swallowkit 1.0.0-beta.58 → 1.0.0-beta.59

package/src/core/project/agent-templates/AGENTS.md

@@ -67,8 +67,14 @@ Use only the inspections relevant to the task. Typical inspections include:
 {{runCmd}} swallowkit machine inspect boundaries
 {{runCmd}} swallowkit machine inspect drift
 {{runCmd}} swallowkit machine inspect infra
+{{runCmd}} swallowkit machine inspect capabilities
 ```
 
+`inspect capabilities` answers "what can SwallowKit do" (supported model
+declarations with exact formats, the correct auth-introduction workflow, what
+generated CRUD does and does not guarantee, how seeds are applied). Use it
+instead of guessing or grepping SwallowKit internals.
+
 Use the equivalent `swallowkit_*` MCP tools when available.
 
 Questions that can be answered from the repository or SwallowKit inspection
@@ -236,6 +242,16 @@ Otherwise read and follow the equivalent runbook under
 
 Never repair schema drift by directly patching SwallowKit-managed artifacts.
 
+Additional model-change facts:
+
+- The shared package is consumed through its built `dist/`. `verify project`
+  rebuilds it automatically before typecheck; when typechecking manually,
+  build the shared package first (stale `dist/` shows up as
+  "no exported member" errors).
+- Seed JSON under `dev-seeds/` is only applied by
+  `{{runCmd}} swallowkit dev --seed-env <environment>`; editing the files
+  alone does nothing.
+
 ## New Models / CRUD Features
 
 Use the `swallowkit-add-model` Agent Skill when available.
@@ -247,6 +263,43 @@ SwallowKit should generate framework-owned CRUD artifacts.
 
 Do not manually recreate boilerplate that SwallowKit owns.
 
+## Authentication
+
+Authentication is a **plan/apply operation**, not a free-form config edit.
+Ownership of `swallowkit.config` is split:
+
+- `auth.schemes` — owned by SwallowKit. **Always start with
+  `{{runCmd}} swallowkit machine plan auth --provider <p> [--scheme <name>]`.
+  Never hand-write `auth.schemes` entries**; apply auth appends them, and a
+  hand-written scheme makes the plan fail with "already exists".
+- `auth.authorization.policies` and `swa.allowedProviders` — hand-edited
+  **after** apply (the config is an extension point; this edit is expected).
+  `swa.allowedProviders` can also be set at plan time with
+  `--allowed-providers github,aad`.
+
+After `apply auth`, follow the returned `nextActions`:
+
+1. Define `auth.authorization.policies` referencing the new scheme.
+2. For `swa`: confirm `swa.allowedProviders`; generated login URLs use it.
+3. For `external-token`: implement the generated verifier stub. It fails
+   closed, and **verify passes with the stub in place** — a green verify does
+   not mean external-token auth works end-to-end (`verify project` surfaces a
+   `auth-verifier-stub` warning while the stub is unmodified).
+4. Re-run plan/apply scaffold for models that need auth guards, then verify.
+
+Use the `swallowkit-add-auth` Agent Skill or the
+`.swallowkit/workflows/add-auth.md` runbook when available.
+
+### Generated CRUD scope
+
+Generated CRUD endpoints enforce the model's `authPolicy`
+(authentication + roles) — **they do NOT scope data to the authenticated
+user**. Any caller passing the policy can read or write any document. For
+multi-user data where users may only touch their own records, add ai-authored
+custom endpoints that derive the scoping key (e.g. `learnerId`) from the
+verified principal — never from the request body — and restrict the generated
+write endpoints to admin roles.
+
 ## Verification Is a Completion Gate
 
 Before treating an agent-driven implementation as complete, run SwallowKit
@@ -318,6 +371,7 @@ Current workflows include:
 
 - `swallowkit-add-model`
 - `swallowkit-modify-model`
+- `swallowkit-add-auth`
 - `swallowkit-verify-repair`
 - `swallowkit-provision`
 
@@ -400,9 +454,15 @@ same generated structure.
