@basaltkit/ai 0.10.0 → 0.11.0

package/dist/index.js

@@ -364,7 +364,16 @@ function detectAppFile(reader) {
     (factory) => new RegExp(`\\b${factory}\\s*\\(`).test(found.content)
   );
   const fastifyLoggerConfigured = /fastify\s*:\s*\{[^}]*\blogger\b/.test(found.content);
-  const memorySources = ["MemoryTenantSource", "MemoryUserSource"].filter(
+  const memorySources = [
+    "MemoryTenantSource",
+    "MemoryUserSource",
+    // Security-critical in-memory stores: auth/authorization/domain state that
+    // must survive restarts and be shared across instances in production.
+    "MemoryPasskeyStore",
+    "MemoryWebAuthnChallengeStore",
+    "MemoryAccessStore",
+    "MemoryDomainStore"
+  ].filter(
     (source) => found.content.includes(source)
   );
   const pluginCalls = [
@@ -631,6 +640,31 @@ var DEFAULT_RULES = [
         docs: "/guide/configuration"
       };
     }
+  }),
+  defineRule({
+    id: "in-memory-security-store",
+    category: "security",
+    check(ctx) {
+      const SECURITY_STORES = {
+        MemoryPasskeyStore: "WebAuthn passkeys",
+        MemoryWebAuthnChallengeStore: "WebAuthn challenges",
+        MemoryAccessStore: "roles & permissions",
+        MemoryDomainStore: "verified custom domains"
+      };
+      const hit = (ctx.app?.memorySources ?? []).find((source) => source in SECURITY_STORES);
+      if (!hit) return null;
+      return {
+        id: "in-memory-security-store",
+        title: "Security state is kept in an in-memory store",
+        severity: "warning",
+        category: "security",
+        detected: `${hit} holds ${SECURITY_STORES[hit]} in memory.`,
+        recommended: "Back it with a durable store (database/Redis) in production.",
+        reason: "In-memory security stores are wiped on restart and are not shared across instances \u2014 passkeys/permissions/verified domains would silently reset or diverge per replica, which can lock users out or bypass authorization.",
+        fix: `// swap ${hit} for a durable implementation of the same interface`,
+        docs: "/guide/security"
+      };
+    }
   })
 ];
 var GLOBAL_MODELS = /* @__PURE__ */ new Set(["Tenant", "User", "Plan", "WebhookEvent", "Migration"]);
@@ -2050,7 +2084,7 @@ function renderDoctor(diagnostics, io) {
     }
     if (d.docs) {
       io.log("");
-      io.log(`  Docs: https://basalt.dev${d.docs}`);
+      io.log(`  Docs: https://basaltkit.dev${d.docs}`);
     }
     io.log("");
     io.log("  " + "\u2500".repeat(60));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/ai",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "AI-native developer experience for Basalt: a provider-agnostic engine plus `basalt ai` CLI that understands the project's stack, analyzes it, and diagnoses issues — following the framework's own conventions, not inventing new ones.",
   "license": "MIT",
   "type": "module",
@@ -14,7 +14,7 @@
     "dist"
   ],
   "dependencies": {
-    "@basaltkit/cli": "^1.0.0",
+    "@basaltkit/cli": "^1.2.0",
     "@basaltkit/generator": "^1.1.1"
   },
   "devDependencies": {