swallowkit 1.1.1 → 1.1.3

package/src/__tests__/init-agent-instructions.test.ts

@@ -0,0 +1,99 @@
+import * as fs from "fs";
+import * as path from "path";
+import * as childProcess from "child_process";
+import { initCommand } from "../cli/commands/init";
+import { buildAgentsMd } from "../core/project/agent-instructions";
+import { generateDetailPage, generateEditPage } from "../core/scaffold/ui-generator";
+import { createBasicModelInfo } from "./fixtures";
+
+jest.mock("child_process", () => ({
+  ...jest.requireActual<typeof import("child_process")>("child_process"),
+  spawn: jest.fn(),
+  execSync: jest.fn(),
+}));
+
+describe("init persistence instructions", () => {
+  const cwd = process.cwd();
+  let root: string;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(cwd, ".init-instructions-test-"));
+    process.chdir(root);
+    jest.spyOn(console, "log").mockImplementation(() => undefined);
+    jest.spyOn(console, "warn").mockImplementation(() => undefined);
+    jest.spyOn(process, "exit").mockImplementation(() => { throw new Error("Unexpected init failure"); });
+    jest.mocked(childProcess.execSync).mockReturnValue("main\n");
+    const spawn = jest.mocked(childProcess.spawn as (
+      file: string, args: readonly string[]
+    ) => childProcess.ChildProcess);
+    spawn.mockImplementation((_file, args = []) => {
+      if (args.includes("create-next-app") || args.includes("create-next-app@latest")) {
+        const project = path.join(root, "fictional-app");
+        fs.mkdirSync(path.join(project, "app"), { recursive: true });
+        fs.writeFileSync(path.join(project, "package.json"), JSON.stringify({ name: "fictional-app", scripts: {}, dependencies: {} }));
+        fs.writeFileSync(path.join(project, "next.config.ts"), "const nextConfig = { cacheComponents: true };\nexport default nextConfig;\n");
+        fs.writeFileSync(path.join(project, "tsconfig.json"), '{"compilerOptions":{}}');
+      }
+      const child = new childProcess.ChildProcess();
+      process.nextTick(() => child.emit("close", 0));
+      return child;
+    });
+  });
+
+  afterEach(() => {
+    process.chdir(cwd);
+    fs.rmSync(root, { recursive: true, force: true });
+    jest.restoreAllMocks();
+    jest.clearAllMocks();
+  });
+
+  it.each(["npm", "pnpm"] as const)("writes the persistence rule through actual init using %s, with subprocesses mocked", async (packageManager) => {
+    await initCommand({
+      name: "fictional-app", template: "default", cicd: "skip", backendLanguage: "typescript",
+      cosmosDbMode: "serverless", vnet: "none", swaPlan: "free", packageManager,
+    });
+    const project = path.join(root, "fictional-app");
+    const home = fs.readFileSync(path.join(project, "app", "page.tsx"), "utf-8");
+    expect(home).toMatch(/^'use client'/);
+    expect(home).not.toMatch(/export const (dynamic|revalidate|fetchCache)\b/);
+    expect(home).toContain("useState");
+    expect(home).toContain("fetch('/api/greet?name=SwallowKit')");
+    expect(home).toContain("onClick={testConnection}");
+    expect(home).toContain("scaffoldConfig.models.map");
+    const config = fs.readFileSync(path.join(project, "next.config.ts"), "utf-8");
+    expect(config).toContain("cacheComponents: true");
+    expect(config).toContain("output: 'standalone'");
+    const model = createBasicModelInfo();
+    for (const [route, code, content] of [
+      [path.join("app", "todo", "[id]", "page.tsx"), generateDetailPage(model, "@fictional-app/shared"), "TodoDetailContent"],
+      [path.join("app", "todo", "[id]", "edit", "page.tsx"), generateEditPage(model, "@fictional-app/shared"), "EditTodoContent"],
+    ]) {
+      const file = path.join(project, route);
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      fs.writeFileSync(file, code);
+      const generated = fs.readFileSync(file, "utf-8");
+      expect(generated).toContain(`<${content} />`);
+      expect(generated).toContain("<Suspense fallback=");
+      expect(generated.slice(0, generated.indexOf(`function ${content}`))).not.toContain("useParams()");
+      expect(generated).not.toMatch(/export const (dynamic|revalidate|fetchCache|instant)\b/);
+    }
+    expect(fs.readFileSync(path.join(project, "next.config.ts"), "utf-8")).toContain("cacheComponents: true");
+    const agents = fs.readFileSync(path.join(project, "AGENTS.md"), "utf-8");
+    expect(agents).toBe(buildAgentsMd({ projectName: "fictional-app", backendLanguage: "typescript", packageManager }));
+    expect(agents).toContain("**whether or not it uses custom APIs**");
+    expect(agents).toContain(".swallowkit/artifacts.json");
+    expect(agents).toContain("Never describe a project as deployable");
+    for (const file of [
+      path.join(".swallowkit", "workflows", "add-model.md"),
+      path.join(".github", "skills", "swallowkit-add-model", "SKILL.md"),
+      path.join(".github", "instructions", "shared-models.instructions.md"),
+    ]) {
+      const content = fs.readFileSync(path.join(project, file), "utf-8");
+      expect(content).toContain("even when all APIs are custom");
+      expect(content).toContain(".swallowkit/artifacts.json");
+    }
+    for (const file of ["CLAUDE.md", path.join(".github", "copilot-instructions.md")]) {
+      expect(fs.readFileSync(path.join(project, file), "utf-8")).toContain("root `AGENTS.md`");
+    }
+  });
+});

