@nifrajs/cli 2.2.0 → 2.4.0

package/src/check.ts

@@ -1,14 +1,14 @@
 /**
- * `nifra check` — the agent's (and CI's) definition of done. It makes the guarantees that keep a nifra
+ * `nifra check` - the agent's (and CI's) definition of done. It makes the guarantees that keep a nifra
  * app drift-proof actually *fire*, instead of relying on the agent to remember them:
  *
- *   1. **typecheck** (`tsc --noEmit`) — the frontend↔backend contract is compiler-enforced. The typed
+ *   1. **typecheck** (`tsc --noEmit`) - the frontend↔backend contract is compiler-enforced. The typed
  *      client derives request + response types from the routes, so a shape mismatch is a type error.
- *   2. **typed-client lint** — flags hand-rolled `fetch()` to this app's *own* API (a relative URL),
+ *   2. **typed-client lint** - flags hand-rolled `fetch()` to this app's *own* API (a relative URL),
  *      which bypasses `client<typeof app>` so the compiler can't see the drift.
- *   3. **server-only-import lint** — flags a top-level import of server-only code (a DB driver, `node:`/
+ *   3. **server-only-import lint** - flags a top-level import of server-only code (a DB driver, `node:`/
  *      `bun:` builtins, the `./db` module) into a `routes/` page module. Those modules are bundled for
- *      the browser too, so the import ships server code to the client and breaks the build — the #1
+ *      the browser too, so the import ships server code to the client and breaks the build - the #1
  *      full-stack footgun. Reach server resources via `c.db` / `ctx.api`, never a top-level import.
  *
  * `collectCheckResult` returns a structured, machine-readable result (consumed by `--json` and the
@@ -18,7 +18,11 @@
 
 import { existsSync, readFileSync } from "node:fs"
 import { dirname, isAbsolute, join, resolve } from "node:path"
+import type { AssuranceConfig, AssuranceReport } from "@nifrajs/core/assurance"
 import { Glob } from "bun"
+import type * as TSApi from "typescript"
+import type { CapabilityProjectReport } from "./capabilities-tool.ts"
+import { importTypeScript, type TypeScriptApi } from "./internal/typescript-import.ts"
 
 export interface SourceFinding {
   readonly file: string
@@ -32,10 +36,10 @@ export interface ServerImportFinding extends SourceFinding {
   readonly specifier: string
 }
 
-// `fetch( <ws> ('|"|`) / (not /)` — a string/template arg starting with a single `/` is a relative URL,
+// `fetch( <ws> ('|"|`) / (not /)` - a string/template arg starting with a single `/` is a relative URL,
 // i.e. same-origin = this app's own API. `(?<![.\w])` skips `.fetch(` (a method) and `prefetch(`; the
 // `(?!\/)` skips protocol-relative `//host` (an external origin). A variable arg (`fetch(url)`) is left
-// alone on purpose — undecidable from source, and flagging it would punish legitimate external calls.
+// alone on purpose - undecidable from source, and flagging it would punish legitimate external calls.
 const GLOBAL_FETCH_CALL = /(?<![.\w])fetch\s*\(/g
 const FETCH_CALL = /(?<![.\w])fetch\s*\(/g
 const HTTP_VERBS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"])
@@ -46,7 +50,7 @@ const SIMPLE_REWRITE_METHODS = new Set(["GET", "DELETE", "HEAD", "OPTIONS"])
 const IGNORED =
   /(^|\/)(node_modules|dist(-[a-z0-9]+)?|build|\.nifra|\.git|\.wrangler|coverage)\/|\.(test|spec)\.[cm]?[jt]sx?$/
 
-// A file under `routes/` — a page module bundled for the browser, where a server-only import is unsafe.
+// A file under `routes/` - a page module bundled for the browser, where a server-only import is unsafe.
 const ROUTE_FILE = /(^|\/)routes\//
 
 // Module specifiers that must never be VALUE-imported into a route module: node:/bun: builtins, common
@@ -224,13 +228,13 @@ function scanRoutePattern(
 }
 
 /**
- * Blank, with spaces (newlines preserved, so every byte offset — and line number — is unchanged):
+ * Blank, with spaces (newlines preserved, so every byte offset - and line number - is unchanged):
  *   - `//` line comments and block comments;
- *   - the CONTENTS of backtick template literals — code-as-text (doc `CodeBlock` examples, code
+ *   - the CONTENTS of backtick template literals - code-as-text (doc `CodeBlock` examples, code
  *     generators), never a real statement to lint.
  * Single/double-quoted strings are KEPT (a real import/Response specifier lives in one). A small
  * char-state machine, not a full lexer: it doesn't model regex literals, so a regex containing a quote
- * could mis-skip — in practice the constructs these scanners look for sit before any such regex.
+ * could mis-skip - in practice the constructs these scanners look for sit before any such regex.
  * Shared by the source scanners here and by `nifra doctor` ({@link ./doctor.ts}).
  */
 export function stripComments(src: string): string {
@@ -449,10 +453,203 @@ export function scanStaticRouteText(file: string, content: string): StaticRouteF
   ].sort(bySite)
 }
 
