swallowkit 1.0.0-beta.6 → 1.0.0-beta.61

package/dist/cli/commands/scaffold.js

@@ -38,17 +38,51 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scaffoldCommand = scaffoldCommand;
+exports.resolveAuthPolicy = resolveAuthPolicy;
+exports.resolveModelPath = resolveModelPath;
+exports.createUIAuthOptions = createUIAuthOptions;
+exports.generateCosmosContainer = generateCosmosContainer;
+exports.generateUIComponents = generateUIComponents;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const config_1 = require("../../core/config");
 const model_parser_1 = require("../../core/scaffold/model-parser");
 const functions_generator_1 = require("../../core/scaffold/functions-generator");
+const connector_functions_generator_1 = require("../../core/scaffold/connector-functions-generator");
 const nextjs_generator_1 = require("../../core/scaffold/nextjs-generator");
 const ui_generator_1 = require("../../core/scaffold/ui-generator");
-const config_1 = require("../../core/config");
+const native_schema_generator_1 = require("../../core/scaffold/native-schema-generator");
 const package_manager_1 = require("../../utils/package-manager");
+const manifest_1 = require("../../core/project/manifest");
+const auth_generator_1 = require("../../core/scaffold/auth-generator");
+const file_session_1 = require("../../core/operations/file-session");
+const artifacts_1 = require("../../core/project/artifacts");
+const SCAFFOLD_GENERATOR = "scaffold";
+function getMachineAwareStdio() {
+    return process.env.SWALLOWKIT_MACHINE_OUTPUT === "1" ? "pipe" : "inherit";
+}
+function runSpawnSyncCommand(command, args, cwd) {
+    const result = (0, child_process_1.spawnSync)(command, args, {
+        cwd,
+        stdio: getMachineAwareStdio(),
+        shell: true,
+    });
+    if (typeof result.status === "number" && result.status !== 0) {
+        throw new Error(`${command} ${args.join(" ")} exited with code ${result.status}`);
+    }
+    if (result.error) {
+        throw result.error;
+    }
+}
 async function scaffoldCommand(options) {
     // SwallowKit プロジェクトディレクトリかどうかを検証
     (0, config_1.ensureSwallowKitProject)("scaffold");
+    const configValidation = (0, config_1.validateConfig)((0, config_1.getFullConfig)());
+    if (!configValidation.valid)
+        throw new Error(`Invalid SwallowKit configuration:\n${configValidation.errors.map(error => `- ${error}`).join("\n")}`);
+    // Plan(dry-run) や Apply からセッションが供給される。単体実行時は commit セッションを生成。
+    const session = (0, file_session_1.getActiveFileSession)() ?? new file_session_1.FileOperationSession("commit");
     console.log("🏗️  SwallowKit Scaffold: Generating CRUD operations...\n");
     try {
         // 1. Resolve model file path
@@ -58,6 +92,14 @@ async function scaffoldCommand(options) {
         console.log("🔍 Parsing model file...");
         const modelInfo = await (0, model_parser_1.parseModelFile)(modelPath);
         console.log(`✅ Model parsed: ${modelInfo.name} (${modelInfo.schemaName})`);
+        const backendLanguage = (0, config_1.getBackendLanguage)();
+        console.log(`🧠 Backend language: ${backendLanguage}`);
+        // コネクタモデルかどうかを判定
+        const isConnectorModel = !!modelInfo.connectorConfig;
+        if (isConnectorModel) {
+            console.log(`🔌 Connector model detected: ${modelInfo.connectorConfig.connector}`);
+            console.log(`   Operations: ${modelInfo.connectorConfig.operations.join(", ")}`);
+        }
         // ネストスキーマ参照があれば表示
         if (modelInfo.nestedSchemaRefs.length > 0) {
             console.log(`🔗 Nested schema references detected:`);
@@ -74,36 +116,135 @@ async function scaffoldCommand(options) {
         // 4. Read shared package name
         const functionsDir = options.functionsDir || "functions";
         const sharedPackageName = readSharedPackageName();
+        const relatedModels = backendLanguage === "typescript"
+            ? [modelInfo]
+            : await collectModelGraph(modelPath);
+        for (const relatedModel of relatedModels) {
+            session.registerInput(relatedModel.filePath);
+        }
+        // 4b. 書き込み前に外部 codegen toolchain を検証し、失敗時はプロジェクト無変更で終了する
+        if (session.mode === "commit" && backendLanguage !== "typescript" && !isConnectorModel) {
+            await (0, native_schema_generator_1.validateNativeSchemaToolchain)(relatedModels, modelInfo, backendLanguage, path.join(process.cwd(), functionsDir));
+        }
+        if (options.apiOnly) {
+            console.log("ℹ️  --api-only skips UI generation only; Functions, BFF routes, OpenAPI, and native schema assets are still updated.");
+        }
         // 5. Generate BFF callFunction helper
-        await generateCallFunctionHelper();
+        await generateCallFunctionHelper(session);
         // 6. Generate Azure Functions code
-        await generateFunctionsCode(modelInfo, functionsDir, sharedPackageName);
+        if (isConnectorModel) {
+            await generateConnectorFunctionsCode(modelInfo, functionsDir, sharedPackageName, backendLanguage, session);
+            // 6b. Install connector driver dependencies