package/src/__tests__/plan-apply.test.ts

@@ -83,6 +83,19 @@ function createInfrastructureFixture(rootDir: string): void {
   writeFile(path.join(rootDir, "infra", "modules", "cosmosdb.bicep"), "// baseline cosmos\n");
 }
 
+function addLegacyContainerToInfrastructure(rootDir: string, modelKebab: string): void {
+  const containerPath = `containers/${modelKebab}-container.bicep`;
+  fs.appendFileSync(
+    path.join(rootDir, "infra", "main.bicep"),
+    `\nmodule ${modelKebab.replace(/-([a-z])/g, (_, letter: string) => letter.toUpperCase())}Container '${containerPath}' = {\n  name: '${modelKebab}-container'\n}\n`,
+    "utf-8"
+  );
+  writeFile(
+    path.join(rootDir, "infra", containerPath),
+    "param partitionKeyPath string = '/id'\n\nresource container 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2023-11-15' = {\n  name: 'Todos'\n}\n"
+  );
+}
+
 function createNativeBackendFixture(rootDir: string, backendLanguage: "csharp" | "python"): void {
   createProjectFixture(rootDir);
   writeFile(
@@ -254,6 +267,94 @@ describe("plan / apply / drift / verify machine commands", () => {
     ]);
   });
 
