@nifrajs/cli 2.1.0 → 2.3.0

package/dist/check.js

@@ -1,14 +1,14 @@
 /**
- * `nifra check` — the agent's (and CI's) definition of done. It makes the guarantees that keep a nifra
+ * `nifra check` - the agent's (and CI's) definition of done. It makes the guarantees that keep a nifra
  * app drift-proof actually *fire*, instead of relying on the agent to remember them:
  *
- *   1. **typecheck** (`tsc --noEmit`) — the frontend↔backend contract is compiler-enforced. The typed
+ *   1. **typecheck** (`tsc --noEmit`) - the frontend↔backend contract is compiler-enforced. The typed
  *      client derives request + response types from the routes, so a shape mismatch is a type error.
- *   2. **typed-client lint** — flags hand-rolled `fetch()` to this app's *own* API (a relative URL),
+ *   2. **typed-client lint** - flags hand-rolled `fetch()` to this app's *own* API (a relative URL),
  *      which bypasses `client<typeof app>` so the compiler can't see the drift.
- *   3. **server-only-import lint** — flags a top-level import of server-only code (a DB driver, `node:`/
+ *   3. **server-only-import lint** - flags a top-level import of server-only code (a DB driver, `node:`/
  *      `bun:` builtins, the `./db` module) into a `routes/` page module. Those modules are bundled for
- *      the browser too, so the import ships server code to the client and breaks the build — the #1
+ *      the browser too, so the import ships server code to the client and breaks the build - the #1
  *      full-stack footgun. Reach server resources via `c.db` / `ctx.api`, never a top-level import.
  *
  * `collectCheckResult` returns a structured, machine-readable result (consumed by `--json` and the
@@ -18,10 +18,11 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { Glob } from "bun";
-// `fetch( <ws> ('|"|`) / (not /)` — a string/template arg starting with a single `/` is a relative URL,
+import { importTypeScript } from "./internal/typescript-import.js";
+// `fetch( <ws> ('|"|`) / (not /)` - a string/template arg starting with a single `/` is a relative URL,
 // i.e. same-origin = this app's own API. `(?<![.\w])` skips `.fetch(` (a method) and `prefetch(`; the
 // `(?!\/)` skips protocol-relative `//host` (an external origin). A variable arg (`fetch(url)`) is left
-// alone on purpose — undecidable from source, and flagging it would punish legitimate external calls.
+// alone on purpose - undecidable from source, and flagging it would punish legitimate external calls.
 const GLOBAL_FETCH_CALL = /(?<![.\w])fetch\s*\(/g;
 const FETCH_CALL = /(?<![.\w])fetch\s*\(/g;
 const HTTP_VERBS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
@@ -29,7 +30,7 @@ const SIMPLE_REWRITE_METHODS = new Set(["GET", "DELETE", "HEAD", "OPTIONS"]);
 // Don't scan deps, build output, generated client entries, or tests (which legitimately drive `fetch`).
 // `dist(-<runtime>)?` also covers per-runtime output dirs (dist-bun/dist-node/dist-deno/dist-vercel).
 const IGNORED = /(^|\/)(node_modules|dist(-[a-z0-9]+)?|build|\.nifra|\.git|\.wrangler|coverage)\/|\.(test|spec)\.[cm]?[jt]sx?$/;
-// A file under `routes/` — a page module bundled for the browser, where a server-only import is unsafe.
+// A file under `routes/` - a page module bundled for the browser, where a server-only import is unsafe.
 const ROUTE_FILE = /(^|\/)routes\//;
 // Module specifiers that must never be VALUE-imported into a route module: node:/bun: builtins, common
 // DB drivers/ORМ server entrypoints, and the conventional `./db` module the scaffold generates.
@@ -192,13 +193,13 @@ function scanRoutePattern(file, content, code, pattern) {
     return out;
 }
 /**
- * Blank, with spaces (newlines preserved, so every byte offset — and line number — is unchanged):
+ * Blank, with spaces (newlines preserved, so every byte offset - and line number - is unchanged):
  *   - `//` line comments and block comments;
- *   - the CONTENTS of backtick template literals — code-as-text (doc `CodeBlock` examples, code
+ *   - the CONTENTS of backtick template literals - code-as-text (doc `CodeBlock` examples, code
  *     generators), never a real statement to lint.
  * Single/double-quoted strings are KEPT (a real import/Response specifier lives in one). A small
  * char-state machine, not a full lexer: it doesn't model regex literals, so a regex containing a quote
- * could mis-skip — in practice the constructs these scanners look for sit before any such regex.
+ * could mis-skip - in practice the constructs these scanners look for sit before any such regex.
  * Shared by the source scanners here and by `nifra doctor` ({@link ./doctor.ts}).
  */
 export function stripComments(src) {
@@ -442,10 +443,177 @@ export function scanStaticRouteText(file, content) {
         ...scanRoutePattern(file, content, code, ROUTE_REGISTRATION_SQ),
     ].sort(bySite);
 }
-// `client("` / `client('` / `client(\`` — a URL-first call WITHOUT the `<typeof app>` generic:
+/**
+ * SQL built by interpolating a value into the statement text. The value is not a parameter, it is
+ * STATEMENT, so anything the caller controls can end the literal and continue as SQL.
+ *
+ * Two things this deliberately does not flag, because both are safe and flagging them would train
+ * people to ignore the rule:
+ *
+ * - A TAGGED template - ``sql`... ${id} ...` `` in postgres.js, drizzle or kysely. The tag receives the
+ *   substitutions separately and binds them; that is the parameterised form, not a bypass of it.
+ * - A literal with no substitution at all. `db.query("SELECT … WHERE id = ?")` is the shape being
+ *   argued for.
+ *
+ * A SQL keyword is required in the literal, so `cache.query(`user:${id}`)` stays quiet. The named
+ * escape hatches (`$queryRawUnsafe`, `sql.unsafe`) are flagged on the call alone: their whole purpose
+ * is to take a statement as text, and a substitution in one is the exact thing the name warns about.
