@basaltkit/ai 1.2.0 → 1.4.0

package/dist/context/project.d.ts

@@ -5,6 +5,12 @@
 export interface ProjectReader {
     read(relPath: string): string | null;
     exists(relPath: string): boolean;
+    /**
+     * Every file under `relDir`, recursively, as paths relative to the root.
+     * Optional: a reader without it simply skips the checks that scan the
+     * project's route files.
+     */
+    list?(relDir: string): string[];
 }
 /** Default reader backed by the filesystem. */
 export declare function nodeReader(root: string): ProjectReader;
@@ -64,8 +70,23 @@ export interface EnvFileInfo {
     /** Default value baked into `REDIS_URL`, if any. */
     redisUrlDefault: string | null;
 }
+/**
+ * A route declared central (`meta.tenant: false`) whose permission names the
+ * platform plane (`can: 'platform:…'`), without `tenant: 'never'`. It still
+ * runs on a tenant host, against that tenant's storage.
+ */
+export interface CentralPlatformRouteHint {
+    path: string;
+    /** 1-based line of the `meta` object. */
+    line: number;
+}
 export interface ProjectContext {
     root: string;
+    /**
+     * Platform routes that do not refuse a tenant. Absent when the reader cannot
+     * list files.
+     */
+    centralPlatformRoutes?: CentralPlatformRouteHint[];
     /** All `@basaltkit/*` packages found in package.json deps. */
     installed: string[];
     stack: DetectedStack;

