astroidjs 0.12.1 → 0.14.0

package/dist/astro/csp.js

@@ -9,14 +9,14 @@
 //   - **Astro owns `script-src`.** Its `security.csp` hashes every script it
 //     processes, so the policy can be `'self'` with no `'unsafe-inline'`. What it
 //     does NOT hash is Solid's hydration bootstrap, which `@astrojs/solid-js`
-//     injects on every page carrying an island — Astro only tracks its own inline
+//     injects on every page carrying an island—Astro only tracks its own inline
 //     scripts. So we compute that hash from the very function the renderer calls,
 //     which means it follows solid-js upgrades instead of going stale as a
 //     copy-pasted literal.
 //   - **The middleware owns `style-src`.** Louise's data-driven `style=""`
 //     carriers and the editor's runtime-injected `<style>` need
 //     `'unsafe-inline'`, and per spec a single hash in `style-src` VOIDS
-//     `'unsafe-inline'` — so the two cannot coexist in one directive. The
+//     `'unsafe-inline'`—so the two cannot coexist in one directive. The
 //     generated middleware rewrites that one directive after the fact
 //     (`cspStyleSrc`), leaving Astro's script hashes verbatim.
 //
@@ -33,7 +33,7 @@ export { astroidCspOrigins } from "../security/csp-origins.js";
  * Hash of Solid's inline hydration bootstrap.
  *
  * `@astrojs/solid-js` injects this script on every page with an island, but
- * Astro's CSP tracker only hashes scripts it processed itself — so without this
+ * Astro's CSP tracker only hashes scripts it processed itself—so without this
  * the bootstrap is blocked under `script-src 'self'` and every island silently
  * fails to hydrate. Computed from `generateHydrationScript()` (the same call the
  * renderer makes), so a solid-js upgrade that changes the bootstrap updates the
@@ -45,7 +45,7 @@ export function solidHydrationHash() {
 }
 /**
  * Render one directive. The name is a literal from the union above, so the
- * concatenation is a valid `CspDirective` by construction — which is what the
+ * concatenation is a valid `CspDirective` by construction—which is what the
  * assertion is standing in for (TS widens template concatenation to `string`).
  */
 function directive(name, ...sources) {
@@ -53,7 +53,7 @@ function directive(name, ...sources) {
     return (list ? `${name} ${list}` : name);
 }
 /**
- * The `security` block for `astro.config.mjs` — Astro's half of the split.
+ * The `security` block for `astro.config.mjs`—Astro's half of the split.
  *
  * `style-src` is deliberately absent: the generated middleware rewrites it per
  * response, and declaring it here would be the hash-vs-`'unsafe-inline'`
@@ -93,7 +93,7 @@ export function astroidSecurity(config) {
 }
 /**
  * Vite build options the CSP depends on. `assetsInlineLimit: 0` stops Vite from
- * inlining small assets as `data:` URLs — an inlined script would be inline, and
+ * inlining small assets as `data:` URLs—an inlined script would be inline, and
  * therefore unhashed, and therefore blocked by `script-src 'self'`. Spread this
  * into `vite.build` rather than remembering why the number is zero.
  */

package/dist/astro/index.js

@@ -1,6 +1,6 @@
 // Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
 //
-// `astroidjs/astro` — the BUILD-TIME surface, imported from `astro.config.mjs`.
+// `astroidjs/astro`—the BUILD-TIME surface, imported from `astro.config.mjs`.
 // Kept off the main entry on purpose: it reaches for `node:crypto` and
 // `solid-js/web`, neither of which belongs in the Worker bundle the generated
 // `worker.ts` produces.

package/dist/auth/index.d.ts

@@ -1,6 +1,6 @@
 import type { AstroidConfig } from "../config.js";
 /**
- * The editor Better Auth instance's table prefix — `louise_user`,
+ * The editor Better Auth instance's table prefix—`louise_user`,
  * `louise_session`, … The unprefixed names are left free for a second (portal)
  * instance. Consumed by the generated `editorsRoute` and mirrored by the
  * scaffolded `src/auth.ts` (`getLouiseAuth({ tablePrefix })`) + its migration.
@@ -12,7 +12,7 @@ export declare const ASTROID_EDITOR_TABLE_PREFIX = "louise_";
  * reject a portal that would collide with it.
  */
 export declare const ASTROID_EDITOR_COOKIE_PREFIX = "better-auth";
-/** The editor's Better Auth table name for a given model (e.g. `louise_user`). */
+/** The editor's Better Auth table name for a given model (for example, `louise_user`). */
 export declare function astroidEditorTable(model: string): string;
 /**
  * Reject a portal whose isolation would collide with the editor instance on the