+            await installConnectorDriverDependencies(modelInfo, functionsDir, backendLanguage, session);
+        }
+        else {
+            await generateFunctionsCode(modelInfo, functionsDir, sharedPackageName, backendLanguage, session);
+            if (backendLanguage !== "typescript") {
+                await (0, native_schema_generator_1.generateLanguageSchemaArtifacts)(relatedModels, modelInfo, functionsDir, backendLanguage, session);
+            }
+        }
         // 7. Generate Next.js BFF API Routes
         const apiDir = options.apiDir || "app/api";
-        await generateBFFRoutes(modelInfo, apiDir, sharedPackageName);
-        // 8. Generate Cosmos DB container Bicep file
-        await generateCosmosContainer(modelInfo);
+        if (isConnectorModel) {
+            await generateConnectorBFFRoutesFiles(modelInfo, apiDir, sharedPackageName, session);
+        }
+        else {
+            await generateBFFRoutes(modelInfo, apiDir, sharedPackageName, session);
+        }
+        // 8. Generate Cosmos DB container Bicep file (skip for connector models)
+        if (!isConnectorModel) {
+            await generateCosmosContainer(modelInfo, session);
+        }
         // 9. Generate UI components (unless --api-only)
         if (!options.apiOnly) {
-            await generateUIComponents(modelInfo, sharedPackageName);
-            await updateNavigationMenu(modelInfo);
+            const uiAuthConfig = (0, config_1.getAuthConfig)();
+            const uiAuthPolicy = resolveAuthPolicy(modelInfo, uiAuthConfig);
+            const uiAuthOptions = uiAuthPolicy && uiAuthConfig && uiAuthConfig.provider !== 'none'
+                ? createUIAuthOptions(uiAuthPolicy, uiAuthConfig)
+                : undefined;
+            await generateUIComponents(modelInfo, sharedPackageName, uiAuthOptions, session);
+            if (uiAuthOptions?.authenticatedFetchImport) {
+                applyExternalTokenFetchToGeneratedUi(modelInfo, session, uiAuthOptions.authenticatedFetchImport);
+            }
+            await updateNavigationMenu(modelInfo, session);
+        }
+        if (session.mode === "commit") {
+            (0, artifacts_1.recordSessionOperations)(session.operations, {
+                schemaHash: (0, file_session_1.hashFileIfExists)(modelPath) ?? undefined,
+                sourceModel: modelInfo.name,
+            });
+            await (0, manifest_1.syncProjectManifest)();
         }
         console.log("\n✅ Scaffold completed successfully!");
         console.log("\n📝 Next steps:");
-        console.log(`  1. Review generated files in ${functionsDir}/src/ and ${apiDir}/`);
+        console.log(`  1. Review generated files in ${describeFunctionsOutputPath(functionsDir, backendLanguage)} and ${apiDir}/`);
         if (!options.apiOnly) {
             console.log(`  2. Check the generated UI pages in app/${(0, model_parser_1.toKebabCase)(modelInfo.name)}/`);
             console.log("  3. Navigate to the model from the homepage menu");
         }
-        console.log(`  ${options.apiOnly ? '2' : '4'}. Ensure FUNCTIONS_BASE_URL is set in your .env.local file`);
-        console.log(`  ${options.apiOnly ? '3' : '5'}. Configure CosmosDBConnection in functions/local.settings.json`);
-        console.log(`  ${options.apiOnly ? '4' : '6'}. Run '${(0, package_manager_1.getCommands)((0, package_manager_1.detectFromProject)()).dlx} swallowkit dev' to test the generated code`);
+        if (backendLanguage !== "typescript") {
+            console.log(`  ${options.apiOnly ? "2" : "4"}. Review generated OpenAPI export and native schema assets in ${functionsDir}/openapi/ and ${functionsDir}/generated/`);
+        }
+        console.log(`  ${options.apiOnly ? (backendLanguage === "typescript" ? "2" : "3") : (backendLanguage === "typescript" ? "4" : "5")}. Ensure BACKEND_FUNCTIONS_BASE_URL is set in your .env.local file`);
+        console.log(`  ${options.apiOnly ? (backendLanguage === "typescript" ? "3" : "4") : (backendLanguage === "typescript" ? "5" : "6")}. Configure CosmosDBConnection in functions/local.settings.json`);
+        console.log(`  ${options.apiOnly ? (backendLanguage === "typescript" ? "4" : "5") : (backendLanguage === "typescript" ? "6" : "7")}. Run '${(0, package_manager_1.getCommands)((0, package_manager_1.detectFromProject)()).exec} swallowkit dev' to test the generated code`);
     }
     catch (error) {
         console.error("\n❌ Scaffold failed:", error.message);
         process.exit(1);
     }
 }
+function applyExternalTokenFetchToGeneratedUi(modelInfo, session, importPath = '@/lib/auth/authenticated-fetch') {
+    const uiPrefix = `app/${(0, model_parser_1.toKebabCase)(modelInfo.name)}/`;
+    for (const operation of session.operations) {
+        if (!operation.path.startsWith(uiPrefix) || !operation.path.endsWith('.tsx') || operation.action === 'delete')
+            continue;
+        let content = session.readFile(operation.absolutePath);
+        if (!content.includes('fetch('))
+            continue;
+        content = content.replace(/\bfetch\(/g, 'authenticatedFetch(');