package/dist/context/project.js

@@ -1,5 +1,7 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+/** Upper bound on the files a route scan reads — a doctor run stays cheap on a large repo. */
+const MAX_SCANNED_FILES = 2000;
 /** Default reader backed by the filesystem. */
 export function nodeReader(root) {
     return {
@@ -12,13 +14,49 @@ export function nodeReader(root) {
             }
         },
         exists: (relPath) => existsSync(join(root, relPath)),
+        list(relDir) {
+            const out = [];
+            const walk = (dir) => {
+                let entries;
+                try {
+                    entries = readdirSync(join(root, dir), { withFileTypes: true });
+                }
+                catch {
+                    return;
+                }
+                for (const entry of entries) {
+                    if (out.length >= MAX_SCANNED_FILES)
+                        return;
+                    if (entry.name === 'node_modules' || entry.name.startsWith('.'))
+                        continue;
+                    const rel = `${dir}/${entry.name}`;
+                    if (entry.isDirectory())
+                        walk(rel);
+                    else if (entry.isFile())
+                        out.push(rel);
+                }
+            };
+            walk(trimTrailingSlashes(relDir));
+            return out;
+        },
     };
 }
+/** Drops trailing `/` characters in linear time (a `/\/+$/` regex backtracks on long runs of `/`). */
+function trimTrailingSlashes(path) {
+    let end = path.length;
+    while (end > 0 && path.charCodeAt(end - 1) === 47)
+        end--;
+    return path.slice(0, end);
+}
 /** In-memory reader for tests: keys are relative paths. */
 export function memoryReader(files) {
     return {
         read: (relPath) => files[relPath] ?? null,
         exists: (relPath) => relPath in files,
+        list: (relDir) => {
+            const prefix = `${trimTrailingSlashes(relDir)}/`;
+            return Object.keys(files).filter((path) => path.startsWith(prefix));
+        },
     };
 }
 const APP_CANDIDATES = ['src/app.ts', 'src/app.js', 'app.ts'];
@@ -58,7 +96,52 @@ export function detectProject(root, reader = nodeReader(root)) {
     const env = detectEnvFile(reader);
     const prisma = detectPrisma(reader);
     const stack = buildStack(installed, app, prisma);
-    return { root, installed, stack, prisma, app, server, env };
+    const centralPlatformRoutes = detectCentralPlatformRoutes(reader);
+    return {
+        root,
+        installed,
+        stack,
+        prisma,
+        app,
+        server,
+        env,
+        ...(centralPlatformRoutes ? { centralPlatformRoutes } : {}),
+    };
+}
+/**
+ * Finds `meta: { … }` literals with `tenant: false` and a `can` naming
+ * `platform:…`. A regex over flat object literals, not a parser: it sees
+ * `meta: { tenant: false, can: 'platform:plans' }` written inline, which is
+ * how routes are declared; meta built elsewhere and spread in goes unseen.
+ */
+function detectCentralPlatformRoutes(reader) {
+    if (!reader.list)
+        return undefined;
+    const files = reader
+        .list('src')
+        .filter((path) => /\.[cm]?[jt]s$/.test(path) && !/\.d\.ts$|\.(test|spec)\.[cm]?[jt]s$/.test(path))
+        .slice(0, MAX_SCANNED_FILES);
+    const hits = [];
+    for (const path of files) {
+        const content = reader.read(path);
+        if (!content || !content.includes('platform:'))
+            continue;
+        // Same length as the source, comments and string text blanked: a match
+        // must start in code, so a commented-out route never counts.
+        const code = codeOnly(content);
+        for (const match of content.matchAll(/\bmeta\s*:\s*\{([^{}]*)\}/g)) {
+            const index = match.index ?? 0;
+            if (code.slice(index, index + 4) !== 'meta')
+                continue;
+            const body = match[1] ?? '';
+            if (!/\btenant\s*:\s*false\b/.test(body))
+                continue;
+            if (!/\bcan\s*:\s*\[?\s*['"`]platform:/.test(body))
+                continue;
+            hits.push({ path, line: content.slice(0, index).split('\n').length });
+        }
+    }
+    return hits;
 }
 function detectInstalled(reader) {
     const raw = reader.read('package.json');
@@ -84,9 +167,13 @@ function firstExisting(reader, candidates) {
     return null;
 }
 function detectAppFile(reader) {
-    const found = firstExisting(reader, APP_CANDIDATES);
-    if (!found)
+    const raw = firstExisting(reader, APP_CANDIDATES);
+    if (!raw)
         return null;
+    // Match against CODE only: a commented-out `// tenantMembershipPlugin()` (or the
+    // name inside a string) must never count as a registration — that silenced
+    // security rules for exactly the apps that had disabled the guard.
+    const found = { path: raw.path, content: codeOnly(raw.content) };
     const plugins = PLUGIN_FACTORIES.filter((factory) => new RegExp(`\\b${factory}\\s*\\(`).test(found.content));
     const fastifyLoggerConfigured = /fastify\s*:\s*\{[^}]*\blogger\b/.test(found.content);
     const memorySources = [
@@ -104,6 +191,95 @@ function detectAppFile(reader) {
     ];
     return { path: found.path, plugins, fastifyLoggerConfigured, memorySources, pluginCalls };
 }
+/**
+ * The source with comments removed and string/template-literal TEXT blanked
+ * (quotes and `${…}` expressions are kept, newlines preserved), so detection
+ * regexes only ever see code. A lexer-lite, not a parser: regex literals are
+ * not special-cased, which is fine for app composition files.
+ */
+function codeOnly(source) {
+    let out = '';
+    let i = 0;
+    // Stack of open template literals; each entry is the `${` brace depth inside it.
+    const templates = [];
+    const blank = (ch) => (ch === '\n' ? '\n' : ' ');
+    const inTemplateText = () => templates.length > 0 && templates[templates.length - 1] === -1;
+    while (i < source.length) {
+        const ch = source[i];
+        const next = source[i + 1];
+        if (inTemplateText()) {
+            if (ch === '\\') {
+                out += '  ';
+                i += 2;
+            }
+            else if (ch === '`') {
+                templates.pop();
+                out += ch;
+                i++;
+            }
+            else if (ch === '$' && next === '{') {
+                templates[templates.length - 1] = 0;
+                out += '${';
+                i += 2;
+            }
+            else {
+                out += blank(ch);
+                i++;
+            }
+            continue;
+        }
+        if (ch === '/' && next === '/') {
+            while (i < source.length && source[i] !== '\n') {
+                out += ' ';
+                i++;
+            }
+        }
+        else if (ch === '/' && next === '*') {
+            const end = source.indexOf('*/', i + 2);
+            const stop = end === -1 ? source.length : end + 2;
+            for (; i < stop; i++)
+                out += blank(source[i]);
+        }
+        else if (ch === "'" || ch === '"') {
+            out += ch;
+            i++;
+            while (i < source.length && source[i] !== ch && source[i] !== '\n') {
+                if (source[i] === '\\') {
+                    out += ' ';
+                    i++;
+                }
+                if (i < source.length)
+                    out += blank(source[i]);
+                i++;
+            }
+            if (i < source.length) {
+                out += source[i];
+                i++;
+            }
+        }
+        else if (ch === '`') {
+            templates.push(-1);
+            out += ch;
+            i++;
+        }
+        else {
+            if (templates.length > 0) {
+                const top = templates.length - 1;
+                if (ch === '{')
+                    templates[top] = templates[top] + 1;
+                else if (ch === '}') {
+                    if (templates[top] === 0)
+                        templates[top] = -1;
+                    else
+                        templates[top] = templates[top] - 1;
+                }
+            }
+            out += ch;
+            i++;
+        }
+    }
+    return out;
+}
 function detectServerFile(reader) {
     const found = firstExisting(reader, SERVER_CANDIDATES);
     if (!found)

