lambder 8.1.2 → 9.0.1

package/dist/core/LambderResponseBuilder.d.ts

@@ -1,12 +1,10 @@
-import type { z } from "zod";
 import type { LambderRenderContext } from "./LambderContext.js";
-import { type LambderCookieOptions, type LambderClearCookieOptions } from "../shared/wire/LambderCookie.js";
 import type { LambderFiles } from "./LambderFiles.js";
 import { LambderResponse, type LambderHeadersInput } from "./LambderResponse.js";
 import type { LambderHttpStatusCode } from "../shared/wire/LambderHttpStatus.js";
 import { LambderSafeHtml } from "../shared/LambderHtml.js";
 import type { LambderTemplateData } from "./LambderTemplatingEngine.js";
-import type { LambderApiResponseConfig, LambderApiNullAnswerConfig } from "../shared/wire/LambderApiContract.js";
+import type { LambderApiResponseConfig } from "../shared/wire/LambderApiContract.js";
 export type { LambderApiEnvelopeBody, LambderApiResponseConfig } from "../shared/wire/LambderApiContract.js";
 export type LambderResponseOptions = {
     statusCode?: LambderHttpStatusCode;
@@ -18,19 +16,6 @@ export type LambderResponseOptions = {
     /** "auto" (default): ETag on GET/HEAD 200 when globally enabled. true: force. false: never. */
     etag?: boolean | "auto";
 };
-/**
- * The two shapes of an API answer: the output the contract declares, or
- * `null` beside a config that says why (a refusal flag, an `errorMessage`, a
- * `message`). A bare `res.api(null)` compiles only when the output type
- * itself allows null, so a success payload is always the declared output,
- * which lets a typed caller (LambderInvokeCaller.api) promise it. Untyped
- * resolvers (`TOutput = any`) accept anything. This is the resolver's method
- * type; the core's answer type is LambderApiAnswer.
- */
-export type LambderResolverApiMethod<TOutput, TResult> = {
-    (payload: TOutput, config?: LambderApiResponseConfig, options?: LambderResponseOptions): TResult;
-    (payload: null, config: LambderApiNullAnswerConfig, options?: LambderResponseOptions): TResult;
-};
 export type LambderRawResponseInit = {
     statusCode: LambderHttpStatusCode;
     headers?: LambderHeadersInput;
@@ -40,39 +25,23 @@ export type LambderRawResponseInit = {
     compress?: boolean | "auto";
     etag?: boolean | "auto";
 };
-export default class LambderResponseBuilder<TResponse = any> {
+/**
+ * Builds the responses of routes, hooks and error handlers. An API handler
+ * never holds one: it returns its output or refuses, and writes headers and
+ * cookies through its context (LambderResponseTools).
+ */
+export default class LambderResponseBuilder {
     protected files: LambderFiles | null;
     protected apiVersion: string | null;
     protected ctx?: LambderRenderContext;
-    /** The output schema of the API this builder answers, which every success payload is parsed through; null outside an API handler. */
-    protected apiOutput: z.ZodType | null;
-    constructor({ files, apiVersion, ctx, apiOutput }: {
+    constructor({ files, apiVersion, ctx }: {
         files?: LambderFiles | null;
         apiVersion?: string | null;
         ctx?: LambderRenderContext;
-        apiOutput?: z.ZodType;
     });
     private buildResponse;
     /** The instance's file reader, which res.file and res.templateFile need. */
     private requireFiles;
-    /** Appends a response header; applied onto the response once the handler has one, in call order. */
-    addHeader(key: string, value: string): void;
-    /** Replaces a response header; applied onto the response once the handler has one, in call order. */
-    setHeader(key: string, value: string | string[]): void;
-    /**
-     * Adds a Set-Cookie header. A function-form `domain` is resolved against
-     * the request hostname. Defaults: Path=/, SameSite=Lax, Secure, not
-     * HttpOnly, browser-session lifetime.
-     */
-    setCookie(name: string, value: string, options?: LambderCookieOptions): void;
-    /**
-     * Adds a Set-Cookie header that deletes the cookie. Pass the same
-     * `domain` and `path` the cookie was set with: a cookie's identity is
-     * (name, domain, path), and a deletion under a different scope targets a
-     * different cookie and deletes nothing.