package/dist/auth/index.js

@@ -3,12 +3,12 @@
 // Editor-auth convention + the two-instance isolation guard.
 //
 // Astroid runs up to TWO Better Auth instances on one origin: the EDITOR (the
-// studio — magic-link + passkey, a DB-managed admin allowlist) and, optionally, a
-// second PORTAL instance (customers/members/a shop account — see `portal/`). The
+// studio—magic-link + passkey, a DB-managed admin allowlist) and, optionally, a
+// second PORTAL instance (customers/members/a shop account—see `portal/`). The
 // editor owns Better Auth's default mount (`/api/auth`) and cookie because the
 // Louise editor client hardcodes them; its tables are namespaced with the
 // `louise_` prefix so a second instance can take the unprefixed `user`/`session`
-// tables without collision. The portal is the one that MOVES — a distinct mount,
+// tables without collision. The portal is the one that MOVES—a distinct mount,
 // cookie prefix, and (by default) table prefix.
 //
 // The failure this guards against is subtle and intermittent: two instances that
@@ -18,7 +18,7 @@
 import { AstroidConfigError } from "../errors.js";
 import { astroidPortal } from "../portal/config.js";
 /**
- * The editor Better Auth instance's table prefix — `louise_user`,
+ * The editor Better Auth instance's table prefix—`louise_user`,
  * `louise_session`, … The unprefixed names are left free for a second (portal)
  * instance. Consumed by the generated `editorsRoute` and mirrored by the
  * scaffolded `src/auth.ts` (`getLouiseAuth({ tablePrefix })`) + its migration.
@@ -30,7 +30,7 @@ export const ASTROID_EDITOR_TABLE_PREFIX = "louise_";
  * reject a portal that would collide with it.
  */
 export const ASTROID_EDITOR_COOKIE_PREFIX = "better-auth";
-/** The editor's Better Auth table name for a given model (e.g. `louise_user`). */
+/** The editor's Better Auth table name for a given model (for example, `louise_user`). */
 export function astroidEditorTable(model) {
     return `${ASTROID_EDITOR_TABLE_PREFIX}${model}`;
 }

package/dist/commerce/adapters.d.ts

@@ -62,7 +62,7 @@ export interface FourthwallProductLike {
  * Is this item sold at `locationId` at all?
  *
  * Exported because a location-scoped sync needs to SKIP items the merchant
- * doesn't carry, and `squareToCatalogItem` can't do that for you — it returns
+ * doesn't carry, and `squareToCatalogItem` can't do that for you—it returns
  * one item, and "don't store this row" isn't a `CatalogItem`. Without the guard
  * an unstocked item mirrors as a $0 card with no variants, which looks like a
  * pricing bug rather than a catalog decision.
@@ -79,7 +79,7 @@ export declare function squareItemSoldAt(item: SquareItemLike, locationId: strin
  *
  * `price` is the LOWEST variation price. A Square item is a family ("Bag of
  * beans" with 12oz and 2lb variations), so a single headline number has to mean
- * "from" — taking the first variation's price instead would change with Square's
+ * "from"—taking the first variation's price instead would change with Square's
  * ordering and quietly misprice the card.
  *
  * ## Scoping to one merchant
@@ -90,22 +90,22 @@ export declare function squareItemSoldAt(item: SquareItemLike, locationId: strin
  *
  * The headline number has to be scoped for the same reason the variants are.
  * "From $8" computed over the whole catalog, on a page where the $8 size isn't
- * stocked, advertises a price this merchant will never honour — and because the
+ * stocked, advertises a price this merchant will never honour—and because the
  * dropped variation is usually the cheap one, the error runs in the direction a
  * customer notices at the till.
  *
  * Unscoped behaviour is unchanged: no `locationId` means base prices and every
  * variation, which is correct for a single-location account.
  *
- * An item sold nowhere at `locationId` yields no variants and a price of 0 —
- * filter with {@link squareItemSoldAt} before calling rather than storing that.
+ * An item sold nowhere at `locationId` yields no variants and a price of 0—filter
+ * with {@link squareItemSoldAt} before calling rather than storing that.
  */
 export declare function squareToCatalogItem(item: SquareItemLike, options?: SquareAdapterOptions): CatalogItem;
 /**
  * Fourthwall product → `CatalogItem`. Same "lowest variant wins" rule as Square,
  * for the same reason.
  *
- * Fourthwall already prices in major units, so there's no conversion — mirroring
+ * Fourthwall already prices in major units, so there's no conversion—mirroring
  * `lowestPrice` in `louise-toolkit/commerce/fourthwall`.
  */
 export declare function fourthwallToCatalogItem(product: FourthwallProductLike): CatalogItem;

