@basaltkit/ai 1.4.0 → 1.5.0

package/dist/context/project.d.ts

@@ -40,6 +40,8 @@ export interface PrismaModel {
     fields: string[];
     /** True when the model carries a `tenantId` column (tenant-scoped). */
     tenantScoped: boolean;
+    /** The `@@map("…")` table name, when the model declares one. */
+    table?: string;
 }
 export interface PrismaInfo {
     provider: DetectedStack['database'];
@@ -55,6 +57,8 @@ export interface AppFileInfo {
     memorySources: string[];
     /** Every `<name>Plugin(` factory call in the app file (unfiltered by capability). */
     pluginCalls: string[];
+    /** Plugins called without the option that takes a durable store. */
+    defaultMemoryStores: DefaultMemoryStore[];
 }
 export interface ServerFileInfo {
     path: string;
@@ -80,6 +84,43 @@ export interface CentralPlatformRouteHint {
     /** 1-based line of the `meta` object. */
     line: number;
 }
+/** A spot in a source file a rule points at. */
+export interface SourceHint {
+    path: string;
+    /** 1-based line. */
+    line: number;
+}
+/** Findings from scanning the app's own source files under `src/`. */
+export interface SourceHints {
+    /** `ctx()`, `tryCtx()` or `db()` called while a module loads, outside any function. */
+    moduleScopeContext: SourceHint[];
+    /** `new HookBus()`: a bus of its own, which the app's events never reach. */
+    detachedHookBus: SourceHint[];
+    /** Imports from `zod/v3`. */
+    zodV3Imports: SourceHint[];
+}
+/** What the project's Prisma migrations create. */
+export interface MigrationsInfo {
+    /** The migrations folder, relative to the root. */
+    path: string;
+    /** `migration.sql` files found. */
+    files: number;
+    /** Tables those files create (or rename to), lower-cased, schema prefix dropped. */
+    tables: string[];
+}
+/** The reference schema an installed `@basaltkit/*-prisma` package ships. */
+export interface FrameworkSchema {
+    package: string;
+    models: PrismaModel[];
+}
+/** A plugin left on the in-memory store it falls back to. */
+export interface DefaultMemoryStore {
+    plugin: string;
+    /** The option that takes the durable store. */
+    option: string;
+    /** The package that provides one. */
+    durable: string;
+}
 export interface ProjectContext {
     root: string;
     /**
@@ -94,6 +135,16 @@ export interface ProjectContext {
     app: AppFileInfo | null;
     server: ServerFileInfo | null;
     env: EnvFileInfo | null;
+    /**
+     * The Prisma migrations: null when there is no migrations folder (the
+     * project uses `db push`, or has no Prisma). Absent when the reader cannot
+     * list files.
+     */
+    migrations?: MigrationsInfo | null;
+    /** Reference schemas of the installed `@basaltkit/*-prisma` packages. */
+    frameworkSchemas?: FrameworkSchema[];
+    /** Scan of the app's own source files. Absent when the reader cannot list files. */
+    sourceHints?: SourceHints;
 }
 /** Detect the project's stack and key files. Pure over the injected reader. */
 export declare function detectProject(root: string, reader?: ProjectReader): ProjectContext;

