@vantageos/backend-doctor 0.1.13 → 0.2.0

package/README.md

@@ -18,8 +18,9 @@ The detectors read four kinds of material, each a **comparison target, never an
 
 | Kind | Reads | Rules (examples) |
 |---|---|---|
-| oracle-CSV (Axis-2) | the per-tool inventory `fixtures/vp-by-tool-day158.csv` | R-1..R-13, R-7, R-8, R-37 |
-| oracle-CSV (Axis-1) | VP oracle **vs** the VR inventory `fixtures/vr-by-tool-day159.csv` | R-40 |
+| oracle-CSV (Axis-2) | the per-tool inventory the target's own `.backend-doctor/vp-by-tool.csv` (or `--oracle <file>`); absent => could-not-judge | R-1..R-13, R-7, R-8, R-37 |
+| writer-tier side-car | `vp-writer-tier.csv` beside the VP oracle (or `--writer-tier <file>`), joined on `outil`; absent => R-10 could-not-judge, file named | R-10 |
+| oracle-CSV (Axis-1) | VP oracle **vs** the VR inventory `.backend-doctor/vr-by-tool.csv` (or `--vr-oracle <file>`) | R-40 |
 | source-tree | the real `convex/` source (live path, or `fixtures/vp-convex/` in CI) | R-6, R-11, R-16..R-36 |
 | standard-document | the vendored standard + the four MCP-family docs | R-14, R-15, R-32, R-38, R-39, R-41, R-42 |
 
@@ -33,6 +34,8 @@ backend-doctor is its **own tool** (own package `@vantageos/backend-doctor`, own
 
 ```bash
 npx --yes @vantageos/backend-doctor@<version> <path-to-a-convex-backend>
+# <path> may be the repo root or its convex/ dir: both are normalised to the repo root
+# (nearest package.json/.git) and produce identical results. --version / --help are supported.
 ```
 
 Do not type a stale version as the only pin — read the current one from the registry, never from this README:
@@ -55,6 +58,8 @@ npm test                                          # the detector suite (RED-firs
 npx tsc --noEmit
 ```
 
+`node dist/cli.js` refuses to run (exit 2) when the `dist/` it runs from was compiled from different source than the checkout's `src/`: `npm run build` stamps `dist/build-stamp.json` with a sha256 of `src/**/*.ts`, and the CLI recomputes it before reading anything (`src/build-stamp.ts`). A gate that must not depend on a build step runs from source (`npx tsx src/cli.ts`). An installed package has no `src/` and is identified by its version.
+
 ### The verdict, the tally, and the exit code (D6)
 
 The CLI prints a **machine tally** — the four rule states (`present` / `non-conforming` / `could-not-judge` / `absent`) counted **by code** from the detector results and asserted to sum to the derived rule count (the coverage denominator, never a typed number). No human ever counts rows (the eyeballed-distribution defect is closed). The tally is over **rules** (one worst-state per rule); the printed line also names the raw result count so the two are never confused.
@@ -77,6 +82,18 @@ Verdict mapping, computed from the tally (major = major-high + major):
 
 A `could-not-judge` rule is an **abstention** — a human verdict is owed, never a silent approve; any abstention blocks `approve`, and an abstention on a **critical** rule is reported first. The exit code preserves the engine's honesty (and cross-checks `@vantageos/mcp-doctor`'s `computeExitCode`): **1** = a hard violation (≥1 critical, or any major violation); **2** = a human verdict owed with no hard violation (an abstention — never a clean 0); **0** = approve. `approve` is never printed on an exit that means abstention.
 
+### CR-1 — caller resolution on the exposed surface (doctor-owned, CRITICAL)
+
+Alongside the numbered rules the CLI renders a **CALLER RESOLUTION (CR-1)** section answering one question per registration: **does this public registration resolve its caller before serving or writing data?**
+
+- **Population is the exposed surface itself**, derived from the target tree's own `convex/_generated/api.d.ts` — never a hand-written list and never a pattern over argument names. `internal*`/`httpAction` are excluded and the exclusion is **proven per site** from the builder token on that line. The count classified must **equal** the count exposed; a discrepancy is reported as CR-1's own bug.
+- **Four classes, and every member is named**: `RESOLVES` / `FAIL-OPEN` / `NO-IDENTITY` / `NO-DATA`. `FAIL-OPEN` and unjustified `NO-IDENTITY`/`NO-DATA` are mechanical violations and the gate refuses on them (exit 1).