+  it("updates baseline-owned model artifacts without creating a second container migration", async () => {
+    createNativeBackendFixture(tempDir, "csharp");
+    writeFile(path.join(tempDir, "shared", "models", "answer-record.ts"), createModelSource("AnswerRecord"));
+    createInfrastructureFixture(tempDir);
+    addLegacyContainerToInfrastructure(tempDir, "answer-record");
+    const original = initializeLegacyMigrations(tempDir);
+    const restoreCodegenMocks = mockSuccessfulNativeCodegen();
+
+    try {
+      const baselineModelApply = await runMachine(machineArgs("apply", "scaffold", "answer-record"));
+      expect(baselineModelApply.exitCode).toBe(0);
+      expect(loadMigrationManifest(tempDir).migrations).toEqual([]);
+
+      writeFile(
+        path.join(tempDir, "shared", "models", "written-mock-session.ts"),
+        createModelSource("WrittenMockSession")
+      );
+      const newModelApply = await runMachine(machineArgs("apply", "scaffold", "written-mock-session"));
+      expect(newModelApply.exitCode).toBe(0);
+      expect(loadMigrationManifest(tempDir).migrations).toEqual([
+        expect.objectContaining({
+          version: 1,
+          slug: "create-written-mock-session-container",
+          sourceModel: "WrittenMockSession",
+        }),
+      ]);
+
+      writeFile(
+        path.join(tempDir, "shared", "models", "answer-record.ts"),
+        createModelSource("AnswerRecord", "\n  writtenMockSessionId: z.string().optional(),")
+      );
+      const plan = await runMachine(machineArgs("plan", "scaffold", "answer-record"));
+
+      expect(plan.exitCode).toBe(0);
+      expect(plan.response.ok).toBe(true);
+      expect(plan.response.data.operations).toEqual(expect.arrayContaining([
+        expect.objectContaining({ path: "functions/openapi/answer-record.openapi.json", action: "update" }),
+        expect.objectContaining({
+          path: "functions/generated/csharp-models/src/SwallowKitBackendModels/Model/AnswerRecord.cs",
+          action: "update",
+        }),
+        expect.objectContaining({ path: "app/answer-record/_components/AnswerRecordForm.tsx", action: "update" }),
+      ]));
+      expect(plan.response.data.operations).not.toEqual(expect.arrayContaining([
+        expect.objectContaining({ path: expect.stringContaining("infra/migrations/0002-") }),
+      ]));
+      expect(plan.response.data.operations).not.toEqual(expect.arrayContaining([
+        expect.objectContaining({ path: MIGRATION_MANIFEST_PATH.replace(/\\/g, "/") }),
+      ]));
+
+      const apply = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+      expect(apply.exitCode).toBe(0);
+      const updated = loadMigrationManifest(tempDir);
+      expect(updated.migrations).toHaveLength(1);
+      expect(updated.baseline).toEqual(original.baseline);
+
+      const verify = await runMachine(machineArgs("verify", "project", "--checks", "structure,drift"));
+      expect(verify.exitCode).toBe(0);
+      expect(verify.response.ok).toBe(true);
+      expect(verify.response.data.summary.done).toBe(true);
+    } finally {
+      restoreCodegenMocks();
+    }
+  });
+
+  it("requires an explicit migration when a baseline-owned container partition key changes", async () => {
+    createProjectFixture(tempDir);
+    writeFile(
+      path.join(tempDir, "shared", "models", "todo.ts"),
+      `${createModelSource("Todo")}\nexport const partitionKey = '/tenantId';\n`
+    );
+    createInfrastructureFixture(tempDir);
+    addLegacyContainerToInfrastructure(tempDir, "todo");
+    initializeLegacyMigrations(tempDir);
+
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only"));
+
+    expect(plan.exitCode).toBe(1);
+    expect(plan.response.ok).toBe(false);
+    expect(plan.response.status).toBe("blocked");
+    expect(plan.response.error.code).toBe("baseline-container-configuration-change");
+    expect(plan.response.error.details).toEqual(expect.objectContaining({
+      baselinePartitionKey: "/id",
+      requestedPartitionKey: "/tenantId",
+    }));
+    expect(fs.existsSync(path.join(tempDir, "infra", "migrations", "0001-create-todo-container"))).toBe(false);
+  });
+
   it("uses the same approval-free manifest update for a non-legacy project", async () => {
     createProjectFixture(tempDir);
     createInfrastructureFixture(tempDir);

