swallowkit 1.0.0-beta.9 → 1.0.0

package/src/cli/commands/scaffold.ts

@@ -5,25 +5,53 @@
 
 import * as fs from "fs";
 import * as path from "path";
-import { spawn } from "child_process";
-import { getBackendLanguage, ensureSwallowKitProject } from "../../core/config";
-import { ModelInfo, parseModelFile, toKebabCase, toPascalCase } from "../../core/scaffold/model-parser";
+import { spawnSync } from "child_process";
+import { getBackendLanguage, getConnectorDefinition, getAuthConfig, getFullConfig, getNormalizedAuthConfig, ensureSwallowKitProject, normalizeAuthConfig, validateConfig } from "../../core/config";
+import { ModelInfo, parseModelFile, toKebabCase, toPascalCase, toCamelCase } from "../../core/scaffold/model-parser";
 import {
   generateCSharpAzureFunctionsCRUD,
   generateCompactAzureFunctionsCRUD,
   generatePythonAzureFunctionsCRUD,
 } from "../../core/scaffold/functions-generator";
-import { generateCompactBFFRoutes, generateBFFCallFunction } from "../../core/scaffold/nextjs-generator";
-import { generateOpenApiDocument } from "../../core/scaffold/openapi-generator";
+import {
+  generateRdbConnectorFunctionTS,
+  generateApiConnectorFunctionTS,
+  generateRdbConnectorFunctionCSharp,
+  generateApiConnectorFunctionCSharp,
+  generateRdbConnectorFunctionPython,
+  generateApiConnectorFunctionPython,
+} from "../../core/scaffold/connector-functions-generator";
+import { generateCompactBFFRoutes, generateBFFCallFunction, generateConnectorBFFRoutes } from "../../core/scaffold/nextjs-generator";
 import {
   generateListPage,
   generateDetailPage,
   generateFormComponent,
   generateNewPage,
   generateEditPage,
+  generateAuthLayout,
+  UIAuthOptions,
 } from "../../core/scaffold/ui-generator";
+import { generateLanguageSchemaArtifacts, validateNativeSchemaToolchain } from "../../core/scaffold/native-schema-generator";
 import { detectFromProject, getCommands } from "../../utils/package-manager";
-import { BackendLanguage } from "../../types";
+import {
+  BackendLanguage,
+  RdbConnectorConfig,
+  ApiConnectorConfig,
+  RdbModelConnectorConfig,
+  ApiModelConnectorConfig,
+  ModelAuthPolicy,
+  AuthConfig,
+} from "../../types";
+import { syncProjectManifest } from "../../core/project/manifest";
+import { generateBFFCallFunctionWithAuth, generateBFFCallFunctionWithMultipleAuth, generateBFFCallFunctionWithSwaAuth, generateNamedAuthRouterCSharp, generateNamedAuthRouterPython, generateNamedAuthRouterTS } from "../../core/scaffold/auth-generator";
+import {
+  FileOperationSession,
+  getActiveFileSession,
+  hashFileIfExists,
+} from "../../core/operations/file-session";
+import { recordSessionOperations } from "../../core/project/artifacts";
+
+const SCAFFOLD_GENERATOR = "scaffold";
 
 interface ScaffoldOptions {
   model: string; // モデルファイルのパス（例: "lib/models/todo.ts" or "todo"）
@@ -32,10 +60,36 @@ interface ScaffoldOptions {
   apiOnly?: boolean; // true の場合、UI を生成しない（デフォルト: false）
 }
 
+function getMachineAwareStdio(): "inherit" | "pipe" {
+  return process.env.SWALLOWKIT_MACHINE_OUTPUT === "1" ? "pipe" : "inherit";
+}
+
+function runSpawnSyncCommand(command: string, args: string[], cwd: string): void {
+  const result = spawnSync(command, args, {
+    cwd,
+    stdio: getMachineAwareStdio(),
+    shell: true,
+  });
+
+  if (typeof result.status === "number" && result.status !== 0) {
+    throw new Error(`${command} ${args.join(" ")} exited with code ${result.status}`);
+  }
+
+  if (result.error) {
+    throw result.error;
+  }
+}
+
 export async function scaffoldCommand(options: ScaffoldOptions) {
   // SwallowKit プロジェクトディレクトリかどうかを検証
   ensureSwallowKitProject("scaffold");
 
+  const configValidation = validateConfig(getFullConfig());
+  if (!configValidation.valid) throw new Error(`Invalid SwallowKit configuration:\n${configValidation.errors.map(error => `- ${error}`).join("\n")}`);
+
+  // Plan(dry-run) や Apply からセッションが供給される。単体実行時は commit セッションを生成。
+  const session = getActiveFileSession() ?? new FileOperationSession("commit");
+
   console.log("🏗️  SwallowKit Scaffold: Generating CRUD operations...\n");
 
   try {
@@ -51,6 +105,13 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
     const backendLanguage = getBackendLanguage();
     console.log(`🧠 Backend language: ${backendLanguage}`);
     
+    // コネクタモデルかどうかを判定
+    const isConnectorModel = !!modelInfo.connectorConfig;
+    if (isConnectorModel) {
+      console.log(`🔌 Connector model detected: ${modelInfo.connectorConfig!.connector}`);
+      console.log(`   Operations: ${modelInfo.connectorConfig!.operations.join(", ")}`);
+    }
+    
     // ネストスキーマ参照があれば表示
     if (modelInfo.nestedSchemaRefs.length > 0) {
       console.log(`🔗 Nested schema references detected:`);
@@ -74,28 +135,74 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
     const relatedModels = backendLanguage === "typescript"
       ? [modelInfo]
       : await collectModelGraph(modelPath);
+    for (const relatedModel of relatedModels) {
+      session.registerInput(relatedModel.filePath);
+    }
+
+    // 4b. 書き込み前に外部 codegen toolchain を検証し、失敗時はプロジェクト無変更で終了する
+    if (session.mode === "commit" && backendLanguage !== "typescript" && !isConnectorModel) {
+      await validateNativeSchemaToolchain(
+        relatedModels,
+        modelInfo,
+        backendLanguage,
+        path.join(process.cwd(), functionsDir)
+      );
+    }
+
+    if (options.apiOnly) {
+      console.log("ℹ️  --api-only skips UI generation only; Functions, BFF routes, OpenAPI, and native schema assets are still updated.");
+    }
 
