swallowkit 2.0.0-alpha.1 → 2.0.0-alpha.10

package/dist/cli/commands/provision.js

@@ -4,10 +4,144 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.provisionCommand = void 0;
+exports.formatProvisionError = formatProvisionError;
+exports.describeProvisionAction = describeProvisionAction;
+exports.formatProvisionResult = formatProvisionResult;
+exports.createProvisionCommand = createProvisionCommand;
 const commander_1 = require("commander");
 const prompts_1 = __importDefault(require("prompts"));
 const config_1 = require("../../core/config");
 const provision_operations_1 = require("../../core/operations/provision-operations");
+const errors_1 = require("../../machine/errors");
+const azure_diagnostics_1 = require("../../utils/azure-diagnostics");
+const azure_cli_1 = require("../../utils/azure-cli");
+function humanProvisionMessage(message) {
+    return message
+        .replace(/swallowkit machine inspect provision --plan/g, "swallowkit provision --status")
+        .replace(/swallowkit machine apply provision --plan/g, "swallowkit provision --resume")
+        .replace(/plan provision/g, "swallowkit provision")
+        .replace(/\b[Pp]lan\b/g, "Execution")
+        .replace(/preview/g, "deployment preparation")
+        .replace(/after approval/g, "")
+        .replace(/--approve/g, "")
+        .replace(/ {2,}/g, " ");
+}
+function formatProvisionError(error) {
+    if (!(error instanceof errors_1.MachineCommandError))
+        return error instanceof Error ? error.message : String(error);
+    const message = error.code === "azure-deployment-failed" ? error.message : humanProvisionMessage(error.message);
+    const lines = [...new Set(message.split("\n"))];
+    const details = error.details;
+    if (details?.deployment) {
+        lines.push(`Deployment: ${details.deployment.reference.name}; state: ${details.deployment.state}`);
+    }
+    for (const diagnostic of details?.diagnostics ?? []) {
+        if (diagnostic.failureKind || diagnostic.outputTruncated)
+            lines.push((0, azure_diagnostics_1.formatAzureDiagnostic)(diagnostic));
+    }
+    const runId = details?.runId;
+    if (runId) {
+        lines.push(`Check: swallowkit provision --status ${runId}`);
+        if (error.code !== "azure-deployment-failed")
+            lines.push(`Resume: swallowkit provision --resume ${runId}`);
+        else
+            lines.push("Azure reported a terminal failure. Resuming only observes that failed deployment; correct its cause before explicitly deploying again.");
+    }
+    else {
+        for (const action of error.nextActions ?? []) {
+            const command = humanProvisionMessage(action.command);
+            if (!command.includes("machine "))
+                lines.push(command);
+        }
+    }
+    return lines.join("\n");
+}
+async function printProvisionSetup(result) {
+    if (!result.deployment || result.status !== "complete")
+        return;
+    const reference = result.deployment.reference;
+    const fields = ["staticWebAppName", "staticWebAppUrl", "functionsAppName", "functionsAppUrl", "cosmosDbAccountName", "cosmosDatabaseName"];
+    let outputs;
+    try {
+        const response = await (0, azure_cli_1.runAzCliAsync)([
+            "deployment",
+            "group",
+            "show",
+            "--name",
+            reference.name.startsWith("swallowkit-migration-") ? "swallowkit-baseline" : reference.name,
+            "--resource-group",
+            reference.resourceGroup,
+            "--subscription",
+            reference.subscription,
+            "--query",
+            `{${fields.map((field) => `${field}:properties.outputs.${field}.value`).join(",")}}`,
+            "-o",
+            "json",
+        ], { timeout: 30000 });
+        if (response.status !== 0 || response.failureKind || response.stdoutTruncated)
+            throw new Error("Output query did not complete.");
+        const parsed = JSON.parse(response.stdout);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error("Invalid resource output.");
+        outputs = parsed;
+    }
+    catch {
+        console.warn("Deployment succeeded, but resource information could not be read. Inspect the deployment's named outputs in Azure Portal; do not redeploy just to retrieve them.");
+        return;
+    }
+    console.log("\nResource information:");
+    for (const field of fields) {
+        if (typeof outputs[field] === "string")
+            console.log(`  ${field}: ${outputs[field]}`);
+    }
+    const swaName = typeof outputs.staticWebAppName === "string" ? outputs.staticWebAppName : "<swa-name>";
+    const functionsAppName = typeof outputs.functionsAppName === "string" ? outputs.functionsAppName : "<functions-app-name>";
+    const target = ["--resource-group", reference.resourceGroup, "--subscription", reference.subscription];
+    const swaTokenArgs = ["staticwebapp", "secrets", "list", "--name", swaName, ...target, "--query", "properties.apiKey", "-o", "tsv"];
+    const publishProfileArgs = ["webapp", "deployment", "list-publishing-profiles", "--name", functionsAppName, ...target, "--xml"];
+    console.log("\nCI/CD settings (save these as secrets in GitHub Actions or Azure Pipelines):\n");
+    console.log("  [AZURE_STATIC_WEB_APPS_API_TOKEN]");
+    console.log(await readCiCdSecret(swaTokenArgs, typeof outputs.staticWebAppName === "string"));
+    console.log("  [AZURE_FUNCTIONAPP_NAME]");
+    console.log(`    ${functionsAppName}\n`);
+    console.log("  [AZURE_FUNCTIONAPP_PUBLISH_PROFILE]");
+    console.log(await readCiCdSecret(publishProfileArgs, typeof outputs.functionsAppName === "string"));
+    console.log("  These values are shown only in this terminal; SwallowKit does not store them. Treat them as secrets.");
+    console.log("  Next: configure your CI/CD pipeline and manually trigger the first deployment (later pushes deploy automatically).");
+}
+// Reads a CI/CD credential for display in the human terminal only. The value is
+// never written to checkpoints, the ledger, or machine/MCP responses.