-     */
-    clearCookie(name: string, options?: LambderClearCookieOptions): void;
-    logToApiResponse(input: unknown): void;
     raw(init: LambderRawResponseInit): LambderResponse;
     json(data: Record<string, any>, options?: LambderResponseOptions): LambderResponse;
     text(data: string, options?: LambderResponseOptions): LambderResponse;
@@ -109,37 +78,13 @@ export default class LambderResponseBuilder<TResponse = any> {
     templateFile(filePath: string, data?: LambderTemplateData, options?: LambderResponseOptions & {
         htmlVirtualSlots?: boolean;
     }): Promise<LambderResponse>;
-    api(payload: TResponse, config?: LambderApiResponseConfig, options?: LambderResponseOptions): LambderResponse;
-    api(payload: null, config: LambderApiNullAnswerConfig, options?: LambderResponseOptions): LambderResponse;
     /**
-     * A payload as the API's output schema declares it. The type system
-     * accepts a value that carries more than the schema (a row read straight
-     * from a table is assignable to a narrower object type), and without this
-     * the extra fields, a password hash included, would reach the client.
-     * zod strips what the schema does not declare, fills its defaults and
-     * applies its transforms, so the wire and the idempotency store only see
-     * the declared shape. A refusal's payload beside an errorMessage or a
-     * flag is parsed the same way; only null passes as it is. Only an API
-     * handler's own resolver holds the schema: a hook, a validation handler
-     * or an error handler answers in shapes of its own, a cached answer in
-     * its wire form, and is sent as given.
-     *
-     * The payload is the schema's input form (what a handler writes before
-     * the transforms), so a transform runs exactly once. A payload the schema
-     * rejects is a handler breaking its contract, answered as a crash rather
-     * than sent (LambderApiOutputValidationError, which an idempotency key
-     * records as its answer, since the handler has already run).
-     *
-     * The parse is synchronous, so an output schema cannot be async: zod
-     * throws from a synchronous parse that meets an async refinement or
-     * transform, and a transform may throw of its own accord. Either throw
-     * becomes the same LambderApiOutputValidationError, carrying what was
-     * thrown as its cause. Left to escape as it is, it would read as the
-     * handler crashing before its answer: the idempotency engine would
-     * release the key's claim and every retry would run the operation again.
+     * An API envelope written by hand: what a hook, an input validation
+     * handler or a global error handler answers an API call with (a refusal
+     * flag, an errorMessage, a crash). The payload goes out as given; an API
+     * handler's own output is parsed through its schema by the instance
+     * instead. The logList channel is what the request accumulated unless the
+     * config names its own.
      */
-    private declaredPayload;
-    /** Same as api() but forces compression of the response body. */
-    apiBinary(payload: TResponse, config?: LambderApiResponseConfig, options?: LambderResponseOptions): LambderResponse;
-    apiBinary(payload: null, config: LambderApiNullAnswerConfig, options?: LambderResponseOptions): LambderResponse;
+    api(payload: unknown, config?: LambderApiResponseConfig, options?: LambderResponseOptions): LambderResponse;
 }

package/dist/core/LambderResponseBuilder.js

@@ -1,18 +1,18 @@
-import { serializeCookie, serializeClearCookie } from "../shared/wire/LambderCookie.js";
 import { LambderResponse } from "./LambderResponse.js";
 import { buildApiEnvelope } from "../api/LambderApiEnvelope.js";
-import { LambderApiOutputValidationError } from "../api/LambderApiOutputValidationError.js";
+/**
+ * Builds the responses of routes, hooks and error handlers. An API handler
+ * never holds one: it returns its output or refuses, and writes headers and
+ * cookies through its context (LambderResponseTools).
+ */
 export default class LambderResponseBuilder {
     files;
     apiVersion;
     ctx;
-    /** The output schema of the API this builder answers, which every success payload is parsed through; null outside an API handler. */
-    apiOutput;
-    constructor({ files, apiVersion, ctx, apiOutput }) {
+    constructor({ files, apiVersion, ctx }) {
         this.files = files ?? null;
         this.apiVersion = apiVersion ?? null;
         this.ctx = ctx;
-        this.apiOutput = apiOutput ?? null;
     }
     ;
     buildResponse(statusCode, contentType, body, options, defaults) {
@@ -37,49 +37,6 @@ export default class LambderResponseBuilder {
             throw new Error(`Lambder: ${method} requires the files option at creation (e.g. files: new LambderLocalFileSource({ root }))`);
         return this.files;
     }
-    /** Appends a response header; applied onto the response once the handler has one, in call order. */
-    addHeader(key, value) {
-        if (!this.ctx)
-            throw new Error("Lambder: res.addHeader needs the request context, and this response builder was created without one.");
-        this.ctx.responseHeaders.add(key, value);
-    }
-    ;
-    /** Replaces a response header; applied onto the response once the handler has one, in call order. */
-    setHeader(key, value) {
-        if (!this.ctx)
-            throw new Error("Lambder: res.setHeader needs the request context, and this response builder was created without one.");
-        this.ctx.responseHeaders.set(key, value);
-    }
-    ;
-    /**
-     * Adds a Set-Cookie header. A function-form `domain` is resolved against
-     * the request hostname. Defaults: Path=/, SameSite=Lax, Secure, not
-     * HttpOnly, browser-session lifetime.