     // 5. Generate BFF callFunction helper
-    await generateCallFunctionHelper();
+    await generateCallFunctionHelper(session);
 
     // 6. Generate Azure Functions code
-    await generateFunctionsCode(modelInfo, functionsDir, sharedPackageName, backendLanguage);
-
-    if (backendLanguage !== "typescript") {
-      await generateLanguageSchemaArtifacts(relatedModels, modelInfo, functionsDir, backendLanguage);
+    if (isConnectorModel) {
+      await generateConnectorFunctionsCode(modelInfo, functionsDir, sharedPackageName, backendLanguage, session);
+      // 6b. Install connector driver dependencies
+      await installConnectorDriverDependencies(modelInfo, functionsDir, backendLanguage, session);
+    } else {
+      await generateFunctionsCode(modelInfo, functionsDir, sharedPackageName, backendLanguage, session);
+
+      if (backendLanguage !== "typescript") {
+        await generateLanguageSchemaArtifacts(relatedModels, modelInfo, functionsDir, backendLanguage, session);
+      }
     }
 
     // 7. Generate Next.js BFF API Routes
     const apiDir = options.apiDir || "app/api";
-    await generateBFFRoutes(modelInfo, apiDir, sharedPackageName);
+    if (isConnectorModel) {
+      await generateConnectorBFFRoutesFiles(modelInfo, apiDir, sharedPackageName, session);
+    } else {
+      await generateBFFRoutes(modelInfo, apiDir, sharedPackageName, session);
+    }
 
-    // 8. Generate Cosmos DB container Bicep file
-    await generateCosmosContainer(modelInfo);
+    // 8. Generate Cosmos DB container Bicep file (skip for connector models)
+    if (!isConnectorModel) {
+      await generateCosmosContainer(modelInfo, session);
+    }
 
     // 9. Generate UI components (unless --api-only)
     if (!options.apiOnly) {
-      await generateUIComponents(modelInfo, sharedPackageName);
-      await updateNavigationMenu(modelInfo);
+      const uiAuthConfig = getAuthConfig();
+      const uiAuthPolicy = resolveAuthPolicy(modelInfo, uiAuthConfig);
+      const uiAuthOptions: UIAuthOptions | undefined =
+        uiAuthPolicy && uiAuthConfig && uiAuthConfig.provider !== 'none'
+          ? createUIAuthOptions(uiAuthPolicy, uiAuthConfig)
+          : undefined;
+      await generateUIComponents(modelInfo, sharedPackageName, uiAuthOptions, session);
+      if (uiAuthOptions?.authenticatedFetchImport) {
+        applyExternalTokenFetchToGeneratedUi(modelInfo, session, uiAuthOptions.authenticatedFetchImport);
+      }
+      await updateNavigationMenu(modelInfo, session);
+    }
+
+    if (session.mode === "commit") {
+      recordSessionOperations(session.operations, {
+        schemaHash: hashFileIfExists(modelPath) ?? undefined,
+        sourceModel: modelInfo.name,
+      });
+      await syncProjectManifest();
     }
 
     console.log("\n✅ Scaffold completed successfully!");
@@ -106,7 +213,7 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
       console.log("  3. Navigate to the model from the homepage menu");
     }
     if (backendLanguage !== "typescript") {
-      console.log(`  ${options.apiOnly ? "2" : "4"}. Review generated OpenAPI assets in ${functionsDir}/openapi/ and ${functionsDir}/generated/`);
+      console.log(`  ${options.apiOnly ? "2" : "4"}. Review generated OpenAPI export and native schema assets in ${functionsDir}/openapi/ and ${functionsDir}/generated/`);
     }
     console.log(
       `  ${options.apiOnly ? (backendLanguage === "typescript" ? "2" : "3") : (backendLanguage === "typescript" ? "4" : "5")}. Ensure BACKEND_FUNCTIONS_BASE_URL is set in your .env.local file`
@@ -114,17 +221,73 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
     console.log(
       `  ${options.apiOnly ? (backendLanguage === "typescript" ? "3" : "4") : (backendLanguage === "typescript" ? "5" : "6")}. Configure CosmosDBConnection in functions/local.settings.json`
     );
-    console.log(`  ${options.apiOnly ? (backendLanguage === "typescript" ? "4" : "5") : (backendLanguage === "typescript" ? "6" : "7")}. Run '${getCommands(detectFromProject()).dlx} swallowkit dev' to test the generated code`);
+    console.log(`  ${options.apiOnly ? (backendLanguage === "typescript" ? "4" : "5") : (backendLanguage === "typescript" ? "6" : "7")}. Run '${getCommands(detectFromProject()).exec} swallowkit dev' to test the generated code`);
   } catch (error: any) {
     console.error("\n❌ Scaffold failed:", error.message);
     process.exit(1);
   }
 }
 
