swallowkit 2.0.0-alpha.1 → 2.0.0-alpha.10

package/src/__tests__/multi-auth.test.ts

@@ -1,6 +1,7 @@
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
+import { spawnSync } from "child_process";
 import { addAuthCommand } from "../cli/commands/add-auth";
 import { createUIAuthOptions } from "../cli/commands/scaffold";
 import {
@@ -9,12 +10,12 @@ import {
   generateNamedAuthRouterPython,
   generateNamedAuthRouterTS,
 } from "../core/scaffold/auth-generator";
-import { normalizeAuthConfig } from "../core/config";
+import { normalizeAuthConfig, validateConfig } from "../core/config";
 import { parseAuthPolicy } from "../core/scaffold/model-parser";
 import { createBasicModelInfo } from "./fixtures";
 import { generateCSharpAzureFunctionsCRUD, generateCompactAzureFunctionsCRUD, generatePythonAzureFunctionsCRUD } from "../core/scaffold/functions-generator";
 import { generateAuthLayout, generateNewPage } from "../core/scaffold/ui-generator";
-import { AuthConfig } from "../types";
+import { AuthConfig, SwallowKitConfig } from "../types";
 
 const namedAuthConfig: AuthConfig = {
   schemes: {
@@ -57,10 +58,24 @@ describe("named authentication routers", () => {
   it("generates valid branch structure for an SWA-only Python router", () => {
     const swaOnly = normalizeAuthConfig({ schemes: { admin: { provider: "swa", swa: { allowedProviders: ["github"] } } }, authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] } } } })!;
     const python = generateNamedAuthRouterPython(swaOnly);
-    expect(python).toContain('        if PROVIDERS[scheme] == "swa":');
-    expect(python).not.toContain('        elif PROVIDERS[scheme] == "swa":');
+    expect(python).toContain('\n    if PROVIDERS[scheme] == "swa":');
+    expect(python).not.toContain('\n    elif PROVIDERS[scheme] == "swa":');
     expect(python).toContain("ALLOWED_PROVIDERS");
     expect(generateNamedAuthRouterCSharp(swaOnly)).toContain("AllowedProviders[scheme]");
+    expect(generateNamedAuthRouterCSharp(swaOnly)).not.toContain("using Functions.Auth.Schemes;");
+  });
+
+  const pythonCommand = ["python3", "python"].find(command => spawnSync(command, ["--version"], { encoding: "utf-8" }).status === 0);
+  (pythonCommand ? it : it.skip).each([false, true])("compiles named Python auth router syntax (external schemes: %s)", (external) => {
+    const config = external ? auth : normalizeAuthConfig({
+      schemes: { admin: { provider: "swa" } },
+      authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] } } },
+    })!;
+    const result = spawnSync(pythonCommand!, ["-c", "import ast,sys; ast.parse(sys.stdin.read())"], {
+      encoding: "utf-8", input: generateNamedAuthRouterPython(config),
+    });
+    expect(result.stderr).toBe("");
+    expect(result.status).toBe(0);
   });
 
