@nifrajs/testing 2.1.0 → 2.3.0

package/README.md

@@ -65,7 +65,7 @@ const report = await assertAdversarialContract(app, {
 
 `runAdversarialContract` returns the same structured report without throwing. Every failure includes
 `replay: { seed, caseId, runtime }`; rerun one case with `only: caseId`. Contract runs execute one valid
-request for each declared response schema, so use an isolated test app/database—never point the
+request for each declared response schema, so use an isolated test app/database-never point the
 laboratory at production.
 
 `nifra levels` L4 uses this same deep engine through the explicitly configured isolated executor;
@@ -149,7 +149,7 @@ await client.auth.logout.post()                    // a Max-Age=0 Set-Cookie cle
 expect(cookies.get("sid")).toBeUndefined()
 ```
 
-Same in-process client as `testClient` — the app's own `fetch`, no server/port/network, the full real
+Same in-process client as `testClient` - the app's own `fetch`, no server/port/network, the full real
 lifecycle (validation, middleware, contracts, auth) and end-to-end types from `App`. The only addition is
 that every call carries and captures cookies via a shared jar.
 
@@ -162,14 +162,14 @@ that every call carries and captures cookies via a shared jar.
 - `certifyAdapter({ profile, adapterId, createAdapter })` → capability matrix + SHA-256 evidence.
 - `verifyAdapterCertification(report)` → recompute and verify portable certification evidence.
 - `testSession<App>(app, { origin?, cookies? })` → `{ client: Treaty<App>, cookies: CookieJar }`.
-- `cookieJar()` → `CookieJar` — `header()` · `applyTo(headers)` · `store(response)` · `set` · `get` · `clear` · `size`.
+- `cookieJar()` → `CookieJar` - `header()` · `applyTo(headers)` · `store(response)` · `set` · `get` · `clear` · `size`.
   Honours removal (`Max-Age=0` / past `Expires`); other cookie attributes are ignored (in-process, same-origin).
 
 For a **stateless** request (no cookies), use `testClient` from `@nifrajs/client` directly.
 
 ## For AI agents
 
-Start with [`LLM.md`](./LLM.md) — this package's contract card (the exports you call + its footguns),
+Start with [`LLM.md`](./LLM.md) - this package's contract card (the exports you call + its footguns),
 one cheap read instead of the whole corpus. For the wider framework: the repo's
 [`AGENTS.md`](../../AGENTS.md) is the copy-paste quick reference, and
 [`llms-full.txt`](../../llms-full.txt) is the full machine-readable corpus. Run `nifra check` as the

package/dist/adversarial.js

@@ -20,7 +20,7 @@ export class AdversarialContractError extends Error {
         const details = [
             ...report.failures
                 .slice(0, 5)
-                .map((failure) => `${failure.runtime}: ${failure.id} — ${failure.message} (replay seed ${report.seed})`),
+                .map((failure) => `${failure.runtime}: ${failure.id} - ${failure.message} (replay seed ${report.seed})`),
             ...report.gaps
                 .slice(0, 5)
                 .map((gap) => `${gap.route ?? "contract"}${gap.target ? ` ${gap.target}` : ""}: ${gap.message}`),

package/dist/cookies.d.ts

@@ -1,8 +1,8 @@
 /**
- * A tiny cookie jar for in-process tests — parses `Set-Cookie` off responses and emits a `Cookie`
+ * A tiny cookie jar for in-process tests - parses `Set-Cookie` off responses and emits a `Cookie`
  * request header, so a login → authenticated-request flow works without threading headers by hand. It
  * honours removal (`Max-Age=0` / a past `Expires`) so logout clears the cookie; other attributes
- * (Domain/Path/Secure/SameSite) are ignored — everything is same-origin in-process.
+ * (Domain/Path/Secure/SameSite) are ignored - everything is same-origin in-process.
  */
 export interface CookieJar {
     /** The current `Cookie` request-header value (`"a=1; b=2"`, or `""` when empty). */

package/dist/cookies.js

@@ -1,8 +1,8 @@
 /**
- * A tiny cookie jar for in-process tests — parses `Set-Cookie` off responses and emits a `Cookie`
+ * A tiny cookie jar for in-process tests - parses `Set-Cookie` off responses and emits a `Cookie`
  * request header, so a login → authenticated-request flow works without threading headers by hand. It
  * honours removal (`Max-Age=0` / a past `Expires`) so logout clears the cookie; other attributes
- * (Domain/Path/Secure/SameSite) are ignored — everything is same-origin in-process.
+ * (Domain/Path/Secure/SameSite) are ignored - everything is same-origin in-process.
