from "../api/LambderApiRequest.js";
 import type { LambderApiTransport } from "../shared/transport/LambderApiTransport.js";
@@ -114,6 +115,37 @@ type LambderMockRateLimitsOptions<C, S, P extends LambderMockRateLimitPolicies<S
     /** Let a call through when the limiter throws, instead of refusing it. Default: true. */
     failOpen?: boolean;
 };
+/**
+ * The shape a mock guard has to have to stand in for a server guard the
+ * generated `guardDeclarations` table describes: the same input mode and the
+ * same session requirement. The contract cannot say these for every guard
+ * (it names a guardInput's shape, and nothing about a guard fed from the
+ * payload or from nothing), so a mock guard that reads a payload slice the
+ * server's guard never sees, or that requires a session where the server's
+ * does not, would run and decide differently without this.
+ */
+export type LambderMockGuardShapeOf<D> = (D extends {
+    input: "apiInput";
+} ? {
+    apiInput: z.ZodType;
+} : D extends {
+    input: "guardInput";
+} ? {
+    guardInput: z.ZodType;
+} : {
+    apiInput?: undefined;
+    guardInput?: undefined;
+}) & (D extends {
+    session: true;
+} ? {
+    session: true;
+} : {
+    session?: false | undefined;
+});
+/** Each mock guard the declarations know held to its declared shape; a guard the table does not have is free. */
+type LambderMockGuardsAgree<G, D> = {
+    [N in keyof G & keyof D]: G[N] extends LambderMockGuardShapeOf<D[N]> ? unknown : LambderMockGuardShapeOf<D[N]>;
+};
 /**
  * The guards option: required whenever the contract declares any guard name,
  * omittable only for a contract that declares none.
@@ -123,12 +155,12 @@ type LambderMockRateLimitsOptions<C, S, P extends LambderMockRateLimitPolicies<S
  * would answer 200 here. Optional, it would be the droppable half of exactly
  * the check it exists for.
  */
-type LambderMockGuardsOption<C, S, G> = [
+type LambderMockGuardsOption<C, S, G, D> = [
     LambderContractGuardNames<C>
 ] extends [never] ? {
-    guards?: G & LambderMockGuards<C, S> & LambderMockGuardShapes<S, G>;
+    guards?: G & LambderMockGuards<C, S> & LambderMockGuardShapes<S, G> & LambderMockGuardsAgree<G, NoInfer<D>>;
 } : {
-    guards: G & LambderMockGuards<C, S> & LambderMockGuardShapes<S, G>;
+    guards: G & LambderMockGuards<C, S> & LambderMockGuardShapes<S, G> & LambderMockGuardsAgree<G, NoInfer<D>>;
 };
 /**
  * The sessions, idempotency and rateLimits options: each required whenever
@@ -168,7 +200,38 @@ type LambderMockRateLimitsOption<C, S, P extends LambderMockRateLimitPolicies<S>
 type LambderMockGuardShapes<S, G> = {
     [N in keyof G]: LambderMockSurplusKeys<G[N], LambderApiGuard<any, any, any, LambderMockCallContext<S>, LambderMockSessionCallContext<S>>>;
 };
-export type LambderMockAppOptions<C, S, G, P extends LambderMockRateLimitPolicies<S> = LambderMockRateLimitPolicies<S>, I extends boolean | LambderMockIdempotencyOptions<S> = boolean | LambderMockIdempotencyOptions<S>> = LambderMockGuardsOption<C, S, G> & LambderMockSessionsOption<C, S> & LambderMockIdempotencyOption<C, S, I> & LambderMockRateLimitsOption<C, S, P> & {
+/**
+ * What the generated `apiOptions` table has to hold to stand in for the
+ * restated declarations of a contract's entries: an entry for every endpoint
+ * the contract declares, of the endpoint's mode. A table generated before an
+ * endpoint was added, or before one changed mode, is a compile error at the
+ * option rather than a throw when that endpoint's entry registers.
+ */
+export type LambderMockApiOptionsCover<C> = {
+    [K in keyof C & string]: {
+        mode: LambderContractMode<C, K>;
+    };
+};
+export type LambderMockAppOptions<C, S, G, P extends LambderMockRateLimitPolicies<S> = LambderMockRateLimitPolicies<S>, I extends boolean | LambderMockIdempotencyOptions<S> = boolean | LambderMockIdempotencyOptions<S>, D extends Record<string, LambderGuardDeclarationEntry> = {}, A extends Record<string, LambderApiOptionEntry> | undefined = undefined> = LambderMockGuardsOption<C, S, G, D> & LambderMockSessionsOption<C, S> & LambderMockIdempotencyOption<C, S, I> & LambderMockRateLimitsOption<C, S, P> & {
+    /**
+     * The server's guard declarations, as the generated options module
+     * exports them (`guardDeclarations`). Given, every mock guard of a name
+     * the table has is held to its input mode and session requirement at
+     * the `guards` option (see LambderMockGuardShapeOf). Nothing runs on it.
+     */
+    guardDeclarations?: D;
+    /**
+     * The server's declared options per API, as the generated options module
+     * exports them (`apiOptions`). Given, every entry's guards, rateLimit and
+     * idempotency are read off the table rather than restated: an entry is
+     * its handler (and an input schema, if it has one), a restated option is
+     * a compile error, and an endpoint whose mode the table and the builder
+     * disagree on is refused at registration. A restNotMocked answer reads
+     * the endpoint's mode off the table too, so a session endpoint nothing
+     * mocks still reads the session first. The table has to cover the
+     * contract (see LambderMockApiOptionsCover).
+     */
+    apiOptions?: A & LambderMockApiOptionsCover<C>;
     /** Stamped on every answer's envelope as apiVersion, as the server's option is. */
     apiVersion?: string;
     /** The version floor, as on the server: a call naming a lower `version` answers versionExpired whatever its signature says. */