@nifrajs/core 1.12.0 → 2.0.0

package/dist/server/ws-hook.d.ts

@@ -1,10 +1,11 @@
 /**
- * Lazy WebSocket runtime seam. `server.ts` never imports the WS implementation statically — the
- * `@nifrajs/core/ws` subpath entry registers it here on import. That keeps the WS dispatcher, pub/sub
- * registry, Bun socket plumbing, and message-schema validation out of the base server bundle for
- * apps that never call `app.ws()` (~1.5 KB gzipped on the minimal-app benchmark).
+ * WebSocket runtime contract. `server.ts` type-imports only this; the `.use(websocket())` plugin
+ * (from `@nifrajs/core/ws`) installs the implementation on a server instance via the `INSTALL_WS`
+ * symbol seam. That keeps the WS dispatcher, pub/sub registry, Bun socket plumbing, and
+ * message-schema validation out of the base server bundle for apps that never call `app.ws()`
+ * (~1.5 KB gzipped on the minimal-app benchmark).
  *
- * Only type imports below — this module must stay weightless, it is always in the base bundle.
+ * Only type declarations below - this module must stay weightless, it is always in the base bundle.
  */
 import type { NifraWebSocket, StandardWebSocket, TopicRegistry, WebSocketHandler } from "./websocket.js";
 /** The Bun serve `websocket` callback trio, closed over one app's `TopicRegistry`. The `ws`
@@ -17,20 +18,16 @@ export interface BunWsHandlers {
 }
 /** What `@nifrajs/core/ws` registers: everything `server.ts` and `toFetchHandler` need at runtime. */
 export interface WsRuntime {
-    /** `wrapWebSocketMessageValidation` — applied once at `app.ws()` registration. */
+    /** `wrapWebSocketMessageValidation` - applied once at `app.ws()` registration. */
     wrapHandler(handler: WebSocketHandler): WebSocketHandler;
     /** One in-process pub/sub registry per app (backs `ws.subscribe` + `app.publish`). */
     createTopics(): TopicRegistry;
     /** The Bun `websocket` config for `listen()` when the app has WS routes. */
     bunHandlers(topics: TopicRegistry): BunWsHandlers;
-    /** `attachWebSocket` — wires a standard server socket (Workers `WebSocketPair`) to a handler. */
+    /** `attachWebSocket` - wires a standard server socket (Workers `WebSocketPair`) to a handler. */
     attach(socket: StandardWebSocket, handler: WebSocketHandler, data: unknown, options: {
         openNow: boolean;
         pubsub: TopicRegistry;
     }): NifraWebSocket;
 }
-/** Called by `@nifrajs/core/ws` on import. Last registration wins (idempotent in practice — there is
- * one implementation; double-import is a no-op re-set of the same functions). */
-export declare function setWsRuntime(impl: WsRuntime): void;
-export declare function getWsRuntime(): WsRuntime | undefined;
 //# sourceMappingURL=ws-hook.d.ts.map

package/dist/server/ws-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws-hook.d.ts","sourceRoot":"","sources":["../../src/server/ws-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AAEvB;;iDAEiD;AACjD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,GAAG,IAAI,CAAA;IACtE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACvD;AAED,sGAAsG;AACtG,MAAM,WAAW,SAAS;IACxB,kFAAkF;IAClF,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,gBAAgB,CAAA;IACxD,sFAAsF;IACtF,YAAY,IAAI,aAAa,CAAA;IAC7B,4EAA4E;IAC5E,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAAA;IACjD,iGAAiG;IACjG,MAAM,CACJ,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,GACnD,cAAc,CAAA;CAClB;AAID;iFACiF;AACjF,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAElD;AAED,wBAAgB,YAAY,IAAI,SAAS,GAAG,SAAS,CAEpD"}
+{"version":3,"file":"ws-hook.d.ts","sourceRoot":"","sources":["../../src/server/ws-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AAEvB;;iDAEiD;AACjD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,GAAG,IAAI,CAAA;IACtE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACvD;AAED,sGAAsG;AACtG,MAAM,WAAW,SAAS;IACxB,kFAAkF;IAClF,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,gBAAgB,CAAA;IACxD,sFAAsF;IACtF,YAAY,IAAI,aAAa,CAAA;IAC7B,4EAA4E;IAC5E,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAAA;IACjD,iGAAiG;IACjG,MAAM,CACJ,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,GACnD,cAAc,CAAA;CAClB"}