+async function readCiCdSecret(args, resourceKnown) {
+    const manual = `    Run manually: az ${args.map((arg) => (/[\s"]/.test(arg) ? `"${arg}"` : arg)).join(" ")}\n`;
+    if (!resourceKnown)
+        return `    ⚠️ The resource name was not in the deployment outputs.\n${manual}`;
+    try {
+        const response = await (0, azure_cli_1.runAzCliAsync)(args, { timeout: 60000 });
+        const value = response.stdout.trim();
+        if (response.status === 0 && !response.failureKind && !response.stdoutTruncated && value)
+            return `    ${value}\n`;
+    }
+    catch {
+        // Fall through to the manual command; deployment itself already succeeded.
+    }
+    return `    ⚠️ Could not retrieve automatically.\n${manual}`;
+}
+function describeProvisionAction(plan) {
+    switch (plan.mode) {
+        case "bootstrap":
+            return `Resource group ${plan.resourceGroup} does not exist yet. It will be created in ${plan.location} and the infrastructure in infra/main.bicep will be deployed.`;
+        case "migrate":
+            return `${plan.pendingMigrations.length} infrastructure migration(s) will be deployed to ${plan.resourceGroup}: ${plan.pendingMigrations.map((migration) => `${migration.version}-${migration.slug}`).join(", ")}.`;
+        case "adopt":
+            return `The existing resource group ${plan.resourceGroup} will be recorded as SwallowKit baseline 0. Nothing will be deployed.`;
+        case "reconcile":
+            return `infra/main.bicep will be redeployed to ${plan.resourceGroup}. Template-managed settings may be reset.`;
+        case "recover":
+            return `The existing baseline deployment in ${plan.resourceGroup} will be observed and its migration tag/ledger completed after Azure Succeeded. Bicep will not be submitted again.`;
+        default:
+            return `Resource group ${plan.resourceGroup}:`;
+    }
+}
 const PRIMARY_REGIONS = [
     { title: "Japan East (japaneast)", value: "japaneast" },
     { title: "Japan West (japanwest)", value: "japanwest" },
@@ -26,6 +160,39 @@ const SWA_REGIONS = [
     { title: "East US 2 (eastus2)", value: "eastus2" },
     { title: "West Europe (westeurope)", value: "westeurope" },
 ];
+function formatProvisionResult(result) {
+    const outcome = result.outcome === "succeeded"
+        ? "✅ Provisioning completed, including migration tags and the local ledger."
+        : result.outcome === "in-progress"
+            ? "⏳ Azure deployment is still in progress. The local wait ended; this is not an Azure failure."
+            : result.outcome === "partial"
+                ? "⚠️ Provisioning is partially complete. Finish migration bookkeeping from the checkpoint; do not redeploy the baseline."
+                : result.outcome === "failed"
+                    ? "❌ Azure deployment reached a failed/cancelled terminal state."
+                    : "⚠️ Azure deployment result is unknown. A local az interruption does not prove an Azure failure.";
+    const lines = [outcome, `Resource group: ${result.resourceGroup}`];
+    if (result.deployment) {
+        const reference = result.deployment.reference;
+        lines.push(`Deployment: ${reference.name}; subscription: ${reference.subscription}; state: ${result.deployment.state}${reference.id ? `; ID: ${reference.id}` : ""}`);
+        for (const error of result.deployment.errors)
+            lines.push(`${error.code}: ${error.message}`);
+    }
+    for (const warning of result.warnings)
+        lines.push(`Warning: ${humanProvisionMessage(warning)}`);
+    for (const diagnostic of result.diagnostics.filter((entry) => entry.failureKind || entry.outputTruncated)) {
+        lines.push((0, azure_diagnostics_1.formatAzureDiagnostic)(diagnostic));
+    }
+    if (result.status !== "complete") {
+        lines.push(`Check status: swallowkit provision --status ${result.runId}`);
+        if (result.outcome !== "failed")
+            lines.push(`Resume and wait until completion: swallowkit provision --resume ${result.runId}`);
+        if (result.outcome !== "failed")
+            lines.push("Azure may continue after Ctrl+C or process termination. No Azure cancellation or deletion is performed.");
+        else
+            lines.push("Azure reported a terminal failure. Correct its cause before explicitly deploying again; resuming does not repair a failed deployment.");
+    }
+    return lines.join("\n");
+}
 async function resolveLocations(options) {
     if (options.location && options.swaLocation) {
         return { location: options.location, swaLocation: options.swaLocation };
@@ -55,60 +222,116 @@ async function resolveLocations(options) {
         throw new Error("Region selection cancelled.");
     return { location, swaLocation };
 }
-exports.provisionCommand = new commander_1.Command("provision")
-    .description("Bootstrap, adopt, migrate, or explicitly reconcile Azure resources")
-    .requiredOption("-g, --resource-group <name>", "Resource group name")
-    .option("--subscription <id>", "Azure subscription ID")
-    .option("--location <region>", "Primary location for Functions and Cosmos DB")
-    .option("--swa-location <region>", "Static Web App location")
-    .option("--what-if", "Include Azure what-if evidence", false)
-    .option("--adopt-existing", "Adopt an existing untagged resource group without deploying main.bicep", false)
-    .option("--baseline <version>", "Baseline version for adoption (currently 0)")
-    .option("--reconcile", "Explicitly redeploy infra/main.bicep", false)
-    .option("--approve", "Apply the displayed plan without an interactive confirmation", false)