+        content = content.replace(/(if \(!res\.ok\) throw new Error\([^\n]+\);)/g, `if (res.status === 401) throw new Error('Authentication required');\n        $1`);
+        if (!content.includes(importPath)) {
+            const directive = content.match(/^'use client';\s*\r?\n/)?.[0] ?? '';
+            content = `${directive}import { authenticatedFetch } from '${importPath}';\n${content.slice(directive.length)}`;
+        }
+        session.writeFile(operation.absolutePath, content, {
+            ownership: 'managed',
+            generator: SCAFFOLD_GENERATOR,
+            sourceModel: modelInfo.name,
+        });
+    }
+}
+/**
+ * モデルの authPolicy と auth config から実効的な認可ポリシーを解決
+ * - モデルに authPolicy があればそれを使用
+ * - なければ auth.authorization.defaultPolicy に従う
+ * - auth 設定がなければ undefined（ガードなし）
+ */
+function resolveAuthPolicy(modelInfo, authConfig) {
+    // モデルに明示的な authPolicy がある場合はそれを使用
+    if (modelInfo.authPolicy) {
+        const normalized = (0, config_1.normalizeAuthConfig)(authConfig);
+        for (const policyName of [modelInfo.authPolicy.policy, typeof modelInfo.authPolicy.read === 'string' ? modelInfo.authPolicy.read : undefined, typeof modelInfo.authPolicy.write === 'string' ? modelInfo.authPolicy.write : undefined].filter((value) => Boolean(value))) {
+            if (!normalized?.authorization.policies[policyName])
+                throw new Error(`Model '${modelInfo.name}' references undefined auth policy '${policyName}'. Define auth.authorization.policies.${policyName}.`);
+        }
+        return modelInfo.authPolicy;
+    }
+    // auth 設定がない場合はガードなし
+    if (!authConfig || authConfig.provider === 'none') {
+        return undefined;
+    }
+    // defaultPolicy が 'authenticated' なら認証のみ（ロール指定なし）のポリシーを返す
+    const defaultPolicy = authConfig.authorization?.defaultPolicy === 'public' ? 'anonymous' : authConfig.authorization?.defaultPolicy ?? 'authenticated';
+    if (defaultPolicy === 'authenticated') {
+        return {}; // 空のポリシー = 認証のみ、ロール制限なし
+    }
+    if (defaultPolicy !== 'anonymous')
+        return { policy: defaultPolicy };
+    // defaultPolicy が 'anonymous' なら認証不要
+    return undefined;
+}
 /**
  * モデルファイルのパスを解決
  */
@@ -161,68 +302,326 @@ function readSharedPackageName() {
 /**
  * Generate BFF callFunction helper (lib/api/call-function.ts)
  */
-async function generateCallFunctionHelper() {
+async function generateCallFunctionHelper(session) {
     console.log("\n📦 Generating BFF callFunction helper...");
     const cwd = process.cwd();
     const helperDir = path.join(cwd, "lib", "api");
     const helperPath = path.join(helperDir, "call-function.ts");
-    if (!fs.existsSync(helperDir)) {
-        fs.mkdirSync(helperDir, { recursive: true });
+    // auth 設定がある場合は Authorization ヘッダー転送版を生成
+    const authConfig = (0, config_1.getAuthConfig)();
+    const normalizedAuth = (0, config_1.normalizeAuthConfig)(authConfig);
+    const hasAuth = Boolean(normalizedAuth && Object.keys(normalizedAuth.schemes).length > 0);
+    let helperCode;
+    if (hasAuth) {
+        const providers = new Set(Object.values(normalizedAuth.schemes).map(scheme => scheme.provider));
+        helperCode = normalizedAuth.schemes.default && Object.keys(normalizedAuth.schemes).length === 1
+            ? authConfig?.provider === "swa" ? (0, auth_generator_1.generateBFFCallFunctionWithSwaAuth)() : (0, auth_generator_1.generateBFFCallFunctionWithAuth)()
+            : providers.has("swa") ? (0, auth_generator_1.generateBFFCallFunctionWithMultipleAuth)() : (0, auth_generator_1.generateBFFCallFunctionWithAuth)();
+    }
+    else {
+        helperCode = (0, nextjs_generator_1.generateBFFCallFunction)();
     }
-    const helperCode = (0, nextjs_generator_1.generateBFFCallFunction)();
-    fs.writeFileSync(helperPath, helperCode, "utf-8");
+    session.writeFile(helperPath, helperCode, { ownership: "managed", generator: SCAFFOLD_GENERATOR });
     console.log(`✅ Created: ${helperPath}`);
 }
 /**
  * Generate Azure Functions CRUD code
  */
-async function generateFunctionsCode(modelInfo, functionsDir, sharedPackageName) {
+async function generateFunctionsCode(modelInfo, functionsDir, sharedPackageName, backendLanguage, session) {
     console.log("\n🔨 Generating Azure Functions CRUD code...");
+    // Resolve auth policy: model-level authPolicy or global defaultPolicy
+    const authConfig = (0, config_1.getAuthConfig)();
+    const authPolicy = resolveAuthPolicy(modelInfo, authConfig);
+    if (authPolicy) {
+        console.log(`🔐 Auth policy detected: ${JSON.stringify(authPolicy)}`);
+    }
     const modelKebab = (0, model_parser_1.toKebabCase)(modelInfo.name);
-    const functionFilePath = path.join(process.cwd(), functionsDir, "src", `${modelKebab}.ts`);
-    // ディレクトリを作成
-    const functionDir = path.dirname(functionFilePath);
-    if (!fs.existsSync(functionDir)) {
-        fs.mkdirSync(functionDir, { recursive: true });
+    const managedMeta = { ownership: "managed", generator: SCAFFOLD_GENERATOR, sourceModel: modelInfo.name };
+    if (backendLanguage === "typescript") {
+        const normalizedAuth = (0, config_1.getNormalizedAuthConfig)();
