@nifrajs/core 2.2.0 → 2.3.0

package/dist/ledger.d.ts

@@ -4,7 +4,7 @@
  * Every owned effect seam (a repository write, an external call, an email send) records one entry via
  * the `useCapability` beacon. The entry type is deliberately **token-only**: capability ids, phase,
  * an adapter/resource token, dimensionless cost counters, an optional keyed digest, and an error code.
- * There is no free-form payload field — request bodies, rows, and values cannot enter the ledger, so
+ * There is no free-form payload field - request bodies, rows, and values cannot enter the ledger, so
  * redaction holds by construction rather than by filtering. The sealed ledger carries the **route
  * pattern** (`/users/:id`), never the concrete URL, so path parameters cannot leak either.
  *
@@ -22,7 +22,7 @@ export type EffectPhase = "intent" | "committed" | "failed" | "compensated";
 export type EffectCost = Readonly<Record<string, number>>;
 /** Token-only caller metadata shared by an effect intent and outcome. */
 export interface EffectMetadata {
-    /** Adapter/resource token (`repo:orders`, `provider:payments`). A token — never a value or a row. */
+    /** Adapter/resource token (`repo:orders`, `provider:payments`). A token - never a value or a row. */
     readonly target?: string;
     /** Dimensionless counters; see {@link EffectCost}. At most {@link MAX_COST_AXES} axes. */
     readonly cost?: EffectCost;
@@ -37,7 +37,7 @@ export interface EffectEntryInput extends EffectMetadata {
     readonly capability: string;
     /** Default `"intent"`. Record `committed`/`failed`/`compensated` only after the outcome is known. */
     readonly phase?: EffectPhase;
-    /** Outcome error as a bounded token code — never a message, never a stack. */
+    /** Outcome error as a bounded token code - never a message, never a stack. */
     readonly error?: {
         readonly code: string;
     };
@@ -68,10 +68,10 @@ export interface EffectChain {
 /** The immutable result of sealing a request's ledger. Token-only; safe to hand to any sink. */
 export interface SealedEffectLedger {
     readonly method: string;
-    /** The registered route pattern (`/users/:id`) — never the concrete request URL. */
+    /** The registered route pattern (`/users/:id`) - never the concrete request URL. */
     readonly path: string;
     readonly entries: readonly EffectEntry[];
-    /** The route's declared capability tokens — the runtime-enforcement view: recorded ⊆ declared is
+    /** The route's declared capability tokens - the runtime-enforcement view: recorded ⊆ declared is
      * guaranteed by the beacon, and `declared` minus the recorded ids is the unused declaration set. */
     readonly declared: readonly string[];
     /** Present when the ledger was created with `chain: true`. */
@@ -87,7 +87,7 @@ export declare class EffectLedgerOverflowError extends Error {
     readonly maxEntries: number;
     constructor(maxEntries: number);
 }
-/** Thrown by `append` after `seal()` — e.g. an effect attempted while streaming a response body. */
+/** Thrown by `append` after `seal()` - e.g. an effect attempted while streaming a response body. */
 export declare class EffectLedgerSealedError extends Error {
     constructor();
 }
@@ -99,13 +99,13 @@ export interface RequestLedger {
     entries(): readonly EffectEntry[];
     readonly size: number;
     readonly sealed: boolean;
-    /** Finalize the ledger (computing the chain when enabled). Idempotent — always the same result. */
+    /** Finalize the ledger (computing the chain when enabled). Idempotent - always the same result. */
     seal(): Promise<SealedEffectLedger>;
 }
 export interface CreateRequestLedgerOptions {
     /** HTTP method of the matched route. */
     readonly method: string;
-    /** The registered route pattern — callers must never pass the concrete request URL. */
+    /** The registered route pattern - callers must never pass the concrete request URL. */
     readonly path: string;
     /** The route's declared capability tokens, surfaced verbatim on the sealed ledger. Default `[]`. */
     readonly declared?: readonly string[];
@@ -138,7 +138,7 @@ export interface MemoryLedgerSink {
 export declare function createMemoryLedgerSink(options?: MemoryLedgerSinkOptions): MemoryLedgerSink;
 /** Minimum digest key material. A short key would make the keyed digest brute-forceable. */
 export declare const MIN_DIGEST_KEY_BYTES = 16;
-/** Fresh random digest key (32 bytes). Per-process by default — persist one externally to correlate across restarts. */
+/** Fresh random digest key (32 bytes). Per-process by default - persist one externally to correlate across restarts. */
 export declare function randomEffectDigestKey(): Uint8Array;
 /**
  * Keyed HMAC-SHA-256 digest (hex) of an effect payload, for replay/reconciliation matching without

