swallowkit 1.1.2 → 1.1.3

package/src/__tests__/provision-output.test.ts

@@ -0,0 +1,313 @@
+import * as fs from "fs";
+import * as path from "path";
+import * as childProcess from "child_process";
+import type { SpiedFunction } from "jest-mock";
+import * as migrations from "../core/project/migrations";
+import prompts from "prompts";
+import { createProvisionCommand } from "../cli/commands/provision";
+import { planProvisionOperation } from "../core/operations/provision-operations";
+import { createCustomMigration } from "../core/operations/migration-generator";
+import { runMachineCli } from "../machine";
+import { buildSwallowKitToolDefinitions } from "../mcp";
+
+jest.mock("child_process", () => ({
+  ...jest.requireActual<typeof import("child_process")>("child_process"),
+  spawnSync: jest.fn(),
+}));
+jest.mock("prompts", () => jest.fn());
+
+const subscription = "00000000-0000-4000-8000-000000000001";
+const token = "fictional-swa-token-for-tests";
+const profile = '<publishData><publishProfile profileName="fictional" userPWD="fictional-password" /></publishData>';
+const resources = {
+  staticWebAppName: "swa-fictional",
+  staticWebAppUrl: "https://fictional.example",
+  functionsAppName: "func-fictional",
+  functionsAppUrl: "https://functions.example",
+  cosmosDbAccountName: "cosmos-fictional",
+  cosmosDatabaseName: "fictionalDatabase",
+};
+type AzResponse = { status: number | null; stdout: string; stderr?: string; error?: Error; signal?: NodeJS.Signals | null };
+const az = jest.mocked(childProcess.spawnSync as (
+  file: string, args: readonly string[]
+) => childProcess.SpawnSyncReturns<string>);
+
+describe("stable human provision setup output", () => {
+  const cwd = process.cwd();
+  let root: string;
+  let exists: boolean;
+  let tags: Record<string, string>;
+  let outputResponse: AzResponse;
+  let tokenResponse: AzResponse;
+  let profileResponse: AzResponse;
+  let failCommand: string | undefined;
+  let log: SpiedFunction<typeof console.log>;
+  let warn: SpiedFunction<typeof console.warn>;
+  const options = { resourceGroup: "rg-fictional", subscription, location: "japaneast", swaLocation: "eastasia" };
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(cwd, ".provision-output-test-"));
+    process.chdir(root);
+    fs.writeFileSync(path.join(root, "swallowkit.config.js"), "module.exports = {};\n");
+    fs.mkdirSync(path.join(root, "infra"));
+    fs.writeFileSync(path.join(root, "infra", "main.bicep"), "targetScope = 'resourceGroup'\n");
+    fs.writeFileSync(path.join(root, "infra", "main.parameters.json"), JSON.stringify({ parameters: { projectName: { value: "fictional" } } }));
+    migrations.saveMigrationManifest(migrations.createMigrationManifest(root), root);
+    exists = false;
+    tags = {};
+    outputResponse = { status: 0, stdout: JSON.stringify(resources) };
+    tokenResponse = { status: 0, stdout: token };
+    profileResponse = { status: 0, stdout: profile };
+    failCommand = undefined;
+    log = jest.spyOn(console, "log").mockImplementation(() => undefined);
+    warn = jest.spyOn(console, "warn").mockImplementation(() => undefined);
+    const respond = (args: readonly string[]): AzResponse => {
+      const command = args.slice(0, 3).join(" ");
+      if (command === failCommand) return { status: 1, stdout: "", stderr: "fictional failure" };
+      if (args[0] === "--version") return { status: 0, stdout: "fictional az" };
+      if (args[0] === "account") return { status: 0, stdout: subscription };
+      if (args[0] === "group" && args[1] === "exists") return { status: 0, stdout: String(exists) };
+      if (args[0] === "group" && args[1] === "show") return { status: 0, stdout: JSON.stringify({ id: `/subscriptions/${subscription}/resourceGroups/rg-fictional`, tags }) };
+      if (args[0] === "group" && args[1] === "create") {
+        exists = true;
+        return { status: 0, stdout: "{}" };
+      }
+      if (args[0] === "group" && args[1] === "update") {
+        const assignment = args[args.indexOf("--set") + 1];
+        const separator = assignment.indexOf("=");
+        tags[assignment.slice(5, separator)] = assignment.slice(separator + 1);