 - The Zod schema constant and inferred TypeScript type use the same PascalCase
   name: `export const Todo = z.object(...); export type Todo = z.infer<typeof Todo>`.
 - Re-export models from `shared/index.ts`.
-- Mark backend-managed fields as optional in source-of-truth schemas.
+- `id` is a required `z.string()`; only `createdAt` / `updatedAt` are optional
+  backend-managed fields.
+- Models may declare `partitionKey`, `authPolicy`, `displayName`, and
+  `connectorConfig` as exported constants. Exact formats:
+  `{{runCmd}} swallowkit machine inspect capabilities` (modelDeclarations).
 - Cosmos DB containers use PascalCase plural names and default to `/id` as the
-  partition key unless the model declares another key.
+  partition key unless the model declares another key, e.g.
+  `export const partitionKey = '/learnerId';` (the field must exist in the
+  schema).
 
 ## Everyday Commands
 

package/src/core/project/agent-templates/CLAUDE.md

@@ -17,6 +17,9 @@ Always-on rules:
 - Fall back to `{{runCmd}} swallowkit machine ...` when MCP is unavailable.
 - Inspect responsibility boundaries before editing framework-related files.
 - Never hand-edit deterministic SwallowKit-managed artifacts.
+- Add auth schemes only via plan/apply auth; never hand-write `auth.schemes`
+  in swallowkit.config (policies and `swa.allowedProviders` are hand-edited
+  after apply).
 - Use plan/apply for deterministic generation.
 - Respect all `requires-human` states and provisioning approval gates.
 - Run SwallowKit verification before considering implementation complete.

package/src/core/project/agent-templates/copilot-instructions.md

@@ -16,6 +16,9 @@ Key rules:
 - Otherwise use `{{runCmd}} swallowkit machine ...`.
 - Inspect responsibility boundaries before editing framework-related files.
 - Never hand-edit deterministic SwallowKit-managed artifacts.
+- Add auth schemes only via plan/apply auth; never hand-write `auth.schemes`
+  in swallowkit.config (policies and `swa.allowedProviders` are hand-edited
+  after apply).
 - Use plan/apply for deterministic generation.
 - Respect `requires-human` states and other human approval gates.
 - Run SwallowKit verification before completion.

package/src/core/project/agent-templates/shared-models.instructions.md

@@ -13,15 +13,52 @@ source-of-truth models, subject to the current result of
 - Define Zod schemas using `zod/v4` (`import { z } from 'zod/v4'`).
 - Use the Zod pattern where the schema constant and inferred TypeScript type
   share the same name.
-- Include `id`, `createdAt`, and `updatedAt` as optional string fields. The
-  backend manages their values.
+- `id` is a **required** string field: `id: z.string()`. Generated CRUD, UI,
+  and repositories assume `id` is always present — do NOT make it optional.
+- `createdAt` and `updatedAt` are **optional** string fields
+  (`z.string().optional()`). The backend manages their values.
 - Export a `displayName` string for UI display.
 - Re-export every model from `shared/index.ts`, outside managed markers where
   applicable.
 - For relationships, use nested schemas rather than duplicating model shapes.
 
+## Optional model declarations (exact formats)
+
+These are the only declarations SwallowKit parses from a model file:
+
+```ts
+// Cosmos DB partition key (default '/id'). Must reference a schema field.
+export const partitionKey = '/learnerId';
+
+// Role-based access control on generated CRUD.
+export const authPolicy = { roles: ['admin'] };
+// or: { read: ['user'], write: ['admin'] } or: { policy: 'adminOnly' }
+
+// Human-readable name for generated UI.
+export const displayName = 'Learner';
+
+// Bind the model to a configured external connector instead of Cosmos DB.
+export const connectorConfig = {
+  connector: 'mysql',
+  table: 'learners',
+  operations: ['list', 'get', 'create', 'update', 'delete'],
+};
+```
+
+The full machine-readable contract:
+`{{runCmd}} swallowkit machine inspect capabilities`
+
 After changing a model, do not manually patch generated artifacts.