+        if (normalizedAuth && Object.keys(normalizedAuth.schemes).some(name => name !== "default")) {
+            const routerPath = path.join(process.cwd(), functionsDir, "src", "auth", "auth-router.ts");
+            session.writeFile(routerPath, (0, auth_generator_1.generateNamedAuthRouterTS)(normalizedAuth), { ownership: "managed", generator: SCAFFOLD_GENERATOR });
+        }
+        const functionFilePath = path.join(process.cwd(), functionsDir, "src", `${modelKebab}.ts`);
+        const code = (0, functions_generator_1.generateCompactAzureFunctionsCRUD)(modelInfo, sharedPackageName, authPolicy, authConfig?.provider);
+        session.writeFile(functionFilePath, code, managedMeta);
+        console.log(`✅ Created: ${functionFilePath}`);
+        return;
     }
-    // コードを生成
-    const code = (0, functions_generator_1.generateCompactAzureFunctionsCRUD)(modelInfo, sharedPackageName);
-    // ファイルに書き込み
-    fs.writeFileSync(functionFilePath, code, "utf-8");
-    console.log(`✅ Created: ${functionFilePath}`);
+    if (backendLanguage === "csharp") {
+        const normalizedAuth = (0, config_1.getNormalizedAuthConfig)();
+        if (normalizedAuth && Object.keys(normalizedAuth.schemes).some(name => name !== "default")) {
+            const routerPath = path.join(process.cwd(), functionsDir, "Auth", "AuthRouter.cs");
+            session.writeFile(routerPath, (0, auth_generator_1.generateNamedAuthRouterCSharp)(normalizedAuth), { ownership: "managed", generator: SCAFFOLD_GENERATOR });
+        }
+        const crudDir = path.join(process.cwd(), functionsDir, "Crud");
+        const functionFilePath = path.join(crudDir, `${modelInfo.name}CrudFunctions.cs`);
+        // Remove init-generated template (singular) to avoid route conflicts
+        const templatePath = path.join(crudDir, `${modelInfo.name}Function.cs`);
+        if (session.fileExists(templatePath)) {
+            session.deleteFile(templatePath, managedMeta);
+            console.log(`🗑️  Removed template: ${templatePath}`);
+        }
+        session.writeFile(functionFilePath, (0, functions_generator_1.generateCSharpAzureFunctionsCRUD)(modelInfo, authPolicy), managedMeta);
+        console.log(`✅ Created: ${functionFilePath}`);
+        return;
+    }
+    const normalizedAuth = (0, config_1.getNormalizedAuthConfig)();
+    if (normalizedAuth && Object.keys(normalizedAuth.schemes).some(name => name !== "default")) {
+        const routerPath = path.join(process.cwd(), functionsDir, "auth", "auth_router.py");
+        session.writeFile(routerPath, (0, auth_generator_1.generateNamedAuthRouterPython)(normalizedAuth), { ownership: "managed", generator: SCAFFOLD_GENERATOR });
+    }
+    const blueprintsDir = path.join(process.cwd(), functionsDir, "blueprints");
+    const blueprintPath = path.join(blueprintsDir, `${modelKebab.replace(/-/g, "_")}.py`);
+    const { blueprint, registration } = (0, functions_generator_1.generatePythonAzureFunctionsCRUD)(modelInfo, authPolicy);
+    session.writeFile(blueprintPath, blueprint, managedMeta);
+    updatePythonFunctionRegistrations(path.join(process.cwd(), functionsDir, "function_app.py"), registration, session);
+    console.log(`✅ Created: ${blueprintPath}`);
+}
+function createUIAuthOptions(policy, authConfig) {
+    const normalized = (0, config_1.normalizeAuthConfig)(authConfig);
+    const readPolicyName = typeof policy.read === 'string' ? policy.read : policy.policy;
+    const writePolicyName = typeof policy.write === 'string' ? policy.write : policy.policy;
+    const readNamed = readPolicyName ? normalized?.authorization.policies[readPolicyName] : undefined;
+    const named = writePolicyName ? normalized?.authorization.policies[writePolicyName] : undefined;
+    const writeRoles = named?.roles ?? (Array.isArray(policy.write) ? policy.write : policy.roles) ?? [];
+    const externalScheme = [...(readNamed?.schemes ?? []), ...(named?.schemes ?? [])].find(name => normalized?.schemes[name]?.provider === 'external-token');
+    const authScheme = readNamed?.schemes[0] ?? named?.schemes[0];
+    const authenticatedFetchImport = externalScheme ? `@/lib/auth/schemes/${(0, model_parser_1.toKebabCase)(externalScheme)}/authenticated-fetch` : authConfig.provider === 'external-token' ? '@/lib/auth/authenticated-fetch' : undefined;
+    const authContextImport = authScheme ? `@/lib/auth/schemes/${(0, model_parser_1.toKebabCase)(authScheme)}/auth-context` : '@/lib/auth/auth-context';
+    return { authPolicy: policy, writeRoles, authenticatedFetchImport, authContextImport };
+}
+/**
+ * コネクタモデル用 Azure Functions コード生成
+ */
+async function generateConnectorFunctionsCode(modelInfo, functionsDir, sharedPackageName, backendLanguage, session) {
+    console.log("\n🔌 Generating Connector Azure Functions code...");
+    const connectorConfig = modelInfo.connectorConfig;
+    const connectorDef = (0, config_1.getConnectorDefinition)(connectorConfig.connector);
+    if (!connectorDef) {
+        throw new Error(`Connector '${connectorConfig.connector}' not found in swallowkit.config.js.\n` +
+            `  Please add it to the 'connectors' section of your configuration.`);