+        return { status: 0, stdout: "{}" };
+      }
+      if (args[0] === "tag") {
+        const assignment = args[args.indexOf("--tags") + 1];
+        const separator = assignment.indexOf("=");
+        tags[assignment.slice(0, separator)] = assignment.slice(separator + 1);
+        return { status: 0, stdout: "{}" };
+      }
+      if (command === "deployment group create") return { status: 0, stdout: JSON.stringify({ properties: { outputs: {} } }) };
+      if (command === "deployment group what-if") return { status: 0, stdout: '{"changes":[]}' };
+      if (command === "deployment group show") {
+        // Output/secret retrieval must happen only after the stable apply has
+        // committed its manifest and deleted the plan.
+        expect(tags).not.toEqual({});
+        expect(fs.readdirSync(path.join(root, ".swallowkit", "state", "plans"))).toEqual([]);
+        return outputResponse;
+      }
+      if (command === "staticwebapp secrets list") return tokenResponse;
+      if (command === "webapp deployment list-publishing-profiles") return profileResponse;
+      throw new Error(`Unexpected mocked command: ${args.join(" ")}`);
+    };
+    az.mockImplementation((_file, args = []) => ({
+      pid: 0, output: [], signal: null, stderr: "", ...respond(args),
+    }));
+  });
+
+  afterEach(() => {
+    process.chdir(cwd);
+    fs.rmSync(root, { recursive: true, force: true });
+    jest.restoreAllMocks();
+    az.mockReset();
+  });
+
+  async function human(extra: string[] = [], explicitSubscription = true): Promise<void> {
+    await createProvisionCommand().parseAsync([
+      "node", "provision", "-g", options.resourceGroup,
+      "--location", options.location, "--swa-location", options.swaLocation,
+      ...(explicitSubscription ? ["--subscription", subscription] : []), "--approve", ...extra,
+    ]);
+  }
+
+  function transcript(): string {
+    return [...log.mock.calls, ...warn.mock.calls].flat().join("\n");
+  }
+
+  function queries(): Array<readonly string[]> {
+    return az.mock.calls.map((call) => call[1] ?? []).filter((args) =>
+      args[0] === "staticwebapp" || args[0] === "webapp" || args.slice(0, 3).join(" ") === "deployment group show");
+  }
+
+  function assertNoSecretsOnDisk(directory = root): void {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const entryPath = path.join(directory, entry.name);
+      if (entry.isDirectory()) assertNoSecretsOnDisk(entryPath);
+      else {
+        const content = fs.readFileSync(entryPath, "utf-8");
+        expect(content).not.toContain(token);
+        expect(content).not.toContain("fictional-password");
+      }
+    }
+  }
+
+  it("prints all resource fields and CI/CD values only after apply succeeds, scoped to the deployment target", async () => {
+    await human();
+    for (const value of Object.values(resources)) expect(transcript()).toContain(value);
+    for (const label of ["AZURE_STATIC_WEB_APPS_API_TOKEN", "AZURE_FUNCTIONAPP_NAME", "AZURE_FUNCTIONAPP_PUBLISH_PROFILE"]) expect(transcript()).toContain(`[${label}]`);
+    expect(transcript()).toContain(token);
+    expect(transcript()).toContain(profile);
+    expect(transcript()).not.toContain("Run manually");
+    expect(queries()).toHaveLength(3);
+    for (const args of queries()) {
+      expect(args[args.indexOf("--subscription") + 1]).toBe(subscription);
+      expect(args[args.indexOf("--resource-group") + 1]).toBe(options.resourceGroup);
+    }
+    expect(queries()[0]).toEqual(expect.arrayContaining(["--name", "swallowkit-baseline"]));
+    expect(queries()[1]).toEqual(expect.arrayContaining(["--query", "properties.apiKey", "-o", "tsv"]));
+    expect(queries()[2]).toContain("--xml");
+    assertNoSecretsOnDisk();
+  });
+
+  it("pins the active subscription before planning when the flag is omitted", async () => {
+    await human([], false);
+    expect(az.mock.calls[0][1]).toEqual(["account", "show", "--query", "id", "-o", "tsv"]);
+    for (const args of queries()) expect(args).toEqual(expect.arrayContaining(["--subscription", subscription]));
+  });
+
+  it.each([