 
+## After changing a model
+
+- The shared package is consumed via its built `dist/`. `verify project`
+  rebuilds it automatically, but if you typecheck manually, build the shared
+  package first — "no exported member" errors usually mean a stale `dist/`.
+- If `dev-seeds/` exists, update the seed JSON. Seeds are only applied by
+  running `{{runCmd}} swallowkit dev --seed-env <environment>`; editing the
+  JSON alone does nothing.
+
 Use the `swallowkit-modify-model` Agent Skill when available. Otherwise follow
 `.swallowkit/workflows/modify-model.md`.
 

package/src/core/project/capabilities.ts

@@ -0,0 +1,193 @@
+/**
+ * Capabilities — 「SwallowKit に何ができるか」の機械可読な自己記述。
+ *
+ * inspect project/boundaries/infra が「今の状態」を返すのに対し、
+ * inspect capabilities は「モデルで宣言できるもの・認証の正しい導入手順・
+ * 生成 CRUD の守備範囲・シード適用方法」など、状態に依存しない
+ * フレームワーク仕様を返す。Coding Agent がドキュメント外の知識を
+ * 推測で埋めるのを構造的に防ぐことが目的。
+ */
+
+import { getSwallowKitVersion } from "../../version";
+
+export interface CapabilityModelDeclaration {
+  name: string;
+  required: boolean;
+  description: string;
+  format: string;
+  notes?: string[];
+}
+
+export interface CapabilityAuthProvider {
+  provider: string;
+  description: string;
+  postApplySteps: string[];
+}
+
+export interface CapabilitiesContract {
+  contractVersion: number;
+  swallowkitVersion: string;
+  modelDeclarations: CapabilityModelDeclaration[];
+  authentication: {
+    correctWorkflow: string[];
+    rules: string[];
+    providers: CapabilityAuthProvider[];
+    authorizationPolicies: {
+      semantics: string;
+      configExample: string;
+      handEditAllowed: boolean;
+    };
+  };
+  generatedCrud: {
+    guarantees: string[];
+    notGuaranteed: string[];
+    guidance: string[];
+  };
+  sharedModels: {
+    idFieldRule: string;
+    buildNote: string;
+  };
+  seeding: {
+    createTemplates: string;
+    applySeeds: string;
+    notes: string[];
+  };
+  machineCommands: string[];
+  verifyChecks: {
+    defaultChecks: string[];
+    optInChecks: string[];
+    customChecks: string;
+  };
+}
+
+export function inspectCapabilities(): CapabilitiesContract {
+  return {
+    contractVersion: 1,
+    swallowkitVersion: getSwallowKitVersion(),
+    modelDeclarations: [
+      {
+        name: "schema",
+        required: true,
+        description:
+          "Zod object schema; the schema constant and the inferred type share the same PascalCase name. `id` MUST be a required string — generated CRUD, UI, and repositories assume it is always present. Only `createdAt` / `updatedAt` are optional (backend-managed).",
+        format:
+          "export const Todo = z.object({ id: z.string(), title: z.string().min(1), createdAt: z.string().optional(), updatedAt: z.string().optional() });\nexport type Todo = z.infer<typeof Todo>;",
+      },
+      {
+        name: "displayName",
+        required: false,
+        description: "Human-readable name used by generated UI. Defaults to the model name.",
+        format: "export const displayName = 'Todo';",
+      },
+      {
+        name: "partitionKey",
+        required: false,
+        description:
+          "Cosmos DB partition key path for the generated container. Must start with '/' and reference a field that exists in the schema. Defaults to '/id'.",
+        format: "export const partitionKey = '/learnerId';",
+        notes: ["The referenced field (e.g. learnerId) must be declared in the Zod schema."],
+      },
+      {
+        name: "authPolicy",
+        required: false,
+        description:
+          "Role-based access control metadata applied to the generated CRUD Functions. `roles` guards all operations; `read`/`write` guard per-operation; `policy` references a named authorization policy from swallowkit.config auth.authorization.policies.",
+        format:
+          "export const authPolicy = { roles: ['admin'] };\n// or per-operation:\nexport const authPolicy = { read: ['user'], write: ['admin'] };\n// or a named policy:\nexport const authPolicy = { policy: 'adminOnly' };",