+ */
+const SQL_METHODS = new Set([
+    "query",
+    "queryRaw",
+    "prepare",
+    "exec",
+    "execute",
+    "run",
+    "unsafe",
+    "$queryRawUnsafe",
+    "$executeRawUnsafe",
+    "raw",
+]);
+const SQL_KEYWORD = /\b(select|insert\s+into|update|delete\s+from|drop\s+table|create\s+table|alter\s+table|truncate|from|where|values|set|join|union)\b/i;
+const ALWAYS_UNSAFE = new Set(["unsafe", "$queryRawUnsafe", "$executeRawUnsafe", "raw"]);
+/** Describe only the first argument's syntax; comments/strings elsewhere cannot influence the result. */
+function sqlExpressionShape(ts, node) {
+    if (ts.isParenthesizedExpression(node))
+        return sqlExpressionShape(ts, node.expression);
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
+        return {
+            staticText: node.text,
+            dynamic: false,
+            concatenated: false,
+            literal: true,
+            parameterizedTag: false,
+        };
+    }
+    if (ts.isTaggedTemplateExpression(node)) {
+        const tag = node.tag;
+        const parameterizedTag = (ts.isIdentifier(tag) && tag.text === "sql") ||
+            (ts.isPropertyAccessExpression(tag) && tag.getText() === "Prisma.sql");
+        const template = node.template;
+        const staticText = ts.isTemplateExpression(template)
+            ? [template.head.text, ...template.templateSpans.map((span) => span.literal.text)].join("")
+            : template.text;
+        // Only the ecosystem's binding tags are trusted, by NAME - which is the honest limit of a scanner
+        // that reads syntax and runs no type checker. `sql` is what postgres.js, drizzle, slonik and Bun's
+        // own driver all call theirs, and `Prisma.sql` is Prisma's; taking those at their word is a
+        // deliberate trade, and it is worth stating what it costs: a no-op function named `sql` in the
+        // same file is trusted too, so this rule finds mistakes, not an adversary who reads it first.
+        //
+        // Trusting anything else widens that for no gain. This list briefly also held `sqlIdentifiers`,
+        // a name invented for Nifra's own adapters - a second forgeable name that no user has a
+        // convention for, added so Nifra's source would pass its own rule. Names earn their place here by
+        // being what drivers already call the thing, not by being convenient for the framework.
+        //
+        // Everything else - `String.raw`, an identity tag, a member access that merely ends in `.sql` -
+        // is treated as plain interpolation.
+        return {
+            staticText,
+            dynamic: ts.isTemplateExpression(template) && !parameterizedTag,
+            concatenated: false,
+            literal: !ts.isTemplateExpression(template),
+            parameterizedTag,
+        };
+    }
+    if (ts.isTemplateExpression(node)) {
+        return {
+            staticText: [node.head.text, ...node.templateSpans.map((span) => span.literal.text)].join(""),
+            dynamic: true,
+            concatenated: false,
+            literal: false,
+            parameterizedTag: false,
+        };
+    }
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+        const left = sqlExpressionShape(ts, node.left);
+        const right = sqlExpressionShape(ts, node.right);
+        return {
+            staticText: left.staticText + right.staticText,
+            dynamic: left.dynamic || right.dynamic || !left.literal || !right.literal,
+            concatenated: true,
+            literal: left.literal && right.literal,
+            parameterizedTag: false,
+        };
+    }
+    return {
+        staticText: "",
+        dynamic: true,
+        concatenated: false,
+        literal: false,
+        parameterizedTag: false,
+    };
+}
+function sqlMethod(ts, call) {
+    if (ts.isPropertyAccessExpression(call.expression)) {
+        const method = call.expression.name.text;
+        return SQL_METHODS.has(method)
+            ? { method, receiver: call.expression.expression.getText() }
+            : undefined;
+    }
+    if (ts.isElementAccessExpression(call.expression) &&
+        call.expression.argumentExpression !== undefined &&
+        ts.isStringLiteral(call.expression.argumentExpression)) {
+        const method = call.expression.argumentExpression.text;
+        return SQL_METHODS.has(method)
+            ? { method, receiver: call.expression.expression.getText() }
+            : undefined;
+    }
+    return undefined;
+}
+const SQL_RECEIVER = /(?:^|\.)(?:db|sql|prisma|drizzle|database|conn|connection|client|tx)$/i;
+/** Scan one file's text for SQL assembled by interpolation. Pure + line-accurate. */
+export function scanInterpolatedSql(file, content, ts) {
+    const out = [];
+    const lines = content.split("\n");
+    const kind = /\.[cm]?tsx?$/.test(file) ? ts.ScriptKind.TSX : ts.ScriptKind.JS;
+    const source = ts.createSourceFile(file, content, ts.ScriptTarget.Latest, true, kind);
+    // Malformed source is already a typecheck failure. Do not turn parser recovery nodes into a second,
+    // misleading SQL diagnostic (notably an unterminated template recovered as an interpolation).
+    const parseDiagnostics = source.parseDiagnostics;
+    if (parseDiagnostics !== undefined && parseDiagnostics.length > 0)
+        return out;
+    const visit = (node) => {
+        if (ts.isCallExpression(node)) {
+            const sink = sqlMethod(ts, node);
+            const argument = node.arguments[0];
+            if (sink !== undefined && argument !== undefined) {
+                const shape = sqlExpressionShape(ts, argument);
+                const unsafeEscape = ALWAYS_UNSAFE.has(sink.method) && !shape.literal && !shape.parameterizedTag;
+                const assembledSql = shape.dynamic &&
+                    (SQL_KEYWORD.test(shape.staticText) ||
+                        (shape.concatenated && SQL_RECEIVER.test(sink.receiver)));
+                if (unsafeEscape || assembledSql) {
+                    const index = node.getStart(source);
+                    const line = source.getLineAndCharacterOfPosition(index).line + 1;
+                    out.push({ file, line, snippet: (lines[line - 1] ?? "").trim() });
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return out;
+}
+/**
+ * Collect interpolated-SQL findings across the project.
+ *
+ * Returns `undefined` - not an empty array - when TypeScript is not installed. The rule parses source
+ * with the compiler, so without it there is nothing to report and, more to the point, no basis for
+ * reporting nothing. An empty result would read as "no interpolated SQL found", which is the one
+ * answer a security rule must never give when it did not run.
+ */
+export async function scanProjectSql(cwd) {
+    const ts = await importTypeScript();
+    if (ts === undefined)
+        return undefined;
+    const out = [];
+    await walkSource(cwd, (rel, content) => out.push(...scanInterpolatedSql(rel, content, ts)));
+    return out.sort(bySite);
+}
+// `client("` / `client('` / `client(\`` - a URL-first call WITHOUT the `<typeof app>` generic:
 // the compiler has nothing to derive types from, so the anti-drift guarantee silently vanishes.
 // `client<typeof app>("…")` has `<…>` between the name and `(` so it never matches; the published-
-// contract form `client(contract, url)` starts with an identifier, not a quote — also unmatched.
+// contract form `client(contract, url)` starts with an identifier, not a quote - also unmatched.
 const CLIENT_CALL = /(?<![.\w])client\s*\(/g;
 /** Scan one file's text for untyped `client("…")` calls. Pure + line-accurate. */
 export function scanUntypedClient(file, content) {
@@ -463,6 +631,55 @@ export function scanUntypedClient(file, content) {
     }
     return out;
 }
+/**
+ * Specifiers that no longer exist, and what replaced them.