+    ["failed", { status: 1, stdout: token, stderr: "fictional sensitive diagnostic" }],
+    ["missing", { status: 0, stdout: "" }],
+    ["null", { status: 0, stdout: "null" }],
+    ["truncated", { status: 0, stdout: token, error: new Error("ENOBUFS fictional") }],
+    ["interrupted", { status: 0, stdout: token, signal: "SIGTERM" }],
+    ["timeout", { status: null, stdout: token, error: new Error("ETIMEDOUT fictional") }],
+  ] satisfies Array<[string, AzResponse]>)("shows safe manual commands for %s credential retrieval without leaking partial output", async (_name, response) => {
+    tokenResponse = response;
+    profileResponse = { ...response, stdout: response.stdout && response.stdout !== "null" ? profile : response.stdout };
+    await human();
+    expect(transcript()).toContain("Could not retrieve automatically");
+    expect(transcript()).toContain("Run manually: az staticwebapp secrets list");
+    expect(transcript()).toContain("Run manually: az webapp deployment list-publishing-profiles");
+    expect(transcript()).toContain(`--subscription ${subscription}`);
+    expect(transcript()).not.toContain(token);
+    expect(transcript()).not.toContain(profile);
+    expect(transcript()).not.toContain("fictional sensitive diagnostic");
+    assertNoSecretsOnDisk();
+  });
+
+  it("rejects incomplete XML rather than presenting it as a publish profile", async () => {
+    profileResponse.stdout = '<publishData><publishProfile userPWD="fictional-password" />';
+    await human();
+    expect(transcript()).toContain("Run manually: az webapp deployment list-publishing-profiles");
+    expect(transcript()).not.toContain("fictional-password");
+  });
+
+  it("accepts XML publishing profiles containing nested database elements", async () => {
+    profileResponse.stdout = '<publishData><publishProfile profileName="fictional" userPWD="fictional-password"><databases /></publishProfile></publishData>';
+    await human();
+    expect(transcript()).toContain(profileResponse.stdout);
+    expect(transcript()).not.toContain("Run manually");
+  });
+
+  it("shows manual fallbacks for thrown credential errors without printing their details", async () => {
+    const implementation = az.getMockImplementation();
+    if (!implementation) throw new Error("Missing Azure mock implementation.");
+    az.mockImplementation((file, args = []) => {
+      if (args[0] === "webapp" || args[0] === "staticwebapp") throw new Error("fictional-password");
+      return implementation(file, args);
+    });
+    await human();
+    expect(transcript()).toContain("Run manually: az staticwebapp secrets list");
+    expect(transcript()).toContain("Run manually: az webapp deployment list-publishing-profiles");
+    expect(transcript()).not.toContain("fictional-password");
+  });
+
+  it.each(["", "{}", "null", "invalid-json"])("shows manual output and credential commands when resource outputs are unavailable (%s)", async (stdout) => {
+    outputResponse.stdout = stdout;
+    await human();
+    expect(transcript()).toContain("resource name missing");
+    expect(transcript()).toContain('"<swa-name>"');
+    expect(transcript()).toContain('"<functions-app-name>"');
+    expect(queries()).toHaveLength(1);
+    expect(transcript()).not.toContain(token);
+    expect(transcript()).not.toContain(profile);
+  });
+
+  it.each(["deployment group create", "group update --name"])("does not query credentials after %s fails", async (command) => {
+    failCommand = command;
+    await expect(human()).rejects.toThrow("Command failed");
+    expect(queries()).toEqual([]);
+    expect(transcript()).not.toContain("Provision completed");
+  });
+
+  it("does not query credentials if ledger persistence fails after deployment and tag success", async () => {
+    jest.spyOn(migrations, "replaceMigrationManifest").mockImplementation(() => { throw new Error("fictional ledger failure"); });
+    await expect(human()).rejects.toThrow("fictional ledger failure");
+    expect(queries()).toEqual([]);
+  });
+
+  it("does not query credentials on human cancellation", async () => {
+    const stdinTty = Object.getOwnPropertyDescriptor(process.stdin, "isTTY");