package/src/__tests__/provision-output.test.ts

@@ -0,0 +1,313 @@
+import * as fs from "fs";
+import * as path from "path";
+import * as childProcess from "child_process";
+import type { SpiedFunction } from "jest-mock";
+import * as migrations from "../core/project/migrations";
+import prompts from "prompts";
+import { createProvisionCommand } from "../cli/commands/provision";
+import { planProvisionOperation } from "../core/operations/provision-operations";
+import { createCustomMigration } from "../core/operations/migration-generator";
+import { runMachineCli } from "../machine";
+import { buildSwallowKitToolDefinitions } from "../mcp";
+
+jest.mock("child_process", () => ({
+  ...jest.requireActual<typeof import("child_process")>("child_process"),
+  spawnSync: jest.fn(),
+}));
+jest.mock("prompts", () => jest.fn());
+
+const subscription = "00000000-0000-4000-8000-000000000001";
+const token = "fictional-swa-token-for-tests";
+const profile = '<publishData><publishProfile profileName="fictional" userPWD="fictional-password" /></publishData>';
+const resources = {
+  staticWebAppName: "swa-fictional",
+  staticWebAppUrl: "https://fictional.example",
+  functionsAppName: "func-fictional",
+  functionsAppUrl: "https://functions.example",
+  cosmosDbAccountName: "cosmos-fictional",
+  cosmosDatabaseName: "fictionalDatabase",
+};
+type AzResponse = { status: number | null; stdout: string; stderr?: string; error?: Error; signal?: NodeJS.Signals | null };
+const az = jest.mocked(childProcess.spawnSync as (
+  file: string, args: readonly string[]
+) => childProcess.SpawnSyncReturns<string>);
+
+describe("stable human provision setup output", () => {
+  const cwd = process.cwd();
+  let root: string;
+  let exists: boolean;
+  let tags: Record<string, string>;
+  let outputResponse: AzResponse;
+  let tokenResponse: AzResponse;
+  let profileResponse: AzResponse;
+  let failCommand: string | undefined;
+  let log: SpiedFunction<typeof console.log>;
+  let warn: SpiedFunction<typeof console.warn>;
+  const options = { resourceGroup: "rg-fictional", subscription, location: "japaneast", swaLocation: "eastasia" };
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(cwd, ".provision-output-test-"));
+    process.chdir(root);
+    fs.writeFileSync(path.join(root, "swallowkit.config.js"), "module.exports = {};\n");
+    fs.mkdirSync(path.join(root, "infra"));
+    fs.writeFileSync(path.join(root, "infra", "main.bicep"), "targetScope = 'resourceGroup'\n");
+    fs.writeFileSync(path.join(root, "infra", "main.parameters.json"), JSON.stringify({ parameters: { projectName: { value: "fictional" } } }));
+    migrations.saveMigrationManifest(migrations.createMigrationManifest(root), root);
+    exists = false;
+    tags = {};
+    outputResponse = { status: 0, stdout: JSON.stringify(resources) };
+    tokenResponse = { status: 0, stdout: token };
+    profileResponse = { status: 0, stdout: profile };
+    failCommand = undefined;
+    log = jest.spyOn(console, "log").mockImplementation(() => undefined);
+    warn = jest.spyOn(console, "warn").mockImplementation(() => undefined);
+    const respond = (args: readonly string[]): AzResponse => {
+      const command = args.slice(0, 3).join(" ");
+      if (command === failCommand) return { status: 1, stdout: "", stderr: "fictional failure" };
+      if (args[0] === "--version") return { status: 0, stdout: "fictional az" };
+      if (args[0] === "account") return { status: 0, stdout: subscription };
+      if (args[0] === "group" && args[1] === "exists") return { status: 0, stdout: String(exists) };
+      if (args[0] === "group" && args[1] === "show") return { status: 0, stdout: JSON.stringify({ id: `/subscriptions/${subscription}/resourceGroups/rg-fictional`, tags }) };
+      if (args[0] === "group" && args[1] === "create") {
+        exists = true;
+        return { status: 0, stdout: "{}" };
+      }
+      if (args[0] === "group" && args[1] === "update") {
+        const assignment = args[args.indexOf("--set") + 1];
+        const separator = assignment.indexOf("=");
+        tags[assignment.slice(5, separator)] = assignment.slice(separator + 1);
+        return { status: 0, stdout: "{}" };
+      }
+      if (args[0] === "tag") {
+        const assignment = args[args.indexOf("--tags") + 1];
+        const separator = assignment.indexOf("=");
+        tags[assignment.slice(0, separator)] = assignment.slice(separator + 1);
+        return { status: 0, stdout: "{}" };
+      }
+      if (command === "deployment group create") return { status: 0, stdout: JSON.stringify({ properties: { outputs: {} } }) };
+      if (command === "deployment group what-if") return { status: 0, stdout: '{"changes":[]}' };
+      if (command === "deployment group show") {
+        // Output/secret retrieval must happen only after the stable apply has
+        // committed its manifest and deleted the plan.
+        expect(tags).not.toEqual({});
+        expect(fs.readdirSync(path.join(root, ".swallowkit", "state", "plans"))).toEqual([]);
+        return outputResponse;
+      }
+      if (command === "staticwebapp secrets list") return tokenResponse;
+      if (command === "webapp deployment list-publishing-profiles") return profileResponse;
+      throw new Error(`Unexpected mocked command: ${args.join(" ")}`);
+    };
+    az.mockImplementation((_file, args = []) => ({
+      pid: 0, output: [], signal: null, stderr: "", ...respond(args),
+    }));
+  });
+
+  afterEach(() => {
+    process.chdir(cwd);