package/dist/ledger.js

@@ -4,7 +4,7 @@
  * Every owned effect seam (a repository write, an external call, an email send) records one entry via
  * the `useCapability` beacon. The entry type is deliberately **token-only**: capability ids, phase,
  * an adapter/resource token, dimensionless cost counters, an optional keyed digest, and an error code.
- * There is no free-form payload field — request bodies, rows, and values cannot enter the ledger, so
+ * There is no free-form payload field - request bodies, rows, and values cannot enter the ledger, so
  * redaction holds by construction rather than by filtering. The sealed ledger carries the **route
  * pattern** (`/users/:id`), never the concrete URL, so path parameters cannot leak either.
  *
@@ -24,7 +24,7 @@ export class EffectLedgerOverflowError extends Error {
         this.name = "EffectLedgerOverflowError";
     }
 }
-/** Thrown by `append` after `seal()` — e.g. an effect attempted while streaming a response body. */
+/** Thrown by `append` after `seal()` - e.g. an effect attempted while streaming a response body. */
 export class EffectLedgerSealedError extends Error {
     constructor() {
         super("effect ledger is sealed: effects cannot be recorded after the response settles");
@@ -145,7 +145,7 @@ class BoundedRequestLedger {
         if (input.error !== undefined && !ERROR_CODE.test(input.error.code)) {
             throw new TypeError("effect ledger: error code must be a bounded lowercase token");
         }
-        // Only the known token fields are copied — a stray `payload`-like property never survives append.
+        // Only the known token fields are copied - a stray `payload`-like property never survives append.
         const at = this.clock();
         if (!Number.isFinite(at) || at < 0) {
             throw new TypeError("effect ledger: clock must return a finite non-negative number");
@@ -199,7 +199,7 @@ class BoundedRequestLedger {
 export function createRequestLedger(options) {
     return new BoundedRequestLedger(options);
 }
-/** Canonical, key-ordered serialization of one entry — the hash-chain input. */
+/** Canonical, key-ordered serialization of one entry - the hash-chain input. */
 function canonicalEntry(entry) {
     const cost = entry.cost === undefined
         ? ""
@@ -247,7 +247,7 @@ export function createMemoryLedgerSink(options = {}) {
 }
 /** Minimum digest key material. A short key would make the keyed digest brute-forceable. */
 export const MIN_DIGEST_KEY_BYTES = 16;
-/** Fresh random digest key (32 bytes). Per-process by default — persist one externally to correlate across restarts. */
+/** Fresh random digest key (32 bytes). Per-process by default - persist one externally to correlate across restarts. */
 export function randomEffectDigestKey() {
     const bytes = new Uint8Array(32);
     crypto.getRandomValues(bytes);

package/dist/reflection.d.ts

@@ -30,7 +30,7 @@ export interface SchemaReflection {
 export interface ReflectedRouteSchema {
     readonly body?: SchemaReflection;
     readonly query?: SchemaReflection;
-    /** Path-params schema — constraints (uuid format, integer min/max) declared via `params: t.object(…)`. */
+    /** Path-params schema - constraints (uuid format, integer min/max) declared via `params: t.object(…)`. */
     readonly params?: SchemaReflection;
     readonly response?: SchemaReflection;
     readonly errors?: Readonly<Record<string, SchemaReflection>>;

package/dist/router/pattern.js

@@ -34,19 +34,19 @@ function validParamName(name) {
  *
  * The grammar is per-segment: a segment is wholly static or wholly a parameter, so everything after
  * the colon is the name. `/v/:id.json` therefore asks for a parameter literally named `id.json`,
- * which is not what anyone means by it — but the bare "invalid parameter" that produces reads as a
+ * which is not what anyone means by it - but the bare "invalid parameter" that produces reads as a
  * typo rather than as a rule, leaving the author to guess whether the dot, the length, or the casing
  * was the problem. Naming the actual limitation and showing the two ways out is the difference
  * between a five-second fix and a trip to the source.
  */
 function paramNameHint(name) {
     if (RESERVED_PARAM_NAMES.has(name))
-        return ` — "${name}" is reserved (prototype key)`;
+        return ` - "${name}" is reserved (prototype key)`;
     if (name.length === 0)
-        return ` — ":" needs a name after it`;
+        return ` - ":" needs a name after it`;
     // No "a segment is wholly static or wholly a parameter" case here any more: mixed segments made
     // that message obsolete. `:id.json` was the shape it explained, and `:id.json` now compiles.
-    return ` — a name must match ${PARAM_NAME.source}`;
+    return ` - a name must match ${PARAM_NAME.source}`;
 }
 function escapeRegex(value) {
     return value.replace(/[.*+?^()|[\]\\{}$]/g, "\\$&");