+    const stdoutTty = Object.getOwnPropertyDescriptor(process.stdout, "isTTY");
+    Object.defineProperty(process.stdin, "isTTY", { value: true, configurable: true });
+    Object.defineProperty(process.stdout, "isTTY", { value: true, configurable: true });
+    jest.mocked(prompts).mockResolvedValue({ approved: false });
+    try {
+      await createProvisionCommand().parseAsync([
+        "node", "provision", "-g", options.resourceGroup, "--subscription", subscription,
+        "--location", options.location, "--swa-location", options.swaLocation,
+      ]);
+      expect(transcript()).toContain("Provision cancelled");
+      expect(queries()).toEqual([]);
+      expect(exists).toBe(false);
+    } finally {
+      if (stdinTty) Object.defineProperty(process.stdin, "isTTY", stdinTty);
+      else Reflect.deleteProperty(process.stdin, "isTTY");
+      if (stdoutTty) Object.defineProperty(process.stdout, "isTTY", stdoutTty);
+      else Reflect.deleteProperty(process.stdout, "isTTY");
+    }
+  });
+
+  it("restores setup output after a successful explicit reconcile", async () => {
+    exists = true;
+    const manifest = migrations.loadMigrationManifest(root);
+    tags[migrations.getMigrationTagKey(manifest.projectId)] = migrations.encodeMigrationState({ schemaVersion: 1, version: 0, checksum: manifest.baseline.checksum });
+    await human(["--reconcile"]);
+    expect(transcript()).toContain("Provision completed (reconcile)");
+    expect(transcript()).toContain(token);
+    assertNoSecretsOnDisk();
+  });
+
+  it("does not query credentials on no-op or adoption", async () => {
+    exists = true;
+    const manifest = migrations.loadMigrationManifest(root);
+    tags[migrations.getMigrationTagKey(manifest.projectId)] = migrations.encodeMigrationState({ schemaVersion: 1, version: 0, checksum: manifest.baseline.checksum });
+    await human();
+    expect(queries()).toEqual([]);
+    tags = {};
+    migrations.replaceMigrationManifest({ ...manifest, baseline: { ...manifest.baseline, legacy: true } }, root);
+    await human(["--adopt-existing", "--baseline", "0", "--what-if"]);
+    expect(queries()).toEqual([]);
+  });
+
+  it("reads baseline resource outputs after a successful migration rather than using container-only migration outputs", async () => {
+    exists = true;
+    const manifest = migrations.loadMigrationManifest(root);
+    tags[migrations.getMigrationTagKey(manifest.projectId)] = migrations.encodeMigrationState({ schemaVersion: 1, version: 0, checksum: manifest.baseline.checksum });
+    createCustomMigration("fictional-addition", root);
+    await human();
+    expect(transcript()).toContain("Provision completed (migrate)");
+    expect(transcript()).toContain(token);
+    expect(queries()[0]).toEqual(expect.arrayContaining(["--name", "swallowkit-baseline"]));
+    assertNoSecretsOnDisk();
+  });
+
+  it("keeps successful machine and MCP apply responses credential-free and performs no secret queries", async () => {
+    const plan = await planProvisionOperation(options);
+    const writes: string[] = [];
+    jest.spyOn(process.stdout, "write").mockImplementation((chunk) => { writes.push(String(chunk)); return true; });
+    await runMachineCli(["node", "swallowkit", "machine", "apply", "provision", "--plan", plan.planId, "--approve"]);
+    const stdout = writes.join("");
+    expect(JSON.parse(stdout).ok).toBe(true);
+    const runner = jest.fn(async () => ({ stdout, stderr: "", exitCode: 0 }));
+    const tool = buildSwallowKitToolDefinitions(runner).find((entry) => entry.name === "swallowkit_apply_provision");
+    if (!tool) throw new Error("Missing apply provision MCP tool.");
+    const response = await tool.handler({ planId: plan.planId, approve: true });
+    expect(runner).toHaveBeenCalledWith(["apply", "provision", "--plan", plan.planId, "--approve"]);
+    for (const content of [stdout, JSON.stringify(response)]) {
+      expect(content).not.toContain(token);
+      expect(content).not.toContain("fictional-password");
+      expect(content).not.toContain("AZURE_STATIC_WEB_APPS_API_TOKEN");
+    }
+    expect(queries()).toEqual([]);
+    assertNoSecretsOnDisk();
+  });
+});