+ *
+ * These are the breaks a typecheck does not catch and a test suite does not either. `@nifrajs/core/ws`
+ * was a side-effect import removed in 2.0 in favour of `.use(websocket())`; a consuming package kept
+ * the import and a 533-test suite stayed green while the app could not boot. `@nifrajs/budget` folded
+ * into core with no npm deprecation, so `bun install` fails workspace-wide with a resolution error
+ * that names neither the cause nor the replacement.
+ *
+ * A lint is the right shape for this: it runs before boot, names the file and line, and states the
+ * replacement - which is what neither the resolver error nor the runtime failure does.
+ */
+const REMOVED_IMPORTS = [
+    {
+        specifier: "@nifrajs/budget",
+        since: "2.0",
+        replacement: 'import from "@nifrajs/core/budget" - the package folded into core and npm `latest` is still 1.13.0, so a `^2` range resolves to nothing',
+    },
+    {
+        specifier: "@nifrajs/core/ws",
+        since: "2.0",
+        sideEffectOnly: true,
+        replacement: 'a bare `import "@nifrajs/core/ws"` no longer installs the runtime - register it explicitly with `.use(websocket())`, importing `websocket` from the same module',
+    },
+];
+/** Whether the import statement at `index` is the bare side-effect form (`import "x"`), rather than
+ * one with bindings (`import { y } from "x"`). */
+function isSideEffectImport(content, index) {
+    // `staticImportEdges` reports the index of the STATEMENT, not of the specifier, so read forward:
+    // a side-effect import is `import` followed directly by the quoted specifier, with no bindings and
+    // no `from` in between.
+    return /^import\s*["'`]/.test(content.slice(index, index + 32));
+}
+/** Flag an import of a specifier that no longer exists. Pure; matches the exact specifier or a subpath
+ * of it, so `@nifrajs/budget/x` is caught alongside `@nifrajs/budget`. */
+export function scanRemovedImports(file, content) {
+    const out = [];
+    const lines = content.split("\n");
+    for (const edge of staticImportEdges(content)) {
+        const removed = REMOVED_IMPORTS.find((entry) => edge.specifier === entry.specifier || edge.specifier.startsWith(`${entry.specifier}/`));
+        if (removed === undefined)
+            continue;
+        if (removed.sideEffectOnly === true && !isSideEffectImport(content, edge.index))
+            continue;
+        const line = lineAt(content, edge.index);
+        out.push({ file, line, snippet: (lines[line - 1] ?? "").trim() });
+    }
+    return out;
+}
 /** Scan a route module for top-level server-only imports. Returns `[]` for non-route files (only
  * `routes/` modules are browser-bundled, so a server-only import elsewhere is fine). Each finding carries
  * the offending `specifier` so the diagnostic can render the `routeFile → specifier` chain. Pure. */
@@ -486,7 +703,7 @@ export function scanServerOnlyImports(file, content) {
     return out;
 }
 // ---------------------------------------------------------------------------------------------------
-// #4.4 — TRANSITIVE import-chain resolution for `server-only-import`. `scanServerOnlyImports` above is a
+// #4.4 - TRANSITIVE import-chain resolution for `server-only-import`. `scanServerOnlyImports` above is a
 // pure per-file regex scan: it sees only the route's DIRECT `import` line, so it reports the direct edge
 // `routes/x → ../db`. The build leak-guard, which has the real module graph, reports the full transitive
 // `route → ../data → ../db → pg`. These helpers give `nifra check` the same depth via a BOUNDED
@@ -494,24 +711,24 @@ export function scanServerOnlyImports(file, content) {
 // local module graph, and build the shortest chain to a server-only SINK. It's best-effort: an import
 // that can't be precisely resolved (a bare pkg, a tsconfig path alias) falls back to the direct edge.
 // ---------------------------------------------------------------------------------------------------
-// Server-only specifiers that are TERMINAL sinks — a bare `node:`/`bun:` builtin or a known server-only
+// Server-only specifiers that are TERMINAL sinks - a bare `node:`/`bun:` builtin or a known server-only
 // npm package. These are never local source we can walk into, so the chain ends here. (Same vocabulary
-// as SERVER_ONLY, minus the relative `../db` arm — a relative `db` module IS local source we resolve.)
+// as SERVER_ONLY, minus the relative `../db` arm - a relative `db` module IS local source we resolve.)
 const SERVER_ONLY_SINK = /^(?:node:|bun:)|^(?:postgres|pg|mysql2|ioredis|redis|better-sqlite3|mongodb|@libsql\/client)$|^drizzle-orm\/(?:node-postgres|postgres-js|bun-sqlite|libsql|mysql2|pglite)\b/;
 // The `.server` convention: a module named `*.server.ts(x)` is server-only (the client build empties it).
 const SERVER_MODULE_FILE = /\.server(\.[cm]?[jt]sx?)?$/;
-// The explicit poison-import marker (`@nifrajs/web/server-only`) — a module opting into the client-leak
+// The explicit poison-import marker (`@nifrajs/web/server-only`) - a module opting into the client-leak
 // guard. A resolved file whose source carries this side-effect import is a server-only sink.
 const SERVER_ONLY_MARKER_IMPORT = /import\s+["']@nifrajs\/web\/server-only["']/;
 // Depth/visited caps keep the walk linear + cycle-safe. A route's server-only dependency sits within a
 // few hops in practice; the bound stops a pathological graph from blowing up the per-file scan.
 const TRANSITIVE_MAX_DEPTH = 8;
 const TRANSITIVE_MAX_VISITED = 200;
-/** A relative module specifier (`./x`, `../y`) — the only kind we resolve + walk into (a bare specifier
+/** A relative module specifier (`./x`, `../y`) - the only kind we resolve + walk into (a bare specifier
  * is either a sink we recognise by name or a third-party dep we don't follow into node_modules). */
 const isRelativeSpecifier = (spec) => spec.startsWith("./") || spec.startsWith("../");
-// A FRESH copy of the static-import regex per scan. The transitive walk is REENTRANT — the outer
-// per-route loop and the inner BFS both scan imports — and a single shared global-flag regex carries
+// A FRESH copy of the static-import regex per scan. The transitive walk is REENTRANT - the outer
+// per-route loop and the inner BFS both scan imports - and a single shared global-flag regex carries
 // `lastIndex` state, so reusing the module-level `STATIC_IMPORT` across nested calls corrupts the outer
 // loop's position (it restarts forever). A fresh instance per call keeps each scan's state private.
 const staticImportRegex = () => new RegExp(STATIC_IMPORT.source, STATIC_IMPORT.flags);
@@ -538,7 +755,7 @@ export function parseStaticImports(content) {
     return staticImportEdges(content).map((e) => e.specifier);
 }
 /** The server-only SINK an import specifier names directly (a `node:`/`bun:` builtin or a known
- * server-only package), or `undefined` if it isn't a by-name sink. Pure — the label is the specifier
+ * server-only package), or `undefined` if it isn't a by-name sink. Pure - the label is the specifier
  * itself (it's already the actionable name). */
 export function directSinkSpecifier(spec) {
     return SERVER_ONLY_SINK.test(spec) ? spec : undefined;
@@ -551,7 +768,7 @@ export function directSinkSpecifier(spec) {
  * unresolvable alias). At each node, a by-name sink import (`node:fs`, `postgres`) OR a resolved
  * `*.server` / `server-only`-marked dependency terminates the chain. Bounded by depth + a visited set, so
  * it's linear and cycle-free. `routeFile`/`routeContent` seed the walk; `resolve`/`read` supply the graph
- * — pure given those, so it's unit-testable with a fake graph.