package/dist/context/project.js

@@ -52,7 +52,8 @@ function trimTrailingSlashes(path) {
 export function memoryReader(files) {
     return {
         read: (relPath) => files[relPath] ?? null,
-        exists: (relPath) => relPath in files,
+        // A folder exists when a file sits under it, as on disk.
+        exists: (relPath) => relPath in files || Object.keys(files).some((path) => path.startsWith(`${relPath}/`)),
         list: (relDir) => {
             const prefix = `${trimTrailingSlashes(relDir)}/`;
             return Object.keys(files).filter((path) => path.startsWith(prefix));
@@ -97,6 +98,8 @@ export function detectProject(root, reader = nodeReader(root)) {
     const prisma = detectPrisma(reader);
     const stack = buildStack(installed, app, prisma);
     const centralPlatformRoutes = detectCentralPlatformRoutes(reader);
+    const migrations = detectMigrations(reader);
+    const sourceHints = detectSourceHints(reader);
     return {
         root,
         installed,
@@ -105,9 +108,130 @@ export function detectProject(root, reader = nodeReader(root)) {
         app,
         server,
         env,
+        frameworkSchemas: detectFrameworkSchemas(reader, installed, prisma?.provider ?? null),
         ...(centralPlatformRoutes ? { centralPlatformRoutes } : {}),
+        ...(migrations !== undefined ? { migrations } : {}),
+        ...(sourceHints ? { sourceHints } : {}),
     };
 }
+/** The app's own source files: `src/**` scripts, without tests and declarations. */
+function sourceFiles(reader) {
+    if (!reader.list)
+        return undefined;
+    return reader
+        .list('src')
+        .filter((path) => /\.[cm]?[jt]s$/.test(path) && !/\.d\.ts$|\.(test|spec)\.[cm]?[jt]s$/.test(path))
+        .slice(0, MAX_SCANNED_FILES);
+}
+const MIGRATIONS_DIR = 'prisma/migrations';
+/**
+ * Tables the migrations create. Reads `CREATE TABLE` (and `RENAME TO`) from
+ * every `migration.sql`: what `prisma migrate deploy` builds in production.
+ */
+function detectMigrations(reader) {
+    if (!reader.list)
+        return undefined;
+    if (!reader.exists(MIGRATIONS_DIR))
+        return null;
+    const files = reader.list(MIGRATIONS_DIR).filter((path) => path.endsWith('/migration.sql'));
+    const tables = new Set();
+    const name = String.raw `(?:[\x60"\[]?\w+[\x60"\]]?\s*\.\s*)?[\x60"\[]?(\w+)[\x60"\]]?`;
+    const create = new RegExp(String.raw `\bCREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?` + name, 'gi');
+    const rename = new RegExp(String.raw `\bRENAME\s+TO\s+` + name, 'gi');
+    for (const path of files) {
+        const sql = reader.read(path) ?? '';
+        for (const match of sql.matchAll(create))
+            if (match[1])
+                tables.add(match[1].toLowerCase());
+        for (const match of sql.matchAll(rename))
+            if (match[1])
+                tables.add(match[1].toLowerCase());
+    }
+    return { path: MIGRATIONS_DIR, files: files.length, tables: [...tables].sort() };
+}
+/** The reference schema of every installed `@basaltkit/*-prisma` package, in the app's dialect. */
+function detectFrameworkSchemas(reader, installed, provider) {
+    const schemas = [];
+    for (const pkg of installed.filter((name) => name.endsWith('-prisma'))) {
+        const dir = `node_modules/${pkg}/prisma`;
+        const schema = (provider === 'mysql' ? reader.read(`${dir}/schema.mysql.prisma`) : null) ?? reader.read(`${dir}/schema.prisma`);
+        if (schema)
+            schemas.push({ package: pkg, models: parseModels(schema) });
+    }
+    return schemas;
+}
+/** The local names under which a module imports `wanted` from `source` (`{ db as getDb }` → getDb). */
+function localNames(content, source, wanted) {
+    const names = [];
+    const from = new RegExp(String.raw `import\s*(?:type\s*)?\{([^}]*)\}\s*from\s*['"]${source.replace('/', '\\/')}['"]`, 'g');
+    for (const match of content.matchAll(from)) {
+        for (const part of (match[1] ?? '').split(',')) {
+            const [imported, local] = part.trim().split(/\s+as\s+/).map((name) => name.trim());
+            if (imported && wanted.includes(imported))
+                names.push(local ?? imported);
+        }
+    }
+    return names;
+}
+/**
+ * Scans `src/` for three mistakes a regex can see without false alarms:
+ * a request-context call in a module's top-level `const`, a HookBus of its
+ * own, and zod/v3 imports. Matches must start in code (comments and string
+ * text are blanked), as for the route scan.
+ */
+function detectSourceHints(reader) {
+    const files = sourceFiles(reader);
+    if (!files)
+        return undefined;
+    const hints = { moduleScopeContext: [], detachedHookBus: [], zodV3Imports: [] };
+    for (const path of files) {
+        const content = reader.read(path);
+        if (!content)
+            continue;
+        const code = codeOnly(content);
+        const lineOf = (index) => content.slice(0, index).split('\n').length;
+        const callees = [
+            ...localNames(content, '@basaltkit/core', ['ctx', 'tryCtx']),
+            ...localNames(content, '@basaltkit/prisma', ['db']),
+        ];
+        if (callees.length > 0) {
+            const call = new RegExp(String.raw `\b(?:` + callees.join('|') + String.raw `)\s*(?:<[^<>()]*>)?\s*\(\s*\)`);
+            let depth = 0;
+            let offset = 0;
+            for (const line of code.split('\n')) {
+                // A top-level `const x = …` whose initializer, on that line, calls
+                // the context before any function begins: it runs at import time.
+                const declaration = depth === 0