-    .action(async (options) => {
-    (0, config_1.ensureSwallowKitProject)("provision");
-    const locations = await resolveLocations(options);
-    const baseline = options.baseline === undefined ? undefined : Number(options.baseline);
-    const plan = await (0, provision_operations_1.planProvisionOperation)({
-        resourceGroup: options.resourceGroup,
-        subscription: options.subscription,
-        location: locations.location,
-        swaLocation: locations.swaLocation,
-        whatIf: options.whatIf,
-        adoptExisting: options.adoptExisting,
-        baseline,
-        reconcile: options.reconcile,
-    });
-    console.log(`Provision mode: ${plan.mode}`);
-    for (const warning of plan.warnings)
-        console.warn(`Warning: ${warning}`);
-    if (plan.pendingMigrations.length > 0) {
-        console.log(`Pending migrations: ${plan.pendingMigrations.map((migration) => `${migration.version}-${migration.slug}`).join(", ")}`);
-    }
-    for (const command of plan.commands)
-        console.log(`  ${command}`);
-    if (plan.mode === "adoption-required") {
-        throw new Error('Existing resource group requires: migrations init --legacy-baseline, then provision --adopt-existing --baseline 0 --what-if.');
-    }
-    let approved = options.approve === true;
-    if (!approved) {
-        if (!process.stdin.isTTY || !process.stdout.isTTY) {
-            throw new Error("Non-interactive provision requires --approve after reviewing the plan.");
+function createProvisionCommand() {
+    return new commander_1.Command("provision")
+        .description("Deploy Azure infrastructure and show resource information and CI/CD setup")
+        .option("-g, --resource-group <name>", "Resource group name (required for deployment)")
+        .option("--subscription <id>", "Azure subscription ID")
+        .option("--location <region>", "Primary location for Functions and Cosmos DB")
+        .option("--swa-location <region>", "Static Web App location")
+        .option("--what-if", "Check Azure what-if before deployment", false)
+        .option("--adopt-existing", "Adopt an existing untagged resource group without deploying main.bicep", false)
+        .option("--baseline <version>", "Baseline version for adoption (currently 0)")
+        .option("--reconcile", "Explicitly redeploy infra/main.bicep", false)
+        .addOption(new commander_1.Option("--approve", "Compatibility option; invoking provision already requests execution").hideHelp())
+        .option("--status <runId>", "Read an existing execution checkpoint and Azure deployment state without writes")
+        .option("--resume <runId>", "Continue the original execution without resubmitting attempted deployments")
+        .option("--resume-deployment <name>", "Recover an older untracked baseline deployment after verifying its template and parameters")
+        .addOption(new commander_1.Option("--wait-seconds <seconds>", "Optional limit on waiting, 0-3600 seconds (default: wait until Azure finishes; status: 0)").hideHelp())
+        .action(async (options) => {
+        try {
+            (0, config_1.ensureSwallowKitProject)("provision");
+            const waitSeconds = options.waitSeconds === undefined ? undefined : Number(options.waitSeconds);
+            if ((options.resume && options.status) ||
+                ((options.resume || options.status) &&
+                    (options.resourceGroup ||
+                        options.resumeDeployment ||
+                        options.reconcile ||
+                        options.adoptExisting ||
+                        options.subscription ||
+                        options.location ||
+                        options.swaLocation ||
+                        options.whatIf ||
+                        options.baseline !== undefined))) {
+                throw new errors_1.MachineCommandError("invalid-arguments", "Use --status or --resume with the checkpoint ID alone; its original Azure target and reviewed files are preserved.", undefined, "blocked");
+            }
+            if (options.status) {
+                const result = await (0, provision_operations_1.inspectProvisionOperation)({
+                    planId: options.status,
+                    waitSeconds,
+                });
+                console.log(formatProvisionResult(result));
+                if (result.status === "blocked" || result.status === "failed")
+                    process.exitCode = 1;
+                return;
+            }
+            if (options.resume) {
+                const result = await (0, provision_operations_1.applyProvisionOperation)({
+                    planId: options.resume,
+                    approve: true,
+                    waitSeconds,
+                    waitUntilComplete: waitSeconds === undefined,
+                });
+                console.log(formatProvisionResult(result));
+                await printProvisionSetup(result);
+                if (result.status === "blocked" || result.status === "failed")
+                    process.exitCode = 1;
+                return;
+            }
+            if (!options.resourceGroup)
+                throw new errors_1.MachineCommandError("invalid-arguments", "Provision requires --resource-group.", undefined, "blocked");
+            const locations = await resolveLocations(options);
+            const baseline = options.baseline === undefined ? undefined : Number(options.baseline);
+            // Preview in memory: the same Azure checks as the agent workflow, but no saved plan file.
