The AI-Native TypeScript Framework.

import { client } from "@nifrajs/client"
import type { app } from "./server"   // a type import - server code never ships to the client

const api = client<typeof app>("https://api.example.com")

// The path autocompletes. Params and body are typed. No codegen, ever.
const res = await api.users({ id: "42" }).get()

if (res.ok) {
  res.data.id        // typed from the route return or response schema
} else {
  res.error          // client-call failures are returned, never thrown
}

import { app } from "./app"   // one app, defined once

// Bun
export default { port: 3000, fetch: app.fetch }

// Node            import { serve } from "@nifrajs/node"   → serve(app, { port: 3000 })
// Deno            import { serve } from "@nifrajs/deno"   → serve(app, { port: 3000 })

// Cloudflare Workers / Pages · Vercel edge
import { toFetchHandler } from "@nifrajs/core/server"
export default toFetchHandler(app)

// nifra.assurance.ts - security posture as policy, not convention
import { defineAssuranceConfig, NIFRA_ASSURANCE } from "@nifrajs/core/assurance"
import { app } from "./src/app"

export default defineAssuranceConfig({
  source: app,
  capabilities: {
    definitions: [{ id: "db.write", zone: "domain", access: "write" }],
    provenance: {
      // Keep the example complete: assurance classification needs both a capability definition
      // and static provenance coverage for the effect it is meant to protect.
      imports: [{ specifier: "./db/write.ts", capabilities: ["db.write"] }],
      forbiddenImports: [],
    },
  },
  policy: {
    rules: [
      {
        // Every domain write must prove authentication - no exceptions, no drift.
        name: "authenticated-write",
        match: { access: "write", zone: "domain" },
        require: [NIFRA_ASSURANCE.AUTHENTICATED],
      },
    ],
  },
})

// $ nifra assure
// ✖ POST /notes (authenticated-write) is missing nifra.authenticated