@basaltkit/ai 0.10.0 → 1.0.0

package/README.md

@@ -5,9 +5,10 @@ AI-native developer experience for Basalt. A provider-agnostic engine plus a
 diagnoses issues — following the framework's own conventions instead of inventing
 new ones.
 
-> **Status: 0.1 (foundation).** This release ships the provider abstraction and
-> the read-only `ai:analyze` / `ai:doctor` commands. Natural-language planning and
-> scaffolding (`ai:plan`, `ai:make`) build on this foundation in later phases.
+> **Status: 1.0 (stable).** The provider abstraction and the full `basalt ai`
+> command surface — `ai:analyze`, `ai:doctor`, `ai:plan`, `ai:make`, `ai:review` —
+> are settled and covered by semver: breaking changes land only in a new major.
+> The AI layer stays **dev-only** — it is never a runtime dependency of your app.
 
 ## Install
 

package/dist/analyze/run.d.ts

@@ -0,0 +1,19 @@
+import type { ProjectContext } from '../context/project.js';
+import type { Diagnostic } from '../doctor/types.js';
+export interface AnalysisReport {
+    root: string;
+    /** Human-readable capability lines, e.g. `'Fastify detected'`. */
+    capabilities: string[];
+    installed: string[];
+    database: string | null;
+    models: string[];
+    tenantScopedModels: string[];
+    unscopedModels: string[];
+    /** Diagnostics from the doctor rules, summarised into the report. */
+    diagnostics: Diagnostic[];
+}
+/**
+ * Static, offline analysis of a project: what's wired, the data model, and the
+ * doctor's findings — the data behind the `ai:analyze` report.
+ */
+export declare function analyze(ctx: ProjectContext): AnalysisReport;

package/dist/analyze/run.js

@@ -0,0 +1,58 @@
+import { runDoctor } from '../doctor/run.js';
+/**
+ * Static, offline analysis of a project: what's wired, the data model, and the
+ * doctor's findings — the data behind the `ai:analyze` report.
+ */
+export function analyze(ctx) {
+    const { stack, prisma } = ctx;
+    const capabilities = [];
+    if (stack.http === 'fastify')
+        capabilities.push('Fastify detected');
+    if (stack.orm === 'prisma')
+        capabilities.push('Prisma detected');
+    if (stack.database)
+        capabilities.push(`${databaseLabel(stack.database)} detected`);
+    if (stack.tenancy)
+        capabilities.push('Tenancy enabled');
+    if (stack.auth)
+        capabilities.push('Authentication enabled');
+    if (stack.rbac)
+        capabilities.push('RBAC enabled');
+    if (stack.subscriptions)
+        capabilities.push('Subscriptions enabled');
+    if (stack.payments)
+        capabilities.push('Payments enabled');
+    if (stack.queue)
+        capabilities.push('Queue enabled');
+    if (stack.search)
+        capabilities.push('Search enabled');
+    if (stack.audit)
+        capabilities.push('Audit enabled');
+    if (stack.events)
+        capabilities.push('Events enabled');
+    if (stack.scheduler)
+        capabilities.push('Scheduler enabled');
+    if (stack.storage)
+        capabilities.push('Storage enabled');
+    const models = prisma?.models ?? [];
+    return {
+        root: ctx.root,
+        capabilities,
+        installed: ctx.installed,
+        database: stack.database,
+        models: models.map((m) => m.name),
+        tenantScopedModels: models.filter((m) => m.tenantScoped).map((m) => m.name),
+        unscopedModels: models.filter((m) => !m.tenantScoped).map((m) => m.name),
+        diagnostics: runDoctor(ctx),
+    };
+}
+function databaseLabel(db) {
+    switch (db) {
+        case 'postgresql':
+            return 'PostgreSQL';
+        case 'mysql':
+            return 'MySQL';
+        case 'sqlite':
+            return 'SQLite';
+    }
+}

package/dist/commands.d.ts

@@ -0,0 +1,19 @@
+import { type CommandDefinition } from '@basaltkit/cli';
+export interface AiCommandsOptions {
+    /** Project root to analyze. Defaults to the current working directory. */
+    cwd?: string;
+}
+/**
+ * CLI commands for the AI-native DX (foundation phase):
+ *
+ * - `basalt ai`          — overview: detected stack + what the agent can do
+ * - `basalt ai:analyze`  — static analysis report (read-only, offline)
+ * - `basalt ai:doctor`   — diagnostics with fixes (read-only, offline; exits 1 on errors)
+ * - `basalt ai:fix`      — apply a doctor fix, or all auto-fixable ones (offline; --dry-run/--yes)
+ * - `basalt ai:plan`     — natural language → architecture plan (read-only; needs a provider)
+ * - `basalt ai:make`     — plan then implement: scaffold + domain fields, review gate (writes; needs a provider)
+ *
+ * Wire them in like the generator commands:
+ * `commandsPlugin([...generatorCommands(), ...aiCommands()])`.
+ */
+export declare function aiCommands(options?: AiCommandsOptions): CommandDefinition[];