+function applyExternalTokenFetchToGeneratedUi(modelInfo: ModelInfo, session: FileOperationSession, importPath = '@/lib/auth/authenticated-fetch'): void {
+  const uiPrefix = `app/${toKebabCase(modelInfo.name)}/`;
+  for (const operation of session.operations) {
+    if (!operation.path.startsWith(uiPrefix) || !operation.path.endsWith('.tsx') || operation.action === 'delete') continue;
+    let content = session.readFile(operation.absolutePath);
+    if (!content.includes('fetch(')) continue;
+    content = content.replace(/\bfetch\(/g, 'authenticatedFetch(');
+    content = content.replace(
+      /(if \(!res\.ok\) throw new Error\([^\n]+\);)/g,
+      `if (res.status === 401) throw new Error('Authentication required');\n        $1`
+    );
+    if (!content.includes(importPath)) {
+      const directive = content.match(/^'use client';\s*\r?\n/)?.[0] ?? '';
+      content = `${directive}import { authenticatedFetch } from '${importPath}';\n${content.slice(directive.length)}`;
+    }
+    session.writeFile(operation.absolutePath, content, {
+      ownership: 'managed',
+      generator: SCAFFOLD_GENERATOR,
+      sourceModel: modelInfo.name,
+    });
+  }
+}
+
+/**
+ * モデルの authPolicy と auth config から実効的な認可ポリシーを解決
+ * - モデルに authPolicy があればそれを使用
+ * - なければ auth.authorization.defaultPolicy に従う
+ * - auth 設定がなければ undefined（ガードなし）
+ */
+export function resolveAuthPolicy(modelInfo: ModelInfo, authConfig: AuthConfig | undefined): ModelAuthPolicy | undefined {
+  // モデルに明示的な authPolicy がある場合はそれを使用
+  if (modelInfo.authPolicy) {
+    const normalized = normalizeAuthConfig(authConfig);
+    for (const policyName of [modelInfo.authPolicy.policy, typeof modelInfo.authPolicy.read === 'string' ? modelInfo.authPolicy.read : undefined, typeof modelInfo.authPolicy.write === 'string' ? modelInfo.authPolicy.write : undefined].filter((value): value is string => Boolean(value))) {
+      if (!normalized?.authorization.policies[policyName]) throw new Error(`Model '${modelInfo.name}' references undefined auth policy '${policyName}'. Define auth.authorization.policies.${policyName}.`);
+    }
+    return modelInfo.authPolicy;
+  }
+
+  // auth 設定がない場合はガードなし
+  if (!authConfig || authConfig.provider === 'none') {
+    return undefined;
+  }
+
+  // defaultPolicy が 'authenticated' なら認証のみ（ロール指定なし）のポリシーを返す
+  const defaultPolicy = authConfig.authorization?.defaultPolicy === 'public' ? 'anonymous' : authConfig.authorization?.defaultPolicy ?? 'authenticated';
+  if (defaultPolicy === 'authenticated') {
+    return {}; // 空のポリシー = 認証のみ、ロール制限なし
+  }
+
+  if (defaultPolicy !== 'anonymous') return { policy: defaultPolicy };
+
+  // defaultPolicy が 'anonymous' なら認証不要
+  return undefined;
+}
+
 /**
  * モデルファイルのパスを解決
  */
-function resolveModelPath(modelInput: string): string {
+export function resolveModelPath(modelInput: string): string {
   const cwd = process.cwd();
 
   // 絶対パスの場合
@@ -192,7 +355,7 @@ function readSharedPackageName(): string {
 /**
  * Generate BFF callFunction helper (lib/api/call-function.ts)
  */
-async function generateCallFunctionHelper(): Promise<void> {
+async function generateCallFunctionHelper(session: FileOperationSession): Promise<void> {
   console.log("\n📦 Generating BFF callFunction helper...");
 
   const cwd = process.cwd();
@@ -200,12 +363,21 @@ async function generateCallFunctionHelper(): Promise<void> {
   const helperDir = path.join(cwd, "lib", "api");
   const helperPath = path.join(helperDir, "call-function.ts");
 
-  if (!fs.existsSync(helperDir)) {
-    fs.mkdirSync(helperDir, { recursive: true });
+  // auth 設定がある場合は Authorization ヘッダー転送版を生成
+  const authConfig = getAuthConfig();
+  const normalizedAuth = normalizeAuthConfig(authConfig);
+  const hasAuth = Boolean(normalizedAuth && Object.keys(normalizedAuth.schemes).length > 0);
+  let helperCode: string;
+  if (hasAuth) {
+    const providers = new Set(Object.values(normalizedAuth!.schemes).map(scheme => scheme.provider));
+    helperCode = normalizedAuth!.schemes.default && Object.keys(normalizedAuth!.schemes).length === 1
+      ? authConfig?.provider === "swa" ? generateBFFCallFunctionWithSwaAuth() : generateBFFCallFunctionWithAuth()
+      : providers.has("swa") ? generateBFFCallFunctionWithMultipleAuth() : generateBFFCallFunctionWithAuth();
+  } else {
+    helperCode = generateBFFCallFunction();
   }
 
-  const helperCode = generateBFFCallFunction();
-  fs.writeFileSync(helperPath, helperCode, "utf-8");
+  session.writeFile(helperPath, helperCode, { ownership: "managed", generator: SCAFFOLD_GENERATOR });
   console.log(`✅ Created: ${helperPath}`);
 }
 
@@ -216,11 +388,121 @@ async function generateFunctionsCode(
   modelInfo: ModelInfo,
   functionsDir: string,
   sharedPackageName: string,
-  backendLanguage: BackendLanguage
+  backendLanguage: BackendLanguage,
+  session: FileOperationSession
 ): Promise<void> {
   console.log("\n🔨 Generating Azure Functions CRUD code...");
 