+      },
+      {
+        name: "connectorConfig",
+        required: false,
+        description:
+          "Binds the model to a configured external connector (RDB / API) instead of Cosmos DB. The connector must exist in swallowkit.config connectors.",
+        format:
+          "export const connectorConfig = {\n  connector: 'mysql',\n  table: 'todos',\n  operations: ['list', 'get', 'create', 'update', 'delete'],\n};",
+      },
+    ],
+    authentication: {
+      correctWorkflow: [
+        "1. plan auth --provider <custom-jwt|swa|external-token> [--scheme <name>] [--allowed-providers <csv>] — computes the change plan; SwallowKit writes auth.schemes into swallowkit.config for you.",
+        "2. apply auth --plan <planId> — generates auth code and appends the scheme to swallowkit.config.",
+        "3. Hand-edit swallowkit.config auth.authorization.policies to define named policies (the config is an extension point; this edit is expected).",
+        "4. For swa schemes: set swa.allowedProviders via --allowed-providers at plan time, or hand-edit it in the config after apply.",
+        "5. For external-token schemes: implement the generated verifier stub — it fails closed (throws) until implemented.",
+        "6. Re-run plan/apply scaffold for models that need auth guards, then verify project.",
+      ],
+      rules: [
+        "NEVER hand-write auth.schemes entries in swallowkit.config — plan/apply auth owns them and duplicate names abort with 'already exists'.",
+        "authorization.policies and swa.allowedProviders ARE hand-edited after apply (extension-point edits).",
+        "Verifier stubs pass typecheck and verify; a passing verify does NOT mean external-token auth works end-to-end.",
+      ],
+      providers: [
+        {
+          provider: "custom-jwt",
+          description: "Login/logout/me endpoints backed by an RDB user table, bcrypt password check, HS256 JWT.",
+          postApplySteps: ["Set JWT_SECRET in functions/local.settings.json.", "Ensure the user table matches auth.customJwt config."],
+        },
+        {
+          provider: "swa",
+          description: "Azure Static Web Apps built-in auth (EasyAuth). Principal arrives via x-ms-client-principal.",
+          postApplySteps: [
+            "Set swa.allowedProviders (e.g. ['github']) via --allowed-providers or by hand-editing the config; generated login URLs use the first entry.",
+          ],
+        },
+        {
+          provider: "external-token",
+          description: "Bearer tokens issued by an external IdP (LINE, Auth0, ...). SwallowKit generates a fail-closed verifier stub.",
+          postApplySteps: [
+            "Implement the generated verifier (extension point / generated-once; edit freely).",
+            "Implement the frontend token adapter (lib/auth/**/token-adapter.ts).",
+          ],
+        },
+        {
+          provider: "none",
+          description: "Disables authentication in the config.",
+          postApplySteps: [],
+        },
+      ],
+      authorizationPolicies: {
+        semantics:
+          "A named policy lists which schemes may satisfy it and which roles are required. Generated guards call requireAuth(request, policyName). Exactly one scheme must match the presented credentials.",
+        configExample:
+          "auth: {\n  schemes: { admin: { provider: 'swa', swa: { allowedProviders: ['github'] } }, api: { provider: 'external-token' } },\n  authorization: {\n    defaultPolicy: 'anonymous',\n    policies: {\n      adminOnly: { schemes: ['admin'], roles: ['administrator'] },\n      learner: { schemes: ['api'] },\n    },\n  },\n}",
+        handEditAllowed: true,
+      },
+    },
+    generatedCrud: {
+      guarantees: [
+        "Generated CRUD endpoints enforce the model's authPolicy (authentication + role checks).",
+        "Zod validation runs before persistence.",