+- **The only exit is a token in the target source**, `allow-no-caller-resolution: <reason>`, read at the registration. There is no exemption list, no baseline and no tolerated count — `FAIL-OPEN` has no token exit at all.
+- **It asks whether the caller is RESOLVED, never whether a refusal is shaped correctly.** That second question is R-50/R-51's; a handler with no guard has nothing to throw, so it cannot fail a rule about throwing.
+- On a tree that exposes nothing it reports **no applicable site**, never a count.
+
+**CR-1 is NOT one of the numbered rules** in the pinned standard, so it is not in `src/registry.ts` and the 50-of-50 coverage line is unchanged: registering an id the vendored standard does not define would make `coverage.ts` report a phantom rule. Numbering it upstream (proposed **R-52**) is a separate change to the standard document in its own repository. Source and rationale: `src/caller-resolution.ts`.
+
 ## Pins
 
 Every input is pinned and, where it is a vendored document, proven byte-identical to its upstream git blob (an un-hashable vendored doc is an authority granted to oneself).

package/dist/args.d.ts

@@ -0,0 +1,16 @@
+export declare const USAGE = "usage: backend-doctor [<target>] [--oracle <csv>] [--vr-oracle <csv>] [--writer-tier <csv>]\n       backend-doctor --version | --help\n\n  <target>   the repository root or its convex/ dir (default: the current dir).\n             Both name the same backend: paths are normalised to the repo root\n             (nearest dir holding package.json or .git), so the counts are identical.\n  --oracle, --vr-oracle, --writer-tier\n             explicit oracle CSVs; by default they are read from\n             <repo>/convex/.backend-doctor/ or <repo>/.backend-doctor/ \u2014 never from\n             above the repo root and never from this tool's bundled fixtures.\n  --version  print the tool version and exit 0.\n  --help     print this text and exit 0.\n\nexit: 0 approve, 1 a violation / revise, 2 the run could not judge (bad usage,\nunreadable target, stale build, unreadable standard).";
+export type ParsedArgs = {
+    kind: "run";
+    positional: string[];
+    flags: Record<string, string>;
+} | {
+    kind: "version";
+} | {
+    kind: "help";
+} | {
+    kind: "usage-error";
+    message: string;
+};
+/** Flag reader. `--version`/`--help` win over everything else; an unknown flag or
+ * a value flag with no value is a usage error (exit 2) — never a path. */
+export declare function parseArgs(argv: string[]): ParsedArgs;

package/dist/args.js

@@ -0,0 +1,54 @@
+// CLI argument parsing, kept apart from cli.ts (which runs main() on import) so the
+// flag contract is testable without spawning a process.
+const VALUE_FLAGS = new Set(["oracle", "vr-oracle", "writer-tier"]);
+export const USAGE = `usage: backend-doctor [<target>] [--oracle <csv>] [--vr-oracle <csv>] [--writer-tier <csv>]
+       backend-doctor --version | --help
+
+  <target>   the repository root or its convex/ dir (default: the current dir).
+             Both name the same backend: paths are normalised to the repo root
+             (nearest dir holding package.json or .git), so the counts are identical.
+  --oracle, --vr-oracle, --writer-tier
+             explicit oracle CSVs; by default they are read from
+             <repo>/convex/.backend-doctor/ or <repo>/.backend-doctor/ — never from
+             above the repo root and never from this tool's bundled fixtures.
+  --version  print the tool version and exit 0.
+  --help     print this text and exit 0.