+  // Resolve auth policy: model-level authPolicy or global defaultPolicy
+  const authConfig = getAuthConfig();
+  const authPolicy = resolveAuthPolicy(modelInfo, authConfig);
+  if (authPolicy) {
+    console.log(`🔐 Auth policy detected: ${JSON.stringify(authPolicy)}`);
+  }
+
+  const modelKebab = toKebabCase(modelInfo.name);
+  const managedMeta = { ownership: "managed" as const, generator: SCAFFOLD_GENERATOR, sourceModel: modelInfo.name };
+  if (backendLanguage === "typescript") {
+    const normalizedAuth = getNormalizedAuthConfig();
+    if (normalizedAuth && Object.keys(normalizedAuth.schemes).some(name => name !== "default")) {
+      const routerPath = path.join(process.cwd(), functionsDir, "src", "auth", "auth-router.ts");
+      session.writeFile(routerPath, generateNamedAuthRouterTS(normalizedAuth), { ownership: "managed", generator: SCAFFOLD_GENERATOR });
+    }
+    const functionFilePath = path.join(
+      process.cwd(),
+      functionsDir,
+      "src",
+      `${modelKebab}.ts`
+    );
+
+    const code = generateCompactAzureFunctionsCRUD(modelInfo, sharedPackageName, authPolicy, authConfig?.provider);
+    session.writeFile(functionFilePath, code, managedMeta);
+    console.log(`✅ Created: ${functionFilePath}`);
+    return;
+  }
+
+  if (backendLanguage === "csharp") {
+    const normalizedAuth = getNormalizedAuthConfig();
+    if (normalizedAuth && Object.keys(normalizedAuth.schemes).some(name => name !== "default")) {
+      const routerPath = path.join(process.cwd(), functionsDir, "Auth", "AuthRouter.cs");
+      session.writeFile(routerPath, generateNamedAuthRouterCSharp(normalizedAuth), { ownership: "managed", generator: SCAFFOLD_GENERATOR });
+    }
+    const crudDir = path.join(process.cwd(), functionsDir, "Crud");
+    const functionFilePath = path.join(crudDir, `${modelInfo.name}CrudFunctions.cs`);
+
+    // Remove init-generated template (singular) to avoid route conflicts
+    const templatePath = path.join(crudDir, `${modelInfo.name}Function.cs`);
+    if (session.fileExists(templatePath)) {
+      session.deleteFile(templatePath, managedMeta);
+      console.log(`🗑️  Removed template: ${templatePath}`);
+    }
+
+    session.writeFile(functionFilePath, generateCSharpAzureFunctionsCRUD(modelInfo, authPolicy), managedMeta);
+    console.log(`✅ Created: ${functionFilePath}`);
+    return;
+  }
+
+  const normalizedAuth = getNormalizedAuthConfig();
+  if (normalizedAuth && Object.keys(normalizedAuth.schemes).some(name => name !== "default")) {
+    const routerPath = path.join(process.cwd(), functionsDir, "auth", "auth_router.py");
+    session.writeFile(routerPath, generateNamedAuthRouterPython(normalizedAuth), { ownership: "managed", generator: SCAFFOLD_GENERATOR });
+  }
+
+  const blueprintsDir = path.join(process.cwd(), functionsDir, "blueprints");
+  const blueprintPath = path.join(blueprintsDir, `${modelKebab.replace(/-/g, "_")}.py`);
+
+  const { blueprint, registration } = generatePythonAzureFunctionsCRUD(modelInfo, authPolicy);
+  session.writeFile(blueprintPath, blueprint, managedMeta);
+  updatePythonFunctionRegistrations(path.join(process.cwd(), functionsDir, "function_app.py"), registration, session);
+  console.log(`✅ Created: ${blueprintPath}`);
+}
+
+export function createUIAuthOptions(policy: ModelAuthPolicy, authConfig: AuthConfig): UIAuthOptions {
+  const normalized = normalizeAuthConfig(authConfig);
+  const readPolicyName = typeof policy.read === 'string' ? policy.read : policy.policy;
+  const writePolicyName = typeof policy.write === 'string' ? policy.write : policy.policy;
+  const readNamed = readPolicyName ? normalized?.authorization.policies[readPolicyName] : undefined;
+  const named = writePolicyName ? normalized?.authorization.policies[writePolicyName] : undefined;
+  const writeRoles = named?.roles ?? (Array.isArray(policy.write) ? policy.write : policy.roles) ?? [];
+  const externalScheme = [...(readNamed?.schemes ?? []), ...(named?.schemes ?? [])].find(name => normalized?.schemes[name]?.provider === 'external-token');
+  const authScheme = readNamed?.schemes[0] ?? named?.schemes[0];
+  const authenticatedFetchImport = externalScheme ? `@/lib/auth/schemes/${toKebabCase(externalScheme)}/authenticated-fetch` : authConfig.provider === 'external-token' ? '@/lib/auth/authenticated-fetch' : undefined;
+  const authContextImport = authScheme ? `@/lib/auth/schemes/${toKebabCase(authScheme)}/auth-context` : '@/lib/auth/auth-context';
+  return { authPolicy: policy, writeRoles, authenticatedFetchImport, authContextImport };
+}
+
+/**
+ * コネクタモデル用 Azure Functions コード生成
+ */
+async function generateConnectorFunctionsCode(
+  modelInfo: ModelInfo,
+  functionsDir: string,
+  sharedPackageName: string,
+  backendLanguage: BackendLanguage,
+  session: FileOperationSession
+): Promise<void> {
+  console.log("\n🔌 Generating Connector Azure Functions code...");
+
+  const connectorConfig = modelInfo.connectorConfig!;
+  const connectorDef = getConnectorDefinition(connectorConfig.connector);
+
+  if (!connectorDef) {
+    throw new Error(
+      `Connector '${connectorConfig.connector}' not found in swallowkit.config.js.\n` +
+      `  Please add it to the 'connectors' section of your configuration.`
+    );
+  }
+
+  // Resolve auth policy (same logic as Cosmos model scaffolding)
+  const authConfig = getAuthConfig();
+  const authPolicy = resolveAuthPolicy(modelInfo, authConfig);
+  if (authPolicy) {
+    console.log(`🔐 Auth policy detected: ${JSON.stringify(authPolicy)}`);
+  }
+
   const modelKebab = toKebabCase(modelInfo.name);
+  const connectorManagedMeta = { ownership: "managed" as const, generator: SCAFFOLD_GENERATOR, sourceModel: modelInfo.name };
+
   if (backendLanguage === "typescript") {
     const functionFilePath = path.join(
       process.cwd(),
@@ -229,13 +511,26 @@ async function generateFunctionsCode(
       `${modelKebab}.ts`
     );
 
-    const functionDir = path.dirname(functionFilePath);
-    if (!fs.existsSync(functionDir)) {
-      fs.mkdirSync(functionDir, { recursive: true });
+    let code: string;
+    if (connectorDef.type === "rdb") {
+      code = generateRdbConnectorFunctionTS(
+        modelInfo, sharedPackageName,
+        connectorDef as RdbConnectorConfig,
+        connectorConfig as RdbModelConnectorConfig,
+        authPolicy,
+        authConfig?.provider
+      );
+    } else {
+      code = generateApiConnectorFunctionTS(
+        modelInfo, sharedPackageName,
+        connectorDef as ApiConnectorConfig,
+        connectorConfig as ApiModelConnectorConfig,
+        authPolicy,
+        authConfig?.provider
+      );
     }
 
-    const code = generateCompactAzureFunctionsCRUD(modelInfo, sharedPackageName);
-    fs.writeFileSync(functionFilePath, code, "utf-8");
+    session.writeFile(functionFilePath, code, connectorManagedMeta);
     console.log(`✅ Created: ${functionFilePath}`);
     return;
   }
@@ -244,25 +539,175 @@ async function generateFunctionsCode(
     const functionFilePath = path.join(
       process.cwd(),
       functionsDir,
-      "Crud",
-      `${modelInfo.name}Functions.cs`
+      "Connectors",
+      `${modelInfo.name}ConnectorFunctions.cs`
     );
-    fs.mkdirSync(path.dirname(functionFilePath), { recursive: true });
-    fs.writeFileSync(functionFilePath, generateCSharpAzureFunctionsCRUD(modelInfo), "utf-8");
+
+    let code: string;
+    if (connectorDef.type === "rdb") {
+      code = generateRdbConnectorFunctionCSharp(
+        modelInfo,
+        connectorDef as RdbConnectorConfig,
+        connectorConfig as RdbModelConnectorConfig
+      );
+    } else {
+      code = generateApiConnectorFunctionCSharp(
+        modelInfo,
+        connectorDef as ApiConnectorConfig,
+        connectorConfig as ApiModelConnectorConfig
+      );
+    }
+
+    session.writeFile(functionFilePath, code, connectorManagedMeta);
     console.log(`✅ Created: ${functionFilePath}`);
     return;
   }
 
