fix: address PR #40 review feedback (middleware leak + TSS-7 robustness)

- src/server/access/middleware.ts (HIGH): move setResponseStatus +
  logger into dynamic imports inside the .server() body. middleware.ts
  is reachable from start.ts, so top-level imports of
  @tanstack/react-start/server and ~/utils/logger (which pulls Axiom)
  would leak server-only code into the client bundle — exactly the
  TSS-2 class this initiative targets, and a violation of our own
  SKILL.md dynamic-import rule. logger.info/error are module-scope
  closures (no `this`), so the destructure-to-logFn stays safe.

- scripts/check-tss-7.sh (MEDIUM x3):
  - is_exempt now uses leading-`*` glob so ./-prefixed $CHANGED
    paths (git diff --name-only) still match the exemptions.
  - getRequest regex tolerates whitespace: `getRequest ()`,
    `getRequest( )`.
  - auth.api.getSession regex tolerates whitespace: `getSession  (`.

Verified: whitespace-variant fixtures now caught; ./-prefixed exempt
paths still skipped; check-types + biome + 62 unit tests green.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Enalmada

scripts/check-tss-7.sh

@@ -48,14 +48,16 @@ fi
 # Helper modules + test setup are by design exempt — they ARE the
 # canonical helpers, or they configure the global test mock.
 is_exempt() {
+	# Leading `*` so `./src/...`-prefixed paths (e.g. from `git diff
+	# --name-only` in $CHANGED diff-mode) still match the exemptions.
 	case "$1" in
-		src/server/auth/request.ts) return 0 ;;
-		src/server/auth/session.ts) return 0 ;;
-		src/server/auth/auth.ts) return 0 ;;
-		src/test/setup.ts) return 0 ;;
-		src/utils/test/playwright.ts) return 0 ;;
+		*src/server/auth/request.ts) return 0 ;;
+		*src/server/auth/session.ts) return 0 ;;
+		*src/server/auth/auth.ts) return 0 ;;
+		*src/test/setup.ts) return 0 ;;
+		*src/utils/test/playwright.ts) return 0 ;;
 		# Better Auth route handler — different dispatch path
-		src/routes/api/*) return 0 ;;
+		*src/routes/api/*) return 0 ;;
 	esac
 	return 1
 }
@@ -70,8 +72,9 @@ for f in $files; do
 	# typically JSDoc rationale that explicitly mentions the bypassed call
 	# while explaining why the helper exists.
 	#
-	# Bare getRequest() — allow getSessionRequest references via grep -v
-	bare=$(grep -nE 'getRequest\(\)' "$f" 2>/dev/null \
+	# Bare getRequest() — allow getSessionRequest references via grep -v.
+	# Tolerate whitespace variants: `getRequest ()`, `getRequest( )`.
+	bare=$(grep -nE 'getRequest[[:space:]]*\([[:space:]]*\)' "$f" 2>/dev/null \
 		| grep -vE '^[0-9]+:[[:space:]]*(//|\*|/\*)' \
 		| grep -v 'getSessionRequest' \
 		|| true)
@@ -81,8 +84,8 @@ for f in $files; do
 		printf '%s\n' "$bare" | sed 's/^/    /'
 	fi
 
-	# Direct auth.api.getSession( call
-	direct=$(grep -nE 'auth\.api\.getSession\(' "$f" 2>/dev/null \
+	# Direct auth.api.getSession( call. Tolerate whitespace: `getSession  (`.
+	direct=$(grep -nE 'auth\.api\.getSession[[:space:]]*\(' "$f" 2>/dev/null \
 		| grep -vE '^[0-9]+:[[:space:]]*(//|\*|/\*)' \
 		|| true)
 	if [ -n "$direct" ]; then

src/server/access/middleware.ts

@@ -13,17 +13,22 @@
  */
 
 import { createMiddleware } from "@tanstack/react-start";
-import { setResponseStatus } from "@tanstack/react-start/server";
-import { logger } from "~/utils/logger";
 import { hasHttpErrorHints } from "./http-errors";
 
 export const authErrorTranslator = createMiddleware({ type: "function" }).server(async ({ next }) => {
 	try {
 		return await next();
 	} catch (err) {
 		if (hasHttpErrorHints(err)) {
+			// Dynamic imports: middleware.ts is reachable from start.ts, so
+			// top-level imports of `@tanstack/react-start/server` and
+			// `~/utils/logger` (which pulls in Axiom) would leak server-only
+			// code into the client bundle (TSS-2). Load them inside the
+			// server-only `.server()` body instead.
+			const { setResponseStatus } = await import("@tanstack/react-start/server");
 			setResponseStatus(err.httpStatus);
 			// Log server-side for Axiom correlation (4xx info, 5xx error).
+			const { logger } = await import("~/utils/logger");
 			const logFn = err.httpStatus >= 500 ? logger.error : logger.info;
 			logFn(`[authErrorTranslator] ${err.name}`, {
 				message: err.message,