+
+exit: 0 approve, 1 a violation / revise, 2 the run could not judge (bad usage,
+unreadable target, stale build, unreadable standard).`;
+/** Flag reader. `--version`/`--help` win over everything else; an unknown flag or
+ * a value flag with no value is a usage error (exit 2) — never a path. */
+export function parseArgs(argv) {
+    if (argv.some((a) => a === "--version" || a === "-V" || a === "-v"))
+        return { kind: "version" };
+    if (argv.some((a) => a === "--help" || a === "-h"))
+        return { kind: "help" };
+    const positional = [];
+    const flags = {};
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a.startsWith("-") && a !== "-") {
+            const body = a.replace(/^--?/, "");
+            const eq = body.indexOf("=");
+            const name = eq === -1 ? body : body.slice(0, eq);
+            if (!a.startsWith("--") || !VALUE_FLAGS.has(name)) {
+                return { kind: "usage-error", message: `unknown flag ${a}` };
+            }
+            if (eq !== -1)
+                flags[name] = body.slice(eq + 1);
+            else if (argv[i + 1] !== undefined && !argv[i + 1].startsWith("--"))
+                flags[name] = argv[++i];
+            else
+                return { kind: "usage-error", message: `flag ${a} needs a value` };
+        }
+        else
+            positional.push(a);
+    }
+    if (positional.length > 1) {
+        return {
+            kind: "usage-error",
+            message: `expected at most one target, got ${positional.length}: ${positional.join(" ")}`,
+        };
+    }
+    return { kind: "run", positional, flags };
+}

package/dist/build-stamp.d.ts

@@ -0,0 +1,13 @@
+export declare const STAMP_FILE = "build-stamp.json";
+/** sha256 over every `.ts` under `srcDir`: sorted relative path + NUL + bytes. */
+export declare function sourceDigest(srcDir: string): string;
+export type Freshness = {
+    ok: true;
+    mode: "source" | "installed" | "fresh-dist";
+} | {
+    ok: false;
+    reason: string;
+};
+/** Judge the build the CLI is running from. `here` is the directory of the
+ * running module (`dist/` when built, `src/` under tsx). */
+export declare function checkDistFreshness(here: string): Freshness;

package/dist/build-stamp.js

@@ -0,0 +1,76 @@
+// The dist-freshness guard. A gate verdict is a claim about a tree made BY a
+// specific instrument; when `dist/` was compiled from an older `src/` than the
+// checkout it sits in, the verdict silently comes from code nobody is reading
+// (measured: an installed dist built 2026-09-30 judging with detectors that
+// source 60780e6 of 2026-10-01 had already changed).
+//
+// CHOICE — refuse, by CONTENT, not warn by mtime:
+//  - `npm run build` stamps `dist/build-stamp.json` with a sha256 over every
+//    `src/**/*.ts` (path + bytes, sorted). The CLI, when it runs from `dist/` and a
+//    sibling `src/` exists (a checkout), recomputes that digest and REFUSES (exit 2)
+//    on a mismatch or a missing stamp, naming both digests and the two fixes.
+//  - A content digest is immune to what makes mtime useless here: `git checkout`
+//    rewrites mtimes, and a rebuild with no source change must not trip it.
+//  - A warning was rejected: the doctor's verdict line is read by gates, not by a
+//    human watching stderr, so a warning beside a verdict is still a verdict.
+//  - "Document that the gate runs from source" was rejected as the ONLY control:
+//    it is the rule that was already being followed when the stale dist ran.
+//  - An installed package (no sibling `src/`) is not checked: there the published
+//    version IS the instrument's identity, and the tarball carries no source.
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { basename, join, relative } from "node:path";
+export const STAMP_FILE = "build-stamp.json";
+/** sha256 over every `.ts` under `srcDir`: sorted relative path + NUL + bytes. */
+export function sourceDigest(srcDir) {
+    const files = [];
+    const walk = (dir) => {
+        for (const name of readdirSync(dir)) {
+            const full = join(dir, name);
+            if (statSync(full).isDirectory())
+                walk(full);
+            else if (name.endsWith(".ts"))
+                files.push(full);
+        }
+    };
+    walk(srcDir);
+    const h = createHash("sha256");
+    for (const f of files.map((x) => relative(srcDir, x)).sort()) {
+        h.update(f);
+        h.update("\0");
+        h.update(readFileSync(join(srcDir, f)));
+        h.update("\0");
+    }
+    return h.digest("hex");
+}
+/** Judge the build the CLI is running from. `here` is the directory of the
+ * running module (`dist/` when built, `src/` under tsx). */
+export function checkDistFreshness(here) {
+    if (basename(here) !== "dist")
+        return { ok: true, mode: "source" };