-     */
-    setCookie(name, value, options) {
-        if (!this.ctx)
-            throw new Error("Lambder: res.setCookie needs the request context, and this response builder was created without one.");
-        this.addHeader("Set-Cookie", serializeCookie(name, value, options, this.ctx.host));
-    }
-    ;
-    /**
-     * Adds a Set-Cookie header that deletes the cookie. Pass the same
-     * `domain` and `path` the cookie was set with: a cookie's identity is
-     * (name, domain, path), and a deletion under a different scope targets a
-     * different cookie and deletes nothing.
-     */
-    clearCookie(name, options) {
-        if (!this.ctx)
-            throw new Error("Lambder: res.clearCookie needs the request context, and this response builder was created without one.");
-        this.addHeader("Set-Cookie", serializeClearCookie(name, options, this.ctx.host));
-    }
-    ;
-    logToApiResponse(input) {
-        if (!this.ctx)
-            throw new Error("Lambder: res.logToApiResponse needs the request context, and this response builder was created without one.");
-        this.ctx.logList.push(input);
-    }
-    ;
     raw(init) {
         return new LambderResponse({
             statusCode: init.statusCode,
@@ -177,58 +134,17 @@ export default class LambderResponseBuilder {
         return this.buildResponse(200, "text/html; charset=utf-8", template.render(data), options);
     }
     ;
-    api(payload, config = {}, options) {
-        // The envelope is the core's (one writer for both the server and the
-        // mock runtime); the logList channel is what this request accumulated
-        // unless the config names its own.
-        const envelope = buildApiEnvelope(this.apiVersion, this.declaredPayload(payload), { ...config, logList: config.logList || this.ctx?.logList });
-        return this.json(envelope, options);
-    }
-    ;
     /**
-     * A payload as the API's output schema declares it. The type system
-     * accepts a value that carries more than the schema (a row read straight
-     * from a table is assignable to a narrower object type), and without this
-     * the extra fields, a password hash included, would reach the client.
-     * zod strips what the schema does not declare, fills its defaults and
-     * applies its transforms, so the wire and the idempotency store only see
-     * the declared shape. A refusal's payload beside an errorMessage or a
-     * flag is parsed the same way; only null passes as it is. Only an API
-     * handler's own resolver holds the schema: a hook, a validation handler
-     * or an error handler answers in shapes of its own, a cached answer in
-     * its wire form, and is sent as given.
-     *
-     * The payload is the schema's input form (what a handler writes before
-     * the transforms), so a transform runs exactly once. A payload the schema
-     * rejects is a handler breaking its contract, answered as a crash rather
-     * than sent (LambderApiOutputValidationError, which an idempotency key
-     * records as its answer, since the handler has already run).
-     *
-     * The parse is synchronous, so an output schema cannot be async: zod
-     * throws from a synchronous parse that meets an async refinement or
-     * transform, and a transform may throw of its own accord. Either throw
-     * becomes the same LambderApiOutputValidationError, carrying what was
-     * thrown as its cause. Left to escape as it is, it would read as the
-     * handler crashing before its answer: the idempotency engine would
-     * release the key's claim and every retry would run the operation again.
+     * An API envelope written by hand: what a hook, an input validation
+     * handler or a global error handler answers an API call with (a refusal
+     * flag, an errorMessage, a crash). The payload goes out as given; an API
+     * handler's own output is parsed through its schema by the instance
+     * instead. The logList channel is what the request accumulated unless the
+     * config names its own.