-// `client("` / `client('` / `client(\`` — a URL-first call WITHOUT the `<typeof app>` generic:
+/**
+ * SQL built by interpolating a value into the statement text. The value is not a parameter, it is
+ * STATEMENT, so anything the caller controls can end the literal and continue as SQL.
+ *
+ * Two things this deliberately does not flag, because both are safe and flagging them would train
+ * people to ignore the rule:
+ *
+ * - A TAGGED template - ``sql`... ${id} ...` `` in postgres.js, drizzle or kysely. The tag receives the
+ *   substitutions separately and binds them; that is the parameterised form, not a bypass of it.
+ * - A literal with no substitution at all. `db.query("SELECT … WHERE id = ?")` is the shape being
+ *   argued for.
+ *
+ * A SQL keyword is required in the literal, so `cache.query(`user:${id}`)` stays quiet. The named
+ * escape hatches (`$queryRawUnsafe`, `sql.unsafe`) are flagged on the call alone: their whole purpose
+ * is to take a statement as text, and a substitution in one is the exact thing the name warns about.
+ */
+const SQL_METHODS = new Set([
+  "query",
+  "queryRaw",
+  "prepare",
+  "exec",
+  "execute",
+  "run",
+  "unsafe",
+  "$queryRawUnsafe",
+  "$executeRawUnsafe",
+  "raw",
+])
+const SQL_KEYWORD =
+  /\b(select|insert\s+into|update|delete\s+from|drop\s+table|create\s+table|alter\s+table|truncate|from|where|values|set|join|union)\b/i
+const ALWAYS_UNSAFE = new Set(["unsafe", "$queryRawUnsafe", "$executeRawUnsafe", "raw"])
+
+interface SqlExpressionShape {
+  readonly staticText: string
+  readonly dynamic: boolean
+  readonly concatenated: boolean
+  readonly literal: boolean
+  readonly parameterizedTag: boolean
+}
+
+/** Describe only the first argument's syntax; comments/strings elsewhere cannot influence the result. */
+function sqlExpressionShape(ts: TypeScriptApi, node: TSApi.Expression): SqlExpressionShape {
+  if (ts.isParenthesizedExpression(node)) return sqlExpressionShape(ts, node.expression)
+  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
+    return {
+      staticText: node.text,
+      dynamic: false,
+      concatenated: false,
+      literal: true,
+      parameterizedTag: false,
+    }
+  }
+  if (ts.isTaggedTemplateExpression(node)) {
+    const tag = node.tag
+    const parameterizedTag =
+      (ts.isIdentifier(tag) && tag.text === "sql") ||
+      (ts.isPropertyAccessExpression(tag) && tag.getText() === "Prisma.sql")
+    const template = node.template
+    const staticText = ts.isTemplateExpression(template)
+      ? [template.head.text, ...template.templateSpans.map((span) => span.literal.text)].join("")
+      : template.text
+    // Only the ecosystem's binding tags are trusted, by NAME - which is the honest limit of a scanner
+    // that reads syntax and runs no type checker. `sql` is what postgres.js, drizzle, slonik and Bun's
+    // own driver all call theirs, and `Prisma.sql` is Prisma's; taking those at their word is a
+    // deliberate trade, and it is worth stating what it costs: a no-op function named `sql` in the
+    // same file is trusted too, so this rule finds mistakes, not an adversary who reads it first.
+    //
+    // Trusting anything else widens that for no gain. This list briefly also held `sqlIdentifiers`,
+    // a name invented for Nifra's own adapters - a second forgeable name that no user has a
+    // convention for, added so Nifra's source would pass its own rule. Names earn their place here by
+    // being what drivers already call the thing, not by being convenient for the framework.
+    //
+    // Everything else - `String.raw`, an identity tag, a member access that merely ends in `.sql` -
+    // is treated as plain interpolation.
+    return {
+      staticText,
+      dynamic: ts.isTemplateExpression(template) && !parameterizedTag,
+      concatenated: false,
+      literal: !ts.isTemplateExpression(template),
+      parameterizedTag,
+    }
+  }
+  if (ts.isTemplateExpression(node)) {
+    return {
+      staticText: [node.head.text, ...node.templateSpans.map((span) => span.literal.text)].join(""),
+      dynamic: true,
+      concatenated: false,
+      literal: false,
+      parameterizedTag: false,
+    }
+  }
+  if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+    const left = sqlExpressionShape(ts, node.left)
+    const right = sqlExpressionShape(ts, node.right)
+    return {
+      staticText: left.staticText + right.staticText,
+      dynamic: left.dynamic || right.dynamic || !left.literal || !right.literal,
+      concatenated: true,
+      literal: left.literal && right.literal,
+      parameterizedTag: false,
+    }
+  }
+  return {
+    staticText: "",
+    dynamic: true,
+    concatenated: false,
+    literal: false,
+    parameterizedTag: false,
+  }
+}
+
+function sqlMethod(
+  ts: TypeScriptApi,
+  call: TSApi.CallExpression,
+): { method: string; receiver: string } | undefined {
+  if (ts.isPropertyAccessExpression(call.expression)) {
+    const method = call.expression.name.text
+    return SQL_METHODS.has(method)
+      ? { method, receiver: call.expression.expression.getText() }
+      : undefined
+  }
+  if (
+    ts.isElementAccessExpression(call.expression) &&
+    call.expression.argumentExpression !== undefined &&
+    ts.isStringLiteral(call.expression.argumentExpression)
+  ) {
+    const method = call.expression.argumentExpression.text
+    return SQL_METHODS.has(method)
+      ? { method, receiver: call.expression.expression.getText() }
+      : undefined
+  }
+  return undefined
+}
+
+const SQL_RECEIVER = /(?:^|\.)(?:db|sql|prisma|drizzle|database|conn|connection|client|tx)$/i
+
+/** Scan one file's text for SQL assembled by interpolation. Pure + line-accurate. */
+export function scanInterpolatedSql(
+  file: string,
+  content: string,
+  ts: TypeScriptApi,
+): SourceFinding[] {
+  const out: SourceFinding[] = []
+  const lines = content.split("\n")
+  const kind = /\.[cm]?tsx?$/.test(file) ? ts.ScriptKind.TSX : ts.ScriptKind.JS
+  const source = ts.createSourceFile(file, content, ts.ScriptTarget.Latest, true, kind)
+  // Malformed source is already a typecheck failure. Do not turn parser recovery nodes into a second,
+  // misleading SQL diagnostic (notably an unterminated template recovered as an interpolation).
+  const parseDiagnostics = (
+    source as TSApi.SourceFile & { readonly parseDiagnostics?: readonly TSApi.Diagnostic[] }
+  ).parseDiagnostics
+  if (parseDiagnostics !== undefined && parseDiagnostics.length > 0) return out
+  const visit = (node: TSApi.Node): void => {
+    if (ts.isCallExpression(node)) {
+      const sink = sqlMethod(ts, node)
+      const argument = node.arguments[0]
+      if (sink !== undefined && argument !== undefined) {
+        const shape = sqlExpressionShape(ts, argument)
+        const unsafeEscape =
+          ALWAYS_UNSAFE.has(sink.method) && !shape.literal && !shape.parameterizedTag
+        const assembledSql =
+          shape.dynamic &&
+          (SQL_KEYWORD.test(shape.staticText) ||
+            (shape.concatenated && SQL_RECEIVER.test(sink.receiver)))
+        if (unsafeEscape || assembledSql) {
+          const index = node.getStart(source)
+          const line = source.getLineAndCharacterOfPosition(index).line + 1
+          out.push({ file, line, snippet: (lines[line - 1] ?? "").trim() })
+        }
+      }
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(source)
+  return out
+}
+
+/**
+ * Collect interpolated-SQL findings across the project.
+ *
+ * Returns `undefined` - not an empty array - when TypeScript is not installed. The rule parses source
+ * with the compiler, so without it there is nothing to report and, more to the point, no basis for
+ * reporting nothing. An empty result would read as "no interpolated SQL found", which is the one
+ * answer a security rule must never give when it did not run.
+ */
+export async function scanProjectSql(cwd: string): Promise<SourceFinding[] | undefined> {
+  const ts = await importTypeScript()
+  if (ts === undefined) return undefined
+  const out: SourceFinding[] = []
+  await walkSource(cwd, (rel, content) => out.push(...scanInterpolatedSql(rel, content, ts)))
+  return out.sort(bySite)
+}
+
+// `client("` / `client('` / `client(\`` - a URL-first call WITHOUT the `<typeof app>` generic:
 // the compiler has nothing to derive types from, so the anti-drift guarantee silently vanishes.
 // `client<typeof app>("…")` has `<…>` between the name and `(` so it never matches; the published-
-// contract form `client(contract, url)` starts with an identifier, not a quote — also unmatched.
+// contract form `client(contract, url)` starts with an identifier, not a quote - also unmatched.
 const CLIENT_CALL = /(?<![.\w])client\s*\(/g
 
 /** Scan one file's text for untyped `client("…")` calls. Pure + line-accurate. */
@@ -496,14 +693,14 @@ const REMOVED_IMPORTS: ReadonlyArray<{
     specifier: "@nifrajs/budget",
     since: "2.0",
     replacement:
-      'import from "@nifrajs/core/budget" — the package folded into core and npm `latest` is still 1.13.0, so a `^2` range resolves to nothing',
+      'import from "@nifrajs/core/budget" - the package folded into core and npm `latest` is still 1.13.0, so a `^2` range resolves to nothing',
   },
   {
     specifier: "@nifrajs/core/ws",
     since: "2.0",
     sideEffectOnly: true,
     replacement:
-      'a bare `import "@nifrajs/core/ws"` no longer installs the runtime — register it explicitly with `.use(websocket())`, importing `websocket` from the same module',
+      'a bare `import "@nifrajs/core/ws"` no longer installs the runtime - register it explicitly with `.use(websocket())`, importing `websocket` from the same module',
   },
 ]
 