+                    ? /^(?:export\s+)?(?:const|let|var)\s+[\w$]+(?:\s*:[^=]+)?\s*=(?![=>])(.*)$/.exec(line)
+                    : null;
+                if (declaration) {
+                    const initializer = declaration[1] ?? '';
+                    const at = initializer.search(call);
+                    const fn = initializer.search(/=>|\bfunction\b/);
+                    if (at !== -1 && (fn === -1 || at < fn))
+                        hints.moduleScopeContext.push({ path, line: lineOf(offset) });
+                }
+                for (const ch of line) {
+                    if (ch === '{')
+                        depth++;
+                    else if (ch === '}')
+                        depth = Math.max(0, depth - 1);
+                }
+                offset += line.length + 1;
+            }
+        }
+        for (const match of code.matchAll(/\bnew\s+HookBus\s*\(/g)) {
+            hints.detachedHookBus.push({ path, line: lineOf(match.index ?? 0) });
+        }
+        for (const match of content.matchAll(/\b(?:from\s*|import\s*\(\s*|require\s*\(\s*)['"]zod\/v3['"]/g)) {
+            const index = match.index ?? 0;
+            if (!/^(from|import|require)/.test(code.slice(index, index + 7)))
+                continue;
+            hints.zodV3Imports.push({ path, line: lineOf(index) });
+        }
+    }
+    return hints;
+}
 /**
  * Finds `meta: { … }` literals with `tenant: false` and a `can` naming
  * `platform:…`. A regex over flat object literals, not a parser: it sees
@@ -189,7 +313,51 @@ function detectAppFile(reader) {
     const pluginCalls = [
         ...new Set(Array.from(found.content.matchAll(/\b([A-Za-z][A-Za-z0-9]*Plugin)\s*\(/g), (m) => m[1])),
     ];
-    return { path: found.path, plugins, fastifyLoggerConfigured, memorySources, pluginCalls };
+    const defaultMemoryStores = MEMORY_DEFAULT_PLUGINS.filter((spec) => pluginCallArguments(found.content, spec.plugin).some((args) => !takesOption(args, spec.option)));
+    return { path: found.path, plugins, fastifyLoggerConfigured, memorySources, pluginCalls, defaultMemoryStores };
+}
+/**
+ * Plugins that fall back to an in-memory store when the option is left out:
+ * fine in a test, lost on every restart and not shared between instances.
+ */
+const MEMORY_DEFAULT_PLUGINS = [
+    { plugin: 'commentsPlugin', option: 'store', durable: '@basaltkit/comments-prisma' },
+    { plugin: 'activityPlugin', option: 'store', durable: '@basaltkit/activity-prisma' },
+    { plugin: 'auditPlugin', option: 'store', durable: '@basaltkit/audit-prisma' },
+    { plugin: 'filesPlugin', option: 'store', durable: '@basaltkit/files-prisma' },
+    { plugin: 'notificationsPlugin', option: 'inApp', durable: '@basaltkit/notifications-prisma' },
+    { plugin: 'teamsPlugin', option: 'memberships', durable: '@basaltkit/teams-prisma' },
+    { plugin: 'webhooksPlugin', option: 'store', durable: '@basaltkit/webhooks-prisma' },
+    { plugin: 'outboxPlugin', option: 'store', durable: '@basaltkit/events-prisma' },
+];
+/** The argument text of every `<plugin>(…)` call in code, parentheses balanced. */
+function pluginCallArguments(code, plugin) {
+    const out = [];
+    for (const match of code.matchAll(new RegExp(String.raw `\b${plugin}\s*\(`, 'g'))) {
+        let depth = 1;
+        let i = (match.index ?? 0) + match[0].length;
+        const start = i;
+        for (; i < code.length && depth > 0; i++) {
+            if (code[i] === '(')
+                depth++;
+            else if (code[i] === ')')
+                depth--;
+        }
+        out.push(code.slice(start, i - 1).trim());
+    }
+    return out;
+}
+/**
+ * Whether the arguments pass `option`. Anything that is not an inline object
+ * (a variable, a spread) may carry it, so it counts as passed: the rule only
+ * speaks when it can see the option is missing.
+ */
+function takesOption(args, option) {
+    if (args === '')
+        return false;
+    if (!args.startsWith('{') || args.includes('...'))
+        return true;
+    return new RegExp(String.raw `[{,\s]${option}\s*[:,}]|[{,\s]${option}\s*$`).test(args);
 }
 /**
  * The source with comments removed and string/template-literal TEXT blanked
@@ -329,8 +497,11 @@ function normalizeProvider(raw) {
 function parseModels(schema) {
     const models = [];
     const modelRegex = /model\s+(\w+)\s*\{([^}]*)\}/gs;
+    // Comments go first: a `}` in one (`// { id, ...anything }`) would end the
+    // model there, losing every field and the @@map after it.
+    const source = stripComments(schema);
     let match;
-    while ((match = modelRegex.exec(schema)) !== null) {
+    while ((match = modelRegex.exec(source)) !== null) {
         const name = match[1];
         const body = match[2];
         if (!name || body === undefined)
@@ -339,10 +510,15 @@ function parseModels(schema) {
             .split('\n')
             .map((line) => line.trim().split(/\s+/)[0])
             .filter((token) => !!token && !token.startsWith('@') && !token.startsWith('//'));
-        models.push({ name, fields, tenantScoped: fields.includes('tenantId') });
+        const table = /@@map\(\s*"([^"]+)"\s*\)/.exec(body)?.[1];
+        models.push({ name, fields, tenantScoped: fields.includes('tenantId'), ...(table ? { table } : {}) });
     }
     return models;
 }
+/** Drops `//` comments — only at a line start or after whitespace, so `"postgres://…"` survives. */
+function stripComments(schema) {
+    return schema.replace(/(^|\s)\/\/.*$/gm, '$1');
+}
 function buildStack(installed, app, prisma) {
     const stack = {
         http: null,

