swallowkit 1.0.0-beta.5 → 1.0.0-beta.51

package/src/__tests__/machine.test.ts

@@ -0,0 +1,356 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { EventEmitter } from "events";
+import * as childProcess from "child_process";
+import { runMachineCli } from "../machine";
+
+jest.mock("child_process", () => {
+  const actual = jest.requireActual<typeof import("child_process")>("child_process");
+  return {
+    ...actual,
+    spawn: jest.fn(),
+    spawnSync: jest.fn(),
+  };
+});
+
+const repoRoot = process.cwd();
+
+function writeFile(filePath: string, content: string): void {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content, "utf-8");
+}
+
+function createModelSource(name: string): string {
+  return `import { z } from 'zod/v4';
+
+export const ${name} = z.object({
+  id: z.string(),
+  name: z.string().min(1),
+  createdAt: z.string().optional(),
+  updatedAt: z.string().optional(),
+});
+
+export type ${name} = z.infer<typeof ${name}>;
+
+export const displayName = '${name}';
+`;
+}
+
+function createProjectFixture(rootDir: string, options: { includeGeneratedArtifacts?: boolean; forbiddenBffDependency?: boolean } = {}): void {
+  writeFile(path.join(rootDir, "package.json"), JSON.stringify({ name: "sample-app" }, null, 2));
+  writeFile(
+    path.join(rootDir, "swallowkit.config.js"),
+    `module.exports = {
+  database: {
+    connectionString: 'AccountEndpoint=https://example.local;',
+  },
+  backend: {
+    language: 'typescript',
+  },
+  api: {
+    endpoint: '/api/_swallowkit',
+  },
+};
+`
+  );
+  writeFile(path.join(rootDir, "shared", "package.json"), JSON.stringify({ name: "@sample-app/shared" }, null, 2));
+  writeFile(path.join(rootDir, "shared", "index.ts"), "export {};\n");
+  writeFile(path.join(rootDir, "shared", "models", "todo.ts"), createModelSource("Todo"));
+  fs.mkdirSync(path.join(rootDir, "node_modules"), { recursive: true });
+  fs.symlinkSync(
+    path.join(repoRoot, "node_modules", "zod"),
+    path.join(rootDir, "node_modules", "zod"),
+    "junction"
+  );
+
+  if (options.includeGeneratedArtifacts) {
+    writeFile(path.join(rootDir, "lib", "api", "call-function.ts"), "export function callFunction() {}\n");
+    writeFile(path.join(rootDir, "functions", "src", "todo.ts"), "export {};\n");
+    writeFile(path.join(rootDir, "app", "api", "todo", "route.ts"), "export async function GET() { return Response.json([]); }\n");
+    writeFile(path.join(rootDir, "app", "api", "todo", "[id]", "route.ts"), "export async function GET() { return Response.json({}); }\n");
+  }
+
+  if (options.forbiddenBffDependency) {
+    writeFile(
+      path.join(rootDir, "app", "api", "forbidden", "route.ts"),
+      "import { CosmosClient } from '@azure/cosmos';\nexport async function GET() { return Response.json({ ok: Boolean(CosmosClient) }); }\n"
+    );
+  }
+}
+
+function createCSharpScaffoldFixture(rootDir: string): void {
+  writeFile(path.join(rootDir, "package.json"), JSON.stringify({ name: "sample-app" }, null, 2));
+  writeFile(
+    path.join(rootDir, "swallowkit.config.js"),
+    `module.exports = {
+  backend: {
+    language: 'csharp',
+  },
+  api: {
+    endpoint: '/api/_swallowkit',
+  },
+};
+`
+  );
+  writeFile(path.join(rootDir, "shared", "package.json"), JSON.stringify({ name: "@sample-app/shared" }, null, 2));
+  writeFile(path.join(rootDir, "shared", "index.ts"), "export {};\n");
+  writeFile(path.join(rootDir, "shared", "models", "estimate.ts"), createModelSource("Estimate"));
+  writeFile(path.join(rootDir, "shared", "models", "member.ts"), createModelSource("Member"));
+  writeFile(path.join(rootDir, "shared", "models", "team.ts"), createModelSource("Team"));
+  fs.mkdirSync(path.join(rootDir, "node_modules"), { recursive: true });
+  fs.symlinkSync(