+  // Python
   const blueprintsDir = path.join(process.cwd(), functionsDir, "blueprints");
   const blueprintPath = path.join(blueprintsDir, `${modelKebab.replace(/-/g, "_")}.py`);
-  fs.mkdirSync(blueprintsDir, { recursive: true });
 
-  const { blueprint, registration } = generatePythonAzureFunctionsCRUD(modelInfo);
-  fs.writeFileSync(blueprintPath, blueprint, "utf-8");
-  updatePythonFunctionRegistrations(path.join(process.cwd(), functionsDir, "function_app.py"), registration);
+  let result: { blueprint: string; registration: string };
+  if (connectorDef.type === "rdb") {
+    result = generateRdbConnectorFunctionPython(
+      modelInfo,
+      connectorDef as RdbConnectorConfig,
+      connectorConfig as RdbModelConnectorConfig
+    );
+  } else {
+    result = generateApiConnectorFunctionPython(
+      modelInfo,
+      connectorDef as ApiConnectorConfig,
+      connectorConfig as ApiModelConnectorConfig
+    );
+  }
+
+  session.writeFile(blueprintPath, result.blueprint, connectorManagedMeta);
+  updatePythonFunctionRegistrations(path.join(process.cwd(), functionsDir, "function_app.py"), result.registration, session);
   console.log(`✅ Created: ${blueprintPath}`);
 }
 
+/**
+ * コネクタモデルの scaffold 後に、生成コードが必要とする RDB/API ドライバを
+ * functions ディレクトリにインストールする。
+ */
+async function installConnectorDriverDependencies(
+  modelInfo: ModelInfo,
+  functionsDir: string,
+  backendLanguage: BackendLanguage,
+  session: FileOperationSession
+): Promise<void> {
+  const connectorConfig = modelInfo.connectorConfig!;
+  const connectorDef = getConnectorDefinition(connectorConfig.connector);
+  if (!connectorDef || connectorDef.type !== "rdb") return;
+
+  const rdbDef = connectorDef as RdbConnectorConfig;
+  const functionsPath = path.join(process.cwd(), functionsDir);
+
+  if (backendLanguage === "typescript") {
+    const driverMap: Record<string, { deps: string[]; devDeps: string[] }> = {
+      mysql:     { deps: ["mysql2"],  devDeps: [] },
+      postgres:  { deps: ["pg"],      devDeps: ["@types/pg"] },
+      sqlserver: { deps: ["mssql"],   devDeps: [] },
+    };
+    const entry = driverMap[rdbDef.provider];
+    if (!entry) return;
+
+    // package.json を読んで、既にインストール済みならスキップ
+    const pkgJsonPath = path.join(functionsPath, "package.json");
+    if (fs.existsSync(pkgJsonPath)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+      const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+      const missingDeps = entry.deps.filter(d => !allDeps[d]);
+      const missingDevDeps = entry.devDeps.filter(d => !allDeps[d]);
+      if (missingDeps.length === 0 && missingDevDeps.length === 0) return;
+    }
+
+    if (session.mode === "collect") {
+      session.addWarning(
+        `external-install: ${rdbDef.provider} driver dependencies (${[...entry.deps, ...entry.devDeps].join(", ")}) will be installed into ${functionsDir}/ on apply.`
+      );
+      return;
+    }
+
+    console.log(`\n📦 Installing ${rdbDef.provider} driver dependencies...`);
+    const pm = detectFromProject(functionsPath);
+    const cmds = getCommands(pm);
+
+    if (entry.deps.length > 0) {
+      runSpawnSyncCommand(cmds.name, [pm === "pnpm" ? "add" : "install", ...entry.deps], functionsPath);
+    }
+    if (entry.devDeps.length > 0) {
+      runSpawnSyncCommand(cmds.name, [pm === "pnpm" ? "add" : "install", "-D", ...entry.devDeps], functionsPath);
+    }
+    console.log(`✅ ${rdbDef.provider} driver installed`);
+    return;
+  }
+
+  if (backendLanguage === "csharp") {
+    const nugetMap: Record<string, string> = {
+      mysql:     "MySqlConnector",
+      postgres:  "Npgsql",
+      sqlserver: "Microsoft.Data.SqlClient",
+    };
+    const pkg = nugetMap[rdbDef.provider];
+    if (!pkg) return;
+    if (session.mode === "collect") {
+      session.addWarning(`external-install: NuGet package ${pkg} will be added to ${functionsDir}/functions.csproj on apply.`);
+      return;
+    }
+    console.log(`\n📦 Installing ${rdbDef.provider} NuGet package...`);
+    runSpawnSyncCommand("dotnet", ["add", path.join(functionsPath, "functions.csproj"), "package", pkg], functionsPath);
+    console.log(`✅ ${pkg} installed`);
+    return;
+  }
+
+  // Python — requirements.txt に追記
+  const pipMap: Record<string, string> = {
+    mysql:     "mysql-connector-python",
+    postgres:  "psycopg2-binary",
+    sqlserver: "pymssql",
+  };
+  const pipPkg = pipMap[rdbDef.provider];
+  if (!pipPkg) return;
+  const reqPath = path.join(functionsPath, "requirements.txt");
+  if (session.fileExists(reqPath)) {
+    const existing = session.readFile(reqPath);
+    if (!existing.includes(pipPkg)) {
+      console.log(`\n📦 Adding ${pipPkg} to requirements.txt...`);
+      session.writeFile(reqPath, `${existing}\n${pipPkg}\n`, { ownership: "extension-point", generator: SCAFFOLD_GENERATOR });
+      console.log(`✅ ${pipPkg} added`);
+    }
+  }
+}
+
+/**
+ * コネクタモデル用 BFF ルート生成（操作制限に対応）
+ */
+async function generateConnectorBFFRoutesFiles(
+  modelInfo: ModelInfo,
+  apiDir: string,
+  sharedPackageName: string,
+  session: FileOperationSession
+): Promise<void> {
+  console.log("\n🔌 Generating Connector BFF API routes...");
+
+  const modelCamel = toCamelCase(modelInfo.name);
+  const operations = modelInfo.connectorConfig!.operations;
+
+  const listRoutePath = path.join(process.cwd(), apiDir, modelCamel, "route.ts");
+  const detailRoutePath = path.join(process.cwd(), apiDir, modelCamel, "[id]", "route.ts");
+
+  const routes = generateConnectorBFFRoutes(modelInfo, sharedPackageName, operations);
+
+  const meta = { ownership: "managed" as const, generator: SCAFFOLD_GENERATOR, sourceModel: modelInfo.name };
+  session.writeFile(listRoutePath, routes.listRoute, meta);
+  session.writeFile(detailRoutePath, routes.detailRoute, meta);
+
+  console.log(`✅ Created: ${listRoutePath}`);
+  console.log(`✅ Created: ${detailRoutePath}`);
+}
+
 async function collectModelGraph(modelPath: string, seen = new Map<string, ModelInfo>()): Promise<ModelInfo[]> {
   const resolvedPath = path.resolve(modelPath);
   if (seen.has(resolvedPath)) {
@@ -298,140 +743,18 @@ function describeFunctionsOutputPath(functionsDir: string, backendLanguage: Back
   return `${functionsDir}/blueprints/`;
 }
 