+    fs.rmSync(root, { recursive: true, force: true });
+    jest.restoreAllMocks();
+    az.mockReset();
+  });
+
+  async function human(extra: string[] = [], explicitSubscription = true): Promise<void> {
+    await createProvisionCommand().parseAsync([
+      "node", "provision", "-g", options.resourceGroup,
+      "--location", options.location, "--swa-location", options.swaLocation,
+      ...(explicitSubscription ? ["--subscription", subscription] : []), "--approve", ...extra,
+    ]);
+  }
+
+  function transcript(): string {
+    return [...log.mock.calls, ...warn.mock.calls].flat().join("\n");
+  }
+
+  function queries(): Array<readonly string[]> {
+    return az.mock.calls.map((call) => call[1] ?? []).filter((args) =>
+      args[0] === "staticwebapp" || args[0] === "webapp" || args.slice(0, 3).join(" ") === "deployment group show");
+  }
+
+  function assertNoSecretsOnDisk(directory = root): void {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const entryPath = path.join(directory, entry.name);
+      if (entry.isDirectory()) assertNoSecretsOnDisk(entryPath);
+      else {
+        const content = fs.readFileSync(entryPath, "utf-8");
+        expect(content).not.toContain(token);
+        expect(content).not.toContain("fictional-password");
+      }
+    }
+  }
+
+  it("prints all resource fields and CI/CD values only after apply succeeds, scoped to the deployment target", async () => {
+    await human();
+    for (const value of Object.values(resources)) expect(transcript()).toContain(value);
+    for (const label of ["AZURE_STATIC_WEB_APPS_API_TOKEN", "AZURE_FUNCTIONAPP_NAME", "AZURE_FUNCTIONAPP_PUBLISH_PROFILE"]) expect(transcript()).toContain(`[${label}]`);
+    expect(transcript()).toContain(token);
+    expect(transcript()).toContain(profile);
+    expect(transcript()).not.toContain("Run manually");
+    expect(queries()).toHaveLength(3);
+    for (const args of queries()) {
+      expect(args[args.indexOf("--subscription") + 1]).toBe(subscription);
+      expect(args[args.indexOf("--resource-group") + 1]).toBe(options.resourceGroup);
+    }
+    expect(queries()[0]).toEqual(expect.arrayContaining(["--name", "swallowkit-baseline"]));
+    expect(queries()[1]).toEqual(expect.arrayContaining(["--query", "properties.apiKey", "-o", "tsv"]));
+    expect(queries()[2]).toContain("--xml");
+    assertNoSecretsOnDisk();
+  });
+
+  it("pins the active subscription before planning when the flag is omitted", async () => {
+    await human([], false);
+    expect(az.mock.calls[0][1]).toEqual(["account", "show", "--query", "id", "-o", "tsv"]);
+    for (const args of queries()) expect(args).toEqual(expect.arrayContaining(["--subscription", subscription]));
+  });
+
+  it.each([
+    ["failed", { status: 1, stdout: token, stderr: "fictional sensitive diagnostic" }],
+    ["missing", { status: 0, stdout: "" }],
+    ["null", { status: 0, stdout: "null" }],
+    ["truncated", { status: 0, stdout: token, error: new Error("ENOBUFS fictional") }],
+    ["interrupted", { status: 0, stdout: token, signal: "SIGTERM" }],
+    ["timeout", { status: null, stdout: token, error: new Error("ETIMEDOUT fictional") }],
+  ] satisfies Array<[string, AzResponse]>)("shows safe manual commands for %s credential retrieval without leaking partial output", async (_name, response) => {
+    tokenResponse = response;
+    profileResponse = { ...response, stdout: response.stdout && response.stdout !== "null" ? profile : response.stdout };
+    await human();
+    expect(transcript()).toContain("Could not retrieve automatically");
+    expect(transcript()).toContain("Run manually: az staticwebapp secrets list");
+    expect(transcript()).toContain("Run manually: az webapp deployment list-publishing-profiles");
+    expect(transcript()).toContain(`--subscription ${subscription}`);
+    expect(transcript()).not.toContain(token);
+    expect(transcript()).not.toContain(profile);
+    expect(transcript()).not.toContain("fictional sensitive diagnostic");
+    assertNoSecretsOnDisk();
+  });
+
+  it("rejects incomplete XML rather than presenting it as a publish profile", async () => {
+    profileResponse.stdout = '<publishData><publishProfile userPWD="fictional-password" />';
+    await human();
+    expect(transcript()).toContain("Run manually: az webapp deployment list-publishing-profiles");
+    expect(transcript()).not.toContain("fictional-password");
+  });
+
+  it("accepts XML publishing profiles containing nested database elements", async () => {
+    profileResponse.stdout = '<publishData><publishProfile profileName="fictional" userPWD="fictional-password"><databases /></publishProfile></publishData>';
+    await human();
+    expect(transcript()).toContain(profileResponse.stdout);
+    expect(transcript()).not.toContain("Run manually");
+  });
+
+  it("shows manual fallbacks for thrown credential errors without printing their details", async () => {
+    const implementation = az.getMockImplementation();
+    if (!implementation) throw new Error("Missing Azure mock implementation.");
+    az.mockImplementation((file, args = []) => {
+      if (args[0] === "webapp" || args[0] === "staticwebapp") throw new Error("fictional-password");
+      return implementation(file, args);
+    });
+    await human();
+    expect(transcript()).toContain("Run manually: az staticwebapp secrets list");
+    expect(transcript()).toContain("Run manually: az webapp deployment list-publishing-profiles");
+    expect(transcript()).not.toContain("fictional-password");
+  });
+