package/dist/server/ws-hook.js

@@ -1,18 +1,11 @@
 /**
- * Lazy WebSocket runtime seam. `server.ts` never imports the WS implementation statically — the
- * `@nifrajs/core/ws` subpath entry registers it here on import. That keeps the WS dispatcher, pub/sub
- * registry, Bun socket plumbing, and message-schema validation out of the base server bundle for
- * apps that never call `app.ws()` (~1.5 KB gzipped on the minimal-app benchmark).
+ * WebSocket runtime contract. `server.ts` type-imports only this; the `.use(websocket())` plugin
+ * (from `@nifrajs/core/ws`) installs the implementation on a server instance via the `INSTALL_WS`
+ * symbol seam. That keeps the WS dispatcher, pub/sub registry, Bun socket plumbing, and
+ * message-schema validation out of the base server bundle for apps that never call `app.ws()`
+ * (~1.5 KB gzipped on the minimal-app benchmark).
  *
- * Only type imports below — this module must stay weightless, it is always in the base bundle.
+ * Only type declarations below - this module must stay weightless, it is always in the base bundle.
  */
-let runtime;
-/** Called by `@nifrajs/core/ws` on import. Last registration wins (idempotent in practice — there is
- * one implementation; double-import is a no-op re-set of the same functions). */
-export function setWsRuntime(impl) {
-    runtime = impl;
-}
-export function getWsRuntime() {
-    return runtime;
-}
+export {};
 //# sourceMappingURL=ws-hook.js.map

package/dist/server/ws-hook.js.map

@@ -1 +1 @@
-{"version":3,"file":"ws-hook.js","sourceRoot":"","sources":["../../src/server/ws-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmCH,IAAI,OAA8B,CAAA;AAElC;iFACiF;AACjF,MAAM,UAAU,YAAY,CAAC,IAAe;IAC1C,OAAO,GAAG,IAAI,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"ws-hook.js","sourceRoot":"","sources":["../../src/server/ws-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/server.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Lean server entry for the common Nifra runtime.
+ *
+ * Use `@nifrajs/core/server` or the equivalent lean package root when building an HTTP app.
+ * Optional systems such as
+ * causality, invariants, manifests, reflection, and capability tooling live at
+ * their dedicated subpaths. Keeping this entry curated is intentional: do not
+ * export an opt-in module here unless the Server implementation already loads it.
+ */
+export { FrameworkError, RouteConfigError, type RouteConfigErrorCode } from "./errors.js";
+export { FRAMEWORK_NAME, type FrameworkName } from "./internal/brand.js";
+export { METHODS, type Method, Router, type RouterMatch } from "./router/router.js";
+export type { InferInput, InferOutput, StandardIssue, StandardResult, StandardSchemaV1, StandardTypes, ValidationOutcome, } from "./schema/standard.js";
+export type { Context, Params, Platform, Prettify, ResponseControls, RouteSchema, } from "./server/context.js";
+export { type CookieOptions, parseCookies, serializeCookie, signValue, unsignValue, } from "./server/cookies.js";
+export { commonSecretPatterns, jsonLogger, type LogFields, type Logger, type RedactOptions, redactLogFields, silentLogger, } from "./server/logger.js";
+export type { Registry, RouteInfo } from "./server/registry.js";
+export { type AdmissionController, type AdmissionDecision, type AnyServer, type DurableObjectNamespaceLike, defineIdentityPlugin, definePlugin, defineRouterPlugin, type ExecutionContext, type Handler, type IdentityPlugin, type McpPromptDescriptor, type McpResourceDescriptor, type Middleware, type NifraPlugin, type NodeServeOutcome, type OnRequestResult, type PromptArgument, type PromptMessage, type ResponseFinalization, type RouteDescriptor, type RunningServer, type ScheduledController, type ScheduledHandler, Server, type ServerOptions, server, type ToolAnnotations, toFetchHandler, } from "./server/server.js";
+export type { SSEContext, SSEInit, SSEMessage, SSEStream, TypedSSEStream, } from "./server/sse.js";
+export type { NifraWebSocket, StandardWebSocket, WebSocketContext, WebSocketData, WebSocketHandler, WebSocketUpgradeOutcome, } from "./server/websocket.js";
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACnF,YAAY,EACV,UAAU,EACV,WAAW,EACX,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,OAAO,EACP,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,gBAAgB,EAChB,WAAW,GACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,KAAK,aAAa,EAClB,YAAY,EACZ,eAAe,EACf,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,oBAAoB,EACpB,UAAU,EACV,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,KAAK,0BAA0B,EAC/B,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,MAAM,EACN,KAAK,aAAa,EAClB,MAAM,EACN,KAAK,eAAe,EACpB,cAAc,GACf,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,UAAU,EACV,OAAO,EACP,UAAU,EACV,SAAS,EACT,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,uBAAuB,CAAA"}