-async function generateLanguageSchemaArtifacts(
-  models: ModelInfo[],
-  rootModel: ModelInfo,
-  functionsDir: string,
-  backendLanguage: Exclude<BackendLanguage, "typescript">
-): Promise<void> {
-  console.log("\n🧬 Generating OpenAPI-backed schema artifacts...");
-
-  const openApiDir = path.join(process.cwd(), functionsDir, "openapi");
-  fs.mkdirSync(openApiDir, { recursive: true });
-
-  const specPath = path.join(openApiDir, `${toKebabCase(rootModel.name)}.openapi.json`);
-  fs.writeFileSync(specPath, generateOpenApiDocument(models, rootModel), "utf-8");
-  console.log(`✅ Created: ${specPath}`);
-
-  const outputDir = path.join(
-    process.cwd(),
-    functionsDir,
-    "generated",
-    backendLanguage === "csharp" ? "csharp-models" : "python-models"
-  );
-
-  fs.mkdirSync(outputDir, { recursive: true });
-  await runOpenApiGenerator(specPath, outputDir, backendLanguage);
-  if (backendLanguage === "csharp") {
-    pruneGeneratedCSharpArtifacts(outputDir);
+function updatePythonFunctionRegistrations(functionAppPath: string, registration: string, session: FileOperationSession): void {
+  if (!session.fileExists(functionAppPath)) {
+    throw new Error(`Python Functions entrypoint not found: ${functionAppPath}`);
   }
-  console.log(`✅ Generated ${backendLanguage} schema assets: ${outputDir}`);
-}
-
-async function runOpenApiGenerator(
-  specPath: string,
-  outputDir: string,
-  backendLanguage: Exclude<BackendLanguage, "typescript">
-): Promise<void> {
-  const pm = detectFromProject();
-  const command = pm === "pnpm" ? "pnpm" : "npx";
-  const args = pm === "pnpm"
-    ? ["exec", "openapi-generator-cli", ...getOpenApiGeneratorArgs(specPath, outputDir, backendLanguage)]
-    : ["openapi-generator-cli", ...getOpenApiGeneratorArgs(specPath, outputDir, backendLanguage)];
-
-  await new Promise<void>((resolve, reject) => {
-    const child = spawn(command, args, {
-      cwd: process.cwd(),
-      shell: true,
-      stdio: "inherit",
-    });
-
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolve();
-        return;
-      }
 
-      reject(new Error(`OpenAPI generator exited with code ${code}`));
-    });
-
-    child.on("error", reject);
-  });
-}
+  const content = session.readFile(functionAppPath);
 
-export function getOpenApiGeneratorArgs(
-  specPath: string,
-  outputDir: string,
-  backendLanguage: Exclude<BackendLanguage, "typescript">
-): string[] {
-  const globalProperty = backendLanguage === "csharp"
-    ? "models,supportingFiles,apis=false,modelDocs=false,modelTests=false"
-    : "models,apis=false,supportingFiles=false,modelDocs=false,modelTests=false";
-
-  const baseArgs = [
-    "generate",
-    "-i",
-    specPath,
-    "-o",
-    outputDir,
-    "--global-property",
-    globalProperty,
-  ];
-
-  if (backendLanguage === "csharp") {
-    return [
-      ...baseArgs,
-      "-g",
-      "csharp",
-      "--additional-properties",
-      "packageName=SwallowKitBackendModels,targetFramework=net8.0,nullableReferenceTypes=true",
-    ];
-  }
-
-  return [
-    ...baseArgs,
-    "-g",
-    "python",
-    "--additional-properties",
-    "packageName=backend_models,projectName=backend-models",
-  ];
-}
-
-export function getCSharpSchemaArtifactPruneTargets(outputDir: string): string[] {
-  return [
-    path.join(outputDir, "src", "SwallowKitBackendModels.Test"),
-    path.join(outputDir, "src", "SwallowKitBackendModels", "Api"),
-    path.join(outputDir, "src", "SwallowKitBackendModels", "Extensions"),
-  ];
-}
-
-function pruneGeneratedCSharpArtifacts(outputDir: string): void {
-  for (const target of getCSharpSchemaArtifactPruneTargets(outputDir)) {
-    if (fs.existsSync(target)) {
-      fs.rmSync(target, { recursive: true, force: true });
-    }
-  }
-
-  const clientDir = path.join(outputDir, "src", "SwallowKitBackendModels", "Client");
-  if (!fs.existsSync(clientDir)) {
+  // Check if import line already exists (handles init-generated layout)
+  const importLine = registration.split("\n").find((l) => l.startsWith("from ") || l.startsWith("import "));
+  if (importLine && content.includes(importLine)) {
     return;
   }
-
-  for (const entry of fs.readdirSync(clientDir, { withFileTypes: true })) {
-    if (!entry.isFile() || entry.name === "Option.cs") {
-      continue;
-    }
-
-    fs.rmSync(path.join(clientDir, entry.name), { force: true });
-  }
-}
-
-function updatePythonFunctionRegistrations(functionAppPath: string, registration: string): void {
-  if (!fs.existsSync(functionAppPath)) {
-    throw new Error(`Python Functions entrypoint not found: ${functionAppPath}`);
-  }
-
-  const content = fs.readFileSync(functionAppPath, "utf-8");
   if (content.includes(registration)) {
     return;
   }
@@ -442,7 +765,7 @@ function updatePythonFunctionRegistrations(functionAppPath: string, registration
   }
 