package/dist/router/router.js

@@ -45,7 +45,7 @@ function sameNames(a, b) {
  * instead of pre-splitting it into an array. `start` is the index of the first
  * char of the current segment; the segment runs to the next `/` (or end). Tries
  * static, then param, then wildcard; if a static branch dead-ends, param/wildcard
- * are still attempted — so `/a/b/c` and `/a/:x/d` coexist and `/a/b/d` resolves
+ * are still attempted - so `/a/b/c` and `/a/:x/d` coexist and `/a/b/d` resolves
  * to the param route. Fills `paramValues` along the successful path; abandoned
  * branches are popped. Avoiding the split keeps `find` allocation-light: only the
  * segment substrings needed for map lookups (and matched param values) are cut.
@@ -95,9 +95,9 @@ function matchNode(node, path, start, len, paramValues) {
         }
     }
     const paramChild = node.paramChild;
-    // An empty segment (`/users//posts`) never matches a `:param` — matching would hand the handler
+    // An empty segment (`/users//posts`) never matches a `:param` - matching would hand the handler
     // `id: ""` and downstream code a `WHERE id = ''` class of bug. Peers (Hono, Elysia, Next) 404
-    // here too; a static "" child can still match (none is ever registered — INVALID_PATH guards).
+    // here too; a static "" child can still match (none is ever registered - INVALID_PATH guards).
     if (paramChild !== undefined && seg.length > 0) {
         paramValues.push(seg);
         if (isLast) {

package/dist/schema/standard.d.ts

@@ -1,7 +1,7 @@
 /**
  * The Standard Schema v1 interface (https://standardschema.dev), vendored as
- * types + a tiny runtime helper so any compliant validator — zod, valibot,
- * arktype, … — validates requests without coupling the framework to one lib.
+ * types + a tiny runtime helper so any compliant validator - zod, valibot,
+ * arktype, … - validates requests without coupling the framework to one lib.
  * The spec is MIT-licensed and explicitly designed to be copied.
  */
 export interface StandardSchemaV1<Input = unknown, Output = Input> {

package/dist/schema/standard.js

@@ -1,7 +1,7 @@
 /**
  * The Standard Schema v1 interface (https://standardschema.dev), vendored as
- * types + a tiny runtime helper so any compliant validator — zod, valibot,
- * arktype, … — validates requests without coupling the framework to one lib.
+ * types + a tiny runtime helper so any compliant validator - zod, valibot,
+ * arktype, … - validates requests without coupling the framework to one lib.
  * The spec is MIT-licensed and explicitly designed to be copied.
  */
 function normalizeStandardResult(result) {

package/dist/seo.d.ts

@@ -1,5 +1,5 @@
 /**
- * `sitemap.xml` + `robots.txt` builders — pure, edge-safe string generators (no I/O, no runtime deps).
+ * `sitemap.xml` + `robots.txt` builders - pure, edge-safe string generators (no I/O, no runtime deps).
  * Wire them to a route on any runtime:
  *
  *   app.get("/sitemap.xml", () =>
@@ -16,10 +16,10 @@ export type SitemapChangeFreq = "always" | "hourly" | "daily" | "weekly" | "mont
 export interface SitemapEntry {
     /** An absolute URL, or a path that `hostname` will make absolute. */
     readonly url: string;
-    /** Last-modified — a `Date` (serialized as ISO 8601) or a pre-formatted W3C-datetime string. */
+    /** Last-modified - a `Date` (serialized as ISO 8601) or a pre-formatted W3C-datetime string. */
     readonly lastmod?: string | Date;
     readonly changefreq?: SitemapChangeFreq;
-    /** Crawl priority, `0.0`–`1.0`. */
+    /** Crawl priority, `0.0`-`1.0`. */
     readonly priority?: number;
 }
 export interface SitemapOptions {

