swallowkit 2.0.0-alpha.1 → 2.0.0-alpha.10

package/src/__tests__/agent-loop-phase34.test.ts

@@ -17,6 +17,8 @@ import { inspectInfra } from "../core/project/infra";
 import { loadCustomVerifyChecks, compactVerifyResult, runVerify, VerifyResult } from "../core/verify";
 import { buildAgentSkills, buildWorkflowDocs, writeAgentSkills, writeWorkflowDocs } from "../core/project/workflows";
 import { applyProvisionOperation, planProvisionOperation } from "../core/operations/provision-operations";
+import { resetAzCliInvocationCache, setAzCliInvocationForTesting } from "../utils/azure-cli";
+import * as azureCli from "../utils/azure-cli";
 import { createCustomMigration, initializeLegacyMigrations } from "../core/operations/migration-generator";
 import { createMigrationManifest, encodeMigrationState, getMigrationTagKey, saveMigrationManifest } from "../core/project/migrations";
 
@@ -126,12 +128,17 @@ describe("agent loop phase 3/4", () => {
     tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-p34-"));
     process.chdir(tempDir);
     (childProcess.spawnSync as unknown as any).mockReturnValue({ status: 1, stdout: "", stderr: "" });
+    // Platform-independent az invocation; the Windows wrapper resolution is covered in azure-cli.test.ts.
+    setAzCliInvocationForTesting({ command: "az", prefixArgs: [], source: "az" });
+    jest.spyOn(azureCli, "runAzCliAsync").mockImplementation(async (args) => azureCli.runAzCli(args));
   });
 
   afterEach(() => {
+    resetAzCliInvocationCache();
     process.chdir(originalCwd);
     fs.rmSync(tempDir, { recursive: true, force: true });
     jest.clearAllMocks();
+    jest.restoreAllMocks();
   });
 
   it("returns the responsibility boundary contract via inspect boundaries", async () => {
@@ -269,6 +276,7 @@ describe("agent loop phase 3/4", () => {
     createProjectFixture(tempDir);
     writeFile(path.join(tempDir, "infra", "main.bicep"), SAMPLE_MAIN_BICEP);
     writeFile(path.join(tempDir, "infra", "main.parameters.json"), "{}\n");
+    setAzCliInvocationForTesting(null);
 
     const plan = await runMachine([
       "node", "swallowkit", "machine", "plan", "provision",
@@ -312,11 +320,11 @@ describe("agent loop phase 3/4", () => {
     (childProcess.spawnSync as unknown as any).mockImplementation((_file: string, args: string[]) => {
       if (args[0] === "--version") return { status: 0, stdout: "azure-cli", stderr: "" };
       if (args[0] === "group" && args[1] === "exists") return { status: 0, stdout: "true\n", stderr: "" };
-      if (args[0] === "group" && args[1] === "show") return { status: 0, stdout: JSON.stringify({ id: "/subscriptions/test/resourceGroups/rg-sample", tags: {} }), stderr: "" };
+      if (args[0] === "group" && args[1] === "show") return { status: 0, stdout: JSON.stringify({ id: "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-sample", tags: {} }), stderr: "" };
       return { status: 1, stdout: "", stderr: "unexpected" };
     });
 
-    const plan = await planProvisionOperation({ resourceGroup: "rg-sample", location: "japaneast", swaLocation: "eastasia" });
+    const plan = await planProvisionOperation({ resourceGroup: "rg-sample", location: "japaneast", swaLocation: "eastasia", subscription: "11111111-1111-1111-1111-111111111111" });
 
     expect(plan.mode).toBe("adoption-required");
     expect(plan.commands).toEqual([]);
@@ -331,7 +339,7 @@ describe("agent loop phase 3/4", () => {
     (childProcess.spawnSync as unknown as any).mockImplementation((_file: string, args: string[]) => {
       if (args[0] === "--version") return { status: 0, stdout: "azure-cli", stderr: "" };
       if (args[0] === "group" && args[1] === "exists") return { status: 0, stdout: "true\n", stderr: "" };
-      if (args[0] === "group" && args[1] === "show") return { status: 0, stdout: JSON.stringify({ id: "/subscriptions/test/resourceGroups/rg-sample", tags: {} }), stderr: "" };
+      if (args[0] === "group" && args[1] === "show") return { status: 0, stdout: JSON.stringify({ id: "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-sample", tags: {} }), stderr: "" };
       if (args[0] === "deployment" && args[2] === "what-if") {
         return { status: 0, stdout: JSON.stringify({ changes: [{ changeType: "Modify", resourceId: "/functions/sample" }] }), stderr: "" };
       }
@@ -345,6 +353,7 @@ describe("agent loop phase 3/4", () => {
       adoptExisting: true,
       baseline: 0,
       whatIf: true,
+      subscription: "11111111-1111-1111-1111-111111111111",
     });
 