      */
-    declaredPayload(payload) {
-        if (!this.apiOutput || payload === null)
-            return payload;
-        const apiName = this.ctx?.apiName ?? "?";
-        let parsed;
-        try {
-            parsed = this.apiOutput.safeParse(payload);
-        }
-        catch (thrown) {
-            throw new LambderApiOutputValidationError(apiName, { thrown });
-        }
-        if (parsed.success)
-            return parsed.data;
-        throw new LambderApiOutputValidationError(apiName, { zodError: parsed.error });
-    }
-    apiBinary(payload, config = {}, options) {
-        return this.api(payload, config, { ...options, compress: true });
+    api(payload, config = {}, options) {
+        const envelope = buildApiEnvelope(this.apiVersion, payload, { ...config, logList: config.logList || this.ctx?.logList });
+        return this.json(envelope, options);
     }
     ;
 }

package/dist/index.d.ts

@@ -12,6 +12,11 @@ export { lambderCookieJarTransport } from "./shared/transport/lambderCookieJarTr
 export type { LambderApiTransport, LambderApiTransportRequest, LambderTransportFailureReason } from "./shared/transport/LambderApiTransport.js";
 export { LambderCookieJar, parseSetCookie } from "./shared/transport/LambderCookieJar.js";
 export { LambderExpiringMap, LambderExpiringMapFullError } from "./shared/util/LambderExpiringMap.js";
+export { LambderBackoffTimer } from "./shared/util/LambderBackoffTimer.js";
+export type { LambderBackoffTimerOptions } from "./shared/util/LambderBackoffTimer.js";
+export { LambderSignedClaims, keyedDigest, randomSecret } from "./shared/util/LambderSignedClaims.js";
+export type { LambderSignedClaimsOptions } from "./shared/util/LambderSignedClaims.js";
+export { constantTimeEquals } from "./shared/util/LambderTextDigest.js";
 export type { LambderStoredCookie } from "./shared/transport/LambderCookieJar.js";
 export { lambderHandlerTransport } from "./invoke/lambderHandlerTransport.js";
 export type { LambderHandlerTransportOptions } from "./invoke/lambderHandlerTransport.js";
@@ -25,7 +30,7 @@ export { toHttpAnswer } from "./api/LambderApiAnswer.js";
 export type { LambderApiAnswer } from "./api/LambderApiAnswer.js";
 export { LambderAnswerHeaders, getAnswerHeader, setAnswerHeader, addAnswerHeader } from "./shared/wire/LambderAnswerHeaders.js";
 export { createApiCallContext } from "./api/LambderApiCallContext.js";
-export type { LambderApiCallContext, LambderApiCallTrace } from "./api/LambderApiCallContext.js";
+export type { LambderApiCallContext, LambderApiCallTrace, LambderResponseTools } from "./api/LambderApiCallContext.js";
 export type { LambderApiDefinition } from "./api/LambderApiDefinition.js";
 export { apiSignatureOf } from "./api/LambderApiSignature.js";
 export type { LambderApiSignatureEntry } from "./api/LambderApiSignature.js";
@@ -63,7 +68,7 @@ export type { LambderHttpStatusCode } from "./shared/wire/LambderHttpStatus.js";
 export { html, xml, raw, jsonScript, escapeHtml, renderHtmlValue, LambderSafeHtml, type LambderHtmlValue } from "./shared/LambderHtml.js";
 export { LambderTemplatingEngine } from "./core/LambderTemplatingEngine.js";
 export type { LambderTemplateData, LambderTemplatingEngineOptions } from "./core/LambderTemplatingEngine.js";
-export type { LambderResponseOptions, LambderRawResponseInit, LambderResolverApiMethod, } from "./core/LambderResponseBuilder.js";
+export type { LambderResponseOptions, LambderRawResponseInit, } from "./core/LambderResponseBuilder.js";
 export type { LambderRouteMatcher, LambderRouteConditionFn, LambderRouteCondition, LambderPathParamsOf, LambderRoutePath } from "./core/LambderRouting.js";
 export type { LambderCorsConfig } from "./core/LambderCors.js";
 export type { LambderCreateOptions, LambderSessionOptions, LambderActionTools, LambderHandler, } from "./core/LambderCreateOptions.js";
@@ -106,6 +111,12 @@ export type { LambderRateLimiter, LambderRateLimitWindow, LambderRateLimitPolicy
 export { LambderDdbRateLimiter } from "./stores/LambderDdbRateLimiter.js";
 export type { LambderDdbRateLimiterOptions } from "./stores/LambderDdbRateLimiter.js";
 export { LambderMemoryRateLimiter } from "./stores/LambderMemoryRateLimiter.js";
+export { LambderOneShotSecrets } from "./secrets/LambderOneShotSecrets.js";