+            const preview = await (0, provision_operations_1.planProvisionOperation)({
+                resourceGroup: options.resourceGroup,
+                subscription: options.subscription,
+                location: locations.location,
+                swaLocation: locations.swaLocation,
+                whatIf: options.whatIf,
+                adoptExisting: options.adoptExisting,
+                baseline,
+                reconcile: options.reconcile,
+                resumeDeployment: options.resumeDeployment,
+            }, { persist: false });
+            for (const warning of preview.warnings)
+                console.warn(`Warning: ${warning}`);
+            if (preview.mode === "offline") {
+                console.log([
+                    "",
+                    "❌ Azure CLI is unavailable, so the current state of Azure could not be checked. Nothing was changed in Azure.",
+                    "   1. Make sure `az --version` works in this terminal (install: https://aka.ms/azure-cli).",
+                    "   2. Sign in with `az login` (and `az account set --subscription <id>` if needed).",
+                    "   3. Run this command again.",
+                ].join("\n"));
+                process.exitCode = 1;
+                return;
+            }
+            if (preview.mode === "adoption-required") {
+                throw new Error("The existing resource group has no migration tag. For an interrupted baseline use --resume-deployment <original-name> to verify/observe it without redeploying. Legacy adoption applies only to a legacy manifest; do not replace an existing manifest.");
+            }
+            if (preview.mode === "noop") {
+                console.log(`Resource group ${preview.resourceGroup} is already up to date. Nothing to do.`);
+                return;
+            }
+            console.log(`\n${describeProvisionAction(preview)}`);
+            console.log("Deploying Azure infrastructure. Azure resources may incur charges.");
+            console.log("Waiting for the Azure deployment to finish. This often takes 10-20 minutes; resource information and CI/CD settings are shown when it completes.");
+            const result = await (0, provision_operations_1.executeProvisionPlan)(preview, {
+                approve: true,
+                retryHint: provision_operations_1.INTERACTIVE_PROVISION_RETRY_HINT,
+                waitSeconds,
+                waitUntilComplete: waitSeconds === undefined,
+            });
+            console.log(formatProvisionResult(result));
+            await printProvisionSetup(result);
+            if (result.status === "blocked" || result.status === "failed")
+                process.exitCode = 1;
         }
-        const answer = await (0, prompts_1.default)({
-            type: "confirm",
-            name: "approved",
-            message: `Apply the ${plan.mode} plan?`,
-            initial: false,
-        });
-        approved = answer.approved === true;
-    }
-    if (!approved) {
-        console.log("Provision cancelled.");
-        return;
-    }
-    const result = await (0, provision_operations_1.applyProvisionOperation)({ planId: plan.planId, approve: true });
-    console.log(`Provision completed (${plan.mode}). ${result.executedCommands.length} command(s) executed.`);
-});
+        catch (error) {
+            throw new Error(formatProvisionError(error));
+        }
+    });
+}
+exports.provisionCommand = createProvisionCommand();
 //# sourceMappingURL=provision.js.map

package/dist/cli/commands/provision.js.map

@@ -1 +1 @@
-{"version":3,"file":"provision.js","sourceRoot":"","sources":["../../../src/cli/commands/provision.ts"],"names":[],"mappings":";;;;;;AAAA,yCAAoC;AACpC,sDAA8B;AAC9B,8CAA4D;AAC5D,qFAA6G;AAE7G,MAAM,eAAe,GAAG;IACtB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE;IACvD,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE;IACvD,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,UAAU,EAAE;IACpD,EAAE,KAAK,EAAE,gCAAgC,EAAE,KAAK,EAAE,eAAe,EAAE;IACnE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC9C,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE;IAClD,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE;IAClD,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE;IACvD,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,YAAY,EAAE;CAC3D,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,EAAE,KAAK,EAAE,8CAA8C,EAAE,KAAK,EAAE,UAAU,EAAE;IAC5E,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE;IAClD,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE;IACvD,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE;IAClD,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,YAAY,EAAE;CAC3D,CAAC;AAcF,KAAK,UAAU,gBAAgB,CAAC,OAA4B;IAC1D,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAO,EAAC;QAC3B;YACE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YACxC,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,8CAA8C;YACvD,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,CAAC;SACX;QACD;YACE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC3C,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,yBAAyB;YAClC,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,CAAC;SACX;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IACrD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;IAC9D,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAEY,QAAA,gBAAgB,GAAG,IAAI,mBAAO,CAAC,WAAW,CAAC;KACrD,WAAW,CAAC,oEAAoE,CAAC;KACjF,cAAc,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;KACpE,MAAM,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;KACtD,MAAM,CAAC,qBAAqB,EAAE,8CAA8C,CAAC;KAC7E,MAAM