     expect(plan.mode).toBe("adopt");
@@ -362,7 +371,7 @@ describe("agent loop phase 3/4", () => {
     (childProcess.spawnSync as unknown as any).mockImplementation((_file: string, args: string[]) => {
       if (args[0] === "--version") return { status: 0, stdout: "azure-cli", stderr: "" };
       if (args[0] === "group" && args[1] === "exists") return { status: 0, stdout: "true\n", stderr: "" };
-      if (args[0] === "group" && args[1] === "show") return { status: 0, stdout: JSON.stringify({ id: "/subscriptions/test/resourceGroups/rg-sample", tags: {} }), stderr: "" };
+      if (args[0] === "group" && args[1] === "show") return { status: 0, stdout: JSON.stringify({ id: "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-sample", tags: {} }), stderr: "" };
       if (args[0] === "deployment" && args[2] === "what-if") return { status: 0, stdout: JSON.stringify({ changes: [] }), stderr: "" };
       return { status: 1, stdout: "", stderr: "unexpected" };
     });
@@ -372,6 +381,7 @@ describe("agent loop phase 3/4", () => {
       location: "japaneast",
       swaLocation: "eastasia",
       reconcile: true,
+      subscription: "11111111-1111-1111-1111-111111111111",
     });
 
     expect(plan.mode).toBe("reconcile");
@@ -393,12 +403,12 @@ describe("agent loop phase 3/4", () => {
       if (args[0] === "group" && args[1] === "exists") return { status: 0, stdout: "true\n", stderr: "" };
       if (args[0] === "group" && args[1] === "show") {
         const tagKey = getMigrationTagKey(manifest.projectId);
-        return { status: 0, stdout: JSON.stringify({ id: "/subscriptions/test/resourceGroups/rg-sample", tags: { [tagKey]: tagValue } }), stderr: "" };
+        return { status: 0, stdout: JSON.stringify({ id: "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-sample", tags: { [tagKey]: tagValue } }), stderr: "" };
       }
       return { status: 1, stdout: "", stderr: "unexpected" };
     });
 
-    const plan = await planProvisionOperation({ resourceGroup: "rg-sample", location: "japaneast", swaLocation: "eastasia" });
+    const plan = await planProvisionOperation({ resourceGroup: "rg-sample", location: "japaneast", swaLocation: "eastasia", subscription: "11111111-1111-1111-1111-111111111111" });
 
     expect(plan.mode).toBe("migrate");
     expect(plan.pendingMigrations.map((migration) => migration.version)).toEqual([1]);
@@ -419,7 +429,13 @@ describe("agent loop phase 3/4", () => {
     (childProcess.spawnSync as unknown as any).mockImplementation((_file: string, args: string[]) => {
       if (args[0] === "--version") return { status: 0, stdout: "azure-cli", stderr: "" };
       if (args[0] === "group" && args[1] === "exists") return { status: 0, stdout: "true\n", stderr: "" };
-      if (args[0] === "group" && args[1] === "show") return { status: 0, stdout: JSON.stringify({ id: "/subscriptions/test/resourceGroups/rg-sample", tags: { [tagKey]: tagValue } }), stderr: "" };
+      if (args[0] === "group" && args[1] === "show") return { status: 0, stdout: JSON.stringify({ id: "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-sample", tags: { [tagKey]: tagValue } }), stderr: "" };
+      if (args[0] === "deployment" && args[2] === "show") {
+        const name = args[args.indexOf("--name") + 1];
+        return deployedTemplates.length === 0
+          ? { status: 1, stdout: "", stderr: "DeploymentNotFound" }
+          : { status: 0, stdout: JSON.stringify({ id: `/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-sample/providers/Microsoft.Resources/deployments/${name}`, state: "Succeeded", correlationId: "fixture-correlation" }), stderr: "" };
+      }
       if (args[0] === "deployment" && args[2] === "create") {
         deployedTemplates.push(args[args.indexOf("--template-file") + 1]);
         return { status: 0, stdout: JSON.stringify({ properties: { outputs: {} } }), stderr: "" };
@@ -431,7 +447,7 @@ describe("agent loop phase 3/4", () => {
       return { status: 1, stdout: "", stderr: `unexpected: ${args.join(" ")}` };
     });
 