package/dist/seo.js

@@ -1,5 +1,5 @@
 /**
- * `sitemap.xml` + `robots.txt` builders — pure, edge-safe string generators (no I/O, no runtime deps).
+ * `sitemap.xml` + `robots.txt` builders - pure, edge-safe string generators (no I/O, no runtime deps).
  * Wire them to a route on any runtime:
  *
  *   app.get("/sitemap.xml", () =>
@@ -19,7 +19,7 @@ const XML_ESCAPES = {
     '"': """,
     "'": "'",
 };
-/** Escape the five XML metacharacters — `<loc>` and `<lastmod>` carry app- or DB-derived strings. */
+/** Escape the five XML metacharacters - `<loc>` and `<lastmod>` carry app- or DB-derived strings. */
 function escapeXml(value) {
     return value.replace(/[&<>"']/g, (char) => XML_ESCAPES[char]);
 }
@@ -37,7 +37,7 @@ const SITEMAP_MAX_URLS = 50_000;
 /** Build a `<urlset>` sitemap XML document from `entries`. Throws on out-of-spec input (dev-time data). */
 export function sitemap(entries, options = {}) {
     if (entries.length > SITEMAP_MAX_URLS) {
-        throw new RangeError(`sitemap: ${entries.length} entries exceeds the ${SITEMAP_MAX_URLS}-URL per-file limit — split into a sitemap index`);
+        throw new RangeError(`sitemap: ${entries.length} entries exceeds the ${SITEMAP_MAX_URLS}-URL per-file limit - split into a sitemap index`);
     }
     const base = options.hostname?.replace(/\/+$/, "");
     const urls = entries.map((entry) => {
@@ -66,7 +66,7 @@ function resolveLoc(url, base) {
     if (/^https?:\/\//i.test(url))
         return url; // already absolute
     if (base === undefined)
-        return url; // relative — caller's choice (sitemaps prefer absolute)
+        return url; // relative - caller's choice (sitemaps prefer absolute)
     return `${base}${url.startsWith("/") ? "" : "/"}${url}`;
 }
 /** robots.txt is line-oriented, so a newline in any value could inject a forged directive. Flatten it. */

package/dist/server/body.d.ts

@@ -1,5 +1,5 @@
 /**
- * Bounded request-body reading — the single source of truth for nifra's body-size cap. A lying or
+ * Bounded request-body reading - the single source of truth for nifra's body-size cap. A lying or
  * absent `Content-Length` can't force us to buffer an oversized payload: a declared length over the
  * cap is rejected *before* buffering, and a chunked / length-less body is aborted mid-stream once the
  * running byte count exceeds the cap. Shared by the server's schema path, `c.boundedBody`, and
@@ -13,7 +13,7 @@ interface BodySource {
 export declare function parseContentLength(value: string): number | undefined;
 /** The shared streaming byte-cap loop: read until done, or cancel + 413 once over `maxBytes`.
  * A single-chunk body (the common case for small chunked payloads) returns the runtime's own
- * chunk directly — no chunk array, no copy-merge. */
+ * chunk directly - no chunk array, no copy-merge. */
 export declare function drainCapped(body: ReadableStream<Uint8Array>, maxBytes: number): Promise<{
     ok: true;
     bytes: Uint8Array;

package/dist/server/body.js

@@ -1,5 +1,5 @@
 /**
- * Bounded request-body reading — the single source of truth for nifra's body-size cap. A lying or
+ * Bounded request-body reading - the single source of truth for nifra's body-size cap. A lying or
  * absent `Content-Length` can't force us to buffer an oversized payload: a declared length over the
  * cap is rejected *before* buffering, and a chunked / length-less body is aborted mid-stream once the
  * running byte count exceeds the cap. Shared by the server's schema path, `c.boundedBody`, and
@@ -21,7 +21,7 @@ export function parseContentLength(value) {
 }
 /** The shared streaming byte-cap loop: read until done, or cancel + 413 once over `maxBytes`.
  * A single-chunk body (the common case for small chunked payloads) returns the runtime's own
- * chunk directly — no chunk array, no copy-merge. */
+ * chunk directly - no chunk array, no copy-merge. */
 export async function drainCapped(body, maxBytes) {
     const reader = body.getReader();
     let first;