package/src/__tests__/ui-generator.test.ts

@@ -22,6 +22,27 @@ const namedAuthOptions = {
   authContextImport: "@/lib/auth/schemes/staff/auth-context",
 };
 
+describe("dynamic route Cache Components compatibility", () => {
+  it.each([undefined, namedAuthOptions])("keeps detail/edit URL hooks below Suspense with auth=%j", (authOptions) => {
+    const model = createBasicModelInfo();
+    for (const [code, page, content] of [
+      [generateDetailPage(model, "@myapp/shared", authOptions), "TodoDetailPage", "TodoDetailContent"],
+      [generateEditPage(model, "@myapp/shared", authOptions), "EditTodoPage", "EditTodoContent"],
+    ]) {
+      expect(code).toContain("import { Suspense, useEffect, useState } from 'react'");
+      const wrapper = code.slice(code.indexOf(`export default function ${page}`), code.indexOf(`function ${content}`));
+      expect(wrapper).toContain("<Suspense fallback=");
+      expect(wrapper).toContain(`<${content} />`);
+      expect(wrapper).not.toContain("useParams()");
+      expect(wrapper).not.toContain("useAuth()");
+      expect(code.slice(code.indexOf(`function ${content}`))).toContain("const params = useParams()");
+      expect(code).toContain("Loading...");
+      expect(code).toContain("fetch(`/api/todo/${id}`)");
+      expect(code).not.toMatch(/export const (dynamic|revalidate|fetchCache|instant)\b/);
+    }
+  });
+});
+
 describe("generateAuthLayout", () => {
   it("uses the same resolved auth context as authenticated CRUD pages", () => {
     const model = createBasicModelInfo({ name: "Product" });

package/src/cli/commands/init.ts

@@ -1601,8 +1601,6 @@ async function createHomePage(projectDir: string, pm: PackageManager = 'pnpm') {
   
   const pageContent = `'use client'
 
-export const dynamic = 'force-dynamic';
-
 import { useState } from 'react';
 import { scaffoldConfig } from '@/lib/scaffold-config';
 
@@ -3434,4 +3432,3 @@ async function createAzurePipelines(projectDir: string, pm: PackageManager, back
 