-    const plan = await planProvisionOperation({ resourceGroup: "rg-sample", location: "japaneast", swaLocation: "eastasia" });
+    const plan = await planProvisionOperation({ resourceGroup: "rg-sample", location: "japaneast", swaLocation: "eastasia", subscription: "11111111-1111-1111-1111-111111111111" });
     const result = await applyProvisionOperation({ planId: plan.planId, approve: true });
 
     expect(result.executedCommands).toHaveLength(2);
@@ -508,6 +524,30 @@ describe("agent loop phase 3/4", () => {
     );
   });
 
+  it.each<[string, string[]]>([
+    ["pnpm", ["exec", "next", "typegen"]],
+    ["npm", ["exec", "--", "next", "typegen"]],
+  ])("generates Next.js route types with %s before typechecking", async (packageManager, typegenArgs) => {
+    writeFile(
+      path.join(tempDir, "package.json"),
+      JSON.stringify({ name: "sample-app", devEngines: { packageManager: { name: packageManager, version: ">=10", onFail: "error" } } })
+    );
+    writeFile(path.join(tempDir, "tsconfig.json"), JSON.stringify({ compilerOptions: { noEmit: true } }));
+    writeFile(path.join(tempDir, "next.config.ts"), "export default {};\n");
+    writeFile(path.join(tempDir, "node_modules", "next", "package.json"), JSON.stringify({ name: "next", version: "16.0.0" }));
+    const spawnSyncMock = childProcess.spawnSync as unknown as ReturnType<typeof jest.fn>;
+    spawnSyncMock.mockReset();
+    spawnSyncMock
+      .mockReturnValueOnce({ status: 1, stdout: "", stderr: "typegen failed" })
+      .mockReturnValueOnce({ status: 2, stdout: "app/layout.tsx: Cannot find name 'LayoutProps'.", stderr: "" });
+
+    const result = await runVerify(["typecheck"], tempDir);
+
+    expect(spawnSyncMock.mock.calls[0].slice(0, 2)).toEqual([packageManager, typegenArgs]);
+    expect(result.checks[0].status).toBe("fail");
+    expect(result.checks[0].evidence.logTail?.[0]).toMatch(/^next typegen did not complete \(exit 1\)/);
+  });
+
   it("uses the existing typecheck script when present", async () => {
     writeFile(
       path.join(tempDir, "package.json"),
@@ -530,6 +570,101 @@ describe("agent loop phase 3/4", () => {
     );
   });
 