package/dist/server/context.d.ts

@@ -54,12 +54,12 @@ export interface RouteSchema {
      * Dedupe retries of this (mutating) route on an `Idempotency-Key` header. The first request runs and
      * its response is stored; a retry with the same key replays that response without re-running the
      * handler, and a key reused with a different body is rejected (409). A missing key on an
-     * idempotency-required route fails closed (400). Off the hot path — routes without it are unchanged.
+     * idempotency-required route fails closed (400). Off the hot path - routes without it are unchanged.
      */
     readonly idempotency?: IdempotencyConfig;
     /**
      * Highest data-sensitivity this route's response body carries (`public` | `pii` | `secret`). A
-     * declarative, compile-time + introspection fact — never validated at runtime. Reflected for tooling,
+     * declarative, compile-time + introspection fact - never validated at runtime. Reflected for tooling,
      * recorded in the capability lockfile (so a route that starts returning PII is a reviewable change),
      * and read by downstream policy (e.g. a partner-API surface refusing to expose `pii`/`secret`).
      */
@@ -96,20 +96,20 @@ export interface RouteSchema {
     readonly query?: StandardSchemaV1;
     /** Optional **response contract**. When declared: the handler's return is type-checked against it
      * (the implementation can't drift from the contract), the typed client sees THIS as the response type
-     * (the contract — not the handler's incidental return), and it's emitted into OpenAPI/JSON-Schema so
+     * (the contract - not the handler's incidental return), and it's emitted into OpenAPI/JSON-Schema so
      * tooling and coding agents can read the exact shape. It is **not** validated at runtime (zero
-     * hot-path cost) — purely a compile-time + introspection contract. */
+     * hot-path cost) - purely a compile-time + introspection contract. */
     readonly response?: StandardSchemaV1;
     /**
      * Optional **error-response contract**: a map of HTTP status code → the Standard Schema of that error's
      * body. Declares a route's failure modes so they flow into OpenAPI (as non-2xx `responses`), the
-     * `/llms.txt` context, and other introspection — the whole contract, not just the happy path, is legible
+     * `/llms.txt` context, and other introspection - the whole contract, not just the happy path, is legible
      * to tooling and coding agents. Like `response`, it is **not** validated at runtime (zero hot-path cost);
      * it's a compile-time + introspection contract. Example: `{ 404: NotFound, 409: Conflict }`. */
     readonly errors?: Readonly<Record<number, StandardSchemaV1>>;
     /**
      * Optional **SSE event contract**: the Standard Schema of each event's `data` payload on a
-     * streaming route (declared via `app.sse()`). Marks the route as a typed event stream — the
+     * streaming route (declared via `app.sse()`). Marks the route as a typed event stream - the
      * typed client grows a `.subscribe()` for it, and the schema flows into reflection. Like
      * `response`, it is **not** validated at runtime (zero hot-path cost); the server-side
      * `stream.send()` is compile-time-checked against it instead.
@@ -121,7 +121,7 @@ export interface RouteSchema {
      *   - a **`Response`** → returned as-is, short-circuiting the route (custom error envelope, redirect, …).
      *   - **any other value** → treated as a repaired payload and **re-validated once** against the same
      *     schema. If it now passes, the handler runs with it; if it still fails, the original `422` stands.
-     *     Re-validation means a bad return can't bypass the schema — the trust boundary holds.
+     *     Re-validation means a bad return can't bypass the schema - the trust boundary holds.
      *   - **`undefined`** → give up; the original validation `422` is returned unchanged.
      * A route hook **overrides** the app-wide default set via `server({ onValidationError })`; return
      * `undefined` to fall through to the plain `422` even when an app default exists. Typical uses: a custom
@@ -147,8 +147,8 @@ export interface ResponseControls {
     status?: number;
     readonly headers: Record<string, string>;
     /**
-     * Queue a `Set-Cookie` on the response. Defaults are **secure-by-default** —
-     * `HttpOnly; Secure; SameSite=Lax; Path=/` — overridable per call (pass `{ secure: false }` for
+     * Queue a `Set-Cookie` on the response. Defaults are **secure-by-default** -
+     * `HttpOnly; Secure; SameSite=Lax; Path=/` - overridable per call (pass `{ secure: false }` for
      * local http dev). Multiple calls set multiple cookies (they're merged via a `Headers` object, so
      * they don't collapse the way the plain `headers` Record would). Sign the value with `signValue`