+    path.join(repoRoot, "node_modules", "zod"),
+    path.join(rootDir, "node_modules", "zod"),
+    "junction"
+  );
+
+  writeFile(
+    path.join(rootDir, "functions", "Crud", "EstimateFunctions.cs"),
+    "namespace SwallowKit.Functions;\npublic sealed class EstimateFunctions { public void Approve() {} public void Submit() {} public void Remand() {} }\n"
+  );
+  writeFile(path.join(rootDir, "functions", "generated", "csharp-models", "README.md"), "keep generated readme\n");
+  writeFile(path.join(rootDir, "functions", "generated", "csharp-models", "SwallowKitBackendModels.csproj"), "<Project />\n");
+  writeFile(path.join(rootDir, "functions", "generated", "csharp-models", "SwallowKitBackendModels.sln"), "solution\n");
+  writeFile(
+    path.join(rootDir, "functions", "generated", "csharp-models", "src", "SwallowKitBackendModels", "Model", "Member.cs"),
+    "// existing member\n"
+  );
+  writeFile(
+    path.join(rootDir, "functions", "generated", "csharp-models", "src", "SwallowKitBackendModels", "Model", "Team.cs"),
+    "// existing team\n"
+  );
+}
+
+function mockSuccessfulSpawn() {
+  const spawnMock = childProcess.spawn as unknown as any;
+  spawnMock.mockImplementation(() => {
+    const child = new EventEmitter() as childProcess.ChildProcess;
+    process.nextTick(() => child.emit("close", 0));
+    return child;
+  });
+  return spawnMock;
+}
+
+function createFreshInitProjectFixture(rootDir: string, backendLanguage: "csharp" | "python" = "csharp"): void {
+  writeFile(path.join(rootDir, "package.json"), JSON.stringify({ name: "sample-app" }, null, 2));
+  writeFile(
+    path.join(rootDir, "swallowkit.config.js"),
+    `module.exports = {
+  backend: {
+    language: '${backendLanguage}',
+  },
+  functions: {
+    baseUrl: process.env.BACKEND_FUNCTIONS_BASE_URL || process.env.FUNCTIONS_BASE_URL || 'http://localhost:7071',
+  },
+  deployment: {
+    resourceGroup: process.env.AZURE_RESOURCE_GROUP || '',
+    swaName: process.env.AZURE_SWA_NAME || '',
+  },
+};
+`
+  );
+  writeFile(path.join(rootDir, "shared", "package.json"), JSON.stringify({ name: "@sample-app/shared" }, null, 2));
+  writeFile(path.join(rootDir, "shared", "index.ts"), "export {};\n");
+  fs.mkdirSync(path.join(rootDir, "shared", "models"), { recursive: true });
+  writeFile(path.join(rootDir, "app", "api", "greet", "route.ts"), "export async function GET() { return Response.json({}); }\n");
+  writeFile(path.join(rootDir, "lib", "api", "backend.ts"), "export const api = {};\n");
+  fs.mkdirSync(path.join(rootDir, "functions"), { recursive: true });
+}
+
+async function runMachine(argv: string[]): Promise<{ response: any; exitCode: number }> {
+  const writes: string[] = [];
+  const originalWrite = process.stdout.write.bind(process.stdout);
+  const originalExitCode = process.exitCode;
+
+  (process.stdout.write as unknown as (chunk: string | Uint8Array) => boolean) = ((chunk: string | Uint8Array) => {
+    writes.push(typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf-8"));
+    return true;
+  }) as typeof process.stdout.write;
+
+  process.exitCode = 0;
+
+  try {
+    await runMachineCli(argv);
+    return {
+      response: JSON.parse(writes.join("")),
+      exitCode: process.exitCode || 0,
+    };
+  } finally {
+    process.stdout.write = originalWrite;
+    process.exitCode = originalExitCode;
+  }
+}
+
+describe("machine CLI", () => {
+  const originalCwd = process.cwd();
+  let tempDir: string;
+
+  beforeEach(() => {
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-machine-"));
+    process.chdir(tempDir);
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("inspects SwallowKit project metadata as JSON", async () => {
+    createProjectFixture(tempDir, { includeGeneratedArtifacts: true });
+