@@ -555,7 +752,7 @@ export function scanServerOnlyImports(file: string, content: string): ServerImpo
 }
 
 // ---------------------------------------------------------------------------------------------------
-// #4.4 — TRANSITIVE import-chain resolution for `server-only-import`. `scanServerOnlyImports` above is a
+// #4.4 - TRANSITIVE import-chain resolution for `server-only-import`. `scanServerOnlyImports` above is a
 // pure per-file regex scan: it sees only the route's DIRECT `import` line, so it reports the direct edge
 // `routes/x → ../db`. The build leak-guard, which has the real module graph, reports the full transitive
 // `route → ../data → ../db → pg`. These helpers give `nifra check` the same depth via a BOUNDED
@@ -564,14 +761,14 @@ export function scanServerOnlyImports(file: string, content: string): ServerImpo
 // that can't be precisely resolved (a bare pkg, a tsconfig path alias) falls back to the direct edge.
 // ---------------------------------------------------------------------------------------------------
 
-// Server-only specifiers that are TERMINAL sinks — a bare `node:`/`bun:` builtin or a known server-only
+// Server-only specifiers that are TERMINAL sinks - a bare `node:`/`bun:` builtin or a known server-only
 // npm package. These are never local source we can walk into, so the chain ends here. (Same vocabulary
-// as SERVER_ONLY, minus the relative `../db` arm — a relative `db` module IS local source we resolve.)
+// as SERVER_ONLY, minus the relative `../db` arm - a relative `db` module IS local source we resolve.)
 const SERVER_ONLY_SINK =
   /^(?:node:|bun:)|^(?:postgres|pg|mysql2|ioredis|redis|better-sqlite3|mongodb|@libsql\/client)$|^drizzle-orm\/(?:node-postgres|postgres-js|bun-sqlite|libsql|mysql2|pglite)\b/
 // The `.server` convention: a module named `*.server.ts(x)` is server-only (the client build empties it).
 const SERVER_MODULE_FILE = /\.server(\.[cm]?[jt]sx?)?$/
-// The explicit poison-import marker (`@nifrajs/web/server-only`) — a module opting into the client-leak
+// The explicit poison-import marker (`@nifrajs/web/server-only`) - a module opting into the client-leak
 // guard. A resolved file whose source carries this side-effect import is a server-only sink.
 const SERVER_ONLY_MARKER_IMPORT = /import\s+["']@nifrajs\/web\/server-only["']/
 // Depth/visited caps keep the walk linear + cycle-safe. A route's server-only dependency sits within a
@@ -579,13 +776,13 @@ const SERVER_ONLY_MARKER_IMPORT = /import\s+["']@nifrajs\/web\/server-only["']/
 const TRANSITIVE_MAX_DEPTH = 8
 const TRANSITIVE_MAX_VISITED = 200
 
-/** A relative module specifier (`./x`, `../y`) — the only kind we resolve + walk into (a bare specifier
+/** A relative module specifier (`./x`, `../y`) - the only kind we resolve + walk into (a bare specifier
  * is either a sink we recognise by name or a third-party dep we don't follow into node_modules). */
 const isRelativeSpecifier = (spec: string): boolean =>
   spec.startsWith("./") || spec.startsWith("../")
 
-// A FRESH copy of the static-import regex per scan. The transitive walk is REENTRANT — the outer
-// per-route loop and the inner BFS both scan imports — and a single shared global-flag regex carries
+// A FRESH copy of the static-import regex per scan. The transitive walk is REENTRANT - the outer
+// per-route loop and the inner BFS both scan imports - and a single shared global-flag regex carries
 // `lastIndex` state, so reusing the module-level `STATIC_IMPORT` across nested calls corrupts the outer
 // loop's position (it restarts forever). A fresh instance per call keeps each scan's state private.
 const staticImportRegex = (): RegExp => new RegExp(STATIC_IMPORT.source, STATIC_IMPORT.flags)
@@ -613,7 +810,7 @@ export function parseStaticImports(content: string): string[] {
 }
 
 /** The server-only SINK an import specifier names directly (a `node:`/`bun:` builtin or a known
- * server-only package), or `undefined` if it isn't a by-name sink. Pure — the label is the specifier
+ * server-only package), or `undefined` if it isn't a by-name sink. Pure - the label is the specifier
  * itself (it's already the actionable name). */
 export function directSinkSpecifier(spec: string): string | undefined {
   return SERVER_ONLY_SINK.test(spec) ? spec : undefined
@@ -622,7 +819,7 @@ export function directSinkSpecifier(spec: string): string | undefined {
 /** One transitive server-only finding: the route module, the route's offending top-level import (the
  * first hop / `specifier`), the line + snippet of that import, and the FULL chain to the sink. */
 export interface TransitiveServerImportFinding extends ServerImportFinding {
-  /** `[routeFile, ...as-written specifiers…, sink]` — the shortest path the walk found. Length 2 means
+  /** `[routeFile, ...as-written specifiers…, sink]` - the shortest path the walk found. Length 2 means
    * the route imports the sink directly (same as the regex scan's direct edge). */
   readonly chain: readonly string[]
   /** True when a precise transitive resolve wasn't possible for the first hop (a bare pkg / path alias),
@@ -645,7 +842,7 @@ export type ModuleReader = (absPath: string) => string | undefined
  * unresolvable alias). At each node, a by-name sink import (`node:fs`, `postgres`) OR a resolved
  * `*.server` / `server-only`-marked dependency terminates the chain. Bounded by depth + a visited set, so
  * it's linear and cycle-free. `routeFile`/`routeContent` seed the walk; `resolve`/`read` supply the graph
- * — pure given those, so it's unit-testable with a fake graph.
+ * - pure given those, so it's unit-testable with a fake graph.
  */
 export function walkServerOnlyChain(
   routeFile: string,
@@ -674,11 +871,11 @@ export function walkServerOnlyChain(
         const sink = directSinkSpecifier(spec)
         if (sink !== undefined) return [...node.chain, sink]
         // (b) Only relative specifiers are local source we resolve + walk into. A bare third-party
-        // specifier that isn't a known sink is a leaf — don't follow it into node_modules.
+        // specifier that isn't a known sink is a leaf - don't follow it into node_modules.
         if (!isRelativeSpecifier(spec)) continue
         const abs = resolve(node.abs, spec)
         if (abs === undefined || seen.has(abs)) continue
-        // (c) A resolved `*.server` module is a server-only sink by the `.server` convention — the chain
+        // (c) A resolved `*.server` module is a server-only sink by the `.server` convention - the chain
         // ends at it (named by the as-written specifier).
         if (SERVER_MODULE_FILE.test(abs)) return [...node.chain, spec]
         const content = read(abs)
@@ -699,8 +896,8 @@ export function walkServerOnlyChain(
 /**
  * Resolve the FULL transitive server-only chain(s) for a route module, given a real fs-backed resolver +
  * reader. For each of the route's top-level imports, if a precise transitive walk finds a sink, the
- * finding carries the full chain; otherwise — when the first hop is itself a direct by-name sink the
- * regex scan already flags, or when a relative import can't be resolved — it falls back to the DIRECT
+ * finding carries the full chain; otherwise - when the first hop is itself a direct by-name sink the
+ * regex scan already flags, or when a relative import can't be resolved - it falls back to the DIRECT
  * edge (`fallback: true`), never a fabricated chain. Returns one finding per offending top-level import,
  * de-duplicated to the shortest chain per first-hop specifier. Non-route files yield `[]`.
  */
@@ -721,21 +918,21 @@ export function resolveServerOnlyChains(
     if (flaggedSpecifiers.has(specifier)) continue
     const line = lineAt(content, index)
     const snippet = (lines[line - 1] ?? "").trim()
-    // (1) A direct by-name sink (`node:fs`, `postgres`) — the route imports it itself; chain is the
+    // (1) A direct by-name sink (`node:fs`, `postgres`) - the route imports it itself; chain is the
     // direct edge. (Length-2 chain == the regex scan's existing `[route, specifier]`.)
     if (directSinkSpecifier(specifier) !== undefined) {
       flaggedSpecifiers.add(specifier)
       out.push({ file, line, snippet, specifier, chain: [file, specifier], fallback: false })
       continue
     }
-    // (2) A relative local import — try the transitive walk from the resolved dependency. If it reaches
+    // (2) A relative local import - try the transitive walk from the resolved dependency. If it reaches
     // a sink, emit the full chain rooted at THIS route's import line.
     if (isRelativeSpecifier(specifier)) {
       const abs = resolve(file, specifier)
       if (abs === undefined) {
         // Unresolvable relative import. If it's the known server-only `../db` convention the regex scan
-        // flags directly, fall back to the direct edge (precise resolve impossible — say so via
-        // `fallback`). Any other unresolvable relative import we can't assert is server-only — skip it.
+        // flags directly, fall back to the direct edge (precise resolve impossible - say so via
+        // `fallback`). Any other unresolvable relative import we can't assert is server-only - skip it.
         if (SERVER_ONLY.test(specifier)) {
           flaggedSpecifiers.add(specifier)
           out.push({ file, line, snippet, specifier, chain: [file, specifier], fallback: true })
@@ -766,7 +963,7 @@ export function resolveServerOnlyChains(
         continue
       }
       // (3) The relative `../db`-style convention the regex scan flags directly, but where the walk
-      // found no deeper sink (e.g. the file wasn't readable past the first hop) — fall back to the
+      // found no deeper sink (e.g. the file wasn't readable past the first hop) - fall back to the
       // direct edge so we still surface the known-server-only convention rather than going silent.
       if (SERVER_ONLY.test(specifier)) {
         flaggedSpecifiers.add(specifier)
@@ -778,7 +975,7 @@ export function resolveServerOnlyChains(
 }
 
