swallowkit 1.1.1 → 1.1.3

package/src/cli/commands/provision.ts

@@ -1,7 +1,83 @@
 import { Command } from "commander";
 import prompts from "prompts";
+import { spawnSync } from "child_process";
 import { ensureSwallowKitProject } from "../../core/config";
-import { applyProvisionOperation, planProvisionOperation } from "../../core/operations/provision-operations";
+import { applyProvisionOperation, planProvisionOperation, ProvisionPlanData } from "../../core/operations/provision-operations";
+
+function readAzOutput(args: string[]): string | undefined {
+  try {
+    const result = spawnSync("az", args, {
+      shell: false,
+      encoding: "utf-8",
+      timeout: 60_000,
+      maxBuffer: 4 * 1024 * 1024,
+    });
+    if (result.status === 0 && !result.error && !result.signal) {
+      const value = result.stdout?.trim();
+      if (value && value !== "null") return value;
+    }
+  } catch {
+    // Callers report a safe fallback without displaying credential-bearing output.
+  }
+  return undefined;
+}
+
+function manualAzCommand(args: string[]): string {
+  return `az ${args.map((arg) => /^[A-Za-z0-9._:/=-]+$/.test(arg) ? arg : JSON.stringify(arg)).join(" ")}`;
+}
+
+function readCiCdSecret(args: string[], resourceKnown: boolean, xml = false): string {
+  const value = resourceKnown ? readAzOutput(args) : undefined;
+  const valid = value && (xml
+    ? /^(?:<\?xml[^>]*\?>\s*)?<publishData(?:\s[^>]*)?>[\s\S]*<\/publishData>$/.test(value)
+      && /<publishProfile\s[^>]+(?:\/>|>[\s\S]*<\/publishProfile>)/.test(value)
+    : /^\S+$/.test(value));
+  if (valid) return `    ${value}\n`;
+  return `    Could not retrieve automatically${resourceKnown ? "" : " (resource name missing)"}.\n    Run manually: ${manualAzCommand(args)}\n`;
+}
+
+// Human CLI only: called after deployment, migration tags, and ledger writes succeed.
+function printProvisionSetup(plan: ProvisionPlanData, subscription: string): void {
+  if (!["bootstrap", "reconcile", "migrate"].includes(plan.mode)) return;
+  const target = ["--resource-group", plan.resourceGroup, "--subscription", subscription];
+  const fields = ["staticWebAppName", "staticWebAppUrl", "functionsAppName", "functionsAppUrl", "cosmosDbAccountName", "cosmosDatabaseName"] as const;
+  const outputArgs = [
+    "deployment", "group", "show", "--name", "swallowkit-baseline", ...target,
+    "--query", `{${fields.map((field) => `${field}:properties.outputs.${field}.value`).join(",")}}`, "-o", "json",
+  ];
+  let outputs: Record<string, unknown> = {};
+  const raw = readAzOutput(outputArgs);
+  try {
+    const parsed: unknown = raw ? JSON.parse(raw) : undefined;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Invalid outputs.");
+    outputs = parsed as Record<string, unknown>;
+    if (!fields.every((field) => typeof outputs[field] === "string" && outputs[field])) {
+      throw new Error("Resource outputs missing.");
+    }
+  } catch {
+    console.warn(`Provision succeeded, but resource information could not be read. Do not redeploy to retrieve it.\nRun manually: ${manualAzCommand(outputArgs)}`);
+  }
+  console.log("\nResource information:");
+  console.log(`  resourceGroup: ${plan.resourceGroup}`);
+  console.log(`  subscription: ${subscription}`);
+  for (const field of fields) {
+    if (typeof outputs[field] === "string" && outputs[field]) console.log(`  ${field}: ${outputs[field]}`);
+  }
+  const knownName = (value: unknown): value is string => typeof value === "string" && /^[A-Za-z0-9-]+$/.test(value);
+  const swaKnown = knownName(outputs.staticWebAppName);
+  const functionsKnown = knownName(outputs.functionsAppName);
+  const swaName = swaKnown ? String(outputs.staticWebAppName) : "<swa-name>";
+  const functionsName = functionsKnown ? String(outputs.functionsAppName) : "<functions-app-name>";
+  console.log("\nCI/CD settings (save these as secrets in GitHub Actions or Azure Pipelines):\n");
+  console.log("  [AZURE_STATIC_WEB_APPS_API_TOKEN]");
+  console.log(readCiCdSecret(["staticwebapp", "secrets", "list", "--name", swaName, ...target, "--query", "properties.apiKey", "-o", "tsv"], swaKnown));
+  console.log("  [AZURE_FUNCTIONAPP_NAME]");
+  console.log(functionsKnown ? `    ${functionsName}\n` : "    Resource name missing; inspect the deployment outputs using the command above.\n");
+  console.log("  [AZURE_FUNCTIONAPP_PUBLISH_PROFILE]");
+  console.log(readCiCdSecret(["webapp", "deployment", "list-publishing-profiles", "--name", functionsName, ...target, "--xml"], functionsKnown, true));
+  console.log("  These values are shown only in this terminal; SwallowKit does not store them. Treat them as secrets.");
+  console.log("  Next: configure your CI/CD pipeline and manually trigger the first deployment.");
+}
 