+    }
+    // Resolve auth policy (same logic as Cosmos model scaffolding)
+    const authConfig = (0, config_1.getAuthConfig)();
+    const authPolicy = resolveAuthPolicy(modelInfo, authConfig);
+    if (authPolicy) {
+        console.log(`🔐 Auth policy detected: ${JSON.stringify(authPolicy)}`);
+    }
+    const modelKebab = (0, model_parser_1.toKebabCase)(modelInfo.name);
+    const connectorManagedMeta = { ownership: "managed", generator: SCAFFOLD_GENERATOR, sourceModel: modelInfo.name };
+    if (backendLanguage === "typescript") {
+        const functionFilePath = path.join(process.cwd(), functionsDir, "src", `${modelKebab}.ts`);
+        let code;
+        if (connectorDef.type === "rdb") {
+            code = (0, connector_functions_generator_1.generateRdbConnectorFunctionTS)(modelInfo, sharedPackageName, connectorDef, connectorConfig, authPolicy, authConfig?.provider);
+        }
+        else {
+            code = (0, connector_functions_generator_1.generateApiConnectorFunctionTS)(modelInfo, sharedPackageName, connectorDef, connectorConfig, authPolicy, authConfig?.provider);
+        }
+        session.writeFile(functionFilePath, code, connectorManagedMeta);
+        console.log(`✅ Created: ${functionFilePath}`);
+        return;
+    }
+    if (backendLanguage === "csharp") {
+        const functionFilePath = path.join(process.cwd(), functionsDir, "Connectors", `${modelInfo.name}ConnectorFunctions.cs`);
+        let code;
+        if (connectorDef.type === "rdb") {
+            code = (0, connector_functions_generator_1.generateRdbConnectorFunctionCSharp)(modelInfo, connectorDef, connectorConfig);
+        }
+        else {
+            code = (0, connector_functions_generator_1.generateApiConnectorFunctionCSharp)(modelInfo, connectorDef, connectorConfig);
+        }
+        session.writeFile(functionFilePath, code, connectorManagedMeta);
+        console.log(`✅ Created: ${functionFilePath}`);
+        return;
+    }
+    // Python
+    const blueprintsDir = path.join(process.cwd(), functionsDir, "blueprints");
+    const blueprintPath = path.join(blueprintsDir, `${modelKebab.replace(/-/g, "_")}.py`);
+    let result;
+    if (connectorDef.type === "rdb") {
+        result = (0, connector_functions_generator_1.generateRdbConnectorFunctionPython)(modelInfo, connectorDef, connectorConfig);
+    }
+    else {
+        result = (0, connector_functions_generator_1.generateApiConnectorFunctionPython)(modelInfo, connectorDef, connectorConfig);
+    }
+    session.writeFile(blueprintPath, result.blueprint, connectorManagedMeta);
+    updatePythonFunctionRegistrations(path.join(process.cwd(), functionsDir, "function_app.py"), result.registration, session);
+    console.log(`✅ Created: ${blueprintPath}`);
+}
+/**
+ * コネクタモデルの scaffold 後に、生成コードが必要とする RDB/API ドライバを
+ * functions ディレクトリにインストールする。
+ */
+async function installConnectorDriverDependencies(modelInfo, functionsDir, backendLanguage, session) {
+    const connectorConfig = modelInfo.connectorConfig;
+    const connectorDef = (0, config_1.getConnectorDefinition)(connectorConfig.connector);
+    if (!connectorDef || connectorDef.type !== "rdb")
+        return;
+    const rdbDef = connectorDef;
+    const functionsPath = path.join(process.cwd(), functionsDir);
+    if (backendLanguage === "typescript") {
+        const driverMap = {
+            mysql: { deps: ["mysql2"], devDeps: [] },
+            postgres: { deps: ["pg"], devDeps: ["@types/pg"] },
+            sqlserver: { deps: ["mssql"], devDeps: [] },
+        };
+        const entry = driverMap[rdbDef.provider];
+        if (!entry)
+            return;
+        // package.json を読んで、既にインストール済みならスキップ
+        const pkgJsonPath = path.join(functionsPath, "package.json");
+        if (fs.existsSync(pkgJsonPath)) {
+            const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+            const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+            const missingDeps = entry.deps.filter(d => !allDeps[d]);
+            const missingDevDeps = entry.devDeps.filter(d => !allDeps[d]);
+            if (missingDeps.length === 0 && missingDevDeps.length === 0)
+                return;
+        }
+        if (session.mode === "collect") {
+            session.addWarning(`external-install: ${rdbDef.provider} driver dependencies (${[...entry.deps, ...entry.devDeps].join(", ")}) will be installed into ${functionsDir}/ on apply.`);
+            return;
+        }
+        console.log(`\n📦 Installing ${rdbDef.provider} driver dependencies...`);
+        const pm = (0, package_manager_1.detectFromProject)(functionsPath);
+        const cmds = (0, package_manager_1.getCommands)(pm);
+        if (entry.deps.length > 0) {
+            runSpawnSyncCommand(cmds.name, [pm === "pnpm" ? "add" : "install", ...entry.deps], functionsPath);
+        }
+        if (entry.devDeps.length > 0) {
+            runSpawnSyncCommand(cmds.name, [pm === "pnpm" ? "add" : "install", "-D", ...entry.devDeps], functionsPath);
+        }
+        console.log(`✅ ${rdbDef.provider} driver installed`);
+        return;