package/dist/server.js

@@ -0,0 +1,16 @@
+/**
+ * Lean server entry for the common Nifra runtime.
+ *
+ * Use `@nifrajs/core/server` or the equivalent lean package root when building an HTTP app.
+ * Optional systems such as
+ * causality, invariants, manifests, reflection, and capability tooling live at
+ * their dedicated subpaths. Keeping this entry curated is intentional: do not
+ * export an opt-in module here unless the Server implementation already loads it.
+ */
+export { FrameworkError, RouteConfigError } from "./errors.js";
+export { FRAMEWORK_NAME } from "./internal/brand.js";
+export { METHODS, Router } from "./router/router.js";
+export { parseCookies, serializeCookie, signValue, unsignValue, } from "./server/cookies.js";
+export { commonSecretPatterns, jsonLogger, redactLogFields, silentLogger, } from "./server/logger.js";
+export { defineIdentityPlugin, definePlugin, defineRouterPlugin, Server, server, toFetchHandler, } from "./server/server.js";
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAA6B,MAAM,aAAa,CAAA;AACzF,OAAO,EAAE,cAAc,EAAsB,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,OAAO,EAAe,MAAM,EAAoB,MAAM,oBAAoB,CAAA;AAkBnF,OAAO,EAEL,YAAY,EACZ,eAAe,EACf,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,oBAAoB,EACpB,UAAU,EAIV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAKL,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAiBlB,MAAM,EAEN,MAAM,EAEN,cAAc,GACf,MAAM,oBAAoB,CAAA"}

package/dist/ws.d.ts

@@ -1,19 +1,28 @@
 /**
- * WebSocket runtime for `@nifrajs/core` — import once at your server entry to enable `app.ws()`:
+ * The opt-in WebSocket runtime plugin.
  *
- *   import "@nifrajs/core/ws"
+ * `.use(websocket())` enables `app.ws()`:
  *
- *   const app = server().ws("/chat", { message: (ws, data) => ws.send(data) })
+ *   import { websocket } from "@nifrajs/core/ws"
  *
- * Why a subpath: an app that never uses WebSockets shouldn't ship the WS dispatcher, pub/sub
- * registry, and Bun socket plumbing in its server bundle (~1.5 KB gzipped on the minimal-app size
- * benchmark). Importing this module registers the runtime with the core server (idempotent);
- * calling `app.ws()` without it fails loud at boot with a `WS_RUNTIME_MISSING` error pointing here.
+ *   const app = server().use(websocket()).ws("/chat", { message: (ws, data) => ws.send(data) })
+ *
+ * Without it, `app.ws()` throws at registration (fail-closed), so an app that never uses WebSockets
+ * never evaluates or bundles the WS dispatcher, pub/sub registry, and Bun socket plumbing (~1.5 KB
+ * gzipped on the minimal-app size benchmark). The runtime installs on that server instance only -
+ * the same `.use()` install seam as `mcp()` / `streaming()` / `idempotency()`, not a process-global
+ * or a side-effect import.
  *
  * Serving adapters that wire standard sockets themselves (`@nifrajs/workers`) import
  * `attachWebSocket` / `TopicRegistry` from here too.
  */
+import type { IdentityPlugin } from "./server/plugin.js";
 import { attachWebSocket, TopicRegistry, wrapWebSocketMessageValidation } from "./server/websocket.js";
+/**
+ * Enable WebSocket routes on a server: `.use(websocket())` turns on `app.ws()`. Applying it twice is
+ * a no-op (named plugin dedupe).
+ */
+export declare function websocket(): IdentityPlugin;
 export type { NifraWebSocket, StandardWebSocket, WebSocketContext, WebSocketData, WebSocketHandler, WebSocketUpgradeOutcome, } from "./server/websocket.js";
 export { attachWebSocket, TopicRegistry, wrapWebSocketMessageValidation };
 //# sourceMappingURL=ws.d.ts.map

