swallowkit 1.0.0-beta.8 → 1.0.0

package/src/cli/commands/init.ts

@@ -9,11 +9,21 @@ import {
   getCommands,
   getWorkspaceConfig,
   getCiSetupStep,
+  getCiInstallCommand,
   getAzurePipelinesSetup,
   getBuildScript,
   getFunctionsPrestart,
   getFunctionsStartScript,
+  getSwaAppBuildCommand,
 } from "../../utils/package-manager";
+import { syncProjectManifest } from "../../core/project/manifest";
+import { writeWorkflowDocs, writeAgentSkills } from "../../core/project/workflows";
+import { writeAgentInstructionFiles } from "../../core/project/agent-instructions";
+import {
+  buildCSharpCodegenToolManifestSource,
+  buildPythonCodegenRequirementsSource,
+} from "../../core/scaffold/native-schema-generator";
+import { getProjectLocalUvPaths } from "../../utils/python-uv";
 
 interface InitOptions {
   name: string;
@@ -23,15 +33,23 @@ interface InitOptions {
   backendLanguage?: BackendLanguage;
   cosmosDbMode?: CosmosDbMode;
   vnet?: VNetOption;
+  swaPlan?: StaticWebAppPlan;
+  packageManager?: PackageManager;
 }
 
 type CiCdProvider = 'github' | 'azure' | 'skip';
 type CosmosDbMode = 'freetier' | 'serverless';
 type VNetOption = 'none' | 'outbound';
+type StaticWebAppPlan = 'free' | 'standard';
+
+export function getStaticWebAppSku(plan: StaticWebAppPlan): 'Free' | 'Standard' {
+  return plan === 'free' ? 'Free' : 'Standard';
+}
 
-interface AzureConfig {
+export interface AzureConfig {
   cosmosDbMode: CosmosDbMode;
   vnetOption: VNetOption;
+  swaPlan: StaticWebAppPlan;
 }
 
 const BACKEND_LANGUAGE_CHOICES: Array<{ title: string; value: BackendLanguage }> = [
@@ -48,6 +66,66 @@ function getBackendLanguageLabel(backendLanguage: BackendLanguage): string {
   return BACKEND_LANGUAGE_CHOICES.find((choice) => choice.value === backendLanguage)?.title || backendLanguage;
 }
 
+export function buildCosmosDbFreeTierBicepSource(): string {
+  return `@description('Cosmos DB account name')
+param accountName string
+
+@description('Database name')
+param databaseName string
+
+@description('Location for Cosmos DB')
+param location string
+
+@description('Public network access')
+@allowed(['Enabled', 'Disabled'])
+param publicNetworkAccess string = 'Enabled'
+
+// Cosmos DB Account (Free Tier)
+resource cosmosAccount 'Microsoft.DocumentDB/databaseAccounts@2023-11-15' = {
+  name: accountName
+  location: location
+  kind: 'GlobalDocumentDB'
+  properties: {
+    databaseAccountOfferType: 'Standard'
+    enableAutomaticFailover: false
+    enableFreeTier: true
+    publicNetworkAccess: publicNetworkAccess
+    disableLocalAuth: true
+    consistencyPolicy: {
+      defaultConsistencyLevel: 'Session'
+    }
+    locations: [
+      {
+        locationName: location
+        failoverPriority: 0
+        isZoneRedundant: false
+      }
+    ]
+    disableKeyBasedMetadataWriteAccess: true
+  }
+}
+
+// Cosmos DB Database
+resource database 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2023-11-15' = {
+  parent: cosmosAccount
+  name: databaseName
+  properties: {
+    resource: {
+      id: databaseName
+    }
+    options: {
+      throughput: 1000
+    }
+  }
+}
+
+output id string = cosmosAccount.id
+output accountName string = cosmosAccount.name
+output endpoint string = cosmosAccount.properties.documentEndpoint
+output databaseName string = database.name
+`;
+}
+
 function getFunctionsWorkerRuntime(backendLanguage: BackendLanguage): string {
   if (backendLanguage === "csharp") {
     return "dotnet-isolated";
@@ -60,7 +138,7 @@ function getFunctionsWorkerRuntime(backendLanguage: BackendLanguage): string {
 
 function getFunctionsRuntimeConfig(backendLanguage: BackendLanguage): { name: string; version: string } {
   if (backendLanguage === "csharp") {
-    return { name: "dotnet-isolated", version: "8.0" };
+    return { name: "dotnet-isolated", version: "10.0" };
   }
   if (backendLanguage === "python") {
     return { name: "python", version: "3.11" };
@@ -68,6 +146,28 @@ function getFunctionsRuntimeConfig(backendLanguage: BackendLanguage): { name: st
   return { name: "node", version: "22" };
 }
 
+export function buildSharedTsConfig() {
+  return {
+    compilerOptions: {
+      target: "ES2020",
+      module: "Node16",
+      moduleResolution: "node16",
+      lib: ["ES2020"],
+      outDir: "dist",
+      rootDir: ".",
+      declaration: true,
+      declarationMap: true,
+      sourceMap: true,
+      strict: true,
+      esModuleInterop: true,
+      skipLibCheck: true,
+      forceConsistentCasingInFileNames: true,
+    },
+    include: ["index.ts", "models/**/*"],
+    exclude: ["node_modules", "dist"],
+  };
+}
+
 async function promptBackendLanguage(): Promise<BackendLanguage> {
   const response = await prompts({
     type: "select",
@@ -96,32 +196,56 @@ async function promptCiCd(): Promise<CiCdProvider> {
   return response.cicd || 'skip';
 }
 
-async function promptAzureConfig(): Promise<AzureConfig> {
-  const cosmosResponse = await prompts({
-    type: 'select',
-    name: 'mode',
-    message: 'Cosmos DB mode (affects cost):',
-    choices: [
-      { title: 'Free Tier (1000 RU/s free, best for first project)', value: 'freetier' },
-      { title: 'Serverless (pay-per-use, flexible)', value: 'serverless' }
-    ],
-    initial: 0
-  });
-
-  const vnetResponse = await prompts({
-    type: 'select',
-    name: 'vnet',
-    message: 'Network security:',
-    choices: [
-      { title: 'VNet Integration (recommended) - Cosmos DB via Private Endpoint', value: 'outbound' },
-      { title: 'None - Public endpoints, simplest but least secure', value: 'none' }
-    ],
-    initial: 0
-  });
+async function promptAzureConfig(options: InitOptions): Promise<AzureConfig> {
+  let swaPlan = options.swaPlan;
+  if (!swaPlan) {
+    const response = await prompts({
+      type: 'select',
+      name: 'plan',
+      message: 'Azure Static Web Apps plan:',
+      choices: [
+        { title: 'Standard (production, SLA and advanced auth/networking features)', value: 'standard' },
+        { title: 'Free (personal projects, no SLA and lower quotas)', value: 'free' }
+      ],
+      initial: 0
+    });
+    swaPlan = response.plan || 'standard';
+  }
+
+  let cosmosDbMode = options.cosmosDbMode;
+  if (!cosmosDbMode) {
+    const response = await prompts({
+      type: 'select',
+      name: 'mode',
+      message: 'Cosmos DB mode (affects cost):',
+      choices: [
+        { title: 'Free Tier (1000 RU/s free, best for first project)', value: 'freetier' },
+        { title: 'Serverless (pay-per-use, flexible)', value: 'serverless' }
+      ],
+      initial: 0
+    });
+    cosmosDbMode = response.mode || 'freetier';
+  }
+
+  let vnetOption = options.vnet;
+  if (!vnetOption) {
+    const response = await prompts({
+      type: 'select',
+      name: 'vnet',
+      message: 'Network security:',
+      choices: [
+        { title: 'VNet Integration (recommended) - Cosmos DB via Private Endpoint', value: 'outbound' },
+        { title: 'None - Public endpoints, simplest but least secure', value: 'none' }
+      ],
+      initial: 0
+    });
+    vnetOption = response.vnet || 'outbound';
+  }
 
   return {
-    cosmosDbMode: cosmosResponse.mode || 'freetier',
-    vnetOption: vnetResponse.vnet || 'outbound'
+    cosmosDbMode: cosmosDbMode || 'freetier',
+    vnetOption: vnetOption || 'outbound',
+    swaPlan: swaPlan || 'standard'
   };
 }
 
@@ -129,8 +253,12 @@ const VALID_CICD: CiCdProvider[] = ['github', 'azure', 'skip'];
 const VALID_BACKEND_LANGUAGE: BackendLanguage[] = ['typescript', 'csharp', 'python'];
 const VALID_COSMOS_DB_MODE: CosmosDbMode[] = ['freetier', 'serverless'];
 const VALID_VNET: VNetOption[] = ['none', 'outbound'];
+const VALID_SWA_PLAN: StaticWebAppPlan[] = ['free', 'standard'];
 
 function validateInitFlags(options: InitOptions): void {
+  if (options.packageManager && !['npm', 'pnpm'].includes(options.packageManager)) {
+    throw new Error('Invalid --package-manager: expected npm or pnpm');
+  }
   if (options.cicd && !VALID_CICD.includes(options.cicd)) {
     console.error(`❌ Invalid --cicd value: "${options.cicd}". Must be: ${VALID_CICD.join(', ')}`);
     process.exit(1);
@@ -147,6 +275,10 @@ function validateInitFlags(options: InitOptions): void {
     console.error(`❌ Invalid --vnet value: "${options.vnet}". Must be: ${VALID_VNET.join(', ')}`);
     process.exit(1);
   }
+  if (options.swaPlan && !VALID_SWA_PLAN.includes(options.swaPlan)) {
+    console.error(`❌ Invalid --swa-plan value: "${options.swaPlan}". Must be: ${VALID_SWA_PLAN.join(', ')}`);
+    process.exit(1);
+  }
 }
 
 export async function initCommand(options: InitOptions) {
@@ -157,7 +289,7 @@ export async function initCommand(options: InitOptions) {
   console.log(`📋 Template: ${options.template}`);
 
   // Detect package manager from invocation context (npx → npm, pnpm dlx → pnpm)
-  const pm: PackageManager = detectFromUserAgent();
+  const pm: PackageManager = options.packageManager || detectFromUserAgent();
   const pmCmd = getCommands(pm);
   console.log(`📦 Package manager: ${pm}`);
 
@@ -170,13 +302,30 @@ export async function initCommand(options: InitOptions) {
       process.exit(1);
     }
 
+    // 非対話環境でプロンプトに入るとハングするため、不足フラグを明示エラーで案内する
+    const interactive =
+      process.stdin.isTTY === true && process.stdout.isTTY === true && !process.env.CI;
+    if (!interactive) {
+      const missing: string[] = [];
+      if (!options.cicd) missing.push('--cicd <github|azure|skip>');
+      if (!options.backendLanguage) missing.push('--backend-language <typescript|csharp|python>');
+      if (!options.cosmosDbMode) missing.push('--cosmos-db-mode <freetier|serverless>');
+      if (!options.vnet) missing.push('--vnet <outbound|none>');
+      if (!options.swaPlan) missing.push('--swa-plan <free|standard>');
+      if (missing.length > 0) {
+        console.error(
+          `❌ Non-interactive environment detected. Pass all configuration flags to run init without prompts:\n` +
+            missing.map((flag) => `   ${flag}`).join('\n')
+        );
+        process.exit(1);
+      }
+    }
+
     // Use flag values if provided, otherwise prompt interactively
     const cicdProvider: CiCdProvider = options.cicd || await promptCiCd();
     const backendLanguage: BackendLanguage = options.backendLanguage || await promptBackendLanguage();
 
-    const azureConfig: AzureConfig = (options.cosmosDbMode && options.vnet)
-      ? { cosmosDbMode: options.cosmosDbMode, vnetOption: options.vnet }
-      : await promptAzureConfig();
+    const azureConfig = await promptAzureConfig(options);
 
     // Create Next.js project with create-next-app
     await createNextJsProject(options.name, pm);
@@ -197,6 +346,8 @@ export async function initCommand(options: InitOptions) {
       await createAzurePipelines(projectDir, pm, backendLanguage);
     }
 