+    const { response, exitCode } = await runMachine(["node", "swallowkit", "machine", "inspect", "project"]);
+
+    expect(exitCode).toBe(0);
+    expect(response.ok).toBe(true);
+    expect(response.command).toBe("inspect-project");
+    expect(response.data.manifest.entities[0].name).toBe("Todo");
+    expect(response.data.manifest.routes).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          name: "Todo-bff-list",
+          publicPath: "/api/todo",
+          exists: true,
+        }),
+      ])
+    );
+  });
+
+  it("validates forbidden BFF dependencies", async () => {
+    createProjectFixture(tempDir, {
+      includeGeneratedArtifacts: true,
+      forbiddenBffDependency: true,
+    });
+
+    const { response, exitCode } = await runMachine(["node", "swallowkit", "machine", "validate", "project"]);
+
+    expect(exitCode).toBe(0);
+    expect(response.ok).toBe(true);
+    expect(response.command).toBe("validate-project");
+    expect(response.data.violations).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          code: "forbidden-bff-dependency",
+          severity: "error",
+        }),
+      ])
+    );
+  });
+
+  it("does not report false positives for a fresh C# init project", async () => {
+    createFreshInitProjectFixture(tempDir, "csharp");
+
+    const { response, exitCode } = await runMachine(["node", "swallowkit", "machine", "validate", "project"]);
+
+    expect(exitCode).toBe(0);
+    expect(response.ok).toBe(true);
+    expect(response.command).toBe("validate-project");
+    expect(response.data.manifest.backendLanguage).toBe("csharp");
+    expect(response.data.manifest.configValidation.valid).toBe(true);
+    expect(response.data.violations).toEqual([]);
+  });
+
+  it("generates model templates through the machine interface", async () => {
+    writeFile(path.join(tempDir, "package.json"), JSON.stringify({ name: "sample-app" }, null, 2));
+    writeFile(
+      path.join(tempDir, "swallowkit.config.js"),
+      `module.exports = {
+  backend: { language: 'typescript' },
+  api: { endpoint: '/api/_swallowkit' },
+};
+`
+    );
+    fs.mkdirSync(path.join(tempDir, "node_modules"), { recursive: true });
+    fs.symlinkSync(
+      path.join(repoRoot, "node_modules", "zod"),
+      path.join(tempDir, "node_modules", "zod"),
+      "junction"
+    );
+    writeFile(path.join(tempDir, "shared", "index.ts"), "export {};\n");
+
+    const { response, exitCode } = await runMachine([
+      "node",
+      "swallowkit",
+      "machine",
+      "generate",
+      "model",
+      "Task",
+      "--overwrite",
+      "never",
+    ]);
+
+    expect(exitCode).toBe(0);
+    expect(response.ok).toBe(true);
+    expect(response.command).toBe("generate-model");
+    expect(response.data.createdFiles).toContain("shared/models/task.ts");
+    expect(fs.existsSync(path.join(tempDir, ".swallowkit", "project.json"))).toBe(true);
+  });
+
+  it("generates scaffold artifacts through the machine interface", async () => {
+    createProjectFixture(tempDir);
+
+    const { response, exitCode } = await runMachine([
+      "node",
+      "swallowkit",
+      "machine",
+      "generate",
+      "scaffold",
+      "todo",
+      "--api-only",
+    ]);
+
+    expect(exitCode).toBe(0);
+    expect(response.ok).toBe(true);
+    expect(response.command).toBe("generate-scaffold");
+    expect(response.data.createdFiles).toEqual(
+      expect.arrayContaining([
+        "app/api/todo/route.ts",
+        "app/api/todo/[id]/route.ts",
+        "functions/src/todo.ts",
+        "lib/api/call-function.ts",
+      ])
+    );
+    expect(fs.existsSync(path.join(tempDir, ".swallowkit", "project.json"))).toBe(true);
+  });
+
+  it("preserves C# custom Functions and shared generated assets when api-only scaffolding one model", async () => {