+      ],
+      notGuaranteed: [
+        "Owner scoping: generated CRUD does NOT restrict rows to the authenticated principal. Any authenticated caller passing the policy can read/write any document.",
+      ],
+      guidance: [
+        "For multi-user data where users may only touch their own records, add ai-authored custom endpoints that derive the scoping key (e.g. learnerId) from the verified principal — never from the request body — and restrict generated write endpoints to admin roles or disable them.",
+      ],
+    },
+    sharedModels: {
+      idFieldRule: "id: z.string() (required). createdAt/updatedAt: z.string().optional(). The backend owns their values.",
+      buildNote:
+        "verify typecheck resolves the shared package from its built dist/. SwallowKit rebuilds shared automatically during verify; when typechecking manually, build the shared package first (errors like \"no exported member\" usually mean a stale dist).",
+    },
+    seeding: {
+      createTemplates: "swallowkit create-dev-seeds <environment> — writes dev-seeds/<environment>/<model>.json templates.",
+      applySeeds: "swallowkit dev --seed-env <environment> — applies the seed JSON to the local Cosmos DB emulator at dev startup.",
+      notes: ["Editing dev-seeds/*.json alone does nothing; seeds are only applied via dev --seed-env."],
+    },
+    machineCommands: [
+      "inspect project | entities | routes | artifacts | boundaries | infra | drift | capabilities",
+      "validate project",
+      "generate model <names...> | generate scaffold <model>",
+      "plan scaffold <models...> | plan auth --provider <p> [--scheme <name>] [--allowed-providers <csv>] | plan provision -g <rg> --location <loc> --swa-location <loc>",
+      "apply scaffold [models...] --plan <id> [--approve] | apply auth --plan <id> [--approve] | apply provision --plan <id> --approve",
+      "verify project [--checks <ids>] [--compact]",
+      "explain failure [--check <id>]",
+    ],
+    verifyChecks: {
+      defaultChecks: ["structure", "drift", "typecheck"],
+      optInChecks: ["build", "lint", "test"],
+      customChecks: "swallowkit.config verify.checks: [{ id, command, title?, timeoutMs? }]",
+    },
+  };
+}

package/src/core/project/validation.ts

@@ -192,6 +192,55 @@ function walkFiles(directory: string, extensions: string[]): string[] {
   return collected;
 }
 
+const VERIFIER_STUB_MARKER = /External token verifier(?: for \S+)? is not configured/;
+
+/**
+ * external-token スキームの verifier が生成スタブのまま (fail-closed throw のみ) だと
+ * typecheck / verify は通るのに実行時は必ず 401/503 になる。
+ * 「認証は生成されたが動かない」状態を warning として可視化する。
+ */
+function validateExternalTokenVerifierStubs(projectRoot: string, manifest: ProjectManifest, violations: ProjectViolation[]): void {
+  const auth = manifest.auth;
+  const hasExternalToken =
+    auth?.provider === "external-token" ||
+    Object.values(auth?.schemes ?? {}).some((scheme) => scheme.provider === "external-token");
+  if (!hasExternalToken) return;
+
+  const candidates: string[] = [
+    path.join("functions", "src", "auth", "external-token-verifier.ts"),
+    path.join("functions", "Auth", "ExternalTokenVerifier.cs"),
+    path.join("functions", "auth", "external_token_verifier.py"),
+  ];
+  const schemeDirs = [
+    { root: path.join("functions", "src", "auth", "schemes"), file: "verifier.ts" },
+    { root: path.join("functions", "Auth", "Schemes"), file: "ExternalTokenVerifier.cs" },
+    { root: path.join("functions", "auth", "schemes"), file: "verifier.py" },
+  ];
+  for (const { root, file } of schemeDirs) {
+    const absoluteRoot = path.join(projectRoot, root);
+    if (!fs.existsSync(absoluteRoot)) continue;
+    for (const entry of fs.readdirSync(absoluteRoot, { withFileTypes: true })) {
+      if (entry.isDirectory()) candidates.push(path.join(root, entry.name, file));
+    }
+  }
+
+  for (const relativePath of candidates) {
+    const absolutePath = path.join(projectRoot, relativePath);