 // A route handler returning a raw `Response` (`=> new Response(`, `return Response.json(`, …) makes the
-// typed client infer `data: never` (`Jsonify<Response>` is `never`) — so frontend/backend drift detection
+// typed client infer `data: never` (`Jsonify<Response>` is `never`) - so frontend/backend drift detection
 // silently vanishes for that route. Advisory, not a failure: a raw Response is sometimes intended
 // (redirects, files, streams). Fix is to return a plain object, or declare `{ response: t.… }` to type it.
 const RESPONSE_RETURN = /(?:=>\s*|return\s+)(?:new\s+Response|Response\s*\.\s*json)\s*\(/g
@@ -816,12 +1013,12 @@ const RAW_RESPONSE_PRAGMA = "nifra-expect raw-response"
 /** Walk the project's `.ts`/`.tsx` source (skipping deps/build/tests), calling `visit` per file.
  * Exported so `nifra doctor` ({@link ./doctor.ts}) scans the same source surface as `nifra check`. */
 /**
- * Paths git considers ignored under `cwd`, in ONE batched `git check-ignore` call — so `.gitignore`
+ * Paths git considers ignored under `cwd`, in ONE batched `git check-ignore` call - so `.gitignore`
  * (root + nested + the global excludesfile) is honoured, not just the built-in {@link IGNORED} list. This
  * is what keeps the scan out of generated/build trees that live under a repo but aren't source: a monorepo
- * that gitignores, say, `builder/projects/` (238 generated apps) would otherwise be walked in full — 40k+
+ * that gitignores, say, `builder/projects/` (238 generated apps) would otherwise be walked in full - 40k+
  * findings, a 50 MB+ result that overwhelms the caller. Returns an EMPTY set when there's no git / not a
- * repo / git errors, so the scan simply degrades to the {@link IGNORED} regex — never throws, never blocks.
+ * repo / git errors, so the scan simply degrades to the {@link IGNORED} regex - never throws, never blocks.
  */
 async function gitIgnored(cwd: string, rels: readonly string[]): Promise<Set<string>> {
   if (rels.length === 0) return new Set()
@@ -852,7 +1049,7 @@ export async function walkSource(
   cwd: string,
   visit: (rel: string, content: string) => void,
 ): Promise<void> {
-  // List candidates first (cheap — no reads), drop the built-in ignores, then exclude gitignored paths in
+  // List candidates first (cheap - no reads), drop the built-in ignores, then exclude gitignored paths in
   // one batch before the (expensive) reads. So a gitignored generated/build tree is never read or scanned.
   const rels: string[] = []
   for await (const rel of new Glob("**/*.{ts,tsx,mts,cts}").scan({ cwd, dot: false })) {
@@ -875,15 +1072,15 @@ export async function scanProject(cwd: string): Promise<SourceFinding[]> {
   return out.sort(bySite)
 }
 
-// #7 — server-manifest drift. `server-manifest.ts` is a COMMITTED generated file (it bakes the route
+// #7 - server-manifest drift. `server-manifest.ts` is a COMMITTED generated file (it bakes the route
 // list + client-entry hash for a disk-less worker). If `routes/` changes but the manifest isn't
-// regenerated, the worker serves a stale route table — a silent edge break that no other check catches.
+// regenerated, the worker serves a stale route table - a silent edge break that no other check catches.
 // We diff each committed manifest's imported route files against the live `routes/` tree.
 
-// The marker comment `generateServerManifest` emits at the top of the file — identifies a generated
+// The marker comment `generateServerManifest` emits at the top of the file - identifies a generated
 // manifest unambiguously (so a user file merely named `server-manifest.ts` isn't mistaken for one).
 const GENERATED_MARKER = "GENERATED by @nifrajs/web generateServerManifest"
-// The first route-import specifier's prefix up to `routes/` (e.g. `./`, `../`, `./src/`) — used to
+// The first route-import specifier's prefix up to `routes/` (e.g. `./`, `../`, `./src/`) - used to
 // locate the routes dir relative to the manifest, and to strip to route-relative keys.
 const ROUTES_PREFIX = /["'](\.{1,2}(?:\/[^"'/]+)*?\/routes\/)[^"']+["']/
 // Route file extensions discovery recognises (mirrors `@nifrajs/web/fs`'s filter).
@@ -892,7 +1089,7 @@ const ROUTE_FILE_EXT = /\.(tsx|jsx|svelte|vue|mdx)$/
 export interface ManifestDriftFinding {
   /** The committed server-manifest file (relative to cwd). */
   readonly file: string
-  /** Route files in `routes/` missing from the manifest (stale manifest — these routes won't serve). */
+  /** Route files in `routes/` missing from the manifest (stale manifest - these routes won't serve). */
   readonly missing: readonly string[]
   /** Route files the manifest imports that no longer exist in `routes/` (a dangling import). */
   readonly extra: readonly string[]
@@ -914,12 +1111,12 @@ export async function scanServerManifestDrift(cwd: string): Promise<ManifestDrif
   for await (const rel of new Glob("**/server-manifest.ts").scan({ cwd, dot: false })) {
     if (IGNORED.test(rel)) continue
     const source = await Bun.file(join(cwd, rel)).text()
-    if (!source.includes(GENERATED_MARKER)) continue // not a generated manifest — skip
+    if (!source.includes(GENERATED_MARKER)) continue // not a generated manifest - skip
     const prefixMatch = ROUTES_PREFIX.exec(source)
     if (prefixMatch?.[1] === undefined) continue // no `routes/` imports → nothing to diff (empty app)
     const routesPrefix = prefixMatch[1]
     const manifestFiles = parseManifestRouteFiles(source, routesPrefix)
-    // The routes dir sits at `<manifest dir>/<prefix>` — resolve it relative to the manifest file.
+    // The routes dir sits at `<manifest dir>/<prefix>` - resolve it relative to the manifest file.
     const manifestDir = rel.includes("/") ? rel.slice(0, rel.lastIndexOf("/")) : ""
     const routesDir = join(cwd, manifestDir, routesPrefix)
     let discovered: string[]
@@ -930,7 +1127,7 @@ export async function scanServerManifestDrift(cwd: string): Promise<ManifestDrif
         .map((f) => f.replaceAll("\\", "/"))
         .filter((f) => ROUTE_FILE_EXT.test(f))
     } catch {
-      continue // routes dir gone/unreadable — not a drift we can assess
+      continue // routes dir gone/unreadable - not a drift we can assess
     }
     const drift = diffManifestRoutes(manifestFiles, discovered)
     if (!isManifestInSync(drift)) {
@@ -995,7 +1192,7 @@ async function typecheck(cwd: string, signal?: AbortSignal): Promise<TypecheckRe
 // `src/x.tsx(12,5): error TS2322: <message>` → one structured diagnostic.
 const TSC_LINE = /^(.+?)\((\d+),\d+\):\s*(?:error|warning)\s+TS\d+:\s*(.+)$/
 