package/dist/commands.js

@@ -0,0 +1,272 @@
+import { defineCommand } from '@basaltkit/cli';
+import { analyze } from './analyze/run.js';
+import { detectProject, nodeReader } from './context/project.js';
+import { hasErrors, runDoctor } from './doctor/run.js';
+import { applyFixEdits, fixableIds, planFix, renderFixes } from './doctor/fixes.js';
+import { createProvider, providerEnvFromProcess } from './provider/factory.js';
+import { createPlan } from './plan/plan.js';
+import { renderPlan } from './plan/render.js';
+import { runMake } from './make/make.js';
+import { renderMakeResult } from './make/render.js';
+import { runPrismaPush } from './make/schema.js';
+import { verifyProject } from './make/verify.js';
+import { reviewImplementation } from './review/review.js';
+import { renderAgentReview } from './review/render.js';
+import { renderAnalysis, renderDoctor } from './render.js';
+/**
+ * CLI commands for the AI-native DX (foundation phase):
+ *
+ * - `basalt ai`          — overview: detected stack + what the agent can do
+ * - `basalt ai:analyze`  — static analysis report (read-only, offline)
+ * - `basalt ai:doctor`   — diagnostics with fixes (read-only, offline; exits 1 on errors)
+ * - `basalt ai:fix`      — apply a doctor fix, or all auto-fixable ones (offline; --dry-run/--yes)
+ * - `basalt ai:plan`     — natural language → architecture plan (read-only; needs a provider)
+ * - `basalt ai:make`     — plan then implement: scaffold + domain fields, review gate (writes; needs a provider)
+ *
+ * Wire them in like the generator commands:
+ * `commandsPlugin([...generatorCommands(), ...aiCommands()])`.
+ */
+export function aiCommands(options = {}) {
+    const rootOf = (flags) => typeof flags['dir'] === 'string' ? flags['dir'] : options.cwd ?? process.cwd();
+    return [
+        defineCommand({
+            name: 'ai',
+            description: 'AI-native DX overview: detected stack and available commands',
+            handle({ args, flags, io }) {
+                const ctx = detectProject(rootOf(flags));
+                const report = analyze(ctx);
+                renderAnalysis(report, io);
+                io.log('');
+                if (args.length > 0) {
+                    io.log(`You asked: "${args.join(' ')}"`);
+                    io.log('Natural-language planning & scaffolding (ai:plan / ai:make) land in the next phase.');
+                    io.log('');
+                }
+                io.log('Available now:');
+                io.log('  basalt ai:analyze          Static analysis report');
+                io.log('  basalt ai:doctor           Diagnostics with suggested fixes');
+                io.log('  basalt ai:fix [id]         Apply an auto-fixable diagnostic');
+                io.log('  basalt ai:plan "<request>" Architecture plan from a description');
+                io.log('  basalt ai:make "<request>" Plan + implement (scaffold + review gate)');
+                return 0;
+            },
+        }),
+        defineCommand({
+            name: 'ai:analyze',
+            description: 'Analyze the project: stack, data model and diagnostics (read-only)',
+            handle({ flags, io }) {
+                const ctx = detectProject(rootOf(flags));
+                renderAnalysis(analyze(ctx), io);
+                return 0;
+            },
+        }),
+        defineCommand({
+            name: 'ai:doctor',
+            description: 'Diagnose configuration, security and tenancy issues (read-only)',
+            handle({ flags, io }) {
+                const ctx = detectProject(rootOf(flags));
+                const diagnostics = runDoctor(ctx);
+                renderDoctor(diagnostics, io);
+                // Non-zero exit on errors so CI can gate on `basalt ai:doctor`.
+                return hasErrors(diagnostics) ? 1 : 0;
+            },
+        }),
+        defineCommand({
+            name: 'ai:fix',
+            description: 'Apply a doctor fix (or all auto-fixable issues). --dry-run to preview, --yes to skip confirm',
+            async handle({ args, flags, io }) {
+                const root = rootOf(flags);
+                const ctx = detectProject(root);
+                const read = (rel) => nodeReader(root).read(rel);
+                const id = args[0];
+                let outcomes;
+                if (id) {
+                    outcomes = [planFix(id, ctx, read)];
+                }
+                else {
+                    // No id: fix every currently-firing rule that has an auto-fixer.
+                    const firing = new Set(runDoctor(ctx).map((d) => d.id));
+                    const targets = fixableIds().filter((f) => firing.has(f));
+                    if (targets.length === 0) {
+                        io.log('Nothing to auto-fix. Run `basalt ai:doctor` for the full picture.');
+                        return 0;
+                    }
+                    outcomes = targets.map((f) => planFix(f, ctx, read));
+                }
+                renderFixes(outcomes, io);
+                const ready = outcomes.filter((o) => o.status === 'ready');
+                if (ready.length === 0) {
+                    // Nothing to write; exit 1 only if the user asked for an unfixable id.
+                    return id && outcomes[0]?.status === 'unfixable' ? 1 : 0;
+                }
+                if (flags['dry-run'] === true) {
+                    io.log('');
+                    io.log('Dry run — nothing written.');
+                    return 0;
+                }
+                if (flags['yes'] !== true) {
+                    const ok = await io.confirm(`Apply ${ready.length} fix(es)?`);
+                    if (!ok) {
+                        io.log('Aborted — nothing changed.');
+                        return 0;
+                    }
+                }
+                for (const outcome of ready)
+                    await applyFixEdits(outcome.edits, root);
+                io.log('');
+                io.log(`✓ Applied ${ready.length} fix(es). Review the changes and restart the server.`);
+                return 0;
+            },
+        }),
+        defineCommand({
+            name: 'ai:plan',
+            description: 'Turn a natural-language request into an architecture plan (read-only)',
+            async handle({ args, flags, io }) {
+                const request = args.join(' ').trim();
+                if (!request) {
+                    io.error('Usage: basalt ai:plan "<what you want to build>"');
+                    return 1;
+                }
+                let provider;