+    }
+    if (backendLanguage === "csharp") {
+        const nugetMap = {
+            mysql: "MySqlConnector",
+            postgres: "Npgsql",
+            sqlserver: "Microsoft.Data.SqlClient",
+        };
+        const pkg = nugetMap[rdbDef.provider];
+        if (!pkg)
+            return;
+        if (session.mode === "collect") {
+            session.addWarning(`external-install: NuGet package ${pkg} will be added to ${functionsDir}/functions.csproj on apply.`);
+            return;
+        }
+        console.log(`\n📦 Installing ${rdbDef.provider} NuGet package...`);
+        runSpawnSyncCommand("dotnet", ["add", path.join(functionsPath, "functions.csproj"), "package", pkg], functionsPath);
+        console.log(`✅ ${pkg} installed`);
+        return;
+    }
+    // Python — requirements.txt に追記
+    const pipMap = {
+        mysql: "mysql-connector-python",
+        postgres: "psycopg2-binary",
+        sqlserver: "pymssql",
+    };
+    const pipPkg = pipMap[rdbDef.provider];
+    if (!pipPkg)
+        return;
+    const reqPath = path.join(functionsPath, "requirements.txt");
+    if (session.fileExists(reqPath)) {
+        const existing = session.readFile(reqPath);
+        if (!existing.includes(pipPkg)) {
+            console.log(`\n📦 Adding ${pipPkg} to requirements.txt...`);
+            session.writeFile(reqPath, `${existing}\n${pipPkg}\n`, { ownership: "extension-point", generator: SCAFFOLD_GENERATOR });
+            console.log(`✅ ${pipPkg} added`);
+        }
+    }
+}
+/**
+ * コネクタモデル用 BFF ルート生成（操作制限に対応）
+ */
+async function generateConnectorBFFRoutesFiles(modelInfo, apiDir, sharedPackageName, session) {
+    console.log("\n🔌 Generating Connector BFF API routes...");
+    const modelCamel = (0, model_parser_1.toCamelCase)(modelInfo.name);
+    const operations = modelInfo.connectorConfig.operations;
+    const listRoutePath = path.join(process.cwd(), apiDir, modelCamel, "route.ts");
+    const detailRoutePath = path.join(process.cwd(), apiDir, modelCamel, "[id]", "route.ts");
+    const routes = (0, nextjs_generator_1.generateConnectorBFFRoutes)(modelInfo, sharedPackageName, operations);
+    const meta = { ownership: "managed", generator: SCAFFOLD_GENERATOR, sourceModel: modelInfo.name };
+    session.writeFile(listRoutePath, routes.listRoute, meta);
+    session.writeFile(detailRoutePath, routes.detailRoute, meta);
+    console.log(`✅ Created: ${listRoutePath}`);
+    console.log(`✅ Created: ${detailRoutePath}`);
+}
+async function collectModelGraph(modelPath, seen = new Map()) {
+    const resolvedPath = path.resolve(modelPath);
+    if (seen.has(resolvedPath)) {
+        return Array.from(seen.values());
+    }
+    const modelInfo = await (0, model_parser_1.parseModelFile)(resolvedPath);
+    seen.set(resolvedPath, modelInfo);
+    for (const ref of modelInfo.nestedSchemaRefs) {
+        const nestedPath = resolveNestedModelPath(resolvedPath, ref.importPath);
+        await collectModelGraph(nestedPath, seen);
+    }
+    return Array.from(seen.values());
+}
+function resolveNestedModelPath(modelPath, importPath) {
+    let resolvedPath = path.resolve(path.dirname(modelPath), importPath);
+    if (!resolvedPath.endsWith(".ts")) {
+        resolvedPath += ".ts";
+    }
+    return resolvedPath;
+}
+function describeFunctionsOutputPath(functionsDir, backendLanguage) {
+    if (backendLanguage === "typescript") {
+        return `${functionsDir}/src/`;
+    }
+    if (backendLanguage === "csharp") {
+        return `${functionsDir}/Crud/`;
+    }
+    return `${functionsDir}/blueprints/`;
+}
+function updatePythonFunctionRegistrations(functionAppPath, registration, session) {
+    if (!session.fileExists(functionAppPath)) {
+        throw new Error(`Python Functions entrypoint not found: ${functionAppPath}`);
+    }
+    const content = session.readFile(functionAppPath);
+    // Check if import line already exists (handles init-generated layout)
+    const importLine = registration.split("\n").find((l) => l.startsWith("from ") || l.startsWith("import "));
+    if (importLine && content.includes(importLine)) {
+        return;
+    }
+    if (content.includes(registration)) {
+        return;
+    }
+    const marker = "# SwallowKit scaffold registrations";
+    if (!content.includes(marker)) {
+        throw new Error(`Could not find scaffold registration marker in ${functionAppPath}`);
+    }
+    const updated = content.replace(marker, `${registration}\n${marker}`);
+    session.writeFile(functionAppPath, updated, { ownership: "extension-point", generator: SCAFFOLD_GENERATOR });
 }
 /**
  * Next.js BFF API Routes を生成
  */
-async function generateBFFRoutes(modelInfo, apiDir, sharedPackageName) {
+async function generateBFFRoutes(modelInfo, apiDir, sharedPackageName, session) {
     console.log("\n🔨 Generating Next.js BFF API routes...");
-    const modelKebab = (0, model_parser_1.toKebabCase)(modelInfo.name);
     const modelCamel = modelInfo.name.charAt(0).toLowerCase() + modelInfo.name.slice(1);
     // List route: app/api/[model]/route.ts
     const listRoutePath = path.join(process.cwd(), apiDir, modelCamel, "route.ts");