-/** A single machine-readable check failure — the unit an agent (or CI) acts on. */
+/** A single machine-readable check failure - the unit an agent (or CI) acts on. */
 export interface CheckDiagnostic {
   readonly rule:
     | "typecheck"
@@ -1003,6 +1200,7 @@ export interface CheckDiagnostic {
     | "untyped-client"
     | "server-only-import"
     | "removed-import"
+    | "interpolated-sql"
     | "response-route"
     | "undeclared-dependency"
     | "duplicate-install"
@@ -1011,14 +1209,14 @@ export interface CheckDiagnostic {
     | "capability-assurance"
     | "capability-config"
     | "check-config"
-  /** `error` fails the gate (a real contract break); `warning` is advisory — surfaced to the agent but
+  /** `error` fails the gate (a real contract break); `warning` is advisory - surfaced to the agent but
    * does NOT fail `nifra check`, for patterns that are sometimes intentional (a route returning a raw
    * `Response`, which silently drops the typed client to `data: never` but is valid for files/redirects). */
   readonly severity: "error" | "warning"
   readonly file?: string
   readonly line?: number
   readonly message: string
-  /** The canonical, rule-level fix — clean of the per-occurrence snippet, so an agent can apply it
+  /** The canonical, rule-level fix - clean of the per-occurrence snippet, so an agent can apply it
    * directly. Set for the lint rules (they have one correct fix); omitted for `typecheck` (the fix is
    * specific to each type error). */
   readonly fix?: string
@@ -1029,12 +1227,12 @@ export interface CheckDiagnostic {
    * The import chain that pulls server-only code into the browser bundle, as display labels
    * `[routeFile, …as-written specifiers…, sink]`. Set only on `server-only-import`.
    *
-   * #4.4: this is now the FULL **transitive** chain — a bounded import-resolution walk (`Bun.resolveSync`
+   * #4.4: this is now the FULL **transitive** chain - a bounded import-resolution walk (`Bun.resolveSync`
    * from each file's dir, BFS the local module graph) follows `route → ../data → ../db → node:crypto`,
    * matching the build leak-guard's depth (`detectNodeBuiltinsInClient` in `@nifrajs/web/build`). A
    * length-2 chain (`[routeFile, specifier]`) means the route imports the sink directly. When a hop can't
    * be resolved precisely (a bare pkg, a tsconfig path alias), the walk degrades to the honest direct
-   * edge rather than fabricating a deeper path — never a lie.
+   * edge rather than fabricating a deeper path - never a lie.
    */
   readonly chain?: readonly string[]
 }
@@ -1048,7 +1246,7 @@ export interface CheckSuggestion {
   readonly steps?: readonly string[]
 }
 
-/** The structured result of a full check — what `--json` prints and the `nifra_check` MCP tool returns. */
+/** The structured result of a full check - what `--json` prints and the `nifra_check` MCP tool returns. */
 export interface CheckResult {
   readonly ok: boolean
   readonly typecheck: "pass" | "fail" | "skipped"
@@ -1057,12 +1255,31 @@ export interface CheckResult {
    * better-auth). Echoed here so `--json` / the MCP tool / the report can show what the typed-client scan
    * deliberately skipped - a suppressed prefix stays auditable instead of silently hiding real drift. */
   readonly externalMounts?: readonly string[]
-  /** Set only when the caller passed `maxDiagnostics` and there were more — `diagnostics` then holds the
+  /** Set only when the caller passed `maxDiagnostics` and there were more - `diagnostics` then holds the
    * first `shown` of `total`. It caps the serialized size so the `nifra_check` MCP tool can't emit a
    * message large enough to break the stdio transport; fix the shown diagnostics and re-run for the rest. */
   readonly truncated?: { readonly shown: number; readonly total: number }
 }
 
+/**
+ * Pre-resolved route-assurance inputs, so the same reflection that `nifra assure` / `nifra levels`
+ * already ran can feed `check`'s capability + trust-manifest diagnostics instead of a second pass.
+ * Supplied by {@link collectProjectVerification}. When omitted, `collectCheckResult` loads and computes
+ * these itself (the standalone `nifra_check` MCP path); the two routes produce byte-identical results.
+ */
+export interface CheckAssuranceContext {
+  /** Whether `nifra.assurance.ts` exists: the gate for running the assurance-fed diagnostics at all. */
+  readonly present: boolean
+  /** The loaded config, when it loaded. Absent when the file is missing or {@link error} is set. */
+  readonly config?: AssuranceConfig
+  /** The failure from loading/evaluating the config, surfaced as a `capability-config` diagnostic. */
+  readonly error?: unknown
+  /** `evaluateRouteAssurance` over the config's source + policy (drives the trust-manifest check). */
+  readonly routeAssurance?: AssuranceReport
+  /** Static capability provenance, when the config declares a capabilities policy. */
+  readonly capability?: CapabilityProjectReport
+}
+
 /** Optional per-project `nifra.check.json` - pure data (no code execution), so it's safe to read before
  * the app is built or even importable, preserving check's pre-`loadApp` invariant. */
 interface CheckConfig {
@@ -1091,21 +1308,25 @@ async function loadCheckConfig(cwd: string): Promise<{ config: CheckConfig; erro
 }
 