   console.log('✅ Azure Pipelines created\n');
 }
-

package/src/cli/commands/provision.ts

@@ -1,7 +1,83 @@
 import { Command } from "commander";
 import prompts from "prompts";
+import { spawnSync } from "child_process";
 import { ensureSwallowKitProject } from "../../core/config";
-import { applyProvisionOperation, planProvisionOperation } from "../../core/operations/provision-operations";
+import { applyProvisionOperation, planProvisionOperation, ProvisionPlanData } from "../../core/operations/provision-operations";
+
+function readAzOutput(args: string[]): string | undefined {
+  try {
+    const result = spawnSync("az", args, {
+      shell: false,
+      encoding: "utf-8",
+      timeout: 60_000,
+      maxBuffer: 4 * 1024 * 1024,
+    });
+    if (result.status === 0 && !result.error && !result.signal) {
+      const value = result.stdout?.trim();
+      if (value && value !== "null") return value;
+    }
+  } catch {
+    // Callers report a safe fallback without displaying credential-bearing output.
+  }
+  return undefined;
+}
+
+function manualAzCommand(args: string[]): string {
+  return `az ${args.map((arg) => /^[A-Za-z0-9._:/=-]+$/.test(arg) ? arg : JSON.stringify(arg)).join(" ")}`;
+}
+
+function readCiCdSecret(args: string[], resourceKnown: boolean, xml = false): string {
+  const value = resourceKnown ? readAzOutput(args) : undefined;
+  const valid = value && (xml
+    ? /^(?:<\?xml[^>]*\?>\s*)?<publishData(?:\s[^>]*)?>[\s\S]*<\/publishData>$/.test(value)
+      && /<publishProfile\s[^>]+(?:\/>|>[\s\S]*<\/publishProfile>)/.test(value)
+    : /^\S+$/.test(value));
+  if (valid) return `    ${value}\n`;
+  return `    Could not retrieve automatically${resourceKnown ? "" : " (resource name missing)"}.\n    Run manually: ${manualAzCommand(args)}\n`;
+}
+
+// Human CLI only: called after deployment, migration tags, and ledger writes succeed.
+function printProvisionSetup(plan: ProvisionPlanData, subscription: string): void {
+  if (!["bootstrap", "reconcile", "migrate"].includes(plan.mode)) return;
+  const target = ["--resource-group", plan.resourceGroup, "--subscription", subscription];
+  const fields = ["staticWebAppName", "staticWebAppUrl", "functionsAppName", "functionsAppUrl", "cosmosDbAccountName", "cosmosDatabaseName"] as const;
+  const outputArgs = [
+    "deployment", "group", "show", "--name", "swallowkit-baseline", ...target,
+    "--query", `{${fields.map((field) => `${field}:properties.outputs.${field}.value`).join(",")}}`, "-o", "json",
+  ];
+  let outputs: Record<string, unknown> = {};
+  const raw = readAzOutput(outputArgs);
+  try {
+    const parsed: unknown = raw ? JSON.parse(raw) : undefined;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Invalid outputs.");
+    outputs = parsed as Record<string, unknown>;
+    if (!fields.every((field) => typeof outputs[field] === "string" && outputs[field])) {
+      throw new Error("Resource outputs missing.");
+    }
+  } catch {
+    console.warn(`Provision succeeded, but resource information could not be read. Do not redeploy to retrieve it.\nRun manually: ${manualAzCommand(outputArgs)}`);
+  }
+  console.log("\nResource information:");
+  console.log(`  resourceGroup: ${plan.resourceGroup}`);
+  console.log(`  subscription: ${subscription}`);
+  for (const field of fields) {
+    if (typeof outputs[field] === "string" && outputs[field]) console.log(`  ${field}: ${outputs[field]}`);
+  }
+  const knownName = (value: unknown): value is string => typeof value === "string" && /^[A-Za-z0-9-]+$/.test(value);
+  const swaKnown = knownName(outputs.staticWebAppName);
+  const functionsKnown = knownName(outputs.functionsAppName);
+  const swaName = swaKnown ? String(outputs.staticWebAppName) : "<swa-name>";
+  const functionsName = functionsKnown ? String(outputs.functionsAppName) : "<functions-app-name>";
+  console.log("\nCI/CD settings (save these as secrets in GitHub Actions or Azure Pipelines):\n");
+  console.log("  [AZURE_STATIC_WEB_APPS_API_TOKEN]");
+  console.log(readCiCdSecret(["staticwebapp", "secrets", "list", "--name", swaName, ...target, "--query", "properties.apiKey", "-o", "tsv"], swaKnown));
+  console.log("  [AZURE_FUNCTIONAPP_NAME]");
+  console.log(functionsKnown ? `    ${functionsName}\n` : "    Resource name missing; inspect the deployment outputs using the command above.\n");
+  console.log("  [AZURE_FUNCTIONAPP_PUBLISH_PROFILE]");
+  console.log(readCiCdSecret(["webapp", "deployment", "list-publishing-profiles", "--name", functionsName, ...target, "--xml"], functionsKnown, true));
+  console.log("  These values are shown only in this terminal; SwallowKit does not store them. Treat them as secrets.");
+  console.log("  Next: configure your CI/CD pipeline and manually trigger the first deployment.");
+}
 
 const PRIMARY_REGIONS = [
   { title: "Japan East (japaneast)", value: "japaneast" },
@@ -64,7 +140,8 @@ async function resolveLocations(options: ProvisionCliOptions): Promise<{ locatio
   return { location, swaLocation };
 }
 