+  it("includes standalone C# compilation in default verification and explains source errors", async () => {
+    createProjectFixture(tempDir);
+    writeFile(path.join(tempDir, "swallowkit.config.json"), JSON.stringify({ backend: { language: "csharp" } }));
+    // The fixture's .js config otherwise takes precedence.
+    fs.unlinkSync(path.join(tempDir, "swallowkit.config.js"));
+    fs.mkdirSync(path.join(tempDir, "shared", "models"), { recursive: true });
+    fs.mkdirSync(path.join(tempDir, "app", "api"), { recursive: true });
+    writeFile(path.join(tempDir, "functions", "SwallowKit.Functions.csproj"), "<Project />\n");
+    const spawnMock = childProcess.spawnSync as unknown as ReturnType<typeof jest.fn>;
+    spawnMock.mockImplementation((command: string, args: string[]) => ({
+      status: command === "dotnet" && args[0] === "build" ? 1 : 0,
+      stdout: command === "dotnet" && args[0] === "build"
+        ? `${path.join(tempDir, "functions", "Crud", "ProbeItemCrudFunctions.cs")}(8,7): error CS0246: Functions namespace not found`
+        : "",
+      stderr: "",
+    }));
+    const result = await runVerify(undefined, tempDir);
+    expect(result.summary.done).toBe(false);
+    expect(result.checks).toContainEqual(expect.objectContaining({
+      id: "backend-build", status: "fail",
+      evidence: expect.objectContaining({ logTail: expect.arrayContaining([expect.stringContaining("(8,7): error CS0246")]) }),
+    }));
+    const explanation = await runMachine(["node", "swallowkit", "machine", "explain", "failure", "--check", "backend-build"]);
+    expect(JSON.stringify(explanation.response)).toContain("(8,7): error CS0246");
+  });
+
+  it.each(["csharp", "python"] as const)("skips %s backend compilation when its toolchain is missing", async (language) => {
+    createProjectFixture(tempDir);
+    writeFile(path.join(tempDir, "swallowkit.config.js"), `module.exports = { backend: { language: '${language}' } };`);
+    const missing = Object.assign(new Error("not found"), { code: "ENOENT" });
+    (childProcess.spawnSync as unknown as ReturnType<typeof jest.fn>).mockReturnValue({ status: null, error: missing });
+    const result = await runVerify(["backend-build"], tempDir);
+    expect(result.checks[0]).toMatchObject({ id: "backend-build", status: "skip" });
+    expect(result.checks[0].evidence.diagnostics?.[0]).toMatch(/not installed|not available/);
+    expect(result.summary).toMatchObject({ skipped: 1, failed: 0 });
+  });
+
+  it("does not hide an installed backend toolchain execution failure as a skip", async () => {
+    createProjectFixture(tempDir);
+    writeFile(path.join(tempDir, "swallowkit.config.js"), "module.exports = { backend: { language: 'csharp' } };");
+    const denied = Object.assign(new Error("spawn EPERM"), { code: "EPERM" });
+    (childProcess.spawnSync as unknown as ReturnType<typeof jest.fn>).mockReturnValue({ status: null, error: denied });
+    const result = await runVerify(["backend-build"], tempDir);
+    expect(result.checks[0]).toMatchObject({ status: "error", evidence: { errorCode: "verification-command-unavailable" } });
+  });
+
+  it("uses the project's compiler and functions tsconfig for TypeScript backend verification", async () => {
+    createProjectFixture(tempDir);
+    fs.symlinkSync(path.join(repoRoot, "node_modules", "typescript"), path.join(tempDir, "node_modules", "typescript"), "junction");
+    const spawnMock = childProcess.spawnSync as unknown as ReturnType<typeof jest.fn>;
+    spawnMock.mockReturnValue({ status: 2, stdout: "src/probe-item.ts(9,3): error TS2322: Invalid type", stderr: "" });
+    const result = await runVerify(["backend-build"], tempDir);
+    expect(result.summary.done).toBe(false);
+    expect(result.checks[0].evidence.diagnostics).toContain("src/probe-item.ts(9,3): error TS2322: Invalid type");
+    expect(spawnMock).toHaveBeenCalledWith(process.execPath, [
+      expect.stringContaining(path.join("typescript", "bin", "tsc")), "--project", "tsconfig.json", "--noEmit",
+    ], expect.objectContaining({ cwd: path.join(tempDir, "functions"), shell: false }));
+  });
+
+  it("prefers the existing Python dev virtualenv and includes source syntax errors", async () => {
+    createProjectFixture(tempDir);
+    writeFile(path.join(tempDir, "swallowkit.config.js"), "module.exports = { backend: { language: 'python' } };");
+    const python = path.join(tempDir, "functions", ".venv", ...(process.platform === "win32" ? ["Scripts", "python.exe"] : ["bin", "python"]));
+    writeFile(python, "mock interpreter");
+    const spawnMock = childProcess.spawnSync as unknown as ReturnType<typeof jest.fn>;
+    spawnMock.mockImplementation((_command: string, args: string[]) => args.includes("compileall")
+      ? { status: 1, stdout: '*** Error compiling "./blueprints/probe_item.py"...\n  File "./blueprints/probe_item.py", line 12\nSyntaxError: invalid syntax', stderr: "" }
+      : { status: 0, stdout: "", stderr: "" });
+    const result = await runVerify(["backend-build"], tempDir);
+    expect(result.checks[0].status).toBe("fail");
+    expect(result.checks[0].evidence.diagnostics).toContain('  File "./blueprints/probe_item.py", line 12');
+    expect(spawnMock).toHaveBeenCalledWith(python, [
+      "-m", "compileall", "-q", "-f", "-x", expect.stringContaining(".codegen-venv"), ".",
+    ], expect.objectContaining({ cwd: path.join(tempDir, "functions"), shell: false }));
+  });
+
+  it.each([
+    ["python", "python"],
+    ["unsupported", "typescript"],
+  ])("resolves the backend like generation when SWALLOWKIT_BACKEND_LANGUAGE=%s", async (override, expected) => {
+    createProjectFixture(tempDir); // config file says typescript
+    fs.symlinkSync(path.join(repoRoot, "node_modules", "typescript"), path.join(tempDir, "node_modules", "typescript"), "junction");
+    const spawnMock = childProcess.spawnSync as unknown as ReturnType<typeof jest.fn>;
+    spawnMock.mockReturnValue({ status: 0, stdout: "", stderr: "" });
+    const previous = process.env.SWALLOWKIT_BACKEND_LANGUAGE;
+    process.env.SWALLOWKIT_BACKEND_LANGUAGE = override;
+    try {
+      const result = await runVerify(["backend-build"], tempDir);
+      expect(result.checks[0].evidence.command).toContain(expected === "python" ? "compileall" : "tsc");
+    } finally {
+      if (previous === undefined) delete process.env.SWALLOWKIT_BACKEND_LANGUAGE;
+      else process.env.SWALLOWKIT_BACKEND_LANGUAGE = previous;
+    }
+  });
+
   it("reports verification command startup failures as blocked", async () => {
     createProjectFixture(tempDir);
     writeFile(path.join(tempDir, "tsconfig.json"), JSON.stringify({ compilerOptions: { noEmit: true } }));