+  it.each(["", "{}", "null", "invalid-json"])("shows manual output and credential commands when resource outputs are unavailable (%s)", async (stdout) => {
+    outputResponse.stdout = stdout;
+    await human();
+    expect(transcript()).toContain("resource name missing");
+    expect(transcript()).toContain('"<swa-name>"');
+    expect(transcript()).toContain('"<functions-app-name>"');
+    expect(queries()).toHaveLength(1);
+    expect(transcript()).not.toContain(token);
+    expect(transcript()).not.toContain(profile);
+  });
+
+  it.each(["deployment group create", "group update --name"])("does not query credentials after %s fails", async (command) => {
+    failCommand = command;
+    await expect(human()).rejects.toThrow("Command failed");
+    expect(queries()).toEqual([]);
+    expect(transcript()).not.toContain("Provision completed");
+  });
+
+  it("does not query credentials if ledger persistence fails after deployment and tag success", async () => {
+    jest.spyOn(migrations, "replaceMigrationManifest").mockImplementation(() => { throw new Error("fictional ledger failure"); });
+    await expect(human()).rejects.toThrow("fictional ledger failure");
+    expect(queries()).toEqual([]);
+  });
+
+  it("does not query credentials on human cancellation", async () => {
+    const stdinTty = Object.getOwnPropertyDescriptor(process.stdin, "isTTY");
+    const stdoutTty = Object.getOwnPropertyDescriptor(process.stdout, "isTTY");
+    Object.defineProperty(process.stdin, "isTTY", { value: true, configurable: true });
+    Object.defineProperty(process.stdout, "isTTY", { value: true, configurable: true });
+    jest.mocked(prompts).mockResolvedValue({ approved: false });
+    try {
+      await createProvisionCommand().parseAsync([
+        "node", "provision", "-g", options.resourceGroup, "--subscription", subscription,
+        "--location", options.location, "--swa-location", options.swaLocation,
+      ]);
+      expect(transcript()).toContain("Provision cancelled");
+      expect(queries()).toEqual([]);
+      expect(exists).toBe(false);
+    } finally {
+      if (stdinTty) Object.defineProperty(process.stdin, "isTTY", stdinTty);
+      else Reflect.deleteProperty(process.stdin, "isTTY");
+      if (stdoutTty) Object.defineProperty(process.stdout, "isTTY", stdoutTty);
+      else Reflect.deleteProperty(process.stdout, "isTTY");
+    }
+  });
+
+  it("restores setup output after a successful explicit reconcile", async () => {
+    exists = true;
+    const manifest = migrations.loadMigrationManifest(root);
+    tags[migrations.getMigrationTagKey(manifest.projectId)] = migrations.encodeMigrationState({ schemaVersion: 1, version: 0, checksum: manifest.baseline.checksum });
+    await human(["--reconcile"]);
+    expect(transcript()).toContain("Provision completed (reconcile)");
+    expect(transcript()).toContain(token);
+    assertNoSecretsOnDisk();
+  });
+
+  it("does not query credentials on no-op or adoption", async () => {
+    exists = true;
+    const manifest = migrations.loadMigrationManifest(root);
+    tags[migrations.getMigrationTagKey(manifest.projectId)] = migrations.encodeMigrationState({ schemaVersion: 1, version: 0, checksum: manifest.baseline.checksum });
+    await human();
+    expect(queries()).toEqual([]);
+    tags = {};
+    migrations.replaceMigrationManifest({ ...manifest, baseline: { ...manifest.baseline, legacy: true } }, root);
+    await human(["--adopt-existing", "--baseline", "0", "--what-if"]);
+    expect(queries()).toEqual([]);
+  });
+
+  it("reads baseline resource outputs after a successful migration rather than using container-only migration outputs", async () => {
+    exists = true;
+    const manifest = migrations.loadMigrationManifest(root);
+    tags[migrations.getMigrationTagKey(manifest.projectId)] = migrations.encodeMigrationState({ schemaVersion: 1, version: 0, checksum: manifest.baseline.checksum });
+    createCustomMigration("fictional-addition", root);
+    await human();
+    expect(transcript()).toContain("Provision completed (migrate)");
+    expect(transcript()).toContain(token);
+    expect(queries()[0]).toEqual(expect.arrayContaining(["--name", "swallowkit-baseline"]));
+    assertNoSecretsOnDisk();
+  });
+
+  it("keeps successful machine and MCP apply responses credential-free and performs no secret queries", async () => {
+    const plan = await planProvisionOperation(options);
+    const writes: string[] = [];
+    jest.spyOn(process.stdout, "write").mockImplementation((chunk) => { writes.push(String(chunk)); return true; });
+    await runMachineCli(["node", "swallowkit", "machine", "apply", "provision", "--plan", plan.planId, "--approve"]);
+    const stdout = writes.join("");
+    expect(JSON.parse(stdout).ok).toBe(true);
+    const runner = jest.fn(async () => ({ stdout, stderr: "", exitCode: 0 }));
+    const tool = buildSwallowKitToolDefinitions(runner).find((entry) => entry.name === "swallowkit_apply_provision");
+    if (!tool) throw new Error("Missing apply provision MCP tool.");
+    const response = await tool.handler({ planId: plan.planId, approve: true });
+    expect(runner).toHaveBeenCalledWith(["apply", "provision", "--plan", plan.planId, "--approve"]);
+    for (const content of [stdout, JSON.stringify(response)]) {
+      expect(content).not.toContain(token);
+      expect(content).not.toContain("fictional-password");
+      expect(content).not.toContain("AZURE_STATIC_WEB_APPS_API_TOKEN");
+    }
+    expect(queries()).toEqual([]);
+    assertNoSecretsOnDisk();
+  });
+});