   const updated = content.replace(marker, `${registration}\n${marker}`);
-  fs.writeFileSync(functionAppPath, updated, "utf-8");
+  session.writeFile(functionAppPath, updated, { ownership: "extension-point", generator: SCAFFOLD_GENERATOR });
 }
 
 /**
@@ -451,11 +774,11 @@ function updatePythonFunctionRegistrations(functionAppPath: string, registration
 async function generateBFFRoutes(
   modelInfo: any,
   apiDir: string,
-  sharedPackageName: string
+  sharedPackageName: string,
+  session: FileOperationSession
 ): Promise<void> {
   console.log("\n🔨 Generating Next.js BFF API routes...");
 
-  const modelKebab = toKebabCase(modelInfo.name);
   const modelCamel = modelInfo.name.charAt(0).toLowerCase() + modelInfo.name.slice(1);
 
   // List route: app/api/[model]/route.ts
@@ -475,24 +798,13 @@ async function generateBFFRoutes(
     "route.ts"
   );
 
-  // ディレクトリを作成
-  const listRouteDir = path.dirname(listRoutePath);
-  const detailRouteDir = path.dirname(detailRoutePath);
-
-  if (!fs.existsSync(listRouteDir)) {
-    fs.mkdirSync(listRouteDir, { recursive: true });
-  }
-
-  if (!fs.existsSync(detailRouteDir)) {
-    fs.mkdirSync(detailRouteDir, { recursive: true });
-  }
-
   // コードを生成
   const routes = generateCompactBFFRoutes(modelInfo, sharedPackageName);
 
   // ファイルに書き込み
-  fs.writeFileSync(listRoutePath, routes.listRoute, "utf-8");
-  fs.writeFileSync(detailRoutePath, routes.detailRoute, "utf-8");
+  const meta = { ownership: "managed" as const, generator: SCAFFOLD_GENERATOR, sourceModel: modelInfo.name };
+  session.writeFile(listRoutePath, routes.listRoute, meta);
+  session.writeFile(detailRoutePath, routes.detailRoute, meta);
 
   console.log(`✅ Created: ${listRoutePath}`);
   console.log(`✅ Created: ${detailRoutePath}`);
@@ -501,7 +813,7 @@ async function generateBFFRoutes(
 /**
  * Generate Cosmos DB container Bicep file
  */
-async function generateCosmosContainer(modelInfo: any): Promise<void> {
+export async function generateCosmosContainer(modelInfo: any, session: FileOperationSession = new FileOperationSession("commit")): Promise<void> {
   console.log("\n🗄️  Generating Cosmos DB container Bicep file...");
 
   const modelKebab = toKebabCase(modelInfo.name);
@@ -515,13 +827,8 @@ async function generateCosmosContainer(modelInfo: any): Promise<void> {
     return;
   }
 
-  // Check if containers directory exists, if not create it
-  const containersDir = path.join(infraDir, "containers");
-  if (!fs.existsSync(containersDir)) {
-    fs.mkdirSync(containersDir, { recursive: true });
-  }
-
   // Generate container Bicep file
+  const containersDir = path.join(infraDir, "containers");
   const containerFileName = `${modelKebab}-container.bicep`;
   const containerFilePath = path.join(containersDir, containerFileName);
 
@@ -535,13 +842,7 @@ param databaseName string
 param containerName string = '${modelPascal}s'
 
 @description('Partition key path')
-param partitionKeyPath string = '/id'
-
-@description('Throughput (RU/s) - only used for Free Tier')
-param throughput int = 400
-
-@description('Cosmos DB mode: freetier or serverless')
-param cosmosDbMode string
+param partitionKeyPath string = '${modelInfo.partitionKey}'
 
 // Reference existing Cosmos DB account
 resource cosmosAccount 'Microsoft.DocumentDB/databaseAccounts@2023-11-15' existing = {
@@ -582,9 +883,6 @@ resource container 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/container
         ]
       }
     }
-    options: cosmosDbMode == 'freetier' ? {
-      throughput: throughput
-    } : {}
   }
 }
 
@@ -592,29 +890,29 @@ output containerName string = container.name
 `;
 
   // Write Bicep file (overwrite if exists)
-  fs.writeFileSync(containerFilePath, bicepContent, "utf-8");
+  session.writeFile(containerFilePath, bicepContent, { ownership: "managed", generator: SCAFFOLD_GENERATOR, sourceModel: modelInfo.name });
   console.log(`✅ Created: ${containerFilePath}`);
 
   // Update main.bicep to include this container module
-  await updateMainBicepWithContainer(modelKebab, modelPascal);
+  await updateMainBicepWithContainer(modelKebab, modelPascal, session);
 }
 
 /**
  * Update main.bicep to include new container module
  */
-async function updateMainBicepWithContainer(modelKebab: string, modelPascal: string): Promise<void> {
+async function updateMainBicepWithContainer(modelKebab: string, modelPascal: string, session: FileOperationSession): Promise<void> {
   const cwd = process.cwd();
   const mainBicepPath = path.join(cwd, "infra", "main.bicep");
 
-  if (!fs.existsSync(mainBicepPath)) {
+  if (!session.fileExists(mainBicepPath)) {
     console.log("ℹ️  main.bicep not found. Please manually add the container module.");
     return;
   }
 
-  let mainBicepContent = fs.readFileSync(mainBicepPath, "utf-8");
+  let mainBicepContent = session.readFile(mainBicepPath);
 