   it("emits Array.Empty<string>() instead of untyped new[] { } for empty C# arrays (CS0826)", () => {
@@ -157,4 +172,100 @@ describe("add-auth named scheme CLI", () => {
     new Function("module", content)(configModule);
     expect((configModule.exports as { auth: { schemes: { admin: { provider: string } } } }).auth.schemes.admin.provider).toBe("swa");
   });
+
+  it("writes named schemes to swallowkit.config.json when both config files exist (loadConfig precedence)", async () => {
+    const js = "module.exports = { backend: { language: 'typescript' } };\n";
+    fs.writeFileSync(path.join(root, "swallowkit.config.js"), js);
+    await addAuthCommand({ scheme: "admin", provider: "swa" });
+    expect(JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8")).auth.schemes.admin.provider).toBe("swa");
+    expect(fs.readFileSync(path.join(root, "swallowkit.config.js"), "utf-8")).toBe(js);
+  });
+
+  it.each(["json", "js"] as const)("disables auth in a %s config with an anonymous default that passes validation", async (format) => {
+    fs.rmSync(path.join(root, "swallowkit.config.json"));
+    if (format === "json") fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "typescript" } }));
+    else fs.writeFileSync(path.join(root, "swallowkit.config.js"), "module.exports = {\n  backend: { language: 'typescript' },\n}\n");
+    await addAuthCommand({ provider: "none" });
+    let config: SwallowKitConfig;
+    if (format === "json") {
+      config = JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8"));
+    } else {
+      const configModule = { exports: {} as SwallowKitConfig };
+      new Function("module", fs.readFileSync(path.join(root, "swallowkit.config.js"), "utf-8"))(configModule);
+      config = configModule.exports;
+    }
+    expect(config.auth).toMatchObject({ provider: "none", authorization: { defaultPolicy: "anonymous" } });
+    expect(validateConfig(config)).toEqual({ valid: true, errors: [] });
+  });
+
+  it("records single-provider auth in swallowkit.config.json instead of silently skipping it", async () => {
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "typescript" } }));
+    fs.mkdirSync(path.join(root, "app"), { recursive: true });
+    fs.writeFileSync(path.join(root, "app", "layout.tsx"), "export default function L({ children }: any) { return <html><body>{children}</body></html>; }\n");
+    await addAuthCommand({ provider: "swa", allowedProviders: ["github"] });
+    expect(JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8")).auth).toEqual({
+      provider: "swa",
+      swa: { allowedProviders: ["github"], roleSource: "swa-roles" },
+      authorization: { defaultPolicy: "authenticated" },
+    });
+  });
+
+  it.each(["typescript", "csharp", "python"] as const)("declares %s backend dependencies for a named custom-jwt scheme", async (language) => {
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language } }));
+    fs.mkdirSync(path.join(root, "functions"), { recursive: true });
+    if (language === "typescript") fs.writeFileSync(path.join(root, "functions", "package.json"), JSON.stringify({ name: "functions", dependencies: {} }));
+    if (language === "csharp") fs.writeFileSync(path.join(root, "functions", "App.Functions.csproj"), "<Project>\n  <ItemGroup>\n  </ItemGroup>\n</Project>\n");
+    if (language === "python") fs.writeFileSync(path.join(root, "functions", "requirements.txt"), "azure-functions\n");
+    await addAuthCommand({ scheme: "staff", provider: "custom-jwt" });
+    if (language === "typescript") {
+      expect(JSON.parse(fs.readFileSync(path.join(root, "functions", "package.json"), "utf-8")).dependencies).toEqual(expect.objectContaining({ jsonwebtoken: expect.any(String), bcryptjs: expect.any(String) }));
+    } else if (language === "csharp") {
+      const csproj = fs.readFileSync(path.join(root, "functions", "App.Functions.csproj"), "utf-8");
+      expect(csproj).toContain('Include="System.IdentityModel.Tokens.Jwt"');
+      expect(csproj).toContain('Include="BCrypt.Net-Next"');
+    } else {
+      expect(fs.readFileSync(path.join(root, "functions", "requirements.txt"), "utf-8")).toMatch(/PyJWT[\s\S]*bcrypt/);
+    }
+  });
+});
+
+describe("Python custom-jwt blueprint registration", () => {
+  const originalCwd = process.cwd();
+  let root: string;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-py-auth-"));
+    fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({ name: "fixture" }));
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "python" } }));
+    fs.mkdirSync(path.join(root, "shared"), { recursive: true });
+    fs.writeFileSync(path.join(root, "shared", "package.json"), JSON.stringify({ name: "@fixture/shared" }));
+    fs.mkdirSync(path.join(root, "functions"), { recursive: true });
+    fs.mkdirSync(path.join(root, "app"), { recursive: true });
+    fs.writeFileSync(path.join(root, "app", "layout.tsx"), "export default function L({ children }: any) { return <html><body>{children}</body></html>; }\n");
+    process.chdir(root);
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  const register = (body: string) => fs.writeFileSync(path.join(root, "functions", "function_app.py"), body);
+
+  it("imports the blueprint object the generated module actually defines", async () => {
+    register("import azure.functions as func\napp = func.FunctionApp()\n# SwallowKit scaffold registrations\n");
+    await addAuthCommand({ provider: "custom-jwt" });
+    const blueprint = fs.readFileSync(path.join(root, "functions", "blueprints", "auth.py"), "utf-8");
+    const app = fs.readFileSync(path.join(root, "functions", "function_app.py"), "utf-8");
+    expect(blueprint).toMatch(/^auth_bp = func\.Blueprint\(\)$/m);
+    expect(app).toContain("from blueprints.auth import auth_bp\napp.register_blueprint(auth_bp)");
+  });
+
+  it("repairs the broken import written by earlier releases without duplicating the registration", async () => {
+    register("import azure.functions as func\napp = func.FunctionApp()\nfrom blueprints.auth import bp as auth_bp\napp.register_blueprint(auth_bp)\n# SwallowKit scaffold registrations\n");
+    await addAuthCommand({ provider: "custom-jwt" });
+    const app = fs.readFileSync(path.join(root, "functions", "function_app.py"), "utf-8");
+    expect(app).not.toContain("import bp as auth_bp");
+    expect(app.match(/app\.register_blueprint\(auth_bp\)/g)).toHaveLength(1);
+  });
 });