 const UNTYPED_CLIENT_HINT =
-  'client("…") without a type argument — write client<typeof app>("…") (or client(contract, url)) so the compiler can catch drift'
+  'client("…") without a type argument - write client<typeof app>("…") (or client(contract, url)) so the compiler can catch drift'
 const FETCH_HINT =
-  "hand-rolled fetch() to your own API — call it through client<typeof app> (from @nifrajs/client) so the compiler catches drift"
+  "hand-rolled fetch() to your own API - call it through client<typeof app> (from @nifrajs/client) so the compiler catches drift"
 const SERVER_IMPORT_HINT =
-  "server-only import in a route module (bundled for the browser) — reach it via c.db / ctx.api inside a loader, never a top-level import"
+  "server-only import in a route module (bundled for the browser) - reach it via c.db / ctx.api inside a loader, never a top-level import"
 const RESPONSE_ROUTE_HINT =
   "route handler returns a raw Response - the typed client infers `data: never`, so drift detection is lost for this route. Return a plain object (it's serialized for you); for a stream use a typed SSE route (`app.sse(...)`), which keeps typed events; or, if a raw Response is intended (file/redirect), add `{ response: t.… }` or a `// nifra-expect raw-response` comment to mark it and silence this"
 const UNDECLARED_DEP_HINT =
-  "imported package is not declared in package.json dependencies — run bun add to declare it"
+  "imported package is not declared in package.json dependencies - run bun add to declare it"
+const SQL_COMPILER_MISSING_HINT =
+  "the interpolated-SQL rule did NOT run - it parses source with the TypeScript compiler, which is an optional peer and is not installed here. This report says nothing about SQL injection either way. Install it with `bun add -d typescript`"
+const SQL_INTERPOLATION_EXAMPLE = "$" + "{value}"
+const INTERPOLATED_SQL_HINT = `SQL built by interpolating a value into the statement text - the value becomes statement, not a parameter, so anything the caller controls can end the literal and continue as SQL. Pass it as a bound parameter (\`?\` / \`$1\` and an argument), or use your driver's tagged template (sql\`… ${SQL_INTERPOLATION_EXAMPLE} …\`), which binds the substitutions for you`
 const MANIFEST_DRIFT_HINT =
-  "server-manifest.ts is out of sync with routes/ — re-run the build to regenerate it (a disk-less worker bakes this route table, so the drift is a silent edge break), then commit it"
+  "server-manifest.ts is out of sync with routes/ - re-run the build to regenerate it (a disk-less worker bakes this route table, so the drift is a silent edge break), then commit it"
 const TRUST_MANIFEST_DRIFT_HINT =
-  "nifra.manifest.json is missing, invalid, or out of sync — run `nifra manifest emit`, review it, and commit the regenerated trust artifact"
+  "nifra.manifest.json is missing, invalid, or out of sync - run `nifra manifest emit`, review it, and commit the regenerated trust artifact"
 const CAPABILITY_HINT =
-  "effect/capability assurance failed — align the route declaration with approved adapter provenance; never bypass an owned effect seam"
+  "effect/capability assurance failed - align the route declaration with approved adapter provenance; never bypass an owned effect seam"
 
