@nifrajs/cli 1.6.0 → 1.11.0

package/docs/types.json

@@ -38,7 +38,84 @@
     "kind": "type",
     "package": "@nifrajs/core",
     "signature": "export type AddRoute<R extends Registry, Method extends string, Path extends string, Info extends RouteInfo> = R & {\n    [P in Path]: {\n        [M in Method]: Info;\n    };\n};",
-    "doc": "/** Merge a new route into the registry, combining methods that share a path. */"
+    "doc": "/**\n * Merge a new route into the registry, combining methods that share a path.\n *\n * SCALING CEILING (measured — see many-routes.test-d.ts and the isolation study below): a single\n * fluent chain hits TS2589 at ~95-100 routes. This intersection is NOT the cause — in isolation it\n * accumulates 1000+ routes cleanly, and heavy per-route `Params<Path>`/schema inference alone\n * reaches 600+. The wall is an INTERACTION unique to the fluent builder: each `.get(path, handler)`\n * both (a) computes the handler's context type from the path (`c.params.id` inferred from `:id`)\n * AND (b) returns `Server<AddRoute<growing-R, …>, Ctx>`. Neither alone strains the compiler; the\n * PRODUCT — recomputing the handler context while re-threading the ever-larger registry at each of\n * N steps — exhausts TypeScript's per-expression instantiation budget around N≈95. It is therefore\n * O(N) and inherent to any builder that infers handler context AND accumulates a typed route\n * registry (Elysia/tRPC/hono's typed clients cap the same way); it is not fixable by reshaping\n * AddRoute. Past ~90 routes, use a path that DOESN'T form the product: split into domain groups and\n * `.merge()` them (each group is a short chain; a merge is one `R & R2` intersection with no\n * per-call context work), or contract-first `implement()` (the registry is one object type declared\n * upfront — no grow-R-per-call, so no ceiling at all).\n */"
+  },
+  {
+    "name": "AdmissionController",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface AdmissionController {\n    admit(req: Request): AdmissionDecision | Promise<AdmissionDecision>;\n}",
+    "doc": "/**\n * A capacity-admission gate. Decides, per request, whether the instance has capacity to run it now —\n * bounding *concurrency*, which rate limits (frequency) and deadlines (duration) do not. Provide an\n * implementation (see `@nifrajs/middleware`'s `createAdmissionController`) as {@link ServerOptions.admission}.\n *\n * Enabling it trades the fused native-route lane for native matching + this gate (the gate cannot be a\n * per-request `onRequest` hook without disabling native routes entirely); when unset, the request path\n * is untouched.\n */"
+  },
+  {
+    "name": "AdmissionControllerHandle",
+    "kind": "interface",
+    "package": "@nifrajs/middleware",
+    "signature": "export interface AdmissionControllerHandle extends AdmissionController {\n    /** Point-in-time counters for observability (otel gauges/counters). */\n    snapshot(): AdmissionSnapshot;\n}"
+  },
+  {
+    "name": "AdmissionDecision",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type AdmissionDecision = {\n    readonly admitted: true;\n    release(): void;\n} | {\n    readonly admitted: false;\n    readonly response: Response;\n};",
+    "doc": "/**\n * The outcome of a capacity-admission decision. `admitted` requests carry a `release` the server calls\n * exactly once when the response is finalized; a shed request carries a ready `429` Response.\n */"
+  },
+  {
+    "name": "AdmissionEvidence",
+    "kind": "interface",
+    "package": "@nifrajs/middleware",
+    "signature": "export interface AdmissionEvidence {\n    readonly inFlight: number;\n    readonly maxInFlight: number;\n    readonly lagMs: number;\n    readonly maxLagMs: number;\n    readonly queued: number;\n}",
+    "doc": "/** Pure capacity evidence handed to the policy hook. The mechanics never invent tenant concepts. */"
+  },
+  {
+    "name": "AdmissionOptions",
+    "kind": "interface",
+    "package": "@nifrajs/middleware",
+    "signature": "export interface AdmissionOptions {\n    /** Max requests running concurrently before the gate queues or sheds. */\n    readonly maxInFlight: number;\n    /** Event-loop lag ceiling (ms); above it, shed even when slots are free (protects p99). Default ∞. */\n    readonly maxLagMs?: number;\n    /** How many requests may briefly wait for a slot before shedding. `0` (default) never queues. */\n    readonly maxQueue?: number;\n    /** How long a queued request waits for a slot before shedding. Default 50ms. */\n    readonly queueTimeoutMs?: number;\n    /** Reserved slots ABOVE `maxInFlight` that only a policy `admit` may draw from. Default 0. */\n    readonly reservedForPolicy?: number;\n    /** Base `Retry-After`, in seconds, for shed responses. Default 1. */\n    readonly baseRetryAfterSec?: number;\n    /**\n     * Live event-loop lag source, in ms. Pass {@link createEventLoopLagSampler} to sample the real loop;\n     * default `() => 0` disables lag-based shedding (in-flight only).\n     */\n    readonly lagMs?: () => number;\n    readonly policy?: AdmissionPolicy;\n    /** Test seam for deterministic queue timeouts; defaults to real timers. */\n    readonly setTimer?: (fn: () => void, ms: number) => {\n        cancel(): void;\n    };\n}"
+  },
+  {
+    "name": "AdmissionPolicy",
+    "kind": "type",
+    "package": "@nifrajs/middleware",
+    "signature": "export type AdmissionPolicy = (req: Request, evidence: AdmissionEvidence) => {\n    decision: \"admit\" | \"shed\";\n    retryAfterSec?: number;\n} | undefined;",
+    "doc": "/**\n * Application-supplied admission policy. Return a decision to override the default mechanics\n * for this request, or `undefined` to defer to them. `admit` may draw from reserved headroom above\n * `maxInFlight`; `shed` forces rejection.\n */"
+  },
+  {
+    "name": "AdmissionSnapshot",
+    "kind": "interface",
+    "package": "@nifrajs/middleware",
+    "signature": "export interface AdmissionSnapshot {\n    readonly inFlight: number;\n    readonly queued: number;\n    readonly fastPathAdmits: number;\n    readonly slowPathEntries: number;\n    readonly everQueued: number;\n    readonly shed: number;\n}"
+  },
+  {
+    "name": "admitDeadline",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function admitDeadline(headers: Headers, options?: DeadlineAdmissionOptions): DeadlineAdmission;",
+    "doc": "/**\n * Validate and clamp an inbound absolute deadline. This is pure admission mechanics: callers supply\n * local policy, then own the timer that drives their existing cancellation signal.\n */"
+  },
+  {
+    "name": "AdversarialContractError",
+    "kind": "class",
+    "package": "@nifrajs/testing",
+    "signature": "export declare class AdversarialContractError extends Error {\n    readonly report: AdversarialContractReport;\n    constructor(report: AdversarialContractReport);\n}"
+  },
+  {
+    "name": "AdversarialContractOptions",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface AdversarialContractOptions {\n    /** Base origin for generated requests. Default `http://nifra.contract`. */\n    readonly origin?: string;\n    /** Replayable seed used for deterministic witness generation. */\n    readonly seed?: number;\n    /** Known-good request values keyed by `\"METHOD /path\"`. Required for opaque Standard Schemas. */\n    readonly witnesses?: Readonly<Record<string, ContractWitness>>;\n    /** Select a subset of reflected routes. */\n    readonly include?: (route: ReflectedRoute) => boolean;\n    /** Execute every case against these targets. Default: the supplied app, named `in-process`. */\n    readonly runtimes?: readonly ContractRuntime[];\n    /** Maximum validator-proven mutations per body/query schema. Default 32. */\n    readonly maxMutationsPerInput?: number;\n    /** Maximum serialized witness size. Default 256 KiB. */\n    readonly maxWitnessBytes?: number;\n    /** Statuses that prove an invalid input was rejected. Default `[422]`. */\n    readonly expectedValidationStatuses?: readonly number[];\n    /**\n     * Attach auth, tenant, or runtime-specific state. Return a new Request; the input Request is already\n     * fresh for this case and runtime.\n     */\n    readonly prepareRequest?: (request: Request, context: ContractCaseContext) => Request | Promise<Request>;\n    /** Override rejection semantics (for apps with a custom validation response). */\n    readonly isRejected?: (response: Response, context: ContractCaseContext) => boolean | Promise<boolean>;\n    /** Validate a real successful response for every declared response schema. Default true. */\n    readonly validateResponses?: boolean;\n    /** Fail the report when a contracted target cannot be exercised. Default true. */\n    readonly requireCoverage?: boolean;\n    /** Greedily minimize an invalid input that unexpectedly reaches the app. Default true. */\n    readonly shrinkFailures?: boolean;\n    /** Cap shrink probes for one failure. Default 12. */\n    readonly maxShrinkAttempts?: number;\n    /** Replay only these stable case IDs. Coverage gaps are advisory when this is set. */\n    readonly only?: string | readonly string[];\n}"
+  },
+  {
+    "name": "AdversarialContractReport",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface AdversarialContractReport {\n    readonly ok: boolean;\n    readonly seed: number;\n    readonly routeCount: number;\n    readonly targetCount: number;\n    readonly runtimeCount: number;\n    readonly results: readonly AdversarialContractResult[];\n    readonly failures: readonly AdversarialContractResult[];\n    readonly gaps: readonly ContractCoverageGap[];\n    readonly counts: {\n        readonly passed: number;\n        readonly failed: number;\n        readonly gaps: number;\n    };\n}"
+  },
+  {
+    "name": "AdversarialContractResult",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface AdversarialContractResult {\n    readonly id: string;\n    readonly route: string;\n    readonly runtime: string;\n    readonly kind: ContractCaseKind;\n    readonly target: ContractTarget;\n    readonly mutation?: string;\n    readonly ok: boolean;\n    readonly status?: number;\n    readonly message: string;\n    /** Number of successful greedy reductions applied to a failing hostile input. */\n    readonly shrinkSteps?: number;\n    readonly replay: ContractReplay;\n}"
   },
   {
     "name": "AgentFileSpec",
@@ -202,6 +279,13 @@
     "signature": "export declare function applyHead(head: Meta): void;",
     "doc": "/**\n * Sync the document head to a route's resolved {@link Meta} on client navigation. Sets the title\n * (when provided) and replaces the **managed** (`data-nifra`) `<meta>`/`<link>` tags — static head\n * content (charset, hand-written tags) is never touched. SSR injects the same `data-nifra` tags, so\n * the first navigation cleanly takes over from the server-rendered head.\n */"
   },
+  {
+    "name": "applyImportMoves",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function applyImportMoves(text: string, moves: readonly {\n    from: string;\n    to: string;\n}[]): {\n    text: string;\n    changes: Array<{\n        from: string;\n        to: string;\n        count: number;\n    }>;\n};",
+    "doc": "/** Rewrite exact import/export/require/dynamic-import specifiers in one source file's text. */"
+  },
   {
     "name": "applyResponseHeaders",
     "kind": "function",
@@ -209,6 +293,13 @@
     "signature": "export declare function applyResponseHeaders(headers: Headers, res: NodeHeaderSink): void;",
     "doc": "/**\n * Copy a Web `Response`'s headers onto a Node response, emitting EACH `Set-Cookie` as its own header. The\n * `Headers` iterator (and `.get`) join multiple set-cookie values with \", \", which corrupts cookies — e.g.\n * better-auth's `session_token` + `session_data` collapse into one unparseable cookie and the session is\n * silently lost. `getSetCookie()` returns them split; Node's `setHeader` emits one header per array element.\n */"
   },
+  {
+    "name": "assertAdversarialContract",
+    "kind": "function",
+    "package": "@nifrajs/testing",
+    "signature": "export declare function assertAdversarialContract(app: ContractTestApp, options?: AdversarialContractOptions): Promise<AdversarialContractReport>;",
+    "doc": "/** Run the contract laboratory and throw an {@link AdversarialContractError} unless it is fully green. */"
+  },
   {
     "name": "assertAuthableDb",
     "kind": "function",
@@ -216,6 +307,20 @@
     "signature": "export declare function assertAuthableDb(db: DbChoice): void;",
     "doc": "/**\n * Guard `--auth` against a DB whose ORM has no clean better-auth adapter. Throws an actionable error\n * for Kysely (passing a raw dialect to better-auth is manual wiring we won't fake-scaffold). Called by\n * the CLI before scaffolding so the failure is early and explains the fix.\n */"
   },
+  {
+    "name": "assertBudgetRemaining",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function assertBudgetRemaining(budget: RequestBudget, requiredMs?: number): void;",
+    "doc": "/** Fail before starting work that cannot fit inside the remaining time. */"
+  },
+  {
+    "name": "assertIncidentReplays",
+    "kind": "function",
+    "package": "@nifrajs/testing",
+    "signature": "export declare function assertIncidentReplays(app: AppLike, capsule: IncidentCapsule, options?: ReplayIncidentOptions): Promise<void>;",
+    "doc": "/** Assert a captured incident still reproduces against the current app. Throws {@link IncidentReplayError}. */"
+  },
   {
     "name": "assertRenderAdapterConformance",
     "kind": "function",
@@ -237,6 +342,100 @@
     "signature": "export declare function assertStorageAdapterConformance(options: StorageAdapterConformanceOptions): Promise<void>;",
     "doc": "/**\n * Execute the observable {@link StorageAdapter} contract without depending on a test runner.\n *\n * The adapter must be isolated because this writes deterministic conformance keys. The promise resolves\n * only after proving byte + metadata round-trips, overwrite, missing/delete semantics, prefix/limit listing,\n * and uniform unsafe-key rejection across every key-taking method. When the adapter also implements an\n * optional capability ({@link PagedStorageAdapter}, {@link PresignableStorageAdapter},\n * {@link MovableStorageAdapter}), that capability's contract is proven too — implementing a capability\n * partially or unsafely fails conformance rather than silently escaping it.\n */"
   },
+  {
+    "name": "AssuranceConfig",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface AssuranceConfig {\n    readonly source: unknown;\n    readonly policy: AssurancePolicy;\n    readonly capabilities?: CapabilityPolicy;\n    /** Off-request-path manifest artifact/signing integration. Private keys remain behind `signer`. */\n    readonly manifest?: {\n        /** Default `nifra.manifest.json`. */\n        readonly path?: string;\n        /** Resolve an operator key reference to a signer (KMS/HSM/local WebCrypto). */\n        readonly signer?: (keyRef: string) => NifraManifestSigner | Promise<NifraManifestSigner>;\n    };\n    /** Dynamic invariant execution is opt-in and must use a disposable/sandboxed target. */\n    readonly invariants?: {\n        readonly executor: InvariantExecutor;\n    };\n}"
+  },
+  {
+    "name": "AssuranceDeclaration",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface AssuranceDeclaration extends AssuranceEvidence {\n    readonly scope: AssuranceScope;\n    /** Restrict evidence to these HTTP methods. Omit for every method. */\n    readonly methods?: readonly Method[];\n    /** Restrict evidence to these absolute route globs. Omit for every path. */\n    readonly paths?: readonly string[];\n}",
+    "doc": "/** Metadata installed on a middleware/plugin by {@link withRouteAssurance}. */"
+  },
+  {
+    "name": "assuranceDeclarationsOf",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function assuranceDeclarationsOf(value: object): readonly AssuranceDeclaration[];"
+  },
+  {
+    "name": "AssuranceEvidence",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface AssuranceEvidence {\n    readonly id: string;\n    readonly source: string;\n}",
+    "doc": "/** Reflection-safe proof that a named enforcement module covered a route. */"
+  },
+  {
+    "name": "assuranceEvidenceFor",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function assuranceEvidenceFor(declarationsToApply: readonly AssuranceDeclaration[], method: string, path: string): readonly AssuranceEvidence[];"
+  },
+  {
+    "name": "AssuranceFinding",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface AssuranceFinding {\n    readonly code: AssuranceFindingCode;\n    readonly method: string;\n    readonly path: string;\n    readonly rule?: string;\n    readonly evidence?: string;\n    readonly message: string;\n}"
+  },
+  {
+    "name": "AssuranceFindingCode",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type AssuranceFindingCode = \"no-routes\" | \"unclassified-route\" | \"missing-evidence\" | \"forbidden-evidence\";"
+  },
+  {
+    "name": "AssurancePolicy",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface AssurancePolicy {\n    /** First matching rule owns a route. Put exceptions before broad defaults. */\n    readonly rules: readonly AssuranceRule[];\n    /** Default `error`: an unclassified route fails closed. */\n    readonly unmatched?: \"error\" | \"ignore\";\n    /** Default false: reject an empty reflected source so a wrong import cannot pass CI silently. */\n    readonly allowEmpty?: boolean;\n}"
+  },
+  {
+    "name": "AssuranceReport",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface AssuranceReport {\n    readonly ok: boolean;\n    readonly routes: readonly AssuredRoute[];\n    readonly findings: readonly AssuranceFinding[];\n    /** Present when the config enables capability/effect assurance. */\n    readonly capabilities?: CapabilityAssuranceReport;\n}"
+  },
+  {
+    "name": "AssuranceRouteSelector",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface AssuranceRouteSelector {\n    /** Omit for every method. */\n    readonly methods?: readonly Method[];\n    /** Absolute route globs. `*` matches one segment; final `**` matches zero or more. */\n    readonly paths?: readonly string[];\n    /** Restrict the rule to MCP tool routes (`true`) or non-tool routes (`false`). */\n    readonly tools?: boolean;\n}"
+  },
+  {
+    "name": "AssuranceRule",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface AssuranceRule {\n    /** Stable human-readable classification included in diagnostics. */\n    readonly name: string;\n    readonly match: AssuranceRouteSelector;\n    /** Evidence ids the route must carry. */\n    readonly require?: readonly string[];\n    /** Evidence ids the route must not carry (useful for public webhooks and health routes). */\n    readonly forbid?: readonly string[];\n}"
+  },
+  {
+    "name": "AssuranceScope",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type AssuranceScope = \"global\" | \"subsequent\" | \"plugin\";",
+    "doc": "/** Where enforcement evidence follows Nifra's route-registration semantics. */"
+  },
+  {
+    "name": "AssuredCapabilityRoute",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface AssuredCapabilityRoute {\n    readonly method: string;\n    readonly path: string;\n    readonly declared: readonly string[];\n    readonly evidence: readonly CapabilityEvidence[];\n    /** Declared capabilities without static/runtime evidence. Informational, never treated as proof. */\n    readonly unproven: readonly string[];\n    readonly covered: boolean;\n    /** Highest data-sensitivity the response carries, when the route declares it. */\n    readonly classification?: DataClassification;\n}"
+  },
+  {
+    "name": "AssuredRoute",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface AssuredRoute {\n    readonly method: string;\n    readonly path: string;\n    readonly rule?: string;\n    readonly evidence: readonly AssuranceEvidence[];\n    readonly missing: readonly string[];\n    readonly forbidden: readonly string[];\n}"
+  },
+  {
+    "name": "attachEffectLedger",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function attachEffectLedger(context: object, ledger: RequestLedger): void;",
+    "doc": "/** Framework wiring: attach a per-request ledger to a handler context. Not for application code. */"
+  },
   {
     "name": "attachWebSocket",
     "kind": "function",
@@ -334,6 +533,20 @@
     "signature": "export interface AwaitProps {\n  /** A `Deferred<T>` from a loader/action's `defer(...)`, or an already-resolved value. */\n  resolve: Deferred<unknown> | unknown\n  /** Rendered with the resolved value (the default snippet). */\n  children?: Snippet<[unknown]>\n  /** Rendered while the deferred is pending (the SSR + pre-resolve state). */\n  pending?: Snippet\n  /** Rendered if the deferred rejects. */\n  error?: Snippet<[unknown]>\n}",
     "doc": "/**\n * Hand-written types for `Await.svelte` (svelte-package would generate this from the component). The\n * internal build resolves `*.svelte` via the ambient `svelte-shim.d.ts`; this file is what *consumers*\n * resolve through the `./await` export's `types` condition.\n */"
   },
+  {
+    "name": "BackendMount",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface BackendMount<Env = unknown> {\n    readonly [NIFRA_BACKEND_MOUNT]: BackendMountHandler<Env>;\n}",
+    "doc": "/** Structural mount capability exposed by an in-process typed client. */"
+  },
+  {
+    "name": "BackendMountHandler",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type BackendMountHandler<Env = unknown> = (request: Request, platform?: Platform<Env>) => Response | Promise<Response>;",
+    "doc": "/** Dispatch one already-materialized request into a backend with its outer runtime platform context. */"
+  },
   {
     "name": "backendRoutes",
     "kind": "function",
@@ -472,6 +685,20 @@
     "signature": "export declare function bridgeScript(): string;",
     "doc": "/** The bridge source, as a string for inlining in a `<script>`. Self-contained, no imports. */"
   },
+  {
+    "name": "BrowserNavigate",
+    "kind": "type",
+    "package": "@nifrajs/web",
+    "signature": "export type BrowserNavigate = (to: string | number, options?: NavigateOptions) => void;",
+    "doc": "/**\n * A history-aware navigate. A **string** `to` is a same-origin path (`/users/7?tab=a`) navigated to\n * (push, or replace with `{ replace: true }`); a **number** is a history delta (`-1` back, `1`\n * forward), matching the browser's `history.go`. Registered by `installHistory`.\n */"
+  },
+  {
+    "name": "BudgetClock",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface BudgetClock {\n    /** Monotonic milliseconds; must never move backwards during the process lifetime. */\n    monotonic(): number;\n    /** Unix epoch milliseconds; used only to translate an absolute wire deadline on admission. */\n    wall(): number;\n}",
+    "doc": "/** The only clocks deadline mechanics need. Inject both for deterministic tests. */"
+  },
   {
     "name": "BUILD_TARGETS",
     "kind": "const",
@@ -506,6 +733,19 @@
     "signature": "export interface BuildManifest {\n    /** URL of the client entry module (content-hashed). */\n    readonly entry: string;\n    /** URLs of every emitted asset (entry + chunks) — for serving + preloading. */\n    readonly assets: readonly string[];\n    /** `routeId → [layout chunk URLs…, own chunk URL]` — the chunks a route needs, for `createWebApp`'s\n     * `routePreload` (`<link rel=\"modulepreload\">` the matched route alongside the entry). Each route +\n     * layout is also a build entrypoint, so it gets a named chunk the bootstrap's lazy import dedupes to. */\n    readonly routes: Readonly<Record<string, readonly string[]>>;\n    /** The app's bundled, content-hashed stylesheet(s) — the bootstrap's **aggregate** CSS (every\n     * `import './x.css'` reachable from the app). The complete stylesheet regardless of which file\n     * imported the CSS; the always-safe fallback `createWebApp` links when a route has no per-route entry\n     * in {@link routeStyles}. Omitted when the app imports no CSS. */\n    readonly css?: readonly string[];\n    /** `routeId → [chain CSS URLs]` — only the stylesheets the matched route's layout chain + own file\n     * actually use (Bun emits a per-entrypoint CSS bundle per route/layout, with shared-component CSS\n     * inlined into each consumer). `createWebApp` links these instead of the aggregate, so a page ships\n     * only its own CSS. A route is omitted (→ aggregate fallback) when its `[name]` collides with another\n     * route's basename (ambiguous CSS↔route) or the build emitted orphan shared-chunk CSS — correctness\n     * over minimality. Absent entirely when the app imports no CSS. */\n    readonly routeStyles?: Readonly<Record<string, readonly string[]>>;\n}",
     "doc": "/** The built asset map — the server reads `entry` for the client script + serves `assets`. */"
   },
+  {
+    "name": "buildNifraManifest",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function buildNifraManifest(input: BuildNifraManifestInput): Promise<NifraManifest>;",
+    "doc": "/** Build one fail-closed, deterministic manifest from already-evaluated assurance reports. */"
+  },
+  {
+    "name": "BuildNifraManifestInput",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface BuildNifraManifestInput {\n    readonly source: unknown;\n    readonly assurance?: AssuranceReport;\n    readonly capabilities?: CapabilityAssuranceReport;\n}"
+  },
   {
     "name": "buildOpenApiDocument",
     "kind": "function",
@@ -550,7 +790,7 @@
     "name": "BuildTargetOptions",
     "kind": "interface",
     "package": "@nifrajs/web",
-    "signature": "export interface BuildTargetOptions {\n    /** The `routes/` directory to discover (absolute path). */\n    readonly routesDir: string;\n    /** Output directory for the assembled deploy dir (absolute path). Cleared and recreated. */\n    readonly outDir: string;\n    /** A scratch directory for intermediate codegen (the generated server entry + manifest) and the\n     * server bundle, cleaned up after. Absolute path. */\n    readonly workDir: string;\n    /** The adapter's client runtime module (exports `mountRouter`), e.g. `\"@nifrajs/web-react/client\"`. */\n    readonly clientModule: string;\n    /** Import specifier (resolvable from `workDir`) of the module exporting `adapter`. */\n    readonly adapterImport: string;\n    /** Import specifier (resolvable from `workDir`) of the module exporting `backend`, or `undefined`. */\n    readonly backendImport?: string;\n    /** A pre-built app instance for `static` prerendering (a `createWebApp` result). Required for\n     * `target: \"static\"` (SSG drives `app.fetch`); ignored otherwise. */\n    readonly prerenderApp?: PrerenderAppLike;\n    /** Client-build plugins (e.g. the MDX/Vue/Solid Bun plugins). */\n    readonly clientPlugins?: readonly BunPlugin[];\n    /** Server-build plugins (e.g. the SSR variants). */\n    readonly serverPlugins?: readonly BunPlugin[];\n    /** Extra Bun.build resolve conditions for the CLIENT build. */\n    readonly conditions?: readonly string[];\n    /** Compile-time `define` replacements layered onto both builds. */\n    readonly define?: Readonly<Record<string, string>>;\n    /** Document `<title>` for the generated server entry. */\n    readonly title?: string;\n}"
+    "signature": "export interface BuildTargetOptions {\n    /** The `routes/` directory to discover (absolute path). */\n    readonly routesDir: string;\n    /** Output directory for the assembled deploy dir (absolute path). Cleared and recreated. */\n    readonly outDir: string;\n    /** A scratch directory for intermediate codegen (the generated server entry + manifest) and the\n     * server bundle, cleaned up after. Absolute path. */\n    readonly workDir: string;\n    /** The adapter's client runtime module (exports `mountRouter`), e.g. `\"@nifrajs/web-react/client\"`. */\n    readonly clientModule: string;\n    /** Import specifier (resolvable from `workDir`) of the module exporting `adapter`. */\n    readonly adapterImport: string;\n    /** Import specifier (resolvable from `workDir`) of the module exporting `backend`, or `undefined`. */\n    readonly backendImport?: string;\n    /** Factory that builds the app for `static` prerendering, GIVEN the client build's manifest — so the\n     * emitted hydration `<script src>` uses the REAL content-hashed entry (`client.entry`) plus the same\n     * styles/route-preload the server targets use. A pre-built instance can't work here: the hash isn't known\n     * until `buildClient` runs inside `buildTarget`, so a hardcoded entry 404s → pages render but never\n     * hydrate. Required for `target: \"static\"` (SSG drives `app.fetch`); ignored otherwise. */\n    readonly prerenderApp?: (client: BuildManifest) => PrerenderAppLike | Promise<PrerenderAppLike>;\n    /** Client-build plugins (e.g. the MDX/Vue/Solid Bun plugins). */\n    readonly clientPlugins?: readonly BunPlugin[];\n    /** Server-build plugins (e.g. the SSR variants). */\n    readonly serverPlugins?: readonly BunPlugin[];\n    /** Extra Bun.build resolve conditions for the CLIENT build. */\n    readonly conditions?: readonly string[];\n    /** Compile-time `define` replacements layered onto both builds. */\n    readonly define?: Readonly<Record<string, string>>;\n    /** Document `<title>` for the generated server entry. */\n    readonly title?: string;\n}"
   },
   {
     "name": "BuildTargetResult",
@@ -665,6 +905,13 @@
     "signature": "export interface CacheStore {\n    /** The cached entry for `key`, or `undefined` on a miss. */\n    get(key: string): Promise<CachedResponse | undefined>;\n    /** Store (or overwrite) the entry for `key`. */\n    set(key: string, value: CachedResponse): Promise<void>;\n    /** Drop `key` (on-demand revalidation / purge). A no-op if absent. */\n    delete(key: string): Promise<void>;\n}",
     "doc": "/**\n * Pluggable ISR cache backend. **Production deploys MUST use a shared/durable store** (Workers KV,\n * Redis, the platform Cache API) so cached pages *and* revalidation hold across instances;\n * {@link MemoryCacheStore} is dev / single-instance only. Implementations are async so a network store\n * (KV/Redis) fits the same interface.\n */"
   },
+  {
+    "name": "canAttempt",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function canAttempt(budget: RequestBudget, estimatedAttemptMs: number, reserveMs?: number): boolean;",
+    "doc": "/** True only when a new attempt plus a caller-owned reserve can still fit. */"
+  },
   {
     "name": "canonical",
     "kind": "function",
@@ -672,11 +919,189 @@
     "signature": "export declare function canonical(href: string): LinkDescriptor;",
     "doc": "/**\n * A `<link rel=\"canonical\">` descriptor for a route's `meta.link`. The canonical URL tells search\n * engines which URL is authoritative for a page (deduping query-string / tracking variants).\n *\n * ```ts\n * export const meta = (a) => ({ link: [canonical(`https://site.com/posts/${a.params.slug}`)] })\n * ```\n */"
   },
+  {
+    "name": "canonicalizeIdempotencyBody",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function canonicalizeIdempotencyBody(body: Uint8Array, contentType: string | null): Uint8Array;",
+    "doc": "/** Canonicalize JSON bodies so whitespace/property-order retries bind to the same semantic request. */"
+  },
+  {
+    "name": "canonicalManifest",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function canonicalManifest(manifest: Pick<NifraManifest, \"manifestVersion\" | \"routes\">): string;",
+    "doc": "/** Canonical bytes are stable across runtime, object-key order, and route registration order. */"
+  },
+  {
+    "name": "CAPABILITY_GUARD",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const CAPABILITY_GUARD: unique symbol;"
+  },
+  {
+    "name": "CapabilityAccess",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type CapabilityAccess = \"read\" | \"write\";"
+  },
+  {
+    "name": "CapabilityAssuranceReport",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityAssuranceReport {\n    readonly ok: boolean;\n    readonly routes: readonly AssuredCapabilityRoute[];\n    readonly findings: readonly CapabilityFinding[];\n}"
+  },
+  {
+    "name": "CapabilityDefinition",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityDefinition {\n    readonly id: string;\n    /** Domain state is subject to HTTP method semantics; operational writes (logs/metrics) are not. */\n    readonly zone: CapabilityZone;\n    readonly access: CapabilityAccess;\n    /** Evidence required when this capability may execute. Default `none`. */\n    readonly idempotency?: CapabilityIdempotency;\n}"
+  },
+  {
+    "name": "CapabilityEvidence",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityEvidence {\n    readonly id: string;\n    readonly kind: CapabilityEvidenceKind;\n    readonly source: string;\n}",
+    "doc": "/** Token-only effect evidence. `source` is an adapter/module id, never request or business data. */"
+  },
+  {
+    "name": "CapabilityEvidenceKind",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type CapabilityEvidenceKind = \"static\" | \"runtime\";"
+  },
+  {
+    "name": "CapabilityEvidenceSet",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityEvidenceSet {\n    readonly routes: readonly RouteCapabilityEvidence[];\n}"
+  },
+  {
+    "name": "CapabilityFinding",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityFinding {\n    readonly code: CapabilityFindingCode;\n    readonly method: string;\n    readonly path: string;\n    readonly capability?: string;\n    readonly message: string;\n}"
+  },
+  {
+    "name": "CapabilityFindingCode",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type CapabilityFindingCode = \"unknown-capability\" | \"provenance-uncovered\" | \"undeclared-capability-evidence\" | \"safe-method-domain-write\" | \"missing-request-idempotency\" | \"missing-durable-idempotency\" | \"forbidden-effect-import\";"
+  },
+  {
+    "name": "CapabilityGuard",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityGuard {\n    readonly allowed: readonly string[];\n    readonly method: string;\n    readonly path: string;\n    readonly onUse?: (event: CapabilityUseEvent) => void;\n}"
+  },
+  {
+    "name": "CapabilityIdempotency",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type CapabilityIdempotency = \"none\" | \"request\" | \"durable\";"
+  },
+  {
+    "name": "CapabilityImportRule",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityImportRule {\n    /** Exact module specifier, or a trailing `/*` prefix rule. */\n    readonly specifier: string;\n    readonly capabilities: readonly string[];\n}"
+  },
+  {
+    "name": "CapabilityImportViolation",
+    "kind": "interface",
+    "package": "@nifrajs/cli",
+    "signature": "export interface CapabilityImportViolation {\n    readonly method: string;\n    readonly path: string;\n    readonly module: string;\n    readonly specifier: string;\n    readonly reason: string;\n    readonly chain: readonly string[];\n}"
+  },
+  {
+    "name": "CapabilityOutcomeOptions",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityOutcomeOptions extends UseCapabilityOptions {\n    /** An outcome can only be recorded after the intent beacon succeeded. */\n    readonly phase: Exclude<EffectPhase, \"intent\">;\n    /** Outcome error as a bounded token code. */\n    readonly error?: {\n        readonly code: string;\n    };\n}"
+  },
+  {
+    "name": "CapabilityPolicy",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityPolicy {\n    readonly definitions: readonly CapabilityDefinition[];\n    /** Required: capability assurance without a static provenance firewall is incomplete. */\n    readonly provenance: CapabilityProvenancePolicy;\n    /** Default `capabilities.lock.json`. */\n    readonly lockfile?: string;\n}"
+  },
+  {
+    "name": "CapabilityProjectReport",
+    "kind": "interface",
+    "package": "@nifrajs/cli",
+    "signature": "export interface CapabilityProjectReport {\n    readonly report: CapabilityAssuranceReport;\n    readonly violations: readonly CapabilityImportViolation[];\n}"
+  },
+  {
+    "name": "CapabilityProvenancePolicy",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityProvenancePolicy {\n    readonly imports: readonly CapabilityImportRule[];\n    readonly forbiddenImports: readonly ForbiddenCapabilityImport[];\n    /** Explicit associations for contract/generated routes that source scanning cannot locate. */\n    readonly routeModules?: readonly CapabilityRouteModule[];\n}"
+  },
+  {
+    "name": "CapabilityRouteModule",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityRouteModule {\n    readonly match: CapabilityRouteSelector;\n    /** Project-relative modules that implement the selected routes. */\n    readonly modules: readonly string[];\n}"
+  },
+  {
+    "name": "CapabilityRouteSelector",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityRouteSelector {\n    readonly methods?: readonly string[];\n    readonly paths?: readonly string[];\n}"
+  },
+  {
+    "name": "CapabilitySnapshot",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilitySnapshot {\n    readonly nifraCapabilities: 1;\n    readonly routes: readonly CapabilitySnapshotRoute[];\n}"
+  },
+  {
+    "name": "CapabilitySnapshotRoute",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilitySnapshotRoute {\n    readonly method: string;\n    readonly path: string;\n    readonly declared: readonly string[];\n    readonly evidenced: readonly string[];\n    readonly unproven: readonly string[];\n    /** Recorded so a route that starts returning `pii`/`secret` flips the lockfile and forces a review. */\n    readonly classification?: DataClassification;\n}"
+  },
+  {
+    "name": "CapabilityUseEvent",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CapabilityUseEvent {\n    readonly capability: string;\n    readonly method: string;\n    readonly path: string;\n}"
+  },
+  {
+    "name": "CapabilityZone",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type CapabilityZone = \"domain\" | \"operational\";"
+  },
+  {
+    "name": "CapturedRequest",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface CapturedRequest {\n    readonly method: string;\n    readonly path: string;\n    readonly query?: Record<string, string>;\n    readonly headers?: Record<string, string>;\n    readonly body?: unknown;\n}"
+  },
+  {
+    "name": "CapturedRequestInput",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface CapturedRequestInput {\n    readonly method?: string;\n    readonly path: string;\n    readonly query?: Record<string, string>;\n    readonly headers?: Record<string, string>;\n    readonly body?: unknown;\n}"