package/src/__tests__/package-manager.test.ts

@@ -141,6 +141,21 @@ describe("getWorkspaceConfig", () => {
       expect(config.value).toEqual(["packages/*", "apps/*"]);
     }
   });
+
+  it.each([
+    ["shared", "functions"],
+    ["shared", "functions", "bff"],
+    ["shared", "bff"],
+  ])("denies SWA CLI keytar builds without approving unknown scripts (%j)", (...workspaces) => {
+    const config = getWorkspaceConfig("pnpm", workspaces);
+    expect(config.type).toBe("file");
+    if (config.type === "file") {
+      expect(config.content).toBe(
+        `packages:\n${workspaces.map((workspace) => `  - ${workspace}`).join("\n")}\n` +
+        "allowBuilds:\n  keytar: false\n  protobufjs: false\n  unrs-resolver: false\n"
+      );
+    }
+  });
 });
 
 describe("getCiSetupStep", () => {
@@ -222,8 +237,8 @@ describe("getFunctionsStartScript", () => {
     expect(getFunctionsStartScript("npm")).toContain("npm start");
   });
 
-  it("uses func start for csharp backends", () => {
-    expect(getFunctionsStartScript("pnpm", "csharp")).toBe("cd functions && func start");
+  it("uses dotnet run for csharp isolated backends", () => {
+    expect(getFunctionsStartScript("pnpm", "csharp")).toBe("cd functions && dotnet run");
   });
 
   it("uses func start for python backends", () => {

package/src/__tests__/plan-apply.test.ts

@@ -2,10 +2,12 @@ import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import * as childProcess from "child_process";
+import * as ts from "typescript";
 import { EventEmitter } from "events";
 import { runMachineCli } from "../machine";
 import { getCSharpSchemaModelPath } from "../core/scaffold/native-schema-generator";
 import { initializeLegacyMigrations } from "../core/operations/migration-generator";
+import { addModelContainerMigration } from "../core/operations/model-migration";
 import {
   MIGRATION_MANIFEST_PATH,
   createMigrationManifest,
@@ -17,6 +19,12 @@ jest.mock("child_process", () => {
   const actual = jest.requireActual<typeof import("child_process")>("child_process");
   return {
     ...actual,
+    execFile: jest.fn((
+      _command: string,
+      _args: string[],
+      _options: object,
+      callback: (error: Error | null, stdout: string, stderr: string) => void
+    ) => process.nextTick(() => callback(null, "", ""))),
     execFileSync: jest.fn(actual.execFileSync),
     spawn: jest.fn(),
     spawnSync: jest.fn(),
@@ -125,6 +133,7 @@ function createNativeBackendFixture(rootDir: string, backendLanguage: "csharp" |
 }
 