package/dist/doctor/rules.js

@@ -109,27 +109,56 @@ export const DEFAULT_RULES = [
         check(ctx) {
             if (!ctx.app || !ctx.stack.tenancy || !ctx.stack.auth)
                 return null;
-            const teamsAvailable = ctx.app.pluginCalls.includes('teamsPlugin') || ctx.installed.includes('@basaltkit/teams');
-            if (!teamsAvailable)
-                return null;
             if (ctx.app.pluginCalls.includes('tenantMembershipPlugin'))
                 return null;
+            // Fire whether or not @basaltkit/teams is installed: tenancy + auth with no
+            // membership guard is the vulnerable shape regardless — staying silent
+            // because the package providing the fix is absent hid it in fresh apps.
+            const teamsInstalled = ctx.app.pluginCalls.includes('teamsPlugin') || ctx.installed.includes('@basaltkit/teams');
             return {
                 id: 'missing-tenant-membership',
                 title: 'Tenant is resolved from the request but membership is never enforced',
                 severity: 'error',
                 category: 'tenancy',
-                detected: `${ctx.app.path} wires tenancy + auth (+ teams) but no tenantMembershipPlugin`,
-                recommended: 'register tenantMembershipPlugin() so every authenticated, tenant-scoped request verifies the user belongs to the resolved tenant',
+                detected: `${ctx.app.path} wires tenancy + auth${teamsInstalled ? ' (+ teams)' : ''} but no tenantMembershipPlugin`,
+                recommended: teamsInstalled
+                    ? 'register tenantMembershipPlugin() so every authenticated, tenant-scoped request verifies the user belongs to the resolved tenant'
+                    : 'install @basaltkit/teams and register teamsPlugin() + tenantMembershipPlugin() so every authenticated, tenant-scoped request verifies the user belongs to the resolved tenant',
                 reason: 'Resolvers take the tenant from client input (x-tenant-id / Host). Without a ' +
                     'membership check, any authenticated user can act on another tenant just by ' +
                     'changing that header — a cross-tenant data breach. Tenant resolution is ' +
                     'identification, never authorization.',
-                fix: "tenantMembershipPlugin()  // central routes opt out with meta: { central: true }",
+                fix: teamsInstalled
+                    ? 'tenantMembershipPlugin()  // central routes opt out with meta: { central: true }'
+                    : 'pnpm add @basaltkit/teams\n// then: teamsPlugin(), tenantMembershipPlugin()  // central routes opt out with meta: { central: true }',
                 docs: '/guide/security',
             };
         },
     }),
+    defineRule({
+        id: 'platform-route-accepts-tenant',
+        category: 'tenancy',
+        check(ctx) {
+            const hits = ctx.centralPlatformRoutes ?? [];
+            if (hits.length === 0)
+                return null;
+            const where = hits.map((hit) => `${hit.path}:${hit.line}`).join(', ');
+            return {
+                id: 'platform-route-accepts-tenant',
+                title: "Platform route declares tenant: false instead of tenant: 'never'",
+                severity: 'warning',
+                category: 'tenancy',
+                detected: `platform routes still served on tenant hosts: ${where}`,
+                recommended: "declare meta: { tenant: 'never' } on routes of the central plane",
+                reason: '`tenant: false` lifts the tenant requirement but still resolves one: ' +
+                    'acme.<host>/platform/… runs inside Acme, against its database, and a ' +
+                    "tenant owner holding '*' satisfies 'platform:*'. `tenant: 'never'` answers " +
+                    'a tenant host with the plain 404 before any guard runs.',
+                fix: "meta: { tenant: 'never', auth: true, can: 'platform:plans.manage' }",
+                docs: '/guide/multi-tenant-pattern',
+            };
+        },
+    }),
     defineRule({
         id: 'tenant-scoping-missing',
         category: 'tenancy',