+  },
+  {
+    "name": "captureIncident",
+    "kind": "function",
+    "package": "@nifrajs/testing",
+    "signature": "export declare function captureIncident(request: Request | CapturedRequestInput, response: Response | {\n    status: number;\n    body?: unknown;\n}, options?: CaptureIncidentOptions): Promise<IncidentCapsule>;",
+    "doc": "/** Build a capsule from a real `Request`+`Response`, or from plain captured fields. */"
+  },
+  {
+    "name": "CaptureIncidentOptions",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface CaptureIncidentOptions {\n    readonly id?: string;\n    readonly capturedAt?: string;\n    /** Header names to keep on the capsule (lowercased match). Default: only `content-type`. */\n    readonly headerAllowList?: readonly string[];\n    readonly note?: string;\n}"
+  },
   {
     "name": "CheckDiagnostic",
     "kind": "interface",
     "package": "@nifrajs/cli",
-    "signature": "export interface CheckDiagnostic {\n    readonly rule: \"typecheck\" | \"typed-client\" | \"untyped-client\" | \"server-only-import\" | \"response-route\" | \"undeclared-dependency\" | \"server-manifest-drift\";\n    /** `error` fails the gate (a real contract break); `warning` is advisory — surfaced to the agent but\n     * does NOT fail `nifra check`, for patterns that are sometimes intentional (a route returning a raw\n     * `Response`, which silently drops the typed client to `data: never` but is valid for files/redirects). */\n    readonly severity: \"error\" | \"warning\";\n    readonly file?: string;\n    readonly line?: number;\n    readonly message: string;\n    /** The canonical, rule-level fix — clean of the per-occurrence snippet, so an agent can apply it\n     * directly. Set for the lint rules (they have one correct fix); omitted for `typecheck` (the fix is\n     * specific to each type error). */\n    readonly fix?: string;\n    /** A richer, agent-oriented fix hint. Diffs are only emitted when the edit is mechanical and local;\n     * ambiguous cases give concrete steps instead of pretending the checker can safely rewrite code. */\n    readonly suggestion?: CheckSuggestion;\n    /**\n     * The import chain that pulls server-only code into the browser bundle, as display labels\n     * `[routeFile, …as-written specifiers…, sink]`. Set only on `server-only-import`.\n     *\n     * #4.4: this is now the FULL **transitive** chain — a bounded import-resolution walk (`Bun.resolveSync`\n     * from each file's dir, BFS the local module graph) follows `route → ../data → ../db → node:crypto`,\n     * matching the build leak-guard's depth (`detectNodeBuiltinsInClient` in `@nifrajs/web/build`). A\n     * length-2 chain (`[routeFile, specifier]`) means the route imports the sink directly. When a hop can't\n     * be resolved precisely (a bare pkg, a tsconfig path alias), the walk degrades to the honest direct\n     * edge rather than fabricating a deeper path — never a lie.\n     */\n    readonly chain?: readonly string[];\n}",
+    "signature": "export interface CheckDiagnostic {\n    readonly rule: \"typecheck\" | \"typed-client\" | \"untyped-client\" | \"server-only-import\" | \"response-route\" | \"undeclared-dependency\" | \"server-manifest-drift\" | \"manifest-drift\" | \"capability-assurance\" | \"capability-config\";\n    /** `error` fails the gate (a real contract break); `warning` is advisory — surfaced to the agent but\n     * does NOT fail `nifra check`, for patterns that are sometimes intentional (a route returning a raw\n     * `Response`, which silently drops the typed client to `data: never` but is valid for files/redirects). */\n    readonly severity: \"error\" | \"warning\";\n    readonly file?: string;\n    readonly line?: number;\n    readonly message: string;\n    /** The canonical, rule-level fix — clean of the per-occurrence snippet, so an agent can apply it\n     * directly. Set for the lint rules (they have one correct fix); omitted for `typecheck` (the fix is\n     * specific to each type error). */\n    readonly fix?: string;\n    /** A richer, agent-oriented fix hint. Diffs are only emitted when the edit is mechanical and local;\n     * ambiguous cases give concrete steps instead of pretending the checker can safely rewrite code. */\n    readonly suggestion?: CheckSuggestion;\n    /**\n     * The import chain that pulls server-only code into the browser bundle, as display labels\n     * `[routeFile, …as-written specifiers…, sink]`. Set only on `server-only-import`.\n     *\n     * #4.4: this is now the FULL **transitive** chain — a bounded import-resolution walk (`Bun.resolveSync`\n     * from each file's dir, BFS the local module graph) follows `route → ../data → ../db → node:crypto`,\n     * matching the build leak-guard's depth (`detectNodeBuiltinsInClient` in `@nifrajs/web/build`). A\n     * length-2 chain (`[routeFile, specifier]`) means the route imports the sink directly. When a hop can't\n     * be resolved precisely (a bare pkg, a tsconfig path alias), the walk degrades to the honest direct\n     * edge rather than fabricating a deeper path — never a lie.\n     */\n    readonly chain?: readonly string[];\n}",
     "doc": "/** A single machine-readable check failure — the unit an agent (or CI) acts on. */"
   },
   {
@@ -699,6 +1124,26 @@
     "signature": "export interface ChunkSize {\n    /** The emitted file's basename (e.g. `index-abc123.js`). */\n    readonly name: string;\n    /** Raw byte length of the file. */\n    readonly bytes: number;\n    /** Gzipped byte length (what the client actually downloads, modulo brotli). */\n    readonly gzip: number;\n}",
     "doc": "/** One emitted chunk's measured size, in raw bytes + gzipped bytes (over-the-wire weight). */"
   },
+  {
+    "name": "classificationAtLeast",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function classificationAtLeast(value: DataClassification, floor: DataClassification): boolean;",
+    "doc": "/** True when `value` is at least as sensitive as `floor` (e.g. `classificationAtLeast(x, \"pii\")`). */"
+  },
+  {
+    "name": "classified",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function classified<S extends object>(schema: S, classification: DataClassification): ClassifiedSchema<S>;",
+    "doc": "/**\n * Attach data-classification metadata without changing validation or inferred input/output types.\n * For Nifra/TypeBox carriers the raw JSON Schema node is tagged too, so metadata survives composition\n * through `t.object`, `t.array`, `t.optional`, and unions.\n */"
+  },
+  {
+    "name": "ClassifiedSchema",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type ClassifiedSchema<S extends object> = S & {\n    readonly [CLASSIFICATION]: DataClassification;\n};"
+  },
   {
     "name": "CLAUDE_MD_PATH",
     "kind": "const",
@@ -778,6 +1223,19 @@
     "package": "@nifrajs/web",
     "signature": "export interface CloudflarePagesRoutesOptions {\n    /** Prerendered request paths (e.g. `prerenderRoutes(...).prerendered.map(p => p.path)`, or the\n     * build's `prerendered.json`). Each is excluded from the worker — plus its static `_data.json`. */\n    readonly prerendered: readonly string[];\n    /** Extra globs to keep OFF the worker (CDN-served). Default `[\"/assets/*\"]` (the hashed bundle). */\n    readonly staticGlobs?: readonly string[];\n}"
   },
+  {
+    "name": "collectAssuranceReport",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function collectAssuranceReport(cwd: string, configPath?: string): Promise<AssuranceReport>;"
+  },
+  {
+    "name": "collectCapabilityProjectReport",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function collectCapabilityProjectReport(cwd: string, source: unknown, policyInput: CapabilityPolicy): Promise<CapabilityProjectReport>;",
+    "doc": "/** Build coverage-qualified static evidence for every reflected route. */"
+  },
   {
     "name": "collectCheckResult",
     "kind": "function",
@@ -792,6 +1250,12 @@
     "signature": "export declare function collectDoctorResult(cwd: string): Promise<DoctorResult>;",
     "doc": "/** Run doctor against the project at `cwd`: diff source imports vs declared deps. */"
   },
+  {
+    "name": "CollectLevelsOptions",
+    "kind": "interface",
+    "package": "@nifrajs/cli",
+    "signature": "export interface CollectLevelsOptions {\n    readonly config?: string;\n    /** Deterministic seed for the L4 invariant run. Default 1. */\n    readonly seed?: number;\n}"
+  },
   {
     "name": "collectPortResult",
     "kind": "function",
@@ -806,6 +1270,13 @@
     "signature": "export declare function collectTestResult(cwd: string, args?: TestToolArgs, opts?: {\n    readonly signal?: AbortSignal;\n}): Promise<TestToolResult>;",
     "doc": "/** Run `bun test` in a project with bounded runtime and bounded output. Arguments are argv entries,\n * never a shell string, so an agent can safely pass a path pattern without command injection risk. */"
   },
+  {
+    "name": "collectVerificationLevels",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function collectVerificationLevels(cwd: string, options?: CollectLevelsOptions): Promise<VerificationLevelsResult>;",
+    "doc": "/** Compute the ladder. Each level is evaluated independently, then gated on the levels below. */"
+  },
   {
     "name": "combine",
     "kind": "function",
@@ -859,7 +1330,7 @@
     "kind": "function",
     "package": "@nifrajs/web-react",
     "signature": "export declare function compose(chain: readonly unknown[], props: RenderProps): ReactNode;",
-    "doc": "/**\n * Fold a layout chain (outermost layout → page) into a single React tree: the page\n * (innermost) receives `props` (the loader data); each layout wraps the child via its\n * `children`. Shared by the server adapter (renderToString) and the client (hydrateRoot).\n */"
+    "doc": "/**\n * Fold a layout chain (outermost layout → page) into a single React tree: the page\n * (innermost) receives `props` (the loader data); each layout wraps the child via its\n * `children`. Shared by the server adapter (renderToString) and the client (hydrateRoot).\n *\n * The whole tree is wrapped in a {@link RouterContext} provider carrying the matched `params` + the\n * current `path` (both threaded through `RenderProps` identically on SSR and client), so the routing\n * hooks (`useParams`/`useLocation`/`useSearchParams`) read the same value on both sides — no hydration\n * mismatch. A render with no routing fields (a non-router adapter usage) provides the empty default.\n */"
   },
   {
     "name": "compose",
@@ -902,6 +1373,27 @@
     "signature": "export declare function computed<T>(fn: () => T): () => T;",
     "doc": "/** Derived value, cached into a signal — recomputes when its tracked inputs change. */"
   },
+  {
+    "name": "computeEffectDigest",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function computeEffectDigest(key: Uint8Array | CryptoKey, payload: Uint8Array): Promise<string>;",
+    "doc": "/**\n * Keyed HMAC-SHA-256 digest (hex) of an effect payload, for replay/reconciliation matching without\n * storing the payload. Keyed on purpose: a bare hash of low-entropy data (an email, a flag) is\n * brute-forceable and would itself leak. Digest the **whole** effect payload, never a single field.\n */"
+  },
+  {
+    "name": "computeIdempotencyFingerprint",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function computeIdempotencyFingerprint(method: string, path: string, body: Uint8Array, contentType?: string): Promise<string>;",
+    "doc": "/**\n * SHA-256 fingerprint binding a key to one request: method, path (+ query), and the raw body bytes.\n * A collision-resistant hash matters — a weak hash would let a crafted body replay another's response.\n */"
+  },
+  {
+    "name": "computeUpgrade",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function computeUpgrade(cwd: string, recipe: UpgradeRecipe, write: boolean): UpgradePlan;",
+    "doc": "/** Compute the plan (and, when `write`, apply it) for a target recipe against `cwd`. */"
+  },
   {
     "name": "consoleAgentExporter",
     "kind": "function",
@@ -979,7 +1471,7 @@
     "name": "Context",
     "kind": "interface",
     "package": "@nifrajs/core",
-    "signature": "export interface Context<Path extends string = string, S extends RouteSchema = RouteSchema> {\n    readonly req: Request;\n    /**\n     * Alias of {@link req} — the same `Request`. Page loaders/actions receive their request as `request`;\n     * this alias lets route handlers and loaders share one name, so `c.request` and `ctx.req` both work\n     * everywhere (no more `c.req` vs `ctx.request` mismatch).\n     */\n    readonly request: Request;\n    readonly params: Params<Path>;\n    readonly query: QueryOf<S>;\n    readonly body: BodyOf<S>;\n    /** The request's cookies, parsed from the `Cookie` header (values URL-decoded). Parsed lazily on\n     * first access + cached. Signed cookies arrive as `value.signature` — verify with `unsignValue`. */\n    readonly cookies: Readonly<Record<string, string>>;\n    readonly set: ResponseControls;\n    /**\n     * Aborts when the server's `requestTimeoutMs` elapses (and never, when no timeout\n     * is configured). Pass it to cancellation-aware work — DB drivers, `fetch` — so a\n     * timed-out request stops doing work instead of running on after the 503.\n     */\n    readonly signal: AbortSignal;\n    /**\n     * Platform bindings from `app.fetch(request, { env })` — Workers `env` (KV/D1/secrets), etc.\n     * `undefined` off-edge (Bun/Node/Deno). Declare the shape with `server<Env>()` to read it typed\n     * (`c.env: Env`); otherwise `unknown`. Validate at the trust boundary before use either way.\n     */\n    readonly env: unknown;\n    /**\n     * Schedule background work. On edge runtimes it extends the response lifetime (Workers\n     * `ctx.waitUntil`); off-edge it runs the promise fire-and-forget (a rejection is swallowed,\n     * never an unhandled rejection).\n     */\n    readonly waitUntil: (promise: Promise<unknown>) => void;\n    /**\n     * Read the raw request body as bytes, **capped** at `maxBytes` (default: the server's\n     * `maxBodyBytes`). For routes with **no body schema** — raw bodies, file uploads,\n     * BYO-validation — where the automatic schema cap doesn't apply. An over-cap body (by\n     * `Content-Length` or while streaming) throws a flat `413`; a malformed `Content-Length`\n     * throws `400`. Consumes the body stream (call once). Pass a larger `maxBytes` for an\n     * upload route, a smaller one to tighten a specific endpoint.\n     */\n    readonly boundedBody: (maxBytes?: number) => Promise<Uint8Array>;\n    /**\n     * `boundedBody` + `JSON.parse` (UTF-8). Same cap + `413`/`400` semantics; additionally\n     * throws a flat `400` on invalid JSON. Use for a schema-less JSON endpoint that still\n     * wants the body bounded.\n     */\n    readonly boundedJson: <T = unknown>(maxBytes?: number) => Promise<T>;\n    /**\n     * Build a JSON `Response`. Pass a status number or a full `ResponseInit` as the second arg. `return` it\n     * from a handler, or `throw` it from `derive`/`beforeHandle` to short-circuit — both work:\n     * `throw c.json({ error: \"unauthorized\" }, 401)`. A terser alternative to\n     * `new Response(JSON.stringify(...), { status, headers: { \"content-type\": \"application/json\" } })`.\n     */\n    readonly json: (body: unknown, init?: ResponseInit | number) => Response;\n    /** Build a `text/plain; charset=utf-8` `Response`. Like {@link json}, pass a status or `ResponseInit`. */\n    readonly text: (body: string, init?: ResponseInit | number) => Response;\n}",
+    "signature": "export interface Context<Path extends string = string, S extends RouteSchema = RouteSchema> {\n    readonly req: Request;\n    /**\n     * Alias of {@link req} — the same `Request`. Page loaders/actions receive their request as `request`;\n     * this alias lets route handlers and loaders share one name, so `c.request` and `ctx.req` both work\n     * everywhere (no more `c.req` vs `ctx.request` mismatch).\n     */\n    readonly request: Request;\n    readonly params: Params<Path>;\n    readonly query: QueryOf<S>;\n    readonly body: BodyOf<S>;\n    /** The request's cookies, parsed from the `Cookie` header (values URL-decoded). Parsed lazily on\n     * first access + cached. Signed cookies arrive as `value.signature` — verify with `unsignValue`. */\n    readonly cookies: Readonly<Record<string, string>>;\n    readonly set: ResponseControls;\n    /**\n     * Aborts when the server's `requestTimeoutMs` elapses (and never, when no timeout\n     * is configured). Pass it to cancellation-aware work — DB drivers, `fetch` — so a\n     * timed-out request stops doing work instead of running on after the 503.\n     */\n    readonly signal: AbortSignal;\n    /**\n     * Absolute request deadline plus monotonic remaining time. It shares {@link signal}; the server\n     * clamps an inbound deadline to local policy when `acceptInboundDeadlines` is enabled.\n     */\n    readonly budget: RequestBudget;\n    /**\n     * Platform bindings from `app.fetch(request, { env })` — Workers `env` (KV/D1/secrets), etc.\n     * `undefined` off-edge (Bun/Node/Deno). Declare the shape with `server<Env>()` to read it typed\n     * (`c.env: Env`); otherwise `unknown`. Validate at the trust boundary before use either way.\n     */\n    readonly env: unknown;\n    /**\n     * Schedule background work. On edge runtimes it extends the response lifetime (Workers\n     * `ctx.waitUntil`); off-edge it runs the promise fire-and-forget (a rejection is swallowed,\n     * never an unhandled rejection).\n     */\n    readonly waitUntil: (promise: Promise<unknown>) => void;\n    /**\n     * Read the raw request body as bytes, **capped** at `maxBytes` (default: the server's\n     * `maxBodyBytes`). For routes with **no body schema** — raw bodies, file uploads,\n     * BYO-validation — where the automatic schema cap doesn't apply. An over-cap body (by\n     * `Content-Length` or while streaming) throws a flat `413`; a malformed `Content-Length`\n     * throws `400`. Consumes the body stream (call once). Pass a larger `maxBytes` for an\n     * upload route, a smaller one to tighten a specific endpoint.\n     */\n    readonly boundedBody: (maxBytes?: number) => Promise<Uint8Array>;\n    /**\n     * `boundedBody` + `JSON.parse` (UTF-8). Same cap + `413`/`400` semantics; additionally\n     * throws a flat `400` on invalid JSON. Use for a schema-less JSON endpoint that still\n     * wants the body bounded.\n     */\n    readonly boundedJson: <T = unknown>(maxBytes?: number) => Promise<T>;\n    /**\n     * Build a JSON `Response`. Pass a status number or a full `ResponseInit` as the second arg. `return` it\n     * from a handler, or `throw` it from `derive`/`beforeHandle` to short-circuit — both work:\n     * `throw c.json({ error: \"unauthorized\" }, 401)`. A terser alternative to\n     * `new Response(JSON.stringify(...), { status, headers: { \"content-type\": \"application/json\" } })`.\n     */\n    readonly json: (body: unknown, init?: ResponseInit | number) => Response;\n    /** Build a `text/plain; charset=utf-8` `Response`. Like {@link json}, pass a status or `ResponseInit`. */\n    readonly text: (body: string, init?: ResponseInit | number) => Response;\n}",
     "doc": "/**\n * Handler context. `params` are inferred from the path; `body` and `query` are\n * the validated outputs of their schemas when declared (else `undefined` /\n * raw `URLSearchParams`).\n */"
   },
   {
@@ -1003,6 +1495,44 @@
     "signature": "export declare function contextStorage(): Middleware;",
     "doc": "/**\n * Store the current nifra `Context` in `AsyncLocalStorage` for helpers that run away from the handler\n * argument, e.g. repository/logger functions called deep in the stack.\n *\n * Import from `@nifrajs/middleware/context-storage` so ordinary `@nifrajs/middleware` imports stay\n * node-compat-free on edge runtimes. The runtime must support `node:async_hooks` AsyncLocalStorage.\n */"
   },
+  {
+    "name": "ContractCaseContext",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface ContractCaseContext {\n    readonly seed: number;\n    readonly caseId: string;\n    readonly route: ReflectedRoute;\n    readonly runtime: string;\n    readonly kind: ContractCaseKind;\n    readonly target: ContractTarget;\n    readonly mutation?: string;\n}",
+    "doc": "/** Stable context passed to request/rejection hooks. It contains no request payloads or secrets. */"
+  },
+  {
+    "name": "ContractCaseKind",
+    "kind": "type",
+    "package": "@nifrajs/testing",
+    "signature": "export type ContractCaseKind = \"input-rejection\" | \"response-conformance\";"
+  },
+  {
+    "name": "ContractCoverageGap",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface ContractCoverageGap {\n    readonly route?: string;\n    readonly target?: ContractTarget;\n    readonly code: ContractCoverageGapCode;\n    readonly message: string;\n}"
+  },
+  {
+    "name": "ContractCoverageGapCode",
+    "kind": "type",
+    "package": "@nifrajs/testing",
+    "signature": "export type ContractCoverageGapCode = \"NO_CONTRACT_TARGETS\" | \"NO_VALIDATOR\" | \"NO_WITNESS\" | \"INVALID_WITNESS\" | \"WITNESS_TOO_LARGE\" | \"UNSUPPORTED_BODY_METHOD\" | \"NO_REJECTED_MUTATION\" | \"NO_RUNTIME\" | \"INVALID_RUNTIME\" | \"CASE_NOT_FOUND\";"
+  },
+  {
+    "name": "ContractReplay",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface ContractReplay {\n    readonly seed: number;\n    readonly caseId: string;\n    readonly runtime: string;\n}"
+  },
+  {
+    "name": "ContractRuntime",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface ContractRuntime {\n    readonly name: string;\n    fetch(request: Request): Response | Promise<Response>;\n}",
+    "doc": "/** A runtime target for the same generated contract cases (for example Bun, Node, and Workers). */"
+  },
   {
     "name": "ContractShape",
     "kind": "type",
@@ -1010,6 +1540,26 @@
     "signature": "export type ContractShape = Record<string, OperationDef>;",
     "doc": "/** A contract: named operations. Names are the handler keys and OpenAPI operationIds. */"
   },
+  {
+    "name": "ContractTarget",
+    "kind": "type",
+    "package": "@nifrajs/testing",
+    "signature": "export type ContractTarget = \"body\" | \"query\" | \"response\";"
+  },
+  {
+    "name": "ContractTestApp",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface ContractTestApp {\n    routes(): readonly unknown[];\n    fetch(request: Request): Response | Promise<Response>;\n}",
+    "doc": "/** Anything that exposes reflected routes and a Web-standard in-process fetch handler. */"
+  },
+  {
+    "name": "ContractWitness",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface ContractWitness {\n    readonly params?: Readonly<Record<string, string>>;\n    readonly query?: unknown;\n    readonly body?: unknown;\n    readonly headers?: HeaderSource;\n}",
+    "doc": "/** A known-good request. Missing body/query values are synthesized from inspectable JSON Schema. */"
+  },
   {
     "name": "cookieJar",
     "kind": "function",
@@ -1050,6 +1600,13 @@
     "package": "@nifrajs/cli",
     "signature": "export declare function countBodyHits(lowerBody: string, group: SearchTermGroup, maxHits: number): number;"
   },
+  {
+    "name": "createAdmissionController",
+    "kind": "function",
+    "package": "@nifrajs/middleware",
+    "signature": "export declare function createAdmissionController(options: AdmissionOptions): AdmissionControllerHandle;",
+    "doc": "/**\n * Build a capacity-admission controller. Pass the returned handle as the server's `admission` option.\n */"
+  },
   {
     "name": "createBunWsHandlers",
     "kind": "function",
@@ -1071,6 +1628,12 @@
     "signature": "export declare function createCachedAppLoader(cwd: string, options?: CachedAppLoaderOptions): (outDirName?: string) => Promise<LoadedApp>;",
     "doc": "/** Cache LoadedApp inside one MCP server process, invalidating when config/backend mtimes change. */"
   },
+  {
+    "name": "createCapabilityGuard",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function createCapabilityGuard(allowed: readonly string[], method: string, path: string, onUse: ((event: CapabilityUseEvent) => void) | undefined): CapabilityGuard;"
+  },
   {
     "name": "createClientRouter",
     "kind": "function",
@@ -1091,6 +1654,20 @@
     "signature": "export declare function createDevServer(options: DevServerOptions): Promise<DevServer>;",
     "doc": "/** Start the dev server: build → serve → watch → rebuild + reload on change. */"
   },
+  {
+    "name": "createEventLoopLagSampler",
+    "kind": "function",
+    "package": "@nifrajs/middleware",
+    "signature": "export declare function createEventLoopLagSampler(resolutionMs?: number, monitor?: LoopDelayMonitor): () => number;",
+    "doc": "/**\n * Event-loop-lag sampler. By default it measures timer drift using only Web/JS runtime primitives, so\n * it works under Node ESM, Bun, Deno, and workers without a hidden CommonJS `require` fallback. An\n * injected histogram remains available for deterministic tests or a runtime-native monitor. Each read\n * returns recent mean lag and resets the sampling window.\n */"
+  },
+  {
+    "name": "createEventRegistry",
+    "kind": "function",
+    "package": "@nifrajs/events",
+    "signature": "export declare function createEventRegistry(contracts: readonly EventContract[]): EventRegistry;",
+    "doc": "/** Build a registry from a set of contracts. Throws on a duplicate `type@version`. */"
+  },
   {
     "name": "createFetcher",
     "kind": "function",
@@ -1137,6 +1714,20 @@
     "package": "@nifrajs/mcp",
     "signature": "export interface CreateMcpServerOptions {\n    readonly name: string;\n    readonly version: string;\n    readonly tools?: readonly McpTool[];\n    /** MCP Apps widgets — their resources are registered and the UI capability is advertised. */\n    readonly widgets?: readonly McpWidget[];\n    /** Extra (non-widget) resources to expose. */\n    readonly resources?: readonly McpResource[];\n    readonly prompts?: readonly McpPrompt[];\n    /** GET health-page text. */\n    readonly health?: string;\n    /** Max JSON-RPC body size in bytes (default 1 MB). */\n    readonly maxBodyBytes?: number;\n}"
   },
+  {
+    "name": "createMemoryIdempotencyStore",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function createMemoryIdempotencyStore(options?: MemoryIdempotencyStoreOptions): MemoryIdempotencyStore;",
+    "doc": "/** Convenience factory mirroring the other core primitives' `create*` style. */"
+  },
+  {
+    "name": "createMemoryLedgerSink",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function createMemoryLedgerSink(options?: MemoryLedgerSinkOptions): MemoryLedgerSink;",
+    "doc": "/** Bounded in-memory sink for tests and local development. Token-only, like every sink. */"
+  },
   {
     "name": "createMockServer",
     "kind": "function",
@@ -1144,6 +1735,13 @@
     "signature": "export declare function createMockServer(app: MockableApp, options?: MockServerOptions | undefined): MockServer;",
     "doc": "/**\n * Create a mock server from a Nifra app's route definitions. For each route\n * with a `schema.response`, generates a handler returning fake data that\n * matches the response schema structure. Routes without response schemas\n * return `{}`.\n */"
   },
+  {
+    "name": "createMutation",
+    "kind": "function",
+    "package": "@nifrajs/web",
+    "signature": "export declare function createMutation<TData, TVariables>(fn: (variables: TVariables) => Promise<TData>, callbacks?: MutationCallbacks<TData, TVariables>): MutationHandle<TData, TVariables>;",
+    "doc": "/**\n * Create a standalone mutation state machine — framework-agnostic, so a per-adapter `useMutation`\n * binding just subscribes to it. Single-flight by a monotonic token: overlapping `mutate` calls each\n * run their `fn`, but only the latest publishes state (an older, slower response can't clobber a newer\n * one). The callbacks fire in TanStack order: `onMutate` (before), then `onSuccess`/`onError`, then\n * `onSettled`.\n */"
+  },
   {
     "name": "createObservationLifecycle",
     "kind": "function",
@@ -1178,6 +1776,32 @@
     "signature": "export declare function createQueue(options?: QueueOptions): Queue;",
     "doc": "/** Create a job queue. Define jobs, enqueue payloads, and `start()` a worker (or `drain()` once). */"
   },
+  {
+    "name": "createRequestBudget",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function createRequestBudget(options: CreateRequestBudgetOptions): RequestBudget;",
+    "doc": "/**\n * Create a budget from an admitted absolute deadline. Wall time is sampled once; every subsequent\n * `remaining()` call is monotonic. This function does not arm a timer—the owner of `signal` does.\n */"
+  },
+  {
+    "name": "CreateRequestBudgetOptions",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CreateRequestBudgetOptions {\n    /** Absolute Unix epoch deadline. */\n    readonly deadline: number;\n    readonly signal: AbortSignal;\n    readonly clock?: BudgetClock;\n}"
+  },
+  {
+    "name": "createRequestLedger",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function createRequestLedger(options: CreateRequestLedgerOptions): RequestLedger;",
+    "doc": "/** Create a bounded per-request ledger. The server wires one per capability-declaring route. */"
+  },
+  {
+    "name": "CreateRequestLedgerOptions",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface CreateRequestLedgerOptions {\n    /** HTTP method of the matched route. */\n    readonly method: string;\n    /** The registered route pattern — callers must never pass the concrete request URL. */\n    readonly path: string;\n    /** The route's declared capability tokens, surfaced verbatim on the sealed ledger. Default `[]`. */\n    readonly declared?: readonly string[];\n    /** Entry bound; exceeding it throws {@link EffectLedgerOverflowError}. Default {@link DEFAULT_MAX_ENTRIES}. */\n    readonly maxEntries?: number;\n    /** Compute the tamper-evident hash chain at seal. Default false. */\n    readonly chain?: boolean;\n    /** Injectable monotonic clock (ms) for deterministic tests. Default `performance.now`. */\n    readonly clock?: () => number;\n}"
+  },
   {
     "name": "createScheduler",
     "kind": "function",
@@ -1185,6 +1809,13 @@
     "signature": "export declare function createScheduler(options?: SchedulerOptions): Scheduler;",
     "doc": "/** Create an in-process cron scheduler. */"
   },
+  {
+    "name": "createSeededRandom",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function createSeededRandom(seed: number): () => number;",
+    "doc": "/** Deterministic PRNG (mulberry32). Ambient randomness would make failures unreproducible. */"
+  },
   {
     "name": "createSessions",
     "kind": "function",
@@ -1198,6 +1829,13 @@
     "signature": "export declare function createStylesheetEmitter(build: PluginBuilder, namespace: string): StylesheetEmitter;",
     "doc": "/**\n * Wire the virtual-CSS-module handlers onto `build` for `namespace`, returning an {@link StylesheetEmitter}.\n * The `namespace` must be a plain identifier (letters/`-`); it's used verbatim as the import suffix and\n * the Bun namespace. Only the `\"dom\"` build should emit CSS — the `\"ssr\"` build ships no stylesheet.\n */"
   },
+  {
+    "name": "createUnboundedRequestBudget",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function createUnboundedRequestBudget(signal: AbortSignal): RequestBudget;",
+    "doc": "/** Create a local no-deadline view. Outbound header propagation deliberately omits it. */"
+  },
   {
     "name": "createViteDevServer",
     "kind": "function",
@@ -1216,7 +1854,7 @@
     "name": "CreateWebAppOptions",
     "kind": "interface",
     "package": "@nifrajs/web",
-    "signature": "export interface CreateWebAppOptions {\n    readonly adapter: RenderAdapter;\n    readonly manifest: Manifest;\n    /** URL of the built client entry (module script) injected into every page. */\n    readonly clientEntry: string;\n    /** Default document title for all pages. */\n    readonly title?: string;\n    /** Injected into each loader's `ctx.api` — typically an `inProcessClient(app)` (typed\n     * per-route via `@nifrajs/client`'s `createRoutes`). Opaque to the core.\n     *\n     * **Auto-mount.** When `api` exposes a callable `.fetch(url, init)` (every `inProcessClient(backend)`\n     * does — see {@link isMountableApi}), `createWebApp` also serves that backend over HTTP at\n     * {@link apiPrefix} (default `/api`): a request whose pathname starts with the prefix is dispatched\n     * straight to `api.fetch(req.url, req)` before page routing, and the backend's `Response` is returned\n     * untouched. This closes the reported gap where `POST /api/sync` / `/api/auth/*` 404/405'd against the\n     * page router until the app author hand-wrote an `if (pathname.startsWith(\"/api/\")) …` branch in\n     * `server-bun.ts`. The mount runs in `nifra dev` too (the Vite dev server dispatches every request\n     * through this same app). Pass `apiPrefix: \"\"` to disable it (pages-only). */\n    readonly api?: unknown;\n    /** HTTP path prefix the {@link api} backend is auto-mounted at (default `\"/api\"`). A request whose\n     * pathname is exactly the prefix or starts with `prefix + \"/\"` is dispatched to the backend before\n     * page routing; the backend therefore defines its routes at the **full** path (`server().post(\"/api/\n     * sync\", …)`), matching the in-process `inProcessClient` call sites. Set to `\"\"` to disable the\n     * auto-mount entirely (the app serves pages only and `api` stays a loader-only `ctx.api`). Mounting\n     * is also a no-op when `api` has no callable `.fetch` (e.g. a plain object passed as `ctx.api`). */\n    readonly apiPrefix?: string;\n    /** Secret for **draft / preview mode** (see `enableDraft`). When set, a request carrying a valid\n     * signed `__nifra_draft` cookie gets `ctx.draft === true` in loaders/actions (else always `false`).\n     * Pair with `withISR({ draftSecret })` so editors bypass the cache. Omit to disable draft mode. */\n    readonly draftSecret?: string;\n    /** Per-route chunk URLs (`buildClient`'s `BuildManifest.routes`) — `routeId → [layout chunks…, own\n     * chunk]`. When present, each page `modulepreload`s its matched route's chunks alongside the entry,\n     * so the route code downloads in parallel (no entry→route-chunk waterfall). Omit ⇒ entry-only. */\n    readonly routePreload?: Readonly<Record<string, readonly string[]>>;\n    /** The app's bundled stylesheet URLs (`buildClient`'s `BuildManifest.css`) — the aggregate, injected\n     * as `<link rel=\"stylesheet\">` in a page's `<head>`. Used as the fallback for any route absent from\n     * {@link routeStyles}. Omit ⇒ no links (dev, where Vite injects CSS, or a CSS-free app). */\n    readonly styles?: readonly string[];\n    /** Per-route stylesheet URLs (`buildClient`'s `BuildManifest.routeStyles`) — `routeId → [chain CSS]`.\n     * When a matched route has an entry here, only those (its layout chain + own CSS) are linked instead\n     * of the aggregate `styles`, so a page ships only the CSS it uses. An empty array ⇒ no `<link>` (the\n     * page imports no CSS). Routes absent here fall back to `styles`. Omit ⇒ always use `styles`. */\n    readonly routeStyles?: Readonly<Record<string, readonly string[]>>;\n    /** SSG: the prerendered-path set (e.g. from `enumeratePrerenderedPaths` or the build's\n     * `prerendered.json`). Injected as `window.__NIFRA_PRERENDERED__` on every page so a client soft-nav\n     * into a prerendered route fetches its static `_data.json` instead of hitting the worker. */\n    readonly prerenderedPaths?: readonly string[];\n    /** SSG: per dynamic route pattern, its `getStaticPaths` `fallback` (from `enumerateStaticRoutes` or\n     * the build's `prerendered.json`). A route mapped to `\"404\"` rejects any path NOT in\n     * `prerenderedPaths` with the 404 page — the unlisted path simply doesn't exist. `\"ssr\"` (the\n     * default for unmapped routes) renders unlisted paths on-demand. */\n    readonly staticFallbacks?: Readonly<Record<string, \"ssr\" | \"404\">>;\n    /** Observe every loader/action failure — for error-reporting plugins (Sentry-style). Called for\n     * real throws (not control-flow `Response`s like `redirect`), **before** the nearest `_error`\n     * boundary renders / a soft-nav 500 / a rethrow — so it sees errors that the boundary would\n     * otherwise hide. Observation only; its own throws are swallowed so a faulty reporter can't break\n     * rendering. (`beforeLoader` is intentionally omitted — the core HTTP hooks already cover\n     * pre-request work.) */\n    readonly onLoaderError?: (error: unknown, ctx: {\n        readonly request: Request;\n        readonly params: Readonly<Record<string, string>>;\n        readonly route: string;\n    }) => void;\n}"