  */
 /** Read `Set-Cookie` values portably: `getSetCookie()` (Bun/Node/edge) with a single-header fallback. */
 function setCookies(headers) {

package/dist/incident.d.ts

@@ -1,12 +1,12 @@
 /**
- * Turn a failed request into a committed regression test — the one thing a generic error tracker
+ * Turn a failed request into a committed regression test - the one thing a generic error tracker
  * (Sentry, PostHog) can't do, because it needs the framework's contract + in-process replay. Capture
  * the request + observed response, replay it against the CURRENT app, and assert the response contract
  * (status, optionally shape) still reproduces. This does NOT replace error tracking or store incidents
- * — it converts one into a permanent test.
+ * - it converts one into a permanent test.
  *
  * Two surfaces, deliberately separate on the PII axis:
- *   - `replayIncident` / `assertIncidentReplays` run in memory against the REAL captured inputs — nothing
+ *   - `replayIncident` / `assertIncidentReplays` run in memory against the REAL captured inputs - nothing
  *     is written, so reproduction is exact and there is no leak surface.
  *   - `generateRegressionTest` emits a file you commit, so it redacts request values BY DEFAULT and
  *     bannered a sanitize step: a committed fixture must never carry raw PII/secrets.
@@ -74,7 +74,7 @@ export declare class IncidentReplayError extends Error {
 export declare function assertIncidentReplays(app: AppLike, capsule: IncidentCapsule, options?: ReplayIncidentOptions): Promise<void>;
 /**
  * Redact leaf string values by default (unless the dotted key path is allow-listed). Non-strings are
- * kept — they carry the structure that makes the fixture reproduce — so review the emitted file. This
+ * kept - they carry the structure that makes the fixture reproduce - so review the emitted file. This
  * is intentionally aggressive: a committed fixture must not leak PII/secrets.
  */
 export declare function redactForEmission(value: unknown, allow: ReadonlySet<string>, path?: string): unknown;
@@ -90,7 +90,7 @@ export interface GenerateRegressionTestOptions {
 }
 /**
  * Emit a committable regression test from a capsule. Request string values are redacted BY DEFAULT with
- * a sanitize banner — replace the `<redacted>` placeholders with safe, reproducing values before you
+ * a sanitize banner - replace the `<redacted>` placeholders with safe, reproducing values before you
  * commit. The test asserts the response contract via {@link assertIncidentReplays}.
  */
 export declare function generateRegressionTest(capsule: IncidentCapsule, options?: GenerateRegressionTestOptions): string;

package/dist/incident.js

@@ -1,12 +1,12 @@
 /**
- * Turn a failed request into a committed regression test — the one thing a generic error tracker
+ * Turn a failed request into a committed regression test - the one thing a generic error tracker
  * (Sentry, PostHog) can't do, because it needs the framework's contract + in-process replay. Capture
  * the request + observed response, replay it against the CURRENT app, and assert the response contract
  * (status, optionally shape) still reproduces. This does NOT replace error tracking or store incidents
- * — it converts one into a permanent test.
+ * - it converts one into a permanent test.
  *
  * Two surfaces, deliberately separate on the PII axis:
- *   - `replayIncident` / `assertIncidentReplays` run in memory against the REAL captured inputs — nothing
+ *   - `replayIncident` / `assertIncidentReplays` run in memory against the REAL captured inputs - nothing
  *     is written, so reproduction is exact and there is no leak surface.
  *   - `generateRegressionTest` emits a file you commit, so it redacts request values BY DEFAULT and
  *     bannered a sanitize step: a committed fixture must never carry raw PII/secrets.
@@ -162,7 +162,7 @@ export async function assertIncidentReplays(app, capsule, options = {}) {
 const REDACTED = "<redacted>";
 /**
  * Redact leaf string values by default (unless the dotted key path is allow-listed). Non-strings are
- * kept — they carry the structure that makes the fixture reproduce — so review the emitted file. This
+ * kept - they carry the structure that makes the fixture reproduce - so review the emitted file. This
  * is intentionally aggressive: a committed fixture must not leak PII/secrets.
  */
 export function redactForEmission(value, allow, path = "") {
@@ -181,7 +181,7 @@ export function redactForEmission(value, allow, path = "") {
 }
 /**
  * Emit a committable regression test from a capsule. Request string values are redacted BY DEFAULT with
- * a sanitize banner — replace the `<redacted>` placeholders with safe, reproducing values before you
+ * a sanitize banner - replace the `<redacted>` placeholders with safe, reproducing values before you
  * commit. The test asserts the response contract via {@link assertIncidentReplays}.