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export { fetchWithRetry, type RetryOptions } from './provider/http.js';
 export { globalSseFetch, parseSseContent, type SseFetch, type SseResponse } from './provider/sse.js';
 export { createProvider, providerEnvFrom, providerEnvFromProcess, type CreateProviderOptions, type ProviderEnv, type ProviderName, } from './provider/factory.js';
 export { runGeneration, generateText, withAbort, throwIfAborted, abortError, isAbortError, type OnProgress, type WorkflowProgress, type WorkflowRunOptions, } from './generate.js';
-export { detectProject, nodeReader, memoryReader, type AppFileInfo, type DetectedStack, type EnvFileInfo, type PrismaInfo, type PrismaModel, type ProjectContext, type ProjectReader, type ServerFileInfo, } from './context/project.js';
+export { detectProject, nodeReader, memoryReader, type AppFileInfo, type CentralPlatformRouteHint, type DetectedStack, type EnvFileInfo, type PrismaInfo, type PrismaModel, type ProjectContext, type ProjectReader, type ServerFileInfo, } from './context/project.js';
 export { defineRule, type Diagnostic, type DiagnosticCategory, type DoctorRule, type Severity, } from './doctor/types.js';
 export { DEFAULT_RULES } from './doctor/rules.js';
 export { hasErrors, runDoctor } from './doctor/run.js';
@@ -18,6 +18,7 @@ export { BASALT_KNOWLEDGE } from './plan/knowledge.js';
 export { renderPlan } from './plan/render.js';
 export type { ArchitecturePlan, PlanEntity, PlanField, PlanRelation, PlanStep, PlanStepKind, } from './plan/types.js';
 export { runMake } from './make/make.js';
+export { assertSafePlan, UnsafePlanError } from './plan/identifiers.js';
 export { renderMakeResult } from './make/render.js';
 export { verifyProject, type VerifyResult } from './make/verify.js';
 export { canonicalType, domainFields, injectPrismaFields, injectZodFields, prismaType, zodForField, zodValidator, type CanonicalType, } from './make/fields.js';

package/dist/index.js

@@ -24,6 +24,7 @@ export { BASALT_KNOWLEDGE } from './plan/knowledge.js';
 export { renderPlan } from './plan/render.js';
 // Implementation (spec §4 Implement) — execute a plan via the generator + review gate.
 export { runMake } from './make/make.js';
+export { assertSafePlan, UnsafePlanError } from './plan/identifiers.js';
 export { renderMakeResult } from './make/render.js';
 export { verifyProject } from './make/verify.js';
 export { canonicalType, domainFields, injectPrismaFields, injectZodFields, prismaType, zodForField, zodValidator, } from './make/fields.js';

package/dist/make/fields.d.ts

@@ -11,6 +11,12 @@ export declare function prismaType(t: CanonicalType): string;
  * ISO string, matching the mapper.
  */
 export declare function zodValidator(t: CanonicalType, create: boolean): string;
+/**
+ * A single-quoted TS string literal for arbitrary text. Plan enum values are
+ * untrusted (LLM output / MCP client input): escaping via JSON.stringify means
+ * quotes, backslashes and line breaks can never end the literal early.
+ */
+export declare function tsStringLiteral(value: string): string;
 /** Zod validator for a field, honoring an enum (`z.enum([...])`) over its base type. */
 export declare function zodForField(field: PlanField, create: boolean): string;
 /** The entity's own fields, minus reserved/base columns and duplicates. */