 function oneLineDiff(file: string, line: number, before: string, after: string): string {
   return `--- ${file}:${line}\n+++ ${file}:${line}\n@@\n-${before}\n+${after}`
@@ -1207,11 +1428,11 @@ function serverImportSuggestion(
 ): CheckSuggestion {
   const sink = chain[chain.length - 1] ?? specifier
   // Surface the resolved chain in the fix steps so the agent sees the full path (`route → ../data →
-  // ../db → node:crypto`) and which module to cut — not just the route's own top-level import.
+  // ../db → node:crypto`) and which module to cut - not just the route's own top-level import.
   const chainStep =
     chain.length > 2
       ? fallback
-        ? `Server-only code reaches this route through \`${chain.join(" → ")}\` (the deeper chain couldn't be resolved precisely — trace it from \`${specifier}\`).`
+        ? `Server-only code reaches this route through \`${chain.join(" → ")}\` (the deeper chain couldn't be resolved precisely - trace it from \`${specifier}\`).`
         : `Server-only code reaches this route transitively: \`${chain.join(" → ")}\`. The sink is \`${sink}\`; break the chain at the first hop (\`${specifier}\`) or move the sink behind the server boundary.`
       : undefined
   return {
@@ -1248,6 +1469,13 @@ export async function collectCheckResult(
     /** Cap the returned `diagnostics` to this many (adds {@link CheckResult.truncated}). The MCP tool sets
      * it so a huge project can't produce a transport-breaking result; the CLI leaves it unset (all shown). */
     readonly maxDiagnostics?: number
+    /** How the interpolated-SQL rule gets its compiler. Injectable so the "not installed" path - the
+     * one where a security rule reports that it did not run - is testable on a machine that has it. */
+    readonly loadTypeScript?: () => Promise<TypeScriptApi | undefined>
+    /** Route-assurance inputs already computed by {@link collectProjectVerification}. When present,
+     * the capability + trust-manifest diagnostics reuse them instead of loading/reflecting a second
+     * time; when absent, they are computed here (unchanged standalone behavior). */
+    readonly assurance?: CheckAssuranceContext
   } = {},
 ): Promise<CheckResult> {
   const fetches: SourceFinding[] = []
@@ -1256,14 +1484,19 @@ export async function collectCheckResult(
   const removedImports: SourceFinding[] = []
   const serverImports: TransitiveServerImportFinding[] = []
   const responseRoutes: SourceFinding[] = []
+  const interpolatedSql: SourceFinding[] = []
   // Route modules (rel + content) collected during the walk, so the TRANSITIVE server-only resolution
-  // (#4.4) — which needs fs-backed import resolution, not just per-file text — runs after the walk.
+  // (#4.4) - which needs fs-backed import resolution, not just per-file text - runs after the walk.
   const routeModules: Array<{ rel: string; content: string }> = []
   // Load the optional check config first - the typed-client scan needs the external-mount allowlist as it
   // walks. It's a tiny pure-JSON read; a malformed file surfaces as a warning below, never blocking.
   const { config: checkConfig, error: checkConfigError } = await loadCheckConfig(cwd)
+  // The interpolated-SQL rule parses with the TypeScript compiler, which is an optional peer. Resolved
+  // once, before the walk, so a project without it is told the rule did not run rather than being
+  // handed a clean report the rule never produced.
+  const sqlCompiler = await (opts.loadTypeScript ?? importTypeScript)()
   // lintsOnly: skip the tsc pass (seconds on a big project) and run just the near-instant source
-  // lints — the agent inner-loop mode; the full gate stays the definition of done.
+  // lints - the agent inner-loop mode; the full gate stays the definition of done.
   const [tc, _, dr, manifestDrift] = await Promise.all([
     opts.lintsOnly
       ? Promise.resolve<TypecheckResult>({ ran: false, ok: true, note: "skipped (lintsOnly)" })
@@ -1275,6 +1508,8 @@ export async function collectCheckResult(
       removedImports.push(...scanRemovedImports(rel, content))
       if (ROUTE_FILE.test(rel)) routeModules.push({ rel, content })
       responseRoutes.push(...scanResponseRoutes(rel, content))
+      if (sqlCompiler !== undefined)
+        interpolatedSql.push(...scanInterpolatedSql(rel, content, sqlCompiler))
     }),
     import("./doctor.ts").then((m) => m.collectDoctorResult(cwd)),
     scanServerManifestDrift(cwd),
@@ -1288,7 +1523,7 @@ export async function collectCheckResult(
   const resolveModule: ModuleResolver = (fromFile, specifier) => {
     try {
       // `fromFile` is a cwd-RELATIVE route path on the first hop (`routes/x.tsx`) but ABSOLUTE on the
-      // deeper hops the walk takes (it carries resolved absolute paths) — resolve the dir for each.
+      // deeper hops the walk takes (it carries resolved absolute paths) - resolve the dir for each.
       const fromAbs = isAbsolute(fromFile) ? fromFile : join(cwd, fromFile)
       return Bun.resolveSync(specifier, dirname(fromAbs))
     } catch {
@@ -1360,7 +1595,7 @@ export async function collectCheckResult(
       severity: "error",
       file: f.file,
       line: f.line,
-      message: `${f.snippet} — ${FETCH_HINT}`,
+      message: `${f.snippet} - ${FETCH_HINT}`,
       fix: FETCH_HINT,
       suggestion: ownFetchSuggestion(f, routes),
     })
@@ -1376,7 +1611,7 @@ export async function collectCheckResult(
       severity: "error",
       file: f.file,
       line: f.line,
-      message: `${f.snippet} — removed in nifra ${entry?.since ?? "2.0"}: ${entry?.replacement ?? "see the changelog"}`,
+      message: `${f.snippet} - removed in nifra ${entry?.since ?? "2.0"}: ${entry?.replacement ?? "see the changelog"}`,
       fix: entry?.replacement ?? "see the changelog",
     })
   }
@@ -1386,14 +1621,14 @@ export async function collectCheckResult(
       severity: "error",
       file: f.file,
       line: f.line,
-      message: `${f.snippet} — ${UNTYPED_CLIENT_HINT}`,
+      message: `${f.snippet} - ${UNTYPED_CLIENT_HINT}`,
       fix: UNTYPED_CLIENT_HINT,
       suggestion: untypedClientSuggestion(f),
     })
   }
   for (const f of serverImports.sort(bySite)) {
-    // #4.4: the FULL transitive chain the import-resolution walk found — `route → ../data → ../db →
-    // node:crypto`, matching the build leak-guard's depth — instead of just the direct edge. The chain's
+    // #4.4: the FULL transitive chain the import-resolution walk found - `route → ../data → ../db →
+    // node:crypto`, matching the build leak-guard's depth - instead of just the direct edge. The chain's
     // tail is the actual server-only sink; the head is the route. When a precise resolve wasn't possible
     // (a bare pkg / path alias), `fallback` is set and the chain degrades to the honest direct edge.
     const chain = f.chain
@@ -1403,20 +1638,55 @@ export async function collectCheckResult(
       severity: "error",
       file: f.file,
       line: f.line,
-      message: `${f.snippet} — server-only "${sink}" reaches the browser bundle via ${chain.join(" → ")}${f.fallback ? " (direct edge — couldn't resolve the transitive chain precisely)" : ""}; ${SERVER_IMPORT_HINT}`,
+      message: `${f.snippet} - server-only "${sink}" reaches the browser bundle via ${chain.join(" → ")}${f.fallback ? " (direct edge - couldn't resolve the transitive chain precisely)" : ""}; ${SERVER_IMPORT_HINT}`,
       fix: SERVER_IMPORT_HINT,
       chain,
       suggestion: serverImportSuggestion(f.specifier, chain, f.fallback),
     })
   }
-  // Advisory — surfaced but NOT folded into `ok`, so it never fails the gate (a raw Response is valid).
+  if (sqlCompiler === undefined) {
+    // A security rule that could not run must say so. Silence here is indistinguishable from a clean
+    // result, and this is the one rule whose clean result means "no SQL injection was found".
+    diagnostics.push({
+      rule: "interpolated-sql",
+      severity: "warning",
+      message: SQL_COMPILER_MISSING_HINT,
+      fix: SQL_COMPILER_MISSING_HINT,
+      suggestion: {
+        kind: "command",
+        title: "Install TypeScript so the SQL rule can run",
+        command: ["bun add -d typescript"],
+      },
+    })
+  }
+  for (const f of interpolatedSql.sort(bySite)) {
+    diagnostics.push({
+      rule: "interpolated-sql",
+      severity: "error",
+      file: f.file,
+      line: f.line,
+      message: `${f.snippet} - ${INTERPOLATED_SQL_HINT}`,
+      fix: "bind the value as a parameter instead of interpolating it into the statement",
+      suggestion: {
+        kind: "manual",
+        title: "Bind the value instead of interpolating it",
+        steps: [
+          "Replace the interpolation with a placeholder your driver understands (`?` for SQLite/MySQL, `$1` for Postgres).",
+          "Pass the value as an argument alongside the statement, so the driver binds it.",
+          `Or switch to the driver's tagged template (sql\`… ${SQL_INTERPOLATION_EXAMPLE} …\`): the tag receives substitutions separately and binds them.`,
+          "An identifier that genuinely cannot be bound (a table or column name) must be checked against an allowlist you control, never taken from the request.",
+        ],
+      },
+    })
+  }
+  // Advisory - surfaced but NOT folded into `ok`, so it never fails the gate (a raw Response is valid).
   for (const f of responseRoutes.sort(bySite)) {
     diagnostics.push({
       rule: "response-route",
       severity: "warning",
       file: f.file,
       line: f.line,
-      message: `${f.snippet} — ${RESPONSE_ROUTE_HINT}`,
+      message: `${f.snippet} - ${RESPONSE_ROUTE_HINT}`,
       fix: RESPONSE_ROUTE_HINT,
       suggestion: responseRouteSuggestion(),
     })
@@ -1428,7 +1698,7 @@ export async function collectCheckResult(
         severity: "error",
         file: f.file,
         line: f.line,
-        message: `imports ${f.package} which is not declared in package.json — ${UNDECLARED_DEP_HINT}`,
+        message: `imports ${f.package} which is not declared in package.json - ${UNDECLARED_DEP_HINT}`,
         fix: `add ${f.package} to package.json dependencies`,
         suggestion: {
           kind: "command",
@@ -1439,10 +1709,14 @@ export async function collectCheckResult(
     }
     for (const finding of dr.duplicateInstalls) {
       const copies = finding.copies.map((copy) => `${copy.version} at ${copy.path}`).join("; ")
+      const identityHint =
+        finding.package === "@nifrajs/core"
+          ? " (a second @nifrajs/core collapses `typeof backend` to `any` at `.merge()` - usually that error's root cause)"
+          : ""
       diagnostics.push({
         rule: "duplicate-install",
         severity: "error",
-        message: `${finding.package} resolves to multiple physical copies (${copies}) - module identity is unsafe`,
+        message: `${finding.package} resolves to multiple physical copies (${copies}) - module identity is unsafe${identityHint}`,
         fix: "align dependency ranges and reinstall from the workspace root",
         suggestion: {
           kind: "manual",
@@ -1456,7 +1730,7 @@ export async function collectCheckResult(
       })
     }
   }
-  // #7: a committed server-manifest.ts that drifted from routes/ — name the exact missing/extra routes.
+  // #7: a committed server-manifest.ts that drifted from routes/ - name the exact missing/extra routes.
   for (const f of manifestDrift) {
     const parts: string[] = []
     if (f.missing.length > 0) parts.push(`missing from manifest: ${f.missing.join(", ")}`)
@@ -1465,13 +1739,13 @@ export async function collectCheckResult(
       rule: "server-manifest-drift",
       severity: "error",
       file: f.file,
-      message: `${f.file} drifted from routes/ (${parts.join("; ")}) — ${MANIFEST_DRIFT_HINT}`,
+      message: `${f.file} drifted from routes/ (${parts.join("; ")}) - ${MANIFEST_DRIFT_HINT}`,
       fix: MANIFEST_DRIFT_HINT,
       suggestion: {
         kind: "manual",
         title: "Regenerate the committed server manifest",
         steps: [
-          "Re-run your build (`nifra build --target <t>` or your build script) — it regenerates server-manifest.ts from the current routes/.",
+          "Re-run your build (`nifra build --target <t>` or your build script) - it regenerates server-manifest.ts from the current routes/.",
           "Commit the updated server-manifest.ts.",
         ],
       },
@@ -1481,24 +1755,32 @@ export async function collectCheckResult(
   // G+B+D+F: when the project opts into capability assurance, `nifra check` becomes the static
   // provenance firewall as well as the typed-contract gate. Loading is explicit/config-owned; projects
   // without nifra.assurance.ts retain the historical scan and hot path unchanged.
+  const provided = opts.assurance
   const assuranceConfigPath = join(cwd, "nifra.assurance.ts")
-  if (existsSync(assuranceConfigPath)) {
+  if (provided !== undefined ? provided.present : existsSync(assuranceConfigPath)) {
     try {
-      const { loadAssuranceConfig } = await import("./assure.ts")
-      const config = await loadAssuranceConfig(cwd)
-      let capabilityReport:
-        | Awaited<
-            ReturnType<typeof import("./capabilities-tool.ts")["collectCapabilityProjectReport"]>
-          >["report"]
-        | undefined
-      if (config.capabilities !== undefined) {
-        const { collectCapabilityProjectReport } = await import("./capabilities-tool.ts")
-        const project = await collectCapabilityProjectReport(
-          cwd,
-          config.source,
-          config.capabilities,
-        )
-        capabilityReport = project.report
+      // Either the shared reflection from `collectProjectVerification` (no second pass) or, on the
+      // standalone path, loaded + reflected here. Both branches yield the same config + evidence.
+      let config: AssuranceConfig
+      let project: CapabilityProjectReport | undefined
+      let routeAssurance: AssuranceReport | undefined
+      if (provided !== undefined) {
+        // A load/evaluate failure travels as `provided.error`; re-throwing lands it in the same
+        // capability-config diagnostic the standalone catch produces.
+        if (provided.error !== undefined) throw provided.error
+        config = provided.config as AssuranceConfig
+        project = provided.capability
+        routeAssurance = provided.routeAssurance
+      } else {
+        const { loadAssuranceConfig } = await import("./assure.ts")
+        config = await loadAssuranceConfig(cwd)
+        if (config.capabilities !== undefined) {
+          const { collectCapabilityProjectReport } = await import("./capabilities-tool.ts")
+          project = await collectCapabilityProjectReport(cwd, config.source, config.capabilities)
+        }
+      }
+      const capabilityReport = project?.report
+      if (config.capabilities !== undefined && project !== undefined) {
         for (const finding of project.report.findings) {
           const violation =
             finding.code === "forbidden-effect-import"
@@ -1507,11 +1789,22 @@ export async function collectCheckResult(
                     candidate.method === finding.method && candidate.path === finding.path,
                 )
               : undefined
+          const truncation =
+            finding.code === "provenance-truncated"
+              ? project.truncations.find(
+                  (candidate) =>
+                    candidate.method === finding.method && candidate.path === finding.path,
+                )
+              : undefined
           diagnostics.push({
             rule: "capability-assurance",
             severity: "error",
-            ...(violation !== undefined ? { file: violation.module, chain: violation.chain } : {}),
-            message: `${finding.message} — ${CAPABILITY_HINT}`,
+            ...(violation !== undefined
+              ? { file: violation.module, chain: violation.chain }
+              : truncation !== undefined
+                ? { chain: truncation.chain }
+                : {}),
+            message: `${finding.message} - ${CAPABILITY_HINT}`,
             fix: CAPABILITY_HINT,
             suggestion: {
               kind: "manual",
@@ -1519,7 +1812,7 @@ export async function collectCheckResult(
               steps: [
                 "Route effectful work through an import listed in capabilities.provenance.imports.",
                 "Declare the exact capability token on the route; do not widen unrelated routes in the same file.",
-                "For domain writes, add the request-idempotency or durable-command adapter required by the capability definition.",
+                "For domain writes, add the adapter the capability definition requires: `schema.idempotency` for the `request` tier, `.use(durableCommand({ journal }))` from @nifrajs/middleware for the `durable` tier.",
                 "Run `nifra capabilities snapshot` only after assurance passes, then review the lockfile diff.",
               ],
             },
@@ -1527,11 +1820,20 @@ export async function collectCheckResult(
         }
       }
       if (config.manifest !== undefined) {
-        const { evaluateRouteAssurance } = await import("@nifrajs/core/assurance")
         const { buildNifraManifest, parseNifraManifest, serializeNifraManifest } = await import(
           "@nifrajs/core/manifest"
         )
-        const assurance = evaluateRouteAssurance(config.source, config.policy)
+        const assurance =
+          routeAssurance ??
+          (await import("@nifrajs/core/assurance")).evaluateRouteAssurance(
+            config.source,
+            config.policy,
+            {
+              ...(config.capabilities !== undefined
+                ? { definitions: config.capabilities.definitions }
+                : {}),
+            },
+          )
         const path = resolve(cwd, config.manifest.path ?? "nifra.manifest.json")
         let message: string | undefined
         if (!assurance.ok || (capabilityReport !== undefined && !capabilityReport.ok)) {
@@ -1561,7 +1863,7 @@ export async function collectCheckResult(
             rule: "manifest-drift",
             severity: "error",
             file: path,
-            message: `${message} — ${TRUST_MANIFEST_DRIFT_HINT}`,
+            message: `${message} - ${TRUST_MANIFEST_DRIFT_HINT}`,
             fix: TRUST_MANIFEST_DRIFT_HINT,
             suggestion: {
               kind: "command",
@@ -1593,7 +1895,7 @@ export async function collectCheckResult(
   }
 
