@basaltkit/ai 1.3.0 → 1.4.0

package/dist/context/project.d.ts

@@ -5,6 +5,12 @@
 export interface ProjectReader {
     read(relPath: string): string | null;
     exists(relPath: string): boolean;
+    /**
+     * Every file under `relDir`, recursively, as paths relative to the root.
+     * Optional: a reader without it simply skips the checks that scan the
+     * project's route files.
+     */
+    list?(relDir: string): string[];
 }
 /** Default reader backed by the filesystem. */
 export declare function nodeReader(root: string): ProjectReader;
@@ -64,8 +70,23 @@ export interface EnvFileInfo {
     /** Default value baked into `REDIS_URL`, if any. */
     redisUrlDefault: string | null;
 }
+/**
+ * A route declared central (`meta.tenant: false`) whose permission names the
+ * platform plane (`can: 'platform:…'`), without `tenant: 'never'`. It still
+ * runs on a tenant host, against that tenant's storage.
+ */
+export interface CentralPlatformRouteHint {
+    path: string;
+    /** 1-based line of the `meta` object. */
+    line: number;
+}
 export interface ProjectContext {
     root: string;
+    /**
+     * Platform routes that do not refuse a tenant. Absent when the reader cannot
+     * list files.
+     */
+    centralPlatformRoutes?: CentralPlatformRouteHint[];
     /** All `@basaltkit/*` packages found in package.json deps. */
     installed: string[];
     stack: DetectedStack;

package/dist/context/project.js

@@ -1,5 +1,7 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+/** Upper bound on the files a route scan reads — a doctor run stays cheap on a large repo. */
+const MAX_SCANNED_FILES = 2000;
 /** Default reader backed by the filesystem. */
 export function nodeReader(root) {
     return {
@@ -12,13 +14,49 @@ export function nodeReader(root) {
             }
         },
         exists: (relPath) => existsSync(join(root, relPath)),
+        list(relDir) {
+            const out = [];
+            const walk = (dir) => {
+                let entries;
+                try {
+                    entries = readdirSync(join(root, dir), { withFileTypes: true });
+                }
+                catch {
+                    return;
+                }
+                for (const entry of entries) {
+                    if (out.length >= MAX_SCANNED_FILES)
+                        return;
+                    if (entry.name === 'node_modules' || entry.name.startsWith('.'))
+                        continue;
+                    const rel = `${dir}/${entry.name}`;
+                    if (entry.isDirectory())
+                        walk(rel);
+                    else if (entry.isFile())
+                        out.push(rel);
+                }
+            };
+            walk(trimTrailingSlashes(relDir));
+            return out;
+        },
     };
 }
+/** Drops trailing `/` characters in linear time (a `/\/+$/` regex backtracks on long runs of `/`). */
+function trimTrailingSlashes(path) {
+    let end = path.length;
+    while (end > 0 && path.charCodeAt(end - 1) === 47)
+        end--;
+    return path.slice(0, end);
+}
 /** In-memory reader for tests: keys are relative paths. */
 export function memoryReader(files) {
     return {
         read: (relPath) => files[relPath] ?? null,
         exists: (relPath) => relPath in files,
+        list: (relDir) => {
+            const prefix = `${trimTrailingSlashes(relDir)}/`;
+            return Object.keys(files).filter((path) => path.startsWith(prefix));
+        },
     };
 }
 const APP_CANDIDATES = ['src/app.ts', 'src/app.js', 'app.ts'];
@@ -58,7 +96,52 @@ export function detectProject(root, reader = nodeReader(root)) {
     const env = detectEnvFile(reader);
     const prisma = detectPrisma(reader);
     const stack = buildStack(installed, app, prisma);
-    return { root, installed, stack, prisma, app, server, env };
+    const centralPlatformRoutes = detectCentralPlatformRoutes(reader);
+    return {
+        root,
+        installed,
+        stack,
+        prisma,
+        app,
+        server,
+        env,
+        ...(centralPlatformRoutes ? { centralPlatformRoutes } : {}),
+    };
+}
+/**
+ * Finds `meta: { … }` literals with `tenant: false` and a `can` naming
+ * `platform:…`. A regex over flat object literals, not a parser: it sees
+ * `meta: { tenant: false, can: 'platform:plans' }` written inline, which is
+ * how routes are declared; meta built elsewhere and spread in goes unseen.
+ */
+function detectCentralPlatformRoutes(reader) {
+    if (!reader.list)
+        return undefined;
+    const files = reader
+        .list('src')
+        .filter((path) => /\.[cm]?[jt]s$/.test(path) && !/\.d\.ts$|\.(test|spec)\.[cm]?[jt]s$/.test(path))
+        .slice(0, MAX_SCANNED_FILES);
+    const hits = [];
+    for (const path of files) {
+        const content = reader.read(path);
+        if (!content || !content.includes('platform:'))
+            continue;
+        // Same length as the source, comments and string text blanked: a match
+        // must start in code, so a commented-out route never counts.
+        const code = codeOnly(content);
+        for (const match of content.matchAll(/\bmeta\s*:\s*\{([^{}]*)\}/g)) {
+            const index = match.index ?? 0;
+            if (code.slice(index, index + 4) !== 'meta')
+                continue;
+            const body = match[1] ?? '';
+            if (!/\btenant\s*:\s*false\b/.test(body))
+                continue;
+            if (!/\bcan\s*:\s*\[?\s*['"`]platform:/.test(body))
+                continue;
+            hits.push({ path, line: content.slice(0, index).split('\n').length });
+        }
+    }
+    return hits;
 }
 function detectInstalled(reader) {
     const raw = reader.read('package.json');