package/dist/commerce/adapters.js

@@ -4,20 +4,20 @@
 //
 // This is the file the whole module exists for. themidwestartist.com's loader
 // says it outright: coracle runs the same helper over Square, "only the
-// content/repo reads differ — issue: repo drift." Two sites, one intent, two
+// content/repo reads differ—issue: repo drift." Two sites, one intent, two
 // hand-written translations that drifted apart. The translation is mechanical,
 // so it belongs here once.
 //
 // Each provider's client already returns a normalized-for-that-provider shape
 // (`SquareCatalogItem`, `FwProduct`); these functions take that last step to the
-// shape the mirror stores. Deliberately pure — they take the provider's objects,
+// shape the mirror stores. Deliberately pure—they take the provider's objects,
 // not credentials or an `env`, so they're trivially testable and the caller
 // keeps control of how the fetch happens (cached, paged, rate-limited).
 /**
  * Is this object sold at `locationId`?
  *
  * Mirrors `presentAt` in `louise-toolkit/commerce/square`, but tolerant of the
- * fields being absent. The two lists are NOT symmetric — `presentAtLocationIds`
+ * fields being absent. The two lists are NOT symmetric—`presentAtLocationIds`
  * is a whitelist consulted when `presentAtAllLocations` is false,
  * `absentAtLocationIds` a blacklist consulted when it is true. Reading them the
  * other way round shows a merchant products they do not carry.
@@ -40,7 +40,7 @@ const toMajor = (cents) => Math.round(cents) / 100;
  * Is this item sold at `locationId` at all?
  *
  * Exported because a location-scoped sync needs to SKIP items the merchant
- * doesn't carry, and `squareToCatalogItem` can't do that for you — it returns
+ * doesn't carry, and `squareToCatalogItem` can't do that for you—it returns
  * one item, and "don't store this row" isn't a `CatalogItem`. Without the guard
  * an unstocked item mirrors as a $0 card with no variants, which looks like a
  * pricing bug rather than a catalog decision.
@@ -61,7 +61,7 @@ export function squareItemSoldAt(item, locationId) {
  *
  * `price` is the LOWEST variation price. A Square item is a family ("Bag of
  * beans" with 12oz and 2lb variations), so a single headline number has to mean
- * "from" — taking the first variation's price instead would change with Square's
+ * "from"—taking the first variation's price instead would change with Square's
  * ordering and quietly misprice the card.
  *
  * ## Scoping to one merchant
@@ -72,15 +72,15 @@ export function squareItemSoldAt(item, locationId) {
  *
  * The headline number has to be scoped for the same reason the variants are.
  * "From $8" computed over the whole catalog, on a page where the $8 size isn't
- * stocked, advertises a price this merchant will never honour — and because the
+ * stocked, advertises a price this merchant will never honour—and because the
  * dropped variation is usually the cheap one, the error runs in the direction a
  * customer notices at the till.
  *
  * Unscoped behaviour is unchanged: no `locationId` means base prices and every
  * variation, which is correct for a single-location account.
  *
- * An item sold nowhere at `locationId` yields no variants and a price of 0 —
- * filter with {@link squareItemSoldAt} before calling rather than storing that.
+ * An item sold nowhere at `locationId` yields no variants and a price of 0—filter
+ * with {@link squareItemSoldAt} before calling rather than storing that.
  */
 export function squareToCatalogItem(item, options = {}) {
     const locationId = options.locationId;
@@ -117,7 +117,7 @@ export function squareToCatalogItem(item, options = {}) {
  * Fourthwall product → `CatalogItem`. Same "lowest variant wins" rule as Square,
  * for the same reason.
  *
- * Fourthwall already prices in major units, so there's no conversion — mirroring
+ * Fourthwall already prices in major units, so there's no conversion—mirroring
  * `lowestPrice` in `louise-toolkit/commerce/fourthwall`.
  */
 export function fourthwallToCatalogItem(product) {

