@basaltkit/ai 0.11.0 → 1.0.1

package/dist/index.js

@@ -1,2389 +1,40 @@
-// src/provider/types.ts
-async function* singleChunkStream(run3) {
-  yield await run3();
-}
-
-// src/provider/http.ts
-var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-function isRetryableStatus(status) {
-  return status >= 500 || status === 429;
-}
-async function fetchWithRetry(fetchImpl, url, init, options = {}) {
-  const retries = options.retries ?? 2;
-  const baseDelayMs = options.baseDelayMs ?? 300;
-  let lastError;
-  for (let attempt = 0; attempt <= retries; attempt++) {
-    try {
-      const res = await fetchImpl(url, init);
-      if (isRetryableStatus(res.status) && attempt < retries) {
-        await sleep(baseDelayMs * 2 ** attempt);
-        continue;
-      }
-      return { ok: res.ok, status: res.status, body: await res.text() };
-    } catch (error) {
-      lastError = error;
-      if (attempt >= retries) throw error;
-      await sleep(baseDelayMs * 2 ** attempt);
-    }
-  }
-  throw lastError instanceof Error ? lastError : new Error("fetchWithRetry: exhausted retries");
-}
-
-// src/provider/anthropic.ts
-var DEFAULT_MODEL = "claude-sonnet-5";
-var API_VERSION = "2023-06-01";
-var AnthropicProvider = class {
-  name = "anthropic";
-  model;
-  apiKey;
-  baseUrl;
-  fetchImpl;
-  constructor(options) {
-    if (!options.apiKey) {
-      throw new Error("AnthropicProvider: apiKey is required (set AI_API_KEY)");
-    }
-    this.apiKey = options.apiKey;
-    this.model = options.model ?? DEFAULT_MODEL;
-    this.baseUrl = (options.baseUrl ?? "https://api.anthropic.com").replace(/\/$/, "");
-    const f = options.fetch ?? globalThis.fetch;
-    if (!f) throw new Error("AnthropicProvider: no fetch available \u2014 pass options.fetch");
-    this.fetchImpl = f;
-  }
-  async generate(options) {
-    const system = options.messages.filter((m) => m.role === "system").map((m) => m.content).join("\n\n");
-    const messages = options.messages.filter((m) => m.role !== "system").map((m) => ({ role: m.role, content: m.content }));
-    const { ok, status, body } = await fetchWithRetry(this.fetchImpl, this.baseUrl + "/v1/messages", {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        "x-api-key": this.apiKey,
-        "anthropic-version": API_VERSION
-      },
-      body: JSON.stringify({
-        model: this.model,
-        max_tokens: options.maxTokens ?? 4096,
-        ...options.temperature !== void 0 ? { temperature: options.temperature } : {},
-        ...system ? { system } : {},
-        messages
-      })
-    });
-    if (!ok) {
-      const detail = safeError(body);
-      throw new Error(`AnthropicProvider: ${status}${detail ? ` \u2014 ${detail}` : ""}`);
-    }
-    const json = JSON.parse(body);
-    return (json.content ?? []).filter((block) => block.type === "text").map((block) => block.text ?? "").join("");
-  }
-  stream(options) {
-    return singleChunkStream(() => this.generate(options));
-  }
-};
-function safeError(text) {
-  try {
-    return JSON.parse(text).error?.message ?? text.slice(0, 200);
-  } catch {
-    return text.slice(0, 200);
-  }
-}
-
-// src/provider/ollama.ts
-var DEFAULT_MODEL2 = "llama3.1";
-var OllamaProvider = class {
-  name = "ollama";
-  model;
-  baseUrl;
-  fetchImpl;
-  constructor(options = {}) {
-    this.model = options.model ?? DEFAULT_MODEL2;
-    this.baseUrl = (options.baseUrl ?? "http://localhost:11434").replace(/\/$/, "");
-    const f = options.fetch ?? globalThis.fetch;
-    if (!f) throw new Error("OllamaProvider: no fetch available \u2014 pass options.fetch");
-    this.fetchImpl = f;
-  }
-  async generate(options) {
-    const { ok, status, body } = await fetchWithRetry(this.fetchImpl, this.baseUrl + "/api/chat", {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({
-        model: this.model,
-        stream: false,
-        messages: options.messages.map((m) => ({ role: m.role, content: m.content })),
-        ...options.temperature !== void 0 ? { options: { temperature: options.temperature } } : {}
-      })
-    });
-    if (!ok) throw new Error(`OllamaProvider: ${status} \u2014 ${body.slice(0, 200)}`);
-    const json = JSON.parse(body);
-    if (json.error) throw new Error(`OllamaProvider: ${json.error}`);
-    return json.message?.content ?? "";
-  }
-  stream(options) {
-    return singleChunkStream(() => this.generate(options));
-  }
-};
-
-// src/provider/sse.ts
-var globalSseFetch = async (url, init) => {
-  const f = globalThis.fetch;
-  if (!f) throw new Error("globalSseFetch: no global fetch available");
-  const res = await f(url, {
-    method: init.method,
-    headers: init.headers,
-    body: init.body
-  });
-  const stream = res.body;
-  const decoder = new TextDecoder();
-  async function* chunks() {
-    if (!stream) return;
-    for await (const part of stream) yield decoder.decode(part, { stream: true });
-  }
-  return { ok: res.ok, status: res.status, text: () => res.text(), chunks: chunks() };
-};
-async function* parseSseContent(chunks) {
-  let buffer = "";
-  for await (const chunk of chunks) {
-    buffer += chunk;
-    const lines = buffer.split("\n");
-    buffer = lines.pop() ?? "";
-    for (const line of lines) {
-      const trimmed = line.trim();
-      if (!trimmed.startsWith("data:")) continue;
-      const payload = trimmed.slice(5).trim();
-      if (payload === "" || payload === "[DONE]") continue;
-      try {
-        const delta = JSON.parse(payload).choices?.[0]?.delta?.content;
-        if (delta) yield delta;
-      } catch {
-      }
-    }
-  }
-}
-
-// src/provider/openai.ts
-var DEFAULT_MODEL3 = "gpt-4o-mini";
-var DEFAULT_BASE_URL = "https://api.openai.com/v1";
-var OpenAICompatibleProvider = class {
-  name = "openai";
-  model;
-  apiKey;
-  baseUrl;
-  streaming;
-  fetchImpl;
-  sseFetchImpl;
-  constructor(options) {
-    if (!options.apiKey) {
-      throw new Error("OpenAICompatibleProvider: apiKey is required (set AI_API_KEY)");
-    }
-    this.apiKey = options.apiKey;
-    this.model = options.model ?? DEFAULT_MODEL3;
-    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
-    this.streaming = options.stream ?? true;
-    this.fetchImpl = options.fetch ?? globalThis.fetch ?? missingFetch;
-    this.sseFetchImpl = options.sseFetch ?? globalSseFetch;
-  }
-  async generate(options) {
-    if (!this.streaming) return this.viaJson(options);
-    let out = "";
-    for await (const delta of this.viaStream(options)) out += delta;
-    return out;
-  }
-  stream(options) {
-    if (!this.streaming) return singleChunkStream(() => this.viaJson(options));
-    return this.viaStream(options);
-  }
-  get endpoint() {
-    return this.baseUrl + "/chat/completions";
-  }
-  headers() {
-    return { "content-type": "application/json", authorization: `Bearer ${this.apiKey}` };
-  }
-  requestBody(options, stream) {
-    return JSON.stringify({
-      model: this.model,
-      messages: options.messages.map((m) => ({ role: m.role, content: m.content })),
-      max_tokens: options.maxTokens ?? 4096,
-      ...options.temperature !== void 0 ? { temperature: options.temperature } : {},
-      ...stream ? { stream: true } : {}
-    });
-  }
-  async *viaStream(options) {
-    const res = await this.sseFetchImpl(this.endpoint, {
-      method: "POST",
-      headers: this.headers(),
-      body: this.requestBody(options, true)
-    });
-    if (!res.ok) {
-      throw new Error(`OpenAICompatibleProvider: ${res.status} \u2014 ${safeError2(await res.text())}`);
-    }
-    yield* parseSseContent(res.chunks);
-  }
-  async viaJson(options) {
-    const { ok, status, body } = await fetchWithRetry(this.fetchImpl, this.endpoint, {
-      method: "POST",
-      headers: this.headers(),
-      body: this.requestBody(options, false)
-    });
-    if (!ok) {
-      const detail = safeError2(body);
-      throw new Error(`OpenAICompatibleProvider: ${status}${detail ? ` \u2014 ${detail}` : ""}`);
-    }
-    return JSON.parse(body).choices?.[0]?.message?.content ?? "";
-  }
-};
-var missingFetch = () => {
-  throw new Error("OpenAICompatibleProvider: no fetch available \u2014 pass options.fetch");
-};
-function safeError2(text) {
-  try {
-    return JSON.parse(text).error?.message ?? text.slice(0, 200);
-  } catch {
-    return text.slice(0, 200);
-  }
-}
-
-// src/provider/factory.ts
-function providerEnvFromProcess() {
-  const e = process.env;
-  return {
-    ...e.AI_PROVIDER !== void 0 ? { AI_PROVIDER: e.AI_PROVIDER } : {},
-    ...e.AI_MODEL !== void 0 ? { AI_MODEL: e.AI_MODEL } : {},
-    ...e.AI_API_KEY !== void 0 ? { AI_API_KEY: e.AI_API_KEY } : {},
-    ...e.AI_BASE_URL !== void 0 ? { AI_BASE_URL: e.AI_BASE_URL } : {},
-    ...e.AI_STREAM !== void 0 ? { AI_STREAM: e.AI_STREAM } : {}
-  };
-}
-function createProvider(env = {}, options = {}) {
-  const name = (env.AI_PROVIDER ?? "anthropic").toLowerCase();
-  const fetchOpt = options.fetch ? { fetch: options.fetch } : {};
-  switch (name) {
-    case "anthropic":
-      return new AnthropicProvider({
-        apiKey: env.AI_API_KEY ?? "",
-        ...env.AI_MODEL ? { model: env.AI_MODEL } : {},
-        ...env.AI_BASE_URL ? { baseUrl: env.AI_BASE_URL } : {},
-        ...fetchOpt
-      });
-    case "ollama":
-      return new OllamaProvider({
-        ...env.AI_MODEL ? { model: env.AI_MODEL } : {},
-        ...env.AI_BASE_URL ? { baseUrl: env.AI_BASE_URL } : {},
-        ...fetchOpt
-      });
-    case "openai":
-    case "openai-compatible":
-      return new OpenAICompatibleProvider({
-        apiKey: env.AI_API_KEY ?? "",
-        ...env.AI_MODEL ? { model: env.AI_MODEL } : {},
-        ...env.AI_BASE_URL ? { baseUrl: env.AI_BASE_URL } : {},
-        ...env.AI_STREAM === "false" ? { stream: false } : {},
-        ...fetchOpt
-      });
-    case "google":
-      throw new Error(
-        `createProvider: 'google' is not implemented in @basaltkit/ai@0.1. Available now: 'anthropic', 'ollama', 'openai' (OpenAI-compatible).`
-      );
-    default:
-      throw new Error(
-        `createProvider: unknown AI_PROVIDER='${name}'. Use 'anthropic', 'ollama' or 'openai'.`
-      );
-  }
-}
-
-// src/context/project.ts
-import { existsSync, readFileSync } from "fs";
-import { join } from "path";
-function nodeReader(root) {
-  return {
-    read(relPath) {
-      try {
-        return readFileSync(join(root, relPath), "utf8");
-      } catch {
-        return null;
-      }
-    },
-    exists: (relPath) => existsSync(join(root, relPath))
-  };
-}
-function memoryReader(files) {
-  return {
-    read: (relPath) => files[relPath] ?? null,
-    exists: (relPath) => relPath in files
-  };
-}
-var APP_CANDIDATES = ["src/app.ts", "src/app.js", "app.ts"];
-var SERVER_CANDIDATES = ["src/server.ts", "src/server.js", "src/main.ts", "server.ts"];
-var ENV_CANDIDATES = ["src/env.ts", "src/env.js", "src/config/env.ts"];
-var SCHEMA_CANDIDATES = ["prisma/schema.prisma", "schema.prisma"];
-var PLUGIN_TO_CAPABILITY = {
-  fastifyPlugin: "http",
-  prismaPlugin: "orm",
-  tenancyPlugin: "tenancy",
-  authPlugin: "auth",
-  permissionsPlugin: "rbac",
-  subscriptionsPlugin: "subscriptions",
-  paymentsPlugin: "payments",
-  storagePlugin: "storage",
-  queuePlugin: "queue",
-  searchPlugin: "search",
-  auditPlugin: "audit",
-  eventsPlugin: "events",
-  schedulerPlugin: "scheduler",
-  loggerPlugin: "logger"
-};
-var PLUGIN_FACTORIES = Object.keys(PLUGIN_TO_CAPABILITY);
-function detectProject(root, reader = nodeReader(root)) {
-  const installed = detectInstalled(reader);
-  const app = detectAppFile(reader);
-  const server = detectServerFile(reader);
-  const env = detectEnvFile(reader);
-  const prisma = detectPrisma(reader);
-  const stack = buildStack(installed, app, prisma);
-  return { root, installed, stack, prisma, app, server, env };
-}
-function detectInstalled(reader) {
-  const raw = reader.read("package.json");
-  if (!raw) return [];
-  try {
-    const pkg = JSON.parse(raw);
-    const deps = { ...pkg.dependencies, ...pkg.devDependencies };
-    return Object.keys(deps).filter((name) => name.startsWith("@basaltkit/")).sort();
-  } catch {
-    return [];
-  }
-}
-function firstExisting(reader, candidates) {
-  for (const path of candidates) {
-    const content = reader.read(path);
-    if (content !== null) return { path, content };
-  }
-  return null;
-}
-function detectAppFile(reader) {
-  const found = firstExisting(reader, APP_CANDIDATES);
-  if (!found) return null;
-  const plugins = PLUGIN_FACTORIES.filter(
-    (factory) => new RegExp(`\\b${factory}\\s*\\(`).test(found.content)
-  );
-  const fastifyLoggerConfigured = /fastify\s*:\s*\{[^}]*\blogger\b/.test(found.content);
-  const memorySources = [
-    "MemoryTenantSource",
-    "MemoryUserSource",
-    // Security-critical in-memory stores: auth/authorization/domain state that
-    // must survive restarts and be shared across instances in production.