  */
 export function generateRegressionTest(capsule, options = {}) {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * @nifrajs/testing — helpers for testing nifra apps in-process. `@nifrajs/client`'s `testClient` is the
+ * @nifrajs/testing - helpers for testing nifra apps in-process. `@nifrajs/client`'s `testClient` is the
  * typed, no-network request client (the supertest/inject equivalent); this adds what it doesn't: a
  * {@link cookieJar} and a cookie-persisting {@link testSession}, so stateful auth/session flows are as
  * easy to test as a single request.

package/dist/index.js

@@ -1,5 +1,5 @@
 /**
- * @nifrajs/testing — helpers for testing nifra apps in-process. `@nifrajs/client`'s `testClient` is the
+ * @nifrajs/testing - helpers for testing nifra apps in-process. `@nifrajs/client`'s `testClient` is the
  * typed, no-network request client (the supertest/inject equivalent); this adds what it doesn't: a
  * {@link cookieJar} and a cookie-persisting {@link testSession}, so stateful auth/session flows are as
  * easy to test as a single request.

package/dist/session.d.ts

@@ -1,6 +1,6 @@
 /**
  * A stateful, cookie-aware in-process test client. `@nifrajs/client`'s `testClient` already drives an
- * app's `fetch` with end-to-end types (no server/port/network) — this wraps it with a {@link CookieJar}
+ * app's `fetch` with end-to-end types (no server/port/network) - this wraps it with a {@link CookieJar}
  * that carries `Set-Cookie` across calls, so a login → authenticated-request flow just works.
  *
  *   import { testSession } from "@nifrajs/testing"
@@ -13,7 +13,7 @@
  */
 import { type ClientOptions, type Treaty } from "@nifrajs/client";
 import { type CookieJar } from "./cookies.js";
-/** The minimal shape a nifra `server()` app satisfies — its own `fetch`. */
+/** The minimal shape a nifra `server()` app satisfies - its own `fetch`. */
 export interface AppLike {
     fetch(request: Request): Response | Promise<Response>;
 }
@@ -24,9 +24,9 @@ export interface TestSessionOptions extends Omit<ClientOptions, "fetch"> {
     readonly cookies?: CookieJar;
 }
 export interface TestSession<App> {
-    /** The end-to-end-typed in-process client — every call carries + captures cookies. */
+    /** The end-to-end-typed in-process client - every call carries + captures cookies. */
     readonly client: Treaty<App>;
-    /** The jar backing this session — inspect (`cookies.get("sid")`), seed, or `clear()` it. */
+    /** The jar backing this session - inspect (`cookies.get("sid")`), seed, or `clear()` it. */
     readonly cookies: CookieJar;
 }
 /** Create a cookie-persisting in-process test client for `app`. */

package/dist/session.js

@@ -1,6 +1,6 @@
 /**
  * A stateful, cookie-aware in-process test client. `@nifrajs/client`'s `testClient` already drives an
- * app's `fetch` with end-to-end types (no server/port/network) — this wraps it with a {@link CookieJar}
+ * app's `fetch` with end-to-end types (no server/port/network) - this wraps it with a {@link CookieJar}
  * that carries `Set-Cookie` across calls, so a login → authenticated-request flow just works.
  *
  *   import { testSession } from "@nifrajs/testing"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/testing",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "Contract-derived adversarial tests, runtime-matrix response conformance, and cookie-aware in-process sessions for Nifra apps.",
   "keywords": [
     "bun",
@@ -37,9 +37,9 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@nifrajs/client": "2.1.0",
-    "@nifrajs/core": "2.1.0",
-    "@nifrajs/mock": "2.1.0"
+    "@nifrajs/client": "2.3.0",
+    "@nifrajs/core": "2.3.0",
+    "@nifrajs/mock": "2.3.0"
   },
   "publishConfig": {
     "access": "public"

package/src/adversarial.ts

@@ -163,7 +163,7 @@ export class AdversarialContractError extends Error {
         .slice(0, 5)
         .map(
           (failure) =>
-            `${failure.runtime}: ${failure.id} — ${failure.message} (replay seed ${report.seed})`,
+            `${failure.runtime}: ${failure.id} - ${failure.message} (replay seed ${report.seed})`,
         ),
       ...report.gaps
         .slice(0, 5)

package/src/cookies.ts

@@ -1,8 +1,8 @@
 /**
- * A tiny cookie jar for in-process tests — parses `Set-Cookie` off responses and emits a `Cookie`
+ * A tiny cookie jar for in-process tests - parses `Set-Cookie` off responses and emits a `Cookie`
  * request header, so a login → authenticated-request flow works without threading headers by hand. It
  * honours removal (`Max-Age=0` / a past `Expires`) so logout clears the cookie; other attributes
- * (Domain/Path/Secure/SameSite) are ignored — everything is same-origin in-process.