+    await syncProjectManifest(projectDir);
+
     // Initialize Git repository and create initial commit
     try {
       // Try git init with -b main (Git 2.28+), fallback to git init
@@ -241,11 +392,11 @@ export async function initCommand(options: InitOptions) {
     console.log(`\n✅ Project "${options.name}" created successfully!`);
     console.log("\n📝 Next steps:");
     console.log(`  cd ${options.name}`);
-    console.log(`  ${pmCmd.dlx} swallowkit create-model <name>  # Create your first model`);
-    console.log(`  ${pmCmd.dlx} swallowkit scaffold shared/models/<name>.ts  # Generate CRUD code`);
-    console.log(`  ${pmCmd.dlx} swallowkit dev  # Start development servers`);
+    console.log(`  ${pmCmd.exec} swallowkit create-model <name>  # Create your first model`);
+    console.log(`  ${pmCmd.exec} swallowkit scaffold shared/models/<name>.ts  # Generate CRUD code`);
+    console.log(`  ${pmCmd.exec} swallowkit dev  # Start development servers`);
     console.log("\n🚀 Deploy to Azure:");
-    console.log(`  ${pmCmd.dlx} swallowkit provision --resource-group <name>`);
+    console.log(`  ${pmCmd.exec} swallowkit provision --resource-group <name>`);
     if (cicdProvider !== 'skip') {
       console.log("  Configure CI/CD secrets and push to repository");
     }
@@ -269,7 +420,7 @@ async function createNextJsProject(projectName: string, pm: PackageManager): Pro
     //             for npm use "npx create-next-app@latest ..."
     const baseArgs = pm === 'pnpm'
       ? ['dlx', 'create-next-app@latest']
-      : ['create-next-app@latest'];
+      : ['--yes', '--package', 'create-next-app@latest', '--', 'create-next-app'];
     
     const args = [
       ...baseArgs,
@@ -279,6 +430,7 @@ async function createNextJsProject(projectName: string, pm: PackageManager): Pro
       '--app',
       '--no-src',
       '--disable-git',
+      '--skip-install',
       '--import-alias',
       '@/*',
       ...(pmCmd.createNextAppFlag ? [pmCmd.createNextAppFlag] : []),
@@ -311,84 +463,211 @@ async function createNextJsProject(projectName: string, pm: PackageManager): Pro
 }
 
 async function upgradeNextJs(projectDir: string, version: string, pm: PackageManager): Promise<void> {
-  return new Promise((resolve, reject) => {
-    console.log(`\n📦 Installing Next.js ${version} (to ensure latest security patches)...\n`);
-    
-    // pnpm: pnpm add next@... ; npm: npm install next@...
-    const args = pm === 'pnpm'
-      ? ['add', `next@${version}`, `react@latest`, `react-dom@latest`, '--save-exact']
-      : ['install', `next@${version}`, `react@latest`, `react-dom@latest`, '--save-exact'];
+  console.log(`\n📦 Installing Next.js ${version} (to ensure latest security patches)...\n`);
 
-    const child = spawn(
-      pm,
-      args,
-      {
-        cwd: projectDir,
-        stdio: 'inherit',
-        shell: true,
-      }
-    );
+  // pnpm: pnpm add next@... ; npm: npm install next@...
+  const args = pm === 'pnpm'
+    ? ['add', `next@${version}`, `react@latest`, `react-dom@latest`, '--save-exact', '--lockfile-only']
+    : ['install', `next@${version}`, `react@latest`, `react-dom@latest`, '--save-exact', '--package-lock-only'];
 
-    child.on('close', (code: number | null) => {
-      if (code !== 0) {
-        reject(new Error(`${pm} add next@${version} exited with code ${code}`));
-      } else {
-        console.log(`\n✅ Next.js ${version} installed\n`);
-        resolve();
-      }
-    });
+  await runPackageManagerCommand(pm, args, projectDir, `${pm} add next@${version}`);
 
-    child.on('error', (error: Error) => {
-      reject(error);
-    });
-  });
+  console.log(`\n✅ Next.js ${version} installed\n`);
 }
 
 async function installDependencies(projectDir: string, pm: PackageManager = 'pnpm'): Promise<void> {
-  return new Promise((resolve, reject) => {
-    console.log('\n📦 Installing dependencies...\n');
-    
-    const child = spawn(
-      pm,
-      ['install'],
-      {
-        cwd: projectDir,
-        stdio: 'inherit',
-        shell: true,
+  console.log('\n📦 Installing dependencies...\n');
+  await runPackageManagerCommand(pm, pm === 'pnpm' ? ['install', '--no-frozen-lockfile'] : ['install'], projectDir, `${pm} install`);
+
+  console.log('\n✅ Dependencies installed\n');
+}
+
+type PackageJson = {
+  dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
+  optionalDependencies?: Record<string, string>;
+  [key: string]: unknown;
+};
+
+export async function withNpmLockfileSafeManifests(projectDir: string, action: () => Promise<void>): Promise<void> {
+  const packageJsonPath = path.join(projectDir, 'package.json');
+  const functionsPackageJsonPath = path.join(projectDir, 'functions', 'package.json');
+  const sharedPackageJsonPath = path.join(projectDir, 'shared', 'package.json');
+  const originalFiles = new Map<string, string>();
+  const hiddenNodeModules = new Map<string, string>();
+
+  function rememberOriginal(filePath: string): void {
+    if (!originalFiles.has(filePath)) {
+      originalFiles.set(filePath, fs.readFileSync(filePath, 'utf-8'));
+    }
+  }
+
+  function readJson(filePath: string): PackageJson {
+    return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+  }
+
+  function writeJson(filePath: string, value: PackageJson): void {
+    fs.writeFileSync(filePath, JSON.stringify(value, null, 2));
+  }
+
+  const sharedPackageName = fs.existsSync(sharedPackageJsonPath)
+    ? (readJson(sharedPackageJsonPath).name as string | undefined)
+    : undefined;
+
+  function replaceSharedWorkspaceDependency(packageJson: PackageJson, replacement: string): boolean {
+    let changed = false;
+
+    for (const section of ['dependencies', 'devDependencies', 'optionalDependencies'] as const) {
+      const dependencies = packageJson[section];
+      if (!dependencies) continue;
+
+      for (const [name, version] of Object.entries(dependencies)) {
+        if (version.startsWith('workspace:') && (name === sharedPackageName || name.endsWith('/shared'))) {
+          dependencies[name] = replacement;
+          changed = true;
+        }
       }
-    );
+    }
 
-    child.on('close', (code: number | null) => {
-      if (code !== 0) {
-        reject(new Error(`${pm} install exited with code ${code}`));
-      } else {
-        console.log('\n✅ Dependencies installed\n');
-        resolve();
+    return changed;
+  }
+
+  function normalizePackageJson(filePath: string, replacement: string): void {
+    if (!fs.existsSync(filePath)) return;
+
+    const packageJson = readJson(filePath);
+    if (!replaceSharedWorkspaceDependency(packageJson, replacement)) return;
+
+    rememberOriginal(filePath);
+    writeJson(filePath, packageJson);
+  }
+
+  function hideNodeModules(directory: string): void {
+    const nodeModulesPath = path.join(directory, 'node_modules');
+    if (!fs.existsSync(nodeModulesPath)) return;
+
+    const hiddenPath = path.join(directory, `.node_modules.swallowkit-npm-lockfile-${process.pid}`);
+    fs.renameSync(nodeModulesPath, hiddenPath);
+    hiddenNodeModules.set(nodeModulesPath, hiddenPath);
+  }
+
+  try {
+    normalizePackageJson(packageJsonPath, 'file:shared');
+    normalizePackageJson(functionsPackageJsonPath, 'file:../shared');
+    hideNodeModules(projectDir);
+    hideNodeModules(path.join(projectDir, 'shared'));
+    hideNodeModules(path.join(projectDir, 'functions'));
+    await action();
+  } finally {
+    for (const [nodeModulesPath, hiddenPath] of hiddenNodeModules) {
+      if (fs.existsSync(nodeModulesPath)) {
+        fs.rmSync(nodeModulesPath, { recursive: true, force: true });
       }
-    });
+      fs.renameSync(hiddenPath, nodeModulesPath);
+    }
 
-    child.on('error', (error: Error) => {
-      reject(error);
+    for (const [filePath, content] of originalFiles) {
+      fs.writeFileSync(filePath, content);
+    }
+  }
+}
+
+/** Run installs without changing the project security policy. */
+async function runPackageManagerCommand(
+  pm: PackageManager,
+  args: string[],
+  projectDir: string,
+  label: string,
+): Promise<void> {
+  const { code, output } = await spawnAndCapture(pm, args, projectDir, pm === 'pnpm');
+
+  if (code === 0) return;
+
+  if (pm === 'pnpm') {
+    if (parseIgnoredBuilds(output).length > 0) {
+      throw new Error(
+        `${label} exited with code ${code}: pnpm still reports unapproved build scripts. ` +
+          'Review the named dependencies and project security policy before allowing any scripts. SwallowKit does not auto-approve them.'
+      );
+    }
+  }
+
+  throw new Error(`${label} exited with code ${code}`);
+}
+
+/**
+ * Spawn a child process inheriting stdin (so interactive prompts still work)
+ * while either inheriting or capturing+teeing stdout/stderr.
+ */
+function spawnAndCapture(
+  pm: PackageManager,
+  args: string[],
+  projectDir: string,
+  capture: boolean,
+): Promise<{ code: number; output: string }> {
+  return new Promise((resolve, reject) => {
+    const stdio: ('inherit' | 'pipe')[] = capture
+      ? ['inherit', 'pipe', 'pipe']
+      : ['inherit', 'inherit', 'inherit'];
+
+    const child = spawn(pm, args, {
+      cwd: projectDir,
+      stdio,
+      shell: true,
     });
+
+    let combined = '';
+    if (capture) {
+      child.stdout?.on('data', (chunk: Buffer) => {
+        process.stdout.write(chunk);
+        combined += chunk.toString('utf8');
+      });
+      child.stderr?.on('data', (chunk: Buffer) => {
+        process.stderr.write(chunk);
+        combined += chunk.toString('utf8');
+      });
+    }
+
+    child.on('close', (code) => resolve({ code: code ?? 0, output: combined }));
+    child.on('error', reject);
   });
 }
 
+/**
+ * Parse pnpm's `Ignored build scripts: foo@1.0.0, bar@2.0.0` warning/error and
+ * return the bare package names (without versions), de-duplicated.
+ */
+export function parseIgnoredBuilds(output: string): string[] {
+  const match = output.match(/Ignored build scripts:\s*([^\n\r]+)/i);
+  if (!match) return [];
+  const list = match[1]
+    .split(',')
+    .map((entry) => entry.trim())
+    // strip version suffix: `sharp@0.34.5` -> `sharp`, `@scope/pkg@1.0.0` -> `@scope/pkg`
+    .map((entry) => entry.replace(/@[^@]+$/, ''))
+    .filter((name) => name.length > 0);
+  return Array.from(new Set(list));
+}
+
 export function injectSwallowKitNextConfig(nextConfigContent: string, projectName: string): string {
   return nextConfigContent.replace(
     /(const\s+nextConfig[:\s]*(?::\s*NextConfig\s*)?=\s*\{)(\s*\/\*[^*]*\*\/)?/,
-    `$1\n  output: 'standalone',\n  transpilePackages: ['@${projectName}/shared'],\n  serverExternalPackages: ['applicationinsights', 'diagnostic-channel-publishers'],$2`
+    `$1\n  output: 'standalone',\n  agentRules: false, // SwallowKit owns the canonical root AGENTS.md contract\n  transpilePackages: ['@${projectName}/shared'],\n  serverExternalPackages: ['applicationinsights', 'diagnostic-channel-publishers'],$2`
   );
 }
 
 export function buildCSharpFunctionsProgramSource(): string {
-  return `using Microsoft.Extensions.DependencyInjection;
+  return `using Microsoft.Azure.Functions.Worker;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
+using Microsoft.Azure.Functions.Worker.ApplicationInsights;
 
 var host = new HostBuilder()
     .ConfigureFunctionsWorkerDefaults()
     .ConfigureServices(services =>
     {
         services.AddApplicationInsightsTelemetryWorkerService();
+        services.ConfigureFunctionsApplicationInsights();
     })
     .Build();
 
@@ -399,7 +678,7 @@ host.Run();
 export function buildCSharpFunctionsProjectSource(): string {
   return `<Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <AzureFunctionsVersion>v4</AzureFunctionsVersion>
     <OutputType>Exe</OutputType>
     <ImplicitUsings>enable</ImplicitUsings>
@@ -413,17 +692,97 @@ export function buildCSharpFunctionsProjectSource(): string {
   <ItemGroup>
     <PackageReference Include="Microsoft.Azure.Cosmos" Version="3.47.0" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
-    <PackageReference Include="Azure.Identity" Version="1.13.2" />
-    <PackageReference Include="Microsoft.Azure.Functions.Worker" Version="1.23.0" />
-    <PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http" Version="3.2.0" />
-    <PackageReference Include="Microsoft.Azure.Functions.Worker.Sdk" Version="1.18.0" OutputItemType="Analyzer" />
+    <PackageReference Include="Azure.Identity" Version="1.17.0" />
+    <PackageReference Include="Microsoft.Azure.Functions.Worker" Version="2.52.0" />
+    <PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http" Version="3.3.0" />
+    <PackageReference Include="Microsoft.Azure.Functions.Worker.Sdk" Version="2.0.7" OutputItemType="Analyzer" />
     <PackageReference Include="Microsoft.ApplicationInsights.WorkerService" Version="2.22.0" />
-    <PackageReference Include="Microsoft.Azure.Functions.Worker.ApplicationInsights" Version="1.2.0" />
+    <PackageReference Include="Microsoft.Azure.Functions.Worker.ApplicationInsights" Version="2.50.0" />
   </ItemGroup>
 </Project>
 `;
 }
 