+    createCSharpScaffoldFixture(tempDir);
+    const spawnSyncMock = childProcess.spawnSync as unknown as any;
+    spawnSyncMock.mockReturnValue({ status: 0 });
+    const spawnMock = mockSuccessfulSpawn();
+
+    try {
+      const { response, exitCode } = await runMachine([
+        "node",
+        "swallowkit",
+        "machine",
+        "generate",
+        "scaffold",
+        "estimate",
+        "--api-only",
+      ]);
+
+      expect(exitCode).toBe(0);
+      expect(response.ok).toBe(true);
+      expect(response.command).toBe("generate-scaffold");
+      expect(response.data.createdFiles).toEqual(
+        expect.arrayContaining([
+          "functions/Crud/EstimateCrudFunctions.cs",
+          "app/api/estimate/route.ts",
+          "app/api/estimate/[id]/route.ts",
+        ])
+      );
+      expect(response.data.deletedFiles).toEqual([]);
+      expect(fs.readFileSync(path.join(tempDir, "functions", "Crud", "EstimateFunctions.cs"), "utf-8")).toContain("Approve");
+      expect(fs.existsSync(path.join(tempDir, "functions", "generated", "csharp-models", "README.md"))).toBe(true);
+      expect(fs.existsSync(path.join(tempDir, "functions", "generated", "csharp-models", "SwallowKitBackendModels.csproj"))).toBe(true);
+      expect(fs.existsSync(path.join(tempDir, "functions", "generated", "csharp-models", "SwallowKitBackendModels.sln"))).toBe(true);
+      expect(fs.readFileSync(path.join(tempDir, "functions", "generated", "csharp-models", "src", "SwallowKitBackendModels", "Model", "Member.cs"), "utf-8")).toBe("// existing member\n");
+      expect(fs.readFileSync(path.join(tempDir, "functions", "generated", "csharp-models", "src", "SwallowKitBackendModels", "Model", "Team.cs"), "utf-8")).toBe("// existing team\n");
+      expect(fs.existsSync(path.join(tempDir, "functions", "generated", "csharp-models", "src", "SwallowKitBackendModels", "Model", "Estimate.cs"))).toBe(true);
+    } finally {
+      spawnMock.mockReset();
+      spawnSyncMock.mockReset();
+    }
+  });
+});

package/src/__tests__/mcp.test.ts

@@ -0,0 +1,145 @@
+import { spawn } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+import { buildSwallowKitToolDefinitions } from "../mcp";
+
+type MachineCliRunner = NonNullable<Parameters<typeof buildSwallowKitToolDefinitions>[0]>;
+const builtMcpEntrypoint = path.resolve(__dirname, "..", "..", "dist", "mcp", "index.js");
+const itWhenBuiltEntrypointExists = fs.existsSync(builtMcpEntrypoint) ? it : it.skip;
+
+describe("SwallowKit MCP tool definitions", () => {
+  it("delegates inspect_project to the machine CLI", async () => {
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({
+        ok: true,
+        command: "inspect-project",
+        data: { manifestSource: "file" },
+      }),
+      stderr: "",
+      exitCode: 0,
+    }));
+
+    const tool = buildSwallowKitToolDefinitions(runner as MachineCliRunner).find((candidate) => candidate.name === "swallowkit_inspect_project");
+    expect(tool).toBeDefined();
+
+    const result = await tool!.handler({});
+    expect(runner).toHaveBeenCalledWith(["inspect", "project"]);
+    expect(JSON.parse(result.content[0].text)).toEqual({
+      manifestSource: "file",
+      metadata: { swallowkitVersion: expect.stringMatching(/^\d+\.\d+\.\d+/) },
+    });
+  });
+
+  it("includes the MCP version in validate_project metadata", async () => {
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({ ok: true, command: "validate-project", data: { valid: true } }),
+      stderr: "",
+      exitCode: 0,
+    }));
+    const tool = buildSwallowKitToolDefinitions(runner as MachineCliRunner).find(
+      (candidate) => candidate.name === "swallowkit_validate_project"
+    );
+
+    const result = await tool!.handler({});