-    "MemoryPasskeyStore",
-    "MemoryWebAuthnChallengeStore",
-    "MemoryAccessStore",
-    "MemoryDomainStore"
-  ].filter(
-    (source) => found.content.includes(source)
-  );
-  const pluginCalls = [
-    ...new Set(Array.from(found.content.matchAll(/\b([A-Za-z][A-Za-z0-9]*Plugin)\s*\(/g), (m) => m[1]))
-  ];
-  return { path: found.path, plugins, fastifyLoggerConfigured, memorySources, pluginCalls };
-}
-function detectServerFile(reader) {
-  const found = firstExisting(reader, SERVER_CANDIDATES);
-  if (!found) return null;
-  return {
-    path: found.path,
-    connectsAtBoot: /\.\$connect\s*\(/.test(found.content),
-    startsServer: /\.listen\s*\(/.test(found.content)
-  };
-}
-function detectEnvFile(reader) {
-  const found = firstExisting(reader, ENV_CANDIDATES);
-  if (!found) return null;
-  return {
-    path: found.path,
-    appSecretDefault: captureDefault(found.content, "APP_SECRET"),
-    redisUrlDefault: captureDefault(found.content, "REDIS_URL")
-  };
-}
-function captureDefault(content, key) {
-  const match = new RegExp(`${key}\\s*:[^\\n]*?\\.default\\(\\s*['"\`]([^'"\`]*)['"\`]`).exec(content);
-  return match ? match[1] ?? null : null;
-}
-function detectPrisma(reader) {
-  const found = firstExisting(reader, SCHEMA_CANDIDATES);
-  if (!found) return null;
-  const providerMatch = /datasource\s+\w+\s*\{[^}]*provider\s*=\s*"(\w+)"/s.exec(found.content);
-  const provider = normalizeProvider(providerMatch?.[1]);
-  const models = parseModels(found.content);
-  return { provider, models };
-}
-function normalizeProvider(raw) {
-  switch (raw) {
-    case "postgresql":
-      return "postgresql";
-    case "mysql":
-      return "mysql";
-    case "sqlite":
-      return "sqlite";
-    default:
-      return null;
-  }
-}
-function parseModels(schema) {
-  const models = [];
-  const modelRegex = /model\s+(\w+)\s*\{([^}]*)\}/gs;
-  let match;
-  while ((match = modelRegex.exec(schema)) !== null) {
-    const name = match[1];
-    const body = match[2];
-    if (!name || body === void 0) continue;
-    const fields = body.split("\n").map((line) => line.trim().split(/\s+/)[0]).filter((token) => !!token && !token.startsWith("@") && !token.startsWith("//"));
-    models.push({ name, fields, tenantScoped: fields.includes("tenantId") });
-  }
-  return models;
-}
-function buildStack(installed, app, prisma) {
-  const stack = {
-    http: null,
-    orm: null,
-    database: prisma?.provider ?? null,
-    tenancy: false,
-    auth: false,
-    rbac: false,
-    subscriptions: false,
-    payments: false,
-    storage: false,
-    queue: false,
-    search: false,
-    audit: false,
-    events: false,
-    scheduler: false,
-    logger: false,
-    ai: installed.includes("@basaltkit/ai")
-  };
-  const enabled = new Set(app?.plugins ?? []);
-  const flags = stack;
-  for (const [factory, capability] of Object.entries(PLUGIN_TO_CAPABILITY)) {
-    if (!enabled.has(factory)) continue;
-    if (capability === "http") stack.http = "fastify";
-    else if (capability === "orm") stack.orm = "prisma";
-    else flags[capability] = true;
-  }
-  if (!stack.http && installed.includes("@basaltkit/fastify")) stack.http = "fastify";
-  if (!stack.orm && installed.includes("@basaltkit/prisma")) stack.orm = "prisma";
-  if (!stack.rbac && installed.includes("@basaltkit/permissions")) stack.rbac = true;
-  return stack;
-}
-
-// src/doctor/types.ts
-function defineRule(rule) {
-  return rule;
-}
-
-// src/doctor/rules.ts
-var DEFAULT_RULES = [
-  // ── observability ─────────────────────────────────────────────────────────
-  defineRule({
-    id: "prisma-lazy-boot",
-    category: "observability",
-    check(ctx) {
-      if (!ctx.stack.orm || !ctx.server) return null;
-      if (ctx.server.connectsAtBoot) return null;
-      return {
-        id: "prisma-lazy-boot",
-        title: "Database connection is not validated at boot",
-        severity: "warning",
-        category: "observability",
-        detected: `${ctx.server.path} never calls prisma.$connect() before listen()`,
-        recommended: "await the Prisma client's $connect() right after boot()",
-        reason: "Prisma connects lazily on the first query, so an unreachable database (wrong host/port/credentials) does NOT crash at startup \u2014 it fails silently on the first request instead.",
-        fix: [
-          "const app = await buildApp({ /* \u2026 */ }).boot()",
-          "await app.container.get(PRISMA).$connect()  // fail loudly if the DB is unreachable"
-        ].join("\n"),
-        docs: "/guide/observability"
-      };
-    }
-  }),
-  defineRule({
-    id: "fastify-logger-off",
-    category: "observability",
-    check(ctx) {
-      if (ctx.stack.http !== "fastify" || !ctx.app) return null;
-      if (ctx.app.fastifyLoggerConfigured) return null;
-      return {
-        id: "fastify-logger-off",
-        title: "Fastify's request logger is disabled",
-        severity: "warning",
-        category: "observability",
-        detected: `fastifyPlugin in ${ctx.app.path} has no fastify.logger option`,
-        recommended: "enable Fastify's logger (at least in development)",
-        reason: "Unhandled request errors are logged via request.log.error, but Fastify's built-in logger defaults to OFF \u2014 so 500s are returned to the client while the terminal stays silent.",
-        fix: "fastifyPlugin({ routes: [...], fastify: { logger: env.NODE_ENV === 'development' } })",
-        docs: "/guide/observability"
-      };
-    }
-  }),
-  // ── security ──────────────────────────────────────────────────────────────
-  defineRule({
-    id: "insecure-app-secret",
-    category: "security",
-    check(ctx) {
-      const value = ctx.env?.appSecretDefault;
-      if (!value) return null;
-      if (!/change|me|example|secret|placeholder|xxx/i.test(value)) return null;
-      return {
-        id: "insecure-app-secret",
-        title: "APP_SECRET has an insecure default",
-        severity: "error",
-        category: "security",
-        detected: `${ctx.env?.path} defaults APP_SECRET to "${value}"`,
-        recommended: "require APP_SECRET from the environment with no fallback in production",
-        reason: "A committed default secret lets anyone forge sessions/JWTs if it ever reaches a deployed environment. Secrets must come from the environment.",
-        fix: "APP_SECRET: z.string().min(32)  // no .default() \u2014 fail fast if unset",
-        docs: "/guide/security"
-      };
-    }
-  }),
-  defineRule({
-    id: "missing-security-plugin",
-    category: "security",
-    check(ctx) {
-      if (!ctx.app) return null;
-      if (ctx.app.pluginCalls.includes("securityPlugin")) return null;
-      return {
-        id: "missing-security-plugin",
-        title: "No securityPlugin \u2014 responses ship without secure headers",
-        severity: "warning",
-        category: "security",
-        detected: `${ctx.app.path} registers no securityPlugin()`,
-        recommended: "add securityPlugin() so secure response headers are set, and enable rate limiting + a CORS allow-list for production",
-        reason: "Without it the API returns no security headers (HSTS, X-Frame-Options, nosniff, \u2026) and applies no rate limiting \u2014 a fresh deploy is unprotected at the edge. The security primitives exist but are off until wired.",
-        fix: "securityPlugin({ /* headers on by default */ rateLimit: { limit: 120, windowMs: 60_000 } })",
-        docs: "/guide/security"
-      };
-    }
-  }),
-  // ── tenancy ───────────────────────────────────────────────────────────────
-  defineRule({
-    id: "missing-tenant-membership",
-    category: "tenancy",
-    check(ctx) {
-      if (!ctx.app || !ctx.stack.tenancy || !ctx.stack.auth) return null;
-      const teamsAvailable = ctx.app.pluginCalls.includes("teamsPlugin") || ctx.installed.includes("@basaltkit/teams");
-      if (!teamsAvailable) return null;
-      if (ctx.app.pluginCalls.includes("tenantMembershipPlugin")) return null;
-      return {
-        id: "missing-tenant-membership",
-        title: "Tenant is resolved from the request but membership is never enforced",
-        severity: "error",
-        category: "tenancy",
-        detected: `${ctx.app.path} wires tenancy + auth (+ teams) but no tenantMembershipPlugin`,
-        recommended: "register tenantMembershipPlugin() so every authenticated, tenant-scoped request verifies the user belongs to the resolved tenant",
-        reason: "Resolvers take the tenant from client input (x-tenant-id / Host). Without a membership check, any authenticated user can act on another tenant just by changing that header \u2014 a cross-tenant data breach. Tenant resolution is identification, never authorization.",
-        fix: "tenantMembershipPlugin()  // central routes opt out with meta: { central: true }",
-        docs: "/guide/security"
-      };
-    }
-  }),
-  defineRule({
-    id: "tenant-scoping-missing",
-    category: "tenancy",
-    check(ctx) {
-      if (!ctx.stack.tenancy || !ctx.prisma) return null;
-      const unscoped = ctx.prisma.models.filter(
-        (model) => !model.tenantScoped && !GLOBAL_MODELS.has(model.name)
-      );
-      if (unscoped.length === 0) return null;
-      const names7 = unscoped.map((m) => m.name).join(", ");
-      return {
-        id: "tenant-scoping-missing",
-        title: "Tenant-scoped app has models without a tenantId",
-        severity: "warning",
-        category: "tenancy",
-        detected: `models without a tenantId column: ${names7}`,
-        recommended: "add a tenantId to tenant-owned models so queries can never leak across tenants",
-        reason: "With tenancy enabled, a model that lacks tenantId cannot be isolated by the tenant-scoping layer \u2014 a query can return rows from other tenants.",
-        fix: "tenantId String  // + @@index([tenantId]); scope every query by the current tenant",
-        docs: "/guide/tenancy"
-      };
-    }
-  }),
-  // ── durability ────────────────────────────────────────────────────────────
-  defineRule({
-    id: "memory-sources-in-use",
-    category: "durability",
-    check(ctx) {
-      const sources = ctx.app?.memorySources ?? [];
-      if (sources.length === 0) return null;
-      return {
-        id: "memory-sources-in-use",
-        title: "Non-durable in-memory sources are wired",
-        severity: "info",
-        category: "durability",
-        detected: `${ctx.app?.path} uses ${sources.join(", ")}`,
-        recommended: "replace in-memory sources with database-backed ones before production",
-        reason: "In-memory sources reset on every restart and are not shared across instances \u2014 fine for local dev, data loss in production.",
-        docs: "/guide/tenancy"
-      };
-    }
-  }),
-  defineRule({
-    id: "redis-localhost-default",
-    category: "config",
-    check(ctx) {
-      const value = ctx.env?.redisUrlDefault;
-      if (!value || !/localhost|127\.0\.0\.1/.test(value)) return null;
-      if (!ctx.stack.queue && !ctx.stack.subscriptions) return null;
-      return {
-        id: "redis-localhost-default",
-        title: "Redis URL defaults to localhost",
-        severity: "info",
-        category: "config",
-        detected: `${ctx.env?.path} defaults REDIS_URL to "${value}"`,
-        recommended: "set REDIS_URL from the environment in every non-local deployment",