+export function buildSwallowKitConfigSource(backendLanguage: BackendLanguage): string {
+  return `module.exports = {
+  backend: {
+    language: '${backendLanguage}',
+  },
+  functions: {
+    baseUrl: process.env.BACKEND_FUNCTIONS_BASE_URL || process.env.FUNCTIONS_BASE_URL || 'http://localhost:7071',
+  },
+  deployment: {
+    resourceGroup: process.env.AZURE_RESOURCE_GROUP || '',
+    swaName: process.env.AZURE_SWA_NAME || '',
+  },
+}
+`;
+}
+
+export function buildGeneratedProjectDependencies(
+  projectName: string,
+  pm: PackageManager = 'pnpm',
+): Record<string, string> {
+  return {
+    '@azure/cosmos': '^4.0.0',
+    'applicationinsights': '^3.3.0',
+    'zod': '^4.0.0',
+    [`@${projectName}/shared`]: pm === 'pnpm' ? 'workspace:*' : 'file:shared',
+  };
+}
+
+function getSwallowKitPackageMetadata(): { name: string; version: string } {
+  const packageJsonPath = path.resolve(__dirname, "..", "..", "..", "package.json");
+
+  try {
+    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8")) as {
+      name?: string;
+      version?: string;
+    };
+
+    return {
+      name: packageJson.name || "swallowkit",
+      version: packageJson.version || "latest",
+    };
+  } catch {
+    // Fall back to the published package name when package metadata is unavailable.
+  }
+
+  return {
+    name: "swallowkit",
+    version: "latest",
+  };
+}
+
+export function buildGeneratedProjectDevDependencies(): Record<string, string> {
+  const { name, version } = getSwallowKitPackageMetadata();
+  return {
+    [name]: version,
+  };
+}
+
+export function buildSwallowKitMcpProjectConfigSource(pm: PackageManager = 'pnpm'): string {
+  const { name } = getSwallowKitPackageMetadata();
+  return JSON.stringify(
+    {
+      mcpServers: {
+        swallowkit: {
+          command: pm === 'pnpm' ? 'pnpm' : 'npx',
+          args: pm === 'pnpm'
+            ? ["dlx", "--package", `${name}@\${SWALLOWKIT_MCP_VERSION}`, "swallowkit-mcp"]
+            : ["--yes", "--package", `${name}@\${SWALLOWKIT_MCP_VERSION}`, "swallowkit-mcp"],
+          cwd: ".",
+          env: {
+            SWALLOWKIT_MCP_VERSION: "latest",
+          },
+        },
+      },
+    },
+    null,
+    2
+  );
+}
+
 async function addSwallowKitFiles(
   projectDir: string,
   options: InitOptions,
@@ -436,27 +795,20 @@ async function addSwallowKitFiles(
   
   const projectName = options.name;
 
-  // 1. Update package.json to add swallowkit and @azure/cosmos dependencies
+  // 1. Update package.json to add runtime dependencies for generated projects
   const packageJsonPath = path.join(projectDir, 'package.json');
   const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
   
-  // Add SwallowKit dependencies (Next.js version already upgraded by upgradeNextJs)
-  // zod is in the shared workspace package, not here
+  // Root BFF/auth code imports Zod directly; declare it as well as the shared package.
   packageJson.dependencies = {
     ...packageJson.dependencies,
-    'swallowkit': 'latest',
-    '@azure/cosmos': '^4.0.0',
-    'applicationinsights': '^3.3.0',
-    [`@${projectName}/shared`]: '*',
+    ...buildGeneratedProjectDependencies(projectName, pm),
+  };
+  packageJson.devDependencies = {
+    ...packageJson.devDependencies,
+    ...buildGeneratedProjectDevDependencies(),
   };
 
-  if (backendLanguage !== "typescript") {
-    packageJson.devDependencies = {
-      ...packageJson.devDependencies,
-      '@openapitools/openapi-generator-cli': '^2.21.0',
-    };
-  }
-  
   packageJson.scripts = {
     ...packageJson.scripts,
     'build': getBuildScript(pm),
@@ -464,28 +816,27 @@ async function addSwallowKitFiles(
     'functions:start': getFunctionsStartScript(pm, backendLanguage),
   };
 
-  if (pm === 'pnpm') {
-    packageJson.packageManager = 'pnpm@latest';
-  }
-  
   packageJson.engines = {
-    node: '20.x',
+    node: '>=22.14.0',
+    ...(pm === 'pnpm' ? { pnpm: '>=11 <13' } : {}),
   };
+  packageJson.devEngines = {
+    packageManager: { name: pm, version: pm === 'pnpm' ? '>=11 <13' : '>=10', onFail: 'error' },
+  };
+  delete packageJson.packageManager;
 
-  // Workspace configuration depends on package manager
+  // Keep package.json workspaces for npm-based CI/CD even when local development uses pnpm.
   const workspacePackages = usesNodeFunctionsProject(backendLanguage) ? ['shared', 'functions'] : ['shared'];
   const wsConfig = getWorkspaceConfig(pm, workspacePackages);
-  if (wsConfig.type === 'file') {
-    // pnpm: workspaces are defined in pnpm-workspace.yaml
-    delete packageJson.workspaces;
-  } else {
-    // npm: workspaces are defined in package.json
+  packageJson.workspaces = workspacePackages;
+
+  if (wsConfig.type !== 'file') {
     packageJson.workspaces = wsConfig.value;
   }
   
   fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2));
 
-  // Create workspace config file if needed (pnpm-workspace.yaml)
+  // Create pnpm-workspace.yaml for local pnpm development when needed.
   if (wsConfig.type === 'file') {
     fs.writeFileSync(path.join(projectDir, wsConfig.filename), wsConfig.content);
   }
@@ -526,20 +877,7 @@ async function addSwallowKitFiles(
   }
 
   // 3. Create SwallowKit config
-  const swallowkitConfig = `/** @type {import('swallowkit').SwallowKitConfig} */
-module.exports = {
-  backend: {
-    language: '${backendLanguage}',
-  },
-  functions: {
-    baseUrl: process.env.BACKEND_FUNCTIONS_BASE_URL || process.env.FUNCTIONS_BASE_URL || 'http://localhost:7071',
-  },
-  deployment: {
-    resourceGroup: process.env.AZURE_RESOURCE_GROUP || '',
-    swaName: process.env.AZURE_SWA_NAME || '',
-  },
-}
-`;
+  const swallowkitConfig = buildSwallowKitConfigSource(backendLanguage);
   fs.writeFileSync(path.join(projectDir, 'swallowkit.config.js'), swallowkitConfig);
 
   // 4. Create shared workspace package for Zod models (Single Source of Truth)
@@ -558,6 +896,13 @@ function getFunctionsBaseUrl(): string {
   return process.env.BACKEND_FUNCTIONS_BASE_URL || process.env.FUNCTIONS_BASE_URL || 'http://localhost:7071';
 }
 
+function getFunctionsKeyHeaders(functionsBaseUrl: string): Record<string, string> {
+  const key = process.env.BACKEND_FUNCTIONS_KEY;
+  if (key) return { 'x-functions-key': key };
+  if (functionsBaseUrl.startsWith('http://localhost:') || functionsBaseUrl.startsWith('http://127.0.0.1:')) return {};
+  throw new Error('BACKEND_FUNCTIONS_KEY is required for non-local Functions calls');
+}
+
 /**
  * Simple HTTP client for calling backend APIs
  * Use this to make requests to BFF API routes (which forward to Azure Functions)
@@ -565,10 +910,11 @@ function getFunctionsBaseUrl(): string {
 async function request<T>(
   endpoint: string,
   method: 'GET' | 'POST' | 'PUT' | 'DELETE',
-  body?: any,
+  body?: unknown,
   queryParams?: Record<string, string>
 ): Promise<T> {
   const functionsBaseUrl = getFunctionsBaseUrl();
+  const keyHeaders = getFunctionsKeyHeaders(functionsBaseUrl);
   let url = \`\${functionsBaseUrl}\${endpoint}\`;
   if (queryParams) {
     const params = new URLSearchParams(queryParams);
@@ -580,6 +926,7 @@ async function request<T>(
       method,
       headers: {
         'Content-Type': 'application/json',
+        ...keyHeaders,
       },
       body: body ? JSON.stringify(body) : undefined,
     });
@@ -635,14 +982,14 @@ export const api = {
   /**
    * Make a POST request
    */
-  post: <T>(endpoint: string, body?: any): Promise<T> => {
+  post: <T>(endpoint: string, body?: unknown): Promise<T> => {
     return request<T>(endpoint, 'POST', body);
   },
 
   /**
    * Make a PUT request
    */
-  put: <T>(endpoint: string, body?: any): Promise<T> => {
+  put: <T>(endpoint: string, body?: unknown): Promise<T> => {
     return request<T>(endpoint, 'PUT', body);
   },
 
@@ -663,6 +1010,7 @@ export const api = {
   // 6. Create .env.example
   const envExample = `# Azure Functions Backend URL
 BACKEND_FUNCTIONS_BASE_URL=http://localhost:7071
+BACKEND_FUNCTIONS_KEY=
 
 # Azure Configuration
 AZURE_RESOURCE_GROUP=your-resource-group
@@ -702,7 +1050,7 @@ export async function register() {
       const originalConsoleError = console.error;
       const originalConsoleWarn = console.warn;
       
-      console.log = function(...args: any[]) {
+      console.log = function(...args: unknown[]) {
         originalConsoleLog.apply(console, args);
         const message = args.map(arg => 
           typeof arg === 'object' ? JSON.stringify(arg) : String(arg)
@@ -713,7 +1061,7 @@ export async function register() {
         });
       };
       
-      console.error = function(...args: any[]) {
+      console.error = function(...args: unknown[]) {
         originalConsoleError.apply(console, args);
         const message = args.map(arg => 
           typeof arg === 'object' ? JSON.stringify(arg) : String(arg)
@@ -724,7 +1072,7 @@ export async function register() {
         });
       };
       
-      console.warn = function(...args: any[]) {
+      console.warn = function(...args: unknown[]) {
         originalConsoleWarn.apply(console, args);
         const message = args.map(arg => 
           typeof arg === 'object' ? JSON.stringify(arg) : String(arg)
@@ -748,6 +1096,7 @@ export async function register() {
   const envLocalContent = [
     '# Azure Functions Backend URL (Local)',
     'BACKEND_FUNCTIONS_BASE_URL=http://localhost:7071',
+    'BACKEND_FUNCTIONS_KEY=',
     ''
   ].join('\n');
   fs.writeFileSync(path.join(projectDir, '.env.local'), envLocalContent);
@@ -796,7 +1145,7 @@ export async function register() {
   createReadme(projectDir, projectName, cicdChoice, azureConfig, pm, backendLanguage);
 
   // 19. Create AI agent instruction files (AGENTS.md, CLAUDE.md, .github/copilot-instructions.md, etc.)
-  createAiAgentFiles(projectDir, projectName, backendLanguage);
+  createAiAgentFiles(projectDir, projectName, backendLanguage, pm);
 }
 
 async function createSharedPackage(projectDir: string, projectName: string) {
@@ -808,6 +1157,7 @@ async function createSharedPackage(projectDir: string, projectName: string) {
 
   // shared/package.json
   const sharedPackageJson = {
+    private: true,
     name: `@${projectName}/shared`,
     version: '1.0.0',
     description: 'Shared Zod models — Single Source of Truth for validation schemas',
@@ -830,28 +1180,9 @@ async function createSharedPackage(projectDir: string, projectName: string) {
   );
 
   // shared/tsconfig.json
-  const sharedTsConfig = {
-    compilerOptions: {
-      target: 'ES2020',
-      module: 'commonjs',
-      moduleResolution: 'node',
-      lib: ['ES2020'],
-      outDir: 'dist',
-      rootDir: '.',
-      declaration: true,
-      declarationMap: true,
-      sourceMap: true,
-      strict: true,
-      esModuleInterop: true,
-      skipLibCheck: true,
-      forceConsistentCasingInFileNames: true,
-    },
-    include: ['index.ts', 'models/**/*'],
-    exclude: ['node_modules', 'dist'],
-  };
   fs.writeFileSync(
     path.join(sharedDir, 'tsconfig.json'),
-    JSON.stringify(sharedTsConfig, null, 2)
+    JSON.stringify(buildSharedTsConfig(), null, 2)
   );
 
   // shared/index.ts (empty re-export file, scaffold will add entries)
@@ -945,8 +1276,9 @@ tsconfig.json
 !dist/**/*.js
 `);
   } else if (backendLanguage === 'python') {
-    gitignoreLines.unshift('.venv', '__pycache__', '.python_packages');
+    gitignoreLines.unshift('.venv', '.codegen-venv', '__pycache__', '.python_packages');
     fs.writeFileSync(path.join(functionsDir, '.funcignore'), `.venv
+.codegen-venv
 __pycache__
 .pytest_cache
 .mypy_cache
@@ -966,8 +1298,8 @@ tests
   fs.writeFileSync(path.join(functionsDir, '.gitignore'), `${gitignoreLines.join('\n')}\n`);
 }
 