-export const provisionCommand = new Command("provision")
+export function createProvisionCommand(): Command {
+  return new Command("provision")
   .description("Bootstrap, adopt, migrate, or explicitly reconcile Azure resources")
   .requiredOption("-g, --resource-group <name>", "Resource group name")
   .option("--subscription <id>", "Azure subscription ID")
@@ -78,10 +155,14 @@ export const provisionCommand = new Command("provision")
   .action(async (options: ProvisionCliOptions) => {
     ensureSwallowKitProject("provision");
     const locations = await resolveLocations(options);
+    const subscription = options.subscription ?? readAzOutput(["account", "show", "--query", "id", "-o", "tsv"]);
+    if (!subscription || !/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(subscription)) {
+      throw new Error("Could not determine the Azure subscription. Run az account show --query id -o tsv, then retry with --subscription <id>.");
+    }
     const baseline = options.baseline === undefined ? undefined : Number(options.baseline);
     const plan = await planProvisionOperation({
       resourceGroup: options.resourceGroup,
-      subscription: options.subscription,
+      subscription,
       location: locations.location,
       swaLocation: locations.swaLocation,
       whatIf: options.whatIf,
@@ -121,4 +202,9 @@ export const provisionCommand = new Command("provision")
 
     const result = await applyProvisionOperation({ planId: plan.planId, approve: true });
     console.log(`Provision completed (${plan.mode}). ${result.executedCommands.length} command(s) executed.`);
+    for (const warning of result.warnings) console.warn(`Warning: ${warning}`);
+    printProvisionSetup(plan, subscription);
   });
+}
+
+export const provisionCommand = createProvisionCommand();

package/src/core/project/agent-templates/AGENTS.md

@@ -254,6 +254,32 @@ Additional model-change facts:
 
 ## New Models / CRUD Features
 
+For every new persistent model, follow the current SwallowKit model-creation
+and infrastructure-generation workflow, **whether or not it uses custom APIs**.
+Adding a hand-written schema alone is not completion.
+
+1. Inspect current capabilities and entities. Use
+   `{{runCmd}} swallowkit create-model <name>` or the agent-facing equivalent
+   `{{runCmd}} swallowkit machine generate model <name> --overwrite never`.
+   This creates the schema, shared export, and model metadata; it does not
+   create the Cosmos DB container by itself.
+2. Author domain fields, then plan/apply scaffold for that model using the
+   current options. In 1.x, scaffold adds new Cosmos DB containers as versioned
+   Bicep migrations under `infra/migrations/`, recorded in its `manifest.json`.
+   Existing baseline-owned containers remain wired in `infra/main.bicep`;
+   do not add duplicate containers or edit applied migrations.
+3. Verify the correspondence between the model, container name/partition key,
+   Bicep wiring or migration manifest, and `.swallowkit/artifacts.json`
+   generation ledger. Use `machine inspect entities`, `machine inspect infra`,
+   `machine inspect drift`, and `machine verify project`; inspect the actual
+   files too. Local generation/verification does not mean Azure was deployed.
+
+Custom APIs and non-persistent types remain ai-authored. Connector-backed
+models follow their connector workflow rather than inventing Cosmos containers.
+If generation is omitted, state the reason and unfinished work explicitly.
+Never describe a project as deployable while required persistence infrastructure
+is missing; do not hand-edit managed infrastructure or the generation ledger.
+
 Use the `swallowkit-add-model` Agent Skill when available.
 
 Otherwise follow the equivalent runbook under `.swallowkit/workflows/`.

package/src/core/project/agent-templates/shared-models.instructions.md

@@ -52,6 +52,13 @@ After changing a model, do not manually patch generated artifacts.
 
 ## After changing a model
 
+- For new persistent models, follow the root `AGENTS.md` model-creation and
+  scaffold infrastructure workflow even when all APIs are custom. A schema
+  alone is not completion: verify container Bicep wiring or migrations and
+  `.swallowkit/artifacts.json`. Non-persistent types and connector-backed
+  models do not require invented Cosmos containers. If generation is omitted,
+  report the reason and unfinished infrastructure; never claim deployability
+  while required persistence infrastructure is missing.
 - The shared package is consumed via its built `dist/`. `verify project`
   rebuilds it automatically, but if you typecheck manually, build the shared
   package first — "no exported member" errors usually mean a stale `dist/`.

package/src/core/project/workflows.ts

@@ -41,6 +41,12 @@ export function buildWorkflowDocs(runCmd: string): WorkflowDoc[] {
 
 Goal: add a data model and derive CRUD/BFF/UI/infra deterministically.
 