package/dist/ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../src/ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,eAAe,EACf,aAAa,EACb,8BAA8B,EAC/B,MAAM,uBAAuB,CAAA;AAW9B,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,8BAA8B,EAAE,CAAA"}
+{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../src/ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,EACL,eAAe,EACf,aAAa,EACb,8BAA8B,EAC/B,MAAM,uBAAuB,CAAA;AAgB9B;;;GAGG;AACH,wBAAgB,SAAS,IAAI,cAAc,CAM1C;AAED,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,8BAA8B,EAAE,CAAA"}

package/dist/ws.js

@@ -1,26 +1,41 @@
 /**
- * WebSocket runtime for `@nifrajs/core` — import once at your server entry to enable `app.ws()`:
+ * The opt-in WebSocket runtime plugin.
  *
- *   import "@nifrajs/core/ws"
+ * `.use(websocket())` enables `app.ws()`:
  *
- *   const app = server().ws("/chat", { message: (ws, data) => ws.send(data) })
+ *   import { websocket } from "@nifrajs/core/ws"
  *
- * Why a subpath: an app that never uses WebSockets shouldn't ship the WS dispatcher, pub/sub
- * registry, and Bun socket plumbing in its server bundle (~1.5 KB gzipped on the minimal-app size
- * benchmark). Importing this module registers the runtime with the core server (idempotent);
- * calling `app.ws()` without it fails loud at boot with a `WS_RUNTIME_MISSING` error pointing here.
+ *   const app = server().use(websocket()).ws("/chat", { message: (ws, data) => ws.send(data) })
+ *
+ * Without it, `app.ws()` throws at registration (fail-closed), so an app that never uses WebSockets
+ * never evaluates or bundles the WS dispatcher, pub/sub registry, and Bun socket plumbing (~1.5 KB
+ * gzipped on the minimal-app size benchmark). The runtime installs on that server instance only -
+ * the same `.use()` install seam as `mcp()` / `streaming()` / `idempotency()`, not a process-global
+ * or a side-effect import.
  *
  * Serving adapters that wire standard sockets themselves (`@nifrajs/workers`) import
  * `attachWebSocket` / `TopicRegistry` from here too.
  */
+import { INSTALL_WS } from "./server/install.js";
 import { attachWebSocket, TopicRegistry, wrapWebSocketMessageValidation, } from "./server/websocket.js";
 import { createBunWsHandlers } from "./server/ws-bun.js";
-import { setWsRuntime } from "./server/ws-hook.js";
-setWsRuntime({
+const WS_RUNTIME = {
     wrapHandler: wrapWebSocketMessageValidation,
     createTopics: () => new TopicRegistry(),
     bunHandlers: createBunWsHandlers,
     attach: attachWebSocket,
-});
+};
+/**
+ * Enable WebSocket routes on a server: `.use(websocket())` turns on `app.ws()`. Applying it twice is
+ * a no-op (named plugin dedupe).
+ */
+export function websocket() {
+    const apply = (app) => {
+        ;
+        app[INSTALL_WS](WS_RUNTIME);
+        return app;
+    };
+    return Object.assign(apply, { pluginName: "nifra:websocket" });
+}
 export { attachWebSocket, TopicRegistry, wrapWebSocketMessageValidation };
 //# sourceMappingURL=ws.js.map