-function createTypeScriptFunctionsProject(projectDir: string, functionsDir: string, pm: PackageManager): void {
-  const functionsPackageJson = {
+export function buildTypeScriptFunctionsPackageJson(projectName: string, pm: PackageManager = 'pnpm') {
+  return {
     name: 'functions',
     version: '1.0.0',
     description: 'Azure Functions backend',
@@ -982,13 +1314,17 @@ function createTypeScriptFunctionsProject(projectDir: string, functionsDir: stri
       '@azure/cosmos': '^4.0.0',
       '@azure/identity': '^4.0.0',
       zod: '>=3.25.0',
-      [`@${path.basename(projectDir)}/shared`]: '*',
+      [`@${projectName}/shared`]: pm === 'pnpm' ? 'workspace:*' : 'file:../shared',
     },
     devDependencies: {
       '@types/node': '^20.0.0',
       typescript: '^5.0.0',
     },
   };
+}
+
+function createTypeScriptFunctionsProject(projectDir: string, functionsDir: string, pm: PackageManager): void {
+  const functionsPackageJson = buildTypeScriptFunctionsPackageJson(path.basename(projectDir), pm);
   fs.writeFileSync(path.join(functionsDir, 'package.json'), JSON.stringify(functionsPackageJson, null, 2));
 
   const sharedPkgName = `@${path.basename(projectDir)}/shared`;
@@ -1061,7 +1397,7 @@ export async function greet(request: HttpRequest, context: InvocationContext): P
 
 app.http('greet', {
   methods: ['GET', 'POST'],
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: greet
 });
 `);
@@ -1073,6 +1409,11 @@ function createCSharpFunctionsProject(projectDir: string, functionsDir: string):
   const csprojName = `${projectPascal}.Functions.csproj`;
 
   fs.writeFileSync(path.join(functionsDir, csprojName), buildCSharpFunctionsProjectSource());
+  fs.mkdirSync(path.join(functionsDir, '.config'), { recursive: true });
+  fs.writeFileSync(
+    path.join(functionsDir, '.config', 'dotnet-tools.json'),
+    buildCSharpCodegenToolManifestSource()
+  );
 
   fs.writeFileSync(path.join(functionsDir, 'Program.cs'), buildCSharpFunctionsProgramSource());
 
@@ -1088,7 +1429,7 @@ public sealed class GreetFunction
 {
     [Function("greet")]
     public async Task<HttpResponseData> Run(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", "post", Route = "greet")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = "greet")] HttpRequestData request)
     {
         var query = request.Url.Query.TrimStart('?').Split('&', StringSplitOptions.RemoveEmptyEntries);
         var name = "SwallowKit";
@@ -1115,11 +1456,16 @@ public sealed class GreetFunction
 
 function createPythonFunctionsProject(projectDir: string, functionsDir: string): void {
   fs.writeFileSync(path.join(projectDir, '.python-version'), '3.11\n');
+  ensureProjectGitignoreEntry(projectDir, '.uv');
 
   fs.writeFileSync(path.join(functionsDir, 'requirements.txt'), `azure-functions>=1.20.0
 azure-cosmos>=4.9.0
 azure-identity>=1.19.0
 `);
+  fs.writeFileSync(
+    path.join(functionsDir, 'requirements.codegen.txt'),
+    buildPythonCodegenRequirementsSource()
+  );
 
   const blueprintsDir = path.join(functionsDir, 'blueprints');
   fs.mkdirSync(blueprintsDir, { recursive: true });
@@ -1151,13 +1497,29 @@ def greet(req: func.HttpRequest) -> func.HttpResponse:
 
 from blueprints.greet import bp as greet_bp
 
-app = func.FunctionApp(http_auth_level=func.AuthLevel.ANONYMOUS)
+app = func.FunctionApp(http_auth_level=func.AuthLevel.FUNCTION)
 
 app.register_blueprint(greet_bp)
 # SwallowKit scaffold registrations
 `);
 }
 
+function ensureProjectGitignoreEntry(projectDir: string, entry: string): void {
+  const gitignorePath = path.join(projectDir, '.gitignore');
+  if (!fs.existsSync(gitignorePath)) {
+    return;
+  }
+
+  const current = fs.readFileSync(gitignorePath, 'utf8');
+  const lines = current.split(/\r?\n/);
+  if (lines.includes(entry)) {
+    return;
+  }
+
+  const normalized = current.endsWith('\n') ? current : `${current}\n`;
+  fs.writeFileSync(gitignorePath, `${normalized}${entry}\n`);
+}
+
 async function createBffApiRoute(projectDir: string) {
   console.log('📦 Creating BFF API route...\n');
   
@@ -1328,7 +1690,7 @@ export default function Home() {
                 Create your first model with Zod and generate CRUD operations automatically.
               </p>
               <code className="block bg-gray-100 dark:bg-gray-900 p-4 rounded text-left text-sm">
-                ${pmCmd.dlx} swallowkit scaffold shared/models/your-model.ts
+                ${pmCmd.exec} swallowkit scaffold shared/models/your-model.ts
               </code>
             </div>
           </section>
@@ -1388,17 +1750,18 @@ function createReadme(
   const backendLanguageLabel = getBackendLanguageLabel(backendLanguage);
   const schemaBridgeDescription = backendLanguage === 'typescript'
     ? 'Zod (shared between frontend and backend)'
-    : `Zod + OpenAPI bridge (Zod in shared/, generated ${backendLanguageLabel} schemas in functions/generated/)`;
+    : `Zod + OpenAPI export (Zod in shared/, native-generated ${backendLanguageLabel} schemas in functions/generated/)`;
   const functionsTree = backendLanguage === 'typescript'
     ? `│   └── src/\n│       └── greet.ts      # Sample function`
     : backendLanguage === 'csharp'
-      ? `│   ├── Crud/\n│   │   └── GreetFunction.cs\n│   └── generated/       # OpenAPI-derived C# models`
-      : `│   ├── blueprints/\n│   │   └── greet.py\n│   └── generated/       # OpenAPI-derived Python models`;
+      ? `│   ├── Crud/\n│   │   └── GreetFunction.cs\n│   └── generated/       # Native-generated C# schema assets`
+      : `│   ├── blueprints/\n│   │   └── greet.py\n│   └── generated/       # Native-generated Python schema assets`;
   const backendScaffoldNote = backendLanguage === 'typescript'
     ? '- Azure Functions CRUD endpoints'
-    : `- Azure Functions ${backendLanguageLabel} CRUD handlers\n- OpenAPI spec + generated ${backendLanguageLabel} schema assets`;
+    : `- Azure Functions ${backendLanguageLabel} CRUD handlers\n- OpenAPI export + native-generated ${backendLanguageLabel} schema assets`;
+  const pythonUvPaths = getProjectLocalUvPaths(projectDir);
   const pythonLocalDevNote = backendLanguage === 'python'
-    ? `\n**Python local dev note**: SwallowKit uses \`functions/.venv\` for local Azure Functions development. If \`uv\` is installed, \`swallowkit dev\` uses it to create/manage that virtual environment; otherwise it falls back to the standard \`venv\` + \`pip\` workflow. Keep \`functions/requirements.txt\` as the dependency source of truth for Azure Functions compatibility.\n`
+    ? `\n**Python local dev note**: SwallowKit uses \`uv\` for Python backends and keeps the managed Python runtime under \`${path.relative(projectDir, pythonUvPaths.pythonInstallDir)}\`. Local Azure Functions runs from \`functions/.venv\`, schema generation uses \`functions/.codegen-venv\`, and \`swallowkit dev\` bootstraps a project-local \`uv\` binary automatically when needed. Keep \`functions/requirements.txt\` and \`functions/requirements.codegen.txt\` as the dependency sources of truth.\n`
     : '';
 
   const readme = `# ${projectName}
@@ -1428,7 +1791,7 @@ This project was initialized with the following settings:
 
 Before you begin, ensure you have the following installed:
 
-1. **Node.js 18+**: [Download](https://nodejs.org/)${pm === 'pnpm' ? `\n2. **pnpm**: \`corepack enable\` or \`npm install -g pnpm\`` : ''}
+1. **Node.js 22.14+**: [Download](https://nodejs.org/)${pm === 'pnpm' ? `\n2. **pnpm**: \`corepack enable\` or \`npm install -g pnpm\`` : ''}
 ${pm === 'pnpm' ? '3' : '2'}. **Azure CLI**: Required for provisioning Azure resources
    - Install: \`winget install Microsoft.AzureCLI\` (Windows)
    - Or: [Download](https://aka.ms/installazurecliwindows)
@@ -1436,7 +1799,7 @@ ${pm === 'pnpm' ? '4' : '3'}. **Azure Cosmos DB Emulator**: Required for local d
    - Windows: \`winget install Microsoft.Azure.CosmosEmulator\`
    - Or: [Download](https://aka.ms/cosmosdb-emulator)
    - Docker: \`docker pull mcr.microsoft.com/cosmosdb/linux/azure-cosmos-emulator\`
-${pm === 'pnpm' ? '6' : '5'}. **Azure Functions Core Tools**: Automatically installed with project dependencies
+${pm === 'pnpm' ? '6' : '5'}. **Azure Functions Core Tools v4**: Install separately for local Azure Functions execution
 
 ## 📁 Project Structure
 
@@ -1462,7 +1825,7 @@ ${functionsTree}
 Define your data model with Zod schema:
 
 \`\`\`bash
-${pmCmd.dlx} swallowkit create-model <model-name>
+${pmCmd.exec} swallowkit create-model <model-name>
 \`\`\`
 
 This creates a model file in \`shared/models/<model-name>.ts\`. Edit it to define your schema.
@@ -1472,7 +1835,7 @@ This creates a model file in \`shared/models/<model-name>.ts\`. Edit it to defin
 Generate complete CRUD operations (Functions, API routes, UI):
 
 \`\`\`bash
-${pmCmd.dlx} swallowkit scaffold shared/models/<model-name>.ts
+${pmCmd.exec} swallowkit scaffold shared/models/<model-name>.ts
 \`\`\`
 
 This generates:
@@ -1484,7 +1847,7 @@ ${backendScaffoldNote}
 ### 3. Start Development Servers
 
 \`\`\`bash
-${pmCmd.dlx} swallowkit dev
+${pmCmd.exec} swallowkit dev
 \`\`\`
 
 This starts:
@@ -1502,7 +1865,7 @@ ${pythonLocalDevNote}
 Create all required Azure resources using Bicep:
 
 \`\`\`bash
-${pmCmd.dlx} swallowkit provision --resource-group <rg-name>
+${pmCmd.exec} swallowkit provision --resource-group <rg-name>
 \`\`\`
 
 This creates:
@@ -1558,10 +1921,10 @@ func azure functionapp publish func-${projectName}
 
 ## 🔧 Available Commands
 
-- \`${pmCmd.dlx} swallowkit create-model <name>\` - Create a new data model
-- \`${pmCmd.dlx} swallowkit scaffold <model-file>\` - Generate CRUD code
-- \`${pmCmd.dlx} swallowkit dev\` - Start development servers
-- \`${pmCmd.dlx} swallowkit provision -g <rg-name>\` - Provision Azure resources
+- \`${pmCmd.exec} swallowkit create-model <name>\` - Create a new data model
+- \`${pmCmd.exec} swallowkit scaffold <model-file>\` - Generate CRUD code
+- \`${pmCmd.exec} swallowkit dev\` - Start development servers
+- \`${pmCmd.exec} swallowkit provision -g <rg-name>\` - Provision Azure resources
 ${azureConfig.vnetOption !== 'none' ? `
 ## 🔒 Network Security (VNet Configuration)
 
@@ -1610,448 +1973,79 @@ This project was generated by SwallowKit. If you encounter any issues or have su
   console.log('✅ README.md created\n');
 }
 