+    if (!fs.existsSync(absolutePath)) continue;
+    const content = fs.readFileSync(absolutePath, "utf-8");
+    if (VERIFIER_STUB_MARKER.test(content)) {
+      pushViolation(violations, {
+        code: "auth-verifier-stub",
+        severity: "warning",
+        message:
+          "External token verifier is still the generated stub; it fails closed, so external-token authentication cannot succeed at runtime.",
+        location: { path: relativePath.replace(/\\/g, "/") },
+        suggestedFix: "Implement the verifier against your identity provider. The file is yours to edit (generated-once).",
+      });
+    }
+  }
+}
+
 export async function validateProject(projectRoot: string = process.cwd()): Promise<ProjectValidationResult> {
   const loaded = await loadProjectManifest(projectRoot);
   const rebuilt = await buildProjectManifest(projectRoot);
@@ -231,6 +280,7 @@ export async function validateProject(projectRoot: string = process.cwd()): Prom
 
   validateGeneratedArtifacts(loaded.manifest, violations);
   validateLayeringViolations(projectRoot, violations);
+  validateExternalTokenVerifierStubs(projectRoot, loaded.manifest, violations);
 
   if (loaded.source === "file") {
     validateManifestDrift(projectRoot, loaded.manifest, rebuilt.manifest, violations);

package/src/core/project/workflows.ts

@@ -60,7 +60,9 @@ Goal: add a data model and derive CRUD/BFF/UI/infra deterministically.
 5. Verify:
    \`${runCmd} swallowkit machine verify project\`
    - \`summary.done: false\` → \`${runCmd} swallowkit machine explain failure\` and repair, then re-verify.
-6. If \`dev-seeds/\` exists, update seed JSON for the new model.
+6. If \`dev-seeds/\` exists, update seed JSON for the new model. Seeds are only
+   applied by \`${runCmd} swallowkit dev --seed-env <environment>\` — editing the
+   JSON alone does nothing.
 
 ## Terminal states
 
@@ -103,6 +105,49 @@ and regenerate. Hand-edits are detected as drift and block unattended overwrites
 `,
   };
 
+  const addAuth: WorkflowDoc = {
+    fileName: "add-auth.md",
+    title: "Add authentication (plan/apply with config ownership rules)",
+    skillName: "swallowkit-add-auth",
+    skillDescription:
+      "Add authentication (custom-jwt, Azure Static Web Apps built-in, or external-token) to a SwallowKit project via plan/apply auth, including the config ownership rules (never hand-write auth.schemes; hand-edit policies and allowedProviders after apply) and post-apply steps. Use when asked to add login, authentication, authorization, roles, or a named auth scheme.",
+    content: `# Workflow: Add authentication
+
+Goal: introduce an auth scheme deterministically and finish the manual follow-ups.
+
+## Config ownership (critical)
+
+- \`auth.schemes\` is **owned by plan/apply auth. Never hand-write scheme entries** —
+  a pre-written scheme makes planning fail with \`already exists\`.
+- \`auth.authorization.policies\` and \`swa.allowedProviders\` are **hand-edited after
+  apply** (the config is an extension point; this is the expected workflow).
+
+## Steps
+
+1. Check what already exists: \`${runCmd} swallowkit machine inspect capabilities\`
+   (authentication section) and the current \`auth\` block in swallowkit.config.
+2. Plan (writes nothing):
+   \`${runCmd} swallowkit machine plan auth --provider <custom-jwt|swa|external-token> [--scheme <name>] [--allowed-providers github,aad]\`
+3. Apply:
+   \`${runCmd} swallowkit machine apply auth --plan <planId>\`
+4. Follow the returned \`nextActions\`:
+   - Define \`auth.authorization.policies\` referencing the scheme (hand-edit).
+   - swa: confirm \`swa.allowedProviders\` — generated login URLs use the first entry.
+   - external-token: implement the generated verifier stub. It fails closed and
+     **verify passes with the stub**, so a green verify does not mean the auth
+     flow works (a \`auth-verifier-stub\` warning is surfaced while unmodified).