+ * - pure given those, so it's unit-testable with a fake graph.
  */
 export function walkServerOnlyChain(routeFile, routeContent, resolve, read) {
     const seen = new Set([routeFile]);
@@ -569,13 +786,13 @@ export function walkServerOnlyChain(routeFile, routeContent, resolve, read) {
                 if (sink !== undefined)
                     return [...node.chain, sink];
                 // (b) Only relative specifiers are local source we resolve + walk into. A bare third-party
-                // specifier that isn't a known sink is a leaf — don't follow it into node_modules.
+                // specifier that isn't a known sink is a leaf - don't follow it into node_modules.
                 if (!isRelativeSpecifier(spec))
                     continue;
                 const abs = resolve(node.abs, spec);
                 if (abs === undefined || seen.has(abs))
                     continue;
-                // (c) A resolved `*.server` module is a server-only sink by the `.server` convention — the chain
+                // (c) A resolved `*.server` module is a server-only sink by the `.server` convention - the chain
                 // ends at it (named by the as-written specifier).
                 if (SERVER_MODULE_FILE.test(abs))
                     return [...node.chain, spec];
@@ -599,8 +816,8 @@ export function walkServerOnlyChain(routeFile, routeContent, resolve, read) {
 /**
  * Resolve the FULL transitive server-only chain(s) for a route module, given a real fs-backed resolver +
  * reader. For each of the route's top-level imports, if a precise transitive walk finds a sink, the
- * finding carries the full chain; otherwise — when the first hop is itself a direct by-name sink the
- * regex scan already flags, or when a relative import can't be resolved — it falls back to the DIRECT
+ * finding carries the full chain; otherwise - when the first hop is itself a direct by-name sink the
+ * regex scan already flags, or when a relative import can't be resolved - it falls back to the DIRECT
  * edge (`fallback: true`), never a fabricated chain. Returns one finding per offending top-level import,
  * de-duplicated to the shortest chain per first-hop specifier. Non-route files yield `[]`.
  */
@@ -618,21 +835,21 @@ export function resolveServerOnlyChains(file, content, resolve, read) {
             continue;
         const line = lineAt(content, index);
         const snippet = (lines[line - 1] ?? "").trim();
-        // (1) A direct by-name sink (`node:fs`, `postgres`) — the route imports it itself; chain is the
+        // (1) A direct by-name sink (`node:fs`, `postgres`) - the route imports it itself; chain is the
         // direct edge. (Length-2 chain == the regex scan's existing `[route, specifier]`.)
         if (directSinkSpecifier(specifier) !== undefined) {
             flaggedSpecifiers.add(specifier);
             out.push({ file, line, snippet, specifier, chain: [file, specifier], fallback: false });
             continue;
         }
-        // (2) A relative local import — try the transitive walk from the resolved dependency. If it reaches
+        // (2) A relative local import - try the transitive walk from the resolved dependency. If it reaches
         // a sink, emit the full chain rooted at THIS route's import line.
         if (isRelativeSpecifier(specifier)) {
             const abs = resolve(file, specifier);
             if (abs === undefined) {
                 // Unresolvable relative import. If it's the known server-only `../db` convention the regex scan
-                // flags directly, fall back to the direct edge (precise resolve impossible — say so via
-                // `fallback`). Any other unresolvable relative import we can't assert is server-only — skip it.
+                // flags directly, fall back to the direct edge (precise resolve impossible - say so via
+                // `fallback`). Any other unresolvable relative import we can't assert is server-only - skip it.
                 if (SERVER_ONLY.test(specifier)) {
                     flaggedSpecifiers.add(specifier);
                     out.push({ file, line, snippet, specifier, chain: [file, specifier], fallback: true });
@@ -664,7 +881,7 @@ export function resolveServerOnlyChains(file, content, resolve, read) {
                 continue;
             }
             // (3) The relative `../db`-style convention the regex scan flags directly, but where the walk
-            // found no deeper sink (e.g. the file wasn't readable past the first hop) — fall back to the
+            // found no deeper sink (e.g. the file wasn't readable past the first hop) - fall back to the
             // direct edge so we still surface the known-server-only convention rather than going silent.
             if (SERVER_ONLY.test(specifier)) {
                 flaggedSpecifiers.add(specifier);
@@ -675,7 +892,7 @@ export function resolveServerOnlyChains(file, content, resolve, read) {
     return out;
 }
 // A route handler returning a raw `Response` (`=> new Response(`, `return Response.json(`, …) makes the
-// typed client infer `data: never` (`Jsonify<Response>` is `never`) — so frontend/backend drift detection
+// typed client infer `data: never` (`Jsonify<Response>` is `never`) - so frontend/backend drift detection
 // silently vanishes for that route. Advisory, not a failure: a raw Response is sometimes intended
 // (redirects, files, streams). Fix is to return a plain object, or declare `{ response: t.… }` to type it.
 const RESPONSE_RETURN = /(?:=>\s*|return\s+)(?:new\s+Response|Response\s*\.\s*json)\s*\(/g;
@@ -711,12 +928,12 @@ const RAW_RESPONSE_PRAGMA = "nifra-expect raw-response";
 /** Walk the project's `.ts`/`.tsx` source (skipping deps/build/tests), calling `visit` per file.
  * Exported so `nifra doctor` ({@link ./doctor.ts}) scans the same source surface as `nifra check`. */
 /**
- * Paths git considers ignored under `cwd`, in ONE batched `git check-ignore` call — so `.gitignore`
+ * Paths git considers ignored under `cwd`, in ONE batched `git check-ignore` call - so `.gitignore`
  * (root + nested + the global excludesfile) is honoured, not just the built-in {@link IGNORED} list. This
  * is what keeps the scan out of generated/build trees that live under a repo but aren't source: a monorepo
- * that gitignores, say, `builder/projects/` (238 generated apps) would otherwise be walked in full — 40k+
+ * that gitignores, say, `builder/projects/` (238 generated apps) would otherwise be walked in full - 40k+
  * findings, a 50 MB+ result that overwhelms the caller. Returns an EMPTY set when there's no git / not a
- * repo / git errors, so the scan simply degrades to the {@link IGNORED} regex — never throws, never blocks.