package/src/__tests__/auth.test.ts

@@ -300,6 +300,15 @@ describe("generateLoginPage", () => {
     expect(code).toContain("handleSubmit");
     expect(code).toContain("/api/auth/login");
   });
+
+  it("keeps the shared form legible with either global color scheme", () => {
+    const code = generateLoginPage();
+    expect(code).toContain("bg-gray-50 dark:bg-gray-900");
+    expect(code).toContain("bg-white dark:bg-gray-800");
+    expect(code).toContain("text-gray-900 dark:text-gray-100");
+    expect(code).toContain("dark:border-gray-600");
+    expect(code).toContain("dark:text-red-300");
+  });
 });
 
 describe("generateAuthContext", () => {

package/src/__tests__/azure-cli.test.ts

@@ -0,0 +1,202 @@
+import * as childProcess from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import * as azureCli from "../utils/azure-cli";
+import {
+  buildBatchCommandLine,
+  checkAzCliAvailability,
+  resetAzCliInvocationCache,
+  resolveAzCliInvocation,
+  runAzCli,
+  setAzCliInvocationForTesting,
+} from "../utils/azure-cli";
+import { INTERACTIVE_PROVISION_RETRY_HINT, executeProvisionPlan, planProvisionOperation } from "../core/operations/provision-operations";
+import { describeProvisionAction } from "../cli/commands/provision";
+import { createMigrationManifest, saveMigrationManifest } from "../core/project/migrations";
+import { formatCliError } from "../cli";
+import { MachineCommandError } from "../machine/errors";
+
+jest.mock("child_process", () => {
+  const actual = jest.requireActual<typeof import("child_process")>("child_process");
+  return { ...actual, spawnSync: jest.fn(actual.spawnSync) };
+});
+
+const spawnSyncMock = jest.mocked(childProcess.spawnSync) as unknown as ReturnType<typeof jest.fn>;
+
+describe("Azure CLI resolution on Windows", () => {
+  let root: string;
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-az-"));
+  });
+  afterEach(() => fs.rmSync(root, { recursive: true, force: true }));
+
+  const touch = (file: string) => {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, "");
+    return file;
+  };
+
+  it("runs the MSI install's bundled Python the same way az.cmd does", () => {
+    const wrapper = touch(path.join(root, "CLI2", "wbin", "az.cmd"));
+    touch(path.join(root, "CLI2", "wbin", "az"));
+    const python = touch(path.join(root, "CLI2", "python.exe"));
+    const invocation = resolveAzCliInvocation({ PATH: `${path.join(root, "missing")};${path.dirname(wrapper)}`, PATHEXT: ".COM;.EXE;.BAT;.CMD" }, "win32");
+    expect(invocation).toEqual({ command: python, prefixArgs: ["-IBm", "azure.cli"], env: { AZ_INSTALLER: "MSI" }, source: wrapper });
+  });
+
+  it("uses an executable directly and other batch wrappers through cmd.exe", () => {
+    const exe = touch(path.join(root, "exe", "az.exe"));
+    expect(resolveAzCliInvocation({ PATH: path.dirname(exe) }, "win32")).toEqual({ command: exe, prefixArgs: [], source: exe });
+    const bat = touch(path.join(root, "venv", "Scripts", "az.bat"));
+    expect(resolveAzCliInvocation({ PATH: path.dirname(bat), ComSpec: "C:\\Windows\\system32\\cmd.exe" }, "win32"))
+      .toEqual({ command: "C:\\Windows\\system32\\cmd.exe", prefixArgs: [], batchScript: bat, source: bat });
+  });
+
+  it("reports not found when PATH has no az, and uses az directly elsewhere", () => {
+    expect(resolveAzCliInvocation({ PATH: root }, "win32")).toBeNull();
+    expect(resolveAzCliInvocation({ PATH: "/usr/bin" }, "linux")).toEqual({ command: "az", prefixArgs: [], source: "az" });
+  });
+
+  it("quotes batch arguments and refuses values cmd.exe would reinterpret", () => {
+    expect(buildBatchCommandLine("C:\\Program Files\\az.cmd", ["deployment", "--template-file", "C:\\my app\\main.bicep", "location=japaneast"]))
+      .toBe('""C:\\Program Files\\az.cmd" "deployment" "--template-file" "C:\\my app\\main.bicep" "location=japaneast""');
+    expect(() => buildBatchCommandLine("az.cmd", ["100%"])).toThrow(/cannot be passed safely/);
+    expect(() => buildBatchCommandLine("az.cmd", ['a"b'])).toThrow(/cannot be passed safely/);
+  });
+});
+
+describe("Azure CLI invocation and availability", () => {