 const PRIMARY_REGIONS = [
   { title: "Japan East (japaneast)", value: "japaneast" },
@@ -64,7 +140,8 @@ async function resolveLocations(options: ProvisionCliOptions): Promise<{ locatio
   return { location, swaLocation };
 }
 
-export const provisionCommand = new Command("provision")
+export function createProvisionCommand(): Command {
+  return new Command("provision")
   .description("Bootstrap, adopt, migrate, or explicitly reconcile Azure resources")
   .requiredOption("-g, --resource-group <name>", "Resource group name")
   .option("--subscription <id>", "Azure subscription ID")
@@ -78,10 +155,14 @@ export const provisionCommand = new Command("provision")
   .action(async (options: ProvisionCliOptions) => {
     ensureSwallowKitProject("provision");
     const locations = await resolveLocations(options);
+    const subscription = options.subscription ?? readAzOutput(["account", "show", "--query", "id", "-o", "tsv"]);
+    if (!subscription || !/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(subscription)) {
+      throw new Error("Could not determine the Azure subscription. Run az account show --query id -o tsv, then retry with --subscription <id>.");
+    }
     const baseline = options.baseline === undefined ? undefined : Number(options.baseline);
     const plan = await planProvisionOperation({
       resourceGroup: options.resourceGroup,
-      subscription: options.subscription,
+      subscription,
       location: locations.location,
       swaLocation: locations.swaLocation,
       whatIf: options.whatIf,
@@ -121,4 +202,9 @@ export const provisionCommand = new Command("provision")
 
     const result = await applyProvisionOperation({ planId: plan.planId, approve: true });
     console.log(`Provision completed (${plan.mode}). ${result.executedCommands.length} command(s) executed.`);
+    for (const warning of result.warnings) console.warn(`Warning: ${warning}`);
+    printProvisionSetup(plan, subscription);
   });
+}
+
+export const provisionCommand = createProvisionCommand();

package/src/cli/commands/scaffold.ts

@@ -851,7 +851,11 @@ export async function generateCosmosContainer(modelInfo: any, session: FileOpera
     return;
   }
   const migration = generateModelContainerMigration(modelInfo, session);
-  console.log(`✅ Created migration ${migration.version}: ${migration.template}`);
+  if (migration) {
+    console.log(`✅ Created migration ${migration.version}: ${migration.template}`);
+  } else {
+    console.log(`ℹ️  Cosmos DB container is already owned by the migration baseline. Skipping infrastructure migration.`);
+  }
 }
 
 /**

package/src/core/operations/migration-generator.ts

@@ -68,6 +68,37 @@ function appendMigration(manifest: MigrationManifest, migration: InfrastructureM
   };
 }
 