package/dist/commerce/checkout-scaffold.d.ts

@@ -2,7 +2,7 @@ import type { AstroidConfig } from "../config.js";
 /** Does this project take card payments in-page? Square storefront only. */
 export declare function usesCardCheckout(config: AstroidConfig): boolean;
 /**
- * `src/pages/api/checkout.ts` — the server-authoritative payment route.
+ * `src/pages/api/checkout.ts`—the server-authoritative payment route.
  *
  * Scaffold-once: a real store adds shipping, tax, an order record, a receipt
  * email. What Astroid fixes is the sequence, because every step of it is a place
@@ -12,7 +12,7 @@ export declare function usesCardCheckout(config: AstroidConfig): boolean;
  */
 export declare function generateAstroidCheckoutRoute(config: AstroidConfig): string | null;
 /**
- * `src/components/SquareCard.astro` — the card input.
+ * `src/components/SquareCard.astro`—the card input.
  *
  * Square's Web Payments SDK renders the field in an iframe from their CDN and
  * hands back a single-use token, so the raw card number never touches the Worker
@@ -29,13 +29,13 @@ export declare function generateAstroidSquareCard(config: AstroidConfig): string
  * application id is shipped to the browser by design, and the environment is a
  * choice, not a credential. Putting them in `credentials` would also fold them
  * into the dormancy gate, which is about whether the module can safely CALL
- * Square — a different question from whether the card field can render.
+ * Square—a different question from whether the card field can render.
  *
  * The two vars are gated SEPARATELY, and that split is load-bearing.
  * `SQUARE_ENVIRONMENT` selects the API HOST for every Square call, so it belongs
  * to any project that talks to Square at all; `SQUARE_APP_ID` only mounts the
- * browser card field. Gating both on card checkout — as this did until
- * `invoicing: "square"` became expressible — left a site that runs Square for
+ * browser card field. Gating both on card checkout—as this did until
+ * `invoicing: "square"` became expressible—left a site that runs Square for
  * invoicing alone with no `SQUARE_ENVIRONMENT`, and `SquareConfig.environment`
  * defaults to "sandbox". Every production invoice would have been created
  * against the sandbox: no error, no warning, just money that never arrives.