+                try {
+                    provider = createProvider(providerEnvFromProcess());
+                }
+                catch (error) {
+                    io.error(`ai:plan needs an AI provider — ${error.message}`);
+                    io.error('Set AI_API_KEY (AI_PROVIDER=anthropic) or run Ollama locally (AI_PROVIDER=ollama).');
+                    return 1;
+                }
+                const ctx = detectProject(rootOf(flags));
+                io.log('Planning...');
+                io.log('');
+                try {
+                    const plan = await createPlan(provider, ctx, request);
+                    renderPlan(plan, io);
+                    return 0;
+                }
+                catch (error) {
+                    io.error(error.message);
+                    return 1;
+                }
+            },
+        }),
+        defineCommand({
+            name: 'ai:make',
+            description: 'Plan then implement a feature: scaffold + domain fields, with a review gate',
+            async handle({ args, flags, io }) {
+                const request = args.join(' ').trim();
+                if (!request) {
+                    io.error('Usage: basalt ai:make "<what to build>" [--dry-run] [--yes] [--force] [--migrate|--no-migrate] [--review] [--verify]');
+                    return 1;
+                }
+                let provider;
+                try {
+                    provider = createProvider(providerEnvFromProcess());
+                }
+                catch (error) {
+                    io.error(`ai:make needs an AI provider — ${error.message}`);
+                    io.error('Set AI_API_KEY (AI_PROVIDER=anthropic) or run Ollama locally (AI_PROVIDER=ollama).');
+                    return 1;
+                }
+                const baseDir = rootOf(flags);
+                const ctx = detectProject(baseDir);
+                io.log('Planning...');
+                io.log('');
+                let plan;
+                try {
+                    plan = await createPlan(provider, ctx, request);
+                }
+                catch (error) {
+                    io.error(error.message);
+                    return 1;
+                }
+                renderPlan(plan, io);
+                io.log('');
+                // Agent review over the generated code — read-only, uses the same provider.
+                const agentReview = async (result) => {
+                    if (flags['review'] !== true)
+                        return true;
+                    io.log('');
+                    io.log('Reviewing (agent)...');
+                    io.log('');
+                    try {
+                        const verdict = await reviewImplementation(provider, plan, result);
+                        renderAgentReview(verdict, io);
+                        return verdict.approved;
+                    }
+                    catch (error) {
+                        io.error(`Review inconclusive — ${error.message}`);
+                        return true; // don't block the build on a review hiccup
+                    }
+                };
+                const dryRun = flags['dry-run'] === true;
+                if (dryRun) {
+                    const result = await runMake(ctx, plan, { dryRun: true, baseDir });
+                    renderMakeResult(result, io);
+                    return (await agentReview(result)) ? 0 : 1;
+                }
+                // Safety: writes require confirmation unless --yes (spec §10).
+                if (flags['yes'] !== true) {
+                    const ok = await io.confirm('Implement this plan? Files will be created and src/app.ts wired.');
+                    if (!ok) {
+                        io.log('Aborted — nothing was changed.');
+                        return 0;
+                    }
+                }
+                io.log('');
+                io.log('Implementing...');
+                io.log('');
+                let result;
+                try {
+                    result = await runMake(ctx, plan, {
+                        baseDir,
+                        force: flags['force'] === true,
+                        // --migrate, or --yes (pre-consented), runs prisma db push inside runMake.
+                        migrate: flags['migrate'] === true || flags['yes'] === true,
+                    });
+                }
+                catch (error) {
+                    io.error(error.message);
+                    return 1;
+                }
+                renderMakeResult(result, io);
+                // The step most often forgotten: without db push the Prisma client has no
+                // delegate for the new model, so every route 500s. Offer it right here.
+                if (!result.migration &&
+                    result.schema?.found &&
+                    flags['no-migrate'] !== true &&
+                    result.resources.some((r) => r.prisma)) {
+                    io.log('');
+                    const ok = await io.confirm('Run `prisma db push` now to create the table(s) + regenerate the Prisma client? (the routes 500 until you do)');
+                    if (ok) {
+                        io.log('Running prisma db push...');
+                        const push = await runPrismaPush(baseDir);
+                        io.log(push.ok
+                            ? '✓ prisma db push done — restart the dev server to load the regenerated client.'
+                            : `✗ prisma db push failed:\n${push.output}`);
+                        if (!push.ok)
+                            return 1;
+                    }
+                    else {
+                        io.log('Skipped — run `npx prisma db push` and restart the server before using the routes.');
+                    }
+                }
+                const approved = await agentReview(result);
+                if (flags['verify'] === true) {
+                    io.log('');
+                    io.log('Verifying (typecheck)...');
+                    const verdict = await verifyProject(baseDir);
+                    if (verdict.ok) {
+                        io.log(`✓ ${verdict.command} passed`);
+                    }
+                    else {
+                        io.error(`✗ ${verdict.command} failed:`);
+                        io.error(verdict.output);
+                        return 1;
+                    }
+                }
+                return result.review.ok && approved ? 0 : 1;
+            },
+        }),
+    ];
+}