      * for tamper-evidence (what `@nifrajs/auth` sessions do).
@@ -165,7 +165,7 @@ export interface ResponseControls {
  */
 export interface Platform<Env = unknown> {
     /** Platform bindings (KV/D1/secrets on Workers). Typed as `Env` when the app declares them via
-     * `server<Env>()`; otherwise `unknown` — validate before use. */
+     * `server<Env>()`; otherwise `unknown` - validate before use. */
     readonly env?: Env;
     /** Extend the response's lifetime for background work (Workers `ctx.waitUntil`). */
     readonly waitUntil?: (promise: Promise<unknown>) => void;
@@ -182,7 +182,7 @@ export interface Platform<Env = unknown> {
 export interface Context<Path extends string = string, S extends RouteSchema = RouteSchema> {
     readonly req: Request;
     /**
-     * Alias of {@link req} — the same `Request`. Page loaders/actions receive their request as `request`;
+     * Alias of {@link req} - the same `Request`. Page loaders/actions receive their request as `request`;
      * this alias lets route handlers and loaders share one name, so `c.request` and `ctx.req` both work
      * everywhere (no more `c.req` vs `ctx.request` mismatch).
      */
@@ -191,12 +191,12 @@ export interface Context<Path extends string = string, S extends RouteSchema = R
     readonly query: QueryOf<S>;
     readonly body: BodyOf<S>;
     /** The request's cookies, parsed from the `Cookie` header (values URL-decoded). Parsed lazily on
-     * first access + cached. Signed cookies arrive as `value.signature` — verify with `unsignValue`. */
+     * first access + cached. Signed cookies arrive as `value.signature` - verify with `unsignValue`. */
     readonly cookies: Readonly<Record<string, string>>;
     readonly set: ResponseControls;
     /**
      * Aborts when the server's `requestTimeoutMs` elapses (and never, when no timeout
-     * is configured). Pass it to cancellation-aware work — DB drivers, `fetch` — so a
+     * is configured). Pass it to cancellation-aware work - DB drivers, `fetch` - so a
      * timed-out request stops doing work instead of running on after the 503.
      */
     readonly signal: AbortSignal;
@@ -206,14 +206,14 @@ export interface Context<Path extends string = string, S extends RouteSchema = R
      */
     readonly budget: RequestBudget;
     /**
-     * Platform bindings from `app.fetch(request, { env })` — Workers `env` (KV/D1/secrets), etc.
+     * Platform bindings from `app.fetch(request, { env })` - Workers `env` (KV/D1/secrets), etc.
      * `undefined` off-edge (Bun/Node/Deno). Declare the shape with `server<Env>()` to read it typed
      * (`c.env: Env`); otherwise `unknown`. Validate at the trust boundary before use either way.
      */
     readonly env: unknown;
     /**
      * The caller's IP. By default the raw socket peer the serving adapter observed (`listen()`,
-     * `@nifrajs/node`, `@nifrajs/deno`) — the one address a client cannot forge — or `undefined` when the
+     * `@nifrajs/node`, `@nifrajs/deno`) - the one address a client cannot forge - or `undefined` when the
      * runtime exposes no socket (Workers) and no trust is declared. Behind a proxy/CDN, set the
      * `clientIp` server option (`{ trustedHops }` or `{ header }`) to derive the real caller from the
      * forwarding chain as far as you trust it; unset, no forwarded header is ever believed. Safe to key
@@ -228,8 +228,8 @@ export interface Context<Path extends string = string, S extends RouteSchema = R
     readonly waitUntil: (promise: Promise<unknown>) => void;
     /**
      * Read the raw request body as bytes, **capped** at `maxBytes` (default: the server's
-     * `maxBodyBytes`). For routes with **no body schema** — raw bodies, file uploads,
-     * BYO-validation — where the automatic schema cap doesn't apply. An over-cap body (by
+     * `maxBodyBytes`). For routes with **no body schema** - raw bodies, file uploads,
+     * BYO-validation - where the automatic schema cap doesn't apply. An over-cap body (by
      * `Content-Length` or while streaming) throws a flat `413`; a malformed `Content-Length`
      * throws `400`. Consumes the body stream (call once). Pass a larger `maxBytes` for an
      * upload route, a smaller one to tighten a specific endpoint.
@@ -243,7 +243,7 @@ export interface Context<Path extends string = string, S extends RouteSchema = R
     readonly boundedJson: <T = unknown>(maxBytes?: number) => Promise<T>;
     /**
      * Build a JSON `Response`. Pass a status number or a full `ResponseInit` as the second arg. `return` it
-     * from a handler, or `throw` it from `derive`/`beforeHandle` to short-circuit — both work:
+     * from a handler, or `throw` it from `derive`/`beforeHandle` to short-circuit - both work:
      * `throw c.json({ error: "unauthorized" }, 401)`. A terser alternative to
      * `new Response(JSON.stringify(...), { status, headers: { "content-type": "application/json" } })`.
      */