package/dist/make/fields.js

@@ -55,10 +55,24 @@ export function zodValidator(t, create) {
 function usable(field) {
     return field.name.trim() !== '' && !RESERVED.has(field.name.toLowerCase());
 }
+/**
+ * A single-quoted TS string literal for arbitrary text. Plan enum values are
+ * untrusted (LLM output / MCP client input): escaping via JSON.stringify means
+ * quotes, backslashes and line breaks can never end the literal early.
+ */
+export function tsStringLiteral(value) {
+    const escaped = JSON.stringify(String(value))
+        .slice(1, -1)
+        .replace(/\\"/g, '"')
+        .replace(/'/g, "\\'")
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
+    return `'${escaped}'`;
+}
 /** Zod validator for a field, honoring an enum (`z.enum([...])`) over its base type. */
 export function zodForField(field, create) {
     if (field.enum && field.enum.length > 0) {
-        return `z.enum([${field.enum.map((v) => `'${v}'`).join(', ')}])`;
+        return `z.enum([${field.enum.map(tsStringLiteral).join(', ')}])`;
     }
     return zodValidator(canonicalType(field.type), create);
 }

package/dist/make/make.js

@@ -5,6 +5,7 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { unifiedDiff } from './diff.js';
 import { domainFields, injectPrismaFields, injectZodFields } from './fields.js';
+import { assertSafePlan } from '../plan/identifiers.js';
 import { externalRelationTargets, injectPrismaRelations, inverseRelationLines, relationFieldLines, relationForeignKeys, } from './relations.js';
 import { injectOpenApiMeta } from './openapi.js';
 import { renderPermissionsFile } from './permissions.js';
@@ -22,6 +23,9 @@ import { injectAuditPlugin, injectAuditService, injectPermissionGuards } from '.
  * touches the database, never deletes.
  */
 export async function runMake(ctx, plan, options = {}) {
+    // The plan is untrusted (LLM / MCP client): refuse any name that could
+    // inject code into the generated sources before generating anything.
+    assertSafePlan(plan);
     const entities = plan.entities.filter((e) => e.name.trim() !== '');
     if (entities.length === 0) {
         throw new Error('ai:make — the plan has no entity to generate.');
@@ -36,7 +40,13 @@ export async function runMake(ctx, plan, options = {}) {
         const gen = findGeneratorCommand(plan, entity.name);
         const prisma = options.prisma ?? gen?.prisma ?? prismaDefault;
         const softDelete = options.softDelete ?? gen?.softDelete ?? false;
-        const generated = generateResource(entity.name, { prisma, softDelete });
+        // Routes are authenticated by the generator's secure default. A
+        // tenant-scoped entity gets the generator's tenant-owned in-memory
+        // repository (requireTenantId()); with Prisma, augmentFiles below replaces
+        // the repository and injects tenantId + @@index itself, so the generator's
+        // tenant output is not requested there (it would duplicate the index).
+        const tenant = ctx.stack.tenancy && entity.tenantScoped && !prisma;
+        const generated = generateResource(entity.name, { prisma, softDelete, tenant });
         const { files, augmented, guarded, audited } = augmentFiles(generated, entity, plan, ctx, { prisma, softDelete });
         const build = {
             name: entity.name,

package/dist/make/repository.js

@@ -1,5 +1,5 @@
 import { names } from '@basaltkit/generator/resource';
-import { canonicalType, domainFields } from './fields.js';
+import { canonicalType, domainFields, tsStringLiteral } from './fields.js';
 /** TypeScript type of a Prisma row column for the mapper's parameter. */
 function rowType(t) {
     switch (t) {
@@ -38,7 +38,7 @@ export function renderPrismaRepository(name, fields, options) {
     }
     // Enum columns are stored as String; the mapper narrows them to the union.
     const colType = (f) => (f.values ? 'string' : rowType(f.canon));
-    const colExpr = (f) => f.values ? `r.${f.name} as ${f.values.map((v) => `'${v}'`).join(' | ')}` : mapExpr(f.name, f.canon);
+    const colExpr = (f) => f.values ? `r.${f.name} as ${f.values.map(tsStringLiteral).join(' | ')}` : mapExpr(f.name, f.canon);
     const rowTypeEntries = [
         'id: string',
         ...bodyFields.map((f) => `${f.name}: ${colType(f)}`),