+    "signature": "export interface CreateWebAppOptions {\n    readonly adapter: RenderAdapter;\n    readonly manifest: Manifest;\n    /** URL of the built client entry (module script) injected into every page. */\n    readonly clientEntry: string;\n    /** Default document title for all pages. */\n    readonly title?: string;\n    /** Injected into each loader's `ctx.api` — typically an `inProcessClient(app)` (typed\n     * per-route via `@nifrajs/client`'s `createRoutes`). Opaque to the core.\n     *\n     * **Auto-mount.** Every `inProcessClient(backend)` exposes the symbol-keyed platform-aware backend\n     * mount interface from `@nifrajs/core/mount`; `createWebApp` also serves that backend over HTTP at\n     * {@link apiPrefix} (default `/api`): a request whose pathname starts with the prefix is dispatched\n     * before page routing with the same `env`/`waitUntil` platform context, and the backend's `Response`\n     * is returned untouched. Legacy custom `.fetch(url, init)` bridges remain mountable but cannot\n     * receive platform context. The mount runs in `nifra dev` too. Pass `apiPrefix: \"\"` to disable it. */\n    readonly api?: unknown;\n    /** HTTP path prefix the {@link api} backend is auto-mounted at (default `\"/api\"`). A request whose\n     * pathname is exactly the prefix or starts with `prefix + \"/\"` is dispatched to the backend before\n     * page routing; the backend therefore defines its routes at the **full** path (`server().post(\"/api/\n     * sync\", …)`), matching the in-process `inProcessClient` call sites. Set to `\"\"` to disable the\n     * auto-mount entirely (the app serves pages only and `api` stays a loader-only `ctx.api`). Mounting\n     * is also a no-op when `api` has neither the symbol mount nor a legacy callable `.fetch`. */\n    readonly apiPrefix?: string;\n    /** Secret for **draft / preview mode** (see `enableDraft`). When set, a request carrying a valid\n     * signed `__nifra_draft` cookie gets `ctx.draft === true` in loaders/actions (else always `false`).\n     * Pair with `withISR({ draftSecret })` so editors bypass the cache. Omit to disable draft mode. */\n    readonly draftSecret?: string;\n    /** Per-route chunk URLs (`buildClient`'s `BuildManifest.routes`) — `routeId → [layout chunks…, own\n     * chunk]`. When present, each page `modulepreload`s its matched route's chunks alongside the entry,\n     * so the route code downloads in parallel (no entry→route-chunk waterfall). Omit ⇒ entry-only. */\n    readonly routePreload?: Readonly<Record<string, readonly string[]>>;\n    /** The app's bundled stylesheet URLs (`buildClient`'s `BuildManifest.css`) — the aggregate, injected\n     * as `<link rel=\"stylesheet\">` in a page's `<head>`. Used as the fallback for any route absent from\n     * {@link routeStyles}. Omit ⇒ no links (dev, where Vite injects CSS, or a CSS-free app). */\n    readonly styles?: readonly string[];\n    /** Per-route stylesheet URLs (`buildClient`'s `BuildManifest.routeStyles`) — `routeId → [chain CSS]`.\n     * When a matched route has an entry here, only those (its layout chain + own CSS) are linked instead\n     * of the aggregate `styles`, so a page ships only the CSS it uses. An empty array ⇒ no `<link>` (the\n     * page imports no CSS). Routes absent here fall back to `styles`. Omit ⇒ always use `styles`. */\n    readonly routeStyles?: Readonly<Record<string, readonly string[]>>;\n    /** SSG: the prerendered-path set (e.g. from `enumeratePrerenderedPaths` or the build's\n     * `prerendered.json`). Injected as `window.__NIFRA_PRERENDERED__` on every page so a client soft-nav\n     * into a prerendered route fetches its static `_data.json` instead of hitting the worker. */\n    readonly prerenderedPaths?: readonly string[];\n    /** SSG: per dynamic route pattern, its `getStaticPaths` `fallback` (from `enumerateStaticRoutes` or\n     * the build's `prerendered.json`). A route mapped to `\"404\"` rejects any path NOT in\n     * `prerenderedPaths` with the 404 page — the unlisted path simply doesn't exist. `\"ssr\"` (the\n     * default for unmapped routes) renders unlisted paths on-demand. */\n    readonly staticFallbacks?: Readonly<Record<string, \"ssr\" | \"404\">>;\n    /** Observe every loader/action failure — for error-reporting plugins (Sentry-style). Called for\n     * real throws (not control-flow `Response`s like `redirect`), **before** the nearest `_error`\n     * boundary renders / a soft-nav 500 / a rethrow — so it sees errors that the boundary would\n     * otherwise hide. Observation only; its own throws are swallowed so a faulty reporter can't break\n     * rendering. (`beforeLoader` is intentionally omitted — the core HTTP hooks already cover\n     * pre-request work.) */\n    readonly onLoaderError?: (error: unknown, ctx: {\n        readonly request: Request;\n        readonly params: Readonly<Record<string, string>>;\n        readonly route: string;\n    }) => void;\n}"
   },
   {
     "name": "CronError",
@@ -1284,6 +1922,13 @@
     "package": "create-nifra",
     "signature": "export declare const CURSOR_MCP_JSON_PATH = \".cursor/mcp.json\";"
   },
+  {
+    "name": "DATA_CLASSIFICATION_RANK",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const DATA_CLASSIFICATION_RANK: Readonly<Record<DataClassification, number>>;",
+    "doc": "/** Total order over classifications; higher = more sensitive. */"
+  },
   {
     "name": "DATA_GLOBAL",
     "kind": "const",
@@ -1298,6 +1943,13 @@
     "signature": "export declare const DATA_HEADER = \"x-nifra-data\";",
     "doc": "/**\n * Request header that asks a nifra route's GET to return just the loader data as JSON (instead of\n * the full HTML document). Set by client-side navigation; read by `createWebApp`'s GET handler.\n */"
   },
+  {
+    "name": "DataClassification",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type DataClassification = \"public\" | \"pii\" | \"secret\";",
+    "doc": "/** Sensitivity of the data a response carries. Ordered `public` < `pii` < `secret`. */"
+  },
   {
     "name": "dataFileFor",
     "kind": "function",
@@ -1330,6 +1982,50 @@
     "package": "create-nifra",
     "signature": "export interface DbPreset {\n    /** Human label for messages, e.g. \"Drizzle + libSQL\". */\n    readonly label: string;\n    /** Which ORM/query-layer this preset wires (its query idiom + migration story differ). */\n    readonly orm: Orm;\n    /** SQL dialect, for the auth adapter's `provider` mapping. */\n    readonly dialect: \"postgres\" | \"sqlite\";\n    /** One-line runtime-fit note (next-steps message + AGENTS.md). */\n    readonly note: string;\n    readonly deps: Readonly<Record<string, string>>;\n    readonly devDeps: Readonly<Record<string, string>>;\n    readonly scripts: Readonly<Record<string, string>>;\n    /** Relative path → file contents to write into the scaffolded app. */\n    readonly files: Readonly<Record<string, string>>;\n}"
   },
+  {
+    "name": "DeadlineAdmission",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type DeadlineAdmission = {\n    readonly ok: true;\n    readonly inherited: boolean;\n    readonly timeoutMs: number;\n    /** Absent only for the unbounded no-header/no-local-timeout case. */\n    readonly deadline?: number;\n} | {\n    readonly ok: false;\n    readonly status: 400 | 408;\n    readonly reason: \"malformed_deadline\" | \"deadline_exceeded\";\n};"
+  },
+  {
+    "name": "DeadlineAdmissionOptions",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface DeadlineAdmissionOptions {\n    /** Local request timeout. `0` keeps requests without a wire deadline unbounded. */\n    readonly localTimeoutMs?: number;\n    /** Hard cap for a request carrying the wire header. Default 30 seconds. */\n    readonly maxInboundDeadlineMs?: number;\n    /** Injected wall clock for deterministic admission tests. */\n    readonly wallNow?: () => number;\n}"
+  },
+  {
+    "name": "DeadlineExceededError",
+    "kind": "class",
+    "package": "@nifrajs/core",
+    "signature": "export declare class DeadlineExceededError extends Error {\n    readonly remainingMs: number;\n    readonly requiredMs: number;\n    readonly code: \"NIFRA_DEADLINE_EXCEEDED\";\n    readonly status: 504;\n    constructor(remainingMs: number, requiredMs: number);\n}"
+  },
+  {
+    "name": "DeadlineHeaderResult",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type DeadlineHeaderResult = {\n    readonly ok: true;\n    readonly deadline: number;\n} | {\n    readonly ok: false;\n    readonly reason: \"missing\" | \"malformed\";\n};"
+  },
+  {
+    "name": "DeadlineHeadersInit",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type DeadlineHeadersInit = Headers | Readonly<Record<string, string>> | [string, string][] | undefined;",
+    "doc": "/** DOM-lib-independent subset accepted by the Web `Headers` constructor. */"
+  },
+  {
+    "name": "declarationApplies",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function declarationApplies(declaration: AssuranceDeclaration, method: string, path: string): boolean;"
+  },
+  {
+    "name": "declaredCapabilities",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function declaredCapabilities(context: object): readonly string[];",
+    "doc": "/**\n * Read the route's token-only declaration for admission plugins. This intentionally exposes neither\n * the request nor runtime evidence; it is the stable public seam for private entitlement policy.\n */"
+  },
   {
     "name": "decodeBase64",
     "kind": "function",
@@ -1350,6 +2046,12 @@
     "signature": "export interface DecodedImage {\n    /** RGBA bytes, length `width * height * 4`. */\n    readonly data: Uint8Array;\n    readonly width: number;\n    readonly height: number;\n}",
     "doc": "/** A decoded image: RGBA pixels + dimensions — the lingua franca of WASM codecs (jSquash, Photon, …). */"
   },
+  {
+    "name": "DEFAULT_ASSURANCE_CONFIG",
+    "kind": "const",
+    "package": "@nifrajs/cli",
+    "signature": "export declare const DEFAULT_ASSURANCE_CONFIG = \"nifra.assurance.ts\";"
+  },
   {
     "name": "DEFAULT_DEV_PORT",
     "kind": "const",
@@ -1357,6 +2059,33 @@
     "signature": "export declare const DEFAULT_DEV_PORT = 4321;",
     "doc": "/**\n * The single default port for the dev server (`@nifrajs/web/dev`, `@nifrajs/web/vite`) **and**\n * `nifra start`. Deliberately uncommon: `3000`/`5173`/`8080` collide with whatever else is running\n * (Next, Vite, a stray Node API). `4321` rarely is — and being the *same* constant across `nifra dev`\n * and `nifra start` means a project's URL doesn't change between commands. Override per-run with\n * `--port <n>` or the `PORT` env var. */"
   },
+  {
+    "name": "DEFAULT_IDEMPOTENCY_HEADER",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const DEFAULT_IDEMPOTENCY_HEADER = \"idempotency-key\";",
+    "doc": "/** Canonical request header carrying the client-chosen idempotency key. */"
+  },
+  {
+    "name": "DEFAULT_IDEMPOTENCY_TTL_MS",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const DEFAULT_IDEMPOTENCY_TTL_MS = 86400000;",
+    "doc": "/** Default retention for a stored idempotent response: 24 hours. */"
+  },
+  {
+    "name": "DEFAULT_MANIFEST_FILE",
+    "kind": "const",
+    "package": "@nifrajs/cli",
+    "signature": "export declare const DEFAULT_MANIFEST_FILE = \"nifra.manifest.json\";"
+  },
+  {
+    "name": "DEFAULT_MAX_ENTRIES",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const DEFAULT_MAX_ENTRIES = 1000;",
+    "doc": "/** Per-request entry bound. Generous for real handlers, small enough to stop a runaway loop. */"
+  },
   {
     "name": "DEFAULT_SNAPSHOT_FILE",
     "kind": "const",
@@ -1391,6 +2120,27 @@
     "signature": "export declare const DEFERRED_RUNTIME = \"(() => {\\n  const reg = new Map();\\n  const get = (id) => {\\n    let e = reg.get(id);\\n    if (!e) {\\n      let r, j;\\n      const p = new Promise((a, b) => { r = a; j = b; });\\n      // <Await> reads the tagged status/reason synchronously (it never .then()s a rejected promise),\\n      // so attach a no-op catch to keep a rejection from surfacing as an unhandled rejection.\\n      p.catch(() => {});\\n      e = { p, r, j };\\n      reg.set(id, e);\\n    }\\n    return e;\\n  };\\n  window.__nifraDeferred = (id) => get(id).p;\\n  // Tag the promise (status/value/reason) \\u2014 React's use() reads them and returns SYNCHRONOUSLY at\\n  // hydration, so it renders the resolved content directly into the <Suspense> boundary the server\\n  // streamed (no re-suspend, no fallback flash). r/j also wake awaiters (Solid uses its own _$HY).\\n  window.__nifraResolve = (id, v) => { const e = get(id); e.p.status = \\\"fulfilled\\\"; e.p.value = v; e.r(v); };\\n  window.__nifraReject = (id, x) => { const e = get(id); e.p.status = \\\"rejected\\\"; e.p.reason = x; e.j(x); };\\n})();\";",
     "doc": "/**\n * Inline client runtime injected into the shell `<head>` when a page has deferred data: a per-id\n * promise registry that streamed `__nifraResolve(id, value)` / `__nifraReject(id, err)` scripts settle\n * (created lazily, so a resolve script that arrives before the client maps the placeholder still\n * works), plus `__nifraDeferred(id)` to read the promise. A plain inline script (not the deferred\n * module entry), so it runs before any streamed resolve script.\n */"
   },
+  {
+    "name": "defineAssuranceConfig",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function defineAssuranceConfig(config: AssuranceConfig): AssuranceConfig;",
+    "doc": "/** Identity helper for a `nifra.assurance.ts` default export. */"
+  },
+  {
+    "name": "defineAssurancePolicy",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy;",
+    "doc": "/** Validate and freeze an ordered assurance policy. */"
+  },
+  {
+    "name": "defineCapabilityPolicy",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function defineCapabilityPolicy(policy: CapabilityPolicy): CapabilityPolicy;",
+    "doc": "/** Validate and freeze a capability/provenance policy. */"
+  },
   {
     "name": "defineContract",
     "kind": "function",
@@ -1411,6 +2161,13 @@
     "package": "@nifrajs/env",
     "signature": "export interface DefineEnvOptions {\n    /**\n     * Where to read variables from. Defaults to `process.env` (Bun/Node). On Cloudflare Workers there\n     * is no `process.env` — pass the request's `env` bindings: `defineEnv(shape, { source: env })`.\n     */\n    readonly source?: Record<string, string | undefined>;\n}"
   },
+  {
+    "name": "defineEventContract",
+    "kind": "function",
+    "package": "@nifrajs/events",
+    "signature": "export declare function defineEventContract<Schema extends StandardSchemaV1>(spec: {\n    type: string;\n    version: number;\n    payload: Schema;\n}): EventContract<Schema>;",
+    "doc": "/** Define a portable, versioned event contract. */"
+  },
   {
     "name": "defineIdentityPlugin",
     "kind": "function",
@@ -1428,7 +2185,7 @@
     "name": "DefineMcpToolOptions",
     "kind": "interface",
     "package": "@nifrajs/mcp",
-    "signature": "export interface DefineMcpToolOptions {\n    readonly name: string;\n    readonly description: string;\n    /** JSON Schema for the arguments. Defaults to an empty object schema. */\n    readonly inputSchema?: Record<string, unknown>;\n    /** Link a widget so the tool's result renders as interactive UI in MCP Apps hosts (iframe). */\n    readonly widget?: McpWidget;\n    /** Render-intent for generative hosts that build their own themed UI from `structuredContent`. Lands\n     * in `_meta.ui.intent`. Independent of `widget` — a tool can offer both (widget for MCP Apps hosts,\n     * intent for builders like ShipNow). */\n    readonly intent?: McpUiIntent;\n    readonly handler: (args: Record<string, unknown>, context: McpToolContext) => McpToolHandlerResult | Promise<McpToolHandlerResult>;\n}"
+    "signature": "export interface DefineMcpToolOptions {\n    readonly name: string;\n    readonly description: string;\n    /** JSON Schema for the arguments. Defaults to an empty object schema. */\n    readonly inputSchema?: Record<string, unknown>;\n    /** Link a widget so the tool's result renders as interactive UI in MCP Apps hosts (iframe). */\n    readonly widget?: McpWidget;\n    /** Render-intent for generative hosts that build their own themed UI from `structuredContent`. Lands\n     * in `_meta.ui.intent`. Independent of `widget` — a tool can offer both (widget for MCP Apps hosts,\n     * intent for generative builders). */\n    readonly intent?: McpUiIntent;\n    readonly handler: (args: Record<string, unknown>, context: McpToolContext) => McpToolHandlerResult | Promise<McpToolHandlerResult>;\n}"
   },
   {
     "name": "defineMcpWidget",
@@ -1456,6 +2213,13 @@
     "signature": "export declare const defineRouterPlugin: typeof defineIdentityPlugin;",
     "doc": "/**\n * Alias of {@link defineIdentityPlugin} with a name that says what it's FOR: a plugin that **mounts\n * routes/hooks but adds no context type** (an auth router, an audit logger). Use this — not\n * {@link definePlugin} — for any such plugin, or the typed client silently collapses to `any`. The\n * \"identity\" in {@link defineIdentityPlugin} refers to the type-identity it preserves; `defineRouterPlugin`\n * is the same thing under a clearer name.\n *\n * Mount routes as a **side effect**, then return the app unchanged (registering via `.get`/`.post` would\n * change the type away from the identity `S`; the mounted routes run but aren't in the caller's typed\n * registry — that's the trade that keeps everything else typed):\n *\n * ```ts\n * export const scim = defineRouterPlugin(\"scim\", (app) => {\n *   app.get(\"/scim/v2/Users\", listUsers) // side effect: mounted at runtime\n *   return app                           // return S unchanged → routes added after .use(scim) stay typed\n * })\n * const api = server().get(\"/a\", h).use(scim).get(\"/b\", h) // /a AND /b stay typed\n * ```\n */"
   },
+  {
+    "name": "DehydratedState",
+    "kind": "interface",
+    "package": "@nifrajs/web",
+    "signature": "export interface DehydratedState {\n    readonly queries: ReadonlyArray<{\n        readonly key: unknown;\n        readonly data: unknown;\n        readonly updatedAt: number;\n    }>;\n}",
+    "doc": "/** A serializable snapshot of the cache's successful queries — the SSR→client bridge payload. */"
+  },
   {
     "name": "describeProject",
     "kind": "function",
@@ -1557,6 +2321,13 @@
     "package": "@nifrajs/devtools",
     "signature": "export interface DevToolsOptions {\n    /** Maximum events to retain in the ring buffer (default 200). */\n    readonly maxEvents?: number | undefined;\n    /** Maximum simultaneous SSE connections (default 5). */\n    readonly maxConnections?: number | undefined;\n    /** SSE path (default `/_nifra/devtools`). */\n    readonly path?: string | undefined;\n    /** Explicit enable switch. Defaults to true only when `NODE_ENV === \"development\"`. */\n    readonly enabled?: boolean | undefined;\n    /** Permit non-loopback URL hosts. Default false. */\n    readonly allowRemote?: boolean | undefined;\n    /** Additional origins permitted to open the stream. Same-origin requests are always allowed. */\n    readonly allowedOrigins?: readonly string[] | undefined;\n    /** Optional request authorization for the stream. */\n    readonly authorize?: ((request: Request) => boolean | Promise<boolean>) | undefined;\n    /**\n     * Interval for SSE keep-alive comment frames, in milliseconds (default 15000). Pings stop\n     * idle proxies/dev tunnels from dropping the stream and evict dead connections so they no\n     * longer count against `maxConnections`.\n     */\n    readonly pingIntervalMs?: number | undefined;\n}"
   },
+  {
+    "name": "diffCapabilitySnapshots",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function diffCapabilitySnapshots(before: CapabilitySnapshot, after: CapabilitySnapshot): readonly string[];",
+    "doc": "/** Exact lockfile drift. Human approval is supplied by reviewing the checked-in lockfile change. */"
+  },
   {
     "name": "diffManifestRoutes",
     "kind": "function",
@@ -1564,6 +2335,13 @@
     "signature": "export declare function diffManifestRoutes(manifestFiles: readonly string[], discoveredFiles: readonly string[]): ManifestDrift;",
     "doc": "/**\n * Diff the route files a committed server-manifest imports against the files freshly discovered in\n * `routes/`. Returns the `missing` (in routes/, not in manifest — stale manifest) and `extra` (in\n * manifest, gone from routes/ — dangling import) sets. Empty arrays ⇒ in sync. Pure — the caller\n * supplies both file lists (the committed source is parsed via {@link parseManifestRouteFiles}; the\n * fresh list comes from `discoverRoutes`). Lists need not be pre-sorted; the result is sorted.\n */"
   },
+  {
+    "name": "diffNifraManifests",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function diffNifraManifests(before: NifraManifest, after: NifraManifest): NifraManifestDiff;",
+    "doc": "/** Contract changes reuse the route-diff engine; governance changes fail closed on expanded risk. */"
+  },
   {
     "name": "diffRouteSnapshots",
     "kind": "function",
@@ -1678,6 +2456,69 @@
     "signature": "export declare function effect(fn: () => void): () => void;",
     "doc": "/**\n * Run `fn` now and again whenever any signal it read changes. Returns a disposer. Dependencies\n * re-track on every run, so conditional reads subscribe to exactly the live branch.\n */"
   },
+  {
+    "name": "EffectChain",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface EffectChain {\n    /** `hashes[i]` = SHA-256(hex) over (`hashes[i-1]` + canonical entry `i`). */\n    readonly hashes: readonly string[];\n    /** Last entry hash, or the route-header hash for an empty ledger. Anchor/sign this externally. */\n    readonly head: string;\n}",
+    "doc": "/** Tamper-evidence over the route identity, declarations, and sealed entries. */"
+  },
+  {
+    "name": "EffectCost",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type EffectCost = Readonly<Record<string, number>>;",
+    "doc": "/**\n * Dimensionless resource counters (`{ ms: 12, calls: 1, bytes: 512 }`). Counters carry *how much\n * resource* an effect consumed; mapping counters to money/pricing is deliberately out of scope here.\n */"
+  },
+  {
+    "name": "EffectEntry",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface EffectEntry {\n    /** Monotonic position within the request (0-based). The replay/simulation order. */\n    readonly seq: number;\n    /** Milliseconds from the ledger's (injectable) clock at append time. */\n    readonly at: number;\n    readonly capability: string;\n    readonly phase: EffectPhase;\n    readonly target?: string;\n    readonly cost?: EffectCost;\n    readonly digest?: string;\n    readonly error?: {\n        readonly code: string;\n    };\n}",
+    "doc": "/** One recorded effect. Frozen; token-only by construction (no payload field exists). */"
+  },
+  {
+    "name": "EffectEntryInput",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface EffectEntryInput {\n    /** Capability token (`db.write`, `payments.charge`). Must be a valid capability id. */\n    readonly capability: string;\n    /** Default `\"intent\"`. Record `committed`/`failed`/`compensated` only after the outcome is known. */\n    readonly phase?: EffectPhase;\n    /** Adapter/resource token (`repo:orders`, `provider:payments`). A token — never a value or a row. */\n    readonly target?: string;\n    /** Dimensionless counters; see {@link EffectCost}. At most {@link MAX_COST_AXES} axes. */\n    readonly cost?: EffectCost;\n    /** Optional keyed-HMAC digest of the effect payload (see {@link computeEffectDigest}); hex, 64 chars. */\n    readonly digest?: string;\n    /** Outcome error as a bounded token code — never a message, never a stack. */\n    readonly error?: {\n        readonly code: string;\n    };\n}",
+    "doc": "/** Caller-supplied fields for one entry. Everything else (`seq`, `at`) is assigned by the ledger. */"
+  },
+  {
+    "name": "effectLedgerOf",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function effectLedgerOf(context: object): RequestLedger | undefined;",
+    "doc": "/** The request's effect ledger, when the server enabled one for this route. Read-only access. */"
+  },
+  {
+    "name": "EffectLedgerOptions",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface EffectLedgerOptions {\n    /** Receives each request's sealed ledger (only when it recorded entries). */\n    readonly sink: LedgerSink;\n    /** Per-request entry bound. Default {@link DEFAULT_MAX_ENTRIES}. */\n    readonly maxEntries?: number;\n    /** Compute the tamper-evident hash chain at seal. Default false. */\n    readonly chain?: boolean;\n}",
+    "doc": "/** Server-level effect ledger configuration (see `server({ effectLedger })`). */"
+  },
+  {
+    "name": "EffectLedgerOverflowError",
+    "kind": "class",
+    "package": "@nifrajs/core",
+    "signature": "export declare class EffectLedgerOverflowError extends Error {\n    readonly maxEntries: number;\n    constructor(maxEntries: number);\n}",
+    "doc": "/** Thrown by `append` when the per-request entry bound is exceeded. Fails the request closed. */"
+  },
+  {
+    "name": "EffectLedgerSealedError",
+    "kind": "class",
+    "package": "@nifrajs/core",
+    "signature": "export declare class EffectLedgerSealedError extends Error {\n    constructor();\n}",
+    "doc": "/** Thrown by `append` after `seal()` — e.g. an effect attempted while streaming a response body. */"
+  },
+  {
+    "name": "EffectPhase",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type EffectPhase = \"intent\" | \"committed\" | \"failed\" | \"compensated\";",
+    "doc": "/** Lifecycle phase of one effect. `intent` precedes execution; the rest describe its outcome. */"
+  },
   {
     "name": "EMPTY_PARAMS",
     "kind": "const",
@@ -1827,6 +2668,52 @@
     "package": "@nifrajs/middleware",
     "signature": "export interface ETagOptions {\n    /** Emit a weak validator (`W/\"…\"`). Default `true` — it's a content hash, not a byte-for-byte promise. */\n    readonly weak?: boolean;\n    /** Maximum response bytes to hash. Default `1_000_000`; larger responses pass through unchanged. */\n    readonly maxBytes?: number;\n}"
   },
+  {
+    "name": "evaluateCapabilityAssurance",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function evaluateCapabilityAssurance(source: unknown, policyInput: CapabilityPolicy, evidenceSet: CapabilityEvidenceSet): CapabilityAssuranceReport;",
+    "doc": "/** Compare declared route capabilities against coverage-qualified static/runtime evidence. */"
+  },
+  {
+    "name": "evaluateRouteAssurance",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function evaluateRouteAssurance(source: unknown, policyInput: AssurancePolicy): AssuranceReport;",
+    "doc": "/** Evaluate reflected route evidence against the first matching policy rule. */"
+  },
+  {
+    "name": "EventContract",
+    "kind": "interface",
+    "package": "@nifrajs/events",
+    "signature": "export interface EventContract<Schema extends StandardSchemaV1 = StandardSchemaV1> {\n    readonly type: string;\n    readonly version: number;\n    readonly payload: Schema;\n    /**\n     * Validate a payload and stamp a full envelope (`id`, `occurredAt`). Throws {@link EventContractError}\n     * on an invalid payload. Sync validators only — an async schema throws (use a sync payload schema for\n     * events; the whole point is a cheap boundary check).\n     */\n    create(payload: InferInput<Schema>, options?: {\n        id?: string;\n        occurredAt?: string;\n    }): EventEnvelope<InferOutput<Schema>>;\n    /** Parse untrusted input against this exact contract (type + version + payload). Never throws. */\n    parse(input: unknown): EventParseResult<InferOutput<Schema>>;\n    /** Boolean guard form of {@link parse}. */\n    is(input: unknown): input is EventEnvelope<InferOutput<Schema>>;\n}"
+  },
+  {
+    "name": "EventContractError",
+    "kind": "class",
+    "package": "@nifrajs/events",
+    "signature": "export declare class EventContractError extends Error {\n    readonly type: string;\n    readonly version: number;\n    readonly issues: readonly StandardIssue[];\n    constructor(type: string, version: number, issues: readonly StandardIssue[]);\n}",
+    "doc": "/** Thrown by {@link EventContract.create} when the payload fails the contract schema. */"
+  },
+  {
+    "name": "EventEnvelope",
+    "kind": "interface",
+    "package": "@nifrajs/events",
+    "signature": "export interface EventEnvelope<Payload = unknown> {\n    /** Unique event id (`evt_<uuid>`), stable across redeliveries. */\n    readonly id: string;\n    /** Event type name, e.g. `order.paid`. */\n    readonly type: string;\n    /** Contract version. Bump on a breaking payload change; old + new versions coexist in a registry. */\n    readonly version: number;\n    /** ISO-8601 instant the event occurred. */\n    readonly occurredAt: string;\n    readonly payload: Payload;\n}",
+    "doc": "/** The portable wire shape: identity + versioned type + timestamp + validated payload. */"
+  },
+  {
+    "name": "EventParseResult",
+    "kind": "type",
+    "package": "@nifrajs/events",
+    "signature": "export type EventParseResult<Payload> = {\n    readonly success: true;\n    readonly envelope: EventEnvelope<Payload>;\n} | {\n    readonly success: false;\n    readonly issues: readonly StandardIssue[];\n};"
+  },
+  {
+    "name": "EventRegistry",
+    "kind": "interface",
+    "package": "@nifrajs/events",
+    "signature": "export interface EventRegistry {\n    readonly contracts: readonly EventContract[];\n    /** Look up a contract by type + version (defaults to version 0). */\n    get(type: string, version?: number): EventContract | undefined;\n    /** Dispatch untrusted input to its contract by `type`/`version` and parse. Never throws. */\n    parse(input: unknown): RegistryParseResult;\n}"
+  },
   {
     "name": "Evidence",
     "kind": "interface",
@@ -2086,6 +2973,18 @@
     "package": "@nifrajs/web",
     "signature": "export interface FontSource {\n    /** URL of the self-hosted font file. */\n    readonly url: string;\n    /** `format()` hint (`woff2`, `woff`, `truetype`, …). Inferred from the URL extension when omitted. */\n    readonly format?: string;\n}"
   },
+  {
+    "name": "ForbiddenCapabilityImport",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface ForbiddenCapabilityImport {\n    /** Exact module specifier, or a trailing `/*` prefix rule. */\n    readonly specifier: string;\n    readonly reason: string;\n}"
+  },
+  {
+    "name": "formatAssuranceReport",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function formatAssuranceReport(report: AssuranceReport): string;"
+  },
   {
     "name": "formatBytes",
     "kind": "function",
@@ -2100,6 +2999,12 @@
     "signature": "export declare function formatDiff(diff: RoutesDiff): string;",
     "doc": "/** Render a diff for terminals: breaking first, then info, then compatible. */"
   },
+  {
+    "name": "formatManifestDiff",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function formatManifestDiff(diff: NifraManifestDiff): string;"
+  },
   {
     "name": "formatManifestDrift",
     "kind": "function",
@@ -2206,6 +3111,19 @@
     "signature": "export declare function generateMockValue(schema: unknown, fieldName?: string | undefined, rng?: (() => number) | undefined): unknown;",
     "doc": "/**\n * Generate a mock value from a schema object. Inspects JSON Schema properties\n * (`type`, `properties`, `items`, `enum`, `format`) that TypeBox / NifraSchema\n * objects carry directly. Unsupported constraints fail closed with\n * {@link UnsupportedMockSchemaError} rather than returning a known-invalid response.\n *\n * @param schema  A JSON-Schema-shaped object (TypeBox, NifraSchema, or raw JSON Schema)\n * @param fieldName  Optional field name hint for generating contextual string values\n * @param rng  Optional seeded random function for deterministic output\n */"
   },
+  {
+    "name": "generateRegressionTest",
+    "kind": "function",
+    "package": "@nifrajs/testing",
+    "signature": "export declare function generateRegressionTest(capsule: IncidentCapsule, options?: GenerateRegressionTestOptions): string;",
+    "doc": "/**\n * Emit a committable regression test from a capsule. Request string values are redacted BY DEFAULT with\n * a sanitize banner — replace the `<redacted>` placeholders with safe, reproducing values before you\n * commit. The test asserts the response contract via {@link assertIncidentReplays}.\n */"
+  },
+  {
+    "name": "GenerateRegressionTestOptions",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface GenerateRegressionTestOptions {\n    /** Import specifier for the app under test. Default `\"../src/app\"`. */\n    readonly importPath?: string;\n    /** Named export of the app. Default `\"app\"`. */\n    readonly appExport?: string;\n    /** Also assert the response shape. Default false (status-only is the robust regression signal). */\n    readonly assertShape?: boolean;\n    /** Dotted key paths in the request body whose string values are safe to embed verbatim. */\n    readonly allow?: readonly string[];\n}"
+  },
   {
     "name": "generateServerEntry",
     "kind": "function",
@@ -2240,6 +3158,13 @@
     "signature": "export declare function generateTraceId(): string;",
     "doc": "/** A fresh 16-byte (32-hex) trace id. */"
   },
+  {
+    "name": "getBrowserNavigate",
+    "kind": "function",
+    "package": "@nifrajs/web",
+    "signature": "export declare function getBrowserNavigate(): BrowserNavigate | undefined;",
+    "doc": "/** The active browser navigate, or `undefined` on the server / before `installHistory` has run. A\n * binding calls it when present and falls back to native navigation otherwise. */"
+  },
   {
     "name": "getContext",
     "kind": "function",
@@ -2247,6 +3172,12 @@
     "signature": "export declare function getContext<C extends Context = Context>(): C;",
     "doc": "/** Return the current request context, or throw when no context-storage wrapper is active. */"
   },
+  {
+    "name": "getRecipe",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function getRecipe(version: string): UpgradeRecipe | undefined;"
+  },
   {
     "name": "getSession",
     "kind": "function",
@@ -2426,6 +3357,13 @@
     "signature": "export declare function hydrate(chain: readonly unknown[], props: RenderProps, container: unknown): void;",
     "doc": "/** Hydrate a server-rendered Vue layout `chain` (with the loader `props`) inside `container`. */"
   },
+  {
+    "name": "HydrationBoundary",
+    "kind": "function",
+    "package": "@nifrajs/web-react",
+    "signature": "export declare function HydrationBoundary(props: {\n    readonly state: DehydratedState | undefined;\n    readonly children?: ReactNode;\n}): ReactNode;",
+    "doc": "/**\n * Seed the context's {@link QueryClient} from a server {@link dehydrate} snapshot — the SSR data bridge.\n * Wrap the app (inside `QueryClientProvider`) so server-prefetched queries are in the cache before the\n * first client render, avoiding a loading flash. Hydration runs during render (idempotent, fresher-wins),\n * so the data is available synchronously to child `useQuery`s.\n */"
+  },
   {
     "name": "I18nProvider",
     "kind": "function",
@@ -2485,12 +3423,51 @@
     "package": "@nifrajs/middleware",
     "signature": "export declare function idempotency(options: IdempotencyOptions): Middleware;"
   },
+  {
+    "name": "IdempotencyAbandonInput",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface IdempotencyAbandonInput extends IdempotencyEntryKey {\n    /** Opaque ownership token returned by `begin(state:\"new\")`. */\n    readonly reservation: string;\n}"
+  },
+  {
+    "name": "IdempotencyBeginInput",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface IdempotencyBeginInput extends IdempotencyEntryKey {\n    readonly fingerprint: string;\n    readonly ttlMs: number;\n}"
+  },
+  {
+    "name": "IdempotencyBeginResult",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type IdempotencyBeginResult = {\n    readonly state: \"new\";\n    readonly reservation: string;\n} | {\n    readonly state: \"replay\";\n    readonly response: StoredResponse;\n} | {\n    readonly state: \"mismatch\";\n} | {\n    readonly state: \"in-flight\";\n} | {\n    readonly state: \"capacity\";\n};",
+    "doc": "/**\n * Outcome of reserving a key. `new` → the caller runs the handler and later calls {@link\n * IdempotencyStore.complete}. `replay` → return the stored response, handler never runs. `mismatch`\n * → same key, different request fingerprint (client bug) → 409. `in-flight` → the key is reserved but\n * not yet completed (a concurrent duplicate) → 409 + Retry-After.\n */"
+  },
   {
     "name": "IdempotencyClaim",
     "kind": "type",
     "package": "@nifrajs/middleware",
     "signature": "export type IdempotencyClaim = {\n    readonly state: \"new\";\n} | {\n    readonly state: \"in_flight\";\n} | {\n    readonly state: \"replay\";\n    readonly record: IdempotencyRecord;\n};"
   },
+  {
+    "name": "IdempotencyCompletionInput",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface IdempotencyCompletionInput extends IdempotencyEntryKey {\n    /** Opaque ownership token returned by `begin(state:\"new\")`. */\n    readonly reservation: string;\n    readonly response: StoredResponse;\n}"
+  },
+  {
+    "name": "IdempotencyConfig",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface IdempotencyConfig {\n    /** `request` = in-process dedupe; `durable` = cross-restart, backed by a durable store. */\n    readonly scope: IdempotencyScope;\n    /** Retention for the stored response. Default 24h. */\n    readonly ttlMs?: number;\n    /** Store override. Defaults to the server's shared in-memory store; inject a durable store here. */\n    readonly store?: IdempotencyStore;\n    /** Header carrying the key. Default `idempotency-key`. */\n    readonly headerName?: string;\n    /** Maximum response bytes retained for replay. Defaults to the server body limit. */\n    readonly maxResponseBytes?: number;\n    /**\n     * Required server-owned key namespace. Use a tenant/subject-scoped opaque token for authenticated\n     * routes so two principals choosing the same header key never collide. A static namespace is an\n     * explicit shared/public scope and is safe only when the response is principal-independent. The\n     * resolver receives a clone and must not derive identity from unauthenticated client input.\n     */\n    readonly namespace: string | ((request: {\n        readonly method: string;\n        readonly url: string;\n        readonly headers: {\n            get(name: string): string | null;\n        };\n    }, platform: Platform | undefined) => string | Promise<string>);\n}",
+    "doc": "/**\n * Declares a mutating route as idempotent: the server dedupes retries on an `Idempotency-Key` header\n * (see {@link RouteSchema.idempotency}). Satisfies the capability-assurance idempotency requirement\n * for a request-idempotent `write` capability. Durable response replay is deliberately NOT durable-\n * command evidence: a command/provider key must still prove the side effect itself is deduplicated.\n */"
+  },
+  {
+    "name": "IdempotencyEntryKey",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface IdempotencyEntryKey {\n    readonly namespace: string;\n    readonly key: string;\n}",
+    "doc": "/** Namespaces isolate the same client key across tenants/subjects without putting identity in a header. */"
+  },
   {
     "name": "IdempotencyOptions",
     "kind": "interface",
@@ -2504,6 +3481,26 @@
     "signature": "export interface IdempotencyRecord {\n    readonly status: number;\n    /** Response headers, **excluding `Set-Cookie`** (cookies are session-specific — see {@link idempotency}). */\n    readonly headers: ReadonlyArray<readonly [string, string]>;\n    /** Response body, base64-encoded. */\n    readonly body: string;\n}",
     "doc": "/** A captured response, replayed verbatim on a retry. Body is base64 (binary-safe + JSON-serializable). */"
   },
+  {
+    "name": "IdempotencyResponseTooLargeError",
+    "kind": "class",
+    "package": "@nifrajs/core",
+    "signature": "export declare class IdempotencyResponseTooLargeError extends Error {\n    readonly maxBytes: number;\n    constructor(maxBytes: number);\n}"
+  },
+  {