,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;KAC5D,MAAM,CAAC,WAAW,EAAE,gCAAgC,EAAE,KAAK,CAAC;KAC5D,MAAM,CAAC,kBAAkB,EAAE,wEAAwE,EAAE,KAAK,CAAC;KAC3G,MAAM,CAAC,sBAAsB,EAAE,6CAA6C,CAAC;KAC7E,MAAM,CAAC,aAAa,EAAE,sCAAsC,EAAE,KAAK,CAAC;KACpE,MAAM,CAAC,WAAW,EAAE,8DAA8D,EAAE,KAAK,CAAC;KAC1F,MAAM,CAAC,KAAK,EAAE,OAA4B,EAAE,EAAE;IAC7C,IAAA,gCAAuB,EAAC,WAAW,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,MAAM,IAAA,6CAAsB,EAAC;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ;QACR,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvI,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IAEjE,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,8HAA8H,CAAC,CAAC;IAClJ,CAAC;IAED,IAAI,QAAQ,GAAG,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC;IACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAO,EAAC;YAC3B,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,aAAa,IAAI,CAAC,IAAI,QAAQ;YACvC,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,8CAAuB,EAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,CAAC,IAAI,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,uBAAuB,CAAC,CAAC;AAC5G,CAAC,CAAC,CAAC"}
+{"version":3,"file":"provision.js","sourceRoot":"","sources":["../../../src/cli/commands/provision.ts"],"names":[],"mappings":";;;;;;AA4BA,oDAuBC;AAwED,0DAeC;AAsCD,sDA4BC;AA+BD,wDA4HC;AAvWD,yCAA4C;AAC5C,sDAA8B;AAC9B,8CAA4D;AAC5D,qFAQoD;AACpD,iDAA2D;AAC3D,qEAAsE;AACtE,qDAAsD;AAEtD,SAAS,qBAAqB,CAAC,OAAe;IAC5C,OAAO,OAAO;SACX,OAAO,CAAC,8CAA8C,EAAE,+BAA+B,CAAC;SACxF,OAAO,CAAC,4CAA4C,EAAE,+BAA+B,CAAC;SACtF,OAAO,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;SAClD,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC;SACpC,OAAO,CAAC,UAAU,EAAE,wBAAwB,CAAC;SAC7C,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;SAC9B,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,CAAC,KAAK,YAAY,4BAAmB,CAAC;QAAE,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChH,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAoD,CAAC;IAC3E,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,YAAY,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,eAAe;YAAE,KAAK,CAAC,IAAI,CAAC,IAAA,yCAAqB,EAAC,UAAU,CAAC,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,IAAI,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB;YAAE,KAAK,CAAC,IAAI,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;;YACtG,KAAK,CAAC,IAAI,CAAC,wIAAwI,CAAC,CAAC;IAC5J,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAA4B;IAC7D,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;IAC9C,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,oBAAoB,CAAU,CAAC;IACpJ,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,yBAAa,EAClC;YACE,YAAY;YACZ,OAAO;YACP,MAAM;YACN,QAAQ;YACR,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI;YAC3F,kBAAkB;YAClB,SAAS,CAAC,aAAa;YACvB,gBAAgB;YAChB,SAAS,CAAC,YAAY;YACtB,SAAS;YACT,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,uBAAuB,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;YACpF,IAAI;YACJ,MAAM;SACP,EACD,EAAE,OAAO,EAAE,KAAM,EAAE,CACpB,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACjI,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChH,OAAO,GAAG,MAAiC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CACV,kKAAkK,CACnK,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC;IACvG,MAAM,gBAAgB,GAAG,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAC1H,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;IACvG,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACpI,MAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,0BAA0B,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,EAAE,OAAO,CAAC,CAAC;IAEhI,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,YAAY,EAAE,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,OAAO,gBAAgB,IAAI,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,kBAAkB,EAAE,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,wGAAwG,CAAC,CAAC;IACtH,OAAO,CAAC,GAAG,CAAC,sHAAsH,CAAC,CAAC;AACtI,CAAC;AAED,gFAAgF;AAChF,sEAAsE;AACtE,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,aAAsB;IAClE,MAAM,MAAM,GAAG,wBAAwB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IAC/G,IAAI,CAAC,aAAa;QAAE,OAAO,gEAAgE,MAAM,EAAE,CAAC;IACpG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,yBAAa,EAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAM,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,KAAK;YAAE,OAAO,OAAO,KAAK,IAAI,CAAC;IACpH,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;IACD,OAAO,6CAA6C,MAAM,EAAE,CAAC;AAC/D,CAAC;AAED,SAAgB,uBAAuB,CAAC,IAA0F;IAChI,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,WAAW;YACd,OAAO,kBAAkB,IAAI,CAAC,aAAa,8CAA8C,IAAI,CAAC,QAAQ,+DAA+D,CAAC;QACxK,KAAK,SAAS;YACZ,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,oDAAoD,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACtN,KAAK,OAAO;YACV,OAAO,+BAA+B,IAAI,CAAC,aAAa,uEAAuE,CAAC;QAClI,KAAK,WAAW;YACd,OAAO,0CAA0C,IAAI,CAAC,aAAa,2CAA2C,CAAC;QACjH,KAAK,SAAS;YACZ,OAAO,uCAAuC,IAAI,CAAC,aAAa,oHAAoH,CAAC;QACvL;YACE,OAAO,kBAAkB,IAAI,CAAC,aAAa,GAAG,CAAC;IACnD,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAAG;IACtB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE;IACvD,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE;IACvD,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,UAAU,EAAE;IACpD,EAAE,KAAK,EAAE,gCAAgC,EAAE,KAAK,EAAE,eAAe,EAAE;IACnE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC9C,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE;IAClD,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE;IAClD,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE;IACvD,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,YAAY,EAAE;CAC3D,