+    expect(JSON.parse(result.content[0].text)).toEqual({
+      valid: true,
+      metadata: { swallowkitVersion: expect.stringMatching(/^\d+\.\d+\.\d+/) },
+    });
+  });
+
+  it("delegates scaffold_model with explicit args", async () => {
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({
+        ok: true,
+        command: "generate-scaffold",
+        data: { createdFiles: ["functions/src/todo.ts"] },
+      }),
+      stderr: "",
+      exitCode: 0,
+    }));
+
+    const tool = buildSwallowKitToolDefinitions(runner as MachineCliRunner).find((candidate) => candidate.name === "swallowkit_scaffold_model");
+    expect(tool).toBeDefined();
+
+    const result = await tool!.handler({
+      model: "todo",
+      functionsDir: "functions",
+      apiDir: "app/api",
+      apiOnly: true,
+    });
+
+    expect(runner).toHaveBeenCalledWith([
+      "generate",
+      "scaffold",
+      "todo",
+      "--functions-dir",
+      "functions",
+      "--api-dir",
+      "app/api",
+      "--api-only",
+    ]);
+    expect(JSON.parse(result.content[0].text)).toEqual({ createdFiles: ["functions/src/todo.ts"] });
+  });
+
+  itWhenBuiltEntrypointExists("keeps the built MCP entrypoint alive long enough to complete the handshake", async () => {
+    await new Promise<void>((resolve, reject) => {
+      const child = spawn(process.execPath, [builtMcpEntrypoint], {
+        cwd: path.resolve(__dirname, "..", ".."),
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+      let settled = false;
+      let expectedShutdown = false;
+      let stderr = "";
+
+      const finishResolve = () => {
+        if (!settled) {
+          settled = true;
+          resolve();
+        }
+      };
+
+      const finishReject = (error: Error) => {
+        if (!settled) {
+          settled = true;
+          reject(error);
+        }
+      };
+
+      const timer = setTimeout(() => {
+        expectedShutdown = true;
+        child.kill();
+      }, 1000);
+
+      child.stderr.on("data", (chunk) => {
+        stderr += chunk.toString();
+      });
+
+      child.on("error", (error) => {
+        clearTimeout(timer);
+        finishReject(error);
+      });
+
+      child.on("close", (code, signal) => {
+        clearTimeout(timer);
+
+        if (expectedShutdown) {
+          expect(stderr).toMatch(/\[swallowkit-mcp\] version: \d+\.\d+\.\d+/);
+          finishResolve();
+          return;
+        }
+
+        finishReject(
+          new Error(
+            `Built MCP entrypoint exited early with code ${code ?? "null"} and signal ${signal ?? "null"}${stderr ? `: ${stderr}` : ""}`
+          )
+        );
+      });
+    });
+  });
+
+  itWhenBuiltEntrypointExists("preserves a runtime dynamic execa import in the built MCP entrypoint", () => {
+    const source = fs.readFileSync(builtMcpEntrypoint, "utf8");
+    expect(source).toContain('new Function("specifier", "return import(specifier);")');
+    expect(source).not.toContain('require("execa")');
+  });
+});

package/src/__tests__/model-parser.test.ts

@@ -0,0 +1,52 @@
+import * as fs from "fs";
+import * as path from "path";
+import { parseModelFile } from "../core/scaffold/model-parser";
+
+describe("parseModelFile", () => {
+  it("preserves array and enum metadata for schemas with defaults", async () => {
+    const tempDir = fs.mkdtempSync(path.join(process.cwd(), ".tmp-model-parser-"));
+    const modelPath = path.join(tempDir, "product.ts");
+
+    try {
+      fs.writeFileSync(
+        modelPath,
+        `import { z } from 'zod/v4';
+
+export const Product = z.object({
+  id: z.string(),
+  name: z.string().min(1),
+  price: z.number().min(0),
+  tags: z.array(z.string()).default([]),
+  status: z.enum(['draft', 'active', 'archived']).default('draft'),