-function createAiAgentFiles(projectDir: string, projectName: string, backendLanguage: BackendLanguage) {
+function createAiAgentFiles(
+  projectDir: string,
+  projectName: string,
+  backendLanguage: BackendLanguage,
+  pm: PackageManager
+) {
   console.log('🤖 Creating AI agent instruction files...\n');
-  const backendLanguageLabel = getBackendLanguageLabel(backendLanguage);
-  const functionsStructureLine = backendLanguage === 'typescript'
-    ? `│   └── src/               # HTTP trigger handlers with Cosmos DB bindings`
-    : backendLanguage === 'csharp'
-      ? `│   ├── Crud/              # C# HTTP trigger handlers\n│   └── generated/         # OpenAPI-derived C# schema assets`
-      : `│   ├── blueprints/        # Python HTTP trigger handlers\n│   └── generated/         # OpenAPI-derived Python schema assets`;
-  const backendSchemaNote = backendLanguage === 'typescript'
-    ? `- The shared package (\`@${projectName}/shared\`) is consumed by both Next.js and Azure Functions as a workspace dependency.`
-    : `- The frontend/BFF source of truth stays in \`shared/models/\` as Zod schemas.\n- \`swallowkit scaffold\` exports OpenAPI into \`functions/openapi/\` and generates ${backendLanguageLabel} schema assets into \`functions/generated/\` for backend use.`;
-  const backendRulesNote = backendLanguage === 'typescript'
-    ? `- All CRUD operations and business logic live in \`functions/src/\`.\n- Use Azure Functions Cosmos DB **input/output bindings** (\`extraInputs\`/\`extraOutputs\`) for reads and writes.\n- Use the Cosmos DB SDK client directly **only** for delete operations (bindings do not support delete).\n- Validate all data against Zod schemas before writing to Cosmos DB.\n- The backend auto-generates \`id\` (UUID), \`createdAt\`, and \`updatedAt\` — never trust client-sent values for these fields.`
-    : `- All business logic lives in \`functions/\` and the generated handlers perform real Cosmos DB CRUD.\n- Keep Zod schemas in \`shared/models/\` as the source of truth.\n- Regenerate backend contracts with \`swallowkit scaffold shared/models/<name>.ts\` whenever a schema changes.\n- Use the generated OpenAPI-derived models in \`functions/generated/\` to keep backend contracts aligned.\n- The backend should still own \`id\`, \`createdAt\`, and \`updatedAt\`.`;
-
-  // ── 1. AGENTS.md (Codex / generic agents) ──────────────────────────
-
-  const agentsMd = `# AGENTS.md
-
-This project was generated by **SwallowKit**.
-All coding agents **must** follow the architecture and conventions described below.
-
-## Architecture Overview
-
-This is a full-stack application deployed on Azure with a TypeScript frontend/BFF and an Azure Functions backend in ${backendLanguageLabel}.
-
-\`\`\`
-Frontend (React / Next.js App Router)
-  ↓ fetch('/api/{model}', ...)
-BFF Layer (Next.js API Routes)
-  ↓ HTTP → Azure Functions
-Backend (Azure Functions)
-  ↓
-Azure Cosmos DB (Document Database)
-\`\`\`
-
-### Project Structure
-
-\`\`\`
-${projectName}/
-├── app/                    # Next.js App Router
-│   ├── api/               # BFF API routes (proxy to Azure Functions)
-│   └── {model}/           # UI pages per model (list, detail, create, edit)
-├── functions/             # Azure Functions (backend)
-${functionsStructureLine}
-├── shared/                # Shared workspace package
-│   ├── models/            # Zod schema definitions (single source of truth)
-│   └── index.ts           # Re-exports all models
-├── lib/
-│   └── api/               # API client utilities (backend.ts, call-function.ts)
-├── components/            # Shared React components
-├── infra/                 # Bicep infrastructure-as-code files
-│   ├── main.bicep
-│   └── modules/
-└── .github/workflows/     # CI/CD workflows (if configured)
-\`\`\`
-
-## Critical Design Principles
-
-### 1. Next.js API Routes Are Strictly a BFF (Backend for Frontend)
+  const runCmd = getCommands(pm).exec;
 
-- \`app/api/\` routes exist **only** to proxy requests to Azure Functions.
-- **Never** place business logic, database access, or direct Cosmos DB calls in Next.js API routes.
-- The BFF layer may validate input/output with Zod schemas before forwarding to Functions.
-- Use the \`callFunction\` helper (\`lib/api/call-function.ts\`) or the \`api\` client (\`lib/api/backend.ts\`) to call Azure Functions.
-
-Example BFF route pattern:
-
-\`\`\`typescript
-// app/api/{model}/route.ts
-import { callFunction } from '@/lib/api/call-function';
-import { ModelSchema } from '@${projectName}/shared';
-import { z } from 'zod/v4';
-
-export async function GET() {
-  return callFunction({
-    method: 'GET',
-    path: '/api/{model}',
-    responseSchema: z.array(ModelSchema),
-  });
-}
-
-export async function POST(request: NextRequest) {
-  const body = await request.json();
-  return callFunction({
-    method: 'POST',
-    path: '/api/{model}',
-    body,
-    inputSchema: ModelSchema.omit({ id: true, createdAt: true, updatedAt: true }),
-    responseSchema: ModelSchema,
-    successStatus: 201,
+  writeAgentInstructionFiles(projectDir, {
+    projectName,
+    backendLanguage,
+    packageManager: pm,
   });
-}
-\`\`\`
-
-### 2. Zod Schemas Are the Single Source of Truth
-
-- All data models are defined **once** as Zod schemas in \`shared/models/\`.
-- TypeScript types are derived with \`z.infer<typeof Schema>\` — never define types separately.
-- ${backendSchemaNote}
-
-Model definition pattern:
-
-\`\`\`typescript
-// shared/models/{model}.ts
-import { z } from 'zod/v4';
-
-export const Todo = z.object({
-  id: z.string(),
-  name: z.string().min(1),
-  // ... your fields
-  createdAt: z.string().optional(),
-  updatedAt: z.string().optional(),
-});
-
-export type Todo = z.infer<typeof Todo>;
-export const displayName = 'Todo';
-\`\`\`
-
-Key rules:
-- Use the **Zod official pattern**: the schema constant and the TypeScript type share the same name.
-- \`id\`, \`createdAt\`, and \`updatedAt\` are auto-managed by the backend. Mark them as \`optional()\` in the schema.
-- Always re-export models from \`shared/index.ts\`.
-
-### 3. Azure Functions Own All Business Logic and Data Access
-
-- ${backendRulesNote}
-
-${backendLanguage === 'typescript' ? 'Azure Functions handler pattern:' : `Generated ${backendLanguageLabel} handlers live under \`functions/\`. Re-run \`swallowkit scaffold shared/models/<name>.ts\` after schema changes to keep generated CRUD handlers and \`functions/generated/\` in sync.`}
-
-${backendLanguage === 'typescript' ? `\`\`\`typescript
-// functions/src/{model}.ts
-import { app } from '@azure/functions';
-import { ModelSchema } from '@${projectName}/shared';
-
-const containerName = 'Models'; // PascalCase + 's'
-
-app.http('{model}-get-all', {
-  methods: ['GET'],
-  route: '{model}',
-  authLevel: 'anonymous',
-  extraInputs: [{ type: 'cosmosDB', name: 'cosmosInput', containerName, ... }],
-  handler: async (request, context) => {
-    const documents = context.extraInputs.get('cosmosInput');
-    const validated = z.array(ModelSchema).parse(documents);
-    return { status: 200, jsonBody: validated };
-  },
-});
-\`\`\`` : ''}
-
-## Naming Conventions
-
-| Item | Convention | Example |
-|------|-----------|---------|
-| Model schema file | \`shared/models/{kebab-case}.ts\` | \`shared/models/todo.ts\` |
-| Schema/type name | PascalCase (same name for both) | \`export const Todo = z.object({...}); export type Todo = z.infer<typeof Todo>;\` |
-| Functions handler file | backend-language specific under \`functions/\` | \`${backendLanguage === 'typescript' ? 'functions/src/todo.ts' : backendLanguage === 'csharp' ? 'functions/Crud/TodoFunctions.cs' : 'functions/blueprints/todo.py'}\` |
-| Functions handler name | \`{camelCase}-{operation}\` | \`todo-get-all\`, \`todo-create\` |
-| API route path | \`/api/{camelCase}\` | \`/api/todo\`, \`/api/todo/{id}\` |
-| BFF route file | \`app/api/{kebab-case}/route.ts\` | \`app/api/todo/route.ts\` |
-| BFF detail route | \`app/api/{kebab-case}/[id]/route.ts\` | \`app/api/todo/[id]/route.ts\` |
-| UI page directory | \`app/{kebab-case}/\` | \`app/todo/page.tsx\` |
-| React component | PascalCase | \`TodoForm.tsx\` |
-| Cosmos DB container | PascalCase + 's' | \`Todos\` |
-| Cosmos DB partition key | \`/id\` | Always \`/id\` |
-| Bicep container file | \`infra/containers/{kebab-case}-container.bicep\` | \`infra/containers/todo-container.bicep\` |
-
-## Adding New Models (SwallowKit CLI Skills)
-
-Use the SwallowKit CLI — do **not** manually create model files or CRUD boilerplate.
-
-### Skill: Create a new data model
-
-\`\`\`bash
-npx swallowkit create-model <name>
-# Multiple models at once:
-npx swallowkit create-model user post comment
-\`\`\`
-
-Creates \`shared/models/<name>.ts\` with a Zod schema template including \`id\`, \`createdAt\`, \`updatedAt\`.
-Edit the generated file to add your domain-specific fields, then run scaffold.
-
-### Skill: Generate full CRUD from a model
-
-\`\`\`bash
-npx swallowkit scaffold shared/models/<name>.ts
-\`\`\`
-
-Generates:
-- Azure Functions handlers (${backendLanguage === 'typescript' ? '\`functions/src/<name>.ts\`' : '\`functions/\` language-specific CRUD files + \`functions/generated/\` schema assets'})
-- BFF API routes (\`app/api/<name>/route.ts\`, \`app/api/<name>/[id]/route.ts\`)
-- UI pages (\`app/<name>/page.tsx\`, detail, create, edit pages)
-- Cosmos DB Bicep container config (\`infra/containers/<name>-container.bicep\`)
-
-### Skill: Start development servers
-
-\`\`\`bash
-npx swallowkit dev
-\`\`\`
-
-Runs Next.js (http://localhost:3000) and Azure Functions (http://localhost:7071) concurrently.
-Checks for Cosmos DB Emulator availability.
-
-### Skill: Provision Azure resources
-
-\`\`\`bash
-npx swallowkit provision --resource-group <name> --location <region>
-\`\`\`
-
-Deploys Bicep infrastructure: Static Web Apps, Functions, Cosmos DB, Storage, Managed Identity.
-
-### Typical workflow for "add a new feature/model"
-
-1. \`npx swallowkit create-model <name>\`
-2. Edit \`shared/models/<name>.ts\` — add fields
-3. \`npx swallowkit scaffold shared/models/<name>.ts\`
-4. \`npx swallowkit dev\` — verify at http://localhost:3000/<name>
-
-## Do NOT
-
-- **Do not** put business logic or database calls in \`app/api/\` routes. They are BFF only.
-- **Do not** define TypeScript interfaces/types separately from Zod schemas. Always derive types with \`z.infer<>\`.
-- **Do not** manually duplicate model definitions across layers. Use the shared package.
-- **Do not** manually create CRUD boilerplate. Use \`swallowkit scaffold\`.
-- **Do not** hardcode Cosmos DB connection strings. Use Managed Identity (\`CosmosDBConnection__accountEndpoint\`) in production and emulator settings locally.
-- **Do not** change the partition key strategy. All containers use \`/id\` as the partition key.
-
-## Technology Stack
-
-- **Frontend**: Next.js (App Router), React, TypeScript, Tailwind CSS
-- **BFF**: Next.js API Routes (proxy only)
-- **Backend**: Azure Functions (${backendLanguageLabel})
-- **Database**: Azure Cosmos DB (NoSQL)
-- **Schema**: Zod (shared across all layers via workspace package)
-- **Infrastructure**: Bicep (IaC)
-- **Hosting**: Azure Static Web Apps (frontend) + Azure Functions Flex Consumption (backend)
-- **Auth**: Azure Managed Identity (no connection strings in production)
-- **Monitoring**: Application Insights
-`;
-
-  fs.writeFileSync(path.join(projectDir, 'AGENTS.md'), agentsMd);
-  console.log('  ✅ AGENTS.md (Codex / generic agents)');
-
-  // ── 2. CLAUDE.md (Claude Code) ─────────────────────────────────────
-
-  const claudeMd = `# CLAUDE.md
-
-This file is for Claude Code. Read AGENTS.md in the project root for the full architecture, conventions, and rules.
-
-## Quick Reference
-
-- **Architecture**: Next.js (frontend) → BFF (API routes, proxy only) → Azure Functions (backend) → Cosmos DB
-- **Schema**: Zod schemas in \`shared/models/\` are the single source of truth. Never define types separately.
-- **BFF rule**: \`app/api/\` routes must ONLY proxy to Azure Functions via \`callFunction()\`. No business logic.
-- **Backend language**: ${backendLanguageLabel}
-- **Backend rule**: Regenerate backend contracts with \`swallowkit scaffold\` after schema changes and keep \`functions/generated/\` in sync.
-
-## SwallowKit CLI Commands
-
-| Task | Command |
-|------|---------|
-| Create model | \`npx swallowkit create-model <name>\` |
-| Generate CRUD | \`npx swallowkit scaffold shared/models/<name>.ts\` |
-| Dev servers | \`npx swallowkit dev\` |
-| Provision Azure | \`npx swallowkit provision --resource-group <rg> --location <region>\` |
-
-## Workflow: Add a new model
-
-1. \`npx swallowkit create-model <name>\`
-2. Edit \`shared/models/<name>.ts\` — add your fields
-3. \`npx swallowkit scaffold shared/models/<name>.ts\`
-4. \`npx swallowkit dev\` — verify at http://localhost:3000/<name>
-`;
-
-  fs.writeFileSync(path.join(projectDir, 'CLAUDE.md'), claudeMd);
-  console.log('  ✅ CLAUDE.md (Claude Code)');
-
-  // ── 3. .github/copilot-instructions.md (GitHub Copilot) ────────────
-
-  const ghDir = path.join(projectDir, '.github');
-  fs.mkdirSync(ghDir, { recursive: true });
-
-  const copilotInstructions = `# Copilot Instructions
-
-This project was generated by **SwallowKit**. See \`AGENTS.md\` in the project root for the full specification.
-
-## Architecture (3-layer)
-
-\`\`\`
-Frontend (Next.js App Router) → BFF (Next.js API Routes) → Backend (Azure Functions) → Cosmos DB
-\`\`\`
-
-## Key Rules
-
-1. **BFF is proxy only** — \`app/api/\` routes call Azure Functions via \`callFunction()\`. No business logic, no direct DB access.
-2. **Zod = single source of truth** — Models live in \`shared/models/\`. Types are derived with \`z.infer<>\`. Never define types separately.
-3. **Backend owns data** — All CRUD and business logic stay in \`functions/\`, and generated contract assets under \`functions/generated/\` must stay aligned with \`shared/models/\`.
-4. **Use the CLI** — Run \`npx swallowkit create-model <name>\` then \`npx swallowkit scaffold shared/models/<name>.ts\` to add models. Do not create boilerplate manually.
-
-## Naming
-
-- Schema/type: PascalCase, same name for both (\`export const Todo = z.object({...}); export type Todo = z.infer<typeof Todo>;\`)
-- Files: kebab-case (\`shared/models/todo.ts\`, backend handlers under \`functions/\`)
-- Cosmos DB containers: PascalCase + 's' (\`Todos\`), partition key always \`/id\`
-
-## Managed Fields
-
-\`id\`, \`createdAt\`, \`updatedAt\` are auto-managed by the backend. Define them as \`optional()\` in schemas. Never trust client-sent values.
-`;
-
-  fs.writeFileSync(path.join(ghDir, 'copilot-instructions.md'), copilotInstructions);
-  console.log('  ✅ .github/copilot-instructions.md (GitHub Copilot)');
-
-  // ── 4. .github/instructions/*.instructions.md (Copilot layer-specific) ──
-
-  const instructionsDir = path.join(ghDir, 'instructions');
-  fs.mkdirSync(instructionsDir, { recursive: true });
-
-  // 4a. shared/models — Zod schema layer
-  const sharedModelsInstructions = `---
-applyTo: "shared/models/**"
----
-
-# Shared Models — Zod Schema Rules
-
-Files in this directory are the **single source of truth** for data models across the entire application.
-
-## Rules
-
-- Define Zod schemas using \`zod/v4\` (\`import { z } from 'zod/v4'\`).
-- Use the **Zod official pattern**: the schema constant and the TypeScript type share the same name.
-  \`\`\`typescript
-  export const Todo = z.object({ ... });
-  export type Todo = z.infer<typeof Todo>;
-  \`\`\`
-- Always include \`id: z.string()\`, \`createdAt: z.string().optional()\`, \`updatedAt: z.string().optional()\`. These are managed by the backend.
-- Export a \`displayName\` string constant for UI display.
-- Re-export every model from \`shared/index.ts\`.
-- For relationships, use **nested schemas** (import and embed the related schema), not ID references.
-- After editing a model, run \`npx swallowkit scaffold shared/models/<name>.ts\` to regenerate CRUD code.
-`;
+  console.log('  ✅ AGENTS.md (canonical project contract)');
+  console.log('  ✅ CLAUDE.md (Claude Code adapter)');
+  console.log('  ✅ .github/copilot-instructions.md (GitHub Copilot adapter)');
+  console.log('  ✅ .github/instructions/ (path-specific instructions)');
 