+    const src = join(here, "..", "src");
+    if (!existsSync(src))
+        return { ok: true, mode: "installed" };
+    const stampPath = join(here, STAMP_FILE);
+    const current = sourceDigest(src);
+    if (!existsSync(stampPath)) {
+        return {
+            ok: false,
+            reason: `dist/ carries no ${STAMP_FILE}, so which source it was compiled from cannot be shown (current src sha256 ${current.slice(0, 12)}). Rebuild with \`npm run build\`, or run from source: \`npx tsx src/cli.ts <target>\`.`,
+        };
+    }
+    let stamped;
+    try {
+        stamped = JSON.parse(readFileSync(stampPath, "utf8")).sourceDigest;
+    }
+    catch {
+        stamped = undefined;
+    }
+    if (stamped !== current) {
+        return {
+            ok: false,
+            reason: `dist/ is STALE: compiled from src sha256 ${String(stamped).slice(0, 12)}, the checkout's src is ${current.slice(0, 12)}. A verdict from this build would come from code that is no longer the source. Rebuild with \`npm run build\`, or run from source: \`npx tsx src/cli.ts <target>\`.`,
+        };
+    }
+    return { ok: true, mode: "fresh-dist" };
+}

package/dist/build-stamp.json

@@ -0,0 +1,4 @@
+{
+  "sourceDigest": "f9c7040c0ed49bdf7a77370eeed51651d4556c1ec8a8f674c2ca8ffd55000592",
+  "builtAt": "2026-10-03T20:51:43.107Z"
+}

package/dist/caller-resolution.d.ts

@@ -0,0 +1,222 @@
+import type { Detector, DetectorResult, Tree } from "./engine-types.js";
+export type SrcFile = Tree["files"][number];
+export type SrcLine = SrcFile["lines"][number];
+/** The four classes. Every exposed public registration lands in exactly one. */
+export type CallerClass = "RESOLVES" | "FAIL-OPEN" | "NO-IDENTITY" | "NO-DATA" | "COULD-NOT-JUDGE";
+export interface Registration {
+    /** the api module key the registration is exposed under, e.g. `tasks`. */
+    module: string;
+    /** the exported name, e.g. `listUnlinkedBlocked`. */
+    name: string;
+    /** the api path a caller addresses, e.g. `tasks:listUnlinkedBlocked`. */
+    api: string;
+    rel: string;
+    /** 1-based line of the `export const NAME = <builder>(` opener. */
+    n: number;
+    /** the builder token READ AT THIS SITE — the per-site exclusion proof. */
+    builder: string;
+}
+export interface Finding extends Registration {
+    cls: CallerClass;
+    /** why it landed in that class — the discriminator(s), named. */
+    why: string;
+    /** true when a justification token in the target source cleared the finding. */
+    justified?: boolean;
+}
+export interface CallerResolutionScan {
+    /** api.d.ts module key -> file rel path, derived from the target's own api.d.ts. */
+    exposedModules: Map<string, string>;
+    /** how the population was obtained, for the cross-check line. */
+    populationSource: string;
+    /** every public registration, classified. */
+    findings: Finding[];
+    /** `internal*` / httpAction sites, each with the builder token observed. */
+    excluded: Registration[];
+    /** CR-1's OWN defects: population drift, an unreadable api.d.ts, an
+     *  undelimitable block, an unresolvable builder. Never a silent pass. */
+    selfDefects: string[];
+    /** the cross-check: exposed public registrations vs. classified findings. */
+    exposedCount: number;
+    classifiedCount: number;
+}
+export interface ApiSurface {
+    modules: Map<string, string>;
+    /** set when the surface could NOT be derived — never a silent empty. */
+    unreadable?: string;
+}
+/**
+ * Derive the exposed module surface from `<root>/_generated/api.d.ts`. The engine's
+ * loadTree excludes `_generated/`, so this reads the file from the target root —
+ * the same target the CLI was pointed at, never the tool's own install directory
+ * (the defect that let five oracle-scored rules present a frozen CSV count as a
+ * verdict on a tree they never opened).
+ */
+export declare function deriveApiSurface(root: string, read?: (p: string) => string): ApiSurface;
+export interface BuilderMap {
+    /** builder name -> the public base it produces. */
+    publicBuilders: Map<string, string>;
+    /** builder name -> the non-public base it produces. */
+    nonPublicBuilders: Map<string, string>;
+    /** a `custom*` wrapper whose base resolves to neither — CR-1 refuses on these. */
+    unresolvable: {
+        rel: string;
+        n: number;
+        name: string;
+        base: string;
+    }[];
+}
+/** a file CR-1 judges — never a test, never generated. */
+export declare function isJudgeable(f: SrcFile): boolean;
+/**
+ * Discover every registration BUILDER the tree declares, so a `customQuery(query,…)`
+ * wrapper is recognised as public and a `customQuery(internalQuery,…)` wrapper as
+ * not. A wrapper whose base resolves to neither leaves the exposed surface
+ * unknowable → CR-1 refuses (never a silent green).