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,EAAE,KAAK,EAAE,8CAA8C,EAAE,KAAK,EAAE,UAAU,EAAE;IAC5E,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE;IAClD,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE;IACvD,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE;IAClD,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,YAAY,EAAE;CAC3D,CAAC;AAkBF,SAAgB,qBAAqB,CAAC,MAA4B;IAChE,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,KAAK,WAAW;QAC5B,CAAC,CAAC,0EAA0E;QAC5E,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,aAAa;YAChC,CAAC,CAAC,8FAA8F;YAChG,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS;gBAC5B,CAAC,CAAC,wHAAwH;gBAC1H,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ;oBAC3B,CAAC,CAAC,+DAA+D;oBACjE,CAAC,CAAC,iGAAiG,CAAC;IAC9G,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,mBAAmB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,eAAe,SAAS,CAAC,IAAI,mBAAmB,SAAS,CAAC,YAAY,YAAY,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtK,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChG,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1G,KAAK,CAAC,IAAI,CAAC,IAAA,yCAAqB,EAAC,UAAU,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,+CAA+C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,mEAAmE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/H,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;;YAClJ,KAAK,CAAC,IAAI,CAAC,uIAAuI,CAAC,CAAC;IAC3J,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAA4B;IAC1D,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAO,EAAC;QAC3B;YACE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YACxC,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,8CAA8C;YACvD,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,CAAC;SACX;QACD;YACE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC3C,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,yBAAyB;YAClC,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,CAAC;SACX;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IACrD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;IAC9D,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,SAAgB,sBAAsB;IACpC,OAAO,IAAI,mBAAO,CAAC,WAAW,CAAC;SAC5B,WAAW,CAAC,2EAA2E,CAAC;SACxF,MAAM,CAAC,6BAA6B,EAAE,+CAA+C,CAAC;SACtF,MAAM,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;SACtD,MAAM,CAAC,qBAAqB,EAAE,8CAA8C,CAAC;SAC7E,MAAM,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;SAC5D,MAAM,CAAC,WAAW,EAAE,uCAAuC,EAAE,KAAK,CAAC;SACnE,MAAM,CAAC,kBAAkB,EAAE,wEAAwE,EAAE,KAAK,CAAC;SAC3G,MAAM,CAAC,sBAAsB,EAAE,6CAA6C,CAAC;SAC7E,MAAM,CAAC,aAAa,EAAE,sCAAsC,EAAE,KAAK,CAAC;SACpE,SAAS,CAAC,IAAI,kBAAM,CAAC,WAAW,EAAE,qEAAqE,CAAC,CAAC,QAAQ,EAAE,CAAC;SACpH,MAAM,CAAC,kBAAkB,EAAE,iFAAiF,CAAC;SAC7G,MAAM,CAAC,kBAAkB,EAAE,4EAA4E,CAAC;SACxG,MAAM,CAAC,4BAA4B,EAAE,4FAA4F,CAAC;SAClI,SAAS,CAAC,IAAI,kBAAM,CAAC,0BAA0B,EAAE,2FAA2F,CAAC,CAAC,QAAQ,EAAE,CAAC;SACzJ,MAAM,CAAC,KAAK,EAAE,OAA4B,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,IAAA,gCAAuB,EAAC,WAAW,CAAC,CAAC;YACrC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAChG,IACE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;gBAClC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;oBACjC,CAAC,OAAO,CAAC,aAAa;wBACpB,OAAO,CAAC,gBAAgB;wBACxB,OAAO,CAAC,SAAS;wBACjB,OAAO,CAAC,aAAa;wBACrB,OAAO,CAAC,YAAY;wBACpB,OAAO,CAAC,QAAQ;wBAChB,OAAO,CAAC,WAAW;wBACnB,OAAO,CAAC,MAAM;wBACd,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,EACpC,CAAC;gBACD,MAAM,IAAI,4BAAmB,CAC3B,mBAAmB,EACnB,oHAAoH,EACpH,SAAS,EACT,SAAS,CACV,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,MAAM,IAAA,gDAAyB,EAAC;oBAC7C,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,WAAW;iBACZ,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;oBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,MAAM,IAAA,8CAAuB,EAAC;oBAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,IAAI;oBACb,WAAW;oBACX,iBAAiB,EAAE,WAAW,KAAK,SAAS;iBAC7C,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3C,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBAClC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;oBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa;gBAAE,MAAM,IAAI,4BAAmB,CAAC,mBAAmB,EAAE,sCAAsC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC7I,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvF,0FAA0F;YAC1F,MAAM,OAAO,GAAG,MAAM,IAAA,6CAAsB,EAC1C;gBACE,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,QAAQ;gBACR,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;aAC3C,EACD,EAAE,OAAO,EAAE,KAAK,EAAE,CACnB,CAAC;YAEF,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC;YAE5E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CACT;oBACE,EAAE;oBACF,+GAA+G;oBAC/G,4FAA4F;oBAC5F,qFAAqF;oBACrF,+BAA+B;iBAChC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;gBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,yPAAyP,CAC1P,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,CAAC,aAAa,wCAAwC,CAAC,CAAC;gBAC7F,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,KAAK,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,kJAAkJ,CAAC,CAAC;YAEhK,MAAM,MAAM,GAAG,MAAM,IAAA,2CAAoB,EAAC,OAAO,EAAE;gBACjD,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,uDAAgC;gBAC3C,WAAW;gBACX,iBAAiB,EAAE,WAAW,KAAK,SAAS;aAC7C,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3C,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAEY,QAAA,gBAAgB,GAAG,sBAAsB,EAAE,CAAC"}

package/dist/cli/commands/scaffold.d.ts

@@ -11,8 +11,12 @@ interface ScaffoldOptions {
     functionsDir?: string;
     apiDir?: string;
     apiOnly?: boolean;
+    skipInfra?: boolean;
     expectedSchemaAnalysis?: SchemaAnalysisSnapshot;
 }
+export declare function buildInfraSkippedWarning(modelName: string, modelArgument: string): string;