+function baselineOwnsModelContainer(
+  manifest: MigrationManifest,
+  model: { name: string; partitionKey: string },
+  session: FileOperationSession
+): boolean {
+  const containerSlug = normalizeSlug(model.name);
+  const containerPath = `infra/containers/${containerSlug}-container.bicep`;
+  const mainPath = "infra/main.bicep";
+  const baselinePaths = new Set(manifest.baseline.files.map((file) => file.path.replace(/\\/g, "/")));
+  if (!baselinePaths.has(containerPath) || !baselinePaths.has(mainPath)) return false;
+
+  const mainBicep = session.readFile(path.join(session.rootDirectory, mainPath));
+  const wired = mainBicep.includes(`'containers/${containerSlug}-container.bicep'`) ||
+    mainBicep.includes(`"containers/${containerSlug}-container.bicep"`);
+  if (!wired) return false;
+
+  const containerBicep = session.readFile(path.join(session.rootDirectory, containerPath));
+  const baselinePartitionKey = containerBicep.match(
+    /param\s+partitionKeyPath\s+string\s*=\s*['"]([^'"]+)['"]/
+  )?.[1];
+  if (baselinePartitionKey && baselinePartitionKey !== model.partitionKey) {
+    throw new MachineCommandError(
+      "baseline-container-configuration-change",
+      `Model ${model.name} changes the partition key of a baseline-owned container. Create an explicit infrastructure migration instead of regenerating the container.`,
+      { model: model.name, baselinePartitionKey, requestedPartitionKey: model.partitionKey, containerPath },
+      "blocked"
+    );
+  }
+  return true;
+}
+
 function initializeMigrations(projectRoot: string, legacy: boolean): MigrationManifest {
   const manifest = createMigrationManifest(projectRoot, { legacy });
   const session = new FileOperationSession("commit", projectRoot);
@@ -124,9 +155,12 @@ param location string
 export function generateModelContainerMigration(
   model: { name: string; partitionKey: string },
   session: FileOperationSession = new FileOperationSession("commit")
-): InfrastructureMigration {
+): InfrastructureMigration | null {
   const manifest = readManifestForSession(session);
   const existing = manifest.migrations.find((migration) => migration.source === "model" && migration.sourceModel === model.name);
+  if (!existing && baselineOwnsModelContainer(manifest, model, session)) {
+    return null;
+  }
   const slug = normalizeSlug(`create-${model.name}-container`);
   const version = existing?.version ?? manifest.migrations.length + 1;
   const directory = path.join("infra", "migrations", `${formatVersion(version)}-${slug}`);

package/src/core/project/agent-templates/AGENTS.md

@@ -254,6 +254,32 @@ Additional model-change facts:
 
 ## New Models / CRUD Features
 
+For every new persistent model, follow the current SwallowKit model-creation
+and infrastructure-generation workflow, **whether or not it uses custom APIs**.
+Adding a hand-written schema alone is not completion.
+
+1. Inspect current capabilities and entities. Use
+   `{{runCmd}} swallowkit create-model <name>` or the agent-facing equivalent
+   `{{runCmd}} swallowkit machine generate model <name> --overwrite never`.
+   This creates the schema, shared export, and model metadata; it does not
+   create the Cosmos DB container by itself.
+2. Author domain fields, then plan/apply scaffold for that model using the
+   current options. In 1.x, scaffold adds new Cosmos DB containers as versioned
+   Bicep migrations under `infra/migrations/`, recorded in its `manifest.json`.
+   Existing baseline-owned containers remain wired in `infra/main.bicep`;
+   do not add duplicate containers or edit applied migrations.
+3. Verify the correspondence between the model, container name/partition key,
+   Bicep wiring or migration manifest, and `.swallowkit/artifacts.json`
+   generation ledger. Use `machine inspect entities`, `machine inspect infra`,
+   `machine inspect drift`, and `machine verify project`; inspect the actual
+   files too. Local generation/verification does not mean Azure was deployed.
+
+Custom APIs and non-persistent types remain ai-authored. Connector-backed
+models follow their connector workflow rather than inventing Cosmos containers.
+If generation is omitted, state the reason and unfinished work explicitly.
+Never describe a project as deployable while required persistence infrastructure
+is missing; do not hand-edit managed infrastructure or the generation ledger.
+
 Use the `swallowkit-add-model` Agent Skill when available.
 
 Otherwise follow the equivalent runbook under `.swallowkit/workflows/`.

package/src/core/project/agent-templates/shared-models.instructions.md

@@ -52,6 +52,13 @@ After changing a model, do not manually patch generated artifacts.
 