+export type { LambderOneShotSecretKind, LambderOneShotSecretsOptions, LambderOneShotIssueResult, LambderOneShotRedeemResult, LambderOneShotCodeKindNames, LambderOneShotTokenKindNames, } from "./secrets/LambderOneShotSecrets.js";
+export type { LambderOneShotSecretStore, LambderOneShotSecretRecord, LambderOneShotSecretDraft, LambderOneShotSecretShape, LambderOneShotIssueOutcome, } from "./shared/contracts/LambderOneShotSecretStore.js";
+export { LambderDdbOneShotSecretStore } from "./stores/LambderDdbOneShotSecretStore.js";
+export type { LambderDdbOneShotSecretStoreOptions } from "./stores/LambderDdbOneShotSecretStore.js";
+export { LambderMemoryOneShotSecretStore } from "./stores/LambderMemoryOneShotSecretStore.js";
 export type { LambderIdempotencyStore, LambderIdempotencyBeginResult, LambderIdempotencyDoneRecord, } from "./shared/contracts/LambderIdempotencyStore.js";
 export { LambderDdbIdempotencyStore } from "./stores/LambderDdbIdempotencyStore.js";
 export type { LambderDdbIdempotencyStoreOptions } from "./stores/LambderDdbIdempotencyStore.js";
@@ -118,9 +129,11 @@ export type { LambderRateLimitKeyBuilder } from "./api/LambderApiRateLimits.js";
 export type { LambderContextRateLimit, LambderContextRateLimitCheck, LambderRateLimitCheckResult, LambderChargeablePolicyNames, LambderChargeKeyArgs, LambderRateLimitKeyFn, LambderRateLimitPer, LambderRateLimitBudget, LambderRateLimitChargeAt, LambderApiRateLimitPolicyConfig, LambderApiRateLimitsConfig, LambderAllowedPolicyNames, LambderRateLimitOption, } from "./api/LambderApiRateLimits.js";
 export type { LambderApiIdempotencyConfig } from "./api/LambderApiIdempotency.js";
 export type { LambderGuardsOptionValue, LambderRateLimitOverride, LambderRateLimitOptionValue, LambderApiIdempotencyOption, } from "./shared/wire/LambderApiOptionValues.js";
+export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";
+export type { LambderApiOptionEntries, LambderApiOptionEntry, LambderRateLimitPolicyEntry, LambderGuardDeclarationEntry, LambderApisWithGuard, LambderApisGuardedBy, LambderApisWithMode, LambderGuardParamOf, } from "./shared/wire/LambderApiOptionEntries.js";
 export { createLambderI18n } from "./shared/LambderI18n.js";
 export type { LambderLanguageMeta, LambderI18nConfig, LambderI18nInstance, LambderI18nTranslator, LambderI18nExtractParams, LambderI18nDictionaryLoader, LambderI18nCodes, LambderI18nKeys, LambderI18nTranslatorFor, } from "./shared/LambderI18n.js";
-export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiResponseConfig, LambderApiNullAnswerConfig, LambderContractEntry, LambderMergeContract, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractKeysWithGuard, LambderJsonOf, LambderJsonOutputOf, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractRateLimitNames, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";
+export type { LambderApiContractShape, LambderApiMode, LambderApiEnvelopeBody, LambderApiResponseConfig, LambderContractEntry, LambderMergeContract, LambderGuardNamesIn, LambderContractMode, LambderContractKeysWithMode, LambderContractKeysWithGuard, LambderJsonOf, LambderJsonOutputOf, LambderContractGuardsOf, LambderContractGuardNames, LambderContractGuardInputsOf, LambderContractGuardInput, LambderContractGuardInputNames, LambderContractRateLimitOf, LambderContractRateLimitNames, LambderContractIdempotencyOf, } from "./shared/wire/LambderApiContract.js";
 export type { LambderRenderContext, LambderSessionRenderContext, LambderHttpEvent, LambderHttpEventFormat } from "./core/LambderContext.js";
 export type { LambderApiAnswerOutcome, LambderApiSuccessOutcome, LambderApiCallFailure, LambderApiValidationFailure, LambderApiEnvelopeFailure, LambderApiHttpAnswer, } from "./shared/wire/LambderApiOutcome.js";
 export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";

package/dist/index.js

@@ -9,6 +9,11 @@ export { buildTransportEnvelope, LambderTransportFailure, isLambderTransportFail
 export { lambderCookieJarTransport } from "./shared/transport/lambderCookieJarTransport.js";
 export { LambderCookieJar, parseSetCookie } from "./shared/transport/LambderCookieJar.js";
 export { LambderExpiringMap, LambderExpiringMapFullError } from "./shared/util/LambderExpiringMap.js";
+// Waiting longer after each failure, once: what the upload runner and an app's own retrying code climb.