-        reason: "A localhost default silently falls back to a dev-only queue/dedupe backend in production if the env var is missing.",
-        docs: "/guide/configuration"
-      };
-    }
-  }),
-  defineRule({
-    id: "in-memory-security-store",
-    category: "security",
-    check(ctx) {
-      const SECURITY_STORES = {
-        MemoryPasskeyStore: "WebAuthn passkeys",
-        MemoryWebAuthnChallengeStore: "WebAuthn challenges",
-        MemoryAccessStore: "roles & permissions",
-        MemoryDomainStore: "verified custom domains"
-      };
-      const hit = (ctx.app?.memorySources ?? []).find((source) => source in SECURITY_STORES);
-      if (!hit) return null;
-      return {
-        id: "in-memory-security-store",
-        title: "Security state is kept in an in-memory store",
-        severity: "warning",
-        category: "security",
-        detected: `${hit} holds ${SECURITY_STORES[hit]} in memory.`,
-        recommended: "Back it with a durable store (database/Redis) in production.",
-        reason: "In-memory security stores are wiped on restart and are not shared across instances \u2014 passkeys/permissions/verified domains would silently reset or diverge per replica, which can lock users out or bypass authorization.",
-        fix: `// swap ${hit} for a durable implementation of the same interface`,
-        docs: "/guide/security"
-      };
-    }
-  })
-];
-var GLOBAL_MODELS = /* @__PURE__ */ new Set(["Tenant", "User", "Plan", "WebhookEvent", "Migration"]);
-
-// src/doctor/run.ts
-var SEVERITY_ORDER = { error: 0, warning: 1, info: 2 };
-function runDoctor(ctx, rules = DEFAULT_RULES) {
-  return rules.map((rule) => rule.check(ctx)).filter((d) => d !== null).sort((a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity]);
-}
-function hasErrors(diagnostics) {
-  return diagnostics.some((d) => d.severity === "error");
-}
-
-// src/doctor/fixes.ts
-import { writeFile } from "fs/promises";
-import { join as join2 } from "path";
-var FIXES = {
-  "fastify-logger-off": (read, ctx) => {
-    if (!ctx.app) return null;
-    const content = read(ctx.app.path);
-    if (content === null) return null;
-    if (/fastify\s*:\s*\{[^}]*\blogger\b/.test(content)) return [];
-    const after = content.replace(
-      /fastifyPlugin\(\s*\{/,
-      (m) => `${m} fastify: { logger: process.env.NODE_ENV !== 'production' },`
-    );
-    return after === content ? [] : [{ path: ctx.app.path, before: content, after }];
-  },
-  "insecure-app-secret": (read, ctx) => {
-    if (!ctx.env) return null;
-    const value = ctx.env.appSecretDefault;
-    if (!value || !/change|me|example|secret|placeholder|xxx/i.test(value)) return [];
-    const content = read(ctx.env.path);
-    if (content === null) return null;
-    const after = content.replace(/^(\s*)APP_SECRET:\s*z\.string\(\)[^\n]*$/m, "$1APP_SECRET: z.string().min(32),");
-    return after === content ? [] : [{ path: ctx.env.path, before: content, after }];
-  }
-};
-function fixableIds() {
-  return Object.keys(FIXES);
-}
-function planFix(id, ctx, read) {
-  const applier = FIXES[id];
-  if (!applier) {
-    return { id, status: "unfixable", edits: [], message: "no auto-fix \u2014 apply manually (see `basalt ai:doctor`)" };
-  }
-  const edits = applier(read, ctx);
-  if (edits === null) return { id, status: "unfixable", edits: [], message: "target file not found" };
-  const changed = edits.filter((e) => e.before !== e.after);
-  if (changed.length === 0) return { id, status: "noop", edits: [], message: "nothing to change (already fixed?)" };
-  return { id, status: "ready", edits: changed, message: `edits ${changed.map((e) => e.path).join(", ")}` };
-}
-async function applyFixEdits(edits, baseDir) {
-  for (const edit of edits) await writeFile(join2(baseDir, edit.path), edit.after);
-}
-function renderFixes(outcomes, io) {
-  const mark = { ready: "\u2713", noop: "\u2022", unfixable: "\u26A0" };
-  for (const outcome of outcomes) {
-    io.log(`${mark[outcome.status]} ${outcome.id} \u2014 ${outcome.message}`);
-    for (const edit of outcome.edits) {
-      io.log(`  ${edit.path}:`);
-      for (const [removed, added] of lineDiff(edit.before, edit.after)) {
-        if (removed !== void 0) io.log(`    - ${removed.trim()}`);
-        if (added !== void 0) io.log(`    + ${added.trim()}`);
-      }
-    }
-  }
-}
-function lineDiff(before, after) {
-  const b = before.split("\n");
-  const a = after.split("\n");
-  const out = [];
-  for (let i = 0; i < Math.max(b.length, a.length); i++) {
-    if (b[i] !== a[i]) out.push([b[i], a[i]]);
-  }
-  return out;
-}
-
-// src/analyze/run.ts
-function analyze(ctx) {
-  const { stack, prisma } = ctx;
-  const capabilities = [];
-  if (stack.http === "fastify") capabilities.push("Fastify detected");
-  if (stack.orm === "prisma") capabilities.push("Prisma detected");
-  if (stack.database) capabilities.push(`${databaseLabel(stack.database)} detected`);
-  if (stack.tenancy) capabilities.push("Tenancy enabled");
-  if (stack.auth) capabilities.push("Authentication enabled");
-  if (stack.rbac) capabilities.push("RBAC enabled");
-  if (stack.subscriptions) capabilities.push("Subscriptions enabled");
-  if (stack.payments) capabilities.push("Payments enabled");
-  if (stack.queue) capabilities.push("Queue enabled");
-  if (stack.search) capabilities.push("Search enabled");
-  if (stack.audit) capabilities.push("Audit enabled");
-  if (stack.events) capabilities.push("Events enabled");
-  if (stack.scheduler) capabilities.push("Scheduler enabled");
-  if (stack.storage) capabilities.push("Storage enabled");
-  const models = prisma?.models ?? [];
-  return {
-    root: ctx.root,
-    capabilities,
-    installed: ctx.installed,
-    database: stack.database,
-    models: models.map((m) => m.name),
-    tenantScopedModels: models.filter((m) => m.tenantScoped).map((m) => m.name),
-    unscopedModels: models.filter((m) => !m.tenantScoped).map((m) => m.name),
-    diagnostics: runDoctor(ctx)
-  };
-}
-function databaseLabel(db) {
-  switch (db) {
-    case "postgresql":
-      return "PostgreSQL";
-    case "mysql":
-      return "MySQL";
-    case "sqlite":
-      return "SQLite";
-  }
-}
-
-// src/plan/context.ts
-function buildPlanContext(ctx) {
-  const s = ctx.stack;
-  const caps = [
-    s.http ? `HTTP: ${s.http}` : null,
-    s.orm ? `ORM: ${s.orm}` : null,
-    s.database ? `database: ${s.database}` : null,
-    s.tenancy ? "tenancy: ENABLED \u2014 tenant-owned models must carry tenantId" : "tenancy: off",
-    s.auth ? "auth: enabled" : null,
-    s.rbac ? "RBAC: enabled \u2014 register <resource>.view/create/update/delete" : null,
-    s.audit ? "audit: enabled \u2014 emit <resource>.created/updated/deleted" : null,
-    s.subscriptions ? "subscriptions: enabled" : null,
-    s.payments ? "payments: enabled" : null,
-    s.queue ? "queue: enabled" : null,
-    s.search ? "search: enabled" : null,
-    s.events ? "events: enabled" : null,
-    s.scheduler ? "scheduler: enabled" : null,
-    s.storage ? "storage: enabled" : null
-  ].filter((line) => line !== null);
-  const models = ctx.prisma && ctx.prisma.models.length > 0 ? ctx.prisma.models.map((m) => `${m.name}${m.tenantScoped ? " (tenantId)" : ""}`).join(", ") : "(none)";
-  const lines = [
-    "PROJECT STACK:",
-    ...caps.map((c) => `- ${c}`),
-    "",
-    `EXISTING PRISMA MODELS: ${models}`,
-    "",
-    "GENERATOR: `basalt make:resource <Name>` \u2014 flags: --prisma, --soft-delete, --no-register, --dir, --force."
-  ];
-  if (ctx.app) lines.push(`APP FILE: ${ctx.app.path} (wired plugins: ${ctx.app.plugins.join(", ") || "none"}).`);
-  return lines.join("\n");
-}
-
-// src/plan/knowledge.ts
-var BASALT_KNOWLEDGE = `You are the Architect agent for Basalt \u2014 a batteries-included SaaS framework for Node.js/TypeScript (Fastify + Prisma + Zod). You turn a developer's natural-language request into a precise, convention-following implementation PLAN. You PLAN only; you never write code here.
-
-ABSOLUTE RULES \u2014 always use the framework's official APIs and generators, never invent new ones:
-
-1. SCAFFOLDING. Create a resource with the generator, not by hand:
-   \`basalt make:resource <Name>\` \u2014 generates a full vertical: Zod schema, repository, service, DI plugin, typed routes and a test, all on-convention and auto-wired into src/app.ts.
-   Flags: --prisma (Prisma-backed repository + a schema.prisma model with id/createdAt/updatedAt), --soft-delete (adds deletedAt, a restore() method + route), --no-register (skip wiring), --dir=<path>, --force.
-
-2. PERSISTENCE. Prisma via prismaPlugin. Models live in schema.prisma. After editing the schema, run \`basalt prisma:sync\` to generate the client + migration. Use --prisma so the generator emits the model for you.
-
-3. MULTI-TENANCY. When tenancy is enabled, every tenant-owned model MUST carry a \`tenantId\` column, and the tenancy layer scopes queries by the current tenant. NEVER plan a query that ignores tenant isolation. Platform-global tables (users, tenants, plans) are the only exceptions.
-
-4. RBAC / PERMISSIONS. For each resource, register \`<resource>.view\`, \`<resource>.create\`, \`<resource>.update\`, \`<resource>.delete\` and guard the matching routes with the permission check. Use the resource name in plural, lowercase (e.g. \`patients.create\`).
-
-5. AUDIT. Emit an audit event for each state change: \`<resource>.created\`, \`<resource>.updated\`, \`<resource>.deleted\` (singular resource).
-
-6. VALIDATION + DOCS. Every route carries a Zod schema; OpenAPI is generated from it automatically \u2014 no separate doc wiring.
-
-7. TESTS. Every resource ships a test (the generator creates one; extend it for domain rules).
-
-GROUNDING: Reuse what already exists in the project. Avoid name collisions with existing models. Only add what is missing. Prefer editing the schema + running the generator over hand-writing files.
-
-OUTPUT: Return ONLY a single JSON object (no prose, no markdown fences) matching exactly:
-{
-  "summary": string,                     // 1-2 sentences on the approach
-  "entities": [                          // domain entities to create
-    { "name": string, "fields": [{ "name": string, "type": string, "enum"?: string[] }], "tenantScoped": boolean,
-      "relations": [{ "name": string, "model": string }] }   // belongs-to: this model gets a <name>Id FK \u2192 <model>
-  ],
-  "steps": [                             // ordered implementation steps
-    { "order": number, "title": string, "kind": "generator"|"schema"|"migration"|"service"|"routes"|"permissions"|"audit"|"test"|"docs"|"other", "detail": string, "command": string, "files": string[] }
-  ],
-  "permissions": string[],               // e.g. ["patients.view","patients.create",...]
-  "auditEvents": string[],               // e.g. ["patient.created",...]
-  "tenantScoped": boolean,               // does this feature involve tenant-owned data
-  "warnings": string[]                   // risks, decisions to confirm, missing info
-}
-For generator steps, put the exact command in "command" (e.g. "basalt make:resource Patient --prisma --soft-delete"). Omit "command"/"files" when not applicable.
-
-ENUMS: a field with a fixed set of values (a status/state) MUST set "enum" to those values \u2014 e.g. "estado (pago/pendente)" \u2192 { "name": "estado", "type": "String", "enum": ["pago", "pendente"] }. It becomes a validated z.enum([...]) (stored as a String column), never a free z.string().
