lambder 8.3.1 → 9.0.1

package/dist/shared/wire/LambderApiContract.d.ts

@@ -4,7 +4,6 @@
  * Contracts are built via method chaining and inferred using typeof lambder.ApiContract
  */
 import type { LambderCrashDetail } from "./LambderCrashDetail.js";
-import type { LambderNonEmptyOptionMap } from "../util/LambderTypeUtilities.js";
 import type { LambderAppRefusalMessage } from "./LambderApiRefusal.js";
 import type { LambderApiIdempotencyOption, LambderGuardsOptionValue, LambderRateLimitOptionValue } from "./LambderApiOptionValues.js";
 /** Whether an endpoint runs without a session or requires one (addApi versus addSessionApi). */
@@ -32,15 +31,18 @@ export type LambderApiContractShape = Record<string, {
     /** Present when the API declares idempotency: the `idempotency` option exactly as written. */
     idempotency?: LambderApiIdempotencyOption;
 }>;
-/** Envelope flags/channels the server may set beside (or instead of) the payload. */
+/**
+ * Envelope flags and channels beside (or instead of) the payload: what a
+ * refusal, the pipeline's own answers, a hook or an error handler set. An API
+ * handler sets none of them itself: it returns its output or refuses.
+ */
 export type LambderApiResponseConfig = {
     versionExpired?: boolean;
     sessionExpired?: boolean;
     notAuthorized?: boolean;
-    message?: any;
     /**
-     * A refusal message, or a plain string when writing
-     * (`res.api(null, { errorMessage: "..." })`): the envelope goes out with
+     * A refusal message, or a plain string when writing (a refusal thrown
+     * with refuse(), or an error handler's `res.api(null, { errorMessage })`): the envelope goes out with
      * the message object either way. Read off the wire it can still be a
      * string, or no message at all, wherever a Lambder server did not write
      * the body (a hand-built mock answer, a proxy); refusalMessageOf reads
@@ -58,15 +60,8 @@ export type LambderApiResponseConfig = {
     crash?: LambderCrashDetail;
 };
 /**
- * The config a null answer carries: at least one of the reason fields, so
- * `res.api(null, {})` is a compile error. A bare null with no flag and no
- * message reaches the caller as a success whose payload is null, which is
- * indistinguishable from an endpoint that answered nothing on purpose.
- */
-export type LambderApiNullAnswerConfig = LambderNonEmptyOptionMap<Pick<LambderApiResponseConfig, "versionExpired" | "sessionExpired" | "notAuthorized" | "errorMessage" | "message">> & LambderApiResponseConfig;
-/**
- * The API wire envelope both sides speak: res.api() emits it, LambderCaller
- * parses it. `apiVersion` is always there (null when the server set none):
+ * The API wire envelope both sides speak: the server writes it around a
+ * handler's output or a refusal, LambderCaller parses it. `apiVersion` is always there (null when the server set none):
  * it is how a reader tells a Lambder envelope from another JSON answer, such
  * as API Gateway's own `{ "message": ... }` errors, so an answer without it
  * reads as a server failure.

package/dist/shared/wire/LambderApiRefusal.d.ts

@@ -26,10 +26,9 @@ export type LambderApiRefusalOptions = {
 /**
  * A typed refusal: "this request is denied/invalid" as opposed to "the server
  * crashed". Throw it from anywhere in an API call's call stack (handlers,
- * hooks, or nested helpers with no access to the per-request resolver) and
- * the render pipeline maps it onto the structured API envelope
- * (`res.api(null, { errorMessage, notAuthorized, sessionExpired })`) instead
- * of routing it through setGlobalErrorHandler, so refusals never reach crash
+ * hooks, guards or nested helpers) and the render pipeline maps it onto the
+ * structured API envelope (its errorMessage, notAuthorized and
+ * sessionExpired) instead of routing it through setGlobalErrorHandler, so refusals never reach crash
  * logging and clients receive a parseable response.
  *
  * Thrown outside an API call (e.g. in a route handler) it behaves like any

package/dist/shared/wire/LambderApiRefusal.js

@@ -1,10 +1,9 @@
 /**
  * A typed refusal: "this request is denied/invalid" as opposed to "the server
  * crashed". Throw it from anywhere in an API call's call stack (handlers,
- * hooks, or nested helpers with no access to the per-request resolver) and
- * the render pipeline maps it onto the structured API envelope
- * (`res.api(null, { errorMessage, notAuthorized, sessionExpired })`) instead
- * of routing it through setGlobalErrorHandler, so refusals never reach crash
+ * hooks, guards or nested helpers) and the render pipeline maps it onto the
+ * structured API envelope (its errorMessage, notAuthorized and
+ * sessionExpired) instead of routing it through setGlobalErrorHandler, so refusals never reach crash
  * logging and clients receive a parseable response.
  *
  * Thrown outside an API call (e.g. in a route handler) it behaves like any

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lambder",
-  "version": "8.3.1",
+  "version": "9.0.1",
   "sideEffects": false,
   "description": "Opinionated serverless web framework for TypeScript on AWS Lambda: type-safe APIs from Zod schemas, DynamoDB sessions, and declarative rate limits, authorization guards and idempotency.",
   "keywords": [