@basaltkit/ai 0.9.2 → 0.10.0

package/dist/index.d.ts

@@ -275,6 +275,8 @@ interface AppFileInfo {
     fastifyLoggerConfigured: boolean;
     /** In-memory (non-durable) sources still wired, e.g. `MemoryTenantSource`. */
     memorySources: string[];
+    /** Every `<name>Plugin(` factory call in the app file (unfiltered by capability). */
+    pluginCalls: string[];
 }
 interface ServerFileInfo {
     path: string;

package/dist/index.js

@@ -367,7 +367,10 @@ function detectAppFile(reader) {
   const memorySources = ["MemoryTenantSource", "MemoryUserSource"].filter(
     (source) => found.content.includes(source)
   );
-  return { path: found.path, plugins, fastifyLoggerConfigured, memorySources };
+  const pluginCalls = [
+    ...new Set(Array.from(found.content.matchAll(/\b([A-Za-z][A-Za-z0-9]*Plugin)\s*\(/g), (m) => m[1]))
+  ];
+  return { path: found.path, plugins, fastifyLoggerConfigured, memorySources, pluginCalls };
 }
 function detectServerFile(reader) {
   const found = firstExisting(reader, SERVER_CANDIDATES);
@@ -527,7 +530,47 @@ var DEFAULT_RULES = [
       };
     }
   }),
+  defineRule({
+    id: "missing-security-plugin",
+    category: "security",
+    check(ctx) {
+      if (!ctx.app) return null;
+      if (ctx.app.pluginCalls.includes("securityPlugin")) return null;
+      return {
+        id: "missing-security-plugin",
+        title: "No securityPlugin \u2014 responses ship without secure headers",
+        severity: "warning",
+        category: "security",
+        detected: `${ctx.app.path} registers no securityPlugin()`,
+        recommended: "add securityPlugin() so secure response headers are set, and enable rate limiting + a CORS allow-list for production",
+        reason: "Without it the API returns no security headers (HSTS, X-Frame-Options, nosniff, \u2026) and applies no rate limiting \u2014 a fresh deploy is unprotected at the edge. The security primitives exist but are off until wired.",
+        fix: "securityPlugin({ /* headers on by default */ rateLimit: { limit: 120, windowMs: 60_000 } })",
+        docs: "/guide/security"
+      };
+    }
+  }),
   // ── tenancy ───────────────────────────────────────────────────────────────
+  defineRule({
+    id: "missing-tenant-membership",
+    category: "tenancy",
+    check(ctx) {
+      if (!ctx.app || !ctx.stack.tenancy || !ctx.stack.auth) return null;
+      const teamsAvailable = ctx.app.pluginCalls.includes("teamsPlugin") || ctx.installed.includes("@basaltkit/teams");
+      if (!teamsAvailable) return null;
+      if (ctx.app.pluginCalls.includes("tenantMembershipPlugin")) return null;
+      return {
+        id: "missing-tenant-membership",
+        title: "Tenant is resolved from the request but membership is never enforced",
+        severity: "error",
+        category: "tenancy",
+        detected: `${ctx.app.path} wires tenancy + auth (+ teams) but no tenantMembershipPlugin`,
+        recommended: "register tenantMembershipPlugin() so every authenticated, tenant-scoped request verifies the user belongs to the resolved tenant",
+        reason: "Resolvers take the tenant from client input (x-tenant-id / Host). Without a membership check, any authenticated user can act on another tenant just by changing that header \u2014 a cross-tenant data breach. Tenant resolution is identification, never authorization.",
+        fix: "tenantMembershipPlugin()  // central routes opt out with meta: { central: true }",
+        docs: "/guide/security"
+      };
+    }
+  }),
   defineRule({
     id: "tenant-scoping-missing",
     category: "tenancy",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/ai",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "description": "AI-native developer experience for Basalt: a provider-agnostic engine plus `basalt ai` CLI that understands the project's stack, analyzes it, and diagnoses issues — following the framework's own conventions, not inventing new ones.",
   "license": "MIT",
   "type": "module",