-
-RELATIONS: express a belongs-to as an entry in "relations" (e.g. an Appointment belongs to a Patient \u2192 { "name": "patient", "model": "Patient" }). Do NOT also add the "<name>Id" field to "fields" \u2014 the FK column, the @relation and the inverse field are generated. Prefer generating both sides of a relation in the same plan.`;
-
-// src/plan/plan.ts
-var STEP_KINDS = [
-  "generator",
-  "schema",
-  "migration",
-  "service",
-  "routes",
-  "permissions",
-  "audit",
-  "test",
-  "docs",
-  "other"
-];
-async function createPlan(provider, ctx, request, options = {}) {
-  const raw = await provider.generate({
-    messages: [
-      { role: "system", content: BASALT_KNOWLEDGE },
-      {
-        role: "user",
-        content: `REQUEST:
-${request}
-
-${buildPlanContext(ctx)}
-
-Return the plan as a single JSON object only.`
-      }
-    ],
-    temperature: options.temperature ?? 0,
-    maxTokens: options.maxTokens ?? 4096
-  });
-  return parsePlan(raw, request);
-}
-function parsePlan(raw, request) {
-  const json = extractJson(raw);
-  let obj;
-  try {
-    obj = JSON.parse(json);
-  } catch {
-    throw new Error(`ai:plan \u2014 the model did not return valid JSON. Got: ${raw.slice(0, 160)}\u2026`);
-  }
-  return {
-    request,
-    summary: typeof obj["summary"] === "string" ? obj["summary"] : "",
-    entities: normalizeEntities(obj["entities"]),
-    steps: normalizeSteps(obj["steps"]),
-    permissions: stringArray(obj["permissions"]),
-    auditEvents: stringArray(obj["auditEvents"]),
-    tenantScoped: obj["tenantScoped"] === true,
-    warnings: stringArray(obj["warnings"])
-  };
-}
-function extractJson(raw) {
-  const withoutFence = raw.replace(/```(?:json)?/gi, "").trim();
-  const start = withoutFence.indexOf("{");
-  const end = withoutFence.lastIndexOf("}");
-  if (start === -1 || end === -1 || end < start) return withoutFence;
-  return withoutFence.slice(start, end + 1);
-}
-function stringArray(value) {
-  return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
-}
-function normalizeEntities(value) {
-  if (!Array.isArray(value)) return [];
-  return value.filter((e) => typeof e === "object" && e !== null).map((e) => {
-    const relations = normalizeRelations(e["relations"]);
-    const entity = {
-      name: typeof e["name"] === "string" ? e["name"] : "Unnamed",
-      fields: normalizeFields(e["fields"]),
-      tenantScoped: e["tenantScoped"] === true,
-      ...relations.length > 0 ? { relations } : {}
-    };
-    return entity;
-  });
-}
-var lowerFirst = (s) => s.charAt(0).toLowerCase() + s.slice(1);
-var upperFirst = (s) => s.charAt(0).toUpperCase() + s.slice(1);
-function normalizeRelations(value) {
-  if (!Array.isArray(value)) return [];
-  const out = [];
-  for (const r of value) {
-    if (typeof r === "string" && r.trim() !== "") {
-      const model = r.trim();
-      out.push({ name: lowerFirst(model), model });
-    } else if (typeof r === "object" && r !== null) {
-      const obj = r;
-      const rawModel = typeof obj["model"] === "string" ? obj["model"] : "";
-      const rawName = typeof obj["name"] === "string" ? obj["name"] : "";
-      const model = rawModel !== "" ? rawModel : rawName !== "" ? upperFirst(rawName) : "";
-      if (model === "") continue;
-      out.push({ name: rawName !== "" ? rawName : lowerFirst(model), model });
-    }
-  }
-  return out;
-}
-function normalizeFields(value) {
-  if (!Array.isArray(value)) return [];
-  return value.filter((f) => typeof f === "object" && f !== null).map((f) => {
-    const values = Array.isArray(f["enum"]) ? f["enum"].filter((v) => typeof v === "string") : [];
-    return {
-      name: typeof f["name"] === "string" ? f["name"] : "",
-      type: typeof f["type"] === "string" ? f["type"] : "String",
-      ...values.length > 0 ? { enum: values } : {}
-    };
-  }).filter((f) => f.name !== "");
-}
-function normalizeSteps(value) {
-  if (!Array.isArray(value)) return [];
-  return value.filter((s) => typeof s === "object" && s !== null).map((s, index) => {
-    const command = typeof s["command"] === "string" ? s["command"] : void 0;
-    const files = stringArray(s["files"]);
-    const step = {
-      order: typeof s["order"] === "number" ? s["order"] : index + 1,
-      title: typeof s["title"] === "string" ? s["title"] : `Step ${index + 1}`,
-      kind: normalizeKind(s["kind"]),
-      detail: typeof s["detail"] === "string" ? s["detail"] : "",
-      ...command ? { command } : {},
-      ...files.length > 0 ? { files } : {}
-    };
-    return step;
-  }).sort((a, b) => a.order - b.order);
-}
-function normalizeKind(value) {
-  return typeof value === "string" && STEP_KINDS.includes(value) ? value : "other";
-}
-
-// src/plan/render.ts
-function renderPlan(plan, io) {
-  io.log("ARCHITECTURE PLAN");
-  io.log("");
-  io.log(`Request: "${plan.request}"`);
-  if (plan.summary) {
-    io.log("");
-    io.log(plan.summary);
-  }
-  if (plan.entities.length > 0) {
-    io.log("");
-    io.log("Entities:");
-    for (const entity of plan.entities) {
-      const scope = entity.tenantScoped ? " (tenant-scoped)" : "";
-      const fields = entity.fields.map((f) => `${f.name}: ${f.type}`).join(", ");
-      io.log(`  \u2022 ${entity.name}${scope}${fields ? ` \u2014 ${fields}` : ""}`);
-      if (entity.relations && entity.relations.length > 0) {
-        io.log(`      relations: ${entity.relations.map((r) => `${r.name} \u2192 ${r.model}`).join(", ")}`);
-      }
-    }
-  }
-  io.log("");
-  io.log("Steps:");
-  if (plan.steps.length === 0) {
-    io.log("  (none proposed)");
-  } else {
-    for (const step of plan.steps) {
-      const n = String(step.order).padStart(2, " ");
-      io.log(`  ${n}. [${step.kind}] ${step.title}`);
-      if (step.detail) io.log(`        ${step.detail}`);
-      if (step.command) io.log(`        $ ${step.command}`);
-      if (step.files && step.files.length > 0) io.log(`        files: ${step.files.join(", ")}`);
-    }
-  }
-  if (plan.permissions.length > 0) {
-    io.log("");
-    io.log(`Permissions: ${plan.permissions.join(", ")}`);
-  }
-  if (plan.auditEvents.length > 0) {
-    io.log(`Audit events: ${plan.auditEvents.join(", ")}`);
-  }
-  if (plan.warnings.length > 0) {
-    io.log("");
-    io.log("\u26A0 Warnings:");
-    for (const warning of plan.warnings) io.log(`  - ${warning}`);
-  }
-  io.log("");
-  io.log("This is a plan only \u2014 nothing was changed.");
-  io.log("Next: `basalt ai:make` will execute it (arrives in the next phase).");
-}
-
-// src/make/make.ts
-import {
-  FileExistsError,
-  generateResource,
-  names as names6,
-  registerResourceInApp,
-  writeGenerated
-} from "@basaltkit/generator";
-
-// src/make/fields.ts
-var RESERVED = /* @__PURE__ */ new Set(["id", "name", "createdat", "updatedat", "deletedat", "tenantid"]);
-function canonicalType(raw) {
-  switch (raw.trim().toLowerCase()) {
-    case "int":
-    case "integer":
-    case "number":
-    case "bigint":
-      return "Int";
-    case "float":
-    case "decimal":
-    case "double":
-      return "Float";
-    case "bool":
-    case "boolean":
-      return "Boolean";
-    case "date":
-    case "datetime":
-    case "timestamp":
-      return "DateTime";
-    case "json":
-    case "object":
-      return "Json";
-    default:
-      return "String";
-  }
-}
-function prismaType(t) {
-  return t;
-}
-function zodValidator(t, create) {
-  switch (t) {
-    case "Int":
-      return "z.number().int()";
-    case "Float":
-      return "z.number()";
-    case "Boolean":
-      return "z.boolean()";
-    case "DateTime":
-      return create ? "z.coerce.date()" : "z.string()";
-    case "Json":
-      return "z.unknown()";
-    case "String":
-      return create ? "z.string().min(1)" : "z.string()";
-  }
-}
-function usable(field) {
-  return field.name.trim() !== "" && !RESERVED.has(field.name.toLowerCase());
-}
-function zodForField(field, create) {
-  if (field.enum && field.enum.length > 0) {
-    return `z.enum([${field.enum.map((v) => `'${v}'`).join(", ")}])`;
-  }
-  return zodValidator(canonicalType(field.type), create);
-}
-function domainFields(fields) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const field of fields) {
-    const key = field.name.toLowerCase();
-    if (!usable(field) || seen.has(key)) continue;
-    seen.add(key);
-    out.push(field);
-  }
-  return out;
-}
-function hasPrismaField(content, name) {
-  return new RegExp(`^[ \\t]*${name}[ \\t]+`, "m").test(content);
-}
-function injectPrismaFields(content, fields, tenantScoped, removeName = false) {
-  const nameAnchor = /^([ \t]*)name[ \t]+String.*$/m;
-  if (!nameAnchor.test(content)) return { content, injected: false };
-  const extras = [];
-  if (tenantScoped && !hasPrismaField(content, "tenantId")) extras.push("  tenantId  String");
-  for (const field of domainFields(fields)) {
-    if (hasPrismaField(content, field.name)) continue;
-    extras.push(`  ${field.name}  ${prismaType(canonicalType(field.type))}`);
-  }
-  if (extras.length === 0) return { content, injected: false };
-  let out = content.replace(nameAnchor, (line) => `${line}
-${extras.join("\n")}`);
-  if (tenantScoped) out = out.replace(/\n\}\s*$/, `
-
-  @@index([tenantId])
-}
-`);
-  if (removeName) out = out.replace(/^[ \t]*name[ \t]+String\b.*\n/m, "");
-  return { content: out, injected: true };
-}
-function injectZodFields(content, fields, removeName = false) {
-  const usableFields = domainFields(fields);
-  if (usableFields.length === 0) return { content, injected: false };
-  let out = content;
-  let injected = false;
-  const entityAnchor = /^([ \t]*)name: z\.string\(\),.*$/m;
-  const entityLines = usableFields.map((f) => `  ${f.name}: ${zodForField(f, false)},`);
-  if (entityAnchor.test(out)) {
-    out = out.replace(entityAnchor, (line) => `${line}
-${entityLines.join("\n")}`);
-    injected = true;
-  }
-  const createAnchor = /^([ \t]*)name: z\.string\(\)\.min\(1\),.*$/m;
-  const createLines = usableFields.map((f) => `  ${f.name}: ${zodForField(f, true)},`);
-  if (createAnchor.test(out)) {
-    out = out.replace(createAnchor, (line) => `${line}
-${createLines.join("\n")}`);
-    injected = true;
-  }
-  if (removeName) {
-    out = out.replace(/^[ \t]*name: z\.string\(\),.*\n/m, "");
-    out = out.replace(/^[ \t]*name: z\.string\(\)\.min\(1\),.*\n/m, "");
-  }
-  return { content: out, injected };
-}
-
-// src/make/relations.ts
-import { names } from "@basaltkit/generator";
-function foreignKey(relation) {
-  return `${relation.name}Id`;
-}
-function relationForeignKeys(entity) {
-  return (entity.relations ?? []).map((r) => ({ name: foreignKey(r), type: "String" }));
-}
-function relationFieldLines(entity) {
-  return (entity.relations ?? []).map(
-    (r) => `  ${r.name} ${names(r.model).pascal} @relation(fields: [${foreignKey(r)}], references: [id])`
-  );
-}
-function inverseRelationLines(modelName, allEntities) {
-  const target = names(modelName).pascal;
-  const lines = [];
-  for (const other of allEntities) {
-    if (names(other.name).pascal === target) continue;
-    for (const r of other.relations ?? []) {
-      if (names(r.model).pascal === target) {
-        lines.push(`  ${pluralCamel(other.name)} ${names(other.name).pascal}[]`);