+5. Add \`authPolicy\` to models that need guards, then re-run plan/apply scaffold
+   for them.
+6. Verify: \`${runCmd} swallowkit machine verify project\`
+
+## Scope guardrail
+
+Generated CRUD enforces authentication and roles but does **not** scope rows to
+the caller. Owner-scoped behavior belongs in ai-authored endpoints that derive
+the scoping key from the verified principal, never from the request body.
+`,
+  };
+
   const verifyRepair: WorkflowDoc = {
     fileName: "verify-and-repair.md",
     title: "Verify and repair loop",
@@ -190,6 +235,7 @@ under \`.github/skills/\` so skills-aware agents load them automatically.
 |----------|------|-------|
 | Add a new model | [add-model.md](./add-model.md) | \`swallowkit-add-model\` |
 | Modify an existing model | [modify-model.md](./modify-model.md) | \`swallowkit-modify-model\` |
+| Add authentication | [add-auth.md](./add-auth.md) | \`swallowkit-add-auth\` |
 | Verify and repair | [verify-and-repair.md](./verify-and-repair.md) | \`swallowkit-verify-repair\` |
 | Provision Azure resources | [provision.md](./provision.md) | \`swallowkit-provision\` |
 
@@ -203,7 +249,7 @@ Full machine-readable contract: \`${runCmd} swallowkit machine inspect boundarie
 `,
   };
 
-  return [index, addModel, modifyModel, verifyRepair, provision];
+  return [index, addModel, modifyModel, addAuth, verifyRepair, provision];
 }
 
 export const WORKFLOWS_DIR = path.join(".swallowkit", "workflows");

package/src/core/scaffold/auth-generator.ts

@@ -61,6 +61,11 @@ function safeIdentifier(name: string): string {
   return name.replace(/[^A-Za-z0-9_]/g, "_");
 }
 
+/** C# の string[] リテラル。空のときは型推論不能な `new[] { }` (CS0826) を避けて Array.Empty<string>() を出力する。 */
+function csharpStringArray(items: string[]): string {
+  return items.length > 0 ? `new[] { ${items.map((item) => `"${item}"`).join(", ")} }` : "Array.Empty<string>()";
+}
+
 function schemeSlug(name: string): string {
   return name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").toLowerCase();
 }
@@ -123,10 +128,10 @@ public static class AuthRouter
 {
     private static readonly Dictionary<string, (string[] Schemes, string[] Roles)> Policies = new()
     {
-${Object.entries(config.authorization.policies).map(([n,p]) => `        ["${n}"] = (new[] { ${p.schemes.map(s=>`"${s}"`).join(", ")} }, new[] { ${(p.roles??[]).map(r=>`"${r}"`).join(", ")} }),`).join("\n")}
+${Object.entries(config.authorization.policies).map(([n,p]) => `        ["${n}"] = (${csharpStringArray(p.schemes)}, ${csharpStringArray(p.roles??[])}),`).join("\n")}
     };
     private static readonly Dictionary<string,string> Providers = new() { ${Object.entries(config.schemes).map(([n,s])=>`["${n}"]="${s.provider}"`).join(", ")} };
-    private static readonly Dictionary<string,string[]> AllowedProviders = new() { ${Object.entries(config.schemes).map(([n,s])=>`["${n}"]=new[] { ${(s.swa?.allowedProviders??[]).map(p=>`"${p}"`).join(", ")} }`).join(", ")} };
+    private static readonly Dictionary<string,string[]> AllowedProviders = new() { ${Object.entries(config.schemes).map(([n,s])=>`["${n}"]=${csharpStringArray(s.swa?.allowedProviders??[])}`).join(", ")} };
     public static async Task<(AuthPrincipal? Principal, HttpResponseData? ErrorResponse)> Authorize(HttpRequestData request, string policyName)
     {
         if (!Policies.TryGetValue(policyName, out var policy)) return (null, await Error(request, HttpStatusCode.Unauthorized, "Undefined authorization policy"));

package/src/core/verify/index.ts

