@basaltkit/ai 1.2.0 → 1.3.0

package/dist/context/project.js

@@ -84,9 +84,13 @@ function firstExisting(reader, candidates) {
     return null;
 }
 function detectAppFile(reader) {
-    const found = firstExisting(reader, APP_CANDIDATES);
-    if (!found)
+    const raw = firstExisting(reader, APP_CANDIDATES);
+    if (!raw)
         return null;
+    // Match against CODE only: a commented-out `// tenantMembershipPlugin()` (or the
+    // name inside a string) must never count as a registration — that silenced
+    // security rules for exactly the apps that had disabled the guard.
+    const found = { path: raw.path, content: codeOnly(raw.content) };
     const plugins = PLUGIN_FACTORIES.filter((factory) => new RegExp(`\\b${factory}\\s*\\(`).test(found.content));
     const fastifyLoggerConfigured = /fastify\s*:\s*\{[^}]*\blogger\b/.test(found.content);
     const memorySources = [
@@ -104,6 +108,95 @@ function detectAppFile(reader) {
     ];
     return { path: found.path, plugins, fastifyLoggerConfigured, memorySources, pluginCalls };
 }
+/**
+ * The source with comments removed and string/template-literal TEXT blanked
+ * (quotes and `${…}` expressions are kept, newlines preserved), so detection
+ * regexes only ever see code. A lexer-lite, not a parser: regex literals are
+ * not special-cased, which is fine for app composition files.
+ */
+function codeOnly(source) {
+    let out = '';
+    let i = 0;
+    // Stack of open template literals; each entry is the `${` brace depth inside it.
+    const templates = [];
+    const blank = (ch) => (ch === '\n' ? '\n' : ' ');
+    const inTemplateText = () => templates.length > 0 && templates[templates.length - 1] === -1;
+    while (i < source.length) {
+        const ch = source[i];
+        const next = source[i + 1];
+        if (inTemplateText()) {
+            if (ch === '\\') {
+                out += '  ';
+                i += 2;
+            }
+            else if (ch === '`') {
+                templates.pop();
+                out += ch;
+                i++;
+            }
+            else if (ch === '$' && next === '{') {
+                templates[templates.length - 1] = 0;
+                out += '${';
+                i += 2;
+            }
+            else {
+                out += blank(ch);
+                i++;
+            }
+            continue;
+        }
+        if (ch === '/' && next === '/') {
+            while (i < source.length && source[i] !== '\n') {
+                out += ' ';
+                i++;
+            }
+        }
+        else if (ch === '/' && next === '*') {
+            const end = source.indexOf('*/', i + 2);
+            const stop = end === -1 ? source.length : end + 2;
+            for (; i < stop; i++)
+                out += blank(source[i]);
+        }
+        else if (ch === "'" || ch === '"') {
+            out += ch;
+            i++;
+            while (i < source.length && source[i] !== ch && source[i] !== '\n') {
+                if (source[i] === '\\') {
+                    out += ' ';
+                    i++;
+                }
+                if (i < source.length)
+                    out += blank(source[i]);
+                i++;
+            }
+            if (i < source.length) {
+                out += source[i];
+                i++;
+            }
+        }
+        else if (ch === '`') {
+            templates.push(-1);
+            out += ch;
+            i++;
+        }
+        else {
+            if (templates.length > 0) {
+                const top = templates.length - 1;
+                if (ch === '{')
+                    templates[top] = templates[top] + 1;
+                else if (ch === '}') {
+                    if (templates[top] === 0)
+                        templates[top] = -1;
+                    else
+                        templates[top] = templates[top] - 1;
+                }
+            }
+            out += ch;
+            i++;
+        }
+    }
+    return out;
+}
 function detectServerFile(reader) {
     const found = firstExisting(reader, SERVER_CANDIDATES);
     if (!found)