+export { LambderBackoffTimer } from "./shared/util/LambderBackoffTimer.js";
+// Signed claims tokens, and the keyed digest and random secret for the secrets an app stores.
+export { LambderSignedClaims, keyedDigest, randomSecret } from "./shared/util/LambderSignedClaims.js";
+export { constantTimeEquals } from "./shared/util/LambderTextDigest.js";
 export { lambderHandlerTransport } from "./invoke/lambderHandlerTransport.js";
 export { synthesizeLambdaHttpEvent, decodeLambdaHttpResult, localLambdaContext, LAMBDER_INVOKE_HEADER, LAMBDER_INVOKED_BY_HEADER, LAMBDER_INVOKE_PROTOCOL, } from "./invoke/LambderLambdaEvent.js";
 // The API core: the request, answer, envelope and pipeline both the server and the mock runtime run
@@ -71,6 +76,11 @@ export { LambderMemoryCache } from "./stores/LambderMemoryCache.js";
 export { RATE_LIMIT_WINDOWS } from "./shared/contracts/LambderRateLimiter.js";
 export { LambderDdbRateLimiter } from "./stores/LambderDdbRateLimiter.js";
 export { LambderMemoryRateLimiter } from "./stores/LambderMemoryRateLimiter.js";
+// One-shot secrets: codes and tokens handed out once and taken back once, the
+// store interface they live in, and the DynamoDB and in-memory stores
+export { LambderOneShotSecrets } from "./secrets/LambderOneShotSecrets.js";
+export { LambderDdbOneShotSecretStore } from "./stores/LambderDdbOneShotSecretStore.js";
+export { LambderMemoryOneShotSecretStore } from "./stores/LambderMemoryOneShotSecretStore.js";
 export { LambderDdbIdempotencyStore } from "./stores/LambderDdbIdempotencyStore.js";
 export { LambderMemoryIdempotencyStore } from "./stores/LambderMemoryIdempotencyStore.js";
 // Declarative per-API policies: guards
@@ -78,6 +88,9 @@ export { lambderGuard, lambderRateLimitKey } from "./core/LambderPolicyBuilders.
 export { lambderGuardBuilder } from "./api/LambderApiGuards.js";
 // Declarative per-API policies: rate limits
 export { lambderRateLimitKeyBuilder, rateLimitRefusal, DEFAULT_RATE_LIMIT_REFUSAL } from "./api/LambderApiRateLimits.js";
+// The declared options as plain data: what apiOptionEntries() reports and
+// writeApiOptions writes, and the readers over the generated tables.
+export { apiGuardParam } from "./shared/wire/LambderApiOptionEntries.js";
 // Typed translations (standalone, isomorphic)
 export { createLambderI18n } from "./shared/LambderI18n.js";
 export { resolveApiOutcome } from "./shared/wire/LambderApiOutcome.js";
@@ -86,5 +99,5 @@ export { createContext, isV2HttpEvent } from "./core/LambderContext.js";
 export { COMPRESSED_PAYLOAD_GZ_FIELD, COMPRESSED_PAYLOAD_BR_FIELD, COMPRESSED_PAYLOAD_BYTES_FIELD, DEFAULT_REQUEST_COMPRESSION_SETTINGS, DEFAULT_MAX_RESTORED_PAYLOAD_BYTES, 
 // The Brotli twin of the browser's compressPayloadGzip, and its defaults.
 DEFAULT_INVOKE_REQUEST_COMPRESSION_SETTINGS, compressPayloadBrotli, } from "./shared/wire/LambderRequestPayload.js";
-// Cookies (res.setCookie / res.clearCookie build on these; exported for code holding a LambderResponse)
+// Cookies (ctx.setCookie / ctx.clearCookie build on these; exported for code holding a LambderResponse)
 export { serializeCookie, serializeClearCookie, resolveCookieDomain } from "./shared/wire/LambderCookie.js";

package/dist/invoke/LambderInvokeCaller.js

@@ -378,10 +378,9 @@ export default class LambderInvokeCaller {
         // The answer's Set-Cookie values, so a session the callee rotated or
         // cleared is visible to whoever is carrying it.
         const cookies = http.cookies;
-        // The declared output, by the callee's own typing: res.api(null)
-        // compiles only for an output that allows null or beside a reason (an
-        // errorMessage is a failure below; a message-only null is the
-        // callee's contract to keep).