+    "name": "IdempotencyScope",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type IdempotencyScope = \"request\" | \"durable\";",
+    "doc": "/** Whether a route's idempotency is satisfied by an in-process store or a durable (cross-restart) one. */"
+  },
+  {
+    "name": "IdempotencyStore",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface IdempotencyStore {\n    /**\n     * An honest durability marker. Omit/`memory` for process-local stores; a route declaring\n     * `scope: \"durable\"` rejects anything other than `durable` at registration.\n     */\n    readonly durability?: \"memory\" | \"durable\";\n    /** Reserve one namespaced key. Exactly one concurrent caller may receive `new`. */\n    begin(input: IdempotencyBeginInput): IdempotencyBeginResult | Promise<IdempotencyBeginResult>;\n    /**\n     * Persist the final response only when `reservation` still owns the key. Returns false for a stale\n     * completion (for example after expiry + re-reservation), which prevents an older request from\n     * overwriting a newer result.\n     */\n    complete(input: IdempotencyCompletionInput): boolean | Promise<boolean>;\n    /** Release only the pending reservation owned by `reservation`. */\n    abandon(input: IdempotencyAbandonInput): boolean | Promise<boolean>;\n}",
+    "doc": "/**\n * Storage seam for idempotent responses. `begin` MUST be atomic: for one key, exactly one concurrent\n * caller sees `new`; the rest see `in-flight` (or `replay` once completed). The in-memory store gets\n * this free from the single-threaded event loop; a durable store uses an atomic insert.\n */"
+  },
   {
     "name": "IdempotencyStore",
     "kind": "interface",
@@ -2511,6 +3508,13 @@
     "signature": "export interface IdempotencyStore {\n    /**\n     * Atomically claim `key`: `\"replay\"` if a completed response is stored, `\"in_flight\"` if another\n     * request holds the lock, else `\"new\"` (the caller now owns the lock and must `complete`/`release`).\n     * The in-flight lock expires after `lockTtlMs` so a crashed handler can't wedge the key forever.\n     */\n    begin(key: string, lockTtlMs: number): Promise<IdempotencyClaim>;\n    /** Store the completed response and release the lock (kept for `ttlMs`). */\n    complete(key: string, record: IdempotencyRecord, ttlMs: number): Promise<void>;\n    /** Release the lock without storing (handler errored / response not cacheable). */\n    release(key: string): Promise<void>;\n}",
     "doc": "/**\n * Store backing the idempotency guarantee. Production deploys MUST use a shared store so the key holds\n * across instances; `begin` MUST be **atomic** (e.g. Redis `SET key NX PX lockTtlMs`) or two concurrent\n * retries can both see `\"new\"`. {@link MemoryIdempotencyStore} is for dev / single-instance only.\n */"
   },
+  {
+    "name": "IDEMPOTENT_REPLAY_HEADER",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const IDEMPOTENT_REPLAY_HEADER = \"x-nifra-idempotent-replay\";",
+    "doc": "/** Header stamped on a replayed response so clients/proxies can tell a replay from a fresh run. */"
+  },
   {
     "name": "identityLoader",
     "kind": "const",
@@ -2657,12 +3661,43 @@
     "signature": "export declare function implement<const C extends ContractShape, H extends HandlersFor<C>>(contract: C, handlers: H): Server<RegistryFromImpl<C, H>>;",
     "doc": "/**\n * Bind handlers to a contract, producing a real {@link Server} you can `.listen()`\n * or `.fetch()`. Each op is registered through the same path as the inline\n * builder, so the result is identical to writing the routes inline — handlers\n * lift over **unchanged** (\"graduation\"), and body/query schemas validate at the\n * request boundary exactly as in inline mode.\n */"
   },
+  {
+    "name": "ImportChange",
+    "kind": "interface",
+    "package": "@nifrajs/cli",
+    "signature": "export interface ImportChange {\n    readonly file: string;\n    readonly from: string;\n    readonly to: string;\n    readonly count: number;\n}"
+  },
   {
     "name": "importHmacKey",
     "kind": "function",
     "package": "@nifrajs/middleware",
     "signature": "export declare function importHmacKey(secret: string | Uint8Array, hash?: string): Promise<CryptoKey>;"
   },
+  {
+    "name": "ImportMove",
+    "kind": "interface",
+    "package": "@nifrajs/cli",
+    "signature": "export interface ImportMove {\n    readonly from: string;\n    readonly to: string;\n}",
+    "doc": "/** An exact import-specifier rewrite (string-level, not AST): `from` → `to`. */"
+  },
+  {
+    "name": "IncidentCapsule",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface IncidentCapsule {\n    readonly id: string;\n    readonly capturedAt: string;\n    readonly request: CapturedRequest;\n    readonly response: {\n        readonly status: number;\n        readonly bodyShape?: unknown;\n    };\n    readonly note?: string;\n}"
+  },
+  {
+    "name": "IncidentReplayError",
+    "kind": "class",
+    "package": "@nifrajs/testing",
+    "signature": "export declare class IncidentReplayError extends Error {\n    readonly result: IncidentReplayResult;\n    readonly capsuleId: string;\n    constructor(capsule: IncidentCapsule, result: IncidentReplayResult);\n}"
+  },
+  {
+    "name": "IncidentReplayResult",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface IncidentReplayResult {\n    readonly reproduced: boolean;\n    readonly status: number;\n    readonly expectedStatus: number;\n    readonly statusMatches: boolean;\n    /** null when shape was not checked. */\n    readonly shapeMatches: boolean | null;\n}"
+  },
   {
     "name": "InferInput",
     "kind": "type",
@@ -2682,6 +3717,27 @@
     "signature": "export type InferOutput<S extends StandardSchemaV1> = NonNullable<S[\"~standard\"][\"types\"]>[\"output\"];",
     "doc": "/** Extract a Standard Schema's validated output type. */"
   },
+  {
+    "name": "InfiniteData",
+    "kind": "interface",
+    "package": "@nifrajs/web",
+    "signature": "export interface InfiniteData<T, P> {\n    readonly pages: readonly T[];\n    readonly pageParams: readonly P[];\n}",
+    "doc": "/** An infinite (paged) query's accumulated data: the fetched `pages` in order + the `pageParam` each\n * was fetched with (so the next/previous param can be derived). */"
+  },
+  {
+    "name": "InfiniteQueryHandle",
+    "kind": "interface",
+    "package": "@nifrajs/web",
+    "signature": "export interface InfiniteQueryHandle<T, P> {\n    snapshot: () => QueryState<InfiniteData<T, P>>;\n    subscribe: (listener: () => void) => () => void;\n    /** Fetch the first page when absent/stale (fresh ⇒ no-op). */\n    fetch: () => Promise<InfiniteData<T, P>>;\n    /** Refetch every currently-loaded page (in order), replacing the data. */\n    refetch: () => Promise<InfiniteData<T, P>>;\n    /** Append the next page (a no-op when `hasNextPage()` is false or a fetch is already in flight). */\n    fetchNextPage: () => Promise<InfiniteData<T, P>>;\n    /** Prepend the previous page (a no-op without `getPreviousPageParam` or when there is none). */\n    fetchPreviousPage: () => Promise<InfiniteData<T, P>>;\n    /** Whether another page can be appended (derived from `getNextPageParam` of the last page). */\n    hasNextPage: () => boolean;\n    /** Whether a page can be prepended (derived from `getPreviousPageParam` of the first page). */\n    hasPreviousPage: () => boolean;\n}",
+    "doc": "/** A stable per-key handle for an infinite (paged) query. */"
+  },
+  {
+    "name": "InfiniteQueryOptions",
+    "kind": "interface",
+    "package": "@nifrajs/web",
+    "signature": "export interface InfiniteQueryOptions<T, P> extends QueryOptions {\n    /** The param the FIRST page is fetched with. */\n    readonly initialPageParam: P;\n    /** Derive the next page's param from the last fetched page (and all pages/params). `undefined`/`null`\n     * ⇒ no next page (`hasNextPage` is false). */\n    readonly getNextPageParam: (lastPage: T, allPages: readonly T[], lastPageParam: P, allPageParams: readonly P[]) => P | undefined | null;\n    /** Derive the previous page's param (for bidirectional infinite lists). Omit ⇒ no previous page. */\n    readonly getPreviousPageParam?: (firstPage: T, allPages: readonly T[], firstPageParam: P, allPageParams: readonly P[]) => P | undefined | null;\n}",
+    "doc": "/** Options for an {@link InfiniteQueryHandle}. `getNextPageParam` (required) derives the param for the\n * next page from the last page — return `undefined`/`null` to signal there is no next page. */"
+  },
   {
     "name": "initAgents",
     "kind": "function",
@@ -2712,8 +3768,15 @@
     "name": "inProcessClient",
     "kind": "function",
     "package": "@nifrajs/client",
-    "signature": "export declare function inProcessClient<App extends {\n    fetch(request: Request): Response | Promise<Response>;\n}>(app: App, options?: Omit<ClientOptions, \"fetch\">): Treaty<App>;",
-    "doc": "/**\n * A {@link client} whose `fetch` calls a nifra app's own `fetch` in-process — no network, full\n * lifecycle (validation, middleware, contracts). For SSR loaders. Typed from `App` exactly like\n * the network client. The `(url, init) → Request` bridge is required because the client calls\n * `fetch(url, init)` while `app.fetch` takes a `Request`.\n *\n * The returned typed proxy ALSO carries a real `fetch(url, init)` method — the same in-process\n * bridge — so `createWebApp({ api: inProcessClient(backend) })` can **auto-mount** the backend over\n * HTTP at `/api/*` (it dispatches `api.fetch(req.url, req)` to the backend, no hand-written\n * `server-bun.ts` `/api/*` branch). Without this, `api.fetch` would resolve to a *route* sub-proxy\n * (a call to `/fetch`), not the backend's own `fetch` — so the mount can't reach the app. The `fetch`\n * key is intercepted on the proxy and shadows any (non-existent) `/fetch` route segment; no app\n * defines a literal `/fetch` route reached via the typed proxy, so this is backward-compatible.\n */"
+    "signature": "export declare function inProcessClient<App extends {\n    fetch(request: Request): Response | Promise<Response>;\n}>(app: App, options?: Omit<ClientOptions, \"fetch\">): InProcessClient<App>;",
+    "doc": "/**\n * A {@link client} whose `fetch` calls a nifra app's own `fetch` in-process — no network, full\n * lifecycle (validation, middleware, contracts). For SSR loaders. Typed from `App` exactly like\n * the network client. The `(url, init) → Request` bridge is required because the client calls\n * `fetch(url, init)` while `app.fetch` takes a `Request`.\n *\n * The returned proxy also implements the explicit symbol-keyed {@link BackendMount} interface, so\n * `createWebApp({ api: inProcessClient(backend) })` can auto-mount the backend while forwarding the\n * outer runtime's `env` and `waitUntil`. The released `.fetch(url, init)` bridge remains available as\n * a compatibility surface for custom integrations, but the platform-aware mount never relies on it.\n */"
+  },
+  {
+    "name": "InProcessClient",
+    "kind": "type",
+    "package": "@nifrajs/client",
+    "signature": "export type InProcessClient<App> = Treaty<App> & BackendMount;",
+    "doc": "/** Typed route client plus the explicit platform-aware backend mount capability. */"
   },
   {
     "name": "installForms",
@@ -2734,6 +3797,31 @@
     "package": "@nifrajs/web",
     "signature": "export interface InstallHistoryOptions {\n    /** Full-page fallback when a client navigation can't proceed (default: `location.assign`). */\n    readonly fallback?: (path: string) => void;\n}"
   },
+  {
+    "name": "InvariantExecutor",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type InvariantExecutor = (request: Request) => Response | Promise<Response>;"
+  },
+  {
+    "name": "InvariantFinding",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface InvariantFinding {\n    readonly code: InvariantFindingCode;\n    readonly method: string;\n    readonly path: string;\n    /** The case's deterministic seed — rerun with it to reproduce the exact request. */\n    readonly seed?: number;\n    readonly message: string;\n}"
+  },
+  {
+    "name": "InvariantFindingCode",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type InvariantFindingCode = \"classification-understated\" | \"server-error-on-valid-input\" | \"response-schema-violation\" | \"validation-bypass\" | \"server-error-on-invalid-input\";",
+    "doc": "/**\n * Contract-generated invariant tests: the declared contract *is* the test suite.\n *\n * `runContractInvariants(app)` reads each route's reflected contract (schemas, classification) and\n * verifies, with deterministic seeded fuzzing, the properties the contract already promises:\n *\n *  1. **Classification consistency** (static) — a route whose response fields are tagged more\n *     sensitive than its declared route-level classification is understating what it emits.\n *  2. **Valid input never crashes** (dynamic) — schema-generated valid requests must not produce 5xx.\n *  3. **Response conformance** (dynamic) — a 2xx response body must validate against the declared\n *     response schema; an undeclared response shape is exactly where sensitive data leaks.\n *  4. **Validation fails closed** (dynamic) — schema-violating bodies must be rejected (4xx), never\n *     accepted (2xx) and never crash (5xx).\n *\n * Everything is deterministic: a seeded PRNG (no ambient randomness, no wall clock), so a failing\n * case reproduces from its seed. Routes whose inputs cannot be generated from their JSON Schema are\n * reported in `skipped` — never silently dropped.\n */"
+  },
+  {
+    "name": "InvariantReport",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface InvariantReport {\n    readonly ok: boolean;\n    /** Routes exercised dynamically. */\n    readonly tested: readonly {\n        readonly method: string;\n        readonly path: string;\n    }[];\n    /** Routes that could not be exercised, with the reason — reported, never silently dropped. */\n    readonly skipped: readonly SkippedRoute[];\n    readonly findings: readonly InvariantFinding[];\n}"
+  },
   {
     "name": "IpMatcher",
     "kind": "type",
@@ -2767,6 +3855,13 @@
     "signature": "export declare function isBuildTarget(value: string): value is BuildTarget;",
     "doc": "/** A type guard narrowing an arbitrary string to a {@link BuildTarget}. */"
   },
+  {
+    "name": "isDataClassification",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function isDataClassification(value: unknown): value is DataClassification;",
+    "doc": "/** Whether `value` is a known classification token. */"
+  },
   {
     "name": "isDraftEnabled",
     "kind": "function",
@@ -3135,6 +4230,20 @@
     "signature": "export interface LayoutEntry {\n    readonly file: string;\n    readonly load: () => Promise<{\n        default: unknown;\n        meta?: MetaInput;\n    }>;\n}",
     "doc": "/** A layout (or `_404`/`_error`) entry: its source file (for client codegen) + a lazy loader.\n *\n * A `_layout.tsx` may export `meta` (static {@link Meta} or a function of the loader data + params,\n * same shape as a route's) to contribute sitewide `<head>` tags — `hreflang`/`preconnect`/etc. that\n * belong on every page under the layout. The layout chain's heads merge with the page's: arrays\n * (`meta`/`link`) concatenate outermost→innermost→page; scalars (`title`) are nearest-wins (the page\n * overrides an inner layout, which overrides an outer one). See `mergeHeads` in `@nifrajs/web`. */"
   },
+  {
+    "name": "LedgerSink",
+    "kind": "type",
+    "package": "@nifrajs/core",
+    "signature": "export type LedgerSink = (ledger: SealedEffectLedger) => void | Promise<void>;",
+    "doc": "/**\n * Receives each sealed ledger once per request (only when it has entries). Implementations must not\n * assume a payload: the ledger is token-only. A durable/tenant-scoped sink lives behind this seam.\n */"
+  },
+  {
+    "name": "Link",
+    "kind": "const",
+    "package": "@nifrajs/web-react",
+    "signature": "export declare const Link: import(\"react\").ForwardRefExoticComponent<LinkProps & import(\"react\").RefAttributes<HTMLAnchorElement>>;",
+    "doc": "/**\n * A client-navigating anchor. Renders a real `<a href={to}>` (so it's a working link before hydration\n * and for right-click / open-in-new-tab), and on a plain left-click navigates through the router\n * instead of a full reload. Calling `navigate` + `preventDefault` here means `installHistory`'s\n * document-level click handler sees `defaultPrevented` and stands down — exactly one navigation.\n */"
+  },
   {
     "name": "LinkDescriptor",
     "kind": "interface",
@@ -3142,12 +4251,26 @@
     "signature": "export interface LinkDescriptor {\n    readonly rel?: string;\n    readonly href?: string;\n    readonly hreflang?: string;\n    readonly crossorigin?: string;\n    readonly media?: string;\n    readonly sizes?: string;\n    readonly type?: string;\n    readonly as?: string;\n    readonly integrity?: string;\n    readonly referrerpolicy?: string;\n    readonly fetchpriority?: string;\n    readonly title?: string;\n    readonly imagesrcset?: string;\n    readonly imagesizes?: string;\n    readonly color?: string;\n    readonly disabled?: boolean;\n    readonly [attr: string]: string | boolean | undefined;\n}",
     "doc": "/**\n * One `<link>` tag's attributes for a route/layout's `meta.link`. The common HTML `<link>` attributes\n * are spelled out and **optional** so a typed partial like `{ rel, href, hreflang }` is assignable —\n * the previous `Record<string, string>` required *every* value to be a present string, which rejected\n * exactly that idiomatic shape (the bug this fixes). The index signature keeps custom/`data-*` attrs\n * (and any future standard attr) passing without a cast; `boolean` covers boolean attributes like\n * `disabled` (rendered as a bare attribute when `true`, omitted when `false`), and `undefined` lets a\n * caller spread in a conditionally-absent attribute. Attribute *names* are still shape-validated and\n * values HTML-escaped at render — a widened type never widens the injection surface.\n */"
   },
+  {
+    "name": "LinkProps",
+    "kind": "interface",
+    "package": "@nifrajs/web-react",
+    "signature": "export interface LinkProps extends Omit<AnchorHTMLAttributes<HTMLAnchorElement>, \"href\"> {\n    /** Same-origin destination path (e.g. `/users/7?tab=posts`). Rendered as the `<a href>`. */\n    readonly to: string;\n    /** Replace the current history entry instead of pushing. */\n    readonly replace?: boolean;\n}",
+    "doc": "/** {@link Link} props: every `<a>` attribute except `href` (set from `to`), plus `to` + `replace`. */"
+  },
   {
     "name": "ListOptions",
     "kind": "interface",
     "package": "@nifrajs/storage",
     "signature": "export interface ListOptions {\n    /** Only keys starting with this prefix. */\n    readonly prefix?: string;\n    /** Cap the number of keys returned. */\n    readonly limit?: number;\n}"
   },
+  {
+    "name": "listRecipeVersions",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function listRecipeVersions(): string[];",
+    "doc": "/** Available target versions, ascending. */"
+  },
   {
     "name": "load",
     "kind": "function",
@@ -3168,6 +4291,12 @@
     "package": "@nifrajs/cli",
     "signature": "export interface LoadAppOptions {\n    /** Optional dynamic-import query used by long-lived MCP processes to bust Bun's module cache. */\n    readonly importQuery?: string;\n}"
   },
+  {
+    "name": "loadAssuranceConfig",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function loadAssuranceConfig(cwd: string, configPath?: string): Promise<AssuranceConfig>;"
+  },
   {
     "name": "loadBackend",
     "kind": "function",
@@ -3269,6 +4398,13 @@
     "signature": "export type Locale = string;",
     "doc": "/**\n * Locale negotiation — pick the best supported locale for a request, from (in priority order) an\n * explicit cookie, then the `Accept-Language` header (quality-ranked, with a base-tag fallback so\n * `fr-CA` matches a supported `fr`). Pure + runtime-agnostic.\n */"
   },
+  {
+    "name": "Location",
+    "kind": "interface",
+    "package": "@nifrajs/web-react",
+    "signature": "export interface Location {\n    readonly pathname: string;\n    readonly search: string;\n    readonly hash: string;\n}",
+    "doc": "/** The parsed current location. `hash` is always `\"\"` — the fragment is client-only and never reaches\n * the router state / server, so exposing a live hash would hydration-mismatch; read `window.location.hash`\n * directly (in an effect) if you truly need it. */"
+  },
   {
     "name": "LogFields",
     "kind": "type",
@@ -3302,6 +4438,20 @@
     "signature": "export declare function lookupType(types: readonly TypeEntry[], name: string): TypeEntry[];",
     "doc": "/** Exact (case-insensitive) name lookup — returns every declaration with that name (a name can exist in\n * more than one package). */"
   },
+  {
+    "name": "LoopDelayHistogram",
+    "kind": "interface",
+    "package": "@nifrajs/middleware",
+    "signature": "export interface LoopDelayHistogram {\n    enable(): void;\n    reset(): void;\n    readonly mean: number;\n}",
+    "doc": "/** The slice of a `perf_hooks` event-loop-delay histogram the sampler needs. */"
+  },
+  {
+    "name": "LoopDelayMonitor",
+    "kind": "type",
+    "package": "@nifrajs/middleware",
+    "signature": "export type LoopDelayMonitor = (resolutionMs: number) => LoopDelayHistogram | undefined;",
+    "doc": "/**\n * Acquires a loop-delay histogram for a resolution, or `undefined` when the runtime has none. This is\n * an optional test/runtime seam; the default sampler is a portable timer-drift monitor.\n */"
+  },
   {
     "name": "Manifest",
     "kind": "interface",
@@ -3336,6 +4486,27 @@
     "signature": "export declare function matches(fields: CronFields, date: Date): boolean;",
     "doc": "/**\n * Does `date` (in its LOCAL time — cron is local-time by convention) match the fields, to the\n * minute? Day-of-month and day-of-week follow the standard OR rule: when BOTH are restricted, a\n * match on EITHER is a match; when only one is restricted, only that one must match.\n */"
   },
+  {
+    "name": "matchesAssuranceSelector",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function matchesAssuranceSelector(route: Pick<ReflectedRoute, \"method\" | \"path\" | \"tool\">, selector: AssuranceRouteSelector): boolean;",
+    "doc": "/** Shared selector semantics for policy rules and framework adapters. */"
+  },
+  {
+    "name": "MAX_COST_AXES",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const MAX_COST_AXES = 8;",
+    "doc": "/** Most cost axes one entry may carry. */"
+  },
+  {
+    "name": "maxClassification",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function maxClassification(values: Iterable<DataClassification>): DataClassification;",
+    "doc": "/** The most sensitive classification among the inputs; `\"public\"` when none are given. */"
+  },
   {
     "name": "MaybePromise",
     "kind": "type",
@@ -3524,7 +4695,7 @@
     "kind": "type",
     "package": "@nifrajs/mcp",
     "signature": "export type McpUiIntent = \"table\" | \"list\" | \"cards\" | \"form\" | \"metric\" | \"detail\" | \"chart\" | (string & {});",
-    "doc": "/**\n * A render-intent hint for GENERATIVE hosts (e.g. the ShipNow builder): how to present the result's\n * `structuredContent` when the host renders its OWN themed UI rather than an iframe widget. The host maps\n * the intent to a component in its design system (a shadcn/Tailwind table, form, metric card, …). Open\n * union — pick a known tag or a custom one.\n */"
+    "doc": "/**\n * A render-intent hint for GENERATIVE hosts: how to present the result's\n * `structuredContent` when the host renders its OWN themed UI rather than an iframe widget. The host maps\n * the intent to a component in its design system (a shadcn/Tailwind table, form, metric card, …). Open\n * union — pick a known tag or a custom one.\n */"
   },
   {
     "name": "McpWidget",
@@ -3558,6 +4729,13 @@
     "package": "@nifrajs/web",
     "signature": "export interface MemoryCacheStoreOptions {\n    /** Allow the in-memory store in production. Off by default — per-instance caching means revalidation\n     * won't propagate across instances and each instance caches separately. */\n    readonly allowInProduction?: boolean;\n    /** Hard cap on entries; the least-recently-used is evicted past it (default 500). */\n    readonly max?: number;\n}"
   },
+  {
+    "name": "MemoryIdempotencyStore",
+    "kind": "class",
+    "package": "@nifrajs/core",
+    "signature": "export declare class MemoryIdempotencyStore implements IdempotencyStore {\n    readonly durability: \"memory\";\n    private readonly entries;\n    private readonly now;\n    private readonly maxEntries;\n    constructor(options?: MemoryIdempotencyStoreOptions);\n    begin(input: IdempotencyBeginInput): IdempotencyBeginResult;\n    complete(input: IdempotencyCompletionInput): boolean;\n    abandon(input: IdempotencyAbandonInput): boolean;\n    /** Evict expired entries. Callers may run this on an interval; access-time eviction covers the rest. */\n    sweep(): void;\n    /** Live entry count (post-sweep semantics are the caller's; this is a raw size for tests/metrics). */\n    get size(): number;\n    private storageKey;\n}",
+    "doc": "/**\n * In-process idempotency store. Reservation is atomic by construction — `begin` never awaits, so the\n * single-threaded event loop serializes concurrent callers for one key. Expired entries are treated\n * as absent (lazy eviction on access); a periodic {@link MemoryIdempotencyStore.sweep} bounds memory.\n */"
+  },
   {
     "name": "MemoryIdempotencyStore",
     "kind": "class",
@@ -3565,6 +4743,12 @@
     "signature": "export declare class MemoryIdempotencyStore implements IdempotencyStore {\n    private readonly entries;\n    constructor(options?: MemoryIdempotencyStoreOptions);\n    begin(key: string, lockTtlMs: number): Promise<IdempotencyClaim>;\n    complete(key: string, record: IdempotencyRecord, ttlMs: number): Promise<void>;\n    release(key: string): Promise<void>;\n}",
     "doc": "/** In-process store. Refuses to run in production unless explicitly allowed (per-instance ⇒ no cross-instance dedupe). */"
   },
+  {
+    "name": "MemoryIdempotencyStoreOptions",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface MemoryIdempotencyStoreOptions {\n    /** Injectable clock (epoch ms) for deterministic TTL tests. Default `Date.now`. */\n    readonly now?: () => number;\n    /** Hard memory bound. At capacity new keys fail closed; completed/pending entries are never evicted early. */\n    readonly maxEntries?: number;\n}"
+  },
   {
     "name": "MemoryIdempotencyStoreOptions",
     "kind": "interface",
@@ -3578,6 +4762,18 @@
     "signature": "export declare class MemoryJobStore implements JobStore {\n    private readonly jobs;\n    private readonly dead;\n    private seq;\n    private readonly idFor;\n    constructor(options?: {\n        idFor?: () => string;\n    });\n    enqueue(job: {\n        name: string;\n        payload: unknown;\n        runAt: number;\n        maxAttempts: number;\n    }): string;\n    lease(now: number, limit: number, leaseMs: number): StoredJob[];\n    complete(id: string): void;\n    retry(id: string, runAt: number): void;\n    deadLetter(id: string, error: string): void;\n    counts(now?: number): JobCounts;\n    /** The dead-letter queue — inspect/requeue failed jobs (not part of the {@link JobStore} contract). */\n    deadLetters(): DeadRecord[];\n}",
     "doc": "/** Construct an in-memory job store. `idFor` is injectable for deterministic tests. */"
   },
+  {
+    "name": "MemoryLedgerSink",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface MemoryLedgerSink {\n    readonly sink: LedgerSink;\n    /** Sealed ledgers received so far, oldest first. */\n    readonly ledgers: readonly SealedEffectLedger[];\n    clear(): void;\n}"
+  },
+  {
+    "name": "MemoryLedgerSinkOptions",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface MemoryLedgerSinkOptions {\n    /** Retain at most this many sealed ledgers (oldest evicted first). Default 1000. */\n    readonly maxLedgers?: number;\n}"
+  },
   {
     "name": "MemoryResponseCache",
     "kind": "class",
@@ -3687,9 +4883,16 @@
     "name": "Middleware",
     "kind": "interface",
     "package": "@nifrajs/core",
-    "signature": "export interface Middleware {\n    readonly name?: string;\n    readonly onRequest?: (req: Request) => MaybePromise<OnRequestResult>;\n    readonly around?: <T>(context: Context, next: () => MaybePromise<T>) => MaybePromise<T>;\n    readonly beforeHandle?: (context: Context) => MaybePromise<unknown>;\n    readonly afterHandle?: (result: unknown, context: Context) => MaybePromise<unknown>;\n    readonly onResponse?: (response: Response, req: Request) => MaybePromise<Response>;\n    readonly onResponseFinalized?: (outcome: ResponseFinalization, req: Request) => MaybePromise<void>;\n    readonly onError?: (error: unknown, context: Context) => MaybePromise<unknown>;\n}",
+    "signature": "export interface Middleware {\n    readonly name?: string;\n    readonly onRequest?: (req: Request, platform?: Platform) => MaybePromise<OnRequestResult>;\n    readonly around?: <T>(context: Context, next: () => MaybePromise<T>) => MaybePromise<T>;\n    readonly beforeHandle?: (context: Context) => MaybePromise<unknown>;\n    readonly afterHandle?: (result: unknown, context: Context) => MaybePromise<unknown>;\n    readonly onResponse?: (response: Response, req: Request) => MaybePromise<Response>;\n    readonly onResponseFinalized?: (outcome: ResponseFinalization, req: Request) => MaybePromise<void>;\n    readonly onError?: (error: unknown, context: Context) => MaybePromise<unknown>;\n}",
     "doc": "/**\n * A bundle of lifecycle hooks applied together via {@link Server.use} — the unit\n * `@nifrajs/middleware` ships (cors, security headers, rate-limit). Every hook is\n * optional and wired to its lifecycle point. Middleware is context-agnostic (sees\n * the base `Context`); `use` does no context-type merging — the full type-merging\n * plugin system is deferred, and `.use` is reserved as its future entry point.\n */"
   },
+  {
+    "name": "MIN_DIGEST_KEY_BYTES",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const MIN_DIGEST_KEY_BYTES = 16;",
+    "doc": "/** Minimum digest key material. A short key would make the keyed digest brute-forceable. */"
+  },
   {
     "name": "MockableApp",
     "kind": "interface",
@@ -3793,6 +4996,34 @@
     "signature": "export interface MovableStorageAdapter extends StorageAdapter {\n    copy(sourceKey: string, destinationKey: string): Promise<void>;\n    move(sourceKey: string, destinationKey: string): Promise<void>;\n}",
     "doc": "/** Optional server-side copy/move capability. */"
   },
+  {
+    "name": "MutationCallbacks",
+    "kind": "interface",
+    "package": "@nifrajs/web",
+    "signature": "export interface MutationCallbacks<TData, TVariables> {\n    readonly onMutate?: (variables: TVariables) => void | Promise<void>;\n    readonly onSuccess?: (data: TData, variables: TVariables) => void | Promise<void>;\n    readonly onError?: (error: unknown, variables: TVariables) => void | Promise<void>;\n    readonly onSettled?: (data: TData | undefined, error: unknown, variables: TVariables) => void | Promise<void>;\n}",
+    "doc": "/** Lifecycle callbacks for a mutation. All optional; `onSettled` runs after success OR error. */"
+  },
+  {
+    "name": "MutationHandle",
+    "kind": "interface",
+    "package": "@nifrajs/web",
+    "signature": "export interface MutationHandle<TData, TVariables> {\n    snapshot: () => MutationState<TData, TVariables>;\n    subscribe: (listener: () => void) => () => void;\n    /** Run the mutation. Resolves to the data (and runs onSuccess/onSettled) or rejects (onError/onSettled).\n     * The latest concurrent call wins the published state (older results are dropped). */\n    mutate: (variables: TVariables) => Promise<TData>;\n    /** Rebind the latest `fn`/callbacks (closures change between renders) without losing state. */\n    rebind: (fn: (variables: TVariables) => Promise<TData>, callbacks: MutationCallbacks<TData, TVariables>) => void;\n    /** Reset to the idle state (clears data/error/variables). */\n    reset: () => void;\n}",
+    "doc": "/** A standalone mutation store: subscribe to its state, fire `mutate`, `reset` back to idle. */"
+  },
+  {
+    "name": "MutationState",
+    "kind": "interface",
+    "package": "@nifrajs/web",
+    "signature": "export interface MutationState<TData, TVariables> {\n    readonly status: MutationStatus;\n    readonly data: TData | undefined;\n    readonly error: unknown;\n    /** The variables of the in-flight / last mutation (`undefined` before the first call). */\n    readonly variables: TVariables | undefined;\n}",
+    "doc": "/** A mutation's observable state. A new (frozen) object per transition (reference-comparable). */"
+  },
+  {
+    "name": "MutationStatus",
+    "kind": "type",
+    "package": "@nifrajs/web",
+    "signature": "export type MutationStatus = \"idle\" | \"pending\" | \"success\" | \"error\";",
+    "doc": "/** A mutation's lifecycle status. */"
+  },
   {
     "name": "namedCombine",
     "kind": "function",
@@ -3800,6 +5031,55 @@
     "signature": "export declare function namedCombine(name: string, ...items: readonly Composable[]): NifraPlugin;",
     "doc": "/** Compose middleware/plugins into one idempotent named bundle. */"
   },
+  {
+    "name": "Navigate",
+    "kind": "function",
+    "package": "@nifrajs/web-react",
+    "signature": "export declare function Navigate({ to, replace }: NavigateProps): null;",
+    "doc": "/**\n * Declaratively navigate on mount — the component analogue of `useNavigate` (e.g. a guard that renders\n * `<Navigate to=\"/login\" replace />`). Navigates in an effect, so it's a safe no-op during SSR (renders\n * `null`); the redirect happens once on the client after hydration.\n */"
+  },
+  {
+    "name": "NavigateFunction",
+    "kind": "type",
+    "package": "@nifrajs/web-react",
+    "signature": "export type NavigateFunction = (to: string | number, options?: NavigateOptions) => void;",
+    "doc": "/** A programmatic navigate: a string path (push, or replace via `{ replace: true }`) or a history delta\n * (`-1`/`1`). A no-op on the server / before hydration (a render-time navigate isn't valid — use\n * {@link Navigate}, which navigates in an effect). */"
+  },
+  {
+    "name": "NavigateOptions",
+    "kind": "interface",
+    "package": "@nifrajs/web",
+    "signature": "export interface NavigateOptions {\n    /** Replace the current history entry instead of pushing a new one (like `history.replaceState`). */\n    readonly replace?: boolean;\n}",
+    "doc": "/** Options for a programmatic navigation. */"
+  },
+  {
+    "name": "NavigateProps",
+    "kind": "interface",
+    "package": "@nifrajs/web-react",
+    "signature": "export interface NavigateProps {\n    readonly to: string;\n    readonly replace?: boolean;\n}",
+    "doc": "/** {@link Navigate} props: the destination `to` and whether to `replace` the history entry. */"
+  },
+  {
+    "name": "NavLink",
+    "kind": "const",
+    "package": "@nifrajs/web-react",
+    "signature": "export declare const NavLink: import(\"react\").ForwardRefExoticComponent<NavLinkProps & import(\"react\").RefAttributes<HTMLAnchorElement>>;",
+    "doc": "/**\n * A {@link Link} that knows whether it points at the current location. Adds `aria-current=\"page\"` when\n * active and resolves function-form `className`/`style`/`children` with `{ isActive, isPending }`.\n * Default matching is prefix-on-segment-boundary (so `/users` is active on `/users/7`); pass `end` for\n * an exact match.\n */"
+  },
+  {
+    "name": "NavLinkProps",
+    "kind": "interface",
+    "package": "@nifrajs/web-react",
+    "signature": "export interface NavLinkProps extends Omit<LinkProps, \"className\" | \"style\" | \"children\"> {\n    /** Match the full path exactly instead of as a prefix (use for `to=\"/\"` so it isn't always active). */\n    readonly end?: boolean;\n    /** Match case-sensitively (default: case-insensitive, like the DOM). */\n    readonly caseSensitive?: boolean;\n    readonly className?: string | ((props: NavLinkRenderProps) => string | undefined);\n    readonly style?: CSSProperties | ((props: NavLinkRenderProps) => CSSProperties | undefined);\n    readonly children?: ReactNode | ((props: NavLinkRenderProps) => ReactNode);\n}",
+    "doc": "/** {@link NavLink} props — like {@link LinkProps}, but `className`/`style`/`children` may be functions\n * of the active state, and `end`/`caseSensitive` tune matching. */"
+  },
+  {
+    "name": "NavLinkRenderProps",
+    "kind": "interface",
+    "package": "@nifrajs/web-react",
+    "signature": "export interface NavLinkRenderProps {\n    /** True when the current location matches this link's `to` (prefix match, or exact when `end`). */\n    readonly isActive: boolean;\n    /** Reserved for a future pending-navigation signal; currently always `false`. */\n    readonly isPending: boolean;\n}",
+    "doc": "/** The state a {@link NavLink}'s function-form `className`/`style`/`children` receive. */"
+  },
   {
     "name": "ndjsonStream",
     "kind": "function",
@@ -3827,6 +5107,33 @@
     "signature": "export declare function nextRun(fields: CronFields, from: Date): Date | null;",
     "doc": "/**\n * The next instant at/after `from` (exclusive of the current minute's already-started second) that\n * matches. Steps minute-by-minute with a safety cap (~5 years) so a never-matching expression\n * returns `null` instead of looping forever.\n */"
   },
+  {
+    "name": "NIFRA_ASSURANCE",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const NIFRA_ASSURANCE: Readonly<{\n    readonly AUTHENTICATED: \"nifra.authenticated\";\n    readonly BODY_BOUNDED: \"nifra.body-bounded\";\n    readonly CSRF: \"nifra.csrf\";\n    readonly DURABLE_COMMAND: \"nifra.durable-command\";\n    readonly IDEMPOTENCY_KEY: \"nifra.idempotency-key\";\n    readonly IP_RESTRICTED: \"nifra.ip-restricted\";\n    readonly RATE_LIMITED: \"nifra.rate-limited\";\n    readonly SECURITY_HEADERS: \"nifra.security-headers\";\n}>;",
+    "doc": "/** Canonical evidence ids emitted by Nifra's official middleware modules. */"
+  },
+  {
+    "name": "NIFRA_ASSURANCE_IDS",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const NIFRA_ASSURANCE_IDS: Readonly<{\n    readonly AUTHENTICATED: \"nifra.authenticated\";\n    readonly BODY_BOUNDED: \"nifra.body-bounded\";\n    readonly CSRF: \"nifra.csrf\";\n    readonly DURABLE_COMMAND: \"nifra.durable-command\";\n    readonly IDEMPOTENCY_KEY: \"nifra.idempotency-key\";\n    readonly IP_RESTRICTED: \"nifra.ip-restricted\";\n    readonly RATE_LIMITED: \"nifra.rate-limited\";\n    readonly SECURITY_HEADERS: \"nifra.security-headers\";\n}>;"