package/dist/doctor/rules.d.ts

@@ -5,3 +5,12 @@ import { type DoctorRule } from './types.js';
  * {@link runDoctor}).
  */
 export declare const DEFAULT_RULES: DoctorRule[];
+/**
+ * Models the framework's `-prisma` packages ship without a tenantId, by design:
+ * identity is central (one AuthUser across tenants, membership checked by
+ * tenantMembershipPlugin), and the others are scoped by their package. Keyed by
+ * model name → its `@@map` table, and matched on both, so an app's own
+ * `Payment` or `Subscription` is still checked. A test keeps this in sync with
+ * the reference schemas.
+ */
+export declare const FRAMEWORK_GLOBAL_MODELS: Readonly<Record<string, string>>;

package/dist/doctor/rules.js

@@ -165,7 +165,7 @@ export const DEFAULT_RULES = [
         check(ctx) {
             if (!ctx.stack.tenancy || !ctx.prisma)
                 return null;
-            const unscoped = ctx.prisma.models.filter((model) => !model.tenantScoped && !GLOBAL_MODELS.has(model.name));
+            const unscoped = ctx.prisma.models.filter((model) => !model.tenantScoped && !GLOBAL_MODELS.has(model.name) && !isFrameworkGlobalModel(model));
             if (unscoped.length === 0)
                 return null;
             const names = unscoped.map((m) => m.name).join(', ');
@@ -183,6 +183,73 @@ export const DEFAULT_RULES = [
             };
         },
     }),
+    // ── database ──────────────────────────────────────────────────────────────
+    defineRule({
+        id: 'schema-not-migrated',
+        category: 'database',
+        check(ctx) {
+            if (!ctx.prisma || !ctx.migrations)
+                return null;
+            const created = new Set(ctx.migrations.tables);
+            const missing = ctx.prisma.models.filter((model) => !created.has(tableOf(model).toLowerCase()));
+            if (missing.length === 0)
+                return null;
+            return {
+                id: 'schema-not-migrated',
+                title: 'Models with no migration — production will not have their tables',
+                severity: 'error',
+                category: 'database',
+                detected: `no migration in ${ctx.migrations.path} creates: ${listOf(missing.map((m) => m.name))}`,
+                recommended: 'create a migration for them and commit it',
+                reason: 'A deploy runs `prisma migrate deploy`, which builds only what the migrations ' +
+                    'create. A table that exists locally because of `prisma db push` is missing in ' +
+                    'production, and the first query on it fails.',
+                fix: [
+                    'pnpm prisma migrate dev --name add_missing_tables',
+                    '// a database built with db push reports drift: generate the SQL with `prisma migrate diff`,',
+                    '// then mark it applied there with `prisma migrate resolve --applied <migration>`',
+                ].join('\n'),
+                docs: '/guide/persistence',
+            };
+        },
+    }),
+    defineRule({
+        id: 'framework-schema-drift',
+        category: 'database',
+        check(ctx) {
+            if (!ctx.prisma || !ctx.frameworkSchemas?.length)
+                return null;
+            const own = new Map(ctx.prisma.models.map((model) => [model.name, model]));
+            const gaps = [];
+            const packages = new Set();
+            for (const schema of ctx.frameworkSchemas) {
+                for (const reference of schema.models) {
+                    const model = own.get(reference.name);
+                    if (!model)
+                        continue;
+                    const missing = reference.fields.filter((field) => !model.fields.includes(field));
+                    if (missing.length === 0)
+                        continue;
+                    gaps.push(...missing.map((field) => `${model.name}.${field}`));
+                    packages.add(schema.package);
+                }
+            }
+            if (gaps.length === 0)
+                return null;
+            return {
+                id: 'framework-schema-drift',
+                title: "Framework models are missing columns of the installed packages' schemas",
+                severity: 'warning',
+                category: 'database',
+                detected: `missing from schema.prisma (${[...packages].join(', ')}): ${listOf(gaps)}`,
+                recommended: 'copy the current models from the installed packages and migrate',
+                reason: 'A package upgrade can add columns its store writes. Until the schema has them, ' +
+                    'the store fails at runtime on the feature that uses them.',
+                fix: 'pnpm basalt prisma:sync   # then: pnpm prisma migrate dev',
+                docs: '/guide/persistence',
+            };
+        },
+    }),
     // ── durability ────────────────────────────────────────────────────────────
     defineRule({
         id: 'memory-sources-in-use',
@@ -254,6 +321,137 @@ export const DEFAULT_RULES = [
             };
         },
     }),
+    defineRule({
+        id: 'plugin-default-memory-store',
+        category: 'durability',
+        check(ctx) {
+            const stores = ctx.app?.defaultMemoryStores ?? [];
+            if (!ctx.app || !ctx.stack.orm || stores.length === 0)
+                return null;
+            return {
+                id: 'plugin-default-memory-store',
+                title: 'Plugins keep their data in memory although the app has a database',
+                severity: 'warning',
+                category: 'durability',
+                detected: `${ctx.app.path}: ${stores.map((s) => `${s.plugin}() without ${s.option}`).join(', ')}`,