   fs.writeFileSync(
-    path.join(instructionsDir, 'shared-models.instructions.md'),
-    sharedModelsInstructions
+    path.join(projectDir, '.mcp.json'),
+    buildSwallowKitMcpProjectConfigSource(pm)
   );
+  console.log('  ✅ .mcp.json (project-scoped MCP bootstrap)');
 
-  // 4b. app/api — BFF layer
-  const bffInstructions = `---
-applyTo: "app/api/**"
----
-
-# BFF API Routes — Rules
-
-Files in \`app/api/\` are the **BFF (Backend for Frontend)** layer. They exist solely to proxy requests to Azure Functions.
-
-## Rules
-
-- **Never** put business logic, database access, or direct Cosmos DB calls here.
-- Use \`callFunction()\` from \`@/lib/api/call-function\` to forward requests to Azure Functions.
-- You may validate input/output with Zod schemas before forwarding.
-- Import schemas from \`@${projectName}/shared\`.
+  writeWorkflowDocs(projectDir, runCmd);
+  console.log('  ✅ .swallowkit/workflows/ (agent-agnostic autonomous-loop runbooks)');
 
-## Pattern
-
-\`\`\`typescript
-import { callFunction } from '@/lib/api/call-function';
-import { ModelSchema } from '@${projectName}/shared';
-import { z } from 'zod/v4';
+  const skillPaths = writeAgentSkills(projectDir, runCmd);
+  console.log('  ✅ .github/skills/ (Agent Skills — agentskills.io open standard)');
+  for (const skillPath of skillPaths) {
+    console.log(`     - ${skillPath}`);
+  }
 
-export async function GET() {
-  return callFunction({
-    method: 'GET',
-    path: '/api/{model}',
-    responseSchema: z.array(ModelSchema),
-  });
+  console.log('\n✅ AI agent files created\n');
+}
+export function buildFunctionsHostKeyBicepExpression(): string {
+  return "listKeys('${resourceId('Microsoft.Web/sites', functionsAppName)}/host/default', '2023-12-01').functionKeys.default";
 }
-\`\`\`
-`;
-
-  fs.writeFileSync(
-    path.join(instructionsDir, 'bff-routes.instructions.md'),
-    bffInstructions
-  );
-
-  // 4c. functions — Azure Functions backend layer
-  const functionsInstructions = `---
-applyTo: "functions/**"
----
 
-# Azure Functions — Backend Rules
+export function buildStaticWebAppConfigBicepSource(): string {
+  return `@description('Static Web App name')
+param staticWebAppName string
 
-Files in \`functions/\` contain all business logic and data access for this application.
+@description('Functions App default hostname for backend API calls')
+param functionsDefaultHostname string
 
-## Rules
+@description('Functions App name used to resolve its host key after deployment')
+param functionsAppName string
 
-- Keep backend contracts aligned with \`shared/models/\` by rerunning \`swallowkit scaffold\` after schema changes.
-- For TypeScript backends, use Cosmos DB **input/output bindings** (\`extraInputs\`/\`extraOutputs\`) for reads and writes.
-- For C#/Python backends, consume the generated OpenAPI-derived assets in \`functions/generated/\`.
-- Auto-generate \`id\` (UUID), \`createdAt\`, and \`updatedAt\` on the backend. Never trust client-sent values.
-- Container names are PascalCase + 's' (e.g., \`Todos\`). Partition key is always \`/id\`.
+@description('Application Insights connection string for SWA')
+param appInsightsConnectionString string
 
-## Handler Pattern
+resource staticWebApp 'Microsoft.Web/staticSites@2023-01-01' existing = {
+  name: staticWebAppName
+}
 
-\`\`\`typescript
-import { app } from '@azure/functions';
-import { ModelSchema } from '@${projectName}/shared';
+resource staticWebAppConfig 'Microsoft.Web/staticSites/config@2023-01-01' = {
+  parent: staticWebApp
+  name: 'appsettings'
+  properties: {
+    APPLICATIONINSIGHTS_CONNECTION_STRING: appInsightsConnectionString
+    ApplicationInsightsAgent_EXTENSION_VERSION: '~3'
+    BACKEND_FUNCTIONS_BASE_URL: 'https://\${functionsDefaultHostname}'
+    BACKEND_FUNCTIONS_KEY: ${buildFunctionsHostKeyBicepExpression()}
+  }
+}
 
-app.http('{model}-get-all', {
-  methods: ['GET'],
-  route: '{model}',
-  authLevel: 'anonymous',
-  extraInputs: [cosmosInput],
-  handler: async (request, context) => {
-    const documents = context.extraInputs.get(cosmosInput);
-    const validated = z.array(ModelSchema).parse(documents);
-    return { status: 200, jsonBody: validated };
-  },
-});
-\`\`\`
+output configName string = staticWebAppConfig.name
 `;
-
-  fs.writeFileSync(
-    path.join(instructionsDir, 'azure-functions.instructions.md'),
-    functionsInstructions
-  );
-
-  console.log('  ✅ .github/instructions/ (Copilot layer-specific instructions)');
-  console.log('     - shared-models.instructions.md');
-  console.log('     - bff-routes.instructions.md');
-  console.log('     - azure-functions.instructions.md');
-
-  console.log('\n✅ AI agent files created\n');
-  console.log('   Supported agents:');
-  console.log('   - OpenAI Codex          → AGENTS.md');
-  console.log('   - Claude Code           → CLAUDE.md (+ AGENTS.md)');
-  console.log('   - GitHub Copilot        → .github/copilot-instructions.md');
-  console.log('   - GitHub Copilot (edit) → .github/instructions/*.instructions.md');
-  console.log('');
 }
 
-async function createInfrastructure(
+export async function createInfrastructure(
   projectDir: string,
   projectName: string,
   azureConfig: AzureConfig,
@@ -2065,6 +2059,7 @@ async function createInfrastructure(
 
   const enableVNet = azureConfig.vnetOption !== 'none';
   const functionsRuntime = getFunctionsRuntimeConfig(backendLanguage);
+  const staticWebAppSku = getStaticWebAppSku(azureConfig.swaPlan);
 
   // main.bicep
   const mainBicep = `targetScope = 'resourceGroup'
@@ -2078,6 +2073,13 @@ param location string = resourceGroup().location
 @description('Location for Static Web App (must be explicitly provided)')
 param swaLocation string
 
+@description('Static Web Apps hosting plan')
+@allowed([
+  'Free'
+  'Standard'
+])
+param staticWebAppSku string = '${staticWebAppSku}'
+
 @description('Cosmos DB mode')
 @allowed(['freetier', 'serverless'])
 param cosmosDbMode string = '${azureConfig.cosmosDbMode}'
@@ -2120,7 +2122,7 @@ module staticWebApp 'modules/staticwebapp.bicep' = {
   params: {
     name: 'swa-\${projectName}'
     location: swaLocation
-    sku: 'Standard'
+    sku: staticWebAppSku
     appInsightsConnectionString: appInsightsSwa.outputs.connectionString
   }
 }
@@ -2161,16 +2163,11 @@ module cosmosPrivateEndpoint 'modules/private-endpoint-cosmos.bicep' = if (enabl
   params: {
     name: 'pe-cosmos-\${projectName}'
     location: location
-    cosmosAccountId: cosmosDbMode == 'freetier' ? cosmosDbFreeTier.outputs.id : cosmosDbServerless.outputs.id
-    cosmosAccountName: cosmosDbMode == 'freetier' ? cosmosDbFreeTier.outputs.accountName : cosmosDbServerless.outputs.accountName
-    subnetId: vnet.outputs.privateEndpointSubnetId
-    vnetId: vnet.outputs.id
+    cosmosAccountId: cosmosDbMode == 'freetier' ? cosmosDbFreeTier!.outputs.id : cosmosDbServerless!.outputs.id
+    cosmosAccountName: cosmosDbMode == 'freetier' ? cosmosDbFreeTier!.outputs.accountName : cosmosDbServerless!.outputs.accountName
+    subnetId: vnet!.outputs.privateEndpointSubnetId
+    vnetId: vnet!.outputs.id
   }
-  dependsOn: [
-    cosmosDbFreeTier
-    cosmosDbServerless
-    vnet
-  ]
 }
 