package/dist/server/contract.d.ts

@@ -15,7 +15,7 @@ export interface ResponseDef {
 /**
  * One operation in a contract. Input schemas are any Standard Schema; `response` is optional.
  *
- * The fields below `response` are **optional OpenAPI metadata** — they don't affect runtime
+ * The fields below `response` are **optional OpenAPI metadata** - they don't affect runtime
  * validation or the inferred handler types, they enrich the document `toOpenAPI` emits. A contract is
  * the natural home for them: it's the versionable description of the API, decoupled from the impl.
  */
@@ -80,7 +80,7 @@ type OpErrors<O extends OperationDef> = O extends {
  * RouteInfo as a *decoupled consumer* sees it from the contract alone: the
  * `output` is the declared `response` schema's type, or `unknown` when none is
  * declared (the consumer can't know the response without the server). Path/method
- * levels are mutable and fields are `readonly` — matching the inline registry, so
+ * levels are mutable and fields are `readonly` - matching the inline registry, so
  * the two are mutually assignable.
  */
 type RouteInfoForOp<O extends OperationDef> = {
@@ -112,7 +112,7 @@ type SchemaForOp<O extends OperationDef> = (O extends {
     params: P;
 } : Record<never, never>);
 /**
- * The handler context for an op — identical to the inline `Context<Path, S>`, so a
+ * The handler context for an op - identical to the inline `Context<Path, S>`, so a
  * handler written for an inline route type-checks unchanged under `implement`
  * (the graduation guarantee).
  */
@@ -120,9 +120,9 @@ export type ContextForOp<O extends OperationDef> = Context<O["path"], SchemaForO
 type MaybePromise<T> = T | Promise<T>;
 /**
  * What a handler may return for an op. When the op declares a `response`, the return is constrained to
- * that contract shape (or a raw `Response`) — so an `implement`ed backend can't drift from the response
+ * that contract shape (or a raw `Response`) - so an `implement`ed backend can't drift from the response
  * the contract's client was built against. With no `response` it's unconstrained (`unknown`), identical
- * to before. Purely type-level — erased at compile time, zero runtime cost — and mirrors the inline
+ * to before. Purely type-level - erased at compile time, zero runtime cost - and mirrors the inline
  * route's `ResponseOf` constraint, so a handler graduates inline↔contract unchanged.
  */
 type HandlerReturnForOp<O extends OperationDef> = O extends {
@@ -148,7 +148,7 @@ export declare function defineContract<const C extends ContractShape>(contract:
 type AnyFn = (...args: never[]) => unknown;
 /**
  * The registry produced by `implement`: input from the contract op; `output` is the declared `response`
- * contract when present (it wins — exactly as in the inline path), else the bound HANDLER's return — so
+ * contract when present (it wins - exactly as in the inline path), else the bound HANDLER's return - so
  * the implemented server stays route-for-route identical to the equivalent inline server (the
  * mode-conformance guarantee), and a contract-typed client and a `typeof app`-typed client agree.
  */
@@ -169,7 +169,7 @@ export type RegistryFromImpl<C extends ContractShape, H extends HandlersFor<C, C
 /**
  * Bind handlers to a contract, producing a real {@link Server} you can `.listen()`
  * or `.fetch()`. Each op is registered through the same path as the inline
- * builder, so the result is identical to writing the routes inline — handlers
+ * builder, so the result is identical to writing the routes inline - handlers
  * lift over **unchanged** ("graduation"), and body/query schemas validate at the
  * request boundary exactly as in inline mode.
  *

package/dist/server/contract.js

@@ -33,7 +33,7 @@ export function defineContract(contract) {
 /**
  * Bind handlers to a contract, producing a real {@link Server} you can `.listen()`
  * or `.fetch()`. Each op is registered through the same path as the inline
- * builder, so the result is identical to writing the routes inline — handlers
+ * builder, so the result is identical to writing the routes inline - handlers
  * lift over **unchanged** ("graduation"), and body/query schemas validate at the
  * request boundary exactly as in inline mode.
  *
@@ -54,9 +54,9 @@ export function implement(contract, handlers, app) {
     const target = (app ?? new Server());
     const routes = Object.entries(contract).map(([name, op]) => {
         // body/query are validated at the request boundary; `response` is a type + introspection contract
-        // ONLY — never validated at runtime and never read on the request hot path (the lifecycle reads
+        // ONLY - never validated at runtime and never read on the request hot path (the lifecycle reads
         // schema.body/query by name; the `bare`/bodyOnly/queryOnly fast-path gates ignore `response`). Built
-        // once here at bind time, not per request — it just carries a reference to the op's existing schema.
+        // once here at bind time, not per request - it just carries a reference to the op's existing schema.
         // A response-less op still yields `undefined`, byte-identical to before.
         const schema = op.params !== undefined ||
             op.body !== undefined ||