+  createdAt: z.string().optional(),
+  updatedAt: z.string().optional(),
+});
+
+export type Product = z.infer<typeof Product>;
+`,
+        "utf-8"
+      );
+
+      const model = await parseModelFile(modelPath);
+      expect(model.fields).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            name: "tags",
+            type: "string",
+            isArray: true,
+            isOptional: true,
+          }),
+          expect.objectContaining({
+            name: "status",
+            type: "string",
+            isArray: false,
+            isOptional: true,
+            enumValues: ["draft", "active", "archived"],
+          }),
+        ])
+      );
+    } finally {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+});

package/src/__tests__/multi-auth.test.ts

@@ -0,0 +1,133 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { addAuthCommand } from "../cli/commands/add-auth";
+import {
+  generateBFFCallFunctionWithMultipleAuth,
+  generateNamedAuthRouterCSharp,
+  generateNamedAuthRouterPython,
+  generateNamedAuthRouterTS,
+} from "../core/scaffold/auth-generator";
+import { normalizeAuthConfig } from "../core/config";
+import { parseAuthPolicy } from "../core/scaffold/model-parser";
+import { createBasicModelInfo } from "./fixtures";
+import { generateCSharpAzureFunctionsCRUD, generateCompactAzureFunctionsCRUD, generatePythonAzureFunctionsCRUD } from "../core/scaffold/functions-generator";
+
+const auth = normalizeAuthConfig({
+  schemes: {
+    admin: { provider: "swa" },
+    lineUser: { provider: "external-token" },
+  },
+  authorization: {
+    defaultPolicy: "anonymous",
+    policies: {
+      adminOnly: { schemes: ["admin"], roles: ["authenticated"] },
+      lineUserOnly: { schemes: ["lineUser"], roles: ["authenticated"] },
+    },
+  },
+})!;
+
+describe("named authentication routers", () => {
+  it("generates deterministic TypeScript policy routing and normalized principals", () => {
+    const code = generateNamedAuthRouterTS(auth);
+    expect(code).toContain("policy.schemes.filter");
+    expect(code).toContain("candidates.length !== 1");
+    expect(code).toContain("subject: value.userId");
+    expect(code).toContain("scheme + ':' + principal.subject");
+    expect(code).toContain("new AuthError(403");
+    expect(code).toContain("new AuthError(503");
+    expect(code).not.toContain("JWT_SECRET");
+  });
+
+  it("generates equivalent C# and Python named guards", () => {
+    const csharp = generateNamedAuthRouterCSharp(auth);
+    const python = generateNamedAuthRouterPython(auth);
+    expect(csharp).toContain("record AuthPrincipal(string Subject, string Scheme, string Issuer");
+    expect(csharp).toContain("candidates.Length != 1");
+    expect(csharp).toContain("HttpStatusCode.Forbidden");
+    expect(python).toContain('principal["scheme"] + ":" + principal["subject"]');
+    expect(python).toContain("len(candidates) != 1");
+    expect(python).toContain("AuthError(503");
+  });
+
+  it("generates valid branch structure for an SWA-only Python router", () => {
+    const swaOnly = normalizeAuthConfig({ schemes: { admin: { provider: "swa", swa: { allowedProviders: ["github"] } } }, authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] } } } })!;
+    const python = generateNamedAuthRouterPython(swaOnly);
+    expect(python).toContain('        if PROVIDERS[scheme] == "swa":');
+    expect(python).not.toContain('        elif PROVIDERS[scheme] == "swa":');
+    expect(python).toContain("ALLOWED_PROVIDERS");
+    expect(generateNamedAuthRouterCSharp(swaOnly)).toContain("AllowedProviders[scheme]");
+  });
+
+  it("scaffolds named read/write guards for all Functions languages", () => {
+    const policy = { read: "adminOnly", write: "lineUserOnly" };