+  },
+  {
+    "name": "NIFRA_BACKEND_MOUNT",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const NIFRA_BACKEND_MOUNT: unique symbol;",
+    "doc": "/** Global symbol so independently bundled copies of core/client/web still agree on the mount seam. */"
+  },
+  {
+    "name": "NIFRA_DEADLINE_HEADER",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const NIFRA_DEADLINE_HEADER = \"x-nifra-deadline\";",
+    "doc": "/** Canonical wire header carrying an absolute Unix epoch deadline in milliseconds. */"
+  },
   {
     "name": "NifraFramework",
     "kind": "interface",
@@ -3834,6 +5141,54 @@
     "signature": "export interface NifraFramework {\n    /** The render adapter, e.g. `reactAdapter` from `@nifrajs/web-react`. */\n    readonly adapter: unknown;\n    /** The client runtime module providing `mountRouter`, e.g. `\"@nifrajs/web-react/client\"`. */\n    readonly clientModule: string;\n    /** Vite plugins for `nifra dev`'s HMR, e.g. `[react()]` / `() => import(\"@vitejs/plugin-vue\")…`. */\n    readonly vitePlugins?: PluginsField;\n    /** Bun build plugins that compile routes for the CLIENT bundle (`nifra build`), e.g.\n     * `[vueBunPlugin(\"dom\")]`. React/Preact JSX is Bun-native → none. */\n    readonly clientPlugins?: PluginsField;\n    /** Bun runtime plugins that compile routes for SSR — `nifra dev` (Bun-native route import) and\n     * `nifra start` register them via `Bun.plugin`, e.g. `[vueBunPlugin(\"ssr\")]`. React/Preact → none. */\n    readonly serverPlugins?: PluginsField;\n    /** Extra Bun.build / Vite resolve conditions, e.g. Solid's `[\"solid\"]`. */\n    readonly conditions?: readonly string[];\n    /** Compile-time `define` replacements, e.g. Vue's `__VUE_*` flags. */\n    readonly define?: Readonly<Record<string, string>>;\n}",
     "doc": "/**\n * The CLI's framework wiring — exported from `nifra.config.ts` (or `framework.ts` as a fallback).\n * `create-nifra` generates it. Only `adapter` + `clientModule` are required; the plugin/condition\n * fields are framework-specific extras (Vue/Svelte/Solid need them; React/Preact don't).\n */"
   },
+  {
+    "name": "NifraManifest",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface NifraManifest {\n    readonly manifestVersion: 1;\n    readonly routes: readonly NifraManifestRoute[];\n    /** SHA-256 hex of the canonical manifest body (`manifestVersion` + `routes`). */\n    readonly contentHash: string;\n}"
+  },
+  {
+    "name": "NifraManifestAssurance",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface NifraManifestAssurance {\n    readonly rule?: string;\n    readonly evidence: readonly {\n        readonly id: string;\n        readonly source: string;\n    }[];\n}"
+  },
+  {
+    "name": "NifraManifestCapabilities",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface NifraManifestCapabilities {\n    readonly declared: readonly string[];\n    readonly evidenced: readonly string[];\n    readonly unproven: readonly string[];\n    readonly covered: boolean;\n}"
+  },
+  {
+    "name": "NifraManifestChange",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface NifraManifestChange {\n    readonly severity: DiffSeverity;\n    readonly method: string;\n    readonly path: string;\n    readonly section: RouteChange[\"section\"] | \"assurance\" | \"capabilities\" | \"classification\";\n    readonly field?: string;\n    readonly message: string;\n}"
+  },
+  {
+    "name": "NifraManifestDiff",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface NifraManifestDiff {\n    readonly changes: readonly NifraManifestChange[];\n    readonly hasBreaking: boolean;\n}"
+  },
+  {
+    "name": "NifraManifestRoute",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface NifraManifestRoute {\n    readonly method: string;\n    readonly path: string;\n    readonly schema?: RouteSnapshotSchema;\n    readonly assurance?: NifraManifestAssurance;\n    readonly capabilities?: NifraManifestCapabilities;\n    readonly classification?: ResponseClassification;\n}"
+  },
+  {
+    "name": "NifraManifestSignature",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface NifraManifestSignature {\n    readonly nifraManifestSignature: 1;\n    readonly algorithm: \"Ed25519\";\n    readonly keyId: string;\n    readonly contentHash: string;\n    /** Base64url Ed25519 signature over the canonical manifest body. */\n    readonly signature: string;\n}"
+  },
+  {
+    "name": "NifraManifestSigner",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface NifraManifestSigner {\n    readonly algorithm: \"Ed25519\";\n    readonly keyId: string;\n    sign(payload: Uint8Array): ArrayBuffer | Uint8Array | Promise<ArrayBuffer | Uint8Array>;\n}"
+  },
   {
     "name": "NifraMonorepoConfig",
     "kind": "interface",
@@ -3910,6 +5265,12 @@
     "signature": "export declare function normalizeRolldownPlugins(plugins: readonly unknown[], isRolldown: boolean): readonly unknown[];",
     "doc": "/**\n * Strip `optimizeDeps.rollupOptions.jsx` from a plugin's `config` hook output when running under\n * rolldown-vite — the source of the scary, harmless `Warning: Invalid input options … \"jsx\" Invalid\n * key: Expected never but received \"jsx\"` on `nifra dev`.\n *\n * Why it happens: `@vitejs/plugin-react@4.x` (and peers) target an *older* rolldown-vite optimizeDeps\n * API — they inject `optimizeDeps.rollupOptions.jsx` to tell the dep pre-bundler to transform JSX. Vite\n * 8's rolldown dep-optimizer renamed that surface to `optimizeDeps.rolldownOptions` (and moved jsx under\n * `transform.jsx`), so the stale `rollupOptions.jsx` is an unrecognized input option → the warning. It's\n * a version-skew artifact, not a real misconfig: the route source JSX transform runs through the\n * plugin's own `transform` hook (untouched here), and node_modules deps that get pre-bundled almost\n * never contain raw JSX — so dropping the dead key changes no behavior and keeps HMR/Fast Refresh\n * intact. We *strip* (rather than translate to `rolldownOptions`) so the fix is version-agnostic: a\n * plugin already emitting the correct `rolldownOptions` is left untouched, and a future plugin bump that\n * stops emitting `rollupOptions.jsx` makes this a no-op.\n *\n * Scoped narrowly: only the `optimizeDeps.rollupOptions.jsx` key is removed, only under rolldown-vite,\n * and only from the value a plugin's `config` hook returns. Non-rolldown Vite is passed through verbatim.\n *\n * FLATTEN FIRST: a Vite plugin factory may return an ARRAY of plugins — `@vitejs/plugin-react`'s `react()`\n * returns `[vite:react-babel, vite:react-refresh]`, and it's `react:react-babel`'s `config` hook that emits\n * the offending `optimizeDeps.rollupOptions.jsx`. `nifra.config.ts` writes `vitePlugins = [react()]`, so the\n * plugin list arrives NESTED (`[[babel, refresh]]`). Without flattening, `.map` sees the inner array (which\n * has no `config`), leaves it untouched, and Vite — which flattens plugin arrays itself before running them\n * — then executes the un-stripped babel hook, so the warning survives. Flattening here (Vite accepts a flat\n * list identically) is what lets the strip reach every real plugin.\n */"
   },
+  {
+    "name": "normalizeRouteCapabilities",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function normalizeRouteCapabilities(values: readonly string[] | undefined): readonly string[];"
+  },
   {
     "name": "number",
     "kind": "function",
@@ -4047,7 +5408,7 @@
     "name": "OperationDef",
     "kind": "interface",
     "package": "@nifrajs/core",
-    "signature": "export interface OperationDef {\n    readonly method: Method;\n    readonly path: string;\n    readonly body?: StandardSchemaV1;\n    readonly query?: StandardSchemaV1;\n    readonly response?: StandardSchemaV1;\n    /** Short summary (OpenAPI `summary`). */\n    readonly summary?: string;\n    /** Longer description (OpenAPI `description`, CommonMark). */\n    readonly description?: string;\n    /** Grouping tags (OpenAPI `tags`). */\n    readonly tags?: readonly string[];\n    /** Mark the operation deprecated. */\n    readonly deprecated?: boolean;\n    /** Security requirements (names ref `securitySchemes`); `[]` = explicitly public. Omit ⇒ inherit the document default. */\n    readonly security?: ReadonlyArray<Readonly<Record<string, readonly string[]>>>;\n    /** Request body content type. Default `application/json`. */\n    readonly requestContentType?: string;\n    /** Content type of the success (`200`) response. Default `application/json`. */\n    readonly responseContentType?: string;\n    /** Additional responses by status code, e.g. `{ \"404\": { description: \"Not found\" } }`. */\n    readonly responses?: Readonly<Record<string, ResponseDef>>;\n}",
+    "signature": "export interface OperationDef {\n    readonly method: Method;\n    readonly path: string;\n    readonly body?: StandardSchemaV1;\n    readonly query?: StandardSchemaV1;\n    readonly response?: StandardSchemaV1;\n    /** Declared effect tokens, carried into route reflection and capability assurance. */\n    readonly capabilities?: readonly string[];\n    /** Dedupe retries of this operation on an `Idempotency-Key` header (see {@link RouteSchema.idempotency}). */\n    readonly idempotency?: IdempotencyConfig;\n    /** Highest data-sensitivity the response carries (see {@link RouteSchema.classification}). */\n    readonly classification?: DataClassification;\n    /** Short summary (OpenAPI `summary`). */\n    readonly summary?: string;\n    /** Longer description (OpenAPI `description`, CommonMark). */\n    readonly description?: string;\n    /** Grouping tags (OpenAPI `tags`). */\n    readonly tags?: readonly string[];\n    /** Mark the operation deprecated. */\n    readonly deprecated?: boolean;\n    /** Security requirements (names ref `securitySchemes`); `[]` = explicitly public. Omit ⇒ inherit the document default. */\n    readonly security?: ReadonlyArray<Readonly<Record<string, readonly string[]>>>;\n    /** Request body content type. Default `application/json`. */\n    readonly requestContentType?: string;\n    /** Content type of the success (`200`) response. Default `application/json`. */\n    readonly responseContentType?: string;\n    /** Additional responses by status code, e.g. `{ \"404\": { description: \"Not found\" } }`. */\n    readonly responses?: Readonly<Record<string, ResponseDef>>;\n}",
     "doc": "/**\n * One operation in a contract. Input schemas are any Standard Schema; `response` is optional.\n *\n * The fields below `response` are **optional OpenAPI metadata** — they don't affect runtime\n * validation or the inferred handler types, they enrich the document `toOpenAPI` emits. A contract is\n * the natural home for them: it's the versionable description of the API, decoupled from the impl.\n */"
   },
   {
@@ -4126,6 +5487,12 @@
     "signature": "export declare function parseArgs(argv: readonly string[]): ParsedArgs;",
     "doc": "/** Parse `[dir] [--template|-t <t>] [--framework|-f <fw>] [--deploy|-d <target>] [--ci|-c github]\n *  [--db <preset>] [--auth <preset>] [--force] [--link <path>]`.\n * `--framework`/`--deploy`/`--ci` all default the template to `site`. */"
   },
+  {
+    "name": "parseCapabilityLockfile",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function parseCapabilityLockfile(content: string, sourcePath: string): CapabilitySnapshot;"
+  },
   {
     "name": "parseContentLength",
     "kind": "function",
@@ -4152,6 +5519,13 @@
     "signature": "export declare function parseCron(expression: string): CronFields;",
     "doc": "/** Parse a 5-field cron expression (or a `@macro`) into matchable {@link CronFields}. */"
   },
+  {
+    "name": "parseDeadlineHeader",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function parseDeadlineHeader(headers: Headers): DeadlineHeaderResult;",
+    "doc": "/** Parse the canonical deadline header without trusting or clamping it. */"
+  },
   {
     "name": "ParsedFontFace",
     "kind": "interface",
@@ -4200,6 +5574,20 @@
     "signature": "export declare function parseNdjsonData(stream: ReadableStream<Uint8Array>, signal?: AbortSignal): Promise<unknown>;",
     "doc": "/**\n * Client side of {@link ndjsonStream} (used by the router's `defaultFetchData` on a soft nav): read\n * the NDJSON body into a data object whose deferred markers settle as resolution lines arrive.\n * Returns after **line 1** so the router can apply the critical data + render immediately; the\n * markers' promises settle/reject in the background. If the stream ends (or `signal` aborts) with\n * markers unsettled, they reject — so `<Await>` never hangs.\n */"
   },
+  {
+    "name": "parseNifraManifest",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function parseNifraManifest(content: string, source?: string): Promise<NifraManifest>;",
+    "doc": "/** Parse and hash-verify an emitted manifest before it is trusted by diff/codegen tooling. */"
+  },
+  {
+    "name": "parseNifraManifestSignature",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function parseNifraManifestSignature(content: string, source?: string): NifraManifestSignature;",
+    "doc": "/** Parse the detached sidecar before selecting its operator-controlled public key. */"
+  },
   {
     "name": "parseSnapshotFile",
     "kind": "function",
@@ -4234,6 +5622,26 @@
     "signature": "export declare function pickLanguage<const L extends readonly string[]>(header: string | null, supported: L, defaultLanguage: L[number]): LanguageMatch;",
     "doc": "/**\n * Pick the best supported language for an `Accept-Language` header. Exact tags win, then compatible\n * base-language matches, then `*`, then the configured default.\n */"
   },
+  {
+    "name": "PinChange",
+    "kind": "interface",
+    "package": "@nifrajs/cli",
+    "signature": "export interface PinChange {\n    readonly file: string;\n    readonly field: string;\n    readonly name: string;\n    readonly from: string;\n    readonly to: string;\n}"
+  },
+  {
+    "name": "PinRule",
+    "kind": "interface",
+    "package": "@nifrajs/cli",
+    "signature": "export interface PinRule {\n    /** Package-name prefix, e.g. `@nifrajs/`, or an exact package name. */\n    readonly match: string;\n    /** Bare target version, e.g. `1.8.0`. The range operator (`^`/`~`/exact) is preserved per-spec. */\n    readonly to: string;\n}",
+    "doc": "/** A pin rule: every dependency whose name starts with `match` is set to version `to`. */"
+  },
+  {
+    "name": "pinSweepText",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function pinSweepText(text: string, rules: readonly {\n    match: string;\n    to: string;\n}[]): {\n    text: string;\n    changes: Array<Omit<PinChange, \"file\">>;\n};",
+    "doc": "/**\n * Apply pin rules to one package.json's TEXT (format-preserving — targeted string replaces, never a\n * JSON re-serialize that would reorder keys or drop comments-as-formatting). Returns the new text and\n * the changes made.\n */"
+  },
   {
     "name": "pipeWebBodyToNode",
     "kind": "function",
@@ -4555,7 +5963,7 @@
     "name": "QueryClient",
     "kind": "interface",
     "package": "@nifrajs/web",
-    "signature": "export interface QueryClient {\n    /** Get the stable {@link QueryHandle} for `key`, fetched via `fn`. Re-binds the latest `fn` each\n     * call (closures change between renders); returns the same handle for the same (hashed) key. */\n    query: <T>(key: unknown, fn: () => Promise<T>) => QueryHandle<T>;\n    /** Mark matching cached queries stale and refetch the **mounted** ones (subscribers > 0). Array\n     * keys match by **prefix** (`[\"todo\"]` ⇒ every `[\"todo\", …]`); other keys match exactly. */\n    invalidateQueries: (keyOrPrefix: unknown) => void;\n}",
+    "signature": "export interface QueryClient {\n    /** Get the stable {@link QueryHandle} for `key`, fetched via `fn`. Re-binds the latest `fn` (and\n     * `options`) each call (closures change between renders); returns the same handle for the same\n     * (hashed) key. */\n    query: <T>(key: unknown, fn: () => Promise<T>, options?: QueryOptions) => QueryHandle<T>;\n    /** Get the stable {@link InfiniteQueryHandle} for `key`, whose pages are fetched via `fn(pageParam)`. */\n    infiniteQuery: <T, P>(key: unknown, fn: (pageParam: P) => Promise<T>, options: InfiniteQueryOptions<T, P>) => InfiniteQueryHandle<T, P>;\n    /** Mark matching cached queries stale and refetch the **mounted** ones (subscribers > 0). Array\n     * keys match by **prefix** (`[\"todo\"]` ⇒ every `[\"todo\", …]`); other keys match exactly. */\n    invalidateQueries: (keyOrPrefix: unknown) => void;\n    /** Read a cached query's data (`undefined` if absent or not yet successful). Synchronous, no fetch. */\n    getQueryData: <T>(key: unknown) => T | undefined;\n    /** Write a query's data directly (optimistic updates, or seeding). Creates the entry if absent; marks\n     * it fresh (`updatedAt = now`). `updater` may be a value or a function of the previous data. */\n    setQueryData: <T>(key: unknown, updater: T | ((prev: T | undefined) => T)) => void;\n    /** Fetch + cache a query's data WITHOUT subscribing (SSR prefetch, hover warm). Resolves when cached;\n     * a fresh entry is a no-op. Rejects if the fetch throws (caller may swallow). */\n    prefetchQuery: <T>(key: unknown, fn: () => Promise<T>, options?: QueryOptions) => Promise<void>;\n    /** Serialize every successful query to a transferable snapshot (server → client SSR bridge). */\n    dehydrate: () => DehydratedState;\n    /** Seed the cache from a {@link dehydrate} snapshot (client boot). Existing fresher entries win. */\n    hydrate: (state: DehydratedState) => void;\n}",
     "doc": "/** The keyed query cache. One per app (a binding registers it like the router). */"
   },
   {
@@ -4564,6 +5972,13 @@
     "package": "@nifrajs/web",
     "signature": "export interface QueryClientOptions {\n    /** Monotonic clock in ms — injected so the core stays deterministic + testable; the adapter binding\n     * passes `() => Date.now()`. */\n    readonly now: () => number;\n    /** Data stays fresh this long after a fetch; older ⇒ refetch on the next `fetch()` (default `0`). */\n    readonly staleTime?: number;\n    /** Evict an entry this long (ms) after its last subscriber leaves (default 5 min). */\n    readonly gcTime?: number;\n    /** Hard cap on cached entries — LRU-evict the oldest *unsubscribed* entry past it (default 1000). */\n    readonly max?: number;\n}"
   },
+  {
+    "name": "QueryClientProvider",
+    "kind": "function",
+    "package": "@nifrajs/web-react",
+    "signature": "export declare function QueryClientProvider(props: {\n    readonly client: QueryClient;\n    readonly children?: ReactNode;\n}): ReactNode;",
+    "doc": "/** Provide a {@link QueryClient} to the tree — required for SSR dehydrate/hydrate and for tests; a\n * client-only app can omit it and rely on the built-in client-side singleton. */"
+  },
   {
     "name": "QueryHandle",
     "kind": "interface",
@@ -4577,6 +5992,13 @@
     "package": "@nifrajs/core",
     "signature": "export declare function queryObjectOf(search: string): Record<string, QueryValue>;"
   },
+  {
+    "name": "QueryOptions",
+    "kind": "interface",
+    "package": "@nifrajs/web",
+    "signature": "export interface QueryOptions {\n    /** Data stays fresh this long (ms) after a fetch; older ⇒ refetch on the next `fetch()`. Overrides\n     * the client default for this key. */\n    readonly staleTime?: number;\n}",
+    "doc": "/** Per-query overrides passed alongside the fetcher. */"
+  },
   {
     "name": "QueryState",
     "kind": "interface",
@@ -4649,6 +6071,13 @@
     "package": "@nifrajs/storage",
     "signature": "export declare class R2Storage implements StorageAdapter {\n    private readonly bucket;\n    constructor(bucket: R2BucketLike);\n    put(key: string, data: StorageData, options?: PutOptions): Promise<void>;\n    get(key: string): Promise<StorageObject | null>;\n    delete(key: string): Promise<void>;\n    exists(key: string): Promise<boolean>;\n    list(options?: ListOptions): Promise<string[]>;\n}"
   },
+  {
+    "name": "randomEffectDigestKey",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function randomEffectDigestKey(): Uint8Array;",
+    "doc": "/** Fresh random digest key (32 bytes). Per-process by default — persist one externally to correlate across restarts. */"
+  },
   {
     "name": "rateLimit",
     "kind": "function",
@@ -4749,6 +6178,27 @@
     "signature": "export declare function readImageDimensions(source: {\n    arrayBuffer(): Promise<ArrayBuffer>;\n    stream?: () => ReadableStream<Uint8Array>;\n}, maxBytes?: number): Promise<ImageInfo | null>;",
     "doc": "/**\n * Read just the leading bytes of an image file (via the platform `Bun.file`/`fetch` blob) and parse its\n * dimensions. Build-time tooling: pre-read dimensions into a manifest so `<Image>` is CLS-safe without\n * hardcoding sizes. Reads at most `maxBytes` (default 64 KB — enough for any header).\n */"
   },
+  {
+    "name": "recipe",
+    "kind": "const",
+    "package": "@nifrajs/cli",
+    "signature": "export declare const recipe: UpgradeRecipe;",
+    "doc": "/**\n * Upgrade recipe for nifra 1.8.0.\n *\n * 1.8.0 is a fixed-group bump: every `@nifrajs/*` package moves in lockstep. The pin sweep sets them\n * all to 1.8.0 (preserving each spec's `^`/`~`/exact style). 1.8.0 introduced no breaking import moves\n * in the public packages — the new surfaces (route assurance, adversarial testing, `@nifrajs/events`)\n * are additive — so `importMoves` is empty. The notes flag the additive follow-ups a bump can't do for\n * you (wiring the new assurance config), keeping the runner honest about what it did and didn't touch.\n */"
+  },
+  {
+    "name": "recordCapabilityOutcome",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function recordCapabilityOutcome(context: object, capability: string, options: CapabilityOutcomeOptions): void;",
+    "doc": "/** Record the terminal outcome of an already-admitted capability without debiting admission twice. */"
+  },
+  {
+    "name": "redactForEmission",
+    "kind": "function",
+    "package": "@nifrajs/testing",
+    "signature": "export declare function redactForEmission(value: unknown, allow: ReadonlySet<string>, path?: string): unknown;",
+    "doc": "/**\n * Redact leaf string values by default (unless the dotted key path is allow-listed). Non-strings are\n * kept — they carry the structure that makes the fixture reproduce — so review the emitted file. This\n * is intentionally aggressive: a committed fixture must not leak PII/secrets.\n */"
+  },
   {
     "name": "redactLogFields",
     "kind": "function",
@@ -4784,11 +6234,18 @@
     "signature": "export interface RedirectOptions {\n    /** HTTP status (default 303 See Other; pass 307/308 to preserve the method). */\n    readonly status?: number;\n    /** Allow an off-origin / absolute destination. Off by default: only a same-origin path (a single\n     * leading `/`) is permitted, so an action can't be turned into an open redirect by passing\n     * attacker-controlled input straight through. Set `true` for a deliberate external redirect. */\n    readonly external?: boolean;\n}",
     "doc": "/** Options for {@link redirect}. */"
   },
+  {
+    "name": "reflectClassification",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function reflectClassification(schema: unknown): ResponseClassification | undefined;",
+    "doc": "/** Read field-level metadata from an introspectable response schema. Never invokes its validator. */"
+  },
   {
     "name": "ReflectedRoute",
     "kind": "interface",
     "package": "@nifrajs/core",
-    "signature": "export interface ReflectedRoute {\n    readonly method: string;\n    readonly path: string;\n    readonly schema?: ReflectedRouteSchema;\n    readonly tool?: {\n        readonly name: string;\n        readonly description: string;\n        readonly annotations?: ToolAnnotations;\n    };\n}"
+    "signature": "export interface ReflectedRoute {\n    readonly method: string;\n    readonly path: string;\n    readonly schema?: ReflectedRouteSchema;\n    readonly assurance?: readonly AssuranceEvidence[];\n    readonly capabilities?: readonly string[];\n    /** Field-level response classification plus the highest sensitivity present. */\n    readonly classification?: ResponseClassification;\n    readonly tool?: {\n        readonly name: string;\n        readonly description: string;\n        readonly annotations?: ToolAnnotations;\n    };\n}"
   },
   {
     "name": "ReflectedRouteSchema",
@@ -4852,6 +6309,12 @@
     "signature": "export type RegistryOf<App> = App extends Server<infer R, infer _Ctx> ? R : never;",
     "doc": "/** Extract the accumulated route registry from a server's type (`typeof app`), ignoring its middleware context. */"
   },
+  {
+    "name": "RegistryParseResult",
+    "kind": "type",
+    "package": "@nifrajs/events",
+    "signature": "export type RegistryParseResult = {\n    readonly success: true;\n    readonly envelope: EventEnvelope;\n    readonly contract: EventContract;\n} | {\n    readonly success: false;\n    readonly reason: \"not-an-object\" | \"unknown-contract\" | \"invalid-payload\";\n    readonly message: string;\n};"
+  },
   {
     "name": "RenderAdapter",
     "kind": "interface",
@@ -4925,7 +6388,7 @@
     "name": "RenderPageOptions",
     "kind": "interface",
     "package": "@nifrajs/web",
-    "signature": "export interface RenderPageOptions {\n    readonly adapter: RenderAdapter;\n    /** The layout chain to render — outermost layout → page (opaque; the adapter renders it). */\n    readonly chain: readonly unknown[];\n    /** The loader output for this request. */\n    readonly data: unknown;\n    /** An action's data return (POST only) — surfaced to the page as `actionData` + serialized\n     * for the client so post-POST hydration matches. Omit on GETs. */\n    readonly actionData?: unknown;\n    /** URL of the built client entry (loaded as a module script). */\n    readonly clientEntry: string;\n    /** Chunk URLs for the **matched** route (its layout chain + own chunk) to `modulepreload` in the\n     * shell — so the route code downloads in parallel with the entry instead of after it\n     * (`buildClient`'s per-route map). Empty/omitted ⇒ only the entry is preloaded (unchanged). */\n    readonly preload?: readonly string[];\n    /** Stylesheet URLs for the **matched** route (its layout chain + own CSS, from `buildClient`'s\n     * `BuildManifest.css`) — injected as `<link rel=\"stylesheet\">` in `<head>` so styles arrive with the\n     * first paint (no FOUC). Rendered even on non-hydrated pages. Empty/omitted ⇒ none (unchanged). */\n    readonly styles?: readonly string[];\n    /** SSG: the prerendered-path set, serialized to `window.__NIFRA_PRERENDERED__` so the client fetches\n     * a static `_data.json` on soft-nav into a prerendered route. Empty/omitted ⇒ not injected. */\n    readonly prerenderedPaths?: readonly string[];\n    /** ISR: route freshness in seconds, emitted as the `x-nifra-isr-revalidate` header for a `withISR`\n     * wrapper to read. Omit ⇒ no header (the wrapper's default TTL applies). */\n    readonly revalidate?: number;\n    /** Matched route id; written to `window.__NIFRA_ROUTE__` so the client hydrates this chain. */\n    readonly routeId?: string;\n    /** HTTP status for the response (default 200; e.g. 404 for a not-found page). */\n    readonly status?: number;\n    /** Document title (fallback when `head.title` is unset). */\n    readonly title?: string;\n    /** Resolved route head — `title` overrides `title` above; `meta`/`link` render as managed\n     * (`data-nifra`) tags the client updates on navigation.\n     *\n     * **Head contract (the layout chain contributes).** `createWebApp` resolves this via\n     * {@link mergeHeads}: a route's head is its **layout chain's** `meta`/`head` exports merged with the\n     * page's. A `_layout.tsx` may `export const meta` (or `export function meta(args)`) — its tags land\n     * on every page below it (the home for `hreflang`, `preconnect`, a section-default `<title>`). The\n     * merge is **nearest-wins for scalars** (the page's `title` overrides an inner layout's, which\n     * overrides an outer one; an undefined page title keeps the layout's) and **concatenated for the\n     * `meta`/`link` arrays** (outermost layout first, page last). `<link>` attributes are name-validated\n     * (any letter/digit/hyphen name — covers `rel`/`href`/`hreflang`/`crossorigin`/`media`/`sizes`/`as`/\n     * `integrity`/`fetchpriority`/…) and value-escaped against XSS. */\n    readonly head?: Meta;\n    /** Id of the container wrapping the app markup (default `\"root\"`). */\n    readonly rootId?: string;\n    /** When `false`, emit a complete but **non-hydrated** document — no client entry script, data\n     * globals, or modulepreloads. Used for server-rendered `_error` pages: a terminal state that needs no\n     * client takeover, and it sidesteps an SSR/hydrate mismatch (the server rendered the boundary, not\n     * the page the client manifest maps this route id to). Default `true`. */\n    readonly hydrate?: boolean;\n    /** Island client bundles (`@nifrajs/web/islands`) to load as `<script type=\"module\">` in the document\n     * tail — emitted **regardless of `hydrate`**, so a static (`hydrate: false`) page can still mount\n     * no-framework islands. URLs are attribute-escaped. Empty/omitted ⇒ none (unchanged output). */\n    readonly islandScripts?: readonly string[];\n}"
+    "signature": "export interface RenderPageOptions {\n    readonly adapter: RenderAdapter;\n    /** The layout chain to render — outermost layout → page (opaque; the adapter renders it). */\n    readonly chain: readonly unknown[];\n    /** The loader output for this request. */\n    readonly data: unknown;\n    /** An action's data return (POST only) — surfaced to the page as `actionData` + serialized\n     * for the client so post-POST hydration matches. Omit on GETs. */\n    readonly actionData?: unknown;\n    /** URL of the built client entry (loaded as a module script). */\n    readonly clientEntry: string;\n    /** Chunk URLs for the **matched** route (its layout chain + own chunk) to `modulepreload` in the\n     * shell — so the route code downloads in parallel with the entry instead of after it\n     * (`buildClient`'s per-route map). Empty/omitted ⇒ only the entry is preloaded (unchanged). */\n    readonly preload?: readonly string[];\n    /** Stylesheet URLs for the **matched** route (its layout chain + own CSS, from `buildClient`'s\n     * `BuildManifest.css`) — injected as `<link rel=\"stylesheet\">` in `<head>` so styles arrive with the\n     * first paint (no FOUC). Rendered even on non-hydrated pages. Empty/omitted ⇒ none (unchanged). */\n    readonly styles?: readonly string[];\n    /** SSG: the prerendered-path set, serialized to `window.__NIFRA_PRERENDERED__` so the client fetches\n     * a static `_data.json` on soft-nav into a prerendered route. Empty/omitted ⇒ not injected. */\n    readonly prerenderedPaths?: readonly string[];\n    /** ISR: route freshness in seconds, emitted as the `x-nifra-isr-revalidate` header for a `withISR`\n     * wrapper to read. Omit ⇒ no header (the wrapper's default TTL applies). */\n    readonly revalidate?: number;\n    /** Matched route id; written to `window.__NIFRA_ROUTE__` so the client hydrates this chain. */\n    readonly routeId?: string;\n    /** The matched route's decoded path params — surfaced to the page as `params` (via {@link RenderProps})\n     * so an adapter's `useParams` is SSR-correct. Omit ⇒ `{}` (a route with no dynamic segments, or an\n     * error/404 render). */\n    readonly params?: Readonly<Record<string, string>>;\n    /** The request's `pathname + search` — surfaced as `path` (via {@link RenderProps}) so an adapter's\n     * `useLocation`/`useSearchParams` render the right URL server-side and hydrate without drift. Omit ⇒\n     * `\"\"`. */\n    readonly path?: string;\n    /** HTTP status for the response (default 200; e.g. 404 for a not-found page). */\n    readonly status?: number;\n    /** Document title (fallback when `head.title` is unset). */\n    readonly title?: string;\n    /** Resolved route head — `title` overrides `title` above; `meta`/`link` render as managed\n     * (`data-nifra`) tags the client updates on navigation.\n     *\n     * **Head contract (the layout chain contributes).** `createWebApp` resolves this via\n     * {@link mergeHeads}: a route's head is its **layout chain's** `meta`/`head` exports merged with the\n     * page's. A `_layout.tsx` may `export const meta` (or `export function meta(args)`) — its tags land\n     * on every page below it (the home for `hreflang`, `preconnect`, a section-default `<title>`). The\n     * merge is **nearest-wins for scalars** (the page's `title` overrides an inner layout's, which\n     * overrides an outer one; an undefined page title keeps the layout's) and **concatenated for the\n     * `meta`/`link` arrays** (outermost layout first, page last). `<link>` attributes are name-validated\n     * (any letter/digit/hyphen name — covers `rel`/`href`/`hreflang`/`crossorigin`/`media`/`sizes`/`as`/\n     * `integrity`/`fetchpriority`/…) and value-escaped against XSS. */\n    readonly head?: Meta;\n    /** Id of the container wrapping the app markup (default `\"root\"`). */\n    readonly rootId?: string;\n    /** When `false`, emit a complete but **non-hydrated** document — no client entry script, data\n     * globals, or modulepreloads. Used for server-rendered `_error` pages: a terminal state that needs no\n     * client takeover, and it sidesteps an SSR/hydrate mismatch (the server rendered the boundary, not\n     * the page the client manifest maps this route id to). Default `true`. */\n    readonly hydrate?: boolean;\n    /** Island client bundles (`@nifrajs/web/islands`) to load as `<script type=\"module\">` in the document\n     * tail — emitted **regardless of `hydrate`**, so a static (`hydrate: false`) page can still mount\n     * no-framework islands. URLs are attribute-escaped. Empty/omitted ⇒ none (unchanged output). */\n    readonly islandScripts?: readonly string[];\n}"
   },
   {
     "name": "renderPageResult",
@@ -4944,7 +6407,7 @@
     "name": "RenderProps",
     "kind": "interface",
     "package": "@nifrajs/web",
-    "signature": "export interface RenderProps {\n    readonly data: unknown;\n    readonly actionData?: unknown;\n    /** True while a client navigation or submit is in flight (client-only; absent/false on SSR). */\n    readonly pending?: boolean;\n    /** The in-flight client submit, for optimistic UI (client-only; absent on SSR + when idle). */\n    readonly submission?: Submission;\n}",
+    "signature": "export interface RenderProps {\n    readonly data: unknown;\n    readonly actionData?: unknown;\n    /** True while a client navigation or submit is in flight (client-only; absent/false on SSR). */\n    readonly pending?: boolean;\n    /** The in-flight client submit, for optimistic UI (client-only; absent on SSR + when idle). */\n    readonly submission?: Submission;\n    /** The matched route's decoded path params (`/users/:id` → `{ id: \"7\" }`). Threaded identically on\n     * SSR (from the request match) and on client navigation (from router state) so an adapter's\n     * `useParams` reads the same value on both, with no hydration mismatch. Absent ⇒ no params (`{}`). */\n    readonly params?: Readonly<Record<string, string>>;\n    /** The current URL's `pathname + search` (no hash — the hash never reaches the server). Threaded on\n     * SSR and client alike so an adapter's `useLocation`/`useSearchParams` hydrate consistently. Absent\n     * on adapters/callers that don't supply it (treated as `\"\"`). */\n    readonly path?: string;\n}",
     "doc": "/** The data handed to a route component. Opaque to the core. `actionData` is the return of a\n * route `action` after a POST (absent on plain GETs). `pending` + `submission` are client-only\n * (absent on SSR): they drive **optimistic UI** — render from `submission.formData` while `pending`. */"
   },
   {
@@ -4976,11 +6439,24 @@
     "doc": "/**\n * Render a {@link SizeReport} as a terse aligned table (biggest first) with a totals row — the text\n * `nifra build --report` prints. Pure (string in, string out) so the formatting is unit-testable.\n */"
   },
   {
-    "name": "renderTypesResult",
-    "kind": "function",
-    "package": "@nifrajs/cli",
-    "signature": "export declare function renderTypesResult(types: readonly TypeEntry[], name: string | undefined, query: string | undefined, limit: number): string;",
-    "doc": "/**\n * Render the tool result. `name` → the exact declaration(s); else `query` → the top matches; else a\n * per-package index of type names. The signatures are authoritative (generated from the built `.d.ts`),\n * so this is the complete answer — there is no need to read a `.d.ts` file.\n */"
+    "name": "renderTypesResult",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function renderTypesResult(types: readonly TypeEntry[], name: string | undefined, query: string | undefined, limit: number): string;",
+    "doc": "/**\n * Render the tool result. `name` → the exact declaration(s); else `query` → the top matches; else a\n * per-package index of type names. The signatures are authoritative (generated from the built `.d.ts`),\n * so this is the complete answer — there is no need to read a `.d.ts` file.\n */"
+  },
+  {
+    "name": "replayIncident",
+    "kind": "function",
+    "package": "@nifrajs/testing",
+    "signature": "export declare function replayIncident(app: AppLike, capsule: IncidentCapsule, options?: ReplayIncidentOptions): Promise<IncidentReplayResult>;",
+    "doc": "/** Replay a captured incident against the current app and report whether it reproduces. */"
+  },
+  {
+    "name": "ReplayIncidentOptions",
+    "kind": "interface",
+    "package": "@nifrajs/testing",
+    "signature": "export interface ReplayIncidentOptions {\n    readonly origin?: string;\n    /** Also require the response body SHAPE to match the captured shape (not just status). Default false. */\n    readonly assertShape?: boolean;\n}"
   },
   {
     "name": "reproduciblePath",
@@ -4989,6 +6465,13 @@
     "signature": "export declare function reproduciblePath(absolutePath: string): string;",