+ * repo / git errors, so the scan simply degrades to the {@link IGNORED} regex - never throws, never blocks.
  */
 async function gitIgnored(cwd, rels) {
     if (rels.length === 0)
@@ -743,7 +960,7 @@ async function gitIgnored(cwd, rels) {
     }
 }
 export async function walkSource(cwd, visit) {
-    // List candidates first (cheap — no reads), drop the built-in ignores, then exclude gitignored paths in
+    // List candidates first (cheap - no reads), drop the built-in ignores, then exclude gitignored paths in
     // one batch before the (expensive) reads. So a gitignored generated/build tree is never read or scanned.
     const rels = [];
     for await (const rel of new Glob("**/*.{ts,tsx,mts,cts}").scan({ cwd, dot: false })) {
@@ -764,14 +981,14 @@ export async function scanProject(cwd) {
     await walkSource(cwd, (rel, content) => out.push(...scanFetchText(rel, content)));
     return out.sort(bySite);
 }
-// #7 — server-manifest drift. `server-manifest.ts` is a COMMITTED generated file (it bakes the route
+// #7 - server-manifest drift. `server-manifest.ts` is a COMMITTED generated file (it bakes the route
 // list + client-entry hash for a disk-less worker). If `routes/` changes but the manifest isn't
-// regenerated, the worker serves a stale route table — a silent edge break that no other check catches.
+// regenerated, the worker serves a stale route table - a silent edge break that no other check catches.
 // We diff each committed manifest's imported route files against the live `routes/` tree.
-// The marker comment `generateServerManifest` emits at the top of the file — identifies a generated
+// The marker comment `generateServerManifest` emits at the top of the file - identifies a generated
 // manifest unambiguously (so a user file merely named `server-manifest.ts` isn't mistaken for one).
 const GENERATED_MARKER = "GENERATED by @nifrajs/web generateServerManifest";
-// The first route-import specifier's prefix up to `routes/` (e.g. `./`, `../`, `./src/`) — used to
+// The first route-import specifier's prefix up to `routes/` (e.g. `./`, `../`, `./src/`) - used to
 // locate the routes dir relative to the manifest, and to strip to route-relative keys.
 const ROUTES_PREFIX = /["'](\.{1,2}(?:\/[^"'/]+)*?\/routes\/)[^"']+["']/;
 // Route file extensions discovery recognises (mirrors `@nifrajs/web/fs`'s filter).
@@ -792,13 +1009,13 @@ export async function scanServerManifestDrift(cwd) {
             continue;
         const source = await Bun.file(join(cwd, rel)).text();
         if (!source.includes(GENERATED_MARKER))
-            continue; // not a generated manifest — skip
+            continue; // not a generated manifest - skip
         const prefixMatch = ROUTES_PREFIX.exec(source);
         if (prefixMatch?.[1] === undefined)
             continue; // no `routes/` imports → nothing to diff (empty app)
         const routesPrefix = prefixMatch[1];
         const manifestFiles = parseManifestRouteFiles(source, routesPrefix);
-        // The routes dir sits at `<manifest dir>/<prefix>` — resolve it relative to the manifest file.
+        // The routes dir sits at `<manifest dir>/<prefix>` - resolve it relative to the manifest file.
         const manifestDir = rel.includes("/") ? rel.slice(0, rel.lastIndexOf("/")) : "";
         const routesDir = join(cwd, manifestDir, routesPrefix);
         let discovered;
@@ -808,7 +1025,7 @@ export async function scanServerManifestDrift(cwd) {
                 .filter((f) => ROUTE_FILE_EXT.test(f));
         }
         catch {
-            continue; // routes dir gone/unreadable — not a drift we can assess
+            continue; // routes dir gone/unreadable - not a drift we can assess
         }
         const drift = diffManifestRoutes(manifestFiles, discovered);
         if (!isManifestInSync(drift)) {
@@ -886,14 +1103,17 @@ async function loadCheckConfig(cwd) {
         };
     }
 }
-const UNTYPED_CLIENT_HINT = 'client("…") without a type argument — write client<typeof app>("…") (or client(contract, url)) so the compiler can catch drift';
-const FETCH_HINT = "hand-rolled fetch() to your own API — call it through client<typeof app> (from @nifrajs/client) so the compiler catches drift";
-const SERVER_IMPORT_HINT = "server-only import in a route module (bundled for the browser) — reach it via c.db / ctx.api inside a loader, never a top-level import";
+const UNTYPED_CLIENT_HINT = 'client("…") without a type argument - write client<typeof app>("…") (or client(contract, url)) so the compiler can catch drift';
+const FETCH_HINT = "hand-rolled fetch() to your own API - call it through client<typeof app> (from @nifrajs/client) so the compiler catches drift";
+const SERVER_IMPORT_HINT = "server-only import in a route module (bundled for the browser) - reach it via c.db / ctx.api inside a loader, never a top-level import";
 const RESPONSE_ROUTE_HINT = "route handler returns a raw Response - the typed client infers `data: never`, so drift detection is lost for this route. Return a plain object (it's serialized for you); for a stream use a typed SSE route (`app.sse(...)`), which keeps typed events; or, if a raw Response is intended (file/redirect), add `{ response: t.… }` or a `// nifra-expect raw-response` comment to mark it and silence this";
-const UNDECLARED_DEP_HINT = "imported package is not declared in package.json dependencies — run bun add to declare it";
-const MANIFEST_DRIFT_HINT = "server-manifest.ts is out of sync with routes/ — re-run the build to regenerate it (a disk-less worker bakes this route table, so the drift is a silent edge break), then commit it";
-const TRUST_MANIFEST_DRIFT_HINT = "nifra.manifest.json is missing, invalid, or out of sync — run `nifra manifest emit`, review it, and commit the regenerated trust artifact";
-const CAPABILITY_HINT = "effect/capability assurance failed — align the route declaration with approved adapter provenance; never bypass an owned effect seam";
+const UNDECLARED_DEP_HINT = "imported package is not declared in package.json dependencies - run bun add to declare it";
+const SQL_COMPILER_MISSING_HINT = "the interpolated-SQL rule did NOT run - it parses source with the TypeScript compiler, which is an optional peer and is not installed here. This report says nothing about SQL injection either way. Install it with `bun add -d typescript`";
+const SQL_INTERPOLATION_EXAMPLE = "$" + "{value}";
+const INTERPOLATED_SQL_HINT = `SQL built by interpolating a value into the statement text - the value becomes statement, not a parameter, so anything the caller controls can end the literal and continue as SQL. Pass it as a bound parameter (\`?\` / \`$1\` and an argument), or use your driver's tagged template (sql\`… ${SQL_INTERPOLATION_EXAMPLE} …\`), which binds the substitutions for you`;
+const MANIFEST_DRIFT_HINT = "server-manifest.ts is out of sync with routes/ - re-run the build to regenerate it (a disk-less worker bakes this route table, so the drift is a silent edge break), then commit it";
+const TRUST_MANIFEST_DRIFT_HINT = "nifra.manifest.json is missing, invalid, or out of sync - run `nifra manifest emit`, review it, and commit the regenerated trust artifact";
+const CAPABILITY_HINT = "effect/capability assurance failed - align the route declaration with approved adapter provenance; never bypass an owned effect seam";
 function oneLineDiff(file, line, before, after) {
     return `--- ${file}:${line}\n+++ ${file}:${line}\n@@\n-${before}\n+${after}`;
 }
@@ -986,10 +1206,10 @@ function ownFetchSuggestion(f, routes) {
 function serverImportSuggestion(specifier, chain, fallback) {
     const sink = chain[chain.length - 1] ?? specifier;
     // Surface the resolved chain in the fix steps so the agent sees the full path (`route → ../data →
-    // ../db → node:crypto`) and which module to cut — not just the route's own top-level import.