package/dist/context/project.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Reads project files relative to a root. Injectable so the whole detection layer
+ * is unit-testable with an in-memory map (no disk).
+ */
+export interface ProjectReader {
+    read(relPath: string): string | null;
+    exists(relPath: string): boolean;
+}
+/** Default reader backed by the filesystem. */
+export declare function nodeReader(root: string): ProjectReader;
+/** In-memory reader for tests: keys are relative paths. */
+export declare function memoryReader(files: Record<string, string>): ProjectReader;
+/** Which capabilities the app actually wires (from its plugin list), not just installs. */
+export interface DetectedStack {
+    http: 'fastify' | null;
+    orm: 'prisma' | null;
+    database: 'postgresql' | 'mysql' | 'sqlite' | null;
+    tenancy: boolean;
+    auth: boolean;
+    rbac: boolean;
+    subscriptions: boolean;
+    payments: boolean;
+    storage: boolean;
+    queue: boolean;
+    search: boolean;
+    audit: boolean;
+    events: boolean;
+    scheduler: boolean;
+    logger: boolean;
+    ai: boolean;
+}
+export interface PrismaModel {
+    name: string;
+    fields: string[];
+    /** True when the model carries a `tenantId` column (tenant-scoped). */
+    tenantScoped: boolean;
+}
+export interface PrismaInfo {
+    provider: DetectedStack['database'];
+    models: PrismaModel[];
+}
+export interface AppFileInfo {
+    path: string;
+    /** Plugin factories detected in the `plugins:` array, e.g. `'fastifyPlugin'`. */
+    plugins: string[];
+    /** `fastifyPlugin({ fastify: { logger … } })` present. */
+    fastifyLoggerConfigured: boolean;
+    /** In-memory (non-durable) sources still wired, e.g. `MemoryTenantSource`. */
+    memorySources: string[];
+    /** Every `<name>Plugin(` factory call in the app file (unfiltered by capability). */
+    pluginCalls: string[];
+}
+export interface ServerFileInfo {
+    path: string;
+    /** Calls `.$connect()` somewhere in bootstrap (fail-loud DB check). */
+    connectsAtBoot: boolean;
+    /** Calls `.listen(` (actually starts a server). */
+    startsServer: boolean;
+}
+export interface EnvFileInfo {
+    path: string;
+    /** Default value baked into `APP_SECRET`, if any. */
+    appSecretDefault: string | null;
+    /** Default value baked into `REDIS_URL`, if any. */
+    redisUrlDefault: string | null;
+}
+export interface ProjectContext {
+    root: string;
+    /** All `@basaltkit/*` packages found in package.json deps. */
+    installed: string[];
+    stack: DetectedStack;
+    prisma: PrismaInfo | null;
+    app: AppFileInfo | null;
+    server: ServerFileInfo | null;
+    env: EnvFileInfo | null;
+}
+/** Detect the project's stack and key files. Pure over the injected reader. */
+export declare function detectProject(root: string, reader?: ProjectReader): ProjectContext;