package/dist/commerce/checkout-scaffold.js

@@ -1,6 +1,6 @@
 // Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
 //
-// The checkout SEAM — the piece that made `archetype: "storefront"` a storefront
+// The checkout SEAM—the piece that made `archetype: "storefront"` a storefront
 // that couldn't take a card.
 //
 // Everything around this already existed: `verifyCheckout` re-prices server-side,
@@ -10,7 +10,7 @@
 // missing was the route in the middle, so none of it was reachable.
 //
 // SCOPE, deliberately narrow. This generates the server-authoritative PAYMENT
-// path and a card input — not a cart, not a checkout page, not shipping or tax.
+// path and a card input—not a cart, not a checkout page, not shipping or tax.
 // Where a cart lives (localStorage, D1, a portal session), what it holds, and how
 // it renders are project decisions Astroid has no business making, and a
 // half-opinionated cart is worse than none. What is NOT a project decision is the
@@ -26,7 +26,7 @@ export function usesCardCheckout(config) {
     return astroidCommerceRoles(config.commerce).storefront === "square";
 }
 /**
- * `src/pages/api/checkout.ts` — the server-authoritative payment route.
+ * `src/pages/api/checkout.ts`—the server-authoritative payment route.
  *
  * Scaffold-once: a real store adds shipping, tax, an order record, a receipt
  * email. What Astroid fixes is the sequence, because every step of it is a place
@@ -42,12 +42,12 @@ export function generateAstroidCheckoutRoute(config) {
     return [
         "// Server-authoritative checkout (POST /api/checkout).",
         "//",
-        "// Scaffolded once and yours to extend — shipping, tax, an order row, a",
+        "// Scaffolded once and yours to extend—shipping, tax, an order row, a",
         "// receipt email all belong here. What should NOT change is the ORDER of the",
         "// steps below; each one is load-bearing:",
         "//",
         multi
-            ? "//   0. Resolve WHICH MERCHANT this sale belongs to, from the host — never\n" +
+            ? "//   0. Resolve WHICH MERCHANT this sale belongs to, from the host—never\n" +
                 "//      from the request body. See `resolveLocationId` below."
             : null,
         multi
@@ -65,7 +65,7 @@ export function generateAstroidCheckoutRoute(config) {
         "//      a double-clicked Pay button charges once while two customers buying",
         "//      the same thing stay two charges.",
         "//   4. Charge only when commerce is actually provisioned. With placeholder",
-        "//      secrets this simulates instead — it must never call Square with a",
+        "//      secrets this simulates instead—it must never call Square with a",
         "//      dummy credential.",
         multi
             ? "//\n" +
@@ -95,13 +95,13 @@ export function generateAstroidCheckoutRoute(config) {
                 "// ── Which merchant is this? ────────────────────────────────────────────────",
                 "//",
                 '// `square.locations: "multi"` means the location is a property of the',
-                "// REQUEST, not of the environment — which is why Astroid does not require a",
+                "// REQUEST, not of the environment—which is why Astroid does not require a",
                 "// SQUARE_LOCATION_ID for this project. Fill this in and keep two rules:",
                 "//",
                 "//   * Derive it from the HOST (or an authenticated session), never from the",
                 "//     request body. A body-supplied location lets a customer name the",
                 "//     cheapest merchant's id and pay that price at the dearest merchant's",
-                "//     shop — the same exploit as a client-supplied price, one level back.",
+                "//     shop—the same exploit as a client-supplied price, one level back.",
                 "//   * Return null for anything unrecognised. Falling back to a default",
                 "//     rings one merchant's sale against another merchant's books, and looks",
                 "//     completely successful while doing it.",
@@ -125,7 +125,7 @@ export function generateAstroidCheckoutRoute(config) {
                 "  // mirror holds ONE price per item, so it structurally cannot answer",
                 '  // "what does this cost at this location". `retrieveVariationPricesAt`',
                 "  // resolves `location_overrides`, and omits any variation the merchant",
-                "  // does not carry — so an unstocked id fails closed as `unavailable`",
+                "  // does not carry—so an unstocked id fails closed as `unavailable`",
                 "  // instead of silently selling at the base price.",
                 "  const locationId = scope?.locationId;",
                 "  if (!locationId) return new Map();",
@@ -150,7 +150,7 @@ export function generateAstroidCheckoutRoute(config) {
                 "  const prices = new Map<string, number>();",
                 "  for (const item of items) {",
                 "    // The mirror stores MAJOR units (dollars); the charge is in minor units.",
-                "    // `Math.round` is not decoration — 19.99 * 100 is 1998.9999999999998, and",
+                "    // `Math.round` is not decoration—19.99 * 100 is 1998.9999999999998, and",
                 "    // a float cent here fails the exact-equality staleness check on every",
                 "    // single checkout.",
                 "    if (variantIds.includes(item.externalId)) {",
@@ -174,7 +174,7 @@ export function generateAstroidCheckoutRoute(config) {
         "  // or probe prices, even though the card token itself is single-use. Requires",
         "  // an Origin/Referer matching the host; a non-browser caller (a stripped",
         "  // header) is refused. If you deliberately serve checkout from another origin,",
-        "  // this is the line to relax — it's yours.",
+        "  // this is the line to relax—it's yours.",
         '  if (!isSameOrigin(request)) return json({ error: "Forbidden" }, 403);',
         "",
         "  const body = (await request.json().catch(() => null)) as {",
@@ -203,7 +203,7 @@ export function generateAstroidCheckoutRoute(config) {
                 '    return json({ error: "This storefront is not open for orders." }, 409);',
                 "  }",
                 "",
-                "  // 4, EARLY — and the ordering is the point. Re-pricing per location is",
+                "  // 4, EARLY—and the ordering is the point. Re-pricing per location is",
                 "  // itself a live Square call, so the dormancy gate has to precede",
                 "  // verification here rather than follow it; running it after would call",
                 "  // Square with a placeholder token, which this route must never do.",
@@ -231,7 +231,7 @@ export function generateAstroidCheckoutRoute(config) {
                 "  const check = await verifyCheckout(body.lines, serverPrices, {",
                 "    scope: { locationId },",
                 "  });",
-                "  // Every stale line, with its live price — feed `issues` to `repairCart`",
+                "  // Every stale line, with its live price—feed `issues` to `repairCart`",
                 "  // (louise-toolkit/commerce) to fix the whole cart in one step.",
                 "  if (!check.ok) {",
                 "    return json({ error: check.message, reason: check.reason, issues: check.issues }, 409);",
@@ -243,7 +243,7 @@ export function generateAstroidCheckoutRoute(config) {