package/dist/ws.js.map

@@ -1 +1 @@
-{"version":3,"file":"ws.js","sourceRoot":"","sources":["../src/ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,eAAe,EACf,aAAa,EACb,8BAA8B,GAC/B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAElD,YAAY,CAAC;IACX,WAAW,EAAE,8BAA8B;IAC3C,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,aAAa,EAAE;IACvC,WAAW,EAAE,mBAAmB;IAChC,MAAM,EAAE,eAAe;CACxB,CAAC,CAAA;AAUF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,8BAA8B,EAAE,CAAA"}
+{"version":3,"file":"ws.js","sourceRoot":"","sources":["../src/ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAGhD,OAAO,EACL,eAAe,EACf,aAAa,EACb,8BAA8B,GAC/B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAGxD,MAAM,UAAU,GAAc;IAC5B,WAAW,EAAE,8BAA8B;IAC3C,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,aAAa,EAAE;IACvC,WAAW,EAAE,mBAAmB;IAChC,MAAM,EAAE,eAAe;CACxB,CAAA;AAOD;;;GAGG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,KAAK,GAAG,CAAsB,GAAM,EAAK,EAAE;QAC/C,CAAC;QAAC,GAAgC,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,CAAA;QAC1D,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAmB,CAAA;AAClF,CAAC;AAUD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,8BAA8B,EAAE,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/core",
-  "version": "1.12.0",
+  "version": "2.0.0",
   "description": "Bun-native, contract-first HTTP framework — the router, server, and route descriptor.",
   "keywords": [
     "bun",
@@ -27,6 +27,11 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./server": {
+      "bun": "./src/server.ts",
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    },
     "./ws": {
       "bun": "./src/ws.ts",
       "types": "./dist/ws.d.ts",
@@ -62,16 +67,21 @@
       "types": "./dist/idempotency.d.ts",
       "default": "./dist/idempotency.js"
     },
-    "./invariants": {
-      "bun": "./src/invariants.ts",
-      "types": "./dist/invariants.d.ts",
-      "default": "./dist/invariants.js"
+    "./idempotency-plugin": {
+      "bun": "./src/idempotency-plugin.ts",
+      "types": "./dist/idempotency-plugin.d.ts",
+      "default": "./dist/idempotency-plugin.js"
     },
     "./ledger": {
       "bun": "./src/ledger.ts",
       "types": "./dist/ledger.d.ts",
       "default": "./dist/ledger.js"
     },
+    "./effect-ledger": {
+      "bun": "./src/effect-ledger.ts",
+      "types": "./dist/effect-ledger.d.ts",
+      "default": "./dist/effect-ledger.js"
+    },
     "./manifest": {
       "bun": "./src/manifest.ts",
       "types": "./dist/manifest.d.ts",
@@ -82,10 +92,70 @@
       "types": "./dist/mount.d.ts",
       "default": "./dist/mount.js"
     },
+    "./mcp": {
+      "bun": "./src/mcp.ts",
+      "types": "./dist/mcp.d.ts",
+      "default": "./dist/mcp.js"
+    },
+    "./node-direct": {
+      "bun": "./src/node-direct.ts",
+      "types": "./dist/node-direct.d.ts",
+      "default": "./dist/node-direct.js"
+    },
+    "./pattern": {
+      "bun": "./src/router/pattern.ts",
+      "types": "./dist/router/pattern.d.ts",
+      "default": "./dist/router/pattern.js"
+    },
     "./causality": {
       "bun": "./src/causality.ts",
       "types": "./dist/causality.d.ts",
       "default": "./dist/causality.js"
+    },
+    "./classification": {
+      "bun": "./src/classification.ts",
+      "types": "./dist/classification.d.ts",
+      "default": "./dist/classification.js"
+    },
+    "./contract": {
+      "bun": "./src/server/contract.ts",
+      "types": "./dist/server/contract.d.ts",
+      "default": "./dist/server/contract.js"
+    },
+    "./cookies": {
+      "bun": "./src/server/cookies.ts",
+      "types": "./dist/server/cookies.d.ts",
+      "default": "./dist/server/cookies.js"
+    },
+    "./logger": {
+      "bun": "./src/server/logger.ts",
+      "types": "./dist/server/logger.d.ts",
+      "default": "./dist/server/logger.js"
+    },
+    "./router": {
+      "bun": "./src/router/router.ts",
+      "types": "./dist/router/router.d.ts",
+      "default": "./dist/router/router.js"
+    },
+    "./schema": {
+      "bun": "./src/schema/standard.ts",
+      "types": "./dist/schema/standard.d.ts",
+      "default": "./dist/schema/standard.js"
+    },
+    "./seo": {
+      "bun": "./src/seo.ts",
+      "types": "./dist/seo.d.ts",
+      "default": "./dist/seo.js"
+    },
+    "./sse": {
+      "bun": "./src/server/sse.ts",
+      "types": "./dist/server/sse.d.ts",
+      "default": "./dist/server/sse.js"
+    },
+    "./webhook": {
+      "bun": "./src/server/webhook.ts",
+      "types": "./dist/server/webhook.d.ts",
+      "default": "./dist/server/webhook.js"
     }
   },
   "files": [
@@ -94,7 +164,13 @@
   ],
   "sideEffects": [
     "./src/ws.ts",
-    "./dist/ws.js"
+    "./dist/ws.js",
+    "./src/server/sse.ts",
+    "./dist/server/sse.js",
+    "./src/node-direct.ts",
+    "./dist/node-direct.js",
+    "./src/mcp-runtime.ts",
+    "./dist/mcp-runtime.js"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json && bun run ../../scripts/fix-dts.ts dist"