+ */
+export declare function discoverBuilders(files: SrcFile[]): BuilderMap;
+/**
+ * Everything CR-1 knows about the tree's own helpers, DERIVED from the tree.
+ *
+ * KEYS ARE `rel::name`, NEVER a bare name, and a reference resolves ONLY inside the
+ * referencing module's SCOPE (what it declares plus what it imports). A single flat
+ * namespace is not a looseness here, it is a SILENT GREEN: `get`, `list`, `create`
+ * and `accept` are declared in many modules of this tree, so a flat
+ * `\bget\s*\(` test reported `search:searchFixPatterns` — which resolves nothing
+ * and hardcodes its namespace — as "consults the verified principal (get())".
+ * Measured on run 6; this shape is the fix.
+ */
+export interface IdentityModel {
+    /** `rel::name` of every function whose body consults the verified principal,
+     *  directly (`ctx.auth.getUserIdentity()`) or transitively. */
+    helpers: Set<string>;
+    /**
+     * The subset of `helpers` that REFUSE on the absent-identity path — a GATE. A
+     * gate decides by throwing, so calling it as a bare statement (`await
+     * requireOrgAdmin(ctx)`) is the fail-closed idiom and NOT a discarded principal.
+     * Only a RESOLVER — a helper that returns a value the handler must then use —
+     * can have its result computed and discarded. Conflating the two made the rule
+     * accuse 30 correctly master-gated mutations on its second run.
+     */
+    gates: Set<string>;
+    /**
+     * Functions that TOUCH DATA, transitively. A registration whose handler reads
+     * nothing itself but delegates to a module-local helper that does IS serving
+     * data — `tasks:list` (`return await runTasksList(ctx, args, scope)`) and
+     * `search:searchFixPatterns` (`await ragSearch(ctx, {…})`) both do exactly that,
+     * and a non-transitive data test filed all of them under NO-DATA on run 5,
+     * which would have been a silent pass on real read paths.
+     */
+    dataFns: Set<string>;
+    /**
+     * Identity helpers whose absent-identity branch GRANTS — a bare `return;` that
+     * lets the caller proceed. `okfBundleNode.ts::assertCanValidate` is exactly this:
+     * `if (identity === null || identity === undefined) { return; }` with the comment
+     * "CLI / deploy-key — server-trusted path". Calling such a helper is not a gate at
+     * all on the path that matters, so a handler whose only authority is one of these
+     * is FAIL-OPEN, and CR-1 says so in those words rather than under the vaguer
+     * "computed and discarded" reason.
+     */
+    permissiveOnAbsence: Map<string, string>;
+    /** the keys that are REGISTRATIONS: reachable ONLY as `internal.…`/`api.…`. */
+    regNames: Set<string>;
+    /** rel -> the local names that module DECLARES or IMPORTS. */
+    scopes: Map<string, Set<string>>;
+    /** identity helpers whose absent-identity branch can return a PRIVILEGED shape
+     *  when an opt-in flag is passed. flag name -> where it was found. */
+    privilegeOnAbsenceFlags: Map<string, string>;
+    /**
+     * VALUE REFUSERS — plain functions that RECEIVE an already-resolved value as a
+     * parameter and THROW on a test of it: `requireTenantNamespace(scope, ns, door)`
+     * at vantage-peers 58ed649 `convex/lib/auth.ts:1286`, which delegates to
+     * `requireResolvedCaller(scope, …)` (`if (scope.anonymous) throw …`). Keyed
+     * `rel::name` -> the parameter POSITIONS refused on, because only a resolved
+     * value passed AT that position is refused. See `deriveValueRefusers` for what
+     * qualifies and what disqualifies.
+     */
+    refuserParams: Map<string, Set<number>>;
+}
+/** the `name` half of a `rel::name` key. */
+export declare function nameOf(key: string): string;
+/** the `rel` half of a `rel::name` key. */
+export declare function relOf(key: string): string;
+export interface Ref {
+    name: string;
+    /** true when only a qualified `internal.…`/`api.…` reference may match it. */
+    qualified: boolean;
+}
+/**
+ * The members of `set` that a handler in `rel` can actually reach: a plain function
+ * declared in `rel` or imported by `rel`, or a registration (reachable from anywhere,
+ * but only through its qualified `internal.…`/`api.…` name).