             : [
                 "  // 1 + 2: re-price and refuse on mismatch.",
                 "  const check = await verifyCheckout(body.lines, serverPrices);",
-                "  // Every stale line, with its live price — feed `issues` to `repairCart`",
+                "  // Every stale line, with its live price—feed `issues` to `repairCart`",
                 "  // (louise-toolkit/commerce) to fix the whole cart in one step.",
                 "  if (!check.ok) {",
                 "    return json({ error: check.message, reason: check.reason, issues: check.issues }, 409);",
@@ -253,7 +253,7 @@ export function generateAstroidCheckoutRoute(config) {
                 '  const idempotencyKey = await checkoutIdempotencyKey(check, "order", cartId);',
                 "",
                 "  // 4: dormant until provisioned. An unconfigured store still re-prices and",
-                "  // still refuses a stale cart — it just doesn't move money.",
+                "  // still refuses a stale cart—it just doesn't move money.",
                 "  // Cast as the toolkit's own `astroidModuleStatus` does: `readSecret`",
                 "  // accepts a plain string OR a Secrets Store binding, which CloudflareEnv",
                 "  // types more narrowly than the resolver's `SecretSource` map.",
@@ -278,7 +278,7 @@ export function generateAstroidCheckoutRoute(config) {
         "",
         "  // Both are guaranteed real by the dormancy gate above; the narrowing here",
         "  // is for the type system, which can't know that. `environment` is a UNION",
-        '  // ("sandbox" | "production"), not a free string — an unrecognised value',
+        '  // ("sandbox" | "production"), not a free string—an unrecognised value',
         "  // would otherwise silently select the sandbox host in production.",
         '  const environment = env.SQUARE_ENVIRONMENT === "production" ? "production" : "sandbox";',
         "  const payment = await createPayment(",
@@ -291,7 +291,7 @@ export function generateAstroidCheckoutRoute(config) {
         "      // The SERVER's number, never the client's.",
         '      amountMoney: { amount: check.subtotalCents, currency: "USD" },',
         multi
-            ? "      // The location the cart was PRICED against — necessarily the same one,\n" +
+            ? "      // The location the cart was PRICED against—necessarily the same one,\n" +
                 "      // or the sale rings against a merchant who never quoted this total."
             : null,
         multi ? "      locationId," : '      locationId: env.SQUARE_LOCATION_ID ?? "",',
@@ -319,7 +319,7 @@ export function generateAstroidCheckoutRoute(config) {
         .join("\n");
 }
 /**
- * `src/components/SquareCard.astro` — the card input.
+ * `src/components/SquareCard.astro`—the card input.
  *
  * Square's Web Payments SDK renders the field in an iframe from their CDN and
  * hands back a single-use token, so the raw card number never touches the Worker
@@ -336,7 +336,7 @@ export function generateAstroidSquareCard(config) {
         "---",
         "// Square Web Payments card input.",
         "//",
-        "// The card field is an IFRAME served by Square's CDN — the raw number never",
+        "// The card field is an IFRAME served by Square's CDN—the raw number never",
         "// enters this page's DOM and never reaches the Worker, which is what keeps the",
         "// site out of PCI scope. `tokenize()` returns a single-use token; POST it to",
         "// /api/checkout, which re-prices server-side before charging.",
@@ -348,7 +348,7 @@ export function generateAstroidSquareCard(config) {
         ...(multi
             ? [
                 "// Multi-location: the merchant is a property of the PAGE, so the id comes",
-                "// in as a prop. Only the card iframe is bound to it — the charge takes its",
+                "// in as a prop. Only the card iframe is bound to it—the charge takes its",
                 "// location from the server, which resolves it independently in",
                 "// /api/checkout. This one cannot pick the merchant, and shouldn't: it is",
                 "// rendered from markup a customer can reach.",
@@ -359,7 +359,7 @@ export function generateAstroidSquareCard(config) {
                 "",
             ]
             : []),
-        "// The PUBLIC application id — safe in the browser, unlike the access token.",
+        "// The PUBLIC application id—safe in the browser, unlike the access token.",
         "// Absent (an unprovisioned store) → render nothing rather than a dead form.",
         "const appId = env.SQUARE_APP_ID;",
         multi ? null : "const locationId = env.SQUARE_LOCATION_ID;",
@@ -417,7 +417,7 @@ export function generateAstroidSquareCard(config) {
         .filter((line) => line !== null)
         .join("\n");
 }
-/** Does this project talk to Square in ANY role — storefront, invoicing, or
+/** Does this project talk to Square in ANY role—storefront, invoicing, or
  *  otherwise? Distinct from {@link usesCardCheckout}, which asks the narrower
  *  question of whether the in-page card field renders. */
 function usesSquare(config) {
@@ -430,13 +430,13 @@ function usesSquare(config) {
  * application id is shipped to the browser by design, and the environment is a
  * choice, not a credential. Putting them in `credentials` would also fold them
  * into the dormancy gate, which is about whether the module can safely CALL
- * Square — a different question from whether the card field can render.
+ * Square—a different question from whether the card field can render.
  *
  * The two vars are gated SEPARATELY, and that split is load-bearing.
  * `SQUARE_ENVIRONMENT` selects the API HOST for every Square call, so it belongs
  * to any project that talks to Square at all; `SQUARE_APP_ID` only mounts the
- * browser card field. Gating both on card checkout — as this did until
- * `invoicing: "square"` became expressible — left a site that runs Square for
+ * browser card field. Gating both on card checkout—as this did until
+ * `invoicing: "square"` became expressible—left a site that runs Square for
  * invoicing alone with no `SQUARE_ENVIRONMENT`, and `SquareConfig.environment`
  * defaults to "sandbox". Every production invoice would have been created
  * against the sandbox: no error, no warning, just money that never arrives.
@@ -459,11 +459,11 @@ export function astroidCheckoutVars(config) {
  * substitutes into `src/env.d.ts`. Empty without card checkout.
  */
 export function generateAstroidCheckoutEnv(config) {
-    // Mirrors the gating in `astroidCheckoutVars` — the app id is card-checkout
+    // Mirrors the gating in `astroidCheckoutVars`—the app id is card-checkout
     // only, the environment belongs to any project that calls Square at all.
     const lines = [];
     if (usesCardCheckout(config)) {
-        lines.push("  /** Square's PUBLIC application id — shipped to the browser to mount the", "   *  Web Payments card field. Not a secret; see wrangler.jsonc `vars`. */", "  SQUARE_APP_ID: string;");
+        lines.push("  /** Square's PUBLIC application id—shipped to the browser to mount the", "   *  Web Payments card field. Not a secret; see wrangler.jsonc `vars`. */", "  SQUARE_APP_ID: string;");
     }
     if (usesSquare(config)) {
         lines.push('  /** Square API environment: "sandbox" or "production". Selects the API', "   *  host for EVERY Square call, so it is required for invoicing too. */", "  SQUARE_ENVIRONMENT: string;");