+    // ../db → node:crypto`) and which module to cut - not just the route's own top-level import.
     const chainStep = chain.length > 2
         ? fallback
-            ? `Server-only code reaches this route through \`${chain.join(" → ")}\` (the deeper chain couldn't be resolved precisely — trace it from \`${specifier}\`).`
+            ? `Server-only code reaches this route through \`${chain.join(" → ")}\` (the deeper chain couldn't be resolved precisely - trace it from \`${specifier}\`).`
             : `Server-only code reaches this route transitively: \`${chain.join(" → ")}\`. The sink is \`${sink}\`; break the chain at the first hop (\`${specifier}\`) or move the sink behind the server boundary.`
         : undefined;
     return {
@@ -1020,16 +1240,22 @@ export async function collectCheckResult(cwd, opts = {}) {
     const fetches = [];
     const staticRoutes = [];
     const untypedClients = [];
+    const removedImports = [];
     const serverImports = [];
     const responseRoutes = [];
+    const interpolatedSql = [];
     // Route modules (rel + content) collected during the walk, so the TRANSITIVE server-only resolution
-    // (#4.4) — which needs fs-backed import resolution, not just per-file text — runs after the walk.
+    // (#4.4) - which needs fs-backed import resolution, not just per-file text - runs after the walk.
     const routeModules = [];
     // Load the optional check config first - the typed-client scan needs the external-mount allowlist as it
     // walks. It's a tiny pure-JSON read; a malformed file surfaces as a warning below, never blocking.
     const { config: checkConfig, error: checkConfigError } = await loadCheckConfig(cwd);
+    // The interpolated-SQL rule parses with the TypeScript compiler, which is an optional peer. Resolved
+    // once, before the walk, so a project without it is told the rule did not run rather than being
+    // handed a clean report the rule never produced.
+    const sqlCompiler = await (opts.loadTypeScript ?? importTypeScript)();
     // lintsOnly: skip the tsc pass (seconds on a big project) and run just the near-instant source
-    // lints — the agent inner-loop mode; the full gate stays the definition of done.
+    // lints - the agent inner-loop mode; the full gate stays the definition of done.
     const [tc, _, dr, manifestDrift] = await Promise.all([
         opts.lintsOnly
             ? Promise.resolve({ ran: false, ok: true, note: "skipped (lintsOnly)" })
@@ -1038,9 +1264,12 @@ export async function collectCheckResult(cwd, opts = {}) {
             fetches.push(...scanFetchText(rel, content, checkConfig.externalMounts));
             staticRoutes.push(...scanStaticRouteText(rel, content));
             untypedClients.push(...scanUntypedClient(rel, content));
+            removedImports.push(...scanRemovedImports(rel, content));
             if (ROUTE_FILE.test(rel))
                 routeModules.push({ rel, content });
             responseRoutes.push(...scanResponseRoutes(rel, content));
+            if (sqlCompiler !== undefined)
+                interpolatedSql.push(...scanInterpolatedSql(rel, content, sqlCompiler));
         }),
         import("./doctor.js").then((m) => m.collectDoctorResult(cwd)),
         scanServerManifestDrift(cwd),
@@ -1053,7 +1282,7 @@ export async function collectCheckResult(cwd, opts = {}) {
     const resolveModule = (fromFile, specifier) => {
         try {
             // `fromFile` is a cwd-RELATIVE route path on the first hop (`routes/x.tsx`) but ABSOLUTE on the
-            // deeper hops the walk takes (it carries resolved absolute paths) — resolve the dir for each.
+            // deeper hops the walk takes (it carries resolved absolute paths) - resolve the dir for each.
             const fromAbs = isAbsolute(fromFile) ? fromFile : join(cwd, fromFile);
             return Bun.resolveSync(specifier, dirname(fromAbs));
         }
@@ -1126,25 +1355,37 @@ export async function collectCheckResult(cwd, opts = {}) {
             severity: "error",
             file: f.file,
             line: f.line,
-            message: `${f.snippet} — ${FETCH_HINT}`,
+            message: `${f.snippet} - ${FETCH_HINT}`,
             fix: FETCH_HINT,
             suggestion: ownFetchSuggestion(f, routes),
         });
     }
+    for (const f of removedImports.sort(bySite)) {
+        const entry = REMOVED_IMPORTS.find((candidate) => f.snippet.includes(`"${candidate.specifier}`) ||
+            f.snippet.includes(`'${candidate.specifier}`));
+        diagnostics.push({
+            rule: "removed-import",
+            severity: "error",
+            file: f.file,
+            line: f.line,
+            message: `${f.snippet} - removed in nifra ${entry?.since ?? "2.0"}: ${entry?.replacement ?? "see the changelog"}`,
+            fix: entry?.replacement ?? "see the changelog",
+        });
+    }
     for (const f of untypedClients.sort(bySite)) {
         diagnostics.push({
             rule: "untyped-client",
             severity: "error",
             file: f.file,
             line: f.line,
-            message: `${f.snippet} — ${UNTYPED_CLIENT_HINT}`,
+            message: `${f.snippet} - ${UNTYPED_CLIENT_HINT}`,
             fix: UNTYPED_CLIENT_HINT,
             suggestion: untypedClientSuggestion(f),
         });
     }
     for (const f of serverImports.sort(bySite)) {
-        // #4.4: the FULL transitive chain the import-resolution walk found — `route → ../data → ../db →
-        // node:crypto`, matching the build leak-guard's depth — instead of just the direct edge. The chain's
+        // #4.4: the FULL transitive chain the import-resolution walk found - `route → ../data → ../db →
+        // node:crypto`, matching the build leak-guard's depth - instead of just the direct edge. The chain's
         // tail is the actual server-only sink; the head is the route. When a precise resolve wasn't possible
         // (a bare pkg / path alias), `fallback` is set and the chain degrades to the honest direct edge.