 // Azure Functions (Flex Consumption) - Deploy AFTER Cosmos DB
@@ -2182,16 +2179,14 @@ module functionsFlex 'modules/functions-flex.bicep' = {
       storageAccountName: 'stg\${uniqueString(resourceGroup().id, projectName)}'
       appInsightsConnectionString: appInsightsFunctions.outputs.connectionString
       swaDefaultHostname: staticWebApp.outputs.defaultHostname
-      cosmosDbEndpoint: cosmosDbMode == 'freetier' ? cosmosDbFreeTier.outputs.endpoint : cosmosDbServerless.outputs.endpoint
-      cosmosDbDatabaseName: cosmosDbMode == 'freetier' ? cosmosDbFreeTier.outputs.databaseName : cosmosDbServerless.outputs.databaseName
+      cosmosDbEndpoint: cosmosDbMode == 'freetier' ? cosmosDbFreeTier!.outputs.endpoint : cosmosDbServerless!.outputs.endpoint
+      cosmosDbDatabaseName: cosmosDbMode == 'freetier' ? cosmosDbFreeTier!.outputs.databaseName : cosmosDbServerless!.outputs.databaseName
       functionsRuntimeName: '${functionsRuntime.name}'
       functionsRuntimeVersion: '${functionsRuntime.version}'
       enableVNet: enableVNet
-      vnetSubnetId: enableVNet ? vnet.outputs.functionsSubnetId : ''
+      vnetSubnetId: enableVNet ? vnet!.outputs.functionsSubnetId : ''
   }
   dependsOn: [
-    cosmosDbFreeTier
-    cosmosDbServerless
     cosmosPrivateEndpoint
   ]
 }
@@ -2200,23 +2195,17 @@ module functionsFlex 'modules/functions-flex.bicep' = {
 module cosmosDbRoleAssignmentFreeTier 'modules/cosmosdb-role-assignment.bicep' = if (cosmosDbMode == 'freetier') {
   name: 'cosmosDbRoleAssignment'
   params: {
-    cosmosAccountName: cosmosDbFreeTier.outputs.accountName
+    cosmosAccountName: cosmosDbFreeTier!.outputs.accountName
     functionsPrincipalId: functionsFlex.outputs.principalId
   }
-  dependsOn: [
-    functionsFlex
-  ]
 }
 
 module cosmosDbRoleAssignmentServerless 'modules/cosmosdb-role-assignment.bicep' = if (cosmosDbMode == 'serverless') {
   name: 'cosmosDbRoleAssignment'
   params: {
-    cosmosAccountName: cosmosDbServerless.outputs.accountName
+    cosmosAccountName: cosmosDbServerless!.outputs.accountName
     functionsPrincipalId: functionsFlex.outputs.principalId
   }
-  dependsOn: [
-    functionsFlex
-  ]
 }
 
 // Update SWA config with Functions hostname (after Functions deployment)
@@ -2225,20 +2214,18 @@ module staticWebAppConfig 'modules/staticwebapp-config.bicep' = {
   params: {
     staticWebAppName: staticWebApp.outputs.name
     functionsDefaultHostname: functionsFlex.outputs.defaultHostname
+    functionsAppName: functionsFlex.outputs.name
     appInsightsConnectionString: appInsightsSwa.outputs.connectionString
   }
-  dependsOn: [
-    functionsFlex
-  ]
 }
 
 output staticWebAppName string = staticWebApp.outputs.name
 output staticWebAppUrl string = staticWebApp.outputs.defaultHostname
 output functionsAppName string = functionsFlex.outputs.name
 output functionsAppUrl string = functionsFlex.outputs.defaultHostname
-output cosmosDbAccountName string = cosmosDbMode == 'freetier' ? cosmosDbFreeTier.outputs.accountName : cosmosDbServerless.outputs.accountName
-output cosmosDbEndpoint string = cosmosDbMode == 'freetier' ? cosmosDbFreeTier.outputs.endpoint : cosmosDbServerless.outputs.endpoint
-output cosmosDatabaseName string = cosmosDbMode == 'freetier' ? cosmosDbFreeTier.outputs.databaseName : cosmosDbServerless.outputs.databaseName
+output cosmosDbAccountName string = cosmosDbMode == 'freetier' ? cosmosDbFreeTier!.outputs.accountName : cosmosDbServerless!.outputs.accountName
+output cosmosDbEndpoint string = cosmosDbMode == 'freetier' ? cosmosDbFreeTier!.outputs.endpoint : cosmosDbServerless!.outputs.endpoint
+output cosmosDatabaseName string = cosmosDbMode == 'freetier' ? cosmosDbFreeTier!.outputs.databaseName : cosmosDbServerless!.outputs.databaseName
 output logAnalyticsWorkspaceName string = logAnalytics.outputs.name
 output logAnalyticsWorkspaceId string = logAnalytics.outputs.id
 output appInsightsSwaName string = appInsightsSwa.outputs.name
@@ -2246,7 +2233,7 @@ output appInsightsSwaConnectionString string = appInsightsSwa.outputs.connection
 output appInsightsFunctionsName string = appInsightsFunctions.outputs.name
 output appInsightsFunctionsConnectionString string = appInsightsFunctions.outputs.connectionString
 output vnetEnabled bool = enableVNet
-output vnetName string = enableVNet ? vnet.outputs.name : ''
+output vnetName string = enableVNet ? vnet!.outputs.name : ''
 `;
   
   fs.writeFileSync(path.join(infraDir, 'main.bicep'), mainBicep);
@@ -2262,6 +2249,9 @@ output vnetName string = enableVNet ? vnet.outputs.name : ''
     "cosmosDbMode": {
       "value": "${azureConfig.cosmosDbMode}"
     },
+    "staticWebAppSku": {
+      "value": "${staticWebAppSku}"
+    },
     "enableVNet": {
       "value": ${enableVNet}
     }
@@ -2311,38 +2301,14 @@ resource staticWebAppConfig 'Microsoft.Web/staticSites/config@2023-01-01' = {
   }
 }
 
-output id string = staticWebApp.id
-output name string = staticWebApp.name
-output defaultHostname string = staticWebApp.properties.defaultHostname
-`;
-  fs.writeFileSync(path.join(modulesDir, 'staticwebapp.bicep'), staticWebAppBicep);
-
-  // modules/staticwebapp-config.bicep (for updating config after Functions deployment)
-  const staticWebAppConfigBicep = `@description('Static Web App name')
-param staticWebAppName string
-
-@description('Functions App default hostname for backend API calls')
-param functionsDefaultHostname string
-
-@description('Application Insights connection string for SWA')
-param appInsightsConnectionString string
-
-resource staticWebApp 'Microsoft.Web/staticSites@2023-01-01' existing = {
-  name: staticWebAppName
-}
-
-resource staticWebAppConfig 'Microsoft.Web/staticSites/config@2023-01-01' = {
-  parent: staticWebApp
-  name: 'appsettings'
-  properties: {
-    APPLICATIONINSIGHTS_CONNECTION_STRING: appInsightsConnectionString
-    ApplicationInsightsAgent_EXTENSION_VERSION: '~3'
-    BACKEND_FUNCTIONS_BASE_URL: 'https://\${functionsDefaultHostname}'
-  }
-}
-
-output configName string = staticWebAppConfig.name
+output id string = staticWebApp.id
+output name string = staticWebApp.name
+output defaultHostname string = staticWebApp.properties.defaultHostname
 `;
+  fs.writeFileSync(path.join(modulesDir, 'staticwebapp.bicep'), staticWebAppBicep);
+
+  // modules/staticwebapp-config.bicep (for updating config after Functions deployment)
+  const staticWebAppConfigBicep = buildStaticWebAppConfigBicepSource();
   fs.writeFileSync(path.join(modulesDir, 'staticwebapp-config.bicep'), staticWebAppConfigBicep);
   
   // modules/loganalytics.bicep (Shared Log Analytics Workspace)
@@ -2565,63 +2531,7 @@ output principalId string = functionApp.identity.principalId
   fs.writeFileSync(path.join(modulesDir, 'functions-flex.bicep'), functionsFlexBicep);
   
   // modules/cosmosdb-freetier.bicep (Free Tier)
-  const cosmosDbFreeTierBicep = `@description('Cosmos DB account name')
-param accountName string
-
-@description('Database name')
-param databaseName string
-
-@description('Location for Cosmos DB')
-param location string
-
-@description('Public network access')
-@allowed(['Enabled', 'Disabled'])
-param publicNetworkAccess string = 'Enabled'
-
-// Cosmos DB Account (Free Tier)
-resource cosmosAccount 'Microsoft.DocumentDB/databaseAccounts@2023-11-15' = {
-  name: accountName
-  location: location
-  kind: 'GlobalDocumentDB'
-  properties: {
-    databaseAccountOfferType: 'Standard'
-    enableAutomaticFailover: false
-    enableFreeTier: true
-    publicNetworkAccess: publicNetworkAccess
-    disableLocalAuth: true
-    consistencyPolicy: {
-      defaultConsistencyLevel: 'Session'
-    }
-    locations: [
-      {
-        locationName: location
-        failoverPriority: 0
-        isZoneRedundant: false
-      }
-    ]
-    disableKeyBasedMetadataWriteAccess: true
-  }
-}
-
-// Cosmos DB Database
-resource database 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2023-11-15' = {
-  parent: cosmosAccount
-  name: databaseName
-  properties: {
-    resource: {
-      id: databaseName
-    }
-    options: {
-      throughput: 1000
-    }
-  }
-}
-
-output id string = cosmosAccount.id
-output accountName string = cosmosAccount.name
-output endpoint string = cosmosAccount.properties.documentEndpoint
-output databaseName string = database.name
-`;
+  const cosmosDbFreeTierBicep = buildCosmosDbFreeTierBicepSource();
   fs.writeFileSync(path.join(modulesDir, 'cosmosdb-freetier.bicep'), cosmosDbFreeTierBicep);
   
   // modules/cosmosdb-serverless.bicep (Serverless)
@@ -2714,9 +2624,10 @@ output roleAssignmentId string = roleAssignment.id
 `;
   fs.writeFileSync(path.join(modulesDir, 'cosmosdb-role-assignment.bicep'), cosmosDbRoleAssignmentBicep);
 
-  // VNet modules (only generate if VNet is enabled)
-  if (enableVNet) {
-    // modules/vnet.bicep
+  // Bicep resolves module files at compile time even when their deployment condition is false,
+  // so these definitions must always be generated. main.bicep still controls deployment with
+  // `if (enableVNet)`.
+  // modules/vnet.bicep
     const vnetBicep = `@description('VNet name')
 param name string
 
@@ -2846,26 +2757,30 @@ output privateDnsZoneId string = privateDnsZone.id
 `;
     fs.writeFileSync(path.join(modulesDir, 'private-endpoint-cosmos.bicep'), cosmosPrivateEndpointBicep);
 
-    console.log('✅ VNet modules created\n');
-  }
+  console.log('✅ VNet module definitions created\n');
 
   console.log('✅ Infrastructure files created\n');
 }
 
-function getGitHubFunctionsWorkflow(pm: PackageManager, backendLanguage: BackendLanguage): string {
+export function getGitHubFunctionsWorkflow(pm: PackageManager, backendLanguage: BackendLanguage, projectPm: PackageManager = pm): string {
   const pmCmd = getCommands(pm);
   const pnpmSetupStep = getCiSetupStep(pm);
+  const npmWorkspaceNormalizationStep = getGitHubNpmWorkspaceNormalizationStep(pm, projectPm);
 
   const commonSetup = `      - uses: actions/checkout@v4
       
+${pnpmSetupStep ? `${pnpmSetupStep}\n` : ''}
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: '22'
-${pnpmSetupStep ? `\n${pnpmSetupStep}\n` : ''}
+${npmWorkspaceNormalizationStep ? '' : `          cache: ${pm}
+          cache-dependency-path: ${projectPm === 'pnpm' ? 'pnpm-lock.yaml' : 'package-lock.json'}
+`}
+${npmWorkspaceNormalizationStep ? `\n${npmWorkspaceNormalizationStep}` : ''}
       - name: Install dependencies
         run: |
-          ${pmCmd.ci}
+          ${getCiInstallCommand(pm, projectPm)}
       
       - name: Build shared package
         run: |
@@ -2951,7 +2866,7 @@ jobs:
 ${commonSetup}      - name: Setup .NET
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: '8.0.x'
+          dotnet-version: '10.0.x'
 
       - name: Publish Functions
         run: |
@@ -3012,16 +2927,18 @@ ${commonSetup}      - name: Setup Python
 `;
 }
 
-function getAzureFunctionsPipeline(pm: PackageManager, backendLanguage: BackendLanguage): string {
+export function getAzureFunctionsPipeline(pm: PackageManager, backendLanguage: BackendLanguage, projectPm: PackageManager = pm): string {
   const pmCmd = getCommands(pm);
   const azPipelinesSetup = getAzurePipelinesSetup(pm);
+  const npmWorkspaceNormalizationStep = getAzurePipelinesNpmWorkspaceNormalizationStep(pm, projectPm);
   const commonSetup = `  - task: NodeTool@0
     inputs:
       versionSpec: '22.x'
     displayName: 'Install Node.js'
 ${azPipelinesSetup ? `\n${azPipelinesSetup}\n` : ''}
+${npmWorkspaceNormalizationStep ? `\n${npmWorkspaceNormalizationStep}\n` : ''}
   - script: |
-      ${pmCmd.ci}
+      ${getCiInstallCommand(pm, projectPm)}
     displayName: 'Install workspace dependencies'
 
   - script: |
@@ -3127,7 +3044,7 @@ variables:
 steps:
 ${commonSetup}  - task: UseDotNet@2
     inputs:
-      version: '8.0.x'
+      version: '10.0.x'
     displayName: 'Install .NET SDK'
 
   - script: |
@@ -3209,6 +3126,195 @@ ${commonSetup}  - task: UsePythonVersion@0
 `;
 }
 