+  afterEach(() => {
+    resetAzCliInvocationCache();
+    spawnSyncMock.mockReset();
+    spawnSyncMock.mockImplementation(jest.requireActual<typeof import("child_process")>("child_process").spawnSync);
+  });
+
+  it("never uses a shell and prepends wrapper arguments", () => {
+    spawnSyncMock.mockReturnValue({ status: 0, stdout: "ok", stderr: "" });
+    const invocation = { command: "C:\\CLI2\\python.exe", prefixArgs: ["-IBm", "azure.cli"], env: { AZ_INSTALLER: "MSI" }, source: "az.cmd" };
+    expect(runAzCli(["group", "exists", "--name", "rg"], { invocation })).toMatchObject({ status: 0, stdout: "ok" });
+    const [command, args, options] = spawnSyncMock.mock.calls[0];
+    expect(command).toBe("C:\\CLI2\\python.exe");
+    expect(args).toEqual(["-IBm", "azure.cli", "group", "exists", "--name", "rg"]);
+    expect(options).toMatchObject({ shell: false, env: expect.objectContaining({ AZ_INSTALLER: "MSI" }) });
+  });
+
+  it("runs batch wrappers through cmd.exe with verbatim quoted arguments", () => {
+    spawnSyncMock.mockReturnValue({ status: 0, stdout: "", stderr: "" });
+    runAzCli(["--version"], { invocation: { command: "cmd.exe", prefixArgs: [], batchScript: "C:\\az.bat", source: "C:\\az.bat" } });
+    const [command, args, options] = spawnSyncMock.mock.calls[0];
+    expect(command).toBe("cmd.exe");
+    expect(args).toEqual(["/d", "/s", "/v:off", "/c", '""C:\\az.bat" "--version""']);
+    expect(options).toMatchObject({ shell: false, windowsVerbatimArguments: true });
+  });
+
+  it("distinguishes a missing CLI from one that cannot start", () => {
+    setAzCliInvocationForTesting(null);
+    expect(checkAzCliAvailability()).toEqual({ available: false, reason: "not-found", detail: "az was not found on PATH." });
+
+    setAzCliInvocationForTesting({ command: "az", prefixArgs: [], source: "az" });
+    spawnSyncMock.mockReturnValue({ status: null, stdout: "", stderr: "", error: Object.assign(new Error("spawn az ENOENT"), { code: "ENOENT" }) });
+    expect(checkAzCliAvailability()).toMatchObject({ available: false, reason: "not-found" });
+
+    spawnSyncMock.mockReturnValue({ status: 1, stdout: "", stderr: "ModuleNotFoundError: azure.cli" });
+    expect(checkAzCliAvailability()).toMatchObject({ available: false, reason: "not-runnable", detail: expect.stringContaining("ModuleNotFoundError") });
+
+    spawnSyncMock.mockReturnValue({ status: 0, stdout: "azure-cli 2.70.0", stderr: "" });
+    expect(checkAzCliAvailability()).toMatchObject({ available: true });
+  });
+});
+
+describe("provision planning with Azure CLI state", () => {
+  const originalCwd = process.cwd();
+  let project: string;
+  beforeEach(() => {
+    project = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-provision-az-"));
+    fs.mkdirSync(path.join(project, "infra"), { recursive: true });
+    fs.writeFileSync(path.join(project, "infra", "main.bicep"), "targetScope = 'resourceGroup'\n");
+    fs.writeFileSync(path.join(project, "infra", "main.parameters.json"), JSON.stringify({ parameters: { projectName: { value: "sample" } } }));
+    saveMigrationManifest(createMigrationManifest(project, { projectId: "project" }), project);
+    process.chdir(project);
+    setAzCliInvocationForTesting({ command: "az", prefixArgs: [], source: "az" });
+    jest.spyOn(azureCli, "runAzCliAsync").mockImplementation(async (args) => runAzCli(args));
+  });
+  afterEach(() => {
+    process.chdir(originalCwd);
+    resetAzCliInvocationCache();
+    spawnSyncMock.mockReset();
+    spawnSyncMock.mockImplementation(jest.requireActual<typeof import("child_process")>("child_process").spawnSync);
+    fs.rmSync(project, { recursive: true, force: true });
+    jest.restoreAllMocks();
+  });
+
+  const options = { resourceGroup: "rg-sample", location: "japaneast", swaLocation: "eastasia", subscription: "11111111-1111-1111-1111-111111111111" };
+
+  it("reads Azure state through the resolved CLI and plans a bootstrap", async () => {
+    spawnSyncMock.mockImplementation((_command: string, args: string[]) => {
+      if (args[0] === "--version") return { status: 0, stdout: "azure-cli", stderr: "" };