package/src/assurance.ts

@@ -20,7 +20,6 @@ import {
   validMethod,
   withRouteAssurance,
 } from "./internal/route-assurance.ts"
-import type { InvariantExecutor } from "./invariants.ts"
 import type { NifraManifestSigner } from "./manifest.ts"
 import { type ReflectedRoute, reflectRoutes } from "./reflection.ts"
 import type { Method } from "./router/router.ts"
@@ -28,6 +27,9 @@ import type { Method } from "./router/router.ts"
 export type { AssuranceDeclaration, AssuranceEvidence, AssuranceScope }
 export { withRouteAssurance }
 
+/** Isolated request executor used by adversarial contract verification. */
+export type InvariantExecutor = (request: Request) => Response | Promise<Response>
+
 /** Canonical evidence ids emitted by Nifra's official middleware modules. */
 export const NIFRA_ASSURANCE = NIFRA_ASSURANCE_IDS
 
@@ -57,6 +59,14 @@ export interface AssurancePolicy {
   readonly unmatched?: "error" | "ignore"
   /** Default false: reject an empty reflected source so a wrong import cannot pass CI silently. */
   readonly allowEmpty?: boolean
+  /**
+   * Default false. When true, a route matched by a **pure-classification** rule (no `require`, no `forbid`)
+   * that carries NO enforcement evidence is reported (`classified-no-evidence`). This surfaces the gap the
+   * feedback flagged: a classification-only policy silently degrades "proof" to a "label". Opt-in, because
+   * a genuinely public route legitimately carries no evidence; enable it once your guards emit evidence
+   * (inline `schema.assurance` or a `withRouteAssurance` middleware) to keep classification honest.
+   */
+  readonly flagClassifiedWithoutEvidence?: boolean
 }
 
 export type AssuranceFindingCode =
@@ -64,6 +74,7 @@ export type AssuranceFindingCode =
   | "unclassified-route"
   | "missing-evidence"
   | "forbidden-evidence"
+  | "classified-no-evidence"
 