package/dist/doctor/rules.js

@@ -109,23 +109,28 @@ export const DEFAULT_RULES = [
         check(ctx) {
             if (!ctx.app || !ctx.stack.tenancy || !ctx.stack.auth)
                 return null;
-            const teamsAvailable = ctx.app.pluginCalls.includes('teamsPlugin') || ctx.installed.includes('@basaltkit/teams');
-            if (!teamsAvailable)
-                return null;
             if (ctx.app.pluginCalls.includes('tenantMembershipPlugin'))
                 return null;
+            // Fire whether or not @basaltkit/teams is installed: tenancy + auth with no
+            // membership guard is the vulnerable shape regardless — staying silent
+            // because the package providing the fix is absent hid it in fresh apps.
+            const teamsInstalled = ctx.app.pluginCalls.includes('teamsPlugin') || ctx.installed.includes('@basaltkit/teams');
             return {
                 id: 'missing-tenant-membership',
                 title: 'Tenant is resolved from the request but membership is never enforced',
                 severity: 'error',
                 category: 'tenancy',
-                detected: `${ctx.app.path} wires tenancy + auth (+ teams) but no tenantMembershipPlugin`,
-                recommended: 'register tenantMembershipPlugin() so every authenticated, tenant-scoped request verifies the user belongs to the resolved tenant',
+                detected: `${ctx.app.path} wires tenancy + auth${teamsInstalled ? ' (+ teams)' : ''} but no tenantMembershipPlugin`,
+                recommended: teamsInstalled
+                    ? 'register tenantMembershipPlugin() so every authenticated, tenant-scoped request verifies the user belongs to the resolved tenant'
+                    : 'install @basaltkit/teams and register teamsPlugin() + tenantMembershipPlugin() so every authenticated, tenant-scoped request verifies the user belongs to the resolved tenant',
                 reason: 'Resolvers take the tenant from client input (x-tenant-id / Host). Without a ' +
                     'membership check, any authenticated user can act on another tenant just by ' +
                     'changing that header — a cross-tenant data breach. Tenant resolution is ' +
                     'identification, never authorization.',
-                fix: "tenantMembershipPlugin()  // central routes opt out with meta: { central: true }",
+                fix: teamsInstalled
+                    ? 'tenantMembershipPlugin()  // central routes opt out with meta: { central: true }'
+                    : 'pnpm add @basaltkit/teams\n// then: teamsPlugin(), tenantMembershipPlugin()  // central routes opt out with meta: { central: true }',
                 docs: '/guide/security',
             };
         },

package/dist/index.d.ts

@@ -18,6 +18,7 @@ export { BASALT_KNOWLEDGE } from './plan/knowledge.js';
 export { renderPlan } from './plan/render.js';
 export type { ArchitecturePlan, PlanEntity, PlanField, PlanRelation, PlanStep, PlanStepKind, } from './plan/types.js';
 export { runMake } from './make/make.js';
+export { assertSafePlan, UnsafePlanError } from './plan/identifiers.js';
 export { renderMakeResult } from './make/render.js';
 export { verifyProject, type VerifyResult } from './make/verify.js';
 export { canonicalType, domainFields, injectPrismaFields, injectZodFields, prismaType, zodForField, zodValidator, type CanonicalType, } from './make/fields.js';

package/dist/index.js

@@ -24,6 +24,7 @@ export { BASALT_KNOWLEDGE } from './plan/knowledge.js';
 export { renderPlan } from './plan/render.js';
 // Implementation (spec §4 Implement) — execute a plan via the generator + review gate.
 export { runMake } from './make/make.js';
+export { assertSafePlan, UnsafePlanError } from './plan/identifiers.js';
 export { renderMakeResult } from './make/render.js';
 export { verifyProject } from './make/verify.js';
 export { canonicalType, domainFields, injectPrismaFields, injectZodFields, prismaType, zodForField, zodValidator, } from './make/fields.js';

package/dist/make/fields.d.ts

@@ -11,6 +11,12 @@ export declare function prismaType(t: CanonicalType): string;
  * ISO string, matching the mapper.
  */
 export declare function zodValidator(t: CanonicalType, create: boolean): string;
+/**
+ * A single-quoted TS string literal for arbitrary text. Plan enum values are
+ * untrusted (LLM output / MCP client input): escaping via JSON.stringify means
+ * quotes, backslashes and line breaks can never end the literal early.
+ */
+export declare function tsStringLiteral(value: string): string;
 /** Zod validator for a field, honoring an enum (`z.enum([...])`) over its base type. */
 export declare function zodForField(field: PlanField, create: boolean): string;
 /** The entity's own fields, minus reserved/base columns and duplicates. */

