@basaltkit/ai 0.9.2 → 0.11.0

package/dist/index.d.ts

@@ -275,6 +275,8 @@ interface AppFileInfo {
     fastifyLoggerConfigured: boolean;
     /** In-memory (non-durable) sources still wired, e.g. `MemoryTenantSource`. */
     memorySources: string[];
+    /** Every `<name>Plugin(` factory call in the app file (unfiltered by capability). */
+    pluginCalls: string[];
 }
 interface ServerFileInfo {
     path: string;

package/dist/index.js

@@ -364,10 +364,22 @@ function detectAppFile(reader) {
     (factory) => new RegExp(`\\b${factory}\\s*\\(`).test(found.content)
   );
   const fastifyLoggerConfigured = /fastify\s*:\s*\{[^}]*\blogger\b/.test(found.content);
-  const memorySources = ["MemoryTenantSource", "MemoryUserSource"].filter(
+  const memorySources = [
+    "MemoryTenantSource",
+    "MemoryUserSource",
+    // Security-critical in-memory stores: auth/authorization/domain state that
+    // must survive restarts and be shared across instances in production.
+    "MemoryPasskeyStore",
+    "MemoryWebAuthnChallengeStore",
+    "MemoryAccessStore",
+    "MemoryDomainStore"
+  ].filter(
     (source) => found.content.includes(source)
   );
-  return { path: found.path, plugins, fastifyLoggerConfigured, memorySources };
+  const pluginCalls = [
+    ...new Set(Array.from(found.content.matchAll(/\b([A-Za-z][A-Za-z0-9]*Plugin)\s*\(/g), (m) => m[1]))
+  ];
+  return { path: found.path, plugins, fastifyLoggerConfigured, memorySources, pluginCalls };
 }
 function detectServerFile(reader) {
   const found = firstExisting(reader, SERVER_CANDIDATES);
@@ -527,7 +539,47 @@ var DEFAULT_RULES = [
       };
     }
   }),
+  defineRule({
+    id: "missing-security-plugin",
+    category: "security",
+    check(ctx) {
+      if (!ctx.app) return null;
+      if (ctx.app.pluginCalls.includes("securityPlugin")) return null;
+      return {
+        id: "missing-security-plugin",
+        title: "No securityPlugin \u2014 responses ship without secure headers",
+        severity: "warning",
+        category: "security",
+        detected: `${ctx.app.path} registers no securityPlugin()`,
+        recommended: "add securityPlugin() so secure response headers are set, and enable rate limiting + a CORS allow-list for production",
+        reason: "Without it the API returns no security headers (HSTS, X-Frame-Options, nosniff, \u2026) and applies no rate limiting \u2014 a fresh deploy is unprotected at the edge. The security primitives exist but are off until wired.",
+        fix: "securityPlugin({ /* headers on by default */ rateLimit: { limit: 120, windowMs: 60_000 } })",
+        docs: "/guide/security"
+      };
+    }
+  }),
   // ── tenancy ───────────────────────────────────────────────────────────────
+  defineRule({
+    id: "missing-tenant-membership",
+    category: "tenancy",
+    check(ctx) {
+      if (!ctx.app || !ctx.stack.tenancy || !ctx.stack.auth) return null;
+      const teamsAvailable = ctx.app.pluginCalls.includes("teamsPlugin") || ctx.installed.includes("@basaltkit/teams");
+      if (!teamsAvailable) return null;
+      if (ctx.app.pluginCalls.includes("tenantMembershipPlugin")) return null;
+      return {
+        id: "missing-tenant-membership",
+        title: "Tenant is resolved from the request but membership is never enforced",
+        severity: "error",
+        category: "tenancy",
+        detected: `${ctx.app.path} wires tenancy + auth (+ teams) but no tenantMembershipPlugin`,
+        recommended: "register tenantMembershipPlugin() so every authenticated, tenant-scoped request verifies the user belongs to the resolved tenant",
+        reason: "Resolvers take the tenant from client input (x-tenant-id / Host). Without a membership check, any authenticated user can act on another tenant just by changing that header \u2014 a cross-tenant data breach. Tenant resolution is identification, never authorization.",
+        fix: "tenantMembershipPlugin()  // central routes opt out with meta: { central: true }",
+        docs: "/guide/security"
+      };
+    }
+  }),
   defineRule({
     id: "tenant-scoping-missing",
     category: "tenancy",
@@ -588,6 +640,31 @@ var DEFAULT_RULES = [
         docs: "/guide/configuration"
       };
     }
+  }),
+  defineRule({
+    id: "in-memory-security-store",
+    category: "security",
+    check(ctx) {
+      const SECURITY_STORES = {
+        MemoryPasskeyStore: "WebAuthn passkeys",
+        MemoryWebAuthnChallengeStore: "WebAuthn challenges",
+        MemoryAccessStore: "roles & permissions",
+        MemoryDomainStore: "verified custom domains"
+      };
+      const hit = (ctx.app?.memorySources ?? []).find((source) => source in SECURITY_STORES);
+      if (!hit) return null;
+      return {
+        id: "in-memory-security-store",
+        title: "Security state is kept in an in-memory store",
+        severity: "warning",
+        category: "security",
+        detected: `${hit} holds ${SECURITY_STORES[hit]} in memory.`,
+        recommended: "Back it with a durable store (database/Redis) in production.",
+        reason: "In-memory security stores are wiped on restart and are not shared across instances \u2014 passkeys/permissions/verified domains would silently reset or diverge per replica, which can lock users out or bypass authorization.",
+        fix: `// swap ${hit} for a durable implementation of the same interface`,
+        docs: "/guide/security"
+      };
+    }
   })
 ];
 var GLOBAL_MODELS = /* @__PURE__ */ new Set(["Tenant", "User", "Plan", "WebhookEvent", "Migration"]);
@@ -2007,7 +2084,7 @@ function renderDoctor(diagnostics, io) {
     }
     if (d.docs) {
       io.log("");
-      io.log(`  Docs: https://basalt.dev${d.docs}`);
+      io.log(`  Docs: https://basaltkit.dev${d.docs}`);
     }
     io.log("");
     io.log("  " + "\u2500".repeat(60));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/ai",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "description": "AI-native developer experience for Basalt: a provider-agnostic engine plus `basalt ai` CLI that understands the project's stack, analyzes it, and diagnoses issues — following the framework's own conventions, not inventing new ones.",
   "license": "MIT",
   "type": "module",
@@ -14,7 +14,7 @@
     "dist"
   ],
   "dependencies": {
-    "@basaltkit/cli": "^1.0.0",
+    "@basaltkit/cli": "^1.2.0",
     "@basaltkit/generator": "^1.1.1"
   },
   "devDependencies": {