   // Cap the diagnostics when asked (the MCP path), so a project with thousands of findings can't return a
-  // message that breaks the stdio transport. `ok` reflects the FULL set — truncation never flips it.
+  // message that breaks the stdio transport. `ok` reflects the FULL set - truncation never flips it.
   const total = diagnostics.length
   const max = opts.maxDiagnostics
   const shown = max !== undefined && total > max ? diagnostics.slice(0, max) : diagnostics
@@ -1613,7 +1915,10 @@ export async function runCheck(
   cwd: string,
   opts: { readonly json?: boolean; readonly lintsOnly?: boolean } = {},
 ): Promise<boolean> {
-  const result = await collectCheckResult(cwd, { lintsOnly: opts.lintsOnly ?? false })
+  // The check view over the one project verification: the same collector `assure` and `levels` read.
+  const { collectProjectVerification } = await import("./verification.ts")
+  const verification = await collectProjectVerification(cwd, { lintsOnly: opts.lintsOnly ?? false })
+  const result = await verification.check()
   if (opts.json) {
     console.log(JSON.stringify(result, null, 2))
     return result.ok
@@ -1624,7 +1929,7 @@ export async function runCheck(
     result.typecheck === "pass"
       ? "✓ typecheck passed"
       : result.typecheck === "fail"
-        ? "✗ typecheck failed — the frontend/backend contract is broken"
+        ? "✗ typecheck failed - the frontend/backend contract is broken"
         : "• typecheck skipped (no tsconfig / typescript not installed)",
   )
   if (result.externalMounts !== undefined && result.externalMounts.length > 0) {
@@ -1639,6 +1944,7 @@ export async function runCheck(
     ["typed-client", "hand-rolled fetch() to your own API"],
     ["untyped-client", 'client("…") missing its <typeof app> type argument'],
     ["server-only-import", "server-only import in a route module"],
+    ["interpolated-sql", "SQL built by interpolating a value into the statement"],
     ["response-route", "route returns a raw Response (typed client → data: never)"],
     ["undeclared-dependency", "undeclared dependency in package.json"],
     ["duplicate-install", "duplicate identity-sensitive dependency install"],