     // Detail route: app/api/[model]/[id]/route.ts
     const detailRoutePath = path.join(process.cwd(), apiDir, modelCamel, "[id]", "route.ts");
-    // ディレクトリを作成
-    const listRouteDir = path.dirname(listRoutePath);
-    const detailRouteDir = path.dirname(detailRoutePath);
-    if (!fs.existsSync(listRouteDir)) {
-        fs.mkdirSync(listRouteDir, { recursive: true });
-    }
-    if (!fs.existsSync(detailRouteDir)) {
-        fs.mkdirSync(detailRouteDir, { recursive: true });
-    }
     // コードを生成
     const routes = (0, nextjs_generator_1.generateCompactBFFRoutes)(modelInfo, sharedPackageName);
     // ファイルに書き込み
-    fs.writeFileSync(listRoutePath, routes.listRoute, "utf-8");
-    fs.writeFileSync(detailRoutePath, routes.detailRoute, "utf-8");
+    const meta = { ownership: "managed", generator: SCAFFOLD_GENERATOR, sourceModel: modelInfo.name };
+    session.writeFile(listRoutePath, routes.listRoute, meta);
+    session.writeFile(detailRoutePath, routes.detailRoute, meta);
     console.log(`✅ Created: ${listRoutePath}`);
     console.log(`✅ Created: ${detailRoutePath}`);
 }
 /**
  * Generate Cosmos DB container Bicep file
  */
-async function generateCosmosContainer(modelInfo) {
+async function generateCosmosContainer(modelInfo, session = new file_session_1.FileOperationSession("commit")) {
     console.log("\n🗄️  Generating Cosmos DB container Bicep file...");
     const modelKebab = (0, model_parser_1.toKebabCase)(modelInfo.name);
     const modelPascal = (0, model_parser_1.toPascalCase)(modelInfo.name);
@@ -233,12 +632,8 @@ async function generateCosmosContainer(modelInfo) {
         console.log("ℹ️  infra directory not found. Skipping Cosmos DB container generation.");
         return;
     }
-    // Check if containers directory exists, if not create it
-    const containersDir = path.join(infraDir, "containers");
-    if (!fs.existsSync(containersDir)) {
-        fs.mkdirSync(containersDir, { recursive: true });
-    }
     // Generate container Bicep file
+    const containersDir = path.join(infraDir, "containers");
     const containerFileName = `${modelKebab}-container.bicep`;
     const containerFilePath = path.join(containersDir, containerFileName);
     const bicepContent = `@description('Cosmos DB account name')
@@ -251,13 +646,7 @@ param databaseName string
 param containerName string = '${modelPascal}s'
 
 @description('Partition key path')
-param partitionKeyPath string = '/id'
-
-@description('Throughput (RU/s) - only used for Free Tier')
-param throughput int = 400
-
-@description('Cosmos DB mode: freetier or serverless')
-param cosmosDbMode string
+param partitionKeyPath string = '${modelInfo.partitionKey}'
 
 // Reference existing Cosmos DB account
 resource cosmosAccount 'Microsoft.DocumentDB/databaseAccounts@2023-11-15' existing = {
@@ -298,33 +687,30 @@ resource container 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/container
         ]
       }
     }
-    options: cosmosDbMode == 'freetier' ? {
-      throughput: throughput
-    } : {}
   }
 }
 
 output containerName string = container.name
 `;
     // Write Bicep file (overwrite if exists)
-    fs.writeFileSync(containerFilePath, bicepContent, "utf-8");
+    session.writeFile(containerFilePath, bicepContent, { ownership: "managed", generator: SCAFFOLD_GENERATOR, sourceModel: modelInfo.name });
     console.log(`✅ Created: ${containerFilePath}`);
     // Update main.bicep to include this container module
-    await updateMainBicepWithContainer(modelKebab, modelPascal);
+    await updateMainBicepWithContainer(modelKebab, modelPascal, session);
 }
 /**
  * Update main.bicep to include new container module
  */
-async function updateMainBicepWithContainer(modelKebab, modelPascal) {
+async function updateMainBicepWithContainer(modelKebab, modelPascal, session) {
     const cwd = process.cwd();
     const mainBicepPath = path.join(cwd, "infra", "main.bicep");
-    if (!fs.existsSync(mainBicepPath)) {
+    if (!session.fileExists(mainBicepPath)) {
         console.log("ℹ️  main.bicep not found. Please manually add the container module.");
         return;
     }
-    let mainBicepContent = fs.readFileSync(mainBicepPath, "utf-8");
+    let mainBicepContent = session.readFile(mainBicepPath);
     // Check if container module already exists
-    const containerModuleName = `${modelKebab.replace(/-/g, '')}Container`;
+    const containerModuleName = `${modelPascal.charAt(0).toLowerCase()}${modelPascal.slice(1)}Container`;
     if (mainBicepContent.includes(`module ${containerModuleName}`)) {
         console.log(`ℹ️  Container module '${containerModuleName}' already exists in main.bicep`);
         return;
@@ -359,26 +745,21 @@ module ${containerModuleName} 'containers/${modelKebab}-container.bicep' = {
   name: '${modelKebab}-container'
   params: {
     cosmosAccountName: cosmosDbMode == 'freetier' ? cosmosDbFreeTier.outputs.accountName : cosmosDbServerless.outputs.accountName
-    databaseName: '$` + `{projectName}Database'
-    cosmosDbMode: cosmosDbMode
+    databaseName: '\${projectName}Database'
   }
-  dependsOn: [