+// setup-node selects the runner runtime only; Oryx reads the app manifest separately.
+export function getSwaNodeVersionCommand(): string {
+  return `node -e "const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));p.engines={...p.engines,node:'>=22.14.0 <23'};fs.writeFileSync('package.json',JSON.stringify(p,null,2)+String.fromCharCode(10));"`;
+}
+
+export function buildAzureSwaPipeline(pm: PackageManager, projectPm: PackageManager = pm): string {
+  // SWA/Oryx also invokes npm internally; normalize only the disposable CI checkout.
+  pm = 'npm';
+  const pmCmd = getCommands(pm);
+  const azPipelinesSetup = getAzurePipelinesSetup(pm);
+  const npmWorkspaceNormalizationStep = getAzurePipelinesNpmWorkspaceNormalizationStep(pm, projectPm);
+
+  return `trigger:
+  branches:
+    include:
+      - main
+  paths:
+    include:
+      - app/**
+      - components/**
+      - lib/**
+      - shared/**
+      - public/**
+      - package.json
+      - next.config.js
+
+pr:
+  branches:
+    include:
+      - main
+  paths:
+    include:
+      - app/**
+      - components/**
+      - lib/**
+      - shared/**
+      - public/**
+      - package.json
+      - next.config.js
+
+pool:
+  vmImage: 'ubuntu-latest'
+
+variables:
+  - group: azure-deployment
+
+steps:
+  - task: NodeTool@0
+    inputs:
+      versionSpec: '22.x'
+    displayName: 'Install Node.js'
+${azPipelinesSetup ? `\n${azPipelinesSetup}\n` : ''}
+  - script: |
+      ${getSwaNodeVersionCommand()}
+    displayName: 'Select Node.js 22 for SWA'
+${npmWorkspaceNormalizationStep ? `\n${npmWorkspaceNormalizationStep}\n` : ''}
+  - script: |
+      ${getCiInstallCommand(pm, projectPm)}
+    displayName: 'Install dependencies'
+
+  - script: |
+      ${pmCmd.run} build
+    env:
+      NODE_ENV: production
+    displayName: 'Build Next.js app'
+
+  - task: AzureStaticWebApp@0
+    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
+    inputs:
+      app_location: '.'
+      output_location: '.next/standalone'
+      skip_app_build: true
+      azure_static_web_apps_api_token: $(AZURE_STATIC_WEB_APPS_API_TOKEN)
+    displayName: 'Deploy to Azure Static Web Apps'
+`;
+}
+
+function getAzurePipelinesNpmWorkspaceNormalizationStep(pm: PackageManager, projectPm: PackageManager): string {
+  if (pm !== 'npm' || projectPm !== 'pnpm') {
+    return '';
+  }
+
+  return `  - script: |
+      node <<'NODE'
+      const fs = require('fs');
+
+      function readJson(path) {
+        return JSON.parse(fs.readFileSync(path, 'utf8'));
+      }
+
+      function writeJson(path, value) {
+        fs.writeFileSync(path, JSON.stringify(value, null, 2) + String.fromCharCode(10));
+      }
+
+      const sharedPackagePath = 'shared/package.json';
+      const sharedPackageName = fs.existsSync(sharedPackagePath) ? readJson(sharedPackagePath).name : undefined;
+
+      function replaceSharedWorkspaceDep(pkg, replacement) {
+        for (const section of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+          if (!pkg[section]) continue;
+
+          for (const [name, version] of Object.entries(pkg[section])) {
+            if (typeof version === 'string' && version.startsWith('workspace:') && (name === sharedPackageName || name.endsWith('/shared'))) {
+              pkg[section][name] = replacement;
+            }
+          }
+        }
+      }
+
+      const root = readJson('package.json');
+      root.workspaces = ['shared', 'functions'].filter(dir => fs.existsSync(dir + '/package.json'));
+      delete root.packageManager;
+      root.devEngines = { ...root.devEngines, packageManager: { name: 'npm', version: '>=10', onFail: 'error' } };
+      replaceSharedWorkspaceDep(root, 'file:shared');
+      root.scripts = root.scripts || {};
+      root.scripts.build = ${JSON.stringify(getBuildScript('npm'))};
+      writeJson('package.json', root);
+
+      if (fs.existsSync('functions/package.json')) {
+        const functionsPkg = readJson('functions/package.json');
+        replaceSharedWorkspaceDep(functionsPkg, 'file:../shared');
+        if (functionsPkg.scripts && functionsPkg.scripts.prestart) {
+          functionsPkg.scripts.prestart = 'npm run build';
+        }
+        writeJson('functions/package.json', functionsPkg);
+      }
+      NODE
+
+      npm install --package-lock-only --ignore-scripts
+    displayName: 'Normalize pnpm workspace for npm CI'`;
+}
+
+function getGitHubNpmWorkspaceNormalizationStep(pm: PackageManager, projectPm: PackageManager): string {
+  if (pm !== 'npm' || projectPm !== 'pnpm') {
+    return '';
+  }
+
+  return `      - name: Normalize pnpm workspace for npm CI
+        shell: bash
+        run: |
+          node <<'NODE'
+          const fs = require('fs');
+
+          function readJson(path) {
+            return JSON.parse(fs.readFileSync(path, 'utf8'));
+          }
+
+          function writeJson(path, value) {
+            fs.writeFileSync(path, JSON.stringify(value, null, 2) + String.fromCharCode(10));
+          }
+
+          const sharedPackagePath = 'shared/package.json';
+          const sharedPackageName = fs.existsSync(sharedPackagePath) ? readJson(sharedPackagePath).name : undefined;
+
+          function replaceSharedWorkspaceDep(pkg, replacement) {
+            for (const section of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+              if (!pkg[section]) continue;
+
+              for (const [name, version] of Object.entries(pkg[section])) {
+                if (typeof version === 'string' && version.startsWith('workspace:') && (name === sharedPackageName || name.endsWith('/shared'))) {
+                  pkg[section][name] = replacement;
+                }
+              }
+            }
+          }
+
+          const root = readJson('package.json');
+          root.workspaces = ['shared', 'functions'].filter(dir => fs.existsSync(dir + '/package.json'));
+          delete root.packageManager;
+          root.devEngines = { ...root.devEngines, packageManager: { name: 'npm', version: '>=10', onFail: 'error' } };
+          replaceSharedWorkspaceDep(root, 'file:shared');
+          root.scripts = root.scripts || {};
+          root.scripts.build = ${JSON.stringify(getBuildScript('npm'))};
+          writeJson('package.json', root);
+
+          if (fs.existsSync('functions/package.json')) {
+            const functionsPkg = readJson('functions/package.json');
+            replaceSharedWorkspaceDep(functionsPkg, 'file:../shared');
+            if (functionsPkg.scripts && functionsPkg.scripts.prestart) {
+              functionsPkg.scripts.prestart = 'npm run build';
+            }
+            writeJson('functions/package.json', functionsPkg);
+          }
+          NODE
+
+          npm install --package-lock-only --ignore-scripts
+`;
+}
+
 async function createGitHubActionsWorkflows(
   projectDir: string,
   azureConfig: AzureConfig,
@@ -3216,13 +3322,27 @@ async function createGitHubActionsWorkflows(
   backendLanguage: BackendLanguage
 ) {
   console.log('📦 Creating GitHub Actions workflows...\n');
-  
-  const pmCmd = getCommands(pm);
   const workflowsDir = path.join(projectDir, '.github', 'workflows');
   fs.mkdirSync(workflowsDir, { recursive: true });
 
-  // deploy-swa.yml
-  const swaWorkflow = `name: Deploy Static Web App
+  const actionsPm: PackageManager = pm;
+
+  const swaWorkflow = buildGitHubSwaWorkflow(actionsPm, pm);
+  fs.writeFileSync(path.join(workflowsDir, 'deploy-swa.yml'), swaWorkflow);
+
+  // deploy-functions.yml
+  const functionsWorkflow = getGitHubFunctionsWorkflow(actionsPm, backendLanguage, pm);
+  fs.writeFileSync(path.join(workflowsDir, 'deploy-functions.yml'), functionsWorkflow);
+
+  console.log('✅ GitHub Actions workflows created\n');
+}
+
+export function buildGitHubSwaWorkflow(pm: PackageManager, projectPm: PackageManager = pm): string {
+  // SWA/Oryx also invokes npm internally; normalize only the disposable CI checkout.
+  pm = 'npm';
+  const npmWorkspaceNormalizationStep = getGitHubNpmWorkspaceNormalizationStep(pm, projectPm);
+
+  return `name: Deploy Static Web App
 
 on:
   push:
@@ -3235,6 +3355,7 @@ on:
       - 'shared/**'
       - 'public/**'
       - 'package.json'
+      - '${projectPm === 'pnpm' ? 'pnpm-lock.yaml' : 'package-lock.json'}'
       - 'next.config.js'
       - 'next.config.ts'
   workflow_dispatch:
@@ -3248,6 +3369,7 @@ on:
       - 'shared/**'
       - 'public/**'
       - 'package.json'
+      - '${projectPm === 'pnpm' ? 'pnpm-lock.yaml' : 'package-lock.json'}'
       - 'next.config.js'
       - 'next.config.ts'
 
@@ -3260,6 +3382,22 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: true
+
+${getCiSetupStep(pm) ? `${getCiSetupStep(pm)}\n` : ''}
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+${npmWorkspaceNormalizationStep ? '' : `          cache: ${pm}
+          cache-dependency-path: ${projectPm === 'pnpm' ? 'pnpm-lock.yaml' : 'package-lock.json'}
+`}
+      - name: Select Node.js 22 for SWA
+        run: |
+          ${getSwaNodeVersionCommand()}
+${npmWorkspaceNormalizationStep ? `\n${npmWorkspaceNormalizationStep}` : ''}
+      - name: Install and build app
+        run: |
+          ${getSwaAppBuildCommand(pm, projectPm)}
       
       - name: Deploy to Azure Static Web Apps
         if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main'
@@ -3271,93 +3409,27 @@ jobs:
           app_location: '/'
           api_location: ''
           output_location: ''
+          app_build_command: 'npm run build'
         env:
           NEXT_TURBOPACK_EXPERIMENTAL_USE_SYSTEM_TLS_CERTS: '1'
 `;
-  fs.writeFileSync(path.join(workflowsDir, 'deploy-swa.yml'), swaWorkflow);
-  
-  // deploy-functions.yml
-  const functionsWorkflow = getGitHubFunctionsWorkflow(pm, backendLanguage);
-  fs.writeFileSync(path.join(workflowsDir, 'deploy-functions.yml'), functionsWorkflow);
-
-  console.log('✅ GitHub Actions workflows created\n');
 }
 
 async function createAzurePipelines(projectDir: string, pm: PackageManager, backendLanguage: BackendLanguage) {
   console.log('📦 Creating Azure Pipelines...\n');
-  
-  const pmCmd = getCommands(pm);
-  const azPipelinesSetup = getAzurePipelinesSetup(pm);
+
+  const pipelinesPm: PackageManager = pm;
   const pipelinesDir = path.join(projectDir, 'pipelines');
   fs.mkdirSync(pipelinesDir, { recursive: true });
 
   // swa.yml
-  const swaPipeline = `trigger:
-  branches:
-    include:
-      - main
-  paths:
-    include:
-      - app/**
-      - components/**
-      - lib/**
-      - shared/**
-      - public/**
-      - package.json
-      - next.config.js
-
-pr:
-  branches:
-    include:
-      - main
-  paths:
-    include:
-      - app/**
-      - components/**
-      - lib/**
-      - shared/**
-      - public/**
-      - package.json
-      - next.config.js
-
-pool:
-  vmImage: 'ubuntu-latest'
-
-variables:
-  - group: azure-deployment
-
-steps:
-  - task: NodeTool@0
-    inputs:
-      versionSpec: '22.x'
-    displayName: 'Install Node.js'
-${azPipelinesSetup ? `\n${azPipelinesSetup}\n` : ''}
-  - script: |
-      ${pmCmd.ci}
-    displayName: 'Install dependencies'
-
-  - script: |
-      ${pmCmd.run} build
-    env:
-      NODE_ENV: production
-    displayName: 'Build Next.js app'
-
-  - task: AzureStaticWebApp@0
-    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
-    inputs:
-      app_location: '.'
-      output_location: '.next/standalone'
-      skip_app_build: true
-      azure_static_web_apps_api_token: $(AZURE_STATIC_WEB_APPS_API_TOKEN)
-    displayName: 'Deploy to Azure Static Web Apps'
-`;
+  const swaPipeline = buildAzureSwaPipeline(pipelinesPm, pm);
   fs.writeFileSync(path.join(pipelinesDir, 'swa.yml'), swaPipeline);
   
   // functions.yml
-  const functionsPipeline = getAzureFunctionsPipeline(pm, backendLanguage);
+  const functionsPipeline = getAzureFunctionsPipeline(pipelinesPm, backendLanguage, pm);
   fs.writeFileSync(path.join(pipelinesDir, 'functions.yml'), functionsPipeline);
 
   console.log('✅ Azure Pipelines created\n');
 }
 
-