package/dist/commerce/checkout.d.ts

@@ -28,13 +28,13 @@ export interface VerifiedLine {
  * worth a notify-me. Collapsing them tells someone to remove an item the shop
  * will restock on Tuesday.
  *
- * A lookup can only produce `"out-of-stock"` by saying so — see
- * {@link ScopedPriceLookup} — because a bare `Map` has no way to distinguish
+ * A lookup can only produce `"out-of-stock"` by saying so—see
+ * {@link ScopedPriceLookup}—because a bare `Map` has no way to distinguish
  * them and guessing would put the wrong sentence on the screen.
  */
 export type CheckoutRefusal = "empty" | "unavailable" | "out-of-stock" | "price-changed" | "invalid";
 /**
- * One way the cart disagrees with the live catalog — the toolkit's
+ * One way the cart disagrees with the live catalog—the toolkit's
  * `CartIssue`, less the add-on case (checkout lines carry no add-ons yet).
  * Hand the list to `repairCart` from `louise-toolkit/commerce` to fix the cart
  * in one step.
@@ -52,7 +52,7 @@ export type CheckoutVerification = {
     reason: CheckoutRefusal;
     message: string;
     /**
-     * Every problem, in cart order, with what the catalog says now — empty
+     * Every problem, in cart order, with what the catalog says now—empty
      * for `"empty"` and `"invalid"`, which are about the request, not the
      * catalog.
      */
@@ -62,7 +62,7 @@ export type CheckoutVerification = {
  *  map omits is treated as no longer purchasable. */
 export type PriceLookup = (variantIds: string[]) => Promise<Map<string, number>>;
 /** Where the sale is happening. Optional, and providers without a location
- *  dimension ignore it — a single-merchant Square account or Fourthwall store
+ *  dimension ignore it—a single-merchant Square account or Fourthwall store
  *  passes nothing and behaves exactly as before. */
 export interface CheckoutScope {
     /** Provider location id (Square) or equivalent merchant key. */
@@ -86,13 +86,13 @@ export interface ScopedPrices {
  * A price lookup that knows WHERE the sale is happening.
  *
  * This is the multi-merchant checkout guard. One shared catalog sold through
- * several merchants carries a different price per location — each shop's
- * commission is absorbed in its own override — so re-pricing a cart against
+ * several merchants carries a different price per location—each shop's
+ * commission is absorbed in its own override—so re-pricing a cart against
  * base prices lets a customer pay the cheapest merchant's price at the dearest
  * merchant's storefront. That is not a rounding error; it is the same class of
  * bug as trusting the client's `unitPriceCents`, just one level further back.
  *
- * `scope` is optional so a {@link PriceLookup} is still assignable here — an
+ * `scope` is optional so a {@link PriceLookup} is still assignable here—an
  * existing single-location lookup simply ignores the extra argument, which is
  * exactly what a function of lower arity does in JavaScript.
  *
@@ -131,7 +131,7 @@ export declare function verifyCheckout(lines: unknown, lookup: ScopedPriceLookup
 /**
  * A deterministic idempotency key for one buyer's checkout attempt.
  *
- * Providers dedupe on this, so the same key must mean the same charge — which
+ * Providers dedupe on this, so the same key must mean the same charge—which
  * cuts both ways, and the second direction is the one that costs money. It is
  * derived from the verified cart *and* `identity`, not from a random value or a
  * timestamp: a customer double-clicking Pay sends the same key twice and is
@@ -141,18 +141,18 @@ export declare function verifyCheckout(lines: unknown, lookup: ScopedPriceLookup
  * **`identity` is required, and it is what makes the key safe.** Without it the
  * key was a pure function of the cart contents, so two DIFFERENT customers
  * buying the same thing for the same price produced byte-identical keys. Stripe
- * and Square scope idempotency keys per account and retain them for ~24h, so the
+ * and Square scope idempotency keys per account and retain them for about 24 hours, so the
  * provider replayed the first customer's PaymentIntent instead of creating the
  * second's: the second buyer was never charged, no second order existed, and the
  * site reported success. On a single-SKU storefront that is ordinary traffic,
  * not an edge case.
  *
  * Pass something stable across a retry of THIS attempt and distinct between
- * buyers — a cart id, a checkout-session id, or a portal user id. Do not pass a
+ * buyers—a cart id, a checkout-session id, or a portal user id. Do not pass a
  * value that varies per request (a fresh uuid defeats the dedupe and a
  * double-click charges twice), and do not pass a constant.
  *
- * `scope` remains the OPERATION — `"order"` vs `"refund"` — so the two can never
+ * `scope` remains the OPERATION—`"order"` vs `"refund"`—so the two can never
  * collide for one buyer. It is not an identity and never was.
  */
 export declare function checkoutIdempotencyKey(verified: {