   // Check if container module already exists
-  const containerModuleName = `${modelKebab.replace(/-/g, '')}Container`;
+  const containerModuleName = `${modelPascal.charAt(0).toLowerCase()}${modelPascal.slice(1)}Container`;
   if (mainBicepContent.includes(`module ${containerModuleName}`)) {
     console.log(`ℹ️  Container module '${containerModuleName}' already exists in main.bicep`);
     return;
@@ -653,13 +951,8 @@ module ${containerModuleName} 'containers/${modelKebab}-container.bicep' = {
   name: '${modelKebab}-container'
   params: {
     cosmosAccountName: cosmosDbMode == 'freetier' ? cosmosDbFreeTier.outputs.accountName : cosmosDbServerless.outputs.accountName
-    databaseName: '$` + `{projectName}Database'
-    cosmosDbMode: cosmosDbMode
+    databaseName: '\${projectName}Database'
   }
-  dependsOn: [
-    cosmosDbFreeTier
-    cosmosDbServerless
-  ]
 }`;
 
   // Insert the module
@@ -668,14 +961,14 @@ module ${containerModuleName} 'containers/${modelKebab}-container.bicep' = {
     containerModule +
     mainBicepContent.slice(insertPosition);
 
-  fs.writeFileSync(mainBicepPath, mainBicepContent, "utf-8");
+  session.writeFile(mainBicepPath, mainBicepContent, { ownership: "extension-point", generator: SCAFFOLD_GENERATOR });
   console.log(`✅ Added container module to main.bicep`);
 }
 
 /**
  * Generate UI components (list, detail, form, create, edit pages)
  */
-async function generateUIComponents(modelInfo: any, sharedPackageName: string): Promise<void> {
+export async function generateUIComponents(modelInfo: ModelInfo, sharedPackageName: string, authOptions?: UIAuthOptions, session: FileOperationSession = new FileOperationSession("commit")): Promise<void> {
   console.log("\n🎨 Generating UI components...");
 
   const modelKebab = toKebabCase(modelInfo.name);
@@ -689,37 +982,38 @@ async function generateUIComponents(modelInfo: any, sharedPackageName: string):
   const idDir = path.join(modelDir, "[id]");
   const editDir = path.join(idDir, "edit");
 
-  // Create directories
-  [componentsDir, newDir, editDir].forEach(dir => {
-    if (!fs.existsSync(dir)) {
-      fs.mkdirSync(dir, { recursive: true });
-    }
-  });
-
   // Generate and write files
-  const listPage = generateListPage(modelInfo, sharedPackageName);
-  const detailPage = generateDetailPage(modelInfo, sharedPackageName);
+  const listPage = generateListPage(modelInfo, sharedPackageName, authOptions);
+  const detailPage = generateDetailPage(modelInfo, sharedPackageName, authOptions);
   const formComponent = generateFormComponent(modelInfo, sharedPackageName);
-  const newPage = generateNewPage(modelInfo);
-  const editPage = generateEditPage(modelInfo, sharedPackageName);
-
-  fs.writeFileSync(path.join(modelDir, "page.tsx"), listPage, "utf-8");
-  fs.writeFileSync(path.join(idDir, "page.tsx"), detailPage, "utf-8");
-  fs.writeFileSync(path.join(componentsDir, `${modelName}Form.tsx`), formComponent, "utf-8");
-  fs.writeFileSync(path.join(newDir, "page.tsx"), newPage, "utf-8");
-  fs.writeFileSync(path.join(editDir, "page.tsx"), editPage, "utf-8");
+  const newPage = generateNewPage(modelInfo, authOptions);
+  const editPage = generateEditPage(modelInfo, sharedPackageName, authOptions);
+  const authLayout = generateAuthLayout(modelInfo, authOptions);
+
+  const meta = { ownership: "managed" as const, generator: SCAFFOLD_GENERATOR, sourceModel: modelInfo.name };
+  session.writeFile(path.join(modelDir, "page.tsx"), listPage, meta);
+  session.writeFile(path.join(idDir, "page.tsx"), detailPage, meta);
+  session.writeFile(path.join(componentsDir, `${modelName}Form.tsx`), formComponent, meta);
+  session.writeFile(path.join(newDir, "page.tsx"), newPage, meta);
+  session.writeFile(path.join(editDir, "page.tsx"), editPage, meta);
+  if (authLayout) {
+    session.writeFile(path.join(modelDir, "layout.tsx"), authLayout, meta);
+  }
 
   console.log(`✅ Created: ${path.join(modelDir, "page.tsx")}`);
   console.log(`✅ Created: ${path.join(idDir, "page.tsx")}`);
   console.log(`✅ Created: ${path.join(componentsDir, `${modelName}Form.tsx`)}`);
   console.log(`✅ Created: ${path.join(newDir, "page.tsx")}`);
   console.log(`✅ Created: ${path.join(editDir, "page.tsx")}`);
+  if (authLayout) {
+    console.log(`✅ Created: ${path.join(modelDir, "layout.tsx")}`);
+  }
 }
 
 /**
  * Update navigation menu on the homepage
  */
-async function updateNavigationMenu(modelInfo: any): Promise<void> {
+async function updateNavigationMenu(modelInfo: any, session: FileOperationSession): Promise<void> {
   console.log("\n📋 Updating navigation menu...");
 
   const modelKebab = toKebabCase(modelInfo.name);
@@ -728,13 +1022,13 @@ async function updateNavigationMenu(modelInfo: any): Promise<void> {
   // Update scaffold config
   const configPath = path.join(cwd, "lib", "scaffold-config.ts");
   
-  if (!fs.existsSync(configPath)) {
+  if (!session.fileExists(configPath)) {
     console.log("⚠️  scaffold-config.ts not found. Skipping navigation menu update.");
     return;
   }
 
   // Read existing config
-  const configContent = fs.readFileSync(configPath, "utf-8");
+  const configContent = session.readFile(configPath);
   
   // Parse models array - extract each model entry
   const models: Array<{ name: string; path: string; label: string }> = [];
@@ -781,6 +1075,7 @@ ${models.map(m => `    { name: '${m.name}', path: '${m.path}', label: '${m.label
 };
 `;
 
-  fs.writeFileSync(configPath, newConfigContent, "utf-8");
+  session.writeFile(configPath, newConfigContent, { ownership: "extension-point", generator: SCAFFOLD_GENERATOR });
   console.log(`✅ Added ${modelInfo.name} to navigation menu`);
 }
+