 function mockSuccessfulNativeCodegen(): () => void {
+  jest.mocked(childProcess.execFile).mockClear();
   const spawnSyncMock = childProcess.spawnSync as unknown as any;
   const spawnMock = childProcess.spawn as unknown as any;
   spawnSyncMock.mockReturnValue({ status: 0 });
@@ -134,6 +143,7 @@ function mockSuccessfulNativeCodegen(): () => void {
     return child;
   });
   return () => {
+    jest.mocked(childProcess.execFile).mockClear();
     spawnMock.mockReset();
     spawnSyncMock.mockReset();
   };
@@ -203,6 +213,7 @@ describe("plan / apply / drift / verify machine commands", () => {
       }),
       warnings: [],
     });
+
     expect(response.data.diagnostics).toEqual([]);
     expect(response.data.operations).toEqual(
       expect.arrayContaining([
@@ -221,6 +232,115 @@ describe("plan / apply / drift / verify machine commands", () => {
     ).toBe(true);
   });
 
+  it.each(["typescript", "csharp", "python"] as const)(
+    "blocks %s scaffold with an explicit authPolicy until authentication is configured",
+    async (language) => {
+      if (language === "typescript") createProjectFixture(tempDir);
+      else createNativeBackendFixture(tempDir, language);
+      fs.appendFileSync(path.join(tempDir, "shared", "models", "todo.ts"), "\nexport const authPolicy = { roles: ['admin'] };\n");
+      const reset = mockSuccessfulNativeCodegen();
+      try {
+        const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+        expect(plan.response).toMatchObject({
+          ok: false, status: "blocked", error: { code: "auth-policy-without-auth" },
+          nextActions: [expect.objectContaining({ command: expect.stringContaining("plan auth") })],
+        });
+        expect(fs.existsSync(path.join(tempDir, ".swallowkit", "state", "plans"))).toBe(false);
+        const generate = await runMachine(machineArgs("generate", "scaffold", "todo", "--api-only", "--skip-infra"));
+        expect(generate.response).toMatchObject({ ok: false, status: "blocked", error: { code: "auth-policy-without-auth" } });
+        expect(fs.existsSync(path.join(tempDir, "functions", "Crud"))).toBe(false);
+        expect(fs.readFileSync(path.join(tempDir, "shared", "index.ts"), "utf-8")).toBe("export {};\n");
+      } finally {
+        reset();
+      }
+    }
+  );
+
+  it("blocks an explicit role policy when the provider is none", async () => {
+    createProjectFixture(tempDir);
+    fs.unlinkSync(path.join(tempDir, "swallowkit.config.js"));
+    writeFile(path.join(tempDir, "swallowkit.config.json"), JSON.stringify({ auth: { provider: "none" } }));
+    fs.appendFileSync(path.join(tempDir, "shared", "models", "todo.ts"), "\nexport const authPolicy = { roles: ['admin'] };\n");
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.response).toMatchObject({ status: "blocked", error: { code: "auth-policy-without-auth" } });
+  });
+
+  it("appends a manually authored model export during plan/apply scaffold without duplicating it", async () => {
+    createProjectFixture(tempDir);
+    const indexPath = path.join(tempDir, "shared", "index.ts");
+    const originalIndex = "// Custom exports are preserved.\nexport {};\n";
+    fs.writeFileSync(indexPath, originalIndex);
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.response.data.operations).toContainEqual(expect.objectContaining({
+      path: "shared/index.ts", action: "append", ownership: "extension-point", conflict: false,
+    }));
+    expect(fs.readFileSync(indexPath, "utf-8")).toBe(originalIndex);
+    const apply = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+    expect(apply.response.ok).toBe(true);
+    expect(fs.readFileSync(indexPath, "utf-8")).toBe(`${originalIndex}export { Todo } from './models/todo';\n`);
+    const repeat = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(repeat.response.data.operations.filter((op: { path: string; action: string }) =>
+      op.path === "shared/index.ts" && op.action !== "skip")).toEqual([]);
+  });
+
+  it.each<["typescript" | "csharp" | "python", "nextjs" | "react"]>([