@@ -29,6 +29,8 @@ export interface VerifyCheckEvidence {
   violations?: ProjectViolation[];
   findings?: DriftFinding[];
   logTail?: string[];
+  /** --compact で抑制された info-severity findings の件数。 */
+  suppressedInfoFindings?: number;
 }
 
 export interface VerifyCheckResult {
@@ -213,6 +215,23 @@ function runTypecheckCheck(projectRoot: string): VerifyCheckResult {
     };
   }
 
+  // typecheck は shared のビルド済み dist/ を参照する。古い dist による
+  // 「no exported member」誤検知を防ぐため、先に shared をビルドする。
+  const sharedBuild = runSharedBuildIfPresent(projectRoot);
+  if (sharedBuild.ran && !sharedBuild.ok) {
+    return {
+      id: "typecheck",
+      title: "TypeScript type check",
+      status: "fail",
+      durationMs: Date.now() - startedAt,
+      fixable: true,
+      evidence: { command: sharedBuild.command, logTail: sharedBuild.logTail },
+      suggestedActions: [
+        "Fix the shared package build errors first; typecheck resolves the shared package from its built dist/.",
+      ],
+    };
+  }
+
   const scripts = readPackageScripts(projectRoot);
   let command: string;
   let args: string[];
@@ -240,6 +259,42 @@ const SCRIPT_CHECK_TITLES: Record<string, string> = {
   test: "Test suite",
 };
 
+interface SharedBuildOutcome {
+  ran: boolean;
+  ok: boolean;
+  command?: string;
+  logTail?: string[];
+}
+
+/** shared/package.json に build script があれば実行する (なければ no-op)。 */
+function runSharedBuildIfPresent(projectRoot: string): SharedBuildOutcome {
+  const sharedPackageJsonPath = path.join(projectRoot, "shared", "package.json");
+  if (!fs.existsSync(sharedPackageJsonPath)) return { ran: false, ok: true };
+  try {
+    const pkg = JSON.parse(fs.readFileSync(sharedPackageJsonPath, "utf-8")) as { scripts?: Record<string, string> };
+    if (typeof pkg.scripts?.build !== "string") return { ran: false, ok: true };
+  } catch {
+    return { ran: false, ok: true };
+  }
+
+  const pm = detectFromProject(projectRoot);
+  const command = getCommands(pm).name;
+  const result = spawnSync(command, ["run", "build"], {
+    cwd: path.join(projectRoot, "shared"),
+    shell: true,
+    encoding: "utf-8",
+    timeout: 5 * 60 * 1000,
+  });
+  const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+  const ok = result.status === 0 && !result.error;
+  return {
+    ran: true,
+    ok,
+    command: `${command} run build (in shared/)`,
+    logTail: ok ? undefined : tailLines(result.error ? `${output}\n${result.error.message}` : output, 50),
+  };
+}
+
 function runScriptCheck(projectRoot: string, scriptName: "build" | "lint" | "test"): VerifyCheckResult {
   const startedAt = Date.now();
   const scripts = readPackageScripts(projectRoot);
@@ -358,6 +413,27 @@ export async function runVerify(
   return result;
 }
 
+/**
+ * Agent 消費向けに info-severity の drift findings (「user-owned が編集されたが想定内」等)
+ * を除去したコンパクトな結果を返す。判定 (summary) は変わらない。
+ */
+export function compactVerifyResult(result: VerifyResult): VerifyResult {
+  return {
+    ...result,
+    checks: result.checks.map((check) => {
+      const findings = check.evidence.findings;
+      if (!findings || findings.length === 0) return check;
+      const kept = findings.filter((finding) => finding.severity !== "info");
+      const suppressed = findings.length - kept.length;
+      if (suppressed === 0) return check;
+      return {
+        ...check,
+        evidence: { ...check.evidence, findings: kept, suppressedInfoFindings: suppressed },
+      };
+    }),
+  };
+}
+
 export interface FailureExplanation {
   checkId: string;
   title: string;