+      if (args[0] === "group" && args[1] === "exists") return { status: 0, stdout: "false\n", stderr: "" };
+      return { status: 1, stdout: "", stderr: `unexpected ${args.join(" ")}` };
+    });
+    const plan = await planProvisionOperation(options);
+    expect(plan.azCliAvailable).toBe(true);
+    expect(plan.mode).toBe("bootstrap");
+    expect(plan.warnings.filter((warning) => warning.startsWith("az-"))).toEqual([]);
+    expect(spawnSyncMock.mock.calls.every((call: unknown[]) => (call[2] as { shell?: boolean }).shell === false)).toBe(true);
+  });
+
+  const plansDir = () => path.join(project, ".swallowkit", "state", "plans");
+  const savedPlans = () => (fs.existsSync(plansDir()) ? fs.readdirSync(plansDir()) : []);
+
+  it("keeps the interactive preview in memory and re-checks Azure before running it", async () => {
+    let groupExists = false;
+    spawnSyncMock.mockImplementation((_command: string, args: string[]) => {
+      if (args[0] === "--version") return { status: 0, stdout: "azure-cli", stderr: "" };
+      if (args[0] === "group" && args[1] === "exists") return { status: 0, stdout: `${groupExists}\n`, stderr: "" };
+      if (args[0] === "group" && args[1] === "show") return { status: 0, stdout: JSON.stringify({ id: `/subscriptions/${options.subscription}/resourceGroups/rg-sample`, tags: {} }), stderr: "" };
+      return { status: 1, stdout: "", stderr: `unexpected ${args.join(" ")}` };
+    });
+    const preview = await planProvisionOperation(options, { persist: false });
+    expect(savedPlans()).toEqual([]);
+    expect(describeProvisionAction(preview)).toBe(
+      "Resource group rg-sample does not exist yet. It will be created in japaneast and the infrastructure in infra/main.bicep will be deployed."
+    );
+
+    groupExists = true;
+    await expect(executeProvisionPlan(preview, { approve: true, retryHint: INTERACTIVE_PROVISION_RETRY_HINT })).rejects.toMatchObject({
+      code: "stale-azure-state",
+      message: 'The resource group was created after the preview was computed. Run "swallowkit provision" again to review the current state.',
+    });
+    expect(spawnSyncMock.mock.calls.some((call: unknown[]) => (call[1] as string[])[0] === "group" && (call[1] as string[])[1] === "create")).toBe(false);
+  });
+
+  it("still saves plans for the machine plan/apply workflow", async () => {
+    spawnSyncMock.mockImplementation((_command: string, args: string[]) => args[0] === "--version"
+      ? { status: 0, stdout: "azure-cli", stderr: "" }
+      : { status: 0, stdout: "false\n", stderr: "" });
+    const plan = await planProvisionOperation(options);
+    expect(savedPlans().some((file) => file.includes(plan.planId))).toBe(true);
+  });
+
+  it("asks for az login instead of reporting a missing CLI", async () => {
+    spawnSyncMock.mockImplementation((_command: string, args: string[]) => args[0] === "--version"
+      ? { status: 0, stdout: "azure-cli", stderr: "" }
+      : { status: 1, stdout: "", stderr: "ERROR: Please run 'az login' to setup account." });
+    await expect(planProvisionOperation(options)).rejects.toMatchObject({ code: "az-not-logged-in", status: "requires-human" });
+  });
+
+  it("reports an installed but broken CLI accurately", async () => {
+    spawnSyncMock.mockReturnValue({ status: 1, stdout: "", stderr: "Failed to load python executable." });
+    const plan = await planProvisionOperation(options);
+    expect(plan.mode).toBe("offline");
+    expect(plan.warnings.some((warning) => warning.startsWith("az-cli-not-runnable:") && warning.includes("Failed to load python executable."))).toBe(true);
+  });
+});
+
+describe("regular CLI error output", () => {
+  it("prints machine errors without a stack trace", () => {
+    const text = formatCliError(new MachineCommandError("online-plan-required", "Cannot apply.", { nextAction: "Run az login." }, "blocked"));
+    expect(text).toBe("❌ Cannot apply.\n   (code: online-plan-required)\n   Next: Run az login.");
+    expect(formatCliError(new Error("plain failure"))).toBe("❌ plain failure");
+  });
+});