         const chain = f.chain;
@@ -1154,20 +1395,55 @@ export async function collectCheckResult(cwd, opts = {}) {
             severity: "error",
             file: f.file,
             line: f.line,
-            message: `${f.snippet} — server-only "${sink}" reaches the browser bundle via ${chain.join(" → ")}${f.fallback ? " (direct edge — couldn't resolve the transitive chain precisely)" : ""}; ${SERVER_IMPORT_HINT}`,
+            message: `${f.snippet} - server-only "${sink}" reaches the browser bundle via ${chain.join(" → ")}${f.fallback ? " (direct edge - couldn't resolve the transitive chain precisely)" : ""}; ${SERVER_IMPORT_HINT}`,
             fix: SERVER_IMPORT_HINT,
             chain,
             suggestion: serverImportSuggestion(f.specifier, chain, f.fallback),
         });
     }
-    // Advisory — surfaced but NOT folded into `ok`, so it never fails the gate (a raw Response is valid).
+    if (sqlCompiler === undefined) {
+        // A security rule that could not run must say so. Silence here is indistinguishable from a clean
+        // result, and this is the one rule whose clean result means "no SQL injection was found".
+        diagnostics.push({
+            rule: "interpolated-sql",
+            severity: "warning",
+            message: SQL_COMPILER_MISSING_HINT,
+            fix: SQL_COMPILER_MISSING_HINT,
+            suggestion: {
+                kind: "command",
+                title: "Install TypeScript so the SQL rule can run",
+                command: ["bun add -d typescript"],
+            },
+        });
+    }
+    for (const f of interpolatedSql.sort(bySite)) {
+        diagnostics.push({
+            rule: "interpolated-sql",
+            severity: "error",
+            file: f.file,
+            line: f.line,
+            message: `${f.snippet} - ${INTERPOLATED_SQL_HINT}`,
+            fix: "bind the value as a parameter instead of interpolating it into the statement",
+            suggestion: {
+                kind: "manual",
+                title: "Bind the value instead of interpolating it",
+                steps: [
+                    "Replace the interpolation with a placeholder your driver understands (`?` for SQLite/MySQL, `$1` for Postgres).",
+                    "Pass the value as an argument alongside the statement, so the driver binds it.",
+                    `Or switch to the driver's tagged template (sql\`… ${SQL_INTERPOLATION_EXAMPLE} …\`): the tag receives substitutions separately and binds them.`,
+                    "An identifier that genuinely cannot be bound (a table or column name) must be checked against an allowlist you control, never taken from the request.",
+                ],
+            },
+        });
+    }
+    // Advisory - surfaced but NOT folded into `ok`, so it never fails the gate (a raw Response is valid).
     for (const f of responseRoutes.sort(bySite)) {
         diagnostics.push({
             rule: "response-route",
             severity: "warning",
             file: f.file,
             line: f.line,
-            message: `${f.snippet} — ${RESPONSE_ROUTE_HINT}`,
+            message: `${f.snippet} - ${RESPONSE_ROUTE_HINT}`,
             fix: RESPONSE_ROUTE_HINT,
             suggestion: responseRouteSuggestion(),
         });
@@ -1179,7 +1455,7 @@ export async function collectCheckResult(cwd, opts = {}) {
                 severity: "error",
                 file: f.file,
                 line: f.line,
-                message: `imports ${f.package} which is not declared in package.json — ${UNDECLARED_DEP_HINT}`,
+                message: `imports ${f.package} which is not declared in package.json - ${UNDECLARED_DEP_HINT}`,
                 fix: `add ${f.package} to package.json dependencies`,
                 suggestion: {
                     kind: "command",
@@ -1207,7 +1483,7 @@ export async function collectCheckResult(cwd, opts = {}) {
             });
         }
     }
-    // #7: a committed server-manifest.ts that drifted from routes/ — name the exact missing/extra routes.
+    // #7: a committed server-manifest.ts that drifted from routes/ - name the exact missing/extra routes.
     for (const f of manifestDrift) {
         const parts = [];
         if (f.missing.length > 0)
@@ -1218,13 +1494,13 @@ export async function collectCheckResult(cwd, opts = {}) {
             rule: "server-manifest-drift",
             severity: "error",
             file: f.file,
-            message: `${f.file} drifted from routes/ (${parts.join("; ")}) — ${MANIFEST_DRIFT_HINT}`,
+            message: `${f.file} drifted from routes/ (${parts.join("; ")}) - ${MANIFEST_DRIFT_HINT}`,
             fix: MANIFEST_DRIFT_HINT,
             suggestion: {
                 kind: "manual",
                 title: "Regenerate the committed server manifest",
                 steps: [
-                    "Re-run your build (`nifra build --target <t>` or your build script) — it regenerates server-manifest.ts from the current routes/.",
+                    "Re-run your build (`nifra build --target <t>` or your build script) - it regenerates server-manifest.ts from the current routes/.",
                     "Commit the updated server-manifest.ts.",
                 ],
             },
@@ -1233,25 +1509,50 @@ export async function collectCheckResult(cwd, opts = {}) {
     // G+B+D+F: when the project opts into capability assurance, `nifra check` becomes the static
     // provenance firewall as well as the typed-contract gate. Loading is explicit/config-owned; projects
     // without nifra.assurance.ts retain the historical scan and hot path unchanged.
+    const provided = opts.assurance;
     const assuranceConfigPath = join(cwd, "nifra.assurance.ts");
-    if (existsSync(assuranceConfigPath)) {
+    if (provided !== undefined ? provided.present : existsSync(assuranceConfigPath)) {
         try {
-            const { loadAssuranceConfig } = await import("./assure.js");
-            const config = await loadAssuranceConfig(cwd);
-            let capabilityReport;
-            if (config.capabilities !== undefined) {
-                const { collectCapabilityProjectReport } = await import("./capabilities-tool.js");
-                const project = await collectCapabilityProjectReport(cwd, config.source, config.capabilities);
-                capabilityReport = project.report;
+            // Either the shared reflection from `collectProjectVerification` (no second pass) or, on the
+            // standalone path, loaded + reflected here. Both branches yield the same config + evidence.
+            let config;
+            let project;
+            let routeAssurance;
+            if (provided !== undefined) {
+                // A load/evaluate failure travels as `provided.error`; re-throwing lands it in the same
+                // capability-config diagnostic the standalone catch produces.