+    ["typescript", "nextjs"], ["csharp", "react"], ["python", "react"],
+  ])("validates auth prerequisites in %s/%s before plan and apply", async (language, frontend) => {
+    if (language === "typescript") createProjectFixture(tempDir);
+    else createNativeBackendFixture(tempDir, language);
+    fs.unlinkSync(path.join(tempDir, "swallowkit.config.js"));
+    const configPath = path.join(tempDir, "swallowkit.config.json");
+    const config = { backend: { language }, frontend: { framework: frontend },
+      auth: { schemes: { admin: { provider: "swa" } }, authorization: {
+        defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"], roles: ["admin"] } },
+      } },
+    };
+    writeFile(configPath, JSON.stringify(config));
+    const modelPath = path.join(tempDir, "shared", "models", "todo.ts");
+    writeFile(modelPath, `${createModelSource("Todo")}\nexport const authPolicy = { roles: ['admin'] };`);
+    const reset = mockSuccessfulNativeCodegen();
+    try {
+      const invalid = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+      expect(invalid.response).toMatchObject({ status: "blocked", error: { code: "auth-policy-requires-named-policy" } });
+      writeFile(modelPath, `${createModelSource("Todo")}\nexport const authPolicy = { policy: 'adminOnly' };`);
+      const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+      expect(plan.response.status).toBe("complete");
+      writeFile(configPath, JSON.stringify({ ...config, auth: undefined }));
+      const stale = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+      expect(stale.response).toMatchObject({ status: "blocked", error: { code: "stale-plan" } });
+      const direct = await runMachine(machineArgs("apply", "scaffold", "todo", "--api-only", "--skip-infra"));
+      expect(direct.response).toMatchObject({ status: "blocked", error: { code: "auth-policy-without-auth" } });
+      expect(fs.readFileSync(path.join(tempDir, "shared", "index.ts"), "utf-8")).toBe("export {};\n");
+    } finally { reset(); }
+  });
+
+  it.each([
+    ['export { Todo } from "./models/todo";\n', false],
+    ["export * from './models/todo';\n", false],
+    ["export type { Todo } from './models/todo';\n", true],
+    ["export type { Todo, displayName } from './models/todo';\n", true],
+    ["export { type Todo } from './models/todo';\n", true],
+    ["export { Todo as MyTodo } from './models/todo';", true],
+  ])("preserves existing exports and handles syntax variations: %s", async (content, append) => {
+    createProjectFixture(tempDir);
+    const indexPath = path.join(tempDir, "shared", "index.ts");
+    fs.writeFileSync(indexPath, content);
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.response.data.operations.some((op: { path: string; action: string }) =>
+      op.path === "shared/index.ts" && op.action === "append")).toBe(append);
+    expect(fs.readFileSync(indexPath, "utf-8")).toBe(content);
+
+    const apply = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+    expect(apply.response.ok).toBe(true);
+    // The shared package must still compile: no duplicate Todo binding, and Todo is usable as a value.
+    writeFile(path.join(tempDir, "shared", "consumer.ts"), "import { Todo } from './index';\nexport const parsed: Todo = Todo.parse({ id: '1', name: 'x' });\n");
+    const program = ts.createProgram([indexPath, path.join(tempDir, "shared", "consumer.ts")], {
+      strict: true, noEmit: true, skipLibCheck: true, module: ts.ModuleKind.ESNext, target: ts.ScriptTarget.ES2020,
+      moduleResolution: ts.ModuleResolutionKind.Bundler,
+    });
+    expect(ts.getPreEmitDiagnostics(program).map((d) => ts.flattenDiagnosticMessageText(d.messageText, "\n"))).toEqual([]);
+  });
+
   it("updates a ledger-unregistered legacy manifest without approval and preserves baseline identity", async () => {
     createProjectFixture(tempDir);
     createInfrastructureFixture(tempDir);
@@ -372,6 +492,64 @@ describe("plan / apply / drift / verify machine commands", () => {
     }));
   });
 