package/dist/make/fields.js

@@ -55,10 +55,24 @@ export function zodValidator(t, create) {
 function usable(field) {
     return field.name.trim() !== '' && !RESERVED.has(field.name.toLowerCase());
 }
+/**
+ * A single-quoted TS string literal for arbitrary text. Plan enum values are
+ * untrusted (LLM output / MCP client input): escaping via JSON.stringify means
+ * quotes, backslashes and line breaks can never end the literal early.
+ */
+export function tsStringLiteral(value) {
+    const escaped = JSON.stringify(String(value))
+        .slice(1, -1)
+        .replace(/\\"/g, '"')
+        .replace(/'/g, "\\'")
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
+    return `'${escaped}'`;
+}
 /** Zod validator for a field, honoring an enum (`z.enum([...])`) over its base type. */
 export function zodForField(field, create) {
     if (field.enum && field.enum.length > 0) {
-        return `z.enum([${field.enum.map((v) => `'${v}'`).join(', ')}])`;
+        return `z.enum([${field.enum.map(tsStringLiteral).join(', ')}])`;
     }
     return zodValidator(canonicalType(field.type), create);
 }

package/dist/make/make.js

@@ -5,6 +5,7 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { unifiedDiff } from './diff.js';
 import { domainFields, injectPrismaFields, injectZodFields } from './fields.js';
+import { assertSafePlan } from '../plan/identifiers.js';
 import { externalRelationTargets, injectPrismaRelations, inverseRelationLines, relationFieldLines, relationForeignKeys, } from './relations.js';
 import { injectOpenApiMeta } from './openapi.js';
 import { renderPermissionsFile } from './permissions.js';
@@ -22,6 +23,9 @@ import { injectAuditPlugin, injectAuditService, injectPermissionGuards } from '.
  * touches the database, never deletes.
  */
 export async function runMake(ctx, plan, options = {}) {
+    // The plan is untrusted (LLM / MCP client): refuse any name that could
+    // inject code into the generated sources before generating anything.
+    assertSafePlan(plan);
     const entities = plan.entities.filter((e) => e.name.trim() !== '');
     if (entities.length === 0) {
         throw new Error('ai:make — the plan has no entity to generate.');
@@ -36,7 +40,13 @@ export async function runMake(ctx, plan, options = {}) {
         const gen = findGeneratorCommand(plan, entity.name);
         const prisma = options.prisma ?? gen?.prisma ?? prismaDefault;
         const softDelete = options.softDelete ?? gen?.softDelete ?? false;
-        const generated = generateResource(entity.name, { prisma, softDelete });
+        // Routes are authenticated by the generator's secure default. A
+        // tenant-scoped entity gets the generator's tenant-owned in-memory
+        // repository (requireTenantId()); with Prisma, augmentFiles below replaces
+        // the repository and injects tenantId + @@index itself, so the generator's
+        // tenant output is not requested there (it would duplicate the index).
+        const tenant = ctx.stack.tenancy && entity.tenantScoped && !prisma;
+        const generated = generateResource(entity.name, { prisma, softDelete, tenant });
         const { files, augmented, guarded, audited } = augmentFiles(generated, entity, plan, ctx, { prisma, softDelete });
         const build = {
             name: entity.name,

package/dist/make/repository.js

@@ -1,5 +1,5 @@
 import { names } from '@basaltkit/generator/resource';
-import { canonicalType, domainFields } from './fields.js';
+import { canonicalType, domainFields, tsStringLiteral } from './fields.js';
 /** TypeScript type of a Prisma row column for the mapper's parameter. */
 function rowType(t) {
     switch (t) {
@@ -38,7 +38,7 @@ export function renderPrismaRepository(name, fields, options) {
     }
     // Enum columns are stored as String; the mapper narrows them to the union.
     const colType = (f) => (f.values ? 'string' : rowType(f.canon));
-    const colExpr = (f) => f.values ? `r.${f.name} as ${f.values.map((v) => `'${v}'`).join(' | ')}` : mapExpr(f.name, f.canon);
+    const colExpr = (f) => f.values ? `r.${f.name} as ${f.values.map(tsStringLiteral).join(' | ')}` : mapExpr(f.name, f.canon);
     const rowTypeEntries = [
         'id: string',
         ...bodyFields.map((f) => `${f.name}: ${colType(f)}`),