+                recommended: 'pass each one the durable store of its -prisma package',
+                reason: 'Left without a store these plugins fall back to memory: the data is gone on ' +
+                    'every restart and each instance sees its own copy.',
+                fix: stores.map((s) => `pnpm add ${s.durable}   // ${s.plugin}({ ${s.option}: … })`).join('\n'),
+                docs: '/guide/persistence',
+            };
+        },
+    }),
+    // ── correctness ───────────────────────────────────────────────────────────
+    defineRule({
+        id: 'context-at-module-scope',
+        category: 'tenancy',
+        check(ctx) {
+            const hits = ctx.sourceHints?.moduleScopeContext ?? [];
+            if (hits.length === 0)
+                return null;
+            return {
+                id: 'context-at-module-scope',
+                title: 'The request context is read while a module loads',
+                severity: 'error',
+                category: 'tenancy',
+                detected: `ctx()/tryCtx()/db() in a top-level declaration: ${whereOf(hits)}`,
+                recommended: 'call it inside the handler or function that needs it',
+                reason: 'At import time there is no request: ctx() and db() throw, and tryCtx() returns ' +
+                    'undefined, so the value is the same for every tenant and every request.',
+                fix: 'const service = () => ctx().container.get(SERVICE)   // a function, called per request',
+                docs: '/guide/concepts#context-asynclocalstorage',
+            };
+        },
+    }),
+    defineRule({
+        id: 'detached-hook-bus',
+        category: 'config',
+        check(ctx) {
+            const hits = ctx.sourceHints?.detachedHookBus ?? [];
+            if (hits.length === 0)
+                return null;
+            return {
+                id: 'detached-hook-bus',
+                title: 'A HookBus of its own — the app\'s events never reach it',
+                severity: 'warning',
+                category: 'config',
+                detected: `new HookBus() in ${whereOf(hits)}`,
+                recommended: "listen on the app's bus: the `hooks` a plugin receives",
+                reason: 'Plugins emit on the bus the app creates. A bus built with new HookBus() is a ' +
+                    'separate one: its listeners are never called and nothing fails.',
+                fix: "definePlugin({ name: 'x', boot({ hooks }) { hooks.on('comment:created', …) } })",
+                docs: '/guide/concepts#hooks-hookbus',
+            };
+        },
+    }),
+    defineRule({
+        id: 'zod-v3-import',
+        category: 'config',
+        check(ctx) {
+            const hits = ctx.sourceHints?.zodV3Imports ?? [];
+            if (hits.length === 0)
+                return null;
+            return {
+                id: 'zod-v3-import',
+                title: 'Schemas built with zod/v3',
+                severity: 'warning',
+                category: 'config',
+                detected: `imports from 'zod/v3': ${whereOf(hits)}`,
+                recommended: "import from 'zod' (Zod 4), as the framework does",
+                reason: 'Routes turn their schemas into OpenAPI and MCP tool input with Zod 4. A zod/v3 ' +
+                    'schema is a different object: those documents come out wrong or the conversion throws.',
+                fix: "import { z } from 'zod'",
+                docs: '/guide/concepts#the-neutral-route-pipeline',
+            };
+        },
+    }),
 ];
 /** Models that legitimately have no tenantId (platform-global tables). */
 const GLOBAL_MODELS = new Set(['Tenant', 'User', 'Plan', 'WebhookEvent', 'Migration']);
+/**
+ * Models the framework's `-prisma` packages ship without a tenantId, by design:
+ * identity is central (one AuthUser across tenants, membership checked by
+ * tenantMembershipPlugin), and the others are scoped by their package. Keyed by
+ * model name → its `@@map` table, and matched on both, so an app's own
+ * `Payment` or `Subscription` is still checked. A test keeps this in sync with
+ * the reference schemas.
+ */
+export const FRAMEWORK_GLOBAL_MODELS = {
+    AuthUser: 'auth_users',
+    AuthSession: 'auth_sessions',
+    AuthRefreshToken: 'auth_refresh_tokens',
+    AuthToken: 'auth_tokens',
+    AuthMfa: 'auth_mfa',
+    AuthTokenVersion: 'auth_token_versions',
+    AuthAccountLink: 'auth_account_links',
+    AuthPasskey: 'auth_passkeys',
+    InAppNotification: 'in_app_notifications',
+    NotificationPreference: 'notification_preferences',
+    PermUserRole: 'perm_user_roles',
+    PermUserPermission: 'perm_user_permissions',
+    PermRolePermission: 'perm_role_permissions',
+    PermTemporaryGrant: 'perm_temporary_grants',
+    PermDelegation: 'perm_delegations',
+    Subscription: 'subscriptions',
+    UsageCounter: 'usage_counters',
+    WebhookEvent: 'webhook_events',
+    Payment: 'payments',
+    RecurringSubscription: 'recurring_subscriptions',
+    Tenant: 'tenants',
+};
+function isFrameworkGlobalModel(model) {
+    const table = Object.hasOwn(FRAMEWORK_GLOBAL_MODELS, model.name) ? FRAMEWORK_GLOBAL_MODELS[model.name] : undefined;
+    return table !== undefined && table === model.table;
+}
+/** The table a model maps to: its `@@map`, else its name. */
+function tableOf(model) {
+    return model.table ?? model.name;
+}
+/** A list cut at ten entries, so a big schema does not flood the report. */
+function listOf(items) {
+    return items.length > 10 ? `${items.slice(0, 10).join(', ')} (+${items.length - 10} more)` : items.join(', ');
+}
+function whereOf(hits) {
+    return listOf(hits.map((hit) => `${hit.path}:${hit.line}`));
+}