-    cosmosDbFreeTier
-    cosmosDbServerless
-  ]
 }`;
     // Insert the module
     mainBicepContent =
         mainBicepContent.slice(0, insertPosition) +
             containerModule +
             mainBicepContent.slice(insertPosition);
-    fs.writeFileSync(mainBicepPath, mainBicepContent, "utf-8");
+    session.writeFile(mainBicepPath, mainBicepContent, { ownership: "extension-point", generator: SCAFFOLD_GENERATOR });
     console.log(`✅ Added container module to main.bicep`);
 }
 /**
  * Generate UI components (list, detail, form, create, edit pages)
  */
-async function generateUIComponents(modelInfo, sharedPackageName) {
+async function generateUIComponents(modelInfo, sharedPackageName, authOptions, session = new file_session_1.FileOperationSession("commit")) {
     console.log("\n🎨 Generating UI components...");
     const modelKebab = (0, model_parser_1.toKebabCase)(modelInfo.name);
     const modelName = modelInfo.name;
@@ -389,44 +770,46 @@ async function generateUIComponents(modelInfo, sharedPackageName) {
     const newDir = path.join(modelDir, "new");
     const idDir = path.join(modelDir, "[id]");
     const editDir = path.join(idDir, "edit");
-    // Create directories
-    [componentsDir, newDir, editDir].forEach(dir => {
-        if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, { recursive: true });
-        }
-    });
     // Generate and write files
-    const listPage = (0, ui_generator_1.generateListPage)(modelInfo, sharedPackageName);
-    const detailPage = (0, ui_generator_1.generateDetailPage)(modelInfo, sharedPackageName);
+    const listPage = (0, ui_generator_1.generateListPage)(modelInfo, sharedPackageName, authOptions);
+    const detailPage = (0, ui_generator_1.generateDetailPage)(modelInfo, sharedPackageName, authOptions);
     const formComponent = (0, ui_generator_1.generateFormComponent)(modelInfo, sharedPackageName);
-    const newPage = (0, ui_generator_1.generateNewPage)(modelInfo);
-    const editPage = (0, ui_generator_1.generateEditPage)(modelInfo, sharedPackageName);
-    fs.writeFileSync(path.join(modelDir, "page.tsx"), listPage, "utf-8");
-    fs.writeFileSync(path.join(idDir, "page.tsx"), detailPage, "utf-8");
-    fs.writeFileSync(path.join(componentsDir, `${modelName}Form.tsx`), formComponent, "utf-8");
-    fs.writeFileSync(path.join(newDir, "page.tsx"), newPage, "utf-8");
-    fs.writeFileSync(path.join(editDir, "page.tsx"), editPage, "utf-8");
+    const newPage = (0, ui_generator_1.generateNewPage)(modelInfo, authOptions);
+    const editPage = (0, ui_generator_1.generateEditPage)(modelInfo, sharedPackageName, authOptions);
+    const authLayout = (0, ui_generator_1.generateAuthLayout)(modelInfo, authOptions);
+    const meta = { ownership: "managed", generator: SCAFFOLD_GENERATOR, sourceModel: modelInfo.name };
+    session.writeFile(path.join(modelDir, "page.tsx"), listPage, meta);
+    session.writeFile(path.join(idDir, "page.tsx"), detailPage, meta);
+    session.writeFile(path.join(componentsDir, `${modelName}Form.tsx`), formComponent, meta);
+    session.writeFile(path.join(newDir, "page.tsx"), newPage, meta);
+    session.writeFile(path.join(editDir, "page.tsx"), editPage, meta);
+    if (authLayout) {
+        session.writeFile(path.join(modelDir, "layout.tsx"), authLayout, meta);
+    }
     console.log(`✅ Created: ${path.join(modelDir, "page.tsx")}`);
     console.log(`✅ Created: ${path.join(idDir, "page.tsx")}`);
     console.log(`✅ Created: ${path.join(componentsDir, `${modelName}Form.tsx`)}`);
     console.log(`✅ Created: ${path.join(newDir, "page.tsx")}`);
     console.log(`✅ Created: ${path.join(editDir, "page.tsx")}`);
+    if (authLayout) {
+        console.log(`✅ Created: ${path.join(modelDir, "layout.tsx")}`);
+    }
 }
 /**
  * Update navigation menu on the homepage
  */
-async function updateNavigationMenu(modelInfo) {
+async function updateNavigationMenu(modelInfo, session) {
     console.log("\n📋 Updating navigation menu...");
     const modelKebab = (0, model_parser_1.toKebabCase)(modelInfo.name);
     const cwd = process.cwd();
     // Update scaffold config
     const configPath = path.join(cwd, "lib", "scaffold-config.ts");
-    if (!fs.existsSync(configPath)) {
+    if (!session.fileExists(configPath)) {
         console.log("⚠️  scaffold-config.ts not found. Skipping navigation menu update.");
         return;
     }
     // Read existing config
-    const configContent = fs.readFileSync(configPath, "utf-8");
+    const configContent = session.readFile(configPath);
     // Parse models array - extract each model entry
     const models = [];
     const modelsMatch = configContent.match(/models:\s*\[([\s\S]*?)\]\s*as\s*ScaffoldModel\[\]/);
@@ -467,7 +850,7 @@ ${models.map(m => `    { name: '${m.name}', path: '${m.path}', label: '${m.label
   ] as ScaffoldModel[]
 };
 `;
-    fs.writeFileSync(configPath, newConfigContent, "utf-8");
+    session.writeFile(configPath, newConfigContent, { ownership: "extension-point", generator: SCAFFOLD_GENERATOR });
     console.log(`✅ Added ${modelInfo.name} to navigation menu`);
 }
 //# sourceMappingURL=scaffold.js.map