package/dist/plan/identifiers.d.ts

@@ -0,0 +1,22 @@
+import type { ArchitecturePlan } from './types.js';
+/**
+ * A plan is untrusted input — an LLM output, or a plan object an MCP client
+ * hands to `basalt_make`. Every name in it is interpolated into generated
+ * TypeScript/Prisma source, so names are restricted to shapes that can never
+ * break out of their syntactic position (identifier, string literal).
+ */
+/** Field and relation names — emitted verbatim as TS properties and Prisma columns. */
+export declare const PLAN_IDENTIFIER: RegExp;
+/** Entity / related-model names — normalized by the generator's `names()` (words → PascalCase). */
+export declare const PLAN_ENTITY_NAME: RegExp;
+/** Audit event names (`invoice.created`, `billing:paid`) — emitted inside string literals. */
+export declare const PLAN_EVENT_NAME: RegExp;
+export declare class UnsafePlanError extends Error {
+    constructor(message: string);
+}
+/**
+ * Throws {@link UnsafePlanError} if any name in the plan could inject code into
+ * the generated sources. Enum VALUES are free text: they are always emitted as
+ * escaped string literals (see `tsStringLiteral`), never raw.
+ */
+export declare function assertSafePlan(plan: ArchitecturePlan): void;

package/dist/plan/identifiers.js

@@ -0,0 +1,54 @@
+/**
+ * A plan is untrusted input — an LLM output, or a plan object an MCP client
+ * hands to `basalt_make`. Every name in it is interpolated into generated
+ * TypeScript/Prisma source, so names are restricted to shapes that can never
+ * break out of their syntactic position (identifier, string literal).
+ */
+/** Field and relation names — emitted verbatim as TS properties and Prisma columns. */
+export const PLAN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Entity / related-model names — normalized by the generator's `names()` (words → PascalCase). */
+export const PLAN_ENTITY_NAME = /^[A-Za-z][A-Za-z0-9 _-]{0,99}$/;
+/** Audit event names (`invoice.created`, `billing:paid`) — emitted inside string literals. */
+export const PLAN_EVENT_NAME = /^[A-Za-z0-9_]+(?:[.:-][A-Za-z0-9_]+)*$/;
+export class UnsafePlanError extends Error {
+    constructor(message) {
+        super(`ai:make — unsafe plan: ${message}`);
+        this.name = 'UnsafePlanError';
+    }
+}
+/**
+ * Throws {@link UnsafePlanError} if any name in the plan could inject code into
+ * the generated sources. Enum VALUES are free text: they are always emitted as
+ * escaped string literals (see `tsStringLiteral`), never raw.
+ */
+export function assertSafePlan(plan) {
+    const entities = plan.entities;
+    if (!Array.isArray(entities))
+        throw new UnsafePlanError('`entities` must be an array.');
+    for (const entity of plan.entities) {
+        if (typeof entity.name !== 'string' || !PLAN_ENTITY_NAME.test(entity.name)) {
+            throw new UnsafePlanError(`entity name ${JSON.stringify(entity.name)} is not a valid identifier.`);
+        }
+        for (const field of entity.fields ?? []) {
+            if (typeof field.name !== 'string' || !PLAN_IDENTIFIER.test(field.name)) {
+                throw new UnsafePlanError(`field name ${JSON.stringify(field.name)} on ${entity.name} is not a valid identifier.`);
+            }
+            if (field.enum !== undefined && !(Array.isArray(field.enum) && field.enum.every((v) => typeof v === 'string'))) {
+                throw new UnsafePlanError(`enum of ${entity.name}.${field.name} must be an array of strings.`);
+            }
+        }
+        for (const relation of entity.relations ?? []) {
+            if (typeof relation.name !== 'string' || !PLAN_IDENTIFIER.test(relation.name)) {
+                throw new UnsafePlanError(`relation name ${JSON.stringify(relation.name)} on ${entity.name} is not a valid identifier.`);
+            }
+            if (typeof relation.model !== 'string' || !PLAN_ENTITY_NAME.test(relation.model)) {
+                throw new UnsafePlanError(`relation model ${JSON.stringify(relation.model)} on ${entity.name} is not a valid identifier.`);
+            }
+        }
+    }
+    for (const event of plan.auditEvents ?? []) {
+        if (typeof event !== 'string' || !PLAN_EVENT_NAME.test(event)) {
+            throw new UnsafePlanError(`audit event ${JSON.stringify(event)} is not a valid event name.`);
+        }
+    }
+}