-      }
-    }
-  }
-  return lines;
-}
-function injectPrismaRelations(content, relationLines, inverseLines) {
-  const all = [...relationLines, ...inverseLines];
-  if (all.length === 0) return { content, injected: false };
-  const out = content.replace(/\n\}\s*$/, `
-${all.join("\n")}
-}
-`);
-  return { content: out, injected: out !== content };
-}
-function externalRelationTargets(entities) {
-  const planModels = new Set(entities.map((e) => names(e.name).pascal));
-  const external = /* @__PURE__ */ new Set();
-  for (const e of entities) {
-    for (const r of e.relations ?? []) {
-      const target = names(r.model).pascal;
-      if (!planModels.has(target)) external.add(target);
-    }
-  }
-  return [...external];
-}
-function pluralCamel(name) {
-  return names(name).pluralKebab.split("-").map((part, i) => i === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)).join("");
-}
-
-// src/make/openapi.ts
-import { names as names2 } from "@basaltkit/generator";
-function summaryFor(method, url, singular, plural) {
-  switch (method.toUpperCase()) {
-    case "GET":
-      return url.includes(":id") ? `Get a ${singular}` : `List ${plural}`;
-    case "POST":
-      return url.endsWith("/restore") ? `Restore a ${singular}` : `Create a ${singular}`;
-    case "PATCH":
-    case "PUT":
-      return `Update a ${singular}`;
-    case "DELETE":
-      return `Delete a ${singular}`;
-    default:
-      return `${singular} operation`;
-  }
-}
-function injectOpenApiMeta(content, entityName) {
-  const n = names2(entityName);
-  const singular = n.kebab.replace(/-/g, " ");
-  const plural = n.pluralKebab.replace(/-/g, " ");
-  const tag = n.pascal;
-  let injected = false;
-  const out = content.replace(
-    /route\(\{\s*\n(\s*)method: '(\w+)',\s*\n\s*url: '([^']*)',(?:\s*\n\s*meta: \{([^}]*)\},)?/g,
-    (_match, indent, method, url, metaInner) => {
-      const extra = `summary: '${summaryFor(method, url, singular, plural)}', tags: ['${tag}']`;
-      const meta = metaInner !== void 0 ? `{ ${metaInner.trim()}, ${extra} }` : `{ ${extra} }`;
-      injected = true;
-      return `route({
-${indent}method: '${method}',
-${indent}url: '${url}',
-${indent}meta: ${meta},`;
-    }
-  );
-  return { content: out, injected };
-}
-
-// src/make/permissions.ts
-import { names as names3 } from "@basaltkit/generator";
-function permissionList(name) {
-  const prefix = names3(name).pluralKebab;
-  return ["view", "create", "update", "delete"].map((action) => `${prefix}.${action}`);
-}
-function renderPermissionsFile(name) {
-  const n = names3(name);
-  const listLines = permissionList(name).map((p) => `  '${p}',`).join("\n");
-  return `import { GLOBAL_SCOPE, type AccessStore } from '@basaltkit/permissions'
-
-/** RBAC permissions for the ${n.pascal} resource \u2014 the ones its routes guard on. */
-export const ${n.constant}_PERMISSIONS = [
-${listLines}
-] as const
-
-/** Grant every ${n.pascal} permission to a role (default scope: global). */
-export async function grant${n.pascal}Permissions(
-  store: AccessStore,
-  role: string,
-  scope: string = GLOBAL_SCOPE,
-): Promise<void> {
-  await store.grantToRole(role, [...${n.constant}_PERMISSIONS], scope)
-}
-`;
-}
-
-// src/make/repository.ts
-import { names as names4 } from "@basaltkit/generator";
-function rowType(t) {
-  switch (t) {
-    case "Int":
-    case "Float":
-      return "number";
-    case "Boolean":
-      return "boolean";
-    case "DateTime":
-      return "Date";
-    case "Json":
-      return "unknown";
-    case "String":
-      return "string";
-  }
-}
-function mapExpr(field, t) {
-  return t === "DateTime" ? `r.${field}.toISOString()` : `r.${field}`;
-}
-function renderPrismaRepository(name, fields, options) {
-  const n = names4(name);
-  const { softDelete, tenantScoped, keepName } = options;
-  const bodyFields = [];
-  if (keepName) bodyFields.push({ name: "name", canon: "String" });
-  for (const f of domainFields(fields)) {
-    bodyFields.push({ name: f.name, canon: canonicalType(f.type), ...f.enum && f.enum.length > 0 ? { values: f.enum } : {} });
-  }
-  const colType = (f) => f.values ? "string" : rowType(f.canon);
-  const colExpr = (f) => f.values ? `r.${f.name} as ${f.values.map((v) => `'${v}'`).join(" | ")}` : mapExpr(f.name, f.canon);
-  const rowTypeEntries = [
-    "id: string",
-    ...bodyFields.map((f) => `${f.name}: ${colType(f)}`),
-    "createdAt: Date",
-    "updatedAt: Date",
-    ...softDelete ? ["deletedAt: Date | null"] : []
-  ].join("; ");
-  const mapLines = [
-    "  id: r.id,",
-    ...bodyFields.map((f) => `  ${f.name}: ${colExpr(f)},`),
-    "  createdAt: r.createdAt.toISOString(),",
-    "  updatedAt: r.updatedAt.toISOString(),",
-    ...softDelete ? ["  deletedAt: r.deletedAt ? r.deletedAt.toISOString() : null,"] : []
-  ].join("\n");
-  const tenant = (soft) => ["id", tenantScoped ? "tenantId: currentTenantId()" : "", soft && softDelete ? "deletedAt: null" : ""].filter(Boolean).join(", ");
-  const listWhere = [tenantScoped ? "tenantId: currentTenantId()" : "", softDelete ? "deletedAt: null" : ""].filter(Boolean).join(", ");
-  const createData = tenantScoped ? "{ ...input, tenantId: currentTenantId() }" : "input";
-  const updateMethod = tenantScoped ? `  async update(id: string, input: Update${n.pascal}Input): Promise<${n.pascal} | null> {
-    const res = await this.records.updateMany({ where: { ${tenant(true)} }, data: input })
-    return res.count > 0 ? this.find(id) : null
-  }` : `  async update(id: string, input: Update${n.pascal}Input): Promise<${n.pascal} | null> {
-    try {
-      return to${n.pascal}(await this.records.update({ where: { id }, data: input }))
-    } catch {
-      return null
-    }
-  }`;
-  const deleteMethod = renderDelete(tenantScoped, softDelete);
-  const restoreMethod = softDelete ? `
-
-${renderRestore(tenantScoped)}` : "";
-  const interfaceRestore = softDelete ? `
-  restore(id: string): Promise<boolean>` : "";
-  const coreImport = tenantScoped ? "createToken, tryCtx" : "createToken";
-  const httpImport = tenantScoped ? `
-import { HttpError } from '@basaltkit/fastify'` : "";
-  const tenantHelper = tenantScoped ? `
-// Tenant-scoped model. Scoped by tenantId explicitly from the request context, so
-// it works even on a raw client shared with non-tenant models (no global extension).
-// A missing tenant is a client error (400) \u2014 never a silent 500.
-const currentTenantId = (): string => {
-  const id = (tryCtx()?.['tenant'] as { id?: string } | undefined)?.id
-  if (!id) throw new HttpError(400, 'TENANT_REQUIRED', 'No tenant in context \u2014 send the x-tenant-id header (or resolve a tenant first).')
-  return id
-}
-` : "";
-  return `import { ${coreImport} } from '@basaltkit/core'
-import { db } from '@basaltkit/prisma'${httpImport}
-import type { PrismaClient } from '@prisma/client'
-import type { ${n.pascal}, Create${n.pascal}Input, Update${n.pascal}Input } from './${n.kebab}.schema.js'
-${tenantHelper}
-// Map the Prisma row (Date columns) to the API type (ISO-string timestamps).
-const to${n.pascal} = (r: { ${rowTypeEntries} }): ${n.pascal} => ({
-${mapLines}
-})
-
-export interface ${n.pascal}Repository {
-  list(): Promise<${n.pascal}[]>
-  find(id: string): Promise<${n.pascal} | null>
-  create(input: Create${n.pascal}Input): Promise<${n.pascal}>
-  update(id: string, input: Update${n.pascal}Input): Promise<${n.pascal} | null>
-  delete(id: string): Promise<boolean>${interfaceRestore}
-}
-
-export class Prisma${n.pascal}Repository implements ${n.pascal}Repository {
-  private get records() {
-    return db<PrismaClient>().${n.camel}
-  }
-
-  async list(): Promise<${n.pascal}[]> {
-    return (await this.records.findMany(${listWhere ? `{ where: { ${listWhere} } }` : ""})).map(to${n.pascal})
-  }
-
-  async find(id: string): Promise<${n.pascal} | null> {
-    const r = await this.records.findFirst({ where: { ${tenant(true)} } })
-    return r ? to${n.pascal}(r) : null
-  }
-
-  async create(input: Create${n.pascal}Input): Promise<${n.pascal}> {
-    return to${n.pascal}(await this.records.create({ data: ${createData} }))
-  }
-
-${updateMethod}
-
-${deleteMethod}${restoreMethod}
-}
-
-export const ${n.constant}_REPOSITORY = createToken<${n.pascal}Repository>('${n.kebab}.repository')
-`;
-}
-function renderDelete(tenantScoped, softDelete) {
-  if (tenantScoped) {
-    const where = softDelete ? "id, tenantId: currentTenantId(), deletedAt: null" : "id, tenantId: currentTenantId()";
-    const op2 = softDelete ? `updateMany({ where: { ${where} }, data: { deletedAt: new Date() } })` : `deleteMany({ where: { ${where} } })`;
-    return `  async delete(id: string): Promise<boolean> {
-    const res = await this.records.${op2}
-    return res.count > 0
-  }`;
-  }
-  const op = softDelete ? `update({ where: { id }, data: { deletedAt: new Date() } })` : `delete({ where: { id } })`;
-  return `  async delete(id: string): Promise<boolean> {
-    try {
-      await this.records.${op}
-      return true
-    } catch {
-      return false
-    }
-  }`;
-}
-function renderRestore(tenantScoped) {
-  if (tenantScoped) {
-    return `  async restore(id: string): Promise<boolean> {
-    const res = await this.records.updateMany({ where: { id, tenantId: currentTenantId() }, data: { deletedAt: null } })
-    return res.count > 0
-  }`;
-  }
-  return `  async restore(id: string): Promise<boolean> {
-    try {
-      await this.records.update({ where: { id }, data: { deletedAt: null } })
-      return true
-    } catch {
-      return false
-    }
-  }`;
-}
-
-// src/make/schema.ts
-import { execFile } from "child_process";
-import { readFile, writeFile as writeFile2 } from "fs/promises";
-import { join as join3 } from "path";
-import { promisify } from "util";
-var run = promisify(execFile);
-function extractModelBlock(snippet) {
-  const match = /model\s+(\w+)\s*\{[\s\S]*?\n\}/.exec(snippet);
-  if (!match || !match[1]) return null;
-  return { name: match[1], block: match[0] };
-}
-function mergeModelsIntoSchema(schema, blocks) {
-  let content = schema.replace(/\s*$/, "");
-  const merged = [];
-  const skipped = [];
-  for (const { name, block } of blocks) {
-    if (new RegExp(`\\bmodel\\s+${name}\\s*\\{`).test(content)) {
-      skipped.push(name);
-      continue;
-    }
-    content += `
-
-${block.trim()}
-`;
-    merged.push(name);
-  }
-  return { content: content.endsWith("\n") ? content : `${content}
-`, merged, skipped };
-}
-async function readSchema(baseDir, schemaPath) {
-  try {
-    return await readFile(join3(baseDir, schemaPath), "utf8");
-  } catch {
-    return null;
-  }
-}
-async function writeSchema(baseDir, schemaPath, content) {
-  await writeFile2(join3(baseDir, schemaPath), content);
-}
-async function runPrismaPush(baseDir) {
-  try {
-    const { stdout } = await run("npx", ["prisma", "db", "push"], {
-      cwd: baseDir,
-      timeout: 18e4,
-      maxBuffer: 10 * 1024 * 1024
-    });
-    return { ok: true, output: stdout.slice(-2e3) };
-  } catch (error) {
-    const e = error;
-    const output = (e.stdout ?? "") + (e.stderr ?? "") || e.message || "unknown error";
-    return { ok: false, output: output.slice(-3e3) };
-  }
-}
-
-// src/make/wire.ts