     "doc": "/**\n * A **package-root-relative**, forward-slashed form of an absolute path — the input to {@link hash8} for\n * any build-stable identifier (e.g. CSS-module scoped names). Anchoring on the file's nearest\n * `package.json` (not the absolute path, not `process.cwd()`) makes the result independent of BOTH the\n * machine's directory layout AND the working directory: the dom build and the ssr runtime — even on\n * different machines or from different cwds — derive the SAME relative path for a given file, so their\n * scoped class maps always agree. (Hashing the absolute path would differ across CI/host; a\n * cwd-relative path would silently desync if the SSR server started from a non-project-root cwd.)\n */"
   },
+  {
+    "name": "RequestBudget",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface RequestBudget {\n    /** Absolute Unix epoch deadline for wire propagation. */\n    readonly deadline: number;\n    /** The request cancellation signal. Nifra drives this when its effective deadline elapses. */\n    readonly signal: AbortSignal;\n    /** Non-negative milliseconds remaining, measured with the monotonic clock. */\n    remaining(): number;\n    /** A view that finishes `reserveMs` before this budget, preserving time for response cleanup. */\n    child(reserveMs: number): RequestBudget;\n}",
+    "doc": "/** A time budget shared by one request and every downstream hop it initiates. */"
+  },
   {
     "name": "requestId",
     "kind": "function",
@@ -5002,6 +6485,13 @@
     "package": "@nifrajs/middleware",
     "signature": "export interface RequestIdOptions {\n    /** Header read for an inbound id (trace propagation) + echoed on the response. Default `\"x-request-id\"`. */\n    readonly header?: string;\n    /** Generate an id when the inbound header is absent. Default `crypto.randomUUID()`. */\n    readonly generate?: () => string;\n}"
   },
+  {
+    "name": "RequestLedger",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface RequestLedger {\n    /** Validate, freeze, and record one entry. Throws on invalid input, overflow, or after seal. */\n    append(input: EffectEntryInput): EffectEntry;\n    /** Entries recorded so far (frozen snapshot view). */\n    entries(): readonly EffectEntry[];\n    readonly size: number;\n    readonly sealed: boolean;\n    /** Finalize the ledger (computing the chain when enabled). Idempotent — always the same result. */\n    seal(): Promise<SealedEffectLedger>;\n}",
+    "doc": "/** Per-request ledger. `append` is synchronous (hot-path safe); `seal` is idempotent and async. */"
+  },
   {
     "name": "RequestLogFields",
     "kind": "interface",
@@ -5169,6 +6659,13 @@
     "package": "@nifrajs/middleware",
     "signature": "export interface ResponseCacheStore {\n    get(key: string): MaybePromise<CachedResponse | undefined>;\n    set(key: string, response: CachedResponse): MaybePromise<void>;\n    delete?(key: string): MaybePromise<void>;\n}"
   },
+  {
+    "name": "ResponseClassification",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface ResponseClassification {\n    readonly fields: Readonly<Record<string, DataClassification>>;\n    readonly max: DataClassification;\n}",
+    "doc": "/** Field paths use JSON Pointer segments; array items use a `*` segment. */"
+  },
   {
     "name": "ResponseControls",
     "kind": "interface",
@@ -5190,6 +6687,13 @@
     "signature": "export interface ResponseFinalization {\n    /** The final response, or the last response available when a transformation failed. */\n    readonly response: Response;\n    /** A response-hook failure. Terminal observers run fail-open before the error is rethrown. */\n    readonly error?: unknown;\n}",
     "doc": "/** The terminal response-pipeline outcome observed after every transforming `onResponse` hook. */"
   },
+  {
+    "name": "responseFromStored",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function responseFromStored(stored: StoredResponse, options?: {\n    readonly maxBytes?: number;\n}): Response;",
+    "doc": "/** Rebuild a live response from storage, stamping the replay marker header. */"
+  },
   {
     "name": "Result",
     "kind": "type",
@@ -5237,6 +6741,13 @@
     "signature": "export interface RevalidateResult<T> {\n    readonly __nifraRevalidate: readonly string[];\n    readonly data: T;\n}",
     "doc": "/** The wrapper `revalidate()` returns: the action's `data` plus the paths it changed. A plain tagged\n * shape (not a class) so `@nifrajs/client`'s `ActionData` can unwrap it structurally without importing\n * from `@nifrajs/web`. `createWebApp` strips the wrapper — the client receives `data` as the body and\n * the paths via the `X-Nifra-Revalidate` header. */"
   },
+  {
+    "name": "rewriteVersionSpec",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function rewriteVersionSpec(spec: string, toVersion: string): string | null;",
+    "doc": "/**\n * Rewrite a dependency version spec to `toVersion`, preserving the range operator (`^`, `~`, …).\n * Returns null when the spec is not a plain semver spec (→ skip it) or already equals the target.\n */"
+  },
   {
     "name": "robots",
     "kind": "function",
@@ -5270,12 +6781,25 @@
     "signature": "export type RouteBody<App, Path extends string, Method extends string> = Path extends keyof RegistryOf<App> ? Uppercase<Method> extends keyof RegistryOf<App>[Path] ? (RegistryOf<App>[Path][Uppercase<Method>] & RouteInfo)[\"body\"] : never : never;",
     "doc": "/** The body object type of `App`'s `Method Path` route (`never` when the route declares no body). */"
   },
+  {
+    "name": "RouteCapabilityEvidence",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface RouteCapabilityEvidence {\n    readonly method: string;\n    readonly path: string;\n    /** True only when the route's reachable module graph was actually scanned. */\n    readonly covered: boolean;\n    readonly evidence: readonly CapabilityEvidence[];\n}"
+  },
   {
     "name": "RouteChange",
     "kind": "interface",
     "package": "@nifrajs/core",
     "signature": "export interface RouteChange {\n    readonly severity: DiffSeverity;\n    readonly method: string;\n    readonly path: string;\n    /** Which part of the contract changed; \"route\" for add/remove of the whole route. */\n    readonly section: \"route\" | \"body\" | \"query\" | \"response\" | \"sse\" | \"errors\";\n    /** The top-level field (or error status) the change is about, when field-granular. */\n    readonly field?: string;\n    readonly message: string;\n}"
   },
+  {
+    "name": "routeClassification",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function routeClassification(responseSchema: unknown, fallback: DataClassification | undefined): ResponseClassification | undefined;",
+    "doc": "/** Merge field metadata with an optional route-level sensitivity fallback. */"
+  },
   {
     "name": "RouteConfigError",
     "kind": "class",
@@ -5287,14 +6811,14 @@
     "name": "RouteConfigErrorCode",
     "kind": "type",
     "package": "@nifrajs/core",
-    "signature": "export type RouteConfigErrorCode = \"DUPLICATE_ROUTE\" | \"DUPLICATE_PARAM\" | \"PARAM_NAME_CONFLICT\" | \"INVALID_PATH\" | \"INVALID_PARAM_NAME\" | \"WILDCARD_NOT_LAST\" | \"INVALID_METHOD\";",
+    "signature": "export type RouteConfigErrorCode = \"DUPLICATE_ROUTE\" | \"DUPLICATE_PARAM\" | \"PARAM_NAME_CONFLICT\" | \"INVALID_PATH\" | \"INVALID_PARAM_NAME\" | \"WILDCARD_NOT_LAST\" | \"INVALID_METHOD\" | \"INVALID_ASSURANCE\" | \"INVALID_IDEMPOTENCY\";",
     "doc": "/** Stable codes for boot-time (L2) route configuration failures. */"
   },
   {
     "name": "RouteDescriptor",
     "kind": "interface",
     "package": "@nifrajs/core",
-    "signature": "export interface RouteDescriptor {\n    readonly method: Method;\n    readonly path: string;\n    readonly schema: RouteSchema | undefined;\n    readonly tool?: {\n        readonly name: string;\n        readonly description: string;\n        readonly annotations?: ToolAnnotations;\n    };\n}",
+    "signature": "export interface RouteDescriptor {\n    readonly method: Method;\n    readonly path: string;\n    readonly schema: RouteSchema | undefined;\n    /** Effective enforcement evidence, populated only during reflection/introspection. */\n    readonly assurance?: readonly AssuranceEvidence[];\n    /** Normalized declared effect tokens, populated only when the route declares any. */\n    readonly capabilities?: readonly string[];\n    readonly tool?: {\n        readonly name: string;\n        readonly description: string;\n        readonly annotations?: ToolAnnotations;\n    };\n}",
     "doc": "/**\n * A registered route's public descriptor — method, path, and input schemas. The\n * router trie discards the original patterns, so this flat list is what lets tools\n * (e.g. `toOpenAPI`) enumerate routes after registration.\n */"
   },
   {
@@ -5304,6 +6828,13 @@
     "signature": "export interface RouteEntry {\n    readonly id: string;\n    readonly pattern: string;\n    readonly layoutIds: readonly string[];\n    /** `_error` boundary ids in this route's ancestor chain (outermost → innermost). The last is the\n     * **nearest** boundary, rendered when the route's loader throws. Always set by `buildManifest`\n     * (optional only so hand-built test manifests may omit it); absent/empty ⇒ no boundary (error 500s). */\n    readonly errorIds?: readonly string[];\n    readonly file: string;\n    readonly load: () => Promise<RouteModule>;\n}",
     "doc": "/** One matched route: pattern, nested layout ids (outermost → innermost), source file, loader. */"
   },
+  {
+    "name": "routeGlob",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function routeGlob(pattern: string): RegExp;",
+    "doc": "/** Compile an absolute route glob. `*` is one segment; `**` is zero or more segments. */"
+  },
   {
     "name": "RouteInfo",
     "kind": "interface",
@@ -5388,6 +6919,20 @@
     "signature": "export declare class Router<T> {\n    private readonly root;\n    /**\n     * Fast path: fully-static paths (no `:param`/`*`) resolve in a single map\n     * lookup keyed by the full path, skipping the trie walk entirely. Values are\n     * the same `Terminal` objects held in the trie, so adding a method later\n     * updates both views at once.\n     */\n    private readonly staticRoutes;\n    /**\n     * Scratch storage for param/wildcard captures during a synchronous trie walk. `find()` copies the\n     * values into the returned params object before clearing this array, so returned matches never share\n     * mutable state. Kept per Router instance, not module-global, to avoid cross-app coupling.\n     */\n    private readonly paramValuesScratch;\n    constructor();\n    /**\n     * Register a payload for `method` + `path`. Throws {@link RouteConfigError}\n     * (boot-time, L2) on a duplicate route, a malformed pattern, or conflicting\n     * parameter names for the same path shape.\n     */\n    add(method: Method, path: string, payload: T): void;\n    /**\n     * Resolve `method` + `path`. Tolerant of a missing leading slash and of\n     * method casing. Never throws.\n     */\n    find(method: string, path: string): RouterMatch<T>;\n    private findDynamic;\n    private maybeCacheDynamicMatch;\n}",
     "doc": "/**\n * Radix-style segment trie router. Matching precedence is static > param >\n * wildcard. Parameter/wildcard values are returned RAW (not percent-decoded);\n * the server boundary decodes and rejects malformed encodings with a 400,\n * keeping this layer pure and allocation-light.\n *\n * @typeParam T - the payload stored per (method, path); a route descriptor in\n * practice, but the router is agnostic to it.\n */"
   },
+  {
+    "name": "RouterContext",
+    "kind": "const",
+    "package": "@nifrajs/web-react",
+    "signature": "export declare const RouterContext: import(\"react\").Context<RouterContextValue>;",
+    "doc": "/** Router context. The default ({} params, \"\" path) is what a component sees when rendered outside a\n * nifra route tree — the hooks stay defined (no throw) so a stray `useParams` degrades gracefully. */"
+  },
+  {
+    "name": "RouterContextValue",
+    "kind": "interface",
+    "package": "@nifrajs/web-react",
+    "signature": "export interface RouterContextValue {\n    /** The matched route's decoded path params (`/users/:id` → `{ id: \"7\" }`). */\n    readonly params: Readonly<Record<string, string>>;\n    /** The current URL's `pathname + search` (no hash — the router never carries one). */\n    readonly path: string;\n}",
+    "doc": "/** The current route the routing hooks read. Provided by `compose` on SSR + client mount alike. */"
+  },
   {
     "name": "RouterMatch",
     "kind": "type",
@@ -5406,7 +6951,7 @@
     "name": "RouteSchema",
     "kind": "interface",
     "package": "@nifrajs/core",
-    "signature": "export interface RouteSchema {\n    readonly body?: StandardSchemaV1;\n    readonly query?: StandardSchemaV1;\n    /** Optional **response contract**. When declared: the handler's return is type-checked against it\n     * (the implementation can't drift from the contract), the typed client sees THIS as the response type\n     * (the contract — not the handler's incidental return), and it's emitted into OpenAPI/JSON-Schema so\n     * tooling and coding agents can read the exact shape. It is **not** validated at runtime (zero\n     * hot-path cost) — purely a compile-time + introspection contract. */\n    readonly response?: StandardSchemaV1;\n    /**\n     * Optional **error-response contract**: a map of HTTP status code → the Standard Schema of that error's\n     * body. Declares a route's failure modes so they flow into OpenAPI (as non-2xx `responses`), the\n     * `/llms.txt` context, and other introspection — the whole contract, not just the happy path, is legible\n     * to tooling and coding agents. Like `response`, it is **not** validated at runtime (zero hot-path cost);\n     * it's a compile-time + introspection contract. Example: `{ 404: NotFound, 409: Conflict }`. */\n    readonly errors?: Readonly<Record<number, StandardSchemaV1>>;\n    /**\n     * Optional **SSE event contract**: the Standard Schema of each event's `data` payload on a\n     * streaming route (declared via `app.sse()`). Marks the route as a typed event stream — the\n     * typed client grows a `.subscribe()` for it, and the schema flows into reflection. Like\n     * `response`, it is **not** validated at runtime (zero hot-path cost); the server-side\n     * `stream.send()` is compile-time-checked against it instead.\n     */\n    readonly sse?: StandardSchemaV1;\n    /**\n     * Hook fired when the request fails `body`/`query` validation, before the handler runs. `kind` says\n     * which input failed (`\"body\"` | `\"query\"`). Its return value selects one of three outcomes (may be async):\n     *   - a **`Response`** → returned as-is, short-circuiting the route (custom error envelope, redirect, …).\n     *   - **any other value** → treated as a repaired payload and **re-validated once** against the same\n     *     schema. If it now passes, the handler runs with it; if it still fails, the original `422` stands.\n     *     Re-validation means a bad return can't bypass the schema — the trust boundary holds.\n     *   - **`undefined`** → give up; the original validation `422` is returned unchanged.\n     * A route hook **overrides** the app-wide default set via `server({ onValidationError })`; return\n     * `undefined` to fall through to the plain `422` even when an app default exists. Typical uses: a custom\n     * error envelope, coercing the input, or prompting an LLM to repair the payload (re-validated, so it can't\n     * bypass the schema).\n     */\n    readonly onValidationError?: (issues: ReadonlyArray<StandardIssue>, ctx: Context, kind: \"body\" | \"query\") => Response | unknown | Promise<Response | unknown>;\n}",
+    "signature": "export interface RouteSchema {\n    /** Declared effect tokens. Reflected for assurance; never read by validation or serialization. */\n    readonly capabilities?: readonly string[];\n    /**\n     * Dedupe retries of this (mutating) route on an `Idempotency-Key` header. The first request runs and\n     * its response is stored; a retry with the same key replays that response without re-running the\n     * handler, and a key reused with a different body is rejected (409). A missing key on an\n     * idempotency-required route fails closed (400). Off the hot path — routes without it are unchanged.\n     */\n    readonly idempotency?: IdempotencyConfig;\n    /**\n     * Highest data-sensitivity this route's response body carries (`public` | `pii` | `secret`). A\n     * declarative, compile-time + introspection fact — never validated at runtime. Reflected for tooling,\n     * recorded in the capability lockfile (so a route that starts returning PII is a reviewable change),\n     * and read by downstream policy (e.g. a partner-API surface refusing to expose `pii`/`secret`).\n     */\n    readonly classification?: DataClassification;\n    readonly body?: StandardSchemaV1;\n    readonly query?: StandardSchemaV1;\n    /** Optional **response contract**. When declared: the handler's return is type-checked against it\n     * (the implementation can't drift from the contract), the typed client sees THIS as the response type\n     * (the contract — not the handler's incidental return), and it's emitted into OpenAPI/JSON-Schema so\n     * tooling and coding agents can read the exact shape. It is **not** validated at runtime (zero\n     * hot-path cost) — purely a compile-time + introspection contract. */\n    readonly response?: StandardSchemaV1;\n    /**\n     * Optional **error-response contract**: a map of HTTP status code → the Standard Schema of that error's\n     * body. Declares a route's failure modes so they flow into OpenAPI (as non-2xx `responses`), the\n     * `/llms.txt` context, and other introspection — the whole contract, not just the happy path, is legible\n     * to tooling and coding agents. Like `response`, it is **not** validated at runtime (zero hot-path cost);\n     * it's a compile-time + introspection contract. Example: `{ 404: NotFound, 409: Conflict }`. */\n    readonly errors?: Readonly<Record<number, StandardSchemaV1>>;\n    /**\n     * Optional **SSE event contract**: the Standard Schema of each event's `data` payload on a\n     * streaming route (declared via `app.sse()`). Marks the route as a typed event stream — the\n     * typed client grows a `.subscribe()` for it, and the schema flows into reflection. Like\n     * `response`, it is **not** validated at runtime (zero hot-path cost); the server-side\n     * `stream.send()` is compile-time-checked against it instead.\n     */\n    readonly sse?: StandardSchemaV1;\n    /**\n     * Hook fired when the request fails `body`/`query` validation, before the handler runs. `kind` says\n     * which input failed (`\"body\"` | `\"query\"`). Its return value selects one of three outcomes (may be async):\n     *   - a **`Response`** → returned as-is, short-circuiting the route (custom error envelope, redirect, …).\n     *   - **any other value** → treated as a repaired payload and **re-validated once** against the same\n     *     schema. If it now passes, the handler runs with it; if it still fails, the original `422` stands.\n     *     Re-validation means a bad return can't bypass the schema — the trust boundary holds.\n     *   - **`undefined`** → give up; the original validation `422` is returned unchanged.\n     * A route hook **overrides** the app-wide default set via `server({ onValidationError })`; return\n     * `undefined` to fall through to the plain `422` even when an app default exists. Typical uses: a custom\n     * error envelope, coercing the input, or prompting an LLM to repair the payload (re-validated, so it can't\n     * bypass the schema).\n     */\n    readonly onValidationError?: (issues: ReadonlyArray<StandardIssue>, ctx: Context, kind: \"body\" | \"query\") => Response | unknown | Promise<Response | unknown>;\n}",
     "doc": "/** Per-route input schemas. Each is any Standard Schema (zod/valibot/arktype/…). */"
   },
   {
@@ -5474,6 +7019,13 @@
     "signature": "export declare function run(argv: readonly string[]): Promise<{\n    code: 0 | 1;\n    message: string;\n}>;",
     "doc": "/**\n * Run the CLI for `argv` and return the exit code + the message to print — no `process.exit`, `console`,\n * or `process.argv`, so the whole flow (parse → scaffold → next-steps) is unit-testable in-process.\n */"
   },
+  {
+    "name": "runAdversarialContract",
+    "kind": "function",
+    "package": "@nifrajs/testing",
+    "signature": "export declare function runAdversarialContract(app: ContractTestApp, options?: AdversarialContractOptions): Promise<AdversarialContractReport>;",
+    "doc": "/**\n * Execute contract-derived hostile inputs and declared-response conformance against a runtime matrix.\n * Runtime/request failures are captured in the report; inspect `report.ok`, `failures`, and `gaps`\n * (or use {@link assertAdversarialContract} for a throwing test assertion).\n */"
+  },
   {
     "name": "runApp",
     "kind": "function",
@@ -5481,6 +7033,12 @@
     "signature": "export declare function runApp(app: AppLike, requests: readonly RequestSpec[], options?: RunOptions): Promise<RunResult[]>;",
     "doc": "/**\n * Run a batch of requests through the app, in order, and return a result per request. Never throws:\n * an app crash on any request is captured as that result's `error` and the run continues.\n */"
   },
+  {
+    "name": "runAssurance",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function runAssurance(cwd: string, options?: {\n    readonly json?: boolean;\n    readonly config?: string;\n}): Promise<boolean>;"
+  },
   {
     "name": "runBackend",
     "kind": "function",
@@ -5488,6 +7046,20 @@
     "signature": "export declare function runBackend(cwd: string, requests: unknown, entry?: string): Promise<{\n    results: unknown;\n} | {\n    error: string;\n}>;",
     "doc": "/**\n * Resolve the backend entry under `cwd`, import it, and run `requests` through its exported app. Never\n * throws — every failure (missing/invalid entry, import/compile/runtime error) becomes `{ error }`, so\n * the caller (and the agent) always gets actionable output. An import error here IS the failure the\n * agent needs to see and fix.\n */"
   },
+  {
+    "name": "runCapabilityCheck",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function runCapabilityCheck(cwd: string, options?: {\n    readonly config?: string;\n    readonly lockfile?: string;\n    readonly json?: boolean;\n}): Promise<boolean>;",
+    "doc": "/** Fail on assurance violations or any drift from the checked-in capability lockfile. */"
+  },
+  {
+    "name": "runCapabilitySnapshot",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function runCapabilitySnapshot(cwd: string, options?: {\n    readonly config?: string;\n    readonly out?: string;\n}): Promise<boolean>;",
+    "doc": "/** Write a lockfile only from a clean, fully-covered project report. */"
+  },
   {
     "name": "runCheck",
     "kind": "function",
@@ -5495,6 +7067,13 @@
     "signature": "export declare function runCheck(cwd: string, opts?: {\n    readonly json?: boolean;\n    readonly lintsOnly?: boolean;\n}): Promise<boolean>;",
     "doc": "/** Run the full check; print a report (`--json` for machine output) and return whether it passed. */"
   },
+  {
+    "name": "runContractInvariants",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function runContractInvariants(app: ReflectableApp, options?: RunInvariantsOptions): Promise<InvariantReport>;",
+    "doc": "/** Run the contract-derived invariant suite against a reflectable app. Pure; no ambient state. */"
+  },
   {
     "name": "runDiff",
     "kind": "function",
@@ -5516,6 +7095,33 @@
     "signature": "export declare function runInitAgents(cwd: string, opts?: {\n    readonly json?: boolean;\n    readonly force?: boolean;\n}): Promise<boolean>;",
     "doc": "/**\n * CLI entry: run the retrofit at `cwd` and print the result. Returns `true` (the command always succeeds\n * unless a write throws — which propagates as a non-zero exit via the dispatcher's catch). `--json`\n * emits the structured result for agents/CI.\n */"
   },
+  {
+    "name": "RunInvariantsOptions",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface RunInvariantsOptions {\n    /** Deterministic seed for the fuzzer. Default 1. */\n    readonly seed?: number;\n    /** Valid-input cases per route. Default 8. */\n    readonly casesPerRoute?: number;\n    /** Invalid-input (mutated) cases per route with a body schema. Default 4. */\n    readonly invalidCasesPerRoute?: number;\n    /**\n     * Explicit isolated executor for dynamic cases. It must point at a disposable test app, sandbox,\n     * or transaction that is rolled back. The runner never calls `source.fetch()` implicitly: doing so\n     * could charge cards, send mail, or mutate production state merely by running a verification tool.\n     */\n    readonly executor?: InvariantExecutor;\n}"
+  },
+  {
+    "name": "runLevels",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function runLevels(cwd: string, options?: CollectLevelsOptions & {\n    readonly json?: boolean;\n    readonly min?: number;\n}): Promise<boolean>;",
+    "doc": "/** CLI entry: print the ladder (or JSON) and return whether the requested floor is met. */"
+  },
+  {
+    "name": "runManifestDiff",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function runManifestDiff(cwd: string, beforePath: string, afterPath: string, options?: {\n    readonly json?: boolean;\n}): Promise<boolean>;",
+    "doc": "/** Diff two already-emitted, hash-verified artifacts. Suitable for deploy promotion gates. */"
+  },
+  {
+    "name": "runManifestEmit",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function runManifestEmit(cwd: string, options?: {\n    readonly config?: string;\n    readonly out?: string;\n    readonly sign?: string;\n}): Promise<boolean>;",
+    "doc": "/** Build only after both assurance layers pass, then optionally create an operator-signed sidecar. */"
+  },
   {
     "name": "runMcpServer",
     "kind": "function",
@@ -5582,6 +7188,13 @@
     "signature": "export declare function runSnapshot(cwd: string, options: {\n    out?: string;\n}): Promise<void>;",
     "doc": "/** `nifra snapshot`: write the current contract as the CI baseline. */"
   },
+  {
+    "name": "runUpgrade",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function runUpgrade(cwd: string, options: UpgradeOptions): Promise<boolean>;",
+    "doc": "/** CLI entry. Returns false (→ non-zero exit) on an unknown version, no project, or a failed verify. */"
+  },
   {
     "name": "runWebSocket",
     "kind": "function",
@@ -5652,6 +7265,13 @@
     "package": "@nifrajs/cli",
     "signature": "export interface ScaffoldWriteResult extends ScaffoldResult {\n    readonly written: boolean;\n    readonly reason?: string;\n}"
   },
+  {
+    "name": "scanEffectImports",
+    "kind": "function",
+    "package": "@nifrajs/cli",
+    "signature": "export declare function scanEffectImports(content: string): string[];",
+    "doc": "/** Value-bearing import edges relevant to effect provenance, in source order. */"
+  },
   {
     "name": "scanFetchText",
     "kind": "function",
@@ -5793,6 +7413,13 @@
     "package": "@nifrajs/web",
     "signature": "export interface ScssPluginOptions {\n    /** Inject the compiler (default: the `sass` optional peer, loaded lazily). Pass `sass-embedded` or a stub. */\n    readonly compiler?: SassCompiler;\n    /** Output style handed to Sass. Default `\"expanded\"` (Bun minifies the final CSS bundle anyway). */\n    readonly style?: \"expanded\" | \"compressed\";\n    /** Extra import search paths for `@use`/`@import`, in addition to the source file's own directory. */\n    readonly loadPaths?: readonly string[];\n}"
   },
+  {
+    "name": "SealedEffectLedger",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface SealedEffectLedger {\n    readonly method: string;\n    /** The registered route pattern (`/users/:id`) — never the concrete request URL. */\n    readonly path: string;\n    readonly entries: readonly EffectEntry[];\n    /** The route's declared capability tokens — the runtime-enforcement view: recorded ⊆ declared is\n     * guaranteed by the beacon, and `declared` minus the recorded ids is the unused declaration set. */\n    readonly declared: readonly string[];\n    /** Present when the ledger was created with `chain: true`. */\n    readonly chain?: EffectChain;\n}",
+    "doc": "/** The immutable result of sealing a request's ledger. Token-only; safe to hand to any sink. */"
+  },
   {
     "name": "searchExamples",
     "kind": "function",
@@ -5806,6 +7433,13 @@
     "package": "@nifrajs/core",
     "signature": "export declare function searchOf(url: string): string;"
   },
+  {
+    "name": "SearchParamsInit",
+    "kind": "type",
+    "package": "@nifrajs/web-react",
+    "signature": "export type SearchParamsInit = URLSearchParams | Record<string, string | readonly string[]> | string;",
+    "doc": "/** The value forms `setSearchParams` accepts. */"
+  },
   {
     "name": "searchSections",
     "kind": "function",
@@ -5887,6 +7521,27 @@
     "signature": "export declare function serializeData(data: unknown): string;",
     "doc": "/**\n * Serialize loader data for embedding inside an inline `<script>`. `JSON.stringify` alone\n * is NOT safe there: a string containing `</script>` or `<!--` would break out of the\n * script element (an XSS vector). Escape `<`/`>` to `\\uXXXX`, plus the U+2028/U+2029\n * separators.\n */"
   },
+  {
+    "name": "serializeNifraManifest",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function serializeNifraManifest(manifest: NifraManifest): string;",
+    "doc": "/** Byte-stable artifact serialization (including `contentHash`). */"
+  },
+  {
+    "name": "serializeNifraManifestSignature",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function serializeNifraManifestSignature(signature: NifraManifestSignature): string;",
+    "doc": "/** Byte-stable serialization for the detached signature sidecar. */"
+  },
+  {
+    "name": "serializeResponse",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function serializeResponse(response: Response, options?: {\n    readonly maxBytes?: number;\n}): Promise<StoredResponse>;",
+    "doc": "/** Buffer a response into a storable form. Clones first so the live response body stays intact. */"
+  },
   {
     "name": "serve",
     "kind": "function",
@@ -5924,7 +7579,7 @@
     "name": "Server",
     "kind": "class",
     "package": "@nifrajs/core",
-    "signature": "export declare class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {\n    private readonly router;\n    /** WebSocket routes, matched separately at upgrade time (a GET + `Upgrade: websocket`). */\n    private readonly wsRouter;\n    private wsRouteCount;\n    /** In-process pub/sub backing `ws.subscribe(topic)` + `app.publish(topic, data)` (single-instance).\n     * Created by the first `app.ws()` via the `@nifrajs/core/ws` runtime — `undefined` until then, so a\n     * no-WebSocket app never constructs (or bundles) it. */\n    private topics;\n    private readonly routeList;\n    private readonly maxBodyBytes;\n    private readonly wsMaxPayloadBytes;\n    private readonly requestTimeoutMs;\n    private readonly gracefulSignals;\n    private readonly logger;\n    /** App-wide validation-error fallback; a route's own `schema.onValidationError` takes precedence. */\n    private readonly defaultOnValidationError?;\n    private bunServer;\n    private readonly derives;\n    private readonly decorations;\n    private readonly beforeHandleHooks;\n    private readonly afterHandleHooks;\n    private readonly onErrorHooks;\n    private readonly aroundHooks;\n    private readonly onRequestHooks;\n    private readonly onResponseHooks;\n    private readonly onResponseFinalizedHooks;\n    private readonly responseRequests;\n    /** Names of plugins/middleware already applied via `use` — for idempotent dedupe. */\n    private readonly appliedPlugins;\n    /** App-declared MCP resources / prompts (via {@link resource} / {@link prompt}), read by `nifra mcp`. */\n    private readonly mcpResourceList;\n    private readonly mcpPromptList;\n    constructor(options?: ServerOptions);\n    /** Add a per-request, computed context extension for subsequent routes. */\n    derive<D extends object>(fn: (context: Context & Ctx) => MaybePromise<D>): Server<R, Ctx & D>;\n    /** Add a static context value for subsequent routes. */\n    decorate<const K extends string, V>(key: K, value: V): Server<R, Ctx & Record<K, V>>;\n    /**\n     * Run before routing on the raw request. Return a `Response` to short-circuit, or a replacement\n     * `Request` to continue routing with a rewritten method/URL/headers. Global.\n     */\n    onRequest(fn: (req: Request) => MaybePromise<OnRequestResult>): this;\n    /** Run after validation, before the handler; a non-`undefined` return short-circuits. Order-scoped. */\n    beforeHandle(fn: (context: Context & Ctx) => MaybePromise<unknown>): this;\n    /**\n     * Wrap the matched route lifecycle for subsequent routes. This is intentionally generic over the\n     * route output, so wrappers like async context storage do not force Node's direct JSON path through\n     * a Web `Response`. The first registered wrapper is outermost.\n     */\n    around(fn: <T>(context: Context & Ctx, next: () => MaybePromise<T>) => MaybePromise<T>): this;\n    /** Transform the handler's result before it is serialized. Order-scoped. */\n    afterHandle(fn: (result: unknown, context: Context & Ctx) => MaybePromise<unknown>): this;\n    /** Handle a thrown error; a non-`undefined` return becomes the response (else the default 500). Order-scoped. */\n    onError(fn: (error: unknown, context: Context & Ctx) => MaybePromise<unknown>): this;\n    /** Transform every outgoing response — success, error, 404, 405, short-circuit. Global. */\n    onResponse(fn: (response: Response, req: Request) => MaybePromise<Response>): this;\n    /** Observe the terminal response after all transformations. Observers are ordered and fail-open. */\n    onResponseFinalized(fn: (outcome: ResponseFinalization, req: Request) => MaybePromise<void>): this;\n    /**\n     * Apply a type-**identity** plugin ({@link IdentityPlugin}, from {@link defineIdentityPlugin}) — it\n     * registers routes/hooks but doesn't change the types, so this returns `this` with the route registry\n     * and context fully intact. This overload exists specifically so a *named* identity plugin (e.g.\n     * `@nifrajs/better-auth`) threads the registry: its `& { pluginName }` intersection would otherwise\n     * defeat the generic inference of the transforming overload below and collapse the result to `any`.\n     */\n    use(plugin: IdentityPlugin): this;\n    /**\n     * Apply a **plugin function** — `(app) => app`, typically built with {@link definePlugin}. It's\n     * called with `this` and its result is returned, so an inline plugin's `derive`/`decorate` thread\n     * the added context to handlers defined after `use` (the overload is generic over the concrete\n     * `this`). A named plugin already applied is skipped (idempotent dedupe).\n     */\n    use<Out extends AnyServer>(plugin: (app: this) => Out): Out;\n    /**\n     * Apply a {@link Middleware} bundle — wire each hook it provides to its lifecycle point. Returns\n     * `this` (no context-type merging); call it before the routes its `beforeHandle`/`afterHandle`\n     * should cover (those are order-scoped; `onRequest`/`onResponse` are global). A named bundle already\n     * applied is skipped (idempotent).\n     */\n    use(mw: Middleware): this;\n    get<Path extends string, S extends RouteSchema, H extends Handler<Path, S, Ctx>>(path: Path, schema: S, handler: H): Server<AddRoute<R, \"GET\", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>;\n    get<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(path: Path, handler: H): Server<AddRoute<R, \"GET\", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>;\n    /**\n     * Register a **typed SSE route** — a GET endpoint streaming `text/event-stream` whose event\n     * payloads are contracted by `schema.sse`. The handler receives the validated context plus a\n     * {@link TypedSSEStream}: `stream.send(event)` is compile-time-checked against the schema and\n     * JSON-serialized into the SSE `data:` field. The typed client sees the marker and grows a\n     * `.subscribe(onEvent)` for the route with the same payload type — end-to-end typed streaming.\n     *\n     *   const app = server().sse(\"/feed\", { sse: t.object({ id: t.integer(), title: t.string() }) },\n     *     async (c, stream) => {\n     *       stream.send({ id: 1, title: \"hello\" })          // typed\n     *       await waitForDisconnect(stream.signal)\n     *     },\n     *     { keepAlive: 15_000 })\n     *\n     *   // client: const off = api.feed.subscribe((post) => console.log(post.title))\n     *\n     * `init` passes through to the underlying {@link sse} helper (`keepAlive`, extra headers). The\n     * connection closes when the handler resolves, `stream.close()` runs, or the client disconnects\n     * (`stream.signal`). Query/body schemas validate exactly as on any other route.\n     */\n    sse<Path extends string, S extends RouteSchema & {\n        sse: StandardSchemaV1;\n    }>(path: Path, schema: S, run: (context: Context<Path, S> & Ctx, stream: TypedSSEStream<InferOutput<S[\"sse\"]>>) => void | Promise<void>, init?: SSEInit): Server<AddRoute<R, \"GET\", Path, RouteInfoFor<Path, S, Response>>, Ctx>;\n    post<Path extends string, S extends RouteSchema, H extends Handler<Path, S, Ctx>>(path: Path, schema: S, handler: H): Server<AddRoute<R, \"POST\", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>;\n    post<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(path: Path, handler: H): Server<AddRoute<R, \"POST\", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>;\n    put<Path extends string, S extends RouteSchema, H extends Handler<Path, S, Ctx>>(path: Path, schema: S, handler: H): Server<AddRoute<R, \"PUT\", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>;\n    put<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(path: Path, handler: H): Server<AddRoute<R, \"PUT\", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>;\n    patch<Path extends string, S extends RouteSchema, H extends Handler<Path, S, Ctx>>(path: Path, schema: S, handler: H): Server<AddRoute<R, \"PATCH\", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>;\n    patch<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(path: Path, handler: H): Server<AddRoute<R, \"PATCH\", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>;\n    delete<Path extends string, S extends RouteSchema, H extends Handler<Path, S, Ctx>>(path: Path, schema: S, handler: H): Server<AddRoute<R, \"DELETE\", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>;\n    delete<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(path: Path, handler: H): Server<AddRoute<R, \"DELETE\", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>;\n    tool<Name extends string, S extends {\n        description: string;\n        input: StandardSchemaV1;\n        output?: StandardSchemaV1;\n        annotations?: ToolAnnotations;\n    }, H extends (input: InferOutput<S[\"input\"]>, ctx: Context & Ctx) => MaybePromise<S[\"output\"] extends StandardSchemaV1 ? InferOutput<S[\"output\"]> : unknown>>(name: Name, config: S, handler: H): Server<AddRoute<R, \"POST\", `/_nifra/tool/${Name}`, RouteInfoFor<`/_nifra/tool/${Name}`, S[\"output\"] extends StandardSchemaV1 ? {\n        body: S[\"input\"];\n        response: S[\"output\"];\n    } : {\n        body: S[\"input\"];\n    }, OutputOf<H>>>, Ctx>;\n    /**\n     * Declare an MCP **resource** — read-only data an agent can fetch through `nifra mcp` (app config, a\n     * generated document, …). `read` runs in the app process, so capture whatever app state it needs in the\n     * closure. `uri` is the MCP resource identifier (e.g. `\"myapp://config\"`). The sibling of {@link tool}\n     * for the resource half of MCP.