+        // The declared output, by the callee's own typing: a handler returns
+        // its output, so a success payload is null only where the output
+        // allows null.
         if (outcome.ok)
             return { ok: true, payload: (outcome.payload ?? null), response: outcome.response, logList, cookies };
         const shared = { status: outcome.status, retryAfterSeconds: outcome.retryAfterSeconds, logList, cookies };

package/dist/mock/LambderMockApp.d.ts

@@ -10,6 +10,7 @@ import { LambderMemoryIdempotencyStore } from "../stores/LambderMemoryIdempotenc
 import { LambderMemorySessionStore } from "../stores/LambderMemorySessionStore.js";
 import LambderSessionManager, { type LambderCreatedSession } from "../session/LambderSessionManager.js";
 import type { LambderMockAppOptions, LambderMockIdempotencyOptions, LambderMockTransport, LambderMockTransportOptions } from "./LambderMockCreateOptions.js";
+import type { LambderApiOptionEntry, LambderGuardDeclarationEntry } from "../shared/wire/LambderApiOptionEntries.js";
 import type { LambderMockCallContext, LambderMockCallRecord, LambderMockEntry, LambderMockEntryInput, LambderMockFailure, LambderMockFailureReason, LambderMockHandler, LambderMockLatency, LambderMockListener, LambderMockPublicNames, LambderMockRateLimitPolicies, LambderMockRegistryCheck, LambderMockRestEntry, LambderMockSessionCallContext, LambderMockSessionNames, LambderMockSlice, LambderMockOverride } from "./LambderMockTypes.js";
 /**
  * The mock runtime: the API core (LambderApiPipeline, the same class the
@@ -23,9 +24,10 @@ import type { LambderMockCallContext, LambderMockCallRecord, LambderMockEntry, L
  *
  * Create one with initLambderMock<Contract, SessionData>().create(...),
  * which fixes the contract and session types first so everything else is
- * inferred from the options.
+ * inferred from the options. `TDerived` is true for a mock created with the
+ * generated `apiOptions` table, whose entries are their handlers alone.
  */
-export declare class LambderMockApp<C extends LambderApiContractShape, S = any, G extends Record<string, LambderApiGuard<any, any, any>> = {}> {
+export declare class LambderMockApp<C extends LambderApiContractShape, S = any, G extends Record<string, LambderApiGuard<any, any, any>> = {}, TDerived extends boolean = false> {
     readonly apiVersion: string | null;
     /** The memory stores, for assertions and reset; null for a subsystem that is off or backed by a store of yours. */
     readonly sessionStore: LambderMemorySessionStore<S> | null;
@@ -61,9 +63,11 @@ export declare class LambderMockApp<C extends LambderApiContractShape, S = any,
     private readonly recorder;
     /** Registered entries and the overrides over them (see LambderMockEntryRegistry). */
     private readonly registry;
+    /** The server's declared options per API, when create() was given the generated table; the entries' declarations come from here. */
+    private readonly apiOptions;
     /** The jars the runtime owns and what it planted in document.cookie (see LambderMockBrowserCookies). */
     private readonly browserCookies;
-    constructor(options: LambderMockAppOptions<C, S, G>);
+    constructor(options: LambderMockAppOptions<C, S, G, LambderMockRateLimitPolicies<S>, boolean | LambderMockIdempotencyOptions<S>, {}, Record<string, LambderApiOptionEntry> | undefined>);
     /**
      * The registration-time checks every entry goes through, mocked or not:
      * the ones the server runs on a definition, and the mock's own "a session
@@ -75,11 +79,21 @@ export declare class LambderMockApp<C extends LambderApiContractShape, S = any,
      * option, for a mistake fixed by one option at create().
      */
     private assertEntryRegistration;
+    /**
+     * The table's entry for an endpoint, when create() was given one: null
+     * without a table, and a throw for a name the table does not hold or an
+     * entry registered under the other mode. The compiler already refuses
+     * both against the contract; this is where a stale table meets a caller
+     * the compiler did not see.