package/dist/server/cookies.d.ts

@@ -1,5 +1,5 @@
 /**
- * Cookie primitives — parse a request `Cookie` header, serialize a `Set-Cookie`, and sign/verify a
+ * Cookie primitives - parse a request `Cookie` header, serialize a `Set-Cookie`, and sign/verify a
  * value with HMAC-SHA256 via **WebCrypto** (`crypto.subtle`), so they're portable across Bun, Node,
  * Deno, and workerd with no `node:crypto` dependency. Pure + runtime-agnostic: `c.cookies` (read) and
  * `c.set.cookie` (write) build on these, and `@nifrajs/auth` builds sessions on top.
@@ -17,16 +17,16 @@ export interface CookieOptions {
     readonly partitioned?: boolean;
 }
 /** Parse a request `Cookie` header into a name→value map (values URL-decoded). Unparseable pairs are
- * skipped rather than throwing — a junk `Cookie` header shouldn't fail the request.
+ * skipped rather than throwing - a junk `Cookie` header shouldn't fail the request.
  *
  * Hand-rolled index walk instead of `split(";")` + `trim()` chains: those allocated an array + up
  * to three substrings per pair and showed up at ~6% of a realistic (auth + cookie) request. Same
  * semantics, two slices per pair, no intermediate array. */
 export declare function parseCookies(header: string | null | undefined): Record<string, string>;
 /**
- * Serialize a `Set-Cookie` header value. Pure — applies **no** security defaults (the caller, e.g.
+ * Serialize a `Set-Cookie` header value. Pure - applies **no** security defaults (the caller, e.g.
  * `c.set.cookie`, layers `HttpOnly`/`Secure`/`SameSite` on). Throws on an invalid cookie name, a
- * header-injecting `Path`/`Domain`, a non-integer `maxAge`, or an oversized result — a serialization
+ * header-injecting `Path`/`Domain`, a non-integer `maxAge`, or an oversized result - a serialization
  * bug should fail loudly, not silently emit a cookie the browser drops.
  */
 export declare function serializeCookie(name: string, value: string, options?: CookieOptions): string;

package/dist/server/cookies.js

@@ -1,5 +1,5 @@
 /**
- * Cookie primitives — parse a request `Cookie` header, serialize a `Set-Cookie`, and sign/verify a
+ * Cookie primitives - parse a request `Cookie` header, serialize a `Set-Cookie`, and sign/verify a
  * value with HMAC-SHA256 via **WebCrypto** (`crypto.subtle`), so they're portable across Bun, Node,
  * Deno, and workerd with no `node:crypto` dependency. Pure + runtime-agnostic: `c.cookies` (read) and
  * `c.set.cookie` (write) build on these, and `@nifrajs/auth` builds sessions on top.
@@ -7,8 +7,8 @@
 import { requireSecretBytes } from "../internal/secret.js";
 // RFC 6265 cookie-name token: visible ASCII minus separators/whitespace/controls.
 const COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-const MAX_COOKIE_BYTES = 4096; // browsers cap a cookie near 4 KB — reject oversized before the wire
-/** True if `v` contains a character illegal in a cookie attribute (control char or `;` separator) —
+const MAX_COOKIE_BYTES = 4096; // browsers cap a cookie near 4 KB - reject oversized before the wire
+/** True if `v` contains a character illegal in a cookie attribute (control char or `;` separator) -
  * the header-injection guard for dev-supplied `Path`/`Domain`. */
 const hasIllegalChar = (v) => {
     for (let i = 0; i < v.length; i++) {
@@ -19,7 +19,7 @@ const hasIllegalChar = (v) => {
     return false;
 };
 const safeDecode = (v) => {
-    // No `%` ⇒ nothing to decode — skip the call AND its try frame (profiled: cookie values are
+    // No `%` ⇒ nothing to decode - skip the call AND its try frame (profiled: cookie values are
     // overwhelmingly plain; this was ~3% of a realistic request).
     if (!v.includes("%"))
         return v;
@@ -31,7 +31,7 @@ const safeDecode = (v) => {
     }
 };
 /** Parse a request `Cookie` header into a name→value map (values URL-decoded). Unparseable pairs are
- * skipped rather than throwing — a junk `Cookie` header shouldn't fail the request.
+ * skipped rather than throwing - a junk `Cookie` header shouldn't fail the request.
  *
  * Hand-rolled index walk instead of `split(";")` + `trim()` chains: those allocated an array + up
  * to three substrings per pair and showed up at ~6% of a realistic (auth + cookie) request. Same
@@ -86,9 +86,9 @@ export function parseCookies(header) {
     return out;
 }
 /**
- * Serialize a `Set-Cookie` header value. Pure — applies **no** security defaults (the caller, e.g.
+ * Serialize a `Set-Cookie` header value. Pure - applies **no** security defaults (the caller, e.g.
  * `c.set.cookie`, layers `HttpOnly`/`Secure`/`SameSite` on). Throws on an invalid cookie name, a
- * header-injecting `Path`/`Domain`, a non-integer `maxAge`, or an oversized result — a serialization
+ * header-injecting `Path`/`Domain`, a non-integer `maxAge`, or an oversized result - a serialization
  * bug should fail loudly, not silently emit a cookie the browser drops.
  */
 export function serializeCookie(name, value, options = {}) {
@@ -152,7 +152,7 @@ const fromBase64Url = (s) => {
         return bytes;
     }
     catch {
-        return null; // not valid base64 — treat as a bad signature
+        return null; // not valid base64 - treat as a bad signature
     }
 };
 /** Append an HMAC-SHA256 signature to a value → `value.signature` (base64url). For signed cookies. */