+ * (Domain/Path/Secure/SameSite) are ignored - everything is same-origin in-process.
  */
 
 export interface CookieJar {

package/src/incident.ts

@@ -1,12 +1,12 @@
 /**
- * Turn a failed request into a committed regression test — the one thing a generic error tracker
+ * Turn a failed request into a committed regression test - the one thing a generic error tracker
  * (Sentry, PostHog) can't do, because it needs the framework's contract + in-process replay. Capture
  * the request + observed response, replay it against the CURRENT app, and assert the response contract
  * (status, optionally shape) still reproduces. This does NOT replace error tracking or store incidents
- * — it converts one into a permanent test.
+ * - it converts one into a permanent test.
  *
  * Two surfaces, deliberately separate on the PII axis:
- *   - `replayIncident` / `assertIncidentReplays` run in memory against the REAL captured inputs — nothing
+ *   - `replayIncident` / `assertIncidentReplays` run in memory against the REAL captured inputs - nothing
  *     is written, so reproduction is exact and there is no leak surface.
  *   - `generateRegressionTest` emits a file you commit, so it redacts request values BY DEFAULT and
  *     bannered a sanitize step: a committed fixture must never carry raw PII/secrets.
@@ -234,7 +234,7 @@ const REDACTED = "<redacted>"
 
 /**
  * Redact leaf string values by default (unless the dotted key path is allow-listed). Non-strings are
- * kept — they carry the structure that makes the fixture reproduce — so review the emitted file. This
+ * kept - they carry the structure that makes the fixture reproduce - so review the emitted file. This
  * is intentionally aggressive: a committed fixture must not leak PII/secrets.
  */
 export function redactForEmission(value: unknown, allow: ReadonlySet<string>, path = ""): unknown {
@@ -264,7 +264,7 @@ export interface GenerateRegressionTestOptions {
 
 /**
  * Emit a committable regression test from a capsule. Request string values are redacted BY DEFAULT with
- * a sanitize banner — replace the `<redacted>` placeholders with safe, reproducing values before you
+ * a sanitize banner - replace the `<redacted>` placeholders with safe, reproducing values before you
  * commit. The test asserts the response contract via {@link assertIncidentReplays}.
  */
 export function generateRegressionTest(

package/src/index.ts

@@ -1,5 +1,5 @@
 /**
- * @nifrajs/testing — helpers for testing nifra apps in-process. `@nifrajs/client`'s `testClient` is the
+ * @nifrajs/testing - helpers for testing nifra apps in-process. `@nifrajs/client`'s `testClient` is the
  * typed, no-network request client (the supertest/inject equivalent); this adds what it doesn't: a
  * {@link cookieJar} and a cookie-persisting {@link testSession}, so stateful auth/session flows are as
  * easy to test as a single request.

package/src/session.ts

@@ -1,6 +1,6 @@
 /**
  * A stateful, cookie-aware in-process test client. `@nifrajs/client`'s `testClient` already drives an
- * app's `fetch` with end-to-end types (no server/port/network) — this wraps it with a {@link CookieJar}
+ * app's `fetch` with end-to-end types (no server/port/network) - this wraps it with a {@link CookieJar}
  * that carries `Set-Cookie` across calls, so a login → authenticated-request flow just works.
  *
  *   import { testSession } from "@nifrajs/testing"
@@ -14,7 +14,7 @@
 import { type ClientOptions, client, type FetchFn, type Treaty } from "@nifrajs/client"
 import { type CookieJar, cookieJar } from "./cookies.ts"
 
-/** The minimal shape a nifra `server()` app satisfies — its own `fetch`. */
+/** The minimal shape a nifra `server()` app satisfies - its own `fetch`. */
 export interface AppLike {
   fetch(request: Request): Response | Promise<Response>
 }
@@ -27,9 +27,9 @@ export interface TestSessionOptions extends Omit<ClientOptions, "fetch"> {
 }
 
 export interface TestSession<App> {
-  /** The end-to-end-typed in-process client — every call carries + captures cookies. */
+  /** The end-to-end-typed in-process client - every call carries + captures cookies. */
   readonly client: Treaty<App>
-  /** The jar backing this session — inspect (`cookies.get("sid")`), seed, or `clear()` it. */
+  /** The jar backing this session - inspect (`cookies.get("sid")`), seed, or `clear()` it. */
   readonly cookies: CookieJar
 }