package/src/__tests__/boundaries.test.ts

@@ -0,0 +1,42 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { inspectBoundaries } from "../core/project/boundaries";
+import { buildSwallowKitConfigSource } from "../cli/commands/init";
+import type { BackendLanguage } from "../types";
+
+describe("inspect boundaries convention rules", () => {
+  let project: string;
+  const originalCwd = process.cwd();
+
+  beforeEach(() => {
+    project = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-boundaries-"));
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    fs.rmSync(project, { recursive: true, force: true });
+  });
+
+  it.each<BackendLanguage>(["csharp", "python", "typescript"])("matches the %s backend", (language) => {
+    const contract = inspectBoundaries(project, language);
+    expect(contract.backendLanguage).toBe(language);
+    expect(contract.conventionRules).toMatchSnapshot();
+    expect(contract.conventionRules.some((rule) => rule.pattern === "functions/function_app.py")).toBe(language === "python");
+  });
+
+  it("resolves the backend language from swallowkit.config", () => {
+    fs.writeFileSync(path.join(project, "swallowkit.config.js"), buildSwallowKitConfigSource("csharp", "react"));
+    process.chdir(project);
+    const contract = inspectBoundaries(project);
+    expect(contract.backendLanguage).toBe("csharp");
+    expect(contract.conventionRules.map((rule) => rule.pattern)).not.toContain("functions/function_app.py");
+  });
+
+  it("orders specific infrastructure rules before the baseline rule", () => {
+    const patterns = inspectBoundaries(project, "typescript").conventionRules.map((rule) => rule.pattern);
+    expect(patterns.indexOf("infra/migrations/manifest.json")).toBeLessThan(patterns.indexOf("infra/migrations/"));
+    expect(patterns.indexOf("infra/migrations/")).toBeLessThan(patterns.indexOf("infra/"));
+    expect(patterns[patterns.length - 1]).toBe("*");
+  });
+});