package/dist/context/project.js

@@ -0,0 +1,202 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+/** Default reader backed by the filesystem. */
+export function nodeReader(root) {
+    return {
+        read(relPath) {
+            try {
+                return readFileSync(join(root, relPath), 'utf8');
+            }
+            catch {
+                return null;
+            }
+        },
+        exists: (relPath) => existsSync(join(root, relPath)),
+    };
+}
+/** In-memory reader for tests: keys are relative paths. */
+export function memoryReader(files) {
+    return {
+        read: (relPath) => files[relPath] ?? null,
+        exists: (relPath) => relPath in files,
+    };
+}
+const APP_CANDIDATES = ['src/app.ts', 'src/app.js', 'app.ts'];
+const SERVER_CANDIDATES = ['src/server.ts', 'src/server.js', 'src/main.ts', 'server.ts'];
+const ENV_CANDIDATES = ['src/env.ts', 'src/env.js', 'src/config/env.ts'];
+const SCHEMA_CANDIDATES = ['prisma/schema.prisma', 'schema.prisma'];
+/** Maps a plugin factory name → its `DetectedStack` boolean key. */
+const PLUGIN_TO_CAPABILITY = {
+    fastifyPlugin: 'http',
+    prismaPlugin: 'orm',
+    tenancyPlugin: 'tenancy',
+    authPlugin: 'auth',
+    permissionsPlugin: 'rbac',
+    subscriptionsPlugin: 'subscriptions',
+    paymentsPlugin: 'payments',
+    storagePlugin: 'storage',
+    queuePlugin: 'queue',
+    searchPlugin: 'search',
+    auditPlugin: 'audit',
+    eventsPlugin: 'events',
+    schedulerPlugin: 'scheduler',
+    loggerPlugin: 'logger',
+};
+const PLUGIN_FACTORIES = Object.keys(PLUGIN_TO_CAPABILITY);
+/** Detect the project's stack and key files. Pure over the injected reader. */
+export function detectProject(root, reader = nodeReader(root)) {
+    const installed = detectInstalled(reader);
+    const app = detectAppFile(reader);
+    const server = detectServerFile(reader);
+    const env = detectEnvFile(reader);
+    const prisma = detectPrisma(reader);
+    const stack = buildStack(installed, app, prisma);
+    return { root, installed, stack, prisma, app, server, env };
+}
+function detectInstalled(reader) {
+    const raw = reader.read('package.json');
+    if (!raw)
+        return [];
+    try {
+        const pkg = JSON.parse(raw);
+        const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+        return Object.keys(deps)
+            .filter((name) => name.startsWith('@basaltkit/'))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+function firstExisting(reader, candidates) {
+    for (const path of candidates) {
+        const content = reader.read(path);
+        if (content !== null)
+            return { path, content };
+    }
+    return null;
+}
+function detectAppFile(reader) {
+    const found = firstExisting(reader, APP_CANDIDATES);
+    if (!found)
+        return null;
+    const plugins = PLUGIN_FACTORIES.filter((factory) => new RegExp(`\\b${factory}\\s*\\(`).test(found.content));
+    const fastifyLoggerConfigured = /fastify\s*:\s*\{[^}]*\blogger\b/.test(found.content);
+    const memorySources = [
+        'MemoryTenantSource',
+        'MemoryUserSource',
+        // Security-critical in-memory stores: auth/authorization/domain state that
+        // must survive restarts and be shared across instances in production.
+        'MemoryPasskeyStore',
+        'MemoryWebAuthnChallengeStore',
+        'MemoryAccessStore',
+        'MemoryDomainStore',
+    ].filter((source) => found.content.includes(source));
+    const pluginCalls = [
+        ...new Set(Array.from(found.content.matchAll(/\b([A-Za-z][A-Za-z0-9]*Plugin)\s*\(/g), (m) => m[1])),
+    ];