package/dist/commerce/checkout.js

@@ -3,7 +3,7 @@
 // Server-authoritative checkout.
 //
 // A cart arrives from the browser, so every number in it is a claim, not a fact.
-// The rule this encodes — taken from coracle.coffee's working checkout — is that
+// The rule this encodes—taken from coracle.coffee's working checkout—is that
 // the client's price is a **staleness check**, never an input to the charge:
 // look the price up server-side, and if it disagrees with what the customer was
 // shown, refuse rather than silently charging a different amount. Refusing is
@@ -16,7 +16,7 @@
 // The comparison itself is the toolkit's `cartIssues`, which reports EVERY
 // stale line rather than the first: a refusal that names one problem at a time
 // is how a customer ends up fixing a line, retrying, and being refused over the
-// next. What this adds is the opinion — policing the untrusted body, and the
+// next. What this adds is the opinion—policing the untrusted body, and the
 // sentence a customer sees.
 import { cartIssues } from "louise-toolkit/commerce";
 import { AstroidUsageError } from "../errors.js";
@@ -91,7 +91,7 @@ lookup, options = {}) {
     }
     const { prices, outOfStock } = normalizeLookup(await lookup([...new Set(parsed.map((l) => l.variantId))], options.scope));
     // No `liveModifierIds`, so the add-on check is skipped and every issue is a
-    // variant one — which is what makes the narrowing to CheckoutIssue true.
+    // variant one—which is what makes the narrowing to CheckoutIssue true.
     const issues = cartIssues(parsed, { prices, outOfStock });
     const [first] = issues;
     if (first)
@@ -109,7 +109,7 @@ lookup, options = {}) {
 /**
  * A deterministic idempotency key for one buyer's checkout attempt.
  *
- * Providers dedupe on this, so the same key must mean the same charge — which
+ * Providers dedupe on this, so the same key must mean the same charge—which
  * cuts both ways, and the second direction is the one that costs money. It is
  * derived from the verified cart *and* `identity`, not from a random value or a
  * timestamp: a customer double-clicking Pay sends the same key twice and is
@@ -119,18 +119,18 @@ lookup, options = {}) {
  * **`identity` is required, and it is what makes the key safe.** Without it the
  * key was a pure function of the cart contents, so two DIFFERENT customers
  * buying the same thing for the same price produced byte-identical keys. Stripe
- * and Square scope idempotency keys per account and retain them for ~24h, so the
+ * and Square scope idempotency keys per account and retain them for about 24 hours, so the
  * provider replayed the first customer's PaymentIntent instead of creating the
  * second's: the second buyer was never charged, no second order existed, and the
  * site reported success. On a single-SKU storefront that is ordinary traffic,
  * not an edge case.
  *
  * Pass something stable across a retry of THIS attempt and distinct between
- * buyers — a cart id, a checkout-session id, or a portal user id. Do not pass a
+ * buyers—a cart id, a checkout-session id, or a portal user id. Do not pass a
  * value that varies per request (a fresh uuid defeats the dedupe and a
  * double-click charges twice), and do not pass a constant.
  *
- * `scope` remains the OPERATION — `"order"` vs `"refund"` — so the two can never
+ * `scope` remains the OPERATION—`"order"` vs `"refund"`—so the two can never
  * collide for one buyer. It is not an identity and never was.
  */
 export async function checkoutIdempotencyKey(verified, scope, identity) {