package/dist/schema/index.js

@@ -10,6 +10,7 @@
  * tolerant coercion — the model's raw text is never fed to `.parse()` directly).
  */
 import { z } from 'zod';
+import { PLAN_ENTITY_NAME, PLAN_EVENT_NAME, PLAN_IDENTIFIER } from '../plan/identifiers.js';
 /** Bump when the serialized shape of a plan changes incompatibly. */
 export const PLAN_SCHEMA_VERSION = 1;
 /** Bump when the serialized shape of a make result changes incompatibly. */
@@ -103,17 +104,20 @@ export const AnalysisReportSchema = z.object({
     diagnostics: z.array(DiagnosticSchema),
 });
 // --- ArchitecturePlan (plan/types.ts) --------------------------------------
+// Names are interpolated into generated source: only plain identifiers are
+// accepted (see plan/identifiers.ts). Enum values are free text, always
+// emitted as escaped string literals.
 export const PlanFieldSchema = z.object({
-    name: z.string(),
+    name: z.string().regex(PLAN_IDENTIFIER),
     type: z.string(),
     enum: z.array(z.string()).optional(),
 });
 export const PlanRelationSchema = z.object({
-    name: z.string(),
-    model: z.string(),
+    name: z.string().regex(PLAN_IDENTIFIER),
+    model: z.string().regex(PLAN_ENTITY_NAME),
 });
 export const PlanEntitySchema = z.object({
-    name: z.string(),
+    name: z.string().regex(PLAN_ENTITY_NAME),
     fields: z.array(PlanFieldSchema),
     tenantScoped: z.boolean(),
     relations: z.array(PlanRelationSchema).optional(),
@@ -145,7 +149,7 @@ export const ArchitecturePlanSchema = z.object({
     entities: z.array(PlanEntitySchema),
     steps: z.array(PlanStepSchema),
     permissions: z.array(z.string()),
-    auditEvents: z.array(z.string()),
+    auditEvents: z.array(z.string().regex(PLAN_EVENT_NAME)),
     tenantScoped: z.boolean(),
     warnings: z.array(z.string()),
 });

package/dist/workflows.d.ts

@@ -16,4 +16,5 @@ export type { ArchitecturePlan, PlanEntity, PlanField, PlanRelation, PlanStep, P
 export { buildReviewContext, parseReview, reviewImplementation, type ReviewOptions, } from './review/review.js';
 export type { AgentReview, ReviewIssue } from './review/types.js';
 export { runMake } from './make/make.js';
+export { assertSafePlan, UnsafePlanError } from './plan/identifiers.js';
 export type { MakeOptions, MakeResult, MakePreview, FilePreview, ResourceBuild, SchemaMerge, Migration, ReviewResult, ReviewItem, ReviewStatus, } from './make/types.js';

package/dist/workflows.js

@@ -21,3 +21,4 @@ export { buildReviewContext, parseReview, reviewImplementation, } from './review
 // dry-run detects clashes and attaches diffs; writes never touch the DB unless
 // `migrate` is set. Framework-free via `@basaltkit/generator/resource`.
 export { runMake } from './make/make.js';
+export { assertSafePlan, UnsafePlanError } from './plan/identifiers.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/ai",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "engines": {
     "node": ">=22.5.0"
   },
@@ -30,14 +30,14 @@
     "dist"
   ],
   "dependencies": {
-    "zod": "^4.5.4",
-    "@basaltkit/cli": "^1.2.4",
-    "@basaltkit/generator": "^1.3.0"
+    "zod": "^4.6.5",
+    "@basaltkit/generator": "^1.6.0",
+    "@basaltkit/cli": "^1.4.0"
   },
   "devDependencies": {
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.6.1",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.11",
+    "vitest": "^5.0.1",
     "@basaltkit/tsconfig": "^0.24.0"
   },
   "publishConfig": {