package/dist/plan/identifiers.d.ts

@@ -0,0 +1,22 @@
+import type { ArchitecturePlan } from './types.js';
+/**
+ * A plan is untrusted input — an LLM output, or a plan object an MCP client
+ * hands to `basalt_make`. Every name in it is interpolated into generated
+ * TypeScript/Prisma source, so names are restricted to shapes that can never
+ * break out of their syntactic position (identifier, string literal).
+ */
+/** Field and relation names — emitted verbatim as TS properties and Prisma columns. */
+export declare const PLAN_IDENTIFIER: RegExp;
+/** Entity / related-model names — normalized by the generator's `names()` (words → PascalCase). */
+export declare const PLAN_ENTITY_NAME: RegExp;
+/** Audit event names (`invoice.created`, `billing:paid`) — emitted inside string literals. */
+export declare const PLAN_EVENT_NAME: RegExp;
+export declare class UnsafePlanError extends Error {
+    constructor(message: string);
+}
+/**
+ * Throws {@link UnsafePlanError} if any name in the plan could inject code into
+ * the generated sources. Enum VALUES are free text: they are always emitted as
+ * escaped string literals (see `tsStringLiteral`), never raw.
+ */
+export declare function assertSafePlan(plan: ArchitecturePlan): void;

package/dist/plan/identifiers.js

@@ -0,0 +1,54 @@
+/**
+ * A plan is untrusted input — an LLM output, or a plan object an MCP client
+ * hands to `basalt_make`. Every name in it is interpolated into generated
+ * TypeScript/Prisma source, so names are restricted to shapes that can never
+ * break out of their syntactic position (identifier, string literal).
+ */
+/** Field and relation names — emitted verbatim as TS properties and Prisma columns. */
+export const PLAN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Entity / related-model names — normalized by the generator's `names()` (words → PascalCase). */
+export const PLAN_ENTITY_NAME = /^[A-Za-z][A-Za-z0-9 _-]{0,99}$/;
+/** Audit event names (`invoice.created`, `billing:paid`) — emitted inside string literals. */
+export const PLAN_EVENT_NAME = /^[A-Za-z0-9_]+(?:[.:-][A-Za-z0-9_]+)*$/;
+export class UnsafePlanError extends Error {
+    constructor(message) {
+        super(`ai:make — unsafe plan: ${message}`);
+        this.name = 'UnsafePlanError';
+    }
+}
+/**
+ * Throws {@link UnsafePlanError} if any name in the plan could inject code into
+ * the generated sources. Enum VALUES are free text: they are always emitted as
+ * escaped string literals (see `tsStringLiteral`), never raw.
+ */
+export function assertSafePlan(plan) {
+    const entities = plan.entities;
+    if (!Array.isArray(entities))
+        throw new UnsafePlanError('`entities` must be an array.');
+    for (const entity of plan.entities) {
+        if (typeof entity.name !== 'string' || !PLAN_ENTITY_NAME.test(entity.name)) {
+            throw new UnsafePlanError(`entity name ${JSON.stringify(entity.name)} is not a valid identifier.`);
+        }
+        for (const field of entity.fields ?? []) {
+            if (typeof field.name !== 'string' || !PLAN_IDENTIFIER.test(field.name)) {
+                throw new UnsafePlanError(`field name ${JSON.stringify(field.name)} on ${entity.name} is not a valid identifier.`);
+            }
+            if (field.enum !== undefined && !(Array.isArray(field.enum) && field.enum.every((v) => typeof v === 'string'))) {
+                throw new UnsafePlanError(`enum of ${entity.name}.${field.name} must be an array of strings.`);
+            }
+        }
+        for (const relation of entity.relations ?? []) {
+            if (typeof relation.name !== 'string' || !PLAN_IDENTIFIER.test(relation.name)) {
+                throw new UnsafePlanError(`relation name ${JSON.stringify(relation.name)} on ${entity.name} is not a valid identifier.`);
+            }
+            if (typeof relation.model !== 'string' || !PLAN_ENTITY_NAME.test(relation.model)) {
+                throw new UnsafePlanError(`relation model ${JSON.stringify(relation.model)} on ${entity.name} is not a valid identifier.`);
+            }
+        }
+    }
+    for (const event of plan.auditEvents ?? []) {
+        if (typeof event !== 'string' || !PLAN_EVENT_NAME.test(event)) {
+            throw new UnsafePlanError(`audit event ${JSON.stringify(event)} is not a valid event name.`);
+        }
+    }
+}