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export { fetchWithRetry, type RetryOptions } from './provider/http.js';
 export { globalSseFetch, parseSseContent, type SseFetch, type SseResponse } from './provider/sse.js';
 export { createProvider, providerEnvFrom, providerEnvFromProcess, type CreateProviderOptions, type ProviderEnv, type ProviderName, } from './provider/factory.js';
 export { runGeneration, generateText, withAbort, throwIfAborted, abortError, isAbortError, type OnProgress, type WorkflowProgress, type WorkflowRunOptions, } from './generate.js';
-export { detectProject, nodeReader, memoryReader, type AppFileInfo, type CentralPlatformRouteHint, type DetectedStack, type EnvFileInfo, type PrismaInfo, type PrismaModel, type ProjectContext, type ProjectReader, type ServerFileInfo, } from './context/project.js';
+export { detectProject, nodeReader, memoryReader, type AppFileInfo, type CentralPlatformRouteHint, type DefaultMemoryStore, type DetectedStack, type EnvFileInfo, type FrameworkSchema, type MigrationsInfo, type PrismaInfo, type PrismaModel, type ProjectContext, type ProjectReader, type ServerFileInfo, type SourceHint, type SourceHints, } from './context/project.js';
 export { defineRule, type Diagnostic, type DiagnosticCategory, type DoctorRule, type Severity, } from './doctor/types.js';
 export { DEFAULT_RULES } from './doctor/rules.js';
 export { hasErrors, runDoctor } from './doctor/run.js';