+For persistent models, this workflow is required even when all APIs are custom.
+A hand-written schema alone is not completion. Non-persistent types remain
+ai-authored; connector-backed models follow their connector workflow without
+inventing Cosmos containers. If generation is omitted, report the reason and
+unfinished work; never claim deployability with required infrastructure missing.
+
 ## Responsibility boundary
 
 - **You author freely**: the model schema (\`shared/models/<name>.ts\`) and any business logic.
@@ -60,6 +66,13 @@ Goal: add a data model and derive CRUD/BFF/UI/infra deterministically.
 5. Verify:
    \`${runCmd} swallowkit machine verify project\`
    - \`summary.done: false\` → \`${runCmd} swallowkit machine explain failure\` and repair, then re-verify.
+   - Check model/container name and partition key, versioned container
+     migrations in \`infra/migrations/manifest.json\` (or existing baseline-owned
+     container wiring in \`infra/main.bicep\`), and the
+     generation ledger \`.swallowkit/artifacts.json\`. Use \`machine inspect entities\`,
+     \`machine inspect infra\`, and \`machine inspect drift\` and inspect actual files.
+     Model creation alone does not generate containers; scaffold does.
+     Local verification is not proof of Azure deployment.
 6. If \`dev-seeds/\` exists, update seed JSON for the new model. Seeds are only
    applied by \`${runCmd} swallowkit dev --seed-env <environment>\` — editing the
    JSON alone does nothing.

package/src/core/scaffold/ui-generator.ts

@@ -337,7 +337,7 @@ export function generateDetailPage(model: ModelInfo, sharedPackageName: string,
   
   return `'use client';
 
-import { useEffect, useState } from 'react';
+import { Suspense, useEffect, useState } from 'react';
 import { useParams, useRouter } from 'next/navigation';
 import Link from 'next/link';
 import { z } from 'zod/v4';
@@ -347,6 +347,18 @@ ${hasAuth ? `import { useAuth } from '${authContextImport}';` : ''}
 type ${modelName} = z.infer<typeof ${localSchemaName}>;
 
 export default function ${modelName}DetailPage() {
+  return (
+    <Suspense fallback={
+      <div className="flex items-center justify-center min-h-screen">
+        <div className="text-lg text-gray-900 dark:text-gray-100">Loading...</div>
+      </div>
+    }>
+      <${modelName}DetailContent />
+    </Suspense>
+  );
+}
+
+function ${modelName}DetailContent() {
   const params = useParams();
   const router = useRouter();
   const [${modelCamel}, set${modelName}] = useState<${modelName} | null>(null);
@@ -1031,7 +1043,7 @@ export function generateEditPage(model: ModelInfo, sharedPackageName: string, au
   
   return `'use client';
 
-import { useEffect, useState } from 'react';
+import { Suspense, useEffect, useState } from 'react';
 import { useParams, useRouter } from 'next/navigation';
 import ${modelName}Form from '../../_components/${modelName}Form';
 import { z } from 'zod/v4';
@@ -1041,6 +1053,18 @@ ${hasAuth ? `import { useAuth } from '${authContextImport}';` : ''}
 type ${modelName} = z.infer<typeof ${localSchemaName}>;
 
 export default function Edit${modelName}Page() {
+  return (
+    <Suspense fallback={
+      <div className="flex items-center justify-center min-h-screen">
+        <div className="text-lg">Loading...</div>
+      </div>
+    }>
+      <Edit${modelName}Content />
+    </Suspense>
+  );
+}
+
+function Edit${modelName}Content() {
   const params = useParams();
 ${hasAuth ? '  const router = useRouter();' : ''}
   const [${modelCamel}, set${modelName}] = useState<${modelName} | null>(null);