 export interface AssuranceFinding {
   readonly code: AssuranceFindingCode
@@ -140,6 +151,12 @@ export function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy
   if (policy.allowEmpty !== undefined && typeof policy.allowEmpty !== "boolean") {
     throw new Error(`route assurance: allowEmpty must be boolean`)
   }
+  if (
+    policy.flagClassifiedWithoutEvidence !== undefined &&
+    typeof policy.flagClassifiedWithoutEvidence !== "boolean"
+  ) {
+    throw new Error(`route assurance: flagClassifiedWithoutEvidence must be boolean`)
+  }
   const names = new Set<string>()
   const rules = policy.rules.map((rule): AssuranceRule => {
     if (typeof rule.name !== "string" || !nonEmpty(rule.name)) {
@@ -187,6 +204,7 @@ export function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy
     rules: Object.freeze(rules),
     unmatched: policy.unmatched ?? "error",
     allowEmpty: policy.allowEmpty ?? false,
+    flagClassifiedWithoutEvidence: policy.flagClassifiedWithoutEvidence ?? false,
   })
 }
 
@@ -292,6 +310,23 @@ export function evaluateRouteAssurance(
         message: `${route.method} ${route.path} (${rule.name}) carries forbidden ${id}`,
       })
     }
+    // Opt-in visibility: a pure-classification rule (no require + no forbid) matching a route with zero
+    // evidence is a "label without proof". Surface it so the gap isn't silently green. A rule that expects
+    // or forbids evidence already speaks for itself via the loops above, so it's excluded here.
+    if (
+      policy.flagClassifiedWithoutEvidence === true &&
+      evidence.length === 0 &&
+      (rule.require ?? []).length === 0 &&
+      (rule.forbid ?? []).length === 0
+    ) {
+      findings.push({
+        code: "classified-no-evidence",
+        method: route.method,
+        path: route.path,
+        rule: rule.name,
+        message: `${route.method} ${route.path} (${rule.name}) is classified but carries no enforcement evidence`,
+      })
+    }
     routes.push({
       method: route.method,
       path: route.path,

package/src/effect-ledger.ts

@@ -0,0 +1,9 @@
+/**
+ * Opt-in server integration for the per-request effect ledger.
+ *
+ * Kept separate from `@nifrajs/core/server` so a bare HTTP app does not evaluate or bundle ledger
+ * machinery. Import ledger primitives from `@nifrajs/core/ledger`.
+ */
+
+export type { EffectLedgerOptions } from "./ledger.ts"
+export { effectLedger } from "./server/ledger-lane.ts"

package/src/idempotency-plugin.ts

@@ -0,0 +1,7 @@
+/**
+ * Opt-in server integration for request idempotency.
+ *
+ * Kept separate from `@nifrajs/core/server` so a bare HTTP app does not evaluate or bundle the
+ * dedupe lane. Import primitives and stores from `@nifrajs/core/idempotency`.
+ */
+export { type IdempotencyPluginOptions, idempotency } from "./server/idempotency-lane.ts"

package/src/index.ts

@@ -1,143 +1,17 @@
 /**
- * @nifrajs/core — Bun-native, contract-first HTTP framework.
+ * `@nifrajs/core` — Nifra's lean HTTP server API.
  *
- * The router is the perf-critical heart; the server and inline API are built on
- * the unified route descriptor.
+ * Nifra 2.0 keeps the package root intentionally lean. Optional systems live at documented
+ * subpaths so importing the root cannot activate unrelated runtimes.
  */
 