+/** Warn when a model looks per-user (partition key or owner-like id field) but no authentication is configured. */
+export declare function buildUserScopedDataWarning(modelInfo: ModelInfo, authConfig: AuthConfig | undefined): string | undefined;
 export declare function scaffoldCommand(options: ScaffoldOptions): Promise<void>;
 /**
  * モデルの authPolicy と auth config から実効的な認可ポリシーを解決

package/dist/cli/commands/scaffold.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/scaffold.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EAAE,SAAS,EAA4C,MAAM,kCAAkC,CAAC;AAgBvG,OAAO,EAOL,aAAa,EACd,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAML,eAAe,EACf,UAAU,EACX,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,oBAAoB,EAEpB,sBAAsB,EACvB,MAAM,oCAAoC,CAAC;AAM5C,UAAU,eAAe;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;CACjD;AAsBD,wBAAsB,eAAe,CAAC,OAAO,EAAE,eAAe,iBA+K7D;AAyBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,CAyBvH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA4C3D;AAqID,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,GAAG,aAAa,CAYlG;AA4VD;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,GAAE,oBAAyD,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/I;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,aAAa,EAAE,OAAO,GAAE,oBAAyD,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C1M"}
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/scaffold.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EAAE,SAAS,EAA4C,MAAM,kCAAkC,CAAC;AAgBvG,OAAO,EAOL,aAAa,EACd,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAML,eAAe,EACf,UAAU,EACX,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,oBAAoB,EAEpB,sBAAsB,EACvB,MAAM,oCAAoC,CAAC;AAO5C,UAAU,eAAe;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;CACjD;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAGzF;AASD,mHAAmH;AACnH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAUvH;AAsBD,wBAAsB,eAAe,CAAC,OAAO,EAAE,eAAe,iBAkM7D;AAyBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,CA6DvH;AAsBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA4C3D;AAqID,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,GAAG,aAAa,CAYlG;AA4VD;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,GAAE,oBAAyD,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/I;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,aAAa,EAAE,OAAO,GAAE,oBAAyD,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C1M"}

package/dist/cli/commands/scaffold.js

@@ -37,6 +37,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildInfraSkippedWarning = buildInfraSkippedWarning;
+exports.buildUserScopedDataWarning = buildUserScopedDataWarning;
 exports.scaffoldCommand = scaffoldCommand;
 exports.resolveAuthPolicy = resolveAuthPolicy;
 exports.resolveModelPath = resolveModelPath;
@@ -62,7 +64,32 @@ const auth_generator_1 = require("../../core/scaffold/auth-generator");
 const file_session_1 = require("../../core/operations/file-session");
 const migration_generator_1 = require("../../core/operations/migration-generator");
 const artifacts_1 = require("../../core/project/artifacts");
+const create_model_1 = require("../../core/operations/create-model");
 const SCAFFOLD_GENERATOR = "scaffold";
+function buildInfraSkippedWarning(modelName, modelArgument) {
+    return `infra-skipped: The Cosmos DB container migration for ${modelName} was not generated (--skip-infra); infra/ was left unchanged. ` +
+        `Generate it later with "swallowkit migrations add-model ${modelArgument}", or re-plan scaffold without --skip-infra.`;
+}
+const USER_SCOPE_FIELD = /^(user|owner|learner|member|account|customer|student|author|creator|profile|person|employee|patient)Id$/i;
+function isAuthenticationConfigured(authConfig) {
+    if (!authConfig || authConfig.provider === "none")
+        return false;
+    return Boolean(authConfig.provider) || Object.keys(authConfig.schemes ?? {}).length > 0;
+}
+/** Warn when a model looks per-user (partition key or owner-like id field) but no authentication is configured. */
+function buildUserScopedDataWarning(modelInfo, authConfig) {
+    if (isAuthenticationConfigured(authConfig))
+        return undefined;
+    const partitionField = modelInfo.partitionKey.replace(/^\//, "");
+    const fieldNames = modelInfo.fields.filter((field) => field.type === "string" && !field.isArray).map((field) => field.name);
+    const ownerField = [partitionField, ...fieldNames].find((name) => USER_SCOPE_FIELD.test(name) && fieldNames.includes(name));
+    if (!ownerField)
+        return undefined;
+    const reason = ownerField === partitionField ? `is the partition key and looks like a per-user owner id` : `looks like a per-user owner id`;
+    return `user-scoped-data-without-auth: ${modelInfo.name}.${ownerField} ${reason}, but authentication is not configured. ` +
+        `Generated CRUD does not scope data to a principal, so any caller can read and write every ${modelInfo.name} document. ` +
+        `Add authentication with "plan auth", restrict or remove the generated write endpoints, and add ai-authored endpoints that derive ${ownerField} from the verified principal instead of the request body.`;
+}
 function getMachineAwareStdio() {
     return process.env.SWALLOWKIT_MACHINE_OUTPUT === "1" ? "pipe" : "inherit";
 }
@@ -116,6 +143,16 @@ async function scaffoldCommand(options) {
         }
         session.setSchemaAnalysis(schemaAnalysis);
         console.log(`✅ Model parsed: ${modelInfo.name} (${modelInfo.schemaName})`);
+        // Validate policy prerequisites before any generated artifacts are written.