+                if (provided.error !== undefined)
+                    throw provided.error;
+                config = provided.config;
+                project = provided.capability;
+                routeAssurance = provided.routeAssurance;
+            }
+            else {
+                const { loadAssuranceConfig } = await import("./assure.js");
+                config = await loadAssuranceConfig(cwd);
+                if (config.capabilities !== undefined) {
+                    const { collectCapabilityProjectReport } = await import("./capabilities-tool.js");
+                    project = await collectCapabilityProjectReport(cwd, config.source, config.capabilities);
+                }
+            }
+            const capabilityReport = project?.report;
+            if (config.capabilities !== undefined && project !== undefined) {
                 for (const finding of project.report.findings) {
                     const violation = finding.code === "forbidden-effect-import"
                         ? project.violations.find((candidate) => candidate.method === finding.method && candidate.path === finding.path)
                         : undefined;
+                    const truncation = finding.code === "provenance-truncated"
+                        ? project.truncations.find((candidate) => candidate.method === finding.method && candidate.path === finding.path)
+                        : undefined;
                     diagnostics.push({
                         rule: "capability-assurance",
                         severity: "error",
-                        ...(violation !== undefined ? { file: violation.module, chain: violation.chain } : {}),
-                        message: `${finding.message} — ${CAPABILITY_HINT}`,
+                        ...(violation !== undefined
+                            ? { file: violation.module, chain: violation.chain }
+                            : truncation !== undefined
+                                ? { chain: truncation.chain }
+                                : {}),
+                        message: `${finding.message} - ${CAPABILITY_HINT}`,
                         fix: CAPABILITY_HINT,
                         suggestion: {
                             kind: "manual",
@@ -1259,7 +1560,7 @@ export async function collectCheckResult(cwd, opts = {}) {
                             steps: [
                                 "Route effectful work through an import listed in capabilities.provenance.imports.",
                                 "Declare the exact capability token on the route; do not widen unrelated routes in the same file.",
-                                "For domain writes, add the request-idempotency or durable-command adapter required by the capability definition.",
+                                "For domain writes, add the adapter the capability definition requires: `schema.idempotency` for the `request` tier, `.use(durableCommand({ journal }))` from @nifrajs/middleware for the `durable` tier.",
                                 "Run `nifra capabilities snapshot` only after assurance passes, then review the lockfile diff.",
                             ],
                         },
@@ -1267,9 +1568,13 @@ export async function collectCheckResult(cwd, opts = {}) {
                 }
             }
             if (config.manifest !== undefined) {
-                const { evaluateRouteAssurance } = await import("@nifrajs/core/assurance");
                 const { buildNifraManifest, parseNifraManifest, serializeNifraManifest } = await import("@nifrajs/core/manifest");
-                const assurance = evaluateRouteAssurance(config.source, config.policy);
+                const assurance = routeAssurance ??
+                    (await import("@nifrajs/core/assurance")).evaluateRouteAssurance(config.source, config.policy, {
+                        ...(config.capabilities !== undefined
+                            ? { definitions: config.capabilities.definitions }
+                            : {}),
+                    });
                 const path = resolve(cwd, config.manifest.path ?? "nifra.manifest.json");
                 let message;
                 if (!assurance.ok || (capabilityReport !== undefined && !capabilityReport.ok)) {
@@ -1302,7 +1607,7 @@ export async function collectCheckResult(cwd, opts = {}) {
                         rule: "manifest-drift",
                         severity: "error",
                         file: path,
-                        message: `${message} — ${TRUST_MANIFEST_DRIFT_HINT}`,
+                        message: `${message} - ${TRUST_MANIFEST_DRIFT_HINT}`,
                         fix: TRUST_MANIFEST_DRIFT_HINT,
                         suggestion: {
                             kind: "command",
@@ -1334,7 +1639,7 @@ export async function collectCheckResult(cwd, opts = {}) {
         }
     }
     // Cap the diagnostics when asked (the MCP path), so a project with thousands of findings can't return a
-    // message that breaks the stdio transport. `ok` reflects the FULL set — truncation never flips it.
+    // message that breaks the stdio transport. `ok` reflects the FULL set - truncation never flips it.
     const total = diagnostics.length;
     const max = opts.maxDiagnostics;
     const shown = max !== undefined && total > max ? diagnostics.slice(0, max) : diagnostics;
@@ -1350,7 +1655,10 @@ export async function collectCheckResult(cwd, opts = {}) {
 }
 /** Run the full check; print a report (`--json` for machine output) and return whether it passed. */
 export async function runCheck(cwd, opts = {}) {
-    const result = await collectCheckResult(cwd, { lintsOnly: opts.lintsOnly ?? false });
+    // The check view over the one project verification: the same collector `assure` and `levels` read.
+    const { collectProjectVerification } = await import("./verification.js");
+    const verification = await collectProjectVerification(cwd, { lintsOnly: opts.lintsOnly ?? false });
+    const result = await verification.check();
     if (opts.json) {
         console.log(JSON.stringify(result, null, 2));
         return result.ok;
@@ -1359,7 +1667,7 @@ export async function runCheck(cwd, opts = {}) {
     console.log(result.typecheck === "pass"
         ? "✓ typecheck passed"
         : result.typecheck === "fail"
-            ? "✗ typecheck failed — the frontend/backend contract is broken"
+            ? "✗ typecheck failed - the frontend/backend contract is broken"
             : "• typecheck skipped (no tsconfig / typescript not installed)");
     if (result.externalMounts !== undefined && result.externalMounts.length > 0) {
         console.log(`• intentional external mounts (not typed-client checked): ${result.externalMounts.join(", ")}`);
@@ -1370,6 +1678,7 @@ export async function runCheck(cwd, opts = {}) {
         ["typed-client", "hand-rolled fetch() to your own API"],
         ["untyped-client", 'client("…") missing its <typeof app> type argument'],
         ["server-only-import", "server-only import in a route module"],
+        ["interpolated-sql", "SQL built by interpolating a value into the statement"],
         ["response-route", "route returns a raw Response (typed client → data: never)"],
         ["undeclared-dependency", "undeclared dependency in package.json"],
         ["duplicate-install", "duplicate identity-sensitive dependency install"],
@@ -1412,6 +1721,14 @@ export async function runCheck(cwd, opts = {}) {
     if (!existsSync(join(cwd, ".mcp.json"))) {
         console.log("\ntip: no .mcp.json here - run `nifra init-agents` to wire this project's MCP + agent files (no-clobber).");
     }
+    // `public/` used to be served in dev (inherited from Vite) and not in production, so every app
+    // hand-rolled static serving in its own server entry - or shipped a file that 404'd only once
+    // deployed. `@nifrajs/web` owns it now, so an app carrying the workaround can delete it. A tip
+    // rather than a finding: a hand-rolled handler still works (it simply runs first), so this is
+    // not a failure, and telling an app it can delete code is the entire point.
+    if (existsSync(join(cwd, "public"))) {
+        console.log('\ntip: `public/` is now served by @nifrajs/web in dev AND production (publicDir, default "public"). If your server entry hand-rolls static serving, you can delete it.');
+    }
     return result.ok;
 }
 //# sourceMappingURL=check.js.map