+     */
+    private declaredOptionsOf;
+    /** The mode the apiOptions table gives a name, or null without a table or for a name it does not hold. */
+    private declaredModeOf;
     private buildEntry;
     /** A mock for a public endpoint: a handler, or the handler with the endpoint's declarations restated. */
-    publicApi<K extends LambderMockPublicNames<C>, TInputSchema extends z.ZodType = z.ZodType>(name: K, entry: LambderMockEntryInput<C, K, S, G, TInputSchema>): LambderMockEntry<C, K>;
+    publicApi<K extends LambderMockPublicNames<C>, TInputSchema extends z.ZodType = z.ZodType>(name: K, entry: LambderMockEntryInput<C, K, S, G, TInputSchema, TDerived>): LambderMockEntry<C, K>;
     /** A mock for a session endpoint: the pipeline fetches the session before the handler runs, and refuses without one. */
-    sessionApi<K extends LambderMockSessionNames<C>, TInputSchema extends z.ZodType = z.ZodType>(name: K, entry: LambderMockEntryInput<C, K, S, G, TInputSchema>): LambderMockEntry<C, K>;
+    sessionApi<K extends LambderMockSessionNames<C>, TInputSchema extends z.ZodType = z.ZodType>(name: K, entry: LambderMockEntryInput<C, K, S, G, TInputSchema, TDerived>): LambderMockEntry<C, K>;
     /**
      * A public endpoint deliberately left without a mock; a call answers the
      * notMocked refusal carrying the reason.
@@ -111,13 +125,15 @@ export declare class LambderMockApp<C extends LambderApiContractShape, S = any,
      * still refused, and an entry registered later (registerPartial, or a
      * second register) takes its endpoint back from the rest.
      *
-     * What it cannot do is the session read. The mode of an unregistered name
-     * is not knowable at runtime (the contract is a type), so a call it
-     * answers is processed as public: the protocol's pre-pass still runs, so
-     * a stale client still hears versionExpired, but a signed-out call to an
-     * unmocked session endpoint answers "not mocked" where the server answers
-     * sessionExpired. Declare an endpoint whose signed-out path a test cares
-     * about with sessionNotMocked instead.
+     * The mode of an unregistered name comes from the apiOptions table, when
+     * create() was given one, so an unmocked session endpoint still reads the
+     * session and a signed-out call answers sessionExpired as on the server.
+     * Without the table the mode is not knowable at runtime (the contract is
+     * a type), and a call it answers is processed as public: the protocol's
+     * pre-pass still runs, so a stale client still hears versionExpired, but
+     * a signed-out call to an unmocked session endpoint answers "not mocked"
+     * where the server answers sessionExpired. Declare an endpoint whose
+     * signed-out path a test cares about with sessionNotMocked there.
      */
     restNotMocked(reason: string): LambderMockRestEntry;
     private buildNotMockedEntry;
@@ -165,10 +181,11 @@ export declare class LambderMockApp<C extends LambderApiContractShape, S = any,
     /**
      * The entry that answers a name nothing registered, when register() was
      * given a rest entry: the notMocked refusal carrying its reason, run
-     * through the pipeline as a public endpoint, since the mode of an
-     * unregistered name cannot be recovered at runtime. Everything before
-     * dispatch still runs (the signature gate, the payload restore); the
-     * missing session read is the fidelity limit restNotMocked documents.
+     * through the pipeline under the mode the apiOptions table gives the
+     * name, and as a public endpoint where there is no table to say (the
+     * mode of an unregistered name cannot otherwise be recovered at runtime).
+     * Everything before dispatch still runs (the signature gate, the payload
+     * restore, and for a session endpoint the session read).
      */
     private restNotMockedEntry;
     /** The next call to the endpoint fails this way; several calls queue in order. */
@@ -332,5 +349,5 @@ export declare const initLambderMock: <C extends LambderApiContractShape, S = an
      * dropped. `I` exists for the same reason `P` does, and
      * LambderMockSurplusKeys puts the error back on the key.
      */
-    create<const G extends Record<string, LambderApiGuard<any, any, any, LambderMockCallContext<S>, LambderMockSessionCallContext<S>>> = {}, const P extends LambderMockRateLimitPolicies<S> = {}, I extends boolean | LambderMockIdempotencyOptions<S> = boolean | LambderMockIdempotencyOptions<S>>(options: LambderMockAppOptions<C, S, G, P, I>): LambderMockApp<C, S, G>;
+    create<const G extends Record<string, LambderApiGuard<any, any, any, LambderMockCallContext<S>, LambderMockSessionCallContext<S>>> = {}, const P extends LambderMockRateLimitPolicies<S> = {}, I extends boolean | LambderMockIdempotencyOptions<S> = boolean | LambderMockIdempotencyOptions<S>, const D extends Record<string, LambderGuardDeclarationEntry> = {}, const A extends Record<string, LambderApiOptionEntry> | undefined = undefined>(options: LambderMockAppOptions<C, S, G, P, I, D, A>): LambderMockApp<C, S, G, [A] extends [undefined] ? false : true>;
 };