\n     */\n    resource(uri: string, config: {\n        readonly name: string;\n        readonly description?: string;\n        readonly mimeType?: string;\n    }, read: McpResourceDescriptor[\"read\"]): Server<R, Ctx>;\n    /**\n     * Declare an MCP **prompt** — a reusable prompt template an agent can fetch through `nifra mcp`.\n     * `handler` receives the caller's arguments and returns the rendered messages.\n     */\n    prompt(name: string, config: {\n        readonly description: string;\n        readonly arguments?: readonly PromptArgument[];\n    }, handler: McpPromptDescriptor[\"handler\"]): Server<R, Ctx>;\n    /** The MCP resources declared via {@link resource} — enumerated by `nifra mcp`. */\n    mcpResources(): readonly McpResourceDescriptor[];\n    /** The MCP prompts declared via {@link prompt} — enumerated by `nifra mcp`. */\n    mcpPrompts(): readonly McpPromptDescriptor[];\n    /**\n     * Register a **WebSocket** route. The connection upgrades on a `GET` to `path` carrying\n     * `Upgrade: websocket`; the optional `handler.upgrade(c)` runs in the request context first and may\n     * reject (return a `Response`) or seed per-connection `ws.data`. WebSockets are served by the\n     * adapter (`listen()`, `@nifrajs/node`, `@nifrajs/deno`, `toFetchHandler`) — not by bare `app.fetch`, which\n     * has no socket (a WS path through `app.fetch` is a normal HTTP response).\n     *\n     *   app.ws(\"/chat\", { open: (ws) => ws.send(\"hi\"), message: (ws, data) => ws.send(data) })\n     */\n    ws<Data = unknown, Schema extends StandardSchemaV1 | undefined = undefined>(path: string, handler: WebSocketHandler<Data, EnvOf<Ctx>, Schema>): this;\n    /**\n     * Broadcast `data` to every WebSocket connection subscribed to `topic` (via `ws.subscribe(topic)`).\n     * In-process and **single-instance** (see {@link TopicRegistry}) — a multi-instance deploy must bridge\n     * an external fan-out (Redis, a Durable Object) to this. A no-op when nobody is subscribed.\n     */\n    publish(topic: string, data: string | ArrayBufferView | ArrayBuffer): void;\n    private route;\n    /**\n     * Low-level route registration shared by the inline builder and `implement()`.\n     * Captures the server's current `derive`/`decorate` chain into the route — this\n     * is the \"compiled\", order-scoped per-route chain.\n     */\n    register(method: Method, path: string, schema: RouteSchema | undefined, handler: (context: never) => unknown): void;\n    /**\n     * Enumerate the registered routes (method, path, input schemas), in registration\n     * order. Powers `toOpenAPI` and other introspection; the router trie itself no\n     * longer holds the original patterns.\n     */\n    routes(): ReadonlyArray<RouteDescriptor>;\n    /**\n     * Resolve a `Request` to a `Response` — the whole lifecycle, testable without a port. The\n     * optional `platform` carries edge inputs (`env`, `waitUntil`); edge adapters pass it, and\n     * Bun/Node/Deno omit it (then `c.env` is `undefined` and `c.waitUntil` runs fire-and-forget).\n     */\n    fetch(req: Request, platform?: Platform<EnvOf<Ctx>>): MaybePromise<Response>;\n    private fetchSource;\n    /**\n     * Like {@link fetch}, but renders a plain-data result **without** building a Web `Response` — the\n     * `@nifrajs/node` adapter serializes the returned primitives straight to the socket, skipping the undici\n     * `Response` build + body drain (the bulk of the Node bridge cost, measured ≈4µs/req). A handler that\n     * returns a `Response`, an error/short-circuit, or any registered `onResponse` hook falls back to the\n     * full Web path (`{ kind: \"response\" }`), so behavior is identical — only the common JSON-data case is\n     * faster. Same lifecycle as {@link fetch} (body cap, validation, hooks all run); only the final\n     * render differs.\n     */\n    resolveNode(req: Request, platform?: Platform<EnvOf<Ctx>>): MaybePromise<NodeServeOutcome>;\n    resolveNodeSource(source: RequestSource, platform?: Platform<EnvOf<Ctx>>): MaybePromise<NodeServeOutcome>;\n    /**\n     * Resolve a WebSocket upgrade — the seam every serving adapter uses. Returns `pass` (not a WS\n     * upgrade for a registered route → handle as normal HTTP), `reject` (a WS route matched but\n     * `upgrade()` rejected, or the path was malformed → return `response`), or `upgrade` (perform the\n     * runtime upgrade, then dispatch the native socket's events to `handler`, seeding `ws.data` with\n     * `data`). Runs the route's `upgrade(c)` guard in a real request context. Synchronous unless\n     * `upgrade()` is async; a throw rejects with a flat 500 (no detail leaked).\n     */\n    resolveWebSocketUpgrade(req: Request, platform?: Platform<EnvOf<Ctx>>): MaybePromise<WebSocketUpgradeOutcome>;\n    /** Bun `fetch` when WS routes exist: try a WS upgrade first, else run the normal HTTP lifecycle.\n     * `undefined` ⇒ Bun owns the upgraded socket; a `Response` ⇒ a normal reply or a rejected upgrade.\n     * (The socket dispatch itself lives in `ws-bun.ts`, loaded via `@nifrajs/core/ws`.) */\n    private bunFetchWithWebSocket;\n    /**\n     * The shared lifecycle, generic over how the final value is rendered: `finalize` turns a handler's\n     * result + `set` into the output `T` (`toResponse` → a Web `Response`; `toNodeOutcome` → node-direct\n     * primitives), `wrapResponse` lifts an early/error `Response` into that same `T`, and `onTimeout`\n     * produces the 503. The Web `fetch` and `resolveNode` are thin callers over this one routing +\n     * context + lifecycle implementation — no duplication across the trust boundary.\n     */\n    private dispatch;\n    /**\n     * onRequest short-circuit path. Synchronous as long as every hook returns synchronously (the\n     * common case — e.g. CORS returning `undefined` for a non-preflight request): an `async` version\n     * here put EVERY request of any app with one onRequest hook onto the promise machinery, profiled\n     * at ~13% of a realistic request. The first hook that returns a Promise hands the REMAINING\n     * hooks to the async continuation; behavior is identical.\n     */\n    private runWithOnRequest;\n    /** Async tail of {@link runWithOnRequest}: applies the first awaited hook's outcome, then runs\n     * the remaining hooks (awaiting freely — we're already async here). */\n    private continueOnRequest;\n    private takeResponseRequest;\n    /**\n     * Route → build context → run. Synchronous through to the handler for a **bare** route\n     * ({@link RouteEntry.bare}), so a sync handler produces its result with zero promise allocations;\n     * routes with validation/hooks keep the full async {@link runLifecycle}, unchanged.\n     */\n    private routeAndRun;\n    /** The narrowest bare route: a syntactic `() => ...` handler cannot observe the context argument, so\n     * successful requests can skip allocating `RequestContext`. Errors still allocate one for logging. */\n    private runContextlessBare;\n    private contextlessBareError;\n    /**\n     * The synchronous fast path for a {@link RouteEntry.bare} route: apply static decorations, call the\n     * handler, render the result — **no `await`** unless the handler itself returns a promise. It mirrors\n     * the bare slice of {@link runLifecycle} (which a bare route would otherwise no-op through) and shares\n     * {@link logRequestError}; a bare route has no `onError` hooks, so error handling is fully synchronous\n     * (a thrown `Response` is control flow; anything else is a logged flat 500). This is where nifra skips\n     * the per-request async-frame tax — the same win codegen routers get, but without `eval`.\n     */\n    private runBare;\n    /** Bare-route error rendering — identical to {@link runLifecycle}'s catch minus the (absent) onError\n     * loop: a thrown `Response` is returned as deliberate control flow; anything else is logged + 500. */\n    /**\n     * Build a route's fused Web lane (see {@link RouteEntry.fusedWeb}). Composition happens once at\n     * registration; the returned closure is what every request to the route runs. Behavior is\n     * byte-identical to the generic `runBare`/`runContextlessBare` + `toResponse` pair — same\n     * decoration order, same error routing (thrown `Response` = control flow; anything else logs and\n     * 500s), same respond semantics (the lifecycle parity suite pins it).\n     */\n    private buildFusedWeb;\n    private bareError;\n    private runWithAround;\n    private runAround;\n    private runBodyOnly;\n    /** Validate + run the handler for the bodyOnly path — shared by the inline fast path and the\n     * streaming fallback. A method (not per-request closures) so the hot path allocates nothing\n     * beyond the one `.then` continuation. */\n    private finishBodyOnly;\n    private executeHandler;\n    private handleValidationErrorRecovery;\n    private applyBodyValidation;\n    private runQueryOnly;\n    /** Validate-result → set `ctx.query` → run handler. A method (not a per-request closure), the\n     * query analogue of {@link applyBodyValidation}. */\n    private applyQueryValidation;\n    /**\n     * Thread the response through each global `onResponse` hook. Stays SYNCHRONOUS until a hook\n     * actually returns a Promise — an `async` version forced a promise + microtask on EVERY response\n     * of any app with an onResponse hook (cors/securityHeaders/etag/timing all use onResponse), the\n     * same ~13%/req tax the onRequest walk was de-async'd to avoid. The first async hook hands the\n     * rest to {@link continueOnResponse}.\n     */\n    private applyOnResponse;\n    private applyOnResponseAndFinalize;\n    private completeResponseFinalization;\n    private failResponseFinalization;\n    /** Notify terminal observers in order while isolating both sync and async failures. */\n    private notifyResponseFinalized;\n    /** Async tail of {@link applyOnResponse}: runs the remaining hooks once one has gone async. */\n    private continueOnResponse;\n    /**\n     * Bound the response time. On timeout we abort `ctx.signal` (so cancellation-aware\n     * handlers can bail) and return 503; the in-flight work keeps running but its\n     * result is discarded — JS can't forcibly cancel a promise.\n     */\n    private withTimeout;\n    /**\n     * The post-match lifecycle: validate → derive → beforeHandle → handler → afterHandle, with onError.\n     * Generic over the render: a success value goes through `finalize(result, set)` (a Web `Response`, or\n     * node-direct primitives); an early/error `Response` (validation, thrown, 500) through `wrapResponse`.\n     */\n    private runLifecycle;\n    private handleLifecycleError;\n    /** Log an unhandled request error to the (redacting) logger — shared by {@link runLifecycle} and the\n     * bare fast path ({@link bareError}) so both record the same fields. Never throws; never leaks. */\n    private logRequestError;\n    private readAndValidateBody;\n    /**\n     * Read the body as text, capped at `maxBodyBytes`. Rejects (`null`) on a\n     * `Content-Length` over the cap *before* buffering, and aborts mid-stream once the\n     * running byte count exceeds it — so a lying or absent length can't force us to\n     * buffer an oversized payload.\n     *\n     * Fast path: when a non-chunked request carries a `Content-Length` within the cap,\n     * a native `req.json()` is already bounded — under HTTP/1.1 + HTTP/2 framing the\n     * runtime delivers at most `Content-Length` bytes — so we skip the manual stream\n     * loop and a separate text decode. It trusts the wire\n     * *framing*, not the header value: nifra only ever receives framed Requests from the\n     * runtime's HTTP server, never a hand-built one with a mismatched length. Chunked or\n     * length-less bodies fall through to the streaming byte-cap guard below.\n     */\n    private readBoundedJson;\n    /**\n     * Start a `Bun.serve` instance bound to `port` (use `0` for an ephemeral port).\n     *\n     * `reusePort` sets `SO_REUSEPORT` so **multiple processes can bind the same port** and the kernel\n     * load-balances connections across them — the standard way to use every core (Bun is\n     * single-threaded per process). Spawn one process per core, each calling\n     * `app.listen(PORT, { reusePort: true })`; see `examples/cluster.ts`. Every process must opt in,\n     * and all of them must be the same app. Linux balances ~evenly; macOS accepts the flag but may\n     * favor one socket (fine for dev, measure on Linux for production numbers).\n     */\n    listen(port: number, options?: {\n        readonly reusePort?: boolean;\n    }): RunningServer;\n    /**\n     * Gracefully stop: wait for in-flight requests to finish (up to `drainMs`), then\n     * issue a single terminal stop — graceful if everything drained, forced if\n     * stragglers remain. Safe to call when not listening.\n     *\n     * The Bun semantics: poll `pendingRequests` (awaiting\n     * `stop()`'s promise drops in-flight requests), and decide graceful-vs-forced in\n     * ONE call (Bun can't escalate an already-graceful `stop()` to a forced close).\n     * New connections may be accepted during the drain window; in a real deploy the\n     * load balancer has already stopped routing here, and `drainMs` bounds it.\n     */\n    stop({ drainMs }?: {\n        drainMs?: number;\n    }): Promise<void>;\n    private installSignalHandlers;\n}",
+    "signature": "export declare class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext> {\n    private readonly router;\n    /** WebSocket routes, matched separately at upgrade time (a GET + `Upgrade: websocket`). */\n    private readonly wsRouter;\n    private wsRouteCount;\n    /** In-process pub/sub backing `ws.subscribe(topic)` + `app.publish(topic, data)` (single-instance).\n     * Created by the first `app.ws()` via the `@nifrajs/core/ws` runtime — `undefined` until then, so a\n     * no-WebSocket app never constructs (or bundles) it. */\n    private topics;\n    private readonly routeList;\n    private readonly maxBodyBytes;\n    private readonly wsMaxPayloadBytes;\n    private readonly requestTimeoutMs;\n    private readonly acceptInboundDeadlines;\n    private readonly maxInboundDeadlineMs;\n    private readonly deadlineAdmissionOptions;\n    private readonly gracefulSignals;\n    /** Capacity-admission gate; `undefined` = off (the request path pays nothing). */\n    private readonly capacityGate;\n    private readonly onCapabilityUse;\n    /** Effect-ledger defaults pinned at construction; per-route `ledgered` copies add route identity. */\n    private readonly effectLedger;\n    /** App-wide idempotency store (explicit option, else a lazily-created in-process default). */\n    private readonly configuredIdempotencyStore;\n    private lazyIdempotencyStore;\n    private readonly logger;\n    /** App-wide validation-error fallback; a route's own `schema.onValidationError` takes precedence. */\n    private readonly defaultOnValidationError?;\n    private bunServer;\n    private readonly derives;\n    private readonly decorations;\n    private readonly beforeHandleHooks;\n    private readonly afterHandleHooks;\n    private readonly onErrorHooks;\n    private readonly aroundHooks;\n    private readonly onRequestHooks;\n    private readonly onResponseHooks;\n    private readonly onResponseFinalizedHooks;\n    private readonly responseRequests;\n    /** Names of plugins/middleware already applied via `use` — for idempotent dedupe. */\n    private readonly appliedPlugins;\n    /** Order-scoped evidence captured by routes registered after an assured plugin. */\n    private readonly activeAssurance;\n    /** App-wide evidence from global hooks; applies retroactively to every route. */\n    private readonly globalAssurance;\n    /** App-declared MCP resources / prompts (via {@link resource} / {@link prompt}), read by `nifra mcp`. */\n    private readonly mcpResourceList;\n    private readonly mcpPromptList;\n    /**\n     * Every registered route's raw router entry + descriptor, in order — the replay source for\n     * {@link merge}. The entry already carries the chains captured at registration (derives,\n     * decorations, before/after/around/onError), so a merged route behaves exactly as it did on\n     * the server that defined it.\n     */\n    private readonly rawEntries;\n    constructor(options?: ServerOptions);\n    /** Add a per-request, computed context extension for subsequent routes. */\n    derive<D extends object>(fn: (context: Context & Ctx) => MaybePromise<D>): Server<R, Ctx & D>;\n    /** Add a static context value for subsequent routes. */\n    decorate<const K extends string, V>(key: K, value: V): Server<R, Ctx & Record<K, V>>;\n    /**\n     * Run before routing on the raw request. Return a `Response` to short-circuit, or a replacement\n     * `Request` to continue routing with a rewritten method/URL/headers. Global.\n     */\n    onRequest(fn: (req: Request, platform?: Platform<EnvOf<Ctx>>) => MaybePromise<OnRequestResult>): this;\n    /** Run after validation, before the handler; a non-`undefined` return short-circuits. Order-scoped. */\n    beforeHandle(fn: (context: Context & Ctx) => MaybePromise<unknown>): this;\n    /**\n     * Wrap the matched route lifecycle for subsequent routes. This is intentionally generic over the\n     * route output, so wrappers like async context storage do not force Node's direct JSON path through\n     * a Web `Response`. The first registered wrapper is outermost.\n     */\n    around(fn: <T>(context: Context & Ctx, next: () => MaybePromise<T>) => MaybePromise<T>): this;\n    /** Transform the handler's result before it is serialized. Order-scoped. */\n    afterHandle(fn: (result: unknown, context: Context & Ctx) => MaybePromise<unknown>): this;\n    /** Handle a thrown error; a non-`undefined` return becomes the response (else the default 500). Order-scoped. */\n    onError(fn: (error: unknown, context: Context & Ctx) => MaybePromise<unknown>): this;\n    /** Transform every outgoing response — success, error, 404, 405, short-circuit. Global. */\n    onResponse(fn: (response: Response, req: Request) => MaybePromise<Response>): this;\n    /** Observe the terminal response after all transformations. Observers are ordered and fail-open. */\n    onResponseFinalized(fn: (outcome: ResponseFinalization, req: Request) => MaybePromise<void>): this;\n    /**\n     * Apply a type-**identity** plugin ({@link IdentityPlugin}, from {@link defineIdentityPlugin}) — it\n     * registers routes/hooks but doesn't change the types, so this returns `this` with the route registry\n     * and context fully intact. This overload exists specifically so a *named* identity plugin (e.g.\n     * `@nifrajs/better-auth`) threads the registry: its `& { pluginName }` intersection would otherwise\n     * defeat the generic inference of the transforming overload below and collapse the result to `any`.\n     */\n    use(plugin: IdentityPlugin): this;\n    /**\n     * Apply a **plugin function** — `(app) => app`, typically built with {@link definePlugin}. It's\n     * called with `this` and its result is returned, so an inline plugin's `derive`/`decorate` thread\n     * the added context to handlers defined after `use` (the overload is generic over the concrete\n     * `this`). A named plugin already applied is skipped (idempotent dedupe).\n     */\n    use<Out extends AnyServer>(plugin: (app: this) => Out): Out;\n    /**\n     * Apply a {@link Middleware} bundle — wire each hook it provides to its lifecycle point. Returns\n     * `this` (no context-type merging); call it before the routes its `beforeHandle`/`afterHandle`\n     * should cover (those are order-scoped; `onRequest`/`onResponse` are global). A named bundle already\n     * applied is skipped (idempotent).\n     */\n    use(mw: Middleware): this;\n    get<Path extends string, S extends RouteSchema, H extends Handler<Path, S, Ctx>>(path: Path, schema: S, handler: H): Server<AddRoute<R, \"GET\", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>;\n    get<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(path: Path, handler: H): Server<AddRoute<R, \"GET\", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>;\n    /**\n     * Register a **typed SSE route** — a GET endpoint streaming `text/event-stream` whose event\n     * payloads are contracted by `schema.sse`. The handler receives the validated context plus a\n     * {@link TypedSSEStream}: `stream.send(event)` is compile-time-checked against the schema and\n     * JSON-serialized into the SSE `data:` field. The typed client sees the marker and grows a\n     * `.subscribe(onEvent)` for the route with the same payload type — end-to-end typed streaming.\n     *\n     *   const app = server().sse(\"/feed\", { sse: t.object({ id: t.integer(), title: t.string() }) },\n     *     async (c, stream) => {\n     *       stream.send({ id: 1, title: \"hello\" })          // typed\n     *       await waitForDisconnect(stream.signal)\n     *     },\n     *     { keepAlive: 15_000 })\n     *\n     *   // client: const off = api.feed.subscribe((post) => console.log(post.title))\n     *\n     * `init` passes through to the underlying {@link sse} helper (`keepAlive`, extra headers). The\n     * connection closes when the handler resolves, `stream.close()` runs, or the client disconnects\n     * (`stream.signal`). Query/body schemas validate exactly as on any other route.\n     */\n    sse<Path extends string, S extends RouteSchema & {\n        sse: StandardSchemaV1;\n    }>(path: Path, schema: S, run: (context: Context<Path, S> & Ctx, stream: TypedSSEStream<InferOutput<S[\"sse\"]>>) => void | Promise<void>, init?: SSEInit): Server<AddRoute<R, \"GET\", Path, RouteInfoFor<Path, S, Response>>, Ctx>;\n    post<Path extends string, S extends RouteSchema, H extends Handler<Path, S, Ctx>>(path: Path, schema: S, handler: H): Server<AddRoute<R, \"POST\", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>;\n    post<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(path: Path, handler: H): Server<AddRoute<R, \"POST\", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>;\n    put<Path extends string, S extends RouteSchema, H extends Handler<Path, S, Ctx>>(path: Path, schema: S, handler: H): Server<AddRoute<R, \"PUT\", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>;\n    put<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(path: Path, handler: H): Server<AddRoute<R, \"PUT\", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>;\n    patch<Path extends string, S extends RouteSchema, H extends Handler<Path, S, Ctx>>(path: Path, schema: S, handler: H): Server<AddRoute<R, \"PATCH\", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>;\n    patch<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(path: Path, handler: H): Server<AddRoute<R, \"PATCH\", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>;\n    delete<Path extends string, S extends RouteSchema, H extends Handler<Path, S, Ctx>>(path: Path, schema: S, handler: H): Server<AddRoute<R, \"DELETE\", Path, RouteInfoFor<Path, S, OutputOf<H>>>, Ctx>;\n    delete<Path extends string, H extends Handler<Path, RouteSchema, Ctx>>(path: Path, handler: H): Server<AddRoute<R, \"DELETE\", Path, RouteInfoFor<Path, Record<never, never>, OutputOf<H>>>, Ctx>;\n    tool<Name extends string, S extends {\n        description: string;\n        input: StandardSchemaV1;\n        output?: StandardSchemaV1;\n        annotations?: ToolAnnotations;\n    }, H extends (input: InferOutput<S[\"input\"]>, ctx: Context & Ctx) => MaybePromise<S[\"output\"] extends StandardSchemaV1 ? InferOutput<S[\"output\"]> : unknown>>(name: Name, config: S, handler: H): Server<AddRoute<R, \"POST\", `/_nifra/tool/${Name}`, RouteInfoFor<`/_nifra/tool/${Name}`, S[\"output\"] extends StandardSchemaV1 ? {\n        body: S[\"input\"];\n        response: S[\"output\"];\n    } : {\n        body: S[\"input\"];\n    }, OutputOf<H>>>, Ctx>;\n    /**\n     * Declare an MCP **resource** — read-only data an agent can fetch through `nifra mcp` (app config, a\n     * generated document, …). `read` runs in the app process, so capture whatever app state it needs in the\n     * closure. `uri` is the MCP resource identifier (e.g. `\"myapp://config\"`). The sibling of {@link tool}\n     * for the resource half of MCP.\n     */\n    resource(uri: string, config: {\n        readonly name: string;\n        readonly description?: string;\n        readonly mimeType?: string;\n    }, read: McpResourceDescriptor[\"read\"]): Server<R, Ctx>;\n    /**\n     * Declare an MCP **prompt** — a reusable prompt template an agent can fetch through `nifra mcp`.\n     * `handler` receives the caller's arguments and returns the rendered messages.\n     */\n    prompt(name: string, config: {\n        readonly description: string;\n        readonly arguments?: readonly PromptArgument[];\n    }, handler: McpPromptDescriptor[\"handler\"]): Server<R, Ctx>;\n    /** The MCP resources declared via {@link resource} — enumerated by `nifra mcp`. */\n    mcpResources(): readonly McpResourceDescriptor[];\n    /** The MCP prompts declared via {@link prompt} — enumerated by `nifra mcp`. */\n    mcpPrompts(): readonly McpPromptDescriptor[];\n    /**\n     * Register a **WebSocket** route. The connection upgrades on a `GET` to `path` carrying\n     * `Upgrade: websocket`; the optional `handler.upgrade(c)` runs in the request context first and may\n     * reject (return a `Response`) or seed per-connection `ws.data`. WebSockets are served by the\n     * adapter (`listen()`, `@nifrajs/node`, `@nifrajs/deno`, `toFetchHandler`) — not by bare `app.fetch`, which\n     * has no socket (a WS path through `app.fetch` is a normal HTTP response).\n     *\n     *   app.ws(\"/chat\", { open: (ws) => ws.send(\"hi\"), message: (ws, data) => ws.send(data) })\n     */\n    ws<Data = unknown, Schema extends StandardSchemaV1 | undefined = undefined>(path: string, handler: WebSocketHandler<Data, EnvOf<Ctx>, Schema>): this;\n    /**\n     * Broadcast `data` to every WebSocket connection subscribed to `topic` (via `ws.subscribe(topic)`).\n     * In-process and **single-instance** (see {@link TopicRegistry}) — a multi-instance deploy must bridge\n     * an external fan-out (Redis, a Durable Object) to this. A no-op when nobody is subscribed.\n     */\n    publish(topic: string, data: string | ArrayBufferView | ArrayBuffer): void;\n    private route;\n    /**\n     * Low-level route registration shared by the inline builder and `implement()`.\n     * Captures the server's current `derive`/`decorate` chain into the route — this\n     * is the \"compiled\", order-scoped per-route chain.\n     */\n    register(method: Method, path: string, schema: RouteSchema | undefined, handler: (context: never) => unknown): void;\n    /** Resolve a route's declared idempotency into a pinned store + defaults, or `undefined` when off. */\n    private resolveIdempotency;\n    /** The app-wide idempotency store: the configured one, else a lazily-created shared in-process store. */\n    private defaultIdempotencyStore;\n    /**\n     * Merge another server's routes into this one — the composition escape hatch for large apps.\n     *\n     * WHY: the fluent chain accumulates one type-alias level per route, and TypeScript resolves\n     * that stack in one recursion — a single chain hits TS2589 at ~95 routes. Groups keep every\n     * chain short: build each domain (`listings`, `agents`, …) as its own `server()` (its registry\n     * resolves independently), then `app.merge(listings).merge(agents)` — each merge adds ONE level\n     * regardless of group size. 300+ routes stay fully typed (see many-routes.test-d.ts). The\n     * other escape hatch is contract-first `implement()`, whose registry is a single object type.\n     *\n     * Semantics: merged routes keep the chains captured where they were DEFINED — the group's\n     * `derive`/`decorate`/`beforeHandle`/`afterHandle`/`onError`/`around` apply to its routes\n     * exactly as they did standalone, so a group wires its own plugins. The group's request-level\n     * hooks (`onRequest`/`onResponse`/`onResponseFinalized`) are appended to this server's. This\n     * server's route-scoped chains do NOT retroactively wrap merged routes (order-scoped, like\n     * routes registered before a `derive`). Fail closed: a path+method collision throws\n     * `RouteConfigError` at merge time, and a group with WebSocket routes is refused (register\n     * those on the parent).\n     */\n    merge<R2 extends Registry, Ctx2>(other: Server<R2, Ctx2>): Server<R & R2, Ctx>;\n    /**\n     * Enumerate the registered routes (method, path, input schemas), in registration\n     * order. Powers `toOpenAPI` and other introspection; the router trie itself no\n     * longer holds the original patterns.\n     */\n    routes(): ReadonlyArray<RouteDescriptor>;\n    /**\n     * Resolve a `Request` to a `Response` — the whole lifecycle, testable without a port. The\n     * optional `platform` carries edge inputs (`env`, `waitUntil`); edge adapters pass it, and\n     * Bun/Node/Deno omit it (then `c.env` is `undefined` and `c.waitUntil` runs fire-and-forget).\n     */\n    fetch(req: Request, platform?: Platform<EnvOf<Ctx>>): MaybePromise<Response>;\n    private fetchSource;\n    private fetchSourceInner;\n    /** Web response path when Bun already matched the route. The lifecycle and response hooks remain\n     * exactly the same as {@link fetchSource}; only portable URL scanning + trie lookup are skipped. */\n    private fetchMatched;\n    private fetchMatchedInner;\n    /**\n     * Run `produce` under the capacity gate: admit → run → release exactly once when the response is\n     * produced (or the run throws). Only reached when {@link capacityGate} is set, so the off path pays\n     * nothing. The slot is held for the duration of handler execution, not the streaming of the body —\n     * capacity here bounds concurrent *work*, matching how in-flight is counted.\n     */\n    private admitGated;\n    private runAdmitted;\n    /**\n     * Like {@link fetch}, but renders a plain-data result **without** building a Web `Response` — the\n     * `@nifrajs/node` adapter serializes the returned primitives straight to the socket, skipping the undici\n     * `Response` build + body drain (the bulk of the Node bridge cost, measured ≈4µs/req). A handler that\n     * returns a `Response`, an error/short-circuit, or any registered `onResponse` hook falls back to the\n     * full Web path (`{ kind: \"response\" }`), so behavior is identical — only the common JSON-data case is\n     * faster. Same lifecycle as {@link fetch} (body cap, validation, hooks all run); only the final\n     * render differs.\n     */\n    resolveNode(req: Request, platform?: Platform<EnvOf<Ctx>>): MaybePromise<NodeServeOutcome>;\n    resolveNodeSource(source: RequestSource, platform?: Platform<EnvOf<Ctx>>): MaybePromise<NodeServeOutcome>;\n    /**\n     * Resolve a WebSocket upgrade — the seam every serving adapter uses. Returns `pass` (not a WS\n     * upgrade for a registered route → handle as normal HTTP), `reject` (a WS route matched but\n     * `upgrade()` rejected, or the path was malformed → return `response`), or `upgrade` (perform the\n     * runtime upgrade, then dispatch the native socket's events to `handler`, seeding `ws.data` with\n     * `data`). Runs the route's `upgrade(c)` guard in a real request context. Synchronous unless\n     * `upgrade()` is async; a throw rejects with a flat 500 (no detail leaked).\n     */\n    resolveWebSocketUpgrade(req: Request, platform?: Platform<EnvOf<Ctx>>): MaybePromise<WebSocketUpgradeOutcome>;\n    /** Bun `fetch` when WS routes exist: try a WS upgrade first, else run the normal HTTP lifecycle.\n     * `undefined` ⇒ Bun owns the upgraded socket; a `Response` ⇒ a normal reply or a rejected upgrade.\n     * (The socket dispatch itself lives in `ws-bun.ts`, loaded via `@nifrajs/core/ws`.) */\n    private bunFetchWithWebSocket;\n    /**\n     * The shared lifecycle, generic over how the final value is rendered: `finalize` turns a handler's\n     * result + `set` into the output `T` (`toResponse` → a Web `Response`; `toNodeOutcome` → node-direct\n     * primitives), `wrapResponse` lifts an early/error `Response` into that same `T`, and `onTimeout`\n     * produces the 503. The Web `fetch` and `resolveNode` are thin callers over this one routing +\n     * context + lifecycle implementation — no duplication across the trust boundary.\n     */\n    private dispatch;\n    /**\n     * onRequest short-circuit path. Synchronous as long as every hook returns synchronously (the\n     * common case — e.g. CORS returning `undefined` for a non-preflight request): an `async` version\n     * here put EVERY request of any app with one onRequest hook onto the promise machinery, profiled\n     * at ~13% of a realistic request. The first hook that returns a Promise hands the REMAINING\n     * hooks to the async continuation; behavior is identical.\n     */\n    private runWithOnRequest;\n    /** Async tail of {@link runWithOnRequest}: applies the first awaited hook's outcome, then runs\n     * the remaining hooks (awaiting freely — we're already async here). */\n    private continueOnRequest;\n    private takeResponseRequest;\n    /**\n     * Route → build context → run. Synchronous through to the handler for a **bare** route\n     * ({@link RouteEntry.bare}), so a sync handler produces its result with zero promise allocations;\n     * routes with validation/hooks keep the full async {@link runLifecycle}, unchanged.\n     */\n    private routeAndRun;\n    /** Run a route that has already been matched by the runtime or Nifra's portable router. */\n    private runMatched;\n    /**\n     * Idempotency dedupe lane. Reads the `Idempotency-Key`, fingerprints the request, and consults the\n     * store: a fresh key runs the handler (via {@link runMatchedLanes} with the body buffered) and stores\n     * the response; a repeat key replays it without re-running; a key reused with a different body or an\n     * in-flight duplicate is rejected. Every branch materializes a `Response`, then adapts to `T` via the\n     * caller's `wrapResponse`, so it works on the Web fetch path and the Node-native outcome path alike.\n     */\n    private runIdempotent;\n    /** Run a matched route through its selected execution lane (fused/bare/bodyOnly/queryOnly/lifecycle). */\n    private runMatchedLanes;\n    /**\n     * Seal a ledgered request and deliver the sealed ledger to the sink. An empty ledger (declared\n     * capabilities, none exercised) is not delivered — there is nothing to audit. This post-effect\n     * ledger is observational: transactional/durable audit belongs in\n     * the owned effect transaction, so a sink outage must not turn a successful effect into a retryable\n     * 500 that can duplicate it.\n     */\n    private settleEffectLedger;\n    /** The narrowest bare route: a syntactic `() => ...` handler cannot observe the context argument, so\n     * successful requests can skip allocating `RequestContext`. Errors still allocate one for logging. */\n    private runContextlessBare;\n    private contextlessBareError;\n    /**\n     * The synchronous fast path for a {@link RouteEntry.bare} route: apply static decorations, call the\n     * handler, render the result — **no `await`** unless the handler itself returns a promise. It mirrors\n     * the bare slice of {@link runLifecycle} (which a bare route would otherwise no-op through) and shares\n     * {@link logRequestError}; a bare route has no `onError` hooks, so error handling is fully synchronous\n     * (a thrown `Response` is control flow; anything else is a logged flat 500). This is where nifra skips\n     * the per-request async-frame tax — the same win codegen routers get, but without `eval`.\n     */\n    private runBare;\n    /** Bare-route error rendering — identical to {@link runLifecycle}'s catch minus the (absent) onError\n     * loop: a thrown `Response` is returned as deliberate control flow; anything else is logged + 500. */\n    /**\n     * Build a route's fused Web lane (see {@link RouteEntry.fusedWeb}). Composition happens once at\n     * registration; the returned closure is what every request to the route runs. Behavior is\n     * byte-identical to the generic `runBare`/`runContextlessBare` + `toResponse` pair — same\n     * decoration order, same error routing (thrown `Response` = control flow; anything else logs and\n     * 500s), same respond semantics (the lifecycle parity suite pins it).\n     */\n    private buildFusedWeb;\n    private bareError;\n    private runWithAround;\n    private runAround;\n    private runBodyOnly;\n    /** Validate + run the handler for the bodyOnly path — shared by the inline fast path and the\n     * streaming fallback. A method (not per-request closures) so the hot path allocates nothing\n     * beyond the one `.then` continuation. */\n    private finishBodyOnly;\n    private executeHandler;\n    private handleValidationErrorRecovery;\n    private applyBodyValidation;\n    private runQueryOnly;\n    /** Validate-result → set `ctx.query` → run handler. A method (not a per-request closure), the\n     * query analogue of {@link applyBodyValidation}. */\n    private applyQueryValidation;\n    /**\n     * Thread the response through each global `onResponse` hook. Stays SYNCHRONOUS until a hook\n     * actually returns a Promise — an `async` version forced a promise + microtask on EVERY response\n     * of any app with an onResponse hook (cors/securityHeaders/etag/timing all use onResponse), the\n     * same ~13%/req tax the onRequest walk was de-async'd to avoid. The first async hook hands the\n     * rest to {@link continueOnResponse}.\n     */\n    private applyOnResponse;\n    private applyOnResponseAndFinalize;\n    private completeResponseFinalization;\n    private failResponseFinalization;\n    /** Notify terminal observers in order while isolating both sync and async failures. */\n    private notifyResponseFinalized;\n    /** Async tail of {@link applyOnResponse}: runs the remaining hooks once one has gone async. */\n    private continueOnResponse;\n    /**\n     * Bound the response time. On timeout we abort `ctx.signal` (so cancellation-aware\n     * handlers can bail) and return 503; the in-flight work keeps running but its\n     * result is discarded — JS can't forcibly cancel a promise.\n     */\n    private withTimeout;\n    /**\n     * The post-match lifecycle: validate → derive → beforeHandle → handler → afterHandle, with onError.\n     * Generic over the render: a success value goes through `finalize(result, set)` (a Web `Response`, or\n     * node-direct primitives); an early/error `Response` (validation, thrown, 500) through `wrapResponse`.\n     */\n    private runLifecycle;\n    private handleLifecycleError;\n    /** Log an unhandled request error to the (redacting) logger — shared by {@link runLifecycle} and the\n     * bare fast path ({@link bareError}) so both record the same fields. Never throws; never leaks. */\n    private logRequestError;\n    private readAndValidateBody;\n    /**\n     * Read the body as text, capped at `maxBodyBytes`. Rejects (`null`) on a\n     * `Content-Length` over the cap *before* buffering, and aborts mid-stream once the\n     * running byte count exceeds it — so a lying or absent length can't force us to\n     * buffer an oversized payload.\n     *\n     * Fast path: when a non-chunked request carries a `Content-Length` within the cap,\n     * a native `req.json()` is already bounded — under HTTP/1.1 + HTTP/2 framing the\n     * runtime delivers at most `Content-Length` bytes — so we skip the manual stream\n     * loop and a separate text decode. It trusts the wire\n     * *framing*, not the header value: nifra only ever receives framed Requests from the\n     * runtime's HTTP server, never a hand-built one with a mismatched length. Chunked or\n     * length-less bodies fall through to the streaming byte-cap guard below.\n     */\n    private readBoundedJson;\n    /** Compile portable route registrations into Bun's native route table. Apps with request-rewrite\n     * hooks or WebSockets retain the single portable dispatcher because those features must run before\n     * route selection/upgrade. Named wildcards also stay on the fallback until Bun exposes their raw\n     * capture semantics; static and `:param` routes take the native lane. */\n    private buildBunNativeRoutes;\n    /**\n     * Start a `Bun.serve` instance bound to `port` (use `0` for an ephemeral port).\n     *\n     * `reusePort` sets `SO_REUSEPORT` so **multiple processes can bind the same port** and the kernel\n     * load-balances connections across them — the standard way to use every core (Bun is\n     * single-threaded per process). Spawn one process per core, each calling\n     * `app.listen(PORT, { reusePort: true })`; see `examples/cluster.ts`. Every process must opt in,\n     * and all of them must be the same app. Linux balances ~evenly; macOS accepts the flag but may\n     * favor one socket (fine for dev, measure on Linux for production numbers).\n     */\n    listen(port: number, options?: {\n        readonly reusePort?: boolean;\n    }): RunningServer;\n    /**\n     * Gracefully stop: wait for in-flight requests to finish (up to `drainMs`), then\n     * issue a single terminal stop — graceful if everything drained, forced if\n     * stragglers remain. Safe to call when not listening.\n     *\n     * The Bun semantics: poll `pendingRequests` (awaiting\n     * `stop()`'s promise drops in-flight requests), and decide graceful-vs-forced in\n     * ONE call (Bun can't escalate an already-graceful `stop()` to a forced close).\n     * New connections may be accepted during the drain window; in a real deploy the\n     * load balancer has already stopped routing here, and `drainMs` bounds it.\n     */\n    stop({ drainMs }?: {\n        drainMs?: number;\n    }): Promise<void>;\n    private installSignalHandlers;\n}",