+    const model = createBasicModelInfo();
+    const ts = generateCompactAzureFunctionsCRUD(model, "@fixture/shared", policy);
+    const cs = generateCSharpAzureFunctionsCRUD(model, policy);
+    const py = generatePythonAzureFunctionsCRUD(model, policy).blueprint;
+    expect(ts).toContain("./auth/auth-router");
+    expect(ts).toContain('requireAuth(request, "adminOnly")');
+    expect(ts).toContain('requireAuth(request, "lineUserOnly")');
+    expect(cs).toContain('AuthRouter.Authorize(request, "adminOnly")');
+    expect(cs).toContain('AuthRouter.Authorize(request, "lineUserOnly")');
+    expect(py).toContain("from auth.auth_router import");
+    expect(py).toContain('require_auth(req, "adminOnly")');
+    expect(py).toContain('require_auth(req, "lineUserOnly")');
+  });
+
+  it("forwards both credential sources and the Functions host key", () => {
+    const code = generateBFFCallFunctionWithMultipleAuth();
+    expect(code).toContain("fetchHeaders['Authorization']");
+    expect(code).toContain("fetchHeaders['x-ms-client-principal']");
+    expect(code).toContain("'x-functions-key'");
+    expect(code).not.toMatch(/console\.log\([^\n]*(authorization|principal|cookie)/i);
+  });
+
+  it("parses model-wide and operation-specific named policies", () => {
+    expect(parseAuthPolicy("export const authPolicy = { policy: 'adminOnly' };"))
+      .toEqual({ policy: "adminOnly" });
+    expect(parseAuthPolicy("export const authPolicy = { read: 'adminOnly', write: 'lineUserOnly' };"))
+      .toEqual({ read: "adminOnly", write: "lineUserOnly" });
+  });
+});
+
+describe("add-auth named scheme CLI", () => {
+  const originalCwd = process.cwd();
+  let root: string;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-multi-auth-"));
+    fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({ name: "fixture" }));
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "typescript" }, auth: { schemes: {}, authorization: { defaultPolicy: "anonymous", policies: {} } } }, null, 2));
+    process.chdir(root);
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it("adds two schemes without overwriting the first verifier", async () => {
+    await addAuthCommand({ scheme: "admin", provider: "swa" });
+    await addAuthCommand({ scheme: "lineUser", provider: "external-token" });
+    const verifier = path.join(root, "functions", "src", "auth", "schemes", "line-user", "verifier.ts");
+    fs.writeFileSync(verifier, "// user verifier\n", "utf-8");
+    const config = JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8"));
+    expect(config.auth.schemes.admin.provider).toBe("swa");
+    expect(config.auth.schemes.lineUser.provider).toBe("external-token");
+    await expect(addAuthCommand({ scheme: "lineUser", provider: "external-token" })).rejects.toThrow("already exists");
+    expect(fs.readFileSync(verifier, "utf-8")).toBe("// user verifier\n");
+    expect(fs.readFileSync(path.join(root, "lib", "api", "call-function.ts"), "utf-8")).toContain("x-functions-key");
+  });
+
+  it("updates a JavaScript config that already has a trailing comma", async () => {
+    fs.rmSync(path.join(root, "swallowkit.config.json"));
+    fs.writeFileSync(path.join(root, "swallowkit.config.js"), "module.exports = {\n  backend: { language: 'typescript' },\n  api: { endpoint: '/api/test' },\n};\n");
+    await addAuthCommand({ scheme: "admin", provider: "swa" });
+    const content = fs.readFileSync(path.join(root, "swallowkit.config.js"), "utf-8");
+    expect(content).not.toContain(",,");
+    const configModule = { exports: {} as Record<string, unknown> };
+    new Function("module", content)(configModule);
+    expect((configModule.exports as { auth: { schemes: { admin: { provider: string } } } }).auth.schemes.admin.provider).toBe("swa");
+  });
+});