-import { names as names5 } from "@basaltkit/generator";
-function insertAfterLastImport(content, line) {
-  const imports = [...content.matchAll(/^import .*$/gm)];
-  const last = imports.at(-1);
-  if (!last || last.index === void 0) return `${line}
-${content}`;
-  const at = last.index + last[0].length;
-  return `${content.slice(0, at)}
-${line}${content.slice(at)}`;
-}
-function actionFor(method, url) {
-  switch (method.toUpperCase()) {
-    case "GET":
-      return "view";
-    case "POST":
-      return url.endsWith("/restore") ? "update" : "create";
-    case "PATCH":
-    case "PUT":
-      return "update";
-    case "DELETE":
-      return "delete";
-    default:
-      return null;
-  }
-}
-function injectPermissionGuards(content, prefix) {
-  if (!prefix) return { content, injected: false };
-  let injected = false;
-  const out = content.replace(
-    /route\(\{\s*\n(\s*)method: '(\w+)',\s*\n\s*url: '([^']*)',/g,
-    (match, indent, method, url) => {
-      const action = actionFor(method, url);
-      if (!action) return match;
-      injected = true;
-      return `route({
-${indent}method: '${method}',
-${indent}url: '${url}',
-${indent}meta: { can: '${prefix}.${action}' },`;
-    }
-  );
-  return { content: out, injected };
-}
-function eventFor(events, suffix) {
-  const match = events.find((e) => e.endsWith(`.${suffix}`));
-  if (match) return match;
-  const prefix = events[0]?.split(".")[0] ?? "record";
-  return `${prefix}.${suffix}`;
-}
-function injectAuditService(content, resourceName, events) {
-  const n = names5(resourceName);
-  const ctorAnchor = `constructor(private readonly repository: ${n.pascal}Repository) {}`;
-  if (!content.includes(ctorAnchor)) return { content, injected: false };
-  let out = insertAfterLastImport(content, `import type { Audit } from '@basaltkit/audit'`);
-  out = out.replace(
-    ctorAnchor,
-    `constructor(
-    private readonly repository: ${n.pascal}Repository,
-    private readonly audit: Audit,
-  ) {}`
-  );
-  out = out.replace(
-    `  create(input: Create${n.pascal}Input) {
-    return this.repository.create(input)
-  }`,
-    `  async create(input: Create${n.pascal}Input) {
-    const created = await this.repository.create(input)
-    await this.audit.record('${eventFor(events, "created")}', created)
-    return created
-  }`
-  );
-  out = out.replace(
-    `  update(id: string, input: Update${n.pascal}Input) {
-    return this.repository.update(id, input)
-  }`,
-    `  async update(id: string, input: Update${n.pascal}Input) {
-    const updated = await this.repository.update(id, input)
-    if (updated) await this.audit.record('${eventFor(events, "updated")}', updated)
-    return updated
-  }`
-  );
-  out = out.replace(
-    `  remove(id: string) {
-    return this.repository.delete(id)
-  }`,
-    `  async remove(id: string) {
-    const removed = await this.repository.delete(id)
-    if (removed) await this.audit.record('${eventFor(events, "deleted")}', { id })
-    return removed
-  }`
-  );
-  return { content: out, injected: true };
-}
-function injectAuditPlugin(content, resourceName) {
-  const n = names5(resourceName);
-  const anchor = `new ${n.pascal}Service(c.get(${n.constant}_REPOSITORY))`;
-  if (!content.includes(anchor)) return { content, injected: false };
-  let out = insertAfterLastImport(content, `import { AUDIT } from '@basaltkit/audit'`);
-  out = out.replace(anchor, `new ${n.pascal}Service(c.get(${n.constant}_REPOSITORY), c.get(AUDIT))`);
-  return { content: out, injected: true };
-}
-
-// src/make/make.ts
-async function runMake(ctx, plan, options = {}) {
-  const entities = plan.entities.filter((e) => e.name.trim() !== "");
-  if (entities.length === 0) {
-    throw new Error("ai:make \u2014 the plan has no entity to generate.");
-  }
-  const baseDir = options.baseDir ?? process.cwd();
-  const prismaDefault = ctx.stack.orm === "prisma";
-  const resources = [];
-  for (const entity of entities) {
-    const gen = findGeneratorCommand(plan, entity.name);
-    const prisma = options.prisma ?? gen?.prisma ?? prismaDefault;
-    const softDelete = options.softDelete ?? gen?.softDelete ?? false;
-    const generated = generateResource(entity.name, { prisma, softDelete });
-    const { files, augmented, guarded, audited } = augmentFiles(generated, entity, plan, ctx, { prisma, softDelete });
-    const build = {
-      name: entity.name,
-      prisma,
-      softDelete,
-      files,
-      augmented,
-      guarded,
-      audited,
-      written: [],
-      registered: false
-    };
-    if (!options.dryRun) {
-      try {
-        build.written = await writeGenerated(files, {
-          baseDir,
-          ...options.force ? { force: true } : {}
-        });
-        const reg = await registerResourceInApp(entity.name, { baseDir });
-        build.registered = reg.registered;
-        if (!reg.registered && reg.reason && reg.reason !== "already registered") {
-          build.note = `not auto-wired: ${reg.reason}`;
-        }
-      } catch (error) {
-        if (error instanceof FileExistsError) {
-          build.note = error.message.split("\n")[0] ?? error.message;
-        } else {
-          throw error;
-        }
-      }
-    }
-    resources.push(build);
-  }
-  const { schema, migration } = await mergeSchema(resources, baseDir, options);
-  const followUps = buildFollowUps(plan, resources, schema, migration);
-  const review = reviewBuild(ctx, plan, resources, schema, migration);
-  return {
-    request: plan.request,
-    dryRun: options.dryRun === true,
-    resources,
-    ...schema ? { schema } : {},
-    ...migration ? { migration } : {},
-    followUps,
-    review
-  };
-}
-async function mergeSchema(resources, baseDir, options) {
-  const prismaResources = resources.filter((r) => r.prisma);
-  if (prismaResources.length === 0) return { schema: void 0, migration: void 0 };
-  const schemaPath = options.schemaPath ?? "prisma/schema.prisma";
-  const blocks = prismaResources.map((r) => r.files.find((f) => f.path.endsWith(".prisma"))).map((f) => f ? extractModelBlock(f.content) : null).filter((b) => b !== null);
-  const existing = await readSchema(baseDir, schemaPath);
-  if (existing === null) {
-    return { schema: { path: schemaPath, found: false, merged: [], skipped: [], written: false }, migration: void 0 };
-  }
-  const outcome = mergeModelsIntoSchema(existing, blocks);
-  const schema = {
-    path: schemaPath,
-    found: true,
-    merged: outcome.merged,
-    skipped: outcome.skipped,
-    written: false
-  };
-  if (options.dryRun) return { schema, migration: void 0 };
-  if (outcome.merged.length > 0) {
-    await writeSchema(baseDir, schemaPath, outcome.content);
-    schema.written = true;
-  }
-  if (options.migrate && (schema.written || outcome.skipped.length > 0)) {
-    const push = await runPrismaPush(baseDir);
-    return { schema, migration: { ok: push.ok, output: push.output } };
-  }
-  return { schema, migration: void 0 };
-}
-function findGeneratorCommand(plan, entityName) {
-  for (const step of plan.steps) {
-    if (step.kind !== "generator" || !step.command) continue;
-    const parsed = parseGeneratorCommand(step.command);
-    if (parsed && parsed.name.toLowerCase() === entityName.toLowerCase()) return parsed;
-  }
-  return null;
-}
-function parseGeneratorCommand(command) {
-  const match = /make:resource\s+(\w+)([^\n]*)/.exec(command);
-  if (!match || !match[1]) return null;
-  const rest = match[2] ?? "";
-  return { name: match[1], prisma: /--prisma\b/.test(rest), softDelete: /--soft-delete\b/.test(rest) };
-}
-function augmentFiles(files, entity, plan, ctx, opts) {
-  const tenantScoped = ctx.stack.tenancy && entity.tenantScoped;
-  const effectiveFields = [...entity.fields, ...relationForeignKeys(entity)];
-  const removeName = domainFields(effectiveFields).length > 0 && !effectiveFields.some((f) => f.name.toLowerCase() === "name");
-  const keepName = !removeName;
-  const guardPrefix = names6(entity.name).pluralKebab;
-  const wireGuards = ctx.stack.rbac && plan.permissions.length > 0;
-  const wireAudit = ctx.stack.audit && plan.auditEvents.length > 0;
-  let augmented = false;
-  let guarded = false;
-  let audited = false;
-  const out = files.map((file) => {
-    if (file.path.endsWith(".prisma")) {
-      const withFields = injectPrismaFields(file.content, effectiveFields, tenantScoped, removeName);
-      const withRelations = injectPrismaRelations(
-        withFields.content,
-        relationFieldLines(entity),
-        inverseRelationLines(entity.name, plan.entities)
-      );
-      augmented = augmented || withFields.injected || withRelations.injected;
-      return { ...file, content: withRelations.content };
-    }
-    if (file.path.endsWith(".schema.ts")) {
-      const result = injectZodFields(file.content, effectiveFields, removeName);
-      augmented = augmented || result.injected;
-      return { ...file, content: result.content };
-    }
-    if (file.path.endsWith(".repository.ts") && opts.prisma) {
-      const content = renderPrismaRepository(entity.name, effectiveFields, {
-        softDelete: opts.softDelete,
-        tenantScoped,
-        keepName
-      });
-      return { ...file, content };
-    }
-    if (file.path.endsWith(".routes.ts")) {
-      let content = file.content;
-      if (wireGuards) {
-        const result = injectPermissionGuards(content, guardPrefix);
-        content = result.content;
-        guarded = guarded || result.injected;
-      }
-      content = injectOpenApiMeta(content, entity.name).content;
-      return { ...file, content };
-    }
-    if (file.path.endsWith(".service.ts") && wireAudit) {
-      const result = injectAuditService(file.content, entity.name, plan.auditEvents);
-      audited = audited || result.injected;
-      return { ...file, content: result.content };
-    }
-    if (file.path.endsWith(".plugin.ts") && wireAudit) {
-      const result = injectAuditPlugin(file.content, entity.name);
-      return { ...file, content: result.content };
-    }
-    return file;
-  });
-  if (guarded) {
-    const kebab2 = names6(entity.name).kebab;
-    out.push({ path: `src/modules/${kebab2}/${kebab2}.permissions.ts`, content: renderPermissionsFile(entity.name) });
-  }
-  return { files: out, augmented, guarded, audited };
-}
-function buildFollowUps(plan, resources, schema, migration) {
-  const followUps = [];
-  const prismaResources = resources.filter((r) => r.prisma);
-  if (prismaResources.length > 0) {
-    if (!schema?.found) {
-      const list = prismaResources.map((r) => `src/modules/${kebab(r.name)}/${kebab(r.name)}.prisma`).join(", ");
-      followUps.push(
-        `Add the generated model(s) (${list}) to prisma/schema.prisma, then run \`npx prisma db push\` and restart the server.`
-      );
-    } else if (migration) {
-      followUps.push(
-        migration.ok ? "Restart the server so it loads the regenerated Prisma client." : "`prisma db push` failed \u2014 check the output, fix it, and re-run `npx prisma db push`."
-      );
-    } else {
-      followUps.push(
-        "Run `npx prisma db push` (or re-run `ai:make --migrate`) to create the table(s) + regenerate the client, then restart the server."