package/src/__tests__/ui-generator.test.ts

@@ -22,6 +22,27 @@ const namedAuthOptions = {
   authContextImport: "@/lib/auth/schemes/staff/auth-context",
 };
 
+describe("dynamic route Cache Components compatibility", () => {
+  it.each([undefined, namedAuthOptions])("keeps detail/edit URL hooks below Suspense with auth=%j", (authOptions) => {
+    const model = createBasicModelInfo();
+    for (const [code, page, content] of [
+      [generateDetailPage(model, "@myapp/shared", authOptions), "TodoDetailPage", "TodoDetailContent"],
+      [generateEditPage(model, "@myapp/shared", authOptions), "EditTodoPage", "EditTodoContent"],
+    ]) {
+      expect(code).toContain("import { Suspense, useEffect, useState } from 'react'");
+      const wrapper = code.slice(code.indexOf(`export default function ${page}`), code.indexOf(`function ${content}`));
+      expect(wrapper).toContain("<Suspense fallback=");
+      expect(wrapper).toContain(`<${content} />`);
+      expect(wrapper).not.toContain("useParams()");
+      expect(wrapper).not.toContain("useAuth()");
+      expect(code.slice(code.indexOf(`function ${content}`))).toContain("const params = useParams()");
+      expect(code).toContain("Loading...");
+      expect(code).toContain("fetch(`/api/todo/${id}`)");
+      expect(code).not.toMatch(/export const (dynamic|revalidate|fetchCache|instant)\b/);
+    }
+  });
+});
+
 describe("generateAuthLayout", () => {
   it("uses the same resolved auth context as authenticated CRUD pages", () => {
     const model = createBasicModelInfo({ name: "Product" });

package/src/cli/commands/init.ts

@@ -1601,8 +1601,6 @@ async function createHomePage(projectDir: string, pm: PackageManager = 'pnpm') {
   
   const pageContent = `'use client'
 
-export const dynamic = 'force-dynamic';
-
 import { useState } from 'react';
 import { scaffoldConfig } from '@/lib/scaffold-config';
 
@@ -3434,4 +3432,3 @@ async function createAzurePipelines(projectDir: string, pm: PackageManager, back
 
   console.log('✅ Azure Pipelines created\n');
 }
-