+ */
+export declare function reachable(model: IdentityModel, set: Set<string>, rel: string): Ref[];
+/** the refs in `refs` that `text` actually references. */
+export declare function referenced(text: string, refs: Ref[]): Ref[];
+export declare function deriveIdentityModel(files: SrcFile[]): IdentityModel;
+/**
+ * `name` is REFERENCED in `text` — called (`name(`) or passed as a value
+ * (`internal.lib.auth.resolveOrgScopeForAction,`). The second form is how an action
+ * reaches a resolver, so a call-only test is blind to the whole action surface.
+ */
+export declare function references(text: string, name: string, qualified?: boolean): boolean;
+/** Every `if (...)` in `text`, with its brace-balanced condition source. */
+export declare function ifConditions(text: string): {
+    index: number;
+    cond: string;
+    end: number;
+}[];
+/**
+ * ABSENT-IDENTITY GUARD — an `if` whose condition tests `v` ITSELF for absence:
+ * `!v`, `v === null`, `v == null`, `v === undefined`, including as one disjunct of a
+ * widened test (`if (identity === null || identity === undefined)`, the real
+ * `assertCanExportNamespace` shape). It must NOT match a test on a PROPERTY of `v`
+ * (`if (!scope.isMaster)` is an authority test on a RESOLVED principal, not a test
+ * for its absence) — reading those as absence accused every correctly-scoped
+ * dashboard query on the first run of this rule.
+ */
+export declare function absentGuard(text: string, v: string): {
+    index: number;
+    branch: string;
+} | null;
+/**
+ * The GUARDED BRANCH itself, from just after an `if (…)`'s closing paren: a braced
+ * block to its matching brace, else the single statement up to its `;`. Reading a
+ * fixed-width window instead runs past the branch into the rest of the handler, and
+ * that is not a width error — it INVERTS the verdict: `if (ns === null) return [];`
+ * followed by the normal data path read as "the absent-identity branch serves data",
+ * which accused all three `search:*` actions that in fact refuse first (measured).
+ */
+export declare function branchAfter(text: string, from: number): string;
+export interface Classified {
+    cls: CallerClass;
+    why: string;
+    justified?: boolean;
+}
+/**
+ * Classify ONE registration from its own block text. `pre` is the comment context
+ * immediately above the opener (a justification token may sit there or inside).
+ *
+ * ORDER MATTERS and is the rule's logic:
+ *   no data touched                        -> NO-DATA      (token required)
+ *   data touched, principal never consulted-> NO-IDENTITY  (token required)
+ *   principal consulted but not decisive   -> FAIL-OPEN    (NO token exit)
+ *   otherwise                              -> RESOLVES
+ */
+export declare function classify(codeText: string, fullText: string, pre: string, model: IdentityModel, rel: string): Classified;
+/** The exposed surface for a tree, with module rels in the TREE's rel space: a
+ * tree rooted at the repository (src/target.ts) carries `convex/` on every convex
+ * rel, while api.d.ts names modules relative to the convex dir. */
+export declare function surfaceForTree(tree: Tree): ApiSurface;
+export declare function scanCallerResolution(tree: Tree, surface?: ApiSurface): CallerResolutionScan;
+export declare const CR1_ID = "CR-1 a public registration resolves its caller before serving or writing data";
+export declare function byClass(scan: CallerResolutionScan, cls: CallerClass): Finding[];
+/** the findings that are VIOLATIONS: fail-open, plus unjustified no-identity/no-data. */
+export declare function violations(scan: CallerResolutionScan): Finding[];
+export declare function abstentions(scan: CallerResolutionScan): Finding[];
+export declare function callerResolutionResult(scan: CallerResolutionScan): DetectorResult;
+/** The rendered section. EVERY member of EVERY class is named — the truncation that
+ *  let R-50 classify thirteen of the fourteen and show a reader none of them is the
+ *  defect this renderer refuses to repeat. */
+export declare function callerResolutionSection(scan: CallerResolutionScan): string;
+/** CR-1 as an engine Detector, for tests and for a future registry slot. */
+export declare const CR1: Detector;