-      );
-    }
-  }
-  const external = externalRelationTargets(plan.entities);
-  if (external.length > 0) {
-    followUps.push(
-      `Relations reference model(s) not in this plan (${external.join(", ")}). Add the inverse field (e.g. \`items <This>[]\`) to those existing models in schema.prisma so Prisma can validate the relation.`
-    );
-  }
-  const guardedResources = resources.filter((r) => r.guarded);
-  const audited = resources.some((r) => r.audited);
-  if (plan.permissions.length > 0 && guardedResources.length === 0) {
-    followUps.push(`Register RBAC permissions (${plan.permissions.join(", ")}) and guard the routes.`);
-  } else if (guardedResources.length > 0) {
-    const helpers = guardedResources.map((r) => `grant${names6(r.name).pascal}Permissions(store, 'admin')`).join(", ");
-    followUps.push(`Grant permissions to your roles during seed/setup \u2014 call ${helpers} (declared in each module's *.permissions.ts).`);
-  }
-  if (plan.auditEvents.length > 0 && !audited) {
-    followUps.push(`Emit audit events (${plan.auditEvents.join(", ")}) on create/update/delete.`);
-  }
-  return followUps;
-}
-function reviewBuild(ctx, plan, resources, schema, migration) {
-  const items = [];
-  if (ctx.stack.tenancy) {
-    const tenantEntities = plan.entities.filter((e) => e.tenantScoped);
-    if (tenantEntities.length === 0) {
-      items.push({ label: "Tenant isolation", status: "warn", detail: "no entity marked tenant-scoped \u2014 confirm that is intended" });
-    } else {
-      const missing = resources.filter(
-        (r) => plan.entities.find((e) => e.name === r.name)?.tenantScoped && !hasTenantId(r)
-      );
-      items.push(
-        missing.length === 0 ? { label: "Tenant isolation", status: "pass", detail: "tenantId present on tenant-scoped models" } : { label: "Tenant isolation", status: "fail", detail: `missing tenantId: ${missing.map((r) => r.name).join(", ")}` }
-      );
-    }
-  } else {
-    items.push({ label: "Tenant isolation", status: "pass", detail: "tenancy is off \u2014 not applicable" });
-  }
-  const hasRoutes = resources.every((r) => r.files.some((f) => f.path.endsWith(".routes.ts")));
-  const hasSchema = resources.every((r) => r.files.some((f) => f.path.endsWith(".schema.ts")));
-  items.push(
-    hasRoutes && hasSchema ? { label: "Validation & routes", status: "pass", detail: "Zod schema + typed routes generated" } : { label: "Validation & routes", status: "fail", detail: "schema or routes missing" }
-  );
-  const hasTests = resources.every((r) => r.files.some((f) => f.path.endsWith(".test.ts")));
-  items.push(
-    hasTests ? { label: "Tests", status: "pass", detail: "a test file was generated per resource" } : { label: "Tests", status: "fail", detail: "no test generated" }
-  );
-  if (plan.permissions.length > 0) {
-    const guarded = resources.some((r) => r.guarded);
-    items.push(
-      guarded ? { label: "Permissions", status: "pass", detail: "routes guarded + permissions declared in *.permissions.ts (grant via the helper)" } : {
-        label: "Permissions",
-        status: "warn",
-        detail: ctx.stack.rbac ? "planned but not auto-wired" : "RBAC (@basaltkit/permissions) not enabled \u2014 wire manually"
-      }
-    );
-  }
-  if (plan.auditEvents.length > 0) {
-    const audited = resources.some((r) => r.audited);
-    items.push(
-      audited ? { label: "Audit", status: "pass", detail: "AUDIT.record() wired into create/update/delete" } : {
-        label: "Audit",
-        status: "warn",
-        detail: ctx.stack.audit ? "planned but not auto-wired" : "audit (@basaltkit/audit) not enabled \u2014 wire manually"
-      }
-    );
-  }
-  if (resources.some((r) => r.prisma)) {
-    if (migration?.ok) {
-      items.push({ label: "Migration", status: "pass", detail: "model merged into schema.prisma + prisma db push ran" });
-    } else if (migration) {
-      items.push({ label: "Migration", status: "fail", detail: "prisma db push failed \u2014 see output" });
-    } else if (schema?.found) {
-      items.push({ label: "Migration", status: "warn", detail: "model merged into schema.prisma \u2014 run npx prisma db push" });
-    } else {
-      items.push({ label: "Migration", status: "warn", detail: "add the model to schema.prisma + run npx prisma db push" });
-    }
-  }
-  return { items, ok: !items.some((i) => i.status === "fail") };
-}
-function hasTenantId(resource) {
-  const model = resource.files.find((f) => f.path.endsWith(".prisma"));
-  if (!model) return false;
-  return /^[ \t]*tenantId[ \t]+/m.test(model.content);
-}
-function kebab(name) {
-  return name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[\s_]+/g, "-").toLowerCase();
-}
-
-// src/make/render.ts
-var REVIEW_MARK = { pass: "\u2713", warn: "\u26A0", fail: "\u2717" };
-function renderMakeResult(result, io) {
-  for (const resource of result.resources) {
-    const verb = result.dryRun ? "Would generate" : "Generated";
-    const extras = [
-      resource.augmented ? "domain fields" : null,
-      resource.guarded ? "permission guards" : null,
-      resource.audited ? "audit" : null
-    ].filter((x) => x !== null);
-    const tag = extras.length > 0 ? ` (+ ${extras.join(", ")})` : "";
-    io.log(`${verb} ${resource.name}${tag}:`);
-    const paths = result.dryRun ? resource.files.map((f) => f.path) : resource.written;
-    for (const path of paths) io.log(`  ${result.dryRun ? "~" : "+"} ${path}`);
-    if (!result.dryRun) {
-      io.log(resource.registered ? "  \u2713 wired into src/app.ts" : "  \u2022 src/app.ts not auto-wired");
-    }
-    if (resource.note) io.log(`  \u26A0 ${resource.note}`);
-    io.log("");
-  }
-  if (result.schema) {
-    const s = result.schema;
-    if (!s.found) {
-      io.log(`Schema: ${s.path} not found \u2014 add the model(s) manually.`);
-    } else {
-      const parts = [];
-      if (s.merged.length > 0) parts.push(`${result.dryRun ? "would merge" : "merged"} ${s.merged.join(", ")}`);
-      if (s.skipped.length > 0) parts.push(`already present: ${s.skipped.join(", ")}`);
-      io.log(`Schema (${s.path}): ${parts.length > 0 ? parts.join("; ") : "no change"}`);
-    }
-  }
-  if (result.migration) {
-    io.log(result.migration.ok ? "Migration: \u2713 prisma db push" : "Migration: \u2717 prisma db push failed");
-    if (!result.migration.ok) {
-      for (const line of result.migration.output.split("\n").slice(-6)) io.log(`  ${line}`);
-    }
-  }
-  if (result.schema || result.migration) io.log("");
-  io.log("Review:");
-  for (const item of result.review.items) {
-    io.log(`  ${REVIEW_MARK[item.status]} ${item.label} \u2014 ${item.detail}`);
-  }
-  io.log("");
-  if (result.followUps.length > 0) {
-    io.log("Next steps (manual):");
-    for (const step of result.followUps) io.log(`  - ${step}`);
-    io.log("");
-  }
-  if (result.dryRun) {
-    io.log("Dry run \u2014 nothing was written. Re-run without --dry-run to apply.");
-  } else if (result.review.ok) {
-    io.log("\u2713 Implementation completed.");
-  } else {
-    io.log("\u2717 Implementation completed with blocking review issues \u2014 see above.");
-  }
-}
-
-// src/make/verify.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var run2 = promisify2(execFile2);
-async function verifyProject(baseDir, command = "pnpm", args = ["-s", "typecheck"]) {
-  const label = `${command} ${args.join(" ")}`;
-  try {
-    await run2(command, args, { cwd: baseDir, timeout: 18e4, maxBuffer: 10 * 1024 * 1024 });
-    return { ok: true, command: label, output: "" };
-  } catch (error) {
-    const e = error;
-    const output = (e.stdout ?? "") + (e.stderr ?? "") || e.message || "unknown error";
-    return { ok: false, command: label, output: output.slice(-4e3) };
-  }
-}
-
-// src/review/knowledge.ts
-var REVIEW_KNOWLEDGE = `You are the Review agent for Basalt, a SaaS framework (Fastify + Prisma + Zod). Given a feature request, its plan, the deterministic review results and the generated code, decide whether the implementation is correct and on-convention. You do NOT rewrite code \u2014 you review it, precisely.
-
-SCOPE: \`ai:make\` generates a BACKEND resource vertical only \u2014 Prisma model, Zod schema, typed routes, service, repository, permissions and a test. It does NOT generate web/UI, React, frontend pages, background jobs, emails or infrastructure; other tools do. Review ONLY the backend vertical, on its own terms. If the request also asks for something outside this scope (a web page, a component, a job\u2026), mention it as a "warning" at most \u2014 NEVER an "error" \u2014 since \`ai:make\` is not the tool that produces it.
-
-Check these dimensions and only raise an issue you can point to in the code:
-
-- tenancy: a tenant-scoped model MUST carry a tenantId column, and every query in its repository MUST be scoped by tenantId (create stamps it; list/find/update/delete filter by it). Raise an ERROR if a tenant-scoped resource can leak or write across tenants.
-- security: no hardcoded secrets; request bodies validated by Zod; no obvious injection.
-- rbac: routes carry \`meta: { can: '<resource>.<action>' }\` guards, and the permissions are declared. ERROR if a mutating route is unguarded when RBAC is enabled.
-- validation: every route has a Zod schema; the repository maps Prisma rows to the API type (no Date leaking as a Date, no raw row returned).
-- audit: state changes record audit events when audit is enabled (warning if not).
-- tests: a test file exists.
-- fit: the generated backend matches the request's DATA MODEL \u2014 the right entities, fields, relations and tenancy. Do NOT raise an "error" for artifacts outside the backend vertical (web UI, frontend, jobs); those are out of scope.
-
-Return ONLY a single JSON object (no prose, no markdown fences):
-{
-  "summary": string,                       // one or two sentences
-  "issues": [ { "dimension": string, "severity": "error" | "warning", "message": string } ]
-}
-Raise "error" only for a real, blocking convention violation you can cite; use "warning" for improvements. An empty issues array means the implementation is approved.`;
-
-// src/review/review.ts
-var REVIEWABLE = /\.prisma$|\.(schema|routes|service|repository|permissions)\.ts$/;
-function buildReviewContext(plan, result) {
-  const lines = [
-    `REQUEST: ${plan.request}`,
-    "",
-    "PLAN:",
-    `  summary: ${plan.summary}`,
-    `  entities: ${plan.entities.map((e) => `${e.name}${e.tenantScoped ? " (tenant-scoped)" : ""}`).join(", ")}`
-  ];
-  if (plan.permissions.length > 0) lines.push(`  permissions: ${plan.permissions.join(", ")}`);
-  if (plan.auditEvents.length > 0) lines.push(`  auditEvents: ${plan.auditEvents.join(", ")}`);
-  lines.push("", "DETERMINISTIC REVIEW:");
-  for (const item of result.review.items) lines.push(`  [${item.status}] ${item.label}: ${item.detail}`);
-  lines.push("", "GENERATED CODE:");
-  for (const resource of result.resources) {
-    for (const file of resource.files) {
-      if (REVIEWABLE.test(file.path)) lines.push(`--- ${file.path} ---`, file.content);
-    }
-  }
-  return lines.join("\n");
-}
-async function reviewImplementation(provider, plan, result, options = {}) {
-  const raw = await provider.generate({
-    messages: [
-      { role: "system", content: REVIEW_KNOWLEDGE },
-      { role: "user", content: `${buildReviewContext(plan, result)}
-
-Return the verdict as a single JSON object.` }
-    ],
-    temperature: options.temperature ?? 0,
-    maxTokens: options.maxTokens ?? 2048
-  });
-  return parseReview(raw);
-}
-function parseReview(raw) {
-  const json = extractJson2(raw);
-  let obj;
-  try {
-    obj = JSON.parse(json);
-  } catch {
-    throw new Error(`ai review \u2014 the model did not return valid JSON. Got: ${raw.slice(0, 160)}\u2026`);
-  }
-  const issues = normalizeIssues(obj["issues"]);
-  return {
-    approved: !issues.some((i) => i.severity === "error"),
-    summary: typeof obj["summary"] === "string" ? obj["summary"] : "",
-    issues
-  };
-}
-function normalizeIssues(value) {
-  if (!Array.isArray(value)) return [];
-  return value.filter((i) => typeof i === "object" && i !== null).map((i) => ({
-    dimension: typeof i["dimension"] === "string" ? i["dimension"] : "general",
-    severity: i["severity"] === "error" ? "error" : "warning",
-    message: typeof i["message"] === "string" ? i["message"] : ""
-  })).filter((i) => i.message !== "");
-}
-function extractJson2(raw) {
-  const withoutFence = raw.replace(/```(?:json)?/gi, "").trim();
-  const start = withoutFence.indexOf("{");
-  const end = withoutFence.lastIndexOf("}");
-  if (start === -1 || end === -1 || end < start) return withoutFence;
-  return withoutFence.slice(start, end + 1);
-}
-
-// src/review/render.ts
-function renderAgentReview(review, io) {
-  io.log(review.approved ? "\u2713 Review agent: approved" : "\u2717 Review agent: changes requested");
-  if (review.summary) io.log(`  ${review.summary}`);
-  if (review.issues.length > 0) {
-    io.log("  Issues:");
-    for (const issue of review.issues) {
-      io.log(`    ${issue.severity === "error" ? "\u2717" : "\u26A0"} [${issue.dimension}] ${issue.message}`);
-    }
-  }
-}
-
-// src/render.ts
-var MARK = { error: "\u2717", warning: "\u26A0", info: "\u2139" };
-function renderAnalysis(report, io) {
-  io.log("Analyzing project...");
-  io.log("");
-  if (report.capabilities.length === 0) {
-    io.log("  No Basalt capabilities detected \u2014 is this a Basalt app? (looked for src/app.ts)");
-  } else {
-    for (const line of report.capabilities) io.log(`\u2713 ${line}`);
-  }
-  if (report.models.length > 0) {
-    io.log("");
-    io.log(`Data model (${report.models.length} model${report.models.length === 1 ? "" : "s"}):`);
-    for (const name of report.models) {
-      const scoped = report.tenantScopedModels.includes(name);
-      io.log(`  \u2022 ${name}${scoped ? "  (tenant-scoped)" : ""}`);
-    }
-  }
-  io.log("");
-  if (report.diagnostics.length === 0) {
-    io.log("\u2713 No issues found.");
-  } else {
-    const errors = report.diagnostics.filter((d) => d.severity === "error").length;