package/dist/doctor/rules.js

@@ -135,6 +135,30 @@ export const DEFAULT_RULES = [
             };
         },
     }),
+    defineRule({
+        id: 'platform-route-accepts-tenant',
+        category: 'tenancy',
+        check(ctx) {
+            const hits = ctx.centralPlatformRoutes ?? [];
+            if (hits.length === 0)
+                return null;
+            const where = hits.map((hit) => `${hit.path}:${hit.line}`).join(', ');
+            return {
+                id: 'platform-route-accepts-tenant',
+                title: "Platform route declares tenant: false instead of tenant: 'never'",
+                severity: 'warning',
+                category: 'tenancy',
+                detected: `platform routes still served on tenant hosts: ${where}`,
+                recommended: "declare meta: { tenant: 'never' } on routes of the central plane",
+                reason: '`tenant: false` lifts the tenant requirement but still resolves one: ' +
+                    'acme.<host>/platform/… runs inside Acme, against its database, and a ' +
+                    "tenant owner holding '*' satisfies 'platform:*'. `tenant: 'never'` answers " +
+                    'a tenant host with the plain 404 before any guard runs.',
+                fix: "meta: { tenant: 'never', auth: true, can: 'platform:plans.manage' }",
+                docs: '/guide/multi-tenant-pattern',
+            };
+        },
+    }),
     defineRule({
         id: 'tenant-scoping-missing',
         category: 'tenancy',

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export { fetchWithRetry, type RetryOptions } from './provider/http.js';
 export { globalSseFetch, parseSseContent, type SseFetch, type SseResponse } from './provider/sse.js';
 export { createProvider, providerEnvFrom, providerEnvFromProcess, type CreateProviderOptions, type ProviderEnv, type ProviderName, } from './provider/factory.js';
 export { runGeneration, generateText, withAbort, throwIfAborted, abortError, isAbortError, type OnProgress, type WorkflowProgress, type WorkflowRunOptions, } from './generate.js';
-export { detectProject, nodeReader, memoryReader, type AppFileInfo, type DetectedStack, type EnvFileInfo, type PrismaInfo, type PrismaModel, type ProjectContext, type ProjectReader, type ServerFileInfo, } from './context/project.js';
+export { detectProject, nodeReader, memoryReader, type AppFileInfo, type CentralPlatformRouteHint, type DetectedStack, type EnvFileInfo, type PrismaInfo, type PrismaModel, type ProjectContext, type ProjectReader, type ServerFileInfo, } from './context/project.js';
 export { defineRule, type Diagnostic, type DiagnosticCategory, type DoctorRule, type Severity, } from './doctor/types.js';
 export { DEFAULT_RULES } from './doctor/rules.js';
 export { hasErrors, runDoctor } from './doctor/run.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/ai",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "engines": {
     "node": ">=22.5.0"
   },
@@ -30,14 +30,14 @@
     "dist"
   ],
   "dependencies": {
-    "zod": "^4.5.4",
-    "@basaltkit/cli": "^1.2.5",
-    "@basaltkit/generator": "^1.4.0"
+    "zod": "^4.6.5",
+    "@basaltkit/generator": "^1.6.0",
+    "@basaltkit/cli": "^1.4.0"
   },
   "devDependencies": {
-    "@types/node": "^26.5.1",
+    "@types/node": "^26.6.1",
     "typescript": "^7.0.2",
-    "vitest": "^5.0.0",
+    "vitest": "^5.0.1",
     "@basaltkit/tsconfig": "^0.24.0"
   },
   "publishConfig": {