     "doc": "/**\n * The inline server. Routes are chainable and fully type-inferred. `derive`/\n * `decorate` extend the handler context (`Ctx`) for routes defined *after* them,\n * with full types; `Ctx` is server-only and never touches the client registry.\n *\n *   app.decorate(\"db\", db).derive((c) => ({ user: auth(c) }))\n *      .get(\"/me\", (c) => c.user)            // c.user + c.db are typed\n */"
   },
   {
@@ -5972,7 +7627,7 @@
     "name": "ServerOptions",
     "kind": "interface",
     "package": "@nifrajs/core",
-    "signature": "export interface ServerOptions {\n    /**\n     * Max request body size (bytes), enforced **only when a route declares a body schema** — the cap\n     * lives in the schema-validated read path. Default 1_000_000.\n     *\n     * A route WITHOUT a body schema (raw body, file upload, BYO-validation) that reads `c.req` directly\n     * is not auto-bounded — use **`c.boundedBody(maxBytes?)`** / **`c.boundedJson(maxBytes?)`**, which\n     * apply this same cap (override per route by passing `maxBytes` — larger for an upload endpoint,\n     * smaller to tighten one).\n     */\n    readonly maxBodyBytes?: number;\n    /** Max inbound WebSocket message size (bytes) when `listen()`ing on Bun — frames over this are rejected\n     * by the runtime before reaching your handler (so a huge frame can't be JSON-parsed into memory).\n     * Default: `maxBodyBytes` (1 MB). */\n    readonly wsMaxPayloadBytes?: number;\n    /** Per-request timeout (ms): a slower request gets a 503 and `ctx.signal` aborts. 0 disables (default). */\n    readonly requestTimeoutMs?: number;\n    /** When `listen()`ing, install SIGTERM/SIGINT handlers that gracefully `stop()`. Default false. */\n    readonly gracefulSignals?: boolean;\n    /** Structured logger for framework events (redacts secrets). Default: JSON to stderr. */\n    readonly logger?: Logger;\n    /**\n     * App-wide fallback fired when a route **without its own `onValidationError`** fails body/query\n     * validation. Same contract as the per-route hook (`(issues, ctx, kind) => Response | repaired-value |\n     * undefined`): a route's own hook takes precedence, and a route can fall through to the plain `422` by\n     * returning `undefined`. Use it for one app-wide error envelope (like tRPC's `errorFormatter` /\n     * Fastify's `setErrorHandler`) instead of repeating a formatter per route.\n     */\n    readonly onValidationError?: RouteSchema[\"onValidationError\"];\n}"
+    "signature": "export interface ServerOptions {\n    /**\n     * Max request body size (bytes), enforced **only when a route declares a body schema** — the cap\n     * lives in the schema-validated read path. Default 1_000_000.\n     *\n     * A route WITHOUT a body schema (raw body, file upload, BYO-validation) that reads `c.req` directly\n     * is not auto-bounded — use **`c.boundedBody(maxBytes?)`** / **`c.boundedJson(maxBytes?)`**, which\n     * apply this same cap (override per route by passing `maxBytes` — larger for an upload endpoint,\n     * smaller to tighten one).\n     */\n    readonly maxBodyBytes?: number;\n    /** Max inbound WebSocket message size (bytes) when `listen()`ing on Bun — frames over this are rejected\n     * by the runtime before reaching your handler (so a huge frame can't be JSON-parsed into memory).\n     * Default: `maxBodyBytes` (1 MB). */\n    readonly wsMaxPayloadBytes?: number;\n    /** Per-request timeout (ms): a slower request gets a 503 and `ctx.signal` aborts. 0 disables (default). */\n    readonly requestTimeoutMs?: number;\n    /**\n     * Admit the public `x-nifra-deadline` header and let it shorten local work. Disabled by default:\n     * services that participate in trusted cross-service deadline propagation opt in explicitly,\n     * while ordinary/public HTTP routes pay no header-admission tax and ignore hostile client values.\n     */\n    readonly acceptInboundDeadlines?: boolean;\n    /**\n     * Maximum time accepted from an inbound `x-nifra-deadline`, in milliseconds. An incoming absolute\n     * deadline may shorten this cap (and `requestTimeoutMs`, when configured), never extend it.\n     * Default 30_000; applies only when `acceptInboundDeadlines` is enabled and the header is present.\n     */\n    readonly maxInboundDeadlineMs?: number;\n    /** When `listen()`ing, install SIGTERM/SIGINT handlers that gracefully `stop()`. Default false. */\n    readonly gracefulSignals?: boolean;\n    /**\n     * Capacity-admission gate (see {@link AdmissionController}). Bounds concurrent in-flight work so a\n     * healthy instance sheds load (`429` + `Retry-After`) instead of accepting more than it can finish.\n     * Off by default. Enabling it disables the fused native-route fast path (requests route through the\n     * shared matched lane where the gate runs); when unset, the request path pays nothing.\n     */\n    readonly admission?: AdmissionController;\n    /**\n     * Optional token-only observation hook called by `useCapability(c, id)`. It receives no request,\n     * parameters, body, tenant, or values. Routes without capability declarations keep the old hot path.\n     */\n    readonly onCapabilityUse?: (event: CapabilityUseEvent) => void;\n    /**\n     * Enable the per-request effect ledger. Each route that declares `schema.capabilities` gets a\n     * bounded, token-only ledger; `useCapability(c, id, …)` appends one entry per effect, and the sink\n     * receives the sealed ledger when the response settles (only when it recorded entries). Token-only\n     * by construction — capability ids, phases, counters, digests; never payloads, values, or the\n     * concrete URL (the route *pattern* is recorded). Enabling it moves capability-declaring routes off\n     * the fused fast path (they need a per-request context + a settle step); all other routes are\n     * unaffected, and when unset the request path pays nothing.\n     */\n    readonly effectLedger?: EffectLedgerOptions;\n    /**\n     * Default store backing routes that declare `schema.idempotency` without their own `store`. Defaults\n     * to a shared in-process {@link MemoryIdempotencyStore} (created lazily on first idempotent route).\n     * Inject a durable store here to make request-scoped dedupe survive restarts app-wide.\n     */\n    readonly idempotencyStore?: IdempotencyStore;\n    /** Structured logger for framework events (redacts secrets). Default: JSON to stderr. */\n    readonly logger?: Logger;\n    /**\n     * App-wide fallback fired when a route **without its own `onValidationError`** fails body/query\n     * validation. Same contract as the per-route hook (`(issues, ctx, kind) => Response | repaired-value |\n     * undefined`): a route's own hook takes precedence, and a route can fall through to the plain `422` by\n     * returning `undefined`. Use it for one app-wide error envelope (like tRPC's `errorFormatter` /\n     * Fastify's `setErrorHandler`) instead of repeating a formatter per route.\n     */\n    readonly onValidationError?: RouteSchema[\"onValidationError\"];\n}"
   },
   {
     "name": "ServeStaticOptions",
@@ -6035,6 +7690,13 @@
     "signature": "export interface SessionStore {\n    /** The record for `id`, or `undefined` on a miss. */\n    get(id: string): Promise<SessionRecord | undefined>;\n    /** Store (or overwrite) the record for `id`. */\n    set(id: string, record: SessionRecord): Promise<void>;\n    /** Drop `id` (logout / regeneration). A no-op if absent. */\n    delete(id: string): Promise<void>;\n}",
     "doc": "/**\n * Pluggable session backend (store mode). Async so a network store (KV/Redis) fits the same shape.\n * **Production needs a shared/durable store** so sessions hold across instances — {@link MemorySessionStore}\n * prod-guards against the per-instance footgun.\n */"
   },
+  {
+    "name": "setBrowserNavigate",
+    "kind": "function",
+    "package": "@nifrajs/web",
+    "signature": "export declare function setBrowserNavigate(navigate: BrowserNavigate | undefined): void;",
+    "doc": "/** Register (or clear, with `undefined`) the browser navigate — called by `installHistory`. Not for\n * app use. */"
+  },
   {
     "name": "setMountedRouter",
     "kind": "function",
@@ -6076,6 +7738,13 @@
     "package": "@nifrajs/cache",
     "signature": "export interface SetOptions {\n    /** Time-to-live (ms) before the value goes stale. Default: the cache's `defaultTtlMs`. */\n    readonly ttlMs?: number;\n    /** Extra ms past TTL during which the stale value is served while a background refresh runs. Default 0. */\n    readonly swrMs?: number;\n    /** Tags for group invalidation via `invalidateTag`. */\n    readonly tags?: readonly string[];\n}"
   },
+  {
+    "name": "SetSearchParams",
+    "kind": "type",
+    "package": "@nifrajs/web-react",
+    "signature": "export type SetSearchParams = (next: SearchParamsInit | ((prev: URLSearchParams) => SearchParamsInit), options?: NavigateOptions) => void;",
+    "doc": "/** Set the query string. Accepts a `URLSearchParams`, a record, a raw string, or an updater of the\n * current params; navigates to the same pathname with the new query (push, or replace via options). */"
+  },
   {
     "name": "setWsRuntime",
     "kind": "function",
@@ -6089,6 +7758,13 @@
     "package": "@nifrajs/middleware",
     "signature": "export declare function sha256(input: string | Uint8Array): Promise<Uint8Array<ArrayBuffer>>;"
   },
+  {
+    "name": "shapeOf",
+    "kind": "function",
+    "package": "@nifrajs/testing",
+    "signature": "export declare function shapeOf(value: unknown): unknown;",
+    "doc": "/** A stable structural fingerprint: keys + value *types*, not values. Used for the optional shape check. */"
+  },
   {
     "name": "sharpImageBackend",
     "kind": "function",
@@ -6103,6 +7779,13 @@
     "signature": "export type SharpLike = (input: Uint8Array) => SharpInstance;",
     "doc": "/** The slice of a [sharp](https://sharp.pixelplumbing.com) instance this backend uses. Declared\n * structurally so `@nifrajs/image` has no dependency on sharp — pass your own `sharp` import. */"
   },
+  {
+    "name": "ShedReason",
+    "kind": "type",
+    "package": "@nifrajs/middleware",
+    "signature": "export type ShedReason = \"inflight\" | \"loop-lag\" | \"queue-timeout\" | \"policy\" | \"cancelled\";",
+    "doc": "/**\n * Adaptive capacity admission. Rate limiting bounds request *frequency* and `@nifrajs/budget` bounds\n * request *duration*; neither stops a healthy instance from accepting more *concurrent* work than it\n * can finish. This gate admits on live capacity evidence — in-flight count + event-loop lag — briefly\n * queues at the edge, and sheds the rest with `429` + `Retry-After`, so p99 stays bounded under load\n * instead of collapsing.\n *\n * Public mechanics (in-flight + loop lag) know nothing about tenants. An application-supplied {@link AdmissionPolicy}\n * hook layers tenant priority and reserved capacity on top without leaking\n * those concerns into the OSS core.\n *\n * Wire it as the server's `admission` option (NOT an `onRequest` hook — a hook disables the native\n * route table). Off by default: when unset, the request path is untouched.\n */"
+  },
   {
     "name": "signal",
     "kind": "function",
@@ -6164,6 +7847,13 @@
     "package": "@nifrajs/image",
     "signature": "export interface SignImageUrlOptions {\n    /** HMAC secret — must match the handler's `signing.secret`. */\n    readonly secret: string;\n    /** Seconds until the URL expires (adds `&exp=`). Omit for a stable, cacheable-forever signed URL. */\n    readonly expiresIn?: number;\n}"
   },
+  {
+    "name": "signNifraManifest",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function signNifraManifest(manifest: NifraManifest, signer: NifraManifestSigner): Promise<NifraManifestSignature>;",
+    "doc": "/** Sign without handling private keys: the operator-supplied signer may call KMS/HSM/local WebCrypto. */"
+  },
   {
     "name": "signValue",
     "kind": "function",
@@ -6211,6 +7901,19 @@
     "signature": "export interface SizeReport {\n    /** Per-chunk sizes, sorted biggest gzip first (the regression you want to see at the top). */\n    readonly chunks: readonly ChunkSize[];\n    /** Sum of every chunk's raw bytes. */\n    readonly totalBytes: number;\n    /** Sum of every chunk's gzip bytes. */\n    readonly totalGzip: number;\n}",
     "doc": "/** A whole build's size report — every chunk (largest first) + the totals. */"
   },
+  {
+    "name": "SkippedRoute",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface SkippedRoute {\n    readonly method: string;\n    readonly path: string;\n    readonly reason: string;\n}"
+  },
+  {
+    "name": "snapshotCapabilities",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function snapshotCapabilities(report: CapabilityAssuranceReport): CapabilitySnapshot;",
+    "doc": "/** Deterministic, PII-free lockfile material. */"
+  },
   {
     "name": "SnapshotFile",
     "kind": "interface",
@@ -6527,6 +8230,13 @@
     "signature": "export interface StoredJob {\n    readonly id: string;\n    readonly name: string;\n    readonly payload: unknown;\n    readonly attempt: number;\n    readonly maxAttempts: number;\n}",
     "doc": "/** A job as handed back by {@link JobStore.lease}. `attempt` is the count of PRIOR attempts (0 the first time). */"
   },
+  {
+    "name": "StoredResponse",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface StoredResponse {\n    readonly status: number;\n    readonly headers: readonly (readonly [string, string])[];\n    /** Base64-encoded response body; `\"\"` when the response had no body. */\n    readonly body: string;\n}",
+    "doc": "/** A serialized response held by a store. `body` is base64 so binary payloads round-trip intact. */"
+  },
   {
     "name": "string",
     "kind": "function",
@@ -6924,6 +8634,13 @@
     "signature": "export declare function uiResourceMeta(uri: string): Record<string, unknown>;",
     "doc": "/** The MCP Apps `_meta.ui.resourceUri` link, emitted nested (current spec) AND flat (the deprecated\n * `ui/resourceUri`, still read by some hosts) so a tool renders across the transition. */"
   },
+  {
+    "name": "UNBOUNDED_DEADLINE",
+    "kind": "const",
+    "package": "@nifrajs/core",
+    "signature": "export declare const UNBOUNDED_DEADLINE: number;",
+    "doc": "/** Sentinel used only for an unbounded local budget. It is never written to the wire. */"
+  },
   {
     "name": "unsignValue",
     "kind": "function",
@@ -6938,6 +8655,24 @@
     "signature": "export declare class UnsupportedMockSchemaError extends Error {\n    readonly keyword: string;\n    constructor(keyword: string, message: string);\n}",
     "doc": "/**\n * `@nifrajs/mock` — contract-based mock server.\n *\n * Reads a Nifra app's registered routes and their Standard Schema / JSON Schema\n * response definitions, then generates fake responses from supported JSON Schema keywords. Use it\n * for frontend-first development, agent testing, or CI smoke tests.\n */"
   },
+  {
+    "name": "UpgradeOptions",
+    "kind": "interface",
+    "package": "@nifrajs/cli",
+    "signature": "export interface UpgradeOptions {\n    /** Target version, e.g. \"1.8.0\". Required unless `list` is set. */\n    readonly version?: string;\n    /** Apply the edits. Without it, the run is a dry-run that only prints the plan. */\n    readonly write?: boolean;\n    /** Emit a machine-readable plan/result instead of the human report. */\n    readonly json?: boolean;\n    /** Print the available target versions and return. */\n    readonly list?: boolean;\n    /** After `--write`, run `nifra check` and fail the command if it fails. Default true. */\n    readonly verify?: boolean;\n}"
+  },
+  {
+    "name": "UpgradePlan",
+    "kind": "interface",
+    "package": "@nifrajs/cli",
+    "signature": "export interface UpgradePlan {\n    readonly version: string;\n    readonly pins: readonly PinChange[];\n    readonly importMoves: readonly ImportChange[];\n    readonly notes: readonly string[];\n}"
+  },
+  {
+    "name": "UpgradeRecipe",
+    "kind": "interface",
+    "package": "@nifrajs/cli",
+    "signature": "export interface UpgradeRecipe {\n    readonly version: string;\n    readonly pins: readonly PinRule[];\n    readonly importMoves: readonly ImportMove[];\n    /** Human notes printed after the plan — e.g. structural changes the runner deliberately can't do. */\n    readonly notes?: readonly string[];\n}"
+  },
   {
     "name": "UploadResult",
     "kind": "type",
@@ -6958,6 +8693,20 @@
     "package": "@nifrajs/core",
     "signature": "export declare function urlPartsOf(url: string): UrlParts;"
   },
+  {
+    "name": "useCapability",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function useCapability(context: object, capability: string, options?: UseCapabilityOptions): void;",
+    "doc": "/**\n * Runtime effect beacon for owned adapters. It fails closed when the route omitted the capability or\n * when no route guard is present. Static provenance is still required: code can bypass a beacon.\n * When the server enabled the effect ledger, each beacon call also appends one token-only entry.\n */"
+  },
+  {
+    "name": "UseCapabilityOptions",
+    "kind": "interface",
+    "package": "@nifrajs/core",
+    "signature": "export interface UseCapabilityOptions {\n    /** Adapter/resource token recorded on the ledger entry (`repo:orders`). */\n    readonly target?: string;\n    /** Dimensionless resource counters recorded on the ledger entry. */\n    readonly cost?: EffectCost;\n    /** Keyed payload digest (see `computeEffectDigest`). */\n    readonly digest?: string;\n}",
+    "doc": "/**\n * Optional effect-ledger fields for one `useCapability` beacon. Token-only by design: an adapter\n * names *what* it touched and *how much resource* it used — never the value it read or wrote.\n */"
+  },
   {
     "name": "useFetcher",
     "kind": "function",
@@ -7021,6 +8770,34 @@
     "signature": "export declare function useFetchers(): Readonly<ShallowRef<readonly Fetcher[]>>;",
     "doc": "/**\n * Subscribe to the whole live fetcher collection — for a global busy view (e.g. \"3 saving…\"). Read\n * each entry's `.snapshot()` for its state. The ref updates whenever any fetcher transitions or a new\n * one is created.\n */"
   },
+  {
+    "name": "useInfiniteQuery",
+    "kind": "function",
+    "package": "@nifrajs/web-react",
+    "signature": "export declare function useInfiniteQuery<T, P>(key: unknown, fn: (pageParam: P) => Promise<T>, options: UseInfiniteQueryOptions<T, P>): UseInfiniteQueryResult<T, P>;",
+    "doc": "/**\n * Subscribe to a paged (infinite-scroll) query. Returns the accumulated `data.pages` plus\n * `fetchNextPage`/`fetchPreviousPage`/`hasNextPage`/`hasPreviousPage`. Fetches the first page on mount.\n * SSR-idle unless a `QueryClientProvider` supplies a hydrated client.\n */"
+  },
+  {
+    "name": "UseInfiniteQueryOptions",
+    "kind": "interface",
+    "package": "@nifrajs/web-react",
+    "signature": "export interface UseInfiniteQueryOptions<T, P> extends InfiniteQueryOptions<T, P> {\n    readonly enabled?: boolean;\n}",
+    "doc": "/** Options for {@link useInfiniteQuery} — the engine's {@link InfiniteQueryOptions} plus `enabled`. */"
+  },
+  {
+    "name": "UseInfiniteQueryResult",
+    "kind": "interface",
+    "package": "@nifrajs/web-react",
+    "signature": "export interface UseInfiniteQueryResult<T, P> extends QueryState<InfiniteData<T, P>> {\n    readonly isPending: boolean;\n    readonly isError: boolean;\n    readonly isSuccess: boolean;\n    readonly fetchNextPage: () => Promise<InfiniteData<T, P>>;\n    readonly fetchPreviousPage: () => Promise<InfiniteData<T, P>>;\n    readonly hasNextPage: boolean;\n    readonly hasPreviousPage: boolean;\n    readonly refetch: () => Promise<InfiniteData<T, P>>;\n}",
+    "doc": "/** An infinite query's reactive state + paging controls. */"
+  },
+  {
+    "name": "useLocation",
+    "kind": "function",
+    "package": "@nifrajs/web-react",
+    "signature": "export declare function useLocation(): Location;",
+    "doc": "/** The current {@link Location} (`pathname`/`search`/`hash`), derived from the router context. */"
+  },
   {
     "name": "useMDXComponents",
     "kind": "function",
@@ -7028,6 +8805,34 @@
     "signature": "export declare function useMDXComponents(): Record<string, (props: Record<string, unknown>) => unknown>;",
     "doc": "/** Returns the intrinsic-element → Solid-component map MDX content uses. Merge in your own overrides by\n * passing `components` to the MDX content component (they take precedence). */"
   },
+  {
+    "name": "useMutation",
+    "kind": "function",
+    "package": "@nifrajs/web-react",
+    "signature": "export declare function useMutation<TData, TVariables = void>(fn: (variables: TVariables) => Promise<TData>, callbacks?: MutationCallbacks<TData, TVariables>): UseMutationResult<TData, TVariables>;",
+    "doc": "/**\n * A mutation hook (create/update/delete). Returns `{ mutate, mutateAsync, data, error, variables, isIdle,\n * isPending, isError, isSuccess, reset }`. Invalidate affected queries from `onSuccess` via\n * `useQueryClient().invalidateQueries(...)`. The handle is stable across renders; the latest `fn`/\n * callbacks re-bind each render.\n */"
+  },
+  {
+    "name": "UseMutationResult",
+    "kind": "interface",
+    "package": "@nifrajs/web-react",
+    "signature": "export interface UseMutationResult<TData, TVariables> extends MutationState<TData, TVariables> {\n    readonly isIdle: boolean;\n    readonly isPending: boolean;\n    readonly isError: boolean;\n    readonly isSuccess: boolean;\n    /** Fire-and-forget: runs the mutation and swallows rejection (read `error`/`isError` for failures). */\n    readonly mutate: (variables: TVariables) => void;\n    /** Run the mutation and return the promise (rejects on failure) — for `await`. */\n    readonly mutateAsync: (variables: TVariables) => Promise<TData>;\n    /** Reset back to idle. */\n    readonly reset: () => void;\n}",
+    "doc": "/** A mutation's reactive state + imperative controls (the TanStack `useMutation` shape). */"
+  },
+  {
+    "name": "useNavigate",
+    "kind": "function",
+    "package": "@nifrajs/web-react",
+    "signature": "export declare function useNavigate(): NavigateFunction;",
+    "doc": "/** Get the {@link NavigateFunction}. Stable across renders; resolves the browser navigate at call time\n * (so it works as soon as `installHistory` has run, and no-ops before then / on the server). */"
+  },
+  {
+    "name": "useParams",
+    "kind": "function",
+    "package": "@nifrajs/web-react",
+    "signature": "export declare function useParams<T extends Record<string, string | undefined> = Record<string, string>>(): Readonly<T>;",
+    "doc": "/**\n * The matched route's decoded path params — `/users/:id` on `/users/7` → `{ id: \"7\" }`. SSR-correct:\n * `compose` provides the same value server-side (from the request match) and client-side (from router\n * state), so a param rendered into markup doesn't flash on hydration.\n */"
+  },
   {
     "name": "useQuery",
     "kind": "function",
@@ -7039,8 +8844,8 @@
     "name": "useQuery",
     "kind": "function",
     "package": "@nifrajs/web-react",
-    "signature": "export declare function useQuery<T>(key: unknown, fn: () => Promise<T>): UseQueryResult<T>;",
-    "doc": "/**\n * Subscribe to the keyed query for `key`, fetched via `fn`. Returns `{ status, data, error, isFetching,\n * updatedAt, isPending, refetch }`. Concurrent `useQuery`s with the same key share one cache entry +\n * one in-flight fetch (dedup). Refetches on mount and when the key changes; SSR-idle.\n */"
+    "signature": "export declare function useQuery<T>(key: unknown, fn: () => Promise<T>, options?: UseQueryOptions): UseQueryResult<T>;",
+    "doc": "/**\n * Subscribe to the keyed query for `key`, fetched via `fn`. Returns `{ status, data, error, isFetching,\n * updatedAt, isPending, isError, isSuccess, refetch }`. Concurrent `useQuery`s with the same key share\n * one cache entry + one in-flight fetch (dedup). Fetches on mount and when the key changes; `enabled:\n * false` keeps it idle (dependent queries). SSR-idle unless a `QueryClientProvider` supplies a hydrated\n * client.\n */"
   },
   {
     "name": "useQuery",
@@ -7067,8 +8872,8 @@
     "name": "useQueryClient",
     "kind": "function",
     "package": "@nifrajs/web-react",
-    "signature": "export declare function useQueryClient(): Pick<QueryClient, \"invalidateQueries\">;",
-    "doc": "/** Access the query client to imperatively `invalidateQueries(keyOrPrefix)` (e.g. after a mutation). */"
+    "signature": "export declare function useQueryClient(): QueryClient;",
+    "doc": "/** The active {@link QueryClient}: a `QueryClientProvider`'s client, else the client-side singleton,\n * else a no-op (server / pre-hydration). Use it to `invalidateQueries`/`setQueryData`/`prefetchQuery`. */"
   },
   {
     "name": "useQueryClient",
@@ -7091,6 +8896,13 @@
     "signature": "export declare function useQueryClient(): Pick<QueryClient, \"invalidateQueries\">;",
     "doc": "/** Access the query client to imperatively `invalidateQueries(keyOrPrefix)` (e.g. after a mutation). */"
   },
+  {
+    "name": "UseQueryOptions",
+    "kind": "interface",
+    "package": "@nifrajs/web-react",
+    "signature": "export interface UseQueryOptions extends QueryOptions {\n    /** When `false`, don't fetch (the query stays idle) — for dependent queries. Default `true`. */\n    readonly enabled?: boolean;\n}",
+    "doc": "/** Options for {@link useQuery}. */"
+  },
   {
     "name": "UseQueryResult",
     "kind": "interface",
@@ -7102,7 +8914,7 @@
     "name": "UseQueryResult",
     "kind": "interface",
     "package": "@nifrajs/web-react",
-    "signature": "export interface UseQueryResult<T> extends QueryState<T> {\n    /** `status === \"pending\"` — no data yet (initial load). */\n    readonly isPending: boolean;\n    /** Force a refetch (ignores `staleTime`). */\n    readonly refetch: () => Promise<T>;\n}",
+    "signature": "export interface UseQueryResult<T> extends QueryState<T> {\n    /** `status === \"pending\"` — no data yet (initial load). */\n    readonly isPending: boolean;\n    /** `status === \"error\"`. */\n    readonly isError: boolean;\n    /** `status === \"success\"`. */\n    readonly isSuccess: boolean;\n    /** Force a refetch (ignores `staleTime`). */\n    readonly refetch: () => Promise<T>;\n}",
     "doc": "/** A query's reactive {@link QueryState} plus `isPending` + `refetch`. */"
   },
   {
@@ -7112,6 +8924,13 @@
     "signature": "export interface UseQueryResult<T> {\n    readonly state: Readonly<ShallowRef<QueryState<T>>>;\n    /** Force a refetch (ignores `staleTime`). */\n    readonly refetch: () => Promise<T>;\n}",
     "doc": "/** A query's reactive {@link QueryState} (read `.value`) plus `refetch`. */"
   },
+  {
+    "name": "useSearchParams",
+    "kind": "function",
+    "package": "@nifrajs/web-react",
+    "signature": "export declare function useSearchParams(): readonly [URLSearchParams, SetSearchParams];",
+    "doc": "/**\n * The current query as a `URLSearchParams` (SSR-correct via the router context) plus a setter that\n * navigates to the new query. Mirrors react-router's `useSearchParams` tuple.\n */"
+  },
   {
     "name": "useT",
     "kind": "function",
@@ -7179,6 +8998,44 @@
     "package": "@nifrajs/core",
     "signature": "export type ValidationOutcome<Output> = {\n    readonly ok: true;\n    readonly value: Output;\n} | {\n    readonly ok: false;\n    readonly issues: ReadonlyArray<StandardIssue>;\n};"
   },
+  {
+    "name": "validCapabilityId",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function validCapabilityId(value: string): boolean;"
+  },
+  {
+    "name": "validEvidence",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function validEvidence(value: unknown): value is AssuranceEvidence;"
+  },
+  {
+    "name": "validEvidenceId",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function validEvidenceId(value: string): boolean;"
+  },
+  {
+    "name": "validIdempotencyKey",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function validIdempotencyKey(key: string): boolean;",
+    "doc": "/** A key must be a non-empty, bounded, control-char-free token. Fail closed on anything else. */"
+  },
+  {
+    "name": "validIdempotencyNamespace",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function validIdempotencyNamespace(namespace: string): boolean;",
+    "doc": "/** Namespace values are server-resolved, bounded opaque tokens (normally a tenant/subject hash). */"
+  },
+  {
+    "name": "validMethod",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function validMethod(value: string): value is Method;"
+  },
   {
     "name": "vanillaAdapter",
     "kind": "const",
@@ -7200,6 +9057,19 @@
     "signature": "export type Verdict = \"ok\" | \"caveat\" | \"unsupported\";",
     "doc": "/** A target's verdict for one feature: fully fine, works-with-a-caveat, or won't work at all. */"
   },
+  {
+    "name": "VerificationLevelsResult",
+    "kind": "interface",
+    "package": "@nifrajs/cli",
+    "signature": "export interface VerificationLevelsResult {\n    /** Highest level whose whole ladder holds; -1 when even L0 fails. */\n    readonly achieved: number;\n    readonly levels: readonly VerificationLevelStatus[];\n}"
+  },
+  {
+    "name": "VerificationLevelStatus",
+    "kind": "interface",
+    "package": "@nifrajs/cli",
+    "signature": "export interface VerificationLevelStatus {\n    readonly level: number;\n    readonly name: string;\n    readonly ok: boolean;\n    /** Why the level does not hold — a gate failure or a missing prerequisite. Empty when ok. */\n    readonly reasons: readonly string[];\n}",
+    "doc": "/**\n * `nifra levels` — the verification ladder, computed from gates that already exist:\n *\n *   L0 typed contract      — `nifra check` passes (compiler-enforced frontend↔backend contract)\n *   L1 route assurance     — `nifra.assurance.ts` present and every route satisfies its policy\n *   L2 capability lockfile — capability/effect assurance passes and the lockfile is in sync\n *   L3 route manifest      — the emitted manifest hash-verifies and matches the current app\n *   L4 invariant-tested    — every route passes through an explicitly isolated executor\n *\n * A level counts only when every level below it holds — the ladder is cumulative, so \"L3\" is one\n * honest word for a whole posture. Levels are computed, never self-declared.\n */"
+  },
   {
     "name": "VerifiedJwt",
     "kind": "interface",
@@ -7250,6 +9120,13 @@
     "package": "@nifrajs/middleware",
     "signature": "export type VerifyJwtResult<C extends JwtClaims = JwtClaims> = {\n    readonly ok: true;\n    readonly data: VerifiedJwt<C>;\n} | {\n    readonly ok: false;\n    readonly error: Error;\n};"
   },
+  {
+    "name": "verifyNifraManifestSignature",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function verifyNifraManifestSignature(manifest: NifraManifest, signature: NifraManifestSignature, publicKey: CryptoKey): Promise<boolean>;",
+    "doc": "/** Verify the hash first, then the detached Ed25519 signature. Malformed/tampered input returns false. */"
+  },
   {
     "name": "verifyWebhook",
     "kind": "function",
@@ -7273,7 +9150,7 @@
     "name": "VERSION",
     "kind": "const",
     "package": "@nifrajs/core",
-    "signature": "export declare const VERSION: \"1.6.0\";",
+    "signature": "export declare const VERSION: \"1.11.0\";",
     "doc": "/**\n * Current package version. A hardcoded literal on purpose — core runs on the edge (no fs), so it can't\n * read its own package.json at runtime. `scripts/version.ts` rewrites it on every release bump and\n * `check:publish` asserts it equals `@nifrajs/core`'s package version, so the literal can't go stale\n * (it shipped at \"0.0.0\" through 1.0.0 before those guards existed). Kept narrow (`as const`) so\n * consumers can pin it at the type level — see `test/version.test-d.ts`.\n */"
   },
   {
@@ -7396,6 +9273,13 @@
     "signature": "export declare function widgetDocument(opts: DefineMcpWidgetOptions): string;",
     "doc": "/** Assemble the full self-contained widget document (bridge inlined in `<head>` so body scripts can use\n * `mcpApp` immediately). */"
   },
+  {
+    "name": "withDeadlineHeader",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function withDeadlineHeader(input: DeadlineHeadersInit, budget: RequestBudget, reserveMs?: number): Headers;",
+    "doc": "/** Add this budget's absolute deadline to an outbound request. */"
+  },
   {
     "name": "withHeaders",
     "kind": "function",
@@ -7410,6 +9294,13 @@
     "signature": "export declare function withISR(app: ISRApp, options: ISROptions): (req: Request, platform?: ISRPlatform) => Promise<Response>;",
     "doc": "/**\n * Wrap a nifra app with **Incremental Static Regeneration**: a cacheable page is served from\n * {@link CacheStore} when fresh, served **stale while a fresh copy regenerates in the background**\n * (`platform.waitUntil` on edge), or rendered + stored on a miss. Framework-agnostic (it caches the\n * rendered bytes). Returns a `fetch(req, platform?)` handler — hand it to `Bun.serve`/the Workers\n * `export default`, etc. Regeneration is single-flight per key (no stampede on a hot stale page).\n *\n * Each route's freshness comes from the `revalidate` header the app sets (per-route\n * `export const revalidate`), falling back to `options.revalidate`. Only full-document `text/html`\n * GET 200s are cached; everything else (assets, data-mode GETs, redirects, errors) passes through.\n */"
   },
+  {
+    "name": "withRouteAssurance",
+    "kind": "function",
+    "package": "@nifrajs/core",
+    "signature": "export declare function withRouteAssurance<T extends object>(target: T, declaration: AssuranceDeclaration | readonly AssuranceDeclaration[]): T;",
+    "doc": "/** Attach enforcement evidence to the middleware/plugin that installs it. */"
+  },
   {
     "name": "Worker",
     "kind": "interface",