package/dist/schema/index.js

@@ -10,6 +10,7 @@
  * tolerant coercion — the model's raw text is never fed to `.parse()` directly).
  */
 import { z } from 'zod';
+import { PLAN_ENTITY_NAME, PLAN_EVENT_NAME, PLAN_IDENTIFIER } from '../plan/identifiers.js';
 /** Bump when the serialized shape of a plan changes incompatibly. */
 export const PLAN_SCHEMA_VERSION = 1;
 /** Bump when the serialized shape of a make result changes incompatibly. */
@@ -103,17 +104,20 @@ export const AnalysisReportSchema = z.object({
     diagnostics: z.array(DiagnosticSchema),
 });
 // --- ArchitecturePlan (plan/types.ts) --------------------------------------
+// Names are interpolated into generated source: only plain identifiers are
+// accepted (see plan/identifiers.ts). Enum values are free text, always
+// emitted as escaped string literals.
 export const PlanFieldSchema = z.object({
-    name: z.string(),
+    name: z.string().regex(PLAN_IDENTIFIER),
     type: z.string(),
     enum: z.array(z.string()).optional(),
 });
 export const PlanRelationSchema = z.object({
-    name: z.string(),
-    model: z.string(),
+    name: z.string().regex(PLAN_IDENTIFIER),
+    model: z.string().regex(PLAN_ENTITY_NAME),
 });
 export const PlanEntitySchema = z.object({
-    name: z.string(),
+    name: z.string().regex(PLAN_ENTITY_NAME),
     fields: z.array(PlanFieldSchema),
     tenantScoped: z.boolean(),
     relations: z.array(PlanRelationSchema).optional(),
@@ -145,7 +149,7 @@ export const ArchitecturePlanSchema = z.object({
     entities: z.array(PlanEntitySchema),
     steps: z.array(PlanStepSchema),
     permissions: z.array(z.string()),
-    auditEvents: z.array(z.string()),
+    auditEvents: z.array(z.string().regex(PLAN_EVENT_NAME)),
     tenantScoped: z.boolean(),
     warnings: z.array(z.string()),
 });

package/dist/workflows.d.ts

@@ -16,4 +16,5 @@ export type { ArchitecturePlan, PlanEntity, PlanField, PlanRelation, PlanStep, P
 export { buildReviewContext, parseReview, reviewImplementation, type ReviewOptions, } from './review/review.js';
 export type { AgentReview, ReviewIssue } from './review/types.js';
 export { runMake } from './make/make.js';
+export { assertSafePlan, UnsafePlanError } from './plan/identifiers.js';
 export type { MakeOptions, MakeResult, MakePreview, FilePreview, ResourceBuild, SchemaMerge, Migration, ReviewResult, ReviewItem, ReviewStatus, } from './make/types.js';

package/dist/workflows.js

@@ -21,3 +21,4 @@ export { buildReviewContext, parseReview, reviewImplementation, } from './review
 // dry-run detects clashes and attaches diffs; writes never touch the DB unless
 // `migrate` is set. Framework-free via `@basaltkit/generator/resource`.
 export { runMake } from './make/make.js';
+export { assertSafePlan, UnsafePlanError } from './plan/identifiers.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/ai",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "engines": {
     "node": ">=22.5.0"
   },
@@ -31,13 +31,13 @@
   ],
   "dependencies": {
     "zod": "^4.5.4",
-    "@basaltkit/cli": "^1.2.4",
-    "@basaltkit/generator": "^1.3.0"
+    "@basaltkit/cli": "^1.2.5",
+    "@basaltkit/generator": "^1.4.0"
   },
   "devDependencies": {
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.5.1",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.11",
+    "vitest": "^5.0.0",
     "@basaltkit/tsconfig": "^0.24.0"
   },
   "publishConfig": {