+        resolveAuthPolicy(modelInfo, (0, config_1.getAuthConfig)());
+        for (const configName of ["swallowkit.config.js", "swallowkit.config.json", ".swallowkitrc.json"]) {
+            session.registerInput(path.join(process.cwd(), configName));
+        }
+        const userScopeWarning = buildUserScopedDataWarning(modelInfo, (0, config_1.getAuthConfig)());
+        if (userScopeWarning) {
+            session.addWarning(userScopeWarning);
+            console.warn(`⚠️  ${userScopeWarning}`);
+        }
         const backendLanguage = (0, config_1.getBackendLanguage)();
         const frontend = (0, config_1.getFrontendFramework)();
         const apiDir = options.apiDir || (frontend === "react" ? "bff" : "app/api");
@@ -155,6 +192,7 @@ async function scaffoldCommand(options) {
         if (options.apiOnly) {
             console.log("ℹ️  --api-only skips UI generation only; Functions, BFF routes, OpenAPI, and native schema assets are still updated.");
         }
+        (0, create_model_1.updateSharedIndex)(modelPath, modelInfo.schemaName, session);
         // 5. Generate BFF callFunction helper
         await generateCallFunctionHelper(session, apiDir);
         // 6. Generate Azure Functions code
@@ -179,9 +217,16 @@ async function scaffoldCommand(options) {
         else {
             await generateBFFRoutes(modelInfo, apiDir, sharedPackageName, session);
         }
-        // 8. Generate Cosmos DB container Bicep file (skip for connector models)
+        // 8. Generate Cosmos DB container Bicep file (skip for connector models or when infra changes are excluded)
         if (!isConnectorModel) {
-            await generateCosmosContainer(modelInfo, session);
+            if (options.skipInfra) {
+                const warning = buildInfraSkippedWarning(modelInfo.name, (0, model_parser_1.toKebabCase)(modelInfo.name));
+                session.addWarning(warning);
+                console.warn(`\n⚠️  ${warning}`);
+            }
+            else {
+                await generateCosmosContainer(modelInfo, session);
+            }
         }
         // 9. Generate UI components (unless --api-only)
         if (!options.apiOnly) {
@@ -254,11 +299,32 @@ function applyExternalTokenFetchToGeneratedUi(modelInfo, session, importPath = '
 function resolveAuthPolicy(modelInfo, authConfig) {
     // モデルに明示的な authPolicy がある場合はそれを使用
     if (modelInfo.authPolicy) {
+        if (!isAuthenticationConfigured(authConfig)) {
+            throw new errors_1.MachineCommandError("auth-policy-without-auth", `Model '${modelInfo.name}' declares authPolicy, but authentication is not configured. No artifacts were written. Run plan auth and apply auth before scaffolding this model.`, { model: modelInfo.name }, "blocked", [{
+                    command: "swallowkit machine plan auth --provider <custom-jwt|swa|external-token>",
+                    description: "Choose an authentication provider, review and apply its plan, then re-plan scaffold.",
+                }]);
+        }
         const normalized = (0, config_1.normalizeAuthConfig)(authConfig);
+        const usesNamedPolicy = Boolean(modelInfo.authPolicy.policy ||
+            typeof modelInfo.authPolicy.read === "string" || typeof modelInfo.authPolicy.write === "string");
+        // Guards resolve each operation independently: a string selects the named router, an array (or
+        // the roles fallback) selects the single-provider helper. Named schemes only have the router.
+        const operationIsNamed = (selected) => typeof selected === "string" || (selected === undefined && Boolean(modelInfo.authPolicy.policy));
+        const everyOperationNamed = operationIsNamed(modelInfo.authPolicy.read) && operationIsNamed(modelInfo.authPolicy.write) &&
+            !modelInfo.authPolicy.roles;
+        if (authConfig?.schemes && !authConfig.provider && !everyOperationNamed) {
+            throw new errors_1.MachineCommandError("auth-policy-requires-named-policy", `Model '${modelInfo.name}' declares an authPolicy whose read or write operation does not resolve to a named policy, but authentication uses named schemes. Use authPolicy = { policy: '<name>' } or name both read and write policies (role arrays are not supported with named schemes); no artifacts were written.`, { model: modelInfo.name }, "blocked", [{
+                    command: "swallowkit machine inspect capabilities",
+                    description: "Define a named authorization policy selecting the required schemes/roles, reference it from the model, then re-plan scaffold.",
+                }]);
+        }
         for (const policyName of [modelInfo.authPolicy.policy, typeof modelInfo.authPolicy.read === 'string' ? modelInfo.authPolicy.read : undefined, typeof modelInfo.authPolicy.write === 'string' ? modelInfo.authPolicy.write : undefined].filter((value) => Boolean(value))) {
             if (!normalized?.authorization.policies[policyName])
                 throw new Error(`Model '${modelInfo.name}' references undefined auth policy '${policyName}'. Define auth.authorization.policies.${policyName}.`);
         }
+        if (usesNamedPolicy)
+            assertNamedSchemesConfigured(modelInfo.name, "authPolicy", authConfig);
         return modelInfo.authPolicy;
     }
     // auth 設定がない場合はガードなし
@@ -270,11 +336,27 @@ function resolveAuthPolicy(modelInfo, authConfig) {
     if (defaultPolicy === 'authenticated') {
         return {}; // 空のポリシー = 認証のみ、ロール制限なし
     }
-    if (defaultPolicy !== 'anonymous')
+    if (defaultPolicy !== 'anonymous') {
+        assertNamedSchemesConfigured(modelInfo.name, `auth.authorization.defaultPolicy '${defaultPolicy}'`, authConfig);
         return { policy: defaultPolicy };
+    }
     // defaultPolicy が 'anonymous' なら認証不要
     return undefined;
 }
+/**
+ * Named authorization policies are enforced by the generated multi-scheme router and scheme-specific
+ * client contexts, which exist only for named auth.schemes. A single-provider configuration
+ * (auth.provider) has no router, so referencing a named policy would generate code that cannot build.
+ */
+function assertNamedSchemesConfigured(modelName, source, authConfig) {
+    if (Object.keys(authConfig?.schemes ?? {}).some((name) => name !== "default"))
+        return;
+    throw new errors_1.MachineCommandError("auth-named-policy-requires-named-scheme", `Model '${modelName}' uses a named authorization policy via ${source}, but authentication is configured with a single auth.provider. ` +
+        `Named policies require named auth.schemes; no artifacts were written. Use role lists (authPolicy = { roles: [...] } or read/write role arrays) with auth.provider, or add a named scheme.`, { model: modelName, source }, "blocked", [{
+            command: "swallowkit machine plan auth --provider <swa|external-token|custom-jwt> --scheme <name>",
+            description: "Add a named scheme and reference it from auth.authorization.policies, or switch the model to role lists; then re-plan scaffold.",
+        }]);
+}
 /**
  * モデルファイルのパスを解決
  */