 ## After changing a model
 
+- For new persistent models, follow the root `AGENTS.md` model-creation and
+  scaffold infrastructure workflow even when all APIs are custom. A schema
+  alone is not completion: verify container Bicep wiring or migrations and
+  `.swallowkit/artifacts.json`. Non-persistent types and connector-backed
+  models do not require invented Cosmos containers. If generation is omitted,
+  report the reason and unfinished infrastructure; never claim deployability
+  while required persistence infrastructure is missing.
 - The shared package is consumed via its built `dist/`. `verify project`
   rebuilds it automatically, but if you typecheck manually, build the shared
   package first — "no exported member" errors usually mean a stale `dist/`.

package/src/core/project/workflows.ts

@@ -41,6 +41,12 @@ export function buildWorkflowDocs(runCmd: string): WorkflowDoc[] {
 
 Goal: add a data model and derive CRUD/BFF/UI/infra deterministically.
 
+For persistent models, this workflow is required even when all APIs are custom.
+A hand-written schema alone is not completion. Non-persistent types remain
+ai-authored; connector-backed models follow their connector workflow without
+inventing Cosmos containers. If generation is omitted, report the reason and
+unfinished work; never claim deployability with required infrastructure missing.
+
 ## Responsibility boundary
 
 - **You author freely**: the model schema (\`shared/models/<name>.ts\`) and any business logic.
@@ -60,6 +66,13 @@ Goal: add a data model and derive CRUD/BFF/UI/infra deterministically.
 5. Verify:
    \`${runCmd} swallowkit machine verify project\`
    - \`summary.done: false\` → \`${runCmd} swallowkit machine explain failure\` and repair, then re-verify.
+   - Check model/container name and partition key, versioned container
+     migrations in \`infra/migrations/manifest.json\` (or existing baseline-owned
+     container wiring in \`infra/main.bicep\`), and the
+     generation ledger \`.swallowkit/artifacts.json\`. Use \`machine inspect entities\`,
+     \`machine inspect infra\`, and \`machine inspect drift\` and inspect actual files.
+     Model creation alone does not generate containers; scaffold does.
+     Local verification is not proof of Azure deployment.
 6. If \`dev-seeds/\` exists, update seed JSON for the new model. Seeds are only
    applied by \`${runCmd} swallowkit dev --seed-env <environment>\` — editing the
    JSON alone does nothing.

package/src/core/scaffold/ui-generator.ts

@@ -337,7 +337,7 @@ export function generateDetailPage(model: ModelInfo, sharedPackageName: string,
   
   return `'use client';
 
-import { useEffect, useState } from 'react';
+import { Suspense, useEffect, useState } from 'react';
 import { useParams, useRouter } from 'next/navigation';
 import Link from 'next/link';
 import { z } from 'zod/v4';
@@ -347,6 +347,18 @@ ${hasAuth ? `import { useAuth } from '${authContextImport}';` : ''}
 type ${modelName} = z.infer<typeof ${localSchemaName}>;
 
 export default function ${modelName}DetailPage() {
+  return (
+    <Suspense fallback={
+      <div className="flex items-center justify-center min-h-screen">
+        <div className="text-lg text-gray-900 dark:text-gray-100">Loading...</div>
+      </div>
+    }>
+      <${modelName}DetailContent />
+    </Suspense>
+  );
+}
+
+function ${modelName}DetailContent() {
   const params = useParams();
   const router = useRouter();
   const [${modelCamel}, set${modelName}] = useState<${modelName} | null>(null);
@@ -1031,7 +1043,7 @@ export function generateEditPage(model: ModelInfo, sharedPackageName: string, au
   
   return `'use client';
 
-import { useEffect, useState } from 'react';
+import { Suspense, useEffect, useState } from 'react';
 import { useParams, useRouter } from 'next/navigation';
 import ${modelName}Form from '../../_components/${modelName}Form';
 import { z } from 'zod/v4';
@@ -1041,6 +1053,18 @@ ${hasAuth ? `import { useAuth } from '${authContextImport}';` : ''}
 type ${modelName} = z.infer<typeof ${localSchemaName}>;
 
 export default function Edit${modelName}Page() {
+  return (
+    <Suspense fallback={
+      <div className="flex items-center justify-center min-h-screen">
+        <div className="text-lg">Loading...</div>
+      </div>
+    }>
+      <Edit${modelName}Content />
+    </Suspense>
+  );
+}
+
+function Edit${modelName}Content() {
   const params = useParams();
 ${hasAuth ? '  const router = useRouter();' : ''}
   const [${modelCamel}, set${modelName}] = useState<${modelName} | null>(null);