+    return { path: found.path, plugins, fastifyLoggerConfigured, memorySources, pluginCalls };
+}
+function detectServerFile(reader) {
+    const found = firstExisting(reader, SERVER_CANDIDATES);
+    if (!found)
+        return null;
+    return {
+        path: found.path,
+        connectsAtBoot: /\.\$connect\s*\(/.test(found.content),
+        startsServer: /\.listen\s*\(/.test(found.content),
+    };
+}
+function detectEnvFile(reader) {
+    const found = firstExisting(reader, ENV_CANDIDATES);
+    if (!found)
+        return null;
+    return {
+        path: found.path,
+        appSecretDefault: captureDefault(found.content, 'APP_SECRET'),
+        redisUrlDefault: captureDefault(found.content, 'REDIS_URL'),
+    };
+}
+/** Pull the literal from `KEY: z.string()….default('literal')`. */
+function captureDefault(content, key) {
+    const match = new RegExp(`${key}\\s*:[^\\n]*?\\.default\\(\\s*['"\`]([^'"\`]*)['"\`]`).exec(content);
+    return match ? (match[1] ?? null) : null;
+}
+function detectPrisma(reader) {
+    const found = firstExisting(reader, SCHEMA_CANDIDATES);
+    if (!found)
+        return null;
+    const providerMatch = /datasource\s+\w+\s*\{[^}]*provider\s*=\s*"(\w+)"/s.exec(found.content);
+    const provider = normalizeProvider(providerMatch?.[1]);
+    const models = parseModels(found.content);
+    return { provider, models };
+}
+function normalizeProvider(raw) {
+    switch (raw) {
+        case 'postgresql':
+            return 'postgresql';
+        case 'mysql':
+            return 'mysql';
+        case 'sqlite':
+            return 'sqlite';
+        default:
+            return null;
+    }
+}
+function parseModels(schema) {
+    const models = [];
+    const modelRegex = /model\s+(\w+)\s*\{([^}]*)\}/gs;
+    let match;
+    while ((match = modelRegex.exec(schema)) !== null) {
+        const name = match[1];
+        const body = match[2];
+        if (!name || body === undefined)
+            continue;
+        const fields = body
+            .split('\n')
+            .map((line) => line.trim().split(/\s+/)[0])
+            .filter((token) => !!token && !token.startsWith('@') && !token.startsWith('//'));
+        models.push({ name, fields, tenantScoped: fields.includes('tenantId') });
+    }
+    return models;
+}
+function buildStack(installed, app, prisma) {
+    const stack = {
+        http: null,
+        orm: null,
+        database: prisma?.provider ?? null,
+        tenancy: false,
+        auth: false,
+        rbac: false,
+        subscriptions: false,
+        payments: false,
+        storage: false,
+        queue: false,
+        search: false,
+        audit: false,
+        events: false,
+        scheduler: false,
+        logger: false,
+        ai: installed.includes('@basaltkit/ai'),
+    };
+    // Prefer the plugins actually wired in app.ts; fall back to installed packages.
+    const enabled = new Set(app?.plugins ?? []);
+    const flags = stack;
+    for (const [factory, capability] of Object.entries(PLUGIN_TO_CAPABILITY)) {
+        if (!enabled.has(factory))
+            continue;
+        if (capability === 'http')
+            stack.http = 'fastify';
+        else if (capability === 'orm')
+            stack.orm = 'prisma';
+        else
+            flags[capability] = true;
+    }
+    if (!stack.http && installed.includes('@basaltkit/fastify'))
+        stack.http = 'fastify';
+    if (!stack.orm && installed.includes('@basaltkit/prisma'))
+        stack.orm = 'prisma';
+    if (!stack.rbac && installed.includes('@basaltkit/permissions'))
+        stack.rbac = true;
+    return stack;
+}