-    const warnings = report.diagnostics.filter((d) => d.severity === "warning").length;
-    const infos = report.diagnostics.filter((d) => d.severity === "info").length;
-    io.log(`Diagnostics: ${errors} error(s), ${warnings} warning(s), ${infos} info.`);
-    io.log("Run `basalt ai:doctor` for details and fixes.");
-  }
-}
-function renderDoctor(diagnostics, io) {
-  io.log("AI DIAGNOSTICS");
-  io.log("");
-  if (diagnostics.length === 0) {
-    io.log("\u2713 Everything looks healthy.");
-    return;
-  }
-  for (const d of diagnostics) {
-    io.log(`${MARK[d.severity]} ${d.title}  [${d.category}]`);
-    io.log("");
-    io.log("  Detected:");
-    io.log(`    ${d.detected}`);
-    io.log("");
-    io.log("  Recommended:");
-    io.log(`    ${d.recommended}`);
-    io.log("");
-    io.log("  Reason:");
-    io.log(`    ${d.reason}`);
-    if (d.fix) {
-      io.log("");
-      io.log("  Fix:");
-      for (const line of d.fix.split("\n")) io.log(`    ${line}`);
-    }
-    if (d.docs) {
-      io.log("");
-      io.log(`  Docs: https://basaltkit.dev${d.docs}`);
-    }
-    io.log("");
-    io.log("  " + "\u2500".repeat(60));
-    io.log("");
-  }
-  const errors = diagnostics.filter((d) => d.severity === "error").length;
-  const warnings = diagnostics.filter((d) => d.severity === "warning").length;
-  io.log(
-    `${diagnostics.length} finding(s): ${errors} error(s), ${warnings} warning(s), ${diagnostics.length - errors - warnings} info.`
-  );
-}
-
-// src/commands.ts
-import { defineCommand } from "@basaltkit/cli";
-function aiCommands(options = {}) {
-  const rootOf = (flags) => typeof flags["dir"] === "string" ? flags["dir"] : options.cwd ?? process.cwd();
-  return [
-    defineCommand({
-      name: "ai",
-      description: "AI-native DX overview: detected stack and available commands",
-      handle({ args, flags, io }) {
-        const ctx = detectProject(rootOf(flags));
-        const report = analyze(ctx);
-        renderAnalysis(report, io);
-        io.log("");
-        if (args.length > 0) {
-          io.log(`You asked: "${args.join(" ")}"`);
-          io.log("Natural-language planning & scaffolding (ai:plan / ai:make) land in the next phase.");
-          io.log("");
-        }
-        io.log("Available now:");
-        io.log("  basalt ai:analyze          Static analysis report");
-        io.log("  basalt ai:doctor           Diagnostics with suggested fixes");
-        io.log("  basalt ai:fix [id]         Apply an auto-fixable diagnostic");
-        io.log('  basalt ai:plan "<request>" Architecture plan from a description');
-        io.log('  basalt ai:make "<request>" Plan + implement (scaffold + review gate)');
-        return 0;
-      }
-    }),
-    defineCommand({
-      name: "ai:analyze",
-      description: "Analyze the project: stack, data model and diagnostics (read-only)",
-      handle({ flags, io }) {
-        const ctx = detectProject(rootOf(flags));
-        renderAnalysis(analyze(ctx), io);
-        return 0;
-      }
-    }),
-    defineCommand({
-      name: "ai:doctor",
-      description: "Diagnose configuration, security and tenancy issues (read-only)",
-      handle({ flags, io }) {
-        const ctx = detectProject(rootOf(flags));
-        const diagnostics = runDoctor(ctx);
-        renderDoctor(diagnostics, io);
-        return hasErrors(diagnostics) ? 1 : 0;
-      }
-    }),
-    defineCommand({
-      name: "ai:fix",
-      description: "Apply a doctor fix (or all auto-fixable issues). --dry-run to preview, --yes to skip confirm",
-      async handle({ args, flags, io }) {
-        const root = rootOf(flags);
-        const ctx = detectProject(root);
-        const read = (rel) => nodeReader(root).read(rel);
-        const id = args[0];
-        let outcomes;
-        if (id) {
-          outcomes = [planFix(id, ctx, read)];
-        } else {
-          const firing = new Set(runDoctor(ctx).map((d) => d.id));
-          const targets = fixableIds().filter((f) => firing.has(f));
-          if (targets.length === 0) {
-            io.log("Nothing to auto-fix. Run `basalt ai:doctor` for the full picture.");
-            return 0;
-          }
-          outcomes = targets.map((f) => planFix(f, ctx, read));
-        }
-        renderFixes(outcomes, io);
-        const ready = outcomes.filter((o) => o.status === "ready");
-        if (ready.length === 0) {
-          return id && outcomes[0]?.status === "unfixable" ? 1 : 0;
-        }
-        if (flags["dry-run"] === true) {
-          io.log("");
-          io.log("Dry run \u2014 nothing written.");
-          return 0;
-        }
-        if (flags["yes"] !== true) {
-          const ok = await io.confirm(`Apply ${ready.length} fix(es)?`);
-          if (!ok) {
-            io.log("Aborted \u2014 nothing changed.");
-            return 0;
-          }
-        }
-        for (const outcome of ready) await applyFixEdits(outcome.edits, root);
-        io.log("");
-        io.log(`\u2713 Applied ${ready.length} fix(es). Review the changes and restart the server.`);
-        return 0;
-      }
-    }),
-    defineCommand({
-      name: "ai:plan",
-      description: "Turn a natural-language request into an architecture plan (read-only)",
-      async handle({ args, flags, io }) {
-        const request = args.join(" ").trim();
-        if (!request) {
-          io.error('Usage: basalt ai:plan "<what you want to build>"');
-          return 1;
-        }
-        let provider;
-        try {
-          provider = createProvider(providerEnvFromProcess());
-        } catch (error) {
-          io.error(`ai:plan needs an AI provider \u2014 ${error.message}`);
-          io.error("Set AI_API_KEY (AI_PROVIDER=anthropic) or run Ollama locally (AI_PROVIDER=ollama).");
-          return 1;
-        }
-        const ctx = detectProject(rootOf(flags));
-        io.log("Planning...");
-        io.log("");
-        try {
-          const plan = await createPlan(provider, ctx, request);
-          renderPlan(plan, io);
-          return 0;
-        } catch (error) {
-          io.error(error.message);
-          return 1;
-        }
-      }
-    }),
-    defineCommand({
-      name: "ai:make",
-      description: "Plan then implement a feature: scaffold + domain fields, with a review gate",
-      async handle({ args, flags, io }) {
-        const request = args.join(" ").trim();
-        if (!request) {
-          io.error('Usage: basalt ai:make "<what to build>" [--dry-run] [--yes] [--force] [--migrate|--no-migrate] [--review] [--verify]');
-          return 1;
-        }
-        let provider;
-        try {
-          provider = createProvider(providerEnvFromProcess());
-        } catch (error) {
-          io.error(`ai:make needs an AI provider \u2014 ${error.message}`);
-          io.error("Set AI_API_KEY (AI_PROVIDER=anthropic) or run Ollama locally (AI_PROVIDER=ollama).");
-          return 1;
-        }
-        const baseDir = rootOf(flags);
-        const ctx = detectProject(baseDir);
-        io.log("Planning...");
-        io.log("");
-        let plan;
-        try {
-          plan = await createPlan(provider, ctx, request);
-        } catch (error) {
-          io.error(error.message);
-          return 1;
-        }
-        renderPlan(plan, io);
-        io.log("");
-        const agentReview = async (result2) => {
-          if (flags["review"] !== true) return true;
-          io.log("");
-          io.log("Reviewing (agent)...");
-          io.log("");
-          try {
-            const verdict = await reviewImplementation(provider, plan, result2);
-            renderAgentReview(verdict, io);
-            return verdict.approved;
-          } catch (error) {
-            io.error(`Review inconclusive \u2014 ${error.message}`);
-            return true;
-          }
-        };
-        const dryRun = flags["dry-run"] === true;
-        if (dryRun) {
-          const result2 = await runMake(ctx, plan, { dryRun: true, baseDir });
-          renderMakeResult(result2, io);
-          return await agentReview(result2) ? 0 : 1;
-        }
-        if (flags["yes"] !== true) {
-          const ok = await io.confirm("Implement this plan? Files will be created and src/app.ts wired.");
-          if (!ok) {
-            io.log("Aborted \u2014 nothing was changed.");
-            return 0;
-          }
-        }
-        io.log("");
-        io.log("Implementing...");
-        io.log("");
-        let result;
-        try {
-          result = await runMake(ctx, plan, {
-            baseDir,
-            force: flags["force"] === true,
-            // --migrate, or --yes (pre-consented), runs prisma db push inside runMake.
-            migrate: flags["migrate"] === true || flags["yes"] === true
-          });
-        } catch (error) {
-          io.error(error.message);
-          return 1;
-        }
-        renderMakeResult(result, io);
-        if (!result.migration && result.schema?.found && flags["no-migrate"] !== true && result.resources.some((r) => r.prisma)) {
-          io.log("");
-          const ok = await io.confirm(
-            "Run `prisma db push` now to create the table(s) + regenerate the Prisma client? (the routes 500 until you do)"
-          );
-          if (ok) {
-            io.log("Running prisma db push...");
-            const push = await runPrismaPush(baseDir);
-            io.log(
-              push.ok ? "\u2713 prisma db push done \u2014 restart the dev server to load the regenerated client." : `\u2717 prisma db push failed:
-${push.output}`
-            );
-            if (!push.ok) return 1;
-          } else {
-            io.log("Skipped \u2014 run `npx prisma db push` and restart the server before using the routes.");
-          }
-        }
-        const approved = await agentReview(result);
-        if (flags["verify"] === true) {
-          io.log("");
-          io.log("Verifying (typecheck)...");
-          const verdict = await verifyProject(baseDir);
-          if (verdict.ok) {
-            io.log(`\u2713 ${verdict.command} passed`);
-          } else {
-            io.error(`\u2717 ${verdict.command} failed:`);
-            io.error(verdict.output);
-            return 1;
-          }
-        }
-        return result.review.ok && approved ? 0 : 1;
-      }
-    })
-  ];
-}
-export {
-  AnthropicProvider,
-  BASALT_KNOWLEDGE,
-  DEFAULT_RULES,
-  FIXES,
-  OllamaProvider,
-  OpenAICompatibleProvider,
-  REVIEW_KNOWLEDGE,
-  aiCommands,
-  analyze,
-  applyFixEdits,
-  buildPlanContext,
-  buildReviewContext,
-  canonicalType,
-  createPlan,
-  createProvider,
-  defineRule,
-  detectProject,
-  domainFields,
-  externalRelationTargets,
-  extractModelBlock,
-  fetchWithRetry,
-  fixableIds,
-  foreignKey,
-  globalSseFetch,
-  hasErrors,
-  injectAuditPlugin,
-  injectAuditService,
-  injectOpenApiMeta,
-  injectPermissionGuards,
-  injectPrismaFields,
-  injectPrismaRelations,
-  injectZodFields,
-  inverseRelationLines,
-  memoryReader,
-  mergeModelsIntoSchema,
-  nodeReader,
-  parsePlan,
-  parseReview,
-  parseSseContent,
-  permissionList,
-  planFix,
-  prismaType,
-  providerEnvFromProcess,
-  relationFieldLines,
-  relationForeignKeys,
-  renderAgentReview,
-  renderAnalysis,
-  renderDoctor,
-  renderFixes,
-  renderMakeResult,
-  renderPermissionsFile,
-  renderPlan,
-  renderPrismaRepository,
-  reviewImplementation,
-  runDoctor,
-  runMake,
-  runPrismaPush,
-  singleChunkStream,
-  verifyProject,
-  zodForField,
-  zodValidator
-};
+// Provider layer — the vendor-agnostic AI surface (spec §17).
+export { singleChunkStream, } from './provider/types.js';
+export { AnthropicProvider } from './provider/anthropic.js';
+export { OllamaProvider } from './provider/ollama.js';
+export { OpenAICompatibleProvider, } from './provider/openai.js';
+export { fetchWithRetry } from './provider/http.js';
+export { globalSseFetch, parseSseContent } from './provider/sse.js';
+export { createProvider, providerEnvFromProcess, } from './provider/factory.js';
+// Project context — stack/schema/config detection (spec §18, Context Engineering).
+export { detectProject, nodeReader, memoryReader, } from './context/project.js';
+// Diagnostics engine (spec §6, Doctor).
+export { defineRule, } from './doctor/types.js';
+export { DEFAULT_RULES } from './doctor/rules.js';
+export { hasErrors, runDoctor } from './doctor/run.js';
+export { applyFixEdits, fixableIds, planFix, renderFixes, FIXES, } from './doctor/fixes.js';
+// Analysis report (spec §5, Analyze).
+export { analyze } from './analyze/run.js';
+// Planning (spec §3, Plan mode) — natural language → architecture plan.
+export { createPlan, parsePlan } from './plan/plan.js';
+export { buildPlanContext } from './plan/context.js';
+export { BASALT_KNOWLEDGE } from './plan/knowledge.js';
+export { renderPlan } from './plan/render.js';
+// Implementation (spec §4 Implement) — execute a plan via the generator + review gate.
+export { runMake } from './make/make.js';
+export { renderMakeResult } from './make/render.js';
+export { verifyProject } from './make/verify.js';
+export { canonicalType, domainFields, injectPrismaFields, injectZodFields, prismaType, zodForField, zodValidator, } from './make/fields.js';
+export { renderPrismaRepository } from './make/repository.js';
+export { permissionList, renderPermissionsFile } from './make/permissions.js';
+export { injectOpenApiMeta } from './make/openapi.js';
+export { externalRelationTargets, foreignKey, injectPrismaRelations, inverseRelationLines, relationFieldLines, relationForeignKeys, } from './make/relations.js';
+export { injectAuditPlugin, injectAuditService, injectPermissionGuards } from './make/wire.js';
+export { extractModelBlock, mergeModelsIntoSchema, runPrismaPush, } from './make/schema.js';
+// Review agent (spec §19/§20) — LLM critique of the generated code.
+export { buildReviewContext, parseReview, reviewImplementation } from './review/review.js';
+export { REVIEW_KNOWLEDGE } from './review/knowledge.js';
+export { renderAgentReview } from './review/render.js';
+// Rendering + CLI wiring.
+export { renderAnalysis, renderDoctor } from './render.js';
+export { aiCommands } from './commands.js';