+  it("plans and applies with --skip-infra without touching infra/, then adds only the migration later", async () => {
+    createProjectFixture(tempDir);
+    createInfrastructureFixture(tempDir);
+    saveMigrationManifest(createMigrationManifest(tempDir, { legacy: false, projectId: "new-project" }), tempDir);
+    const snapshotInfra = () => {
+      const files: Record<string, string> = {};
+      const visit = (directory: string) => {
+        for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+          const absolute = path.join(directory, entry.name);
+          if (entry.isDirectory()) visit(absolute);
+          else files[path.relative(tempDir, absolute).replace(/\\/g, "/")] = fs.readFileSync(absolute, "utf-8");
+        }
+      };
+      visit(path.join(tempDir, "infra"));
+      return files;
+    };
+    const before = snapshotInfra();
+
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.exitCode).toBe(0);
+    expect(plan.response.data.options.skipInfra).toBe(true);
+    expect(plan.response.data.operations.filter((operation: { path: string }) => operation.path.startsWith("infra/"))).toEqual([]);
+    expect(plan.response.data.warnings).toEqual(expect.arrayContaining([
+      expect.stringMatching(/^infra-skipped: The Cosmos DB container migration for Todo was not generated/),
+    ]));
+    expect(plan.response.nextActions).toContainEqual(expect.objectContaining({ command: "swallowkit migrations add-model todo" }));
+
+    const apply = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+    expect(apply.exitCode).toBe(0);
+    expect(apply.response.data.createdFiles.filter((file: string) => file.startsWith("infra/"))).toEqual([]);
+    expect(apply.response.nextActions).toContainEqual(expect.objectContaining({ command: "swallowkit migrations add-model todo" }));
+    expect(snapshotInfra()).toEqual(before);
+
+    const verify = await runMachine(machineArgs("verify", "project", "--checks", "structure,drift"));
+    expect(verify.exitCode).toBe(0);
+    expect(verify.response.data.summary.done).toBe(true);
+    const drift = await runMachine(machineArgs("inspect", "drift"));
+    expect(drift.response.data.findings.filter((finding: { severity: string }) => finding.severity !== "info")).toEqual([]);
+
+    const dryRun = await addModelContainerMigration("todo", { dryRun: true });
+    expect(dryRun.operations.map((operation) => operation.path)).toEqual([
+      "infra/migrations/0001-create-todo-container/main.bicep",
+      MIGRATION_MANIFEST_PATH.replace(/\\/g, "/"),
+    ]);
+    expect(snapshotInfra()).toEqual(before);
+
+    const added = await addModelContainerMigration("todo");
+    expect(added.migration).toEqual({ version: 1, template: "infra/migrations/0001-create-todo-container/main.bicep" });
+    expect(fs.readFileSync(path.join(tempDir, added.migration!.template), "utf-8")).toContain("'/id'");
+    expect(loadMigrationManifest(tempDir).migrations).toEqual([
+      expect.objectContaining({ version: 1, source: "model", sourceModel: "Todo" }),
+    ]);
+    const again = await addModelContainerMigration("todo");
+    expect(again.operations.every((operation) => operation.action === "skip")).toBe(true);
+    const verifyAfter = await runMachine(machineArgs("verify", "project", "--checks", "structure,drift"));
+    expect(verifyAfter.response.data.summary.done).toBe(true);
+  });
+
   it.each([
     {
       name: "invalid manifest",
@@ -525,6 +703,7 @@ describe("plan / apply / drift / verify machine commands", () => {
         expect(fs.existsSync(path.join(tempDir, "functions", "openapi"))).toBe(false);
         expect(fs.existsSync(path.join(tempDir, modelPath))).toBe(false);
         expect(childProcess.spawn).not.toHaveBeenCalled();
+        expect(childProcess.execFile).not.toHaveBeenCalled();
 
         const applied = await runMachine(
           machineArgs("apply", "scaffold", "--plan", plan.response.data.planId)