package/dist/make/schema.d.ts

@@ -18,5 +18,9 @@ export interface PrismaPushResult {
     /** Tail of stdout/stderr. */
     output: string;
 }
-/** Run `npx prisma db push` — creates the table(s) and regenerates the client. Best-effort. */
+/**
+ * Run the project's own `prisma db push` — creates the table(s) and regenerates the client.
+ * Best-effort. `--no` keeps npx from downloading a Prisma CLI the project does not have
+ * (npm's `latest` is the Prisma 8 release candidate, which has no `db push`).
+ */
 export declare function runPrismaPush(baseDir: string): Promise<PrismaPushResult>;

package/dist/make/schema.js

@@ -36,10 +36,14 @@ export async function readSchema(baseDir, schemaPath) {
 export async function writeSchema(baseDir, schemaPath, content) {
     await writeFile(join(baseDir, schemaPath), content);
 }
-/** Run `npx prisma db push` — creates the table(s) and regenerates the client. Best-effort. */
+/**
+ * Run the project's own `prisma db push` — creates the table(s) and regenerates the client.
+ * Best-effort. `--no` keeps npx from downloading a Prisma CLI the project does not have
+ * (npm's `latest` is the Prisma 8 release candidate, which has no `db push`).
+ */
 export async function runPrismaPush(baseDir) {
     try {
-        const { stdout } = await run('npx', ['prisma', 'db', 'push'], {
+        const { stdout } = await run('npx', ['--no', '--', 'prisma', 'db', 'push'], {
             cwd: baseDir,
             timeout: 180_000,
             maxBuffer: 10 * 1024 * 1024,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/ai",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "engines": {
     "node": ">=22.5.0"
   },
@@ -30,14 +30,14 @@
     "dist"
   ],
   "dependencies": {
-    "zod": "^4.6.5",
-    "@basaltkit/generator": "^1.6.0",
-    "@basaltkit/cli": "^1.4.0"
+    "zod": "^4.6.7",
+    "@basaltkit/cli": "^1.7.0",
+    "@basaltkit/generator": "^1.7.0"
   },
   "devDependencies": {
-    "@types/node": "^26.6.1",
+    "@types/node": "^26.6.5",
     "typescript": "^7.0.2",
-    "vitest": "^5.0.1",
+    "vitest": "^5.0.5",
     "@basaltkit/tsconfig": "^0.24.0"
   },
   "publishConfig": {