 /**
  * Current package version. A hardcoded literal on purpose — core runs on the edge (no fs), so it can't
  * read its own package.json at runtime. `scripts/version.ts` rewrites it on every release bump and
- * `check:publish` asserts it equals `@nifrajs/core`'s package version, so the literal can't go stale
- * (it shipped at "0.0.0" through 1.0.0 before those guards existed). Kept narrow (`as const`) so
- * consumers can pin it at the type level — see `test/version.test-d.ts`.
+ * `check:publish` asserts it equals `@nifrajs/core`'s package version.
  */
-export const VERSION = "1.12.0" as const
+export const VERSION = "2.0.0" as const
 
 export type Version = typeof VERSION
 
-export * from "./assurance.ts"
-export * from "./capabilities.ts"
-export * from "./causality.ts"
-export * from "./classification.ts"
-export * from "./diff.ts"
-export { FrameworkError, RouteConfigError, type RouteConfigErrorCode } from "./errors.ts"
-export * from "./idempotency.ts"
-export { FRAMEWORK_NAME, type FrameworkName } from "./internal/brand.ts"
-export * from "./invariants.ts"
-export * from "./ledger.ts"
-export * from "./manifest.ts"
-export * from "./mount.ts"
-export * from "./reflection.ts"
-export { METHODS, type Method, Router, type RouterMatch } from "./router/router.ts"
-export type {
-  InferInput,
-  InferOutput,
-  StandardIssue,
-  StandardResult,
-  StandardSchemaV1,
-  StandardTypes,
-  ValidationOutcome,
-} from "./schema/standard.ts"
-export { validateStandard } from "./schema/standard.ts"
-export {
-  type RobotsOptions,
-  type RobotsRule,
-  robots,
-  type SitemapChangeFreq,
-  type SitemapEntry,
-  type SitemapOptions,
-  sitemap,
-} from "./seo.ts"
-export type {
-  Context,
-  Params,
-  Platform,
-  Prettify,
-  ResponseControls,
-  RouteSchema,
-} from "./server/context.ts"
-export {
-  type ContextForOp,
-  type ContractShape,
-  defineContract,
-  type HandlersFor,
-  implement,
-  type OperationDef,
-  type RegistryFor,
-  type RegistryFromImpl,
-  type ResponseDef,
-} from "./server/contract.ts"
-export {
-  type CookieOptions,
-  parseCookies,
-  serializeCookie,
-  signValue,
-  unsignValue,
-} from "./server/cookies.ts"
-export {
-  commonSecretPatterns,
-  jsonLogger,
-  type LogFields,
-  type Logger,
-  type RedactOptions,
-  redactLogFields,
-  silentLogger,
-} from "./server/logger.ts"
-export type { Registry, RouteInfo } from "./server/registry.ts"
-export {
-  type AdmissionController,
-  type AdmissionDecision,
-  type AnyServer,
-  type DurableObjectNamespaceLike,
-  defineIdentityPlugin,
-  definePlugin,
-  defineRouterPlugin,
-  type ExecutionContext,
-  type Handler,
-  type IdentityPlugin,
-  type McpPromptDescriptor,
-  type McpResourceDescriptor,
-  type Middleware,
-  type NifraPlugin,
-  type NodeServeOutcome,
-  type OnRequestResult,
-  type PromptArgument,
-  type PromptMessage,
-  type ResponseFinalization,
-  type RouteDescriptor,
-  type RunningServer,
-  type ScheduledController,
-  type ScheduledHandler,
-  Server,
-  type ServerOptions,
-  server,
-  type ToolAnnotations,
-  toFetchHandler,
-} from "./server/server.ts"
-export {
-  type SSEContext,
-  type SSEInit,
-  type SSEMessage,
-  type SSEStream,
-  sse,
-  type TypedSSEStream,
-  typedSSEStream,
-} from "./server/sse.ts"
-export {
-  type SignatureEncoding,
-  type VerifyWebhookOptions,
-  verifyWebhook,
-  type WebhookFailureReason,
-  type WebhookProvider,
-  type WebhookResult,
-} from "./server/webhook.ts"
-export type {
-  NifraWebSocket,
-  StandardWebSocket,
-  WebSocketContext,
-  WebSocketData,
-  WebSocketHandler,
-  WebSocketUpgradeOutcome,
-} from "./server/websocket.ts"
-export { attachWebSocket, TopicRegistry } from "./server/websocket.ts"
+export * from "./server.ts"