swallowkit 2.0.0-alpha.3 → 2.0.0-alpha.5

package/src/__tests__/mcp-version.test.ts

@@ -0,0 +1,262 @@
+import { spawn } from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { compareSemver, isPrerelease, parseSemver } from "../utils/semver";
+import {
+  MCP_DELEGATED_FROM_ENV,
+  buildPinnedUpdateNotice,
+  decideMcpLaunch,
+  resolveProjectSwallowKit,
+} from "../mcp/version-selection";
+import { readMcpConfigVersion, resolveMcpPinVersion } from "../core/project/mcp-config";
+import { configureMcp } from "../cli/commands/configure-mcp";
+import { buildSwallowKitMcpProjectConfigSource, selectInitialMcpVersion } from "../cli/commands/init";
+import { getSwallowKitVersion } from "../version";
+
+const repositoryRoot = path.resolve(__dirname, "..", "..");
+const builtMcpEntrypoint = path.join(repositoryRoot, "dist", "mcp", "index.js");
+const itWhenBuilt = fs.existsSync(builtMcpEntrypoint) ? it : it.skip;
+
+function createProject(version: string | null, options: { mcpScript?: string } = {}): string {
+  const project = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-mcp-version-"));
+  fs.writeFileSync(path.join(project, "package.json"), JSON.stringify({ name: "sample", devEngines: { packageManager: { name: "pnpm" } } }));
+  fs.writeFileSync(path.join(project, ".mcp.json"), buildSwallowKitMcpProjectConfigSource("pnpm"));
+  if (version) {
+    const root = path.join(project, "node_modules", "swallowkit");
+    fs.mkdirSync(path.join(root, "dist", "mcp"), { recursive: true });
+    fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({
+      name: "swallowkit",
+      version,
+      bin: { swallowkit: "dist/cli/index.js", "swallowkit-mcp": "dist/mcp/index.js" },
+    }));
+    fs.writeFileSync(path.join(root, "dist", "mcp", "index.js"), options.mcpScript ?? "");
+  }
+  return project;
+}
+
+describe("semantic version precedence", () => {
+  it.each([
+    ["2.0.0-alpha.3", "1.1.2", 1],
+    ["2.0.0-alpha.3", "2.0.0", -1],
+    ["2.0.0", "2.0.0-alpha.3", 1],
+    ["2.0.0-alpha.3", "2.0.0-alpha.3", 0],
+    ["2.0.0-alpha.3", "2.0.0-alpha.10", -1],
+    ["2.0.0-alpha.3", "2.0.0-beta.1", -1],
+    ["2.0.0-beta.1", "2.0.0-rc.1", -1],
+    ["2.0.0-alpha", "2.0.0-alpha.1", -1],
+    ["2.0.0-1", "2.0.0-alpha", -1],
+    ["1.10.0", "1.9.9", 1],
+    ["1.0.0+build.1", "1.0.0", 0],
+  ])("compares %s with %s", (left, right, expected) => {
+    expect(compareSemver(left, right)).toBe(expected);
+    expect(compareSemver(right, left)).toBe(-expected || 0);
+  });
+
+  it("rejects values that are not semantic versions", () => {
+    expect(parseSemver("latest")).toBeNull();
+    expect(parseSemver("1.2")).toBeNull();
+    expect(parseSemver("01.2.3")).toBeNull();
+    expect(compareSemver("latest", "1.0.0")).toBeNull();
+    expect(isPrerelease("2.0.0-alpha.3")).toBe(true);
+    expect(isPrerelease("2.0.0")).toBe(false);
+  });
+});
+
+describe("MCP launch version selection", () => {
+  const selfPackageRoot = path.join(os.tmpdir(), "published-swallowkit");
+  const project = (version: string, entrypoint: string | null = "/project/node_modules/swallowkit/dist/mcp/index.js") => ({
+    version,
+    packageRoot: "/project/node_modules/swallowkit",
+    mcpEntrypoint: entrypoint,
+  });
+
+  it("delegates when the project install is newer than the latest launcher", () => {
+    const decision = decideMcpLaunch({
+      selfVersion: "1.1.2",
+      selfPackageRoot,
+      env: { SWALLOWKIT_MCP_VERSION: "latest" },
+      project: project("2.0.0-alpha.3"),
+    });
+    expect(decision).toEqual({
+      action: "delegate",
+      entrypoint: "/project/node_modules/swallowkit/dist/mcp/index.js",
+      fromVersion: "1.1.2",
+      toVersion: "2.0.0-alpha.3",
+    });
+  });
+
+  it("treats an unset version like latest", () => {
+    expect(decideMcpLaunch({ selfVersion: "1.1.2", selfPackageRoot, env: {}, project: project("2.0.0-alpha.3") }).action)
+      .toBe("delegate");
+  });
+
+  it.each([
+    ["latest caught up with a stable release", "2.0.0", "2.0.0-alpha.3"],
+    ["same version", "2.0.0-alpha.3", "2.0.0-alpha.3"],
+    ["latest is newer", "2.1.0", "2.0.0"],
+  ])("keeps the launcher when %s", (_label, selfVersion, projectVersion) => {
+    const decision = decideMcpLaunch({ selfVersion, selfPackageRoot, env: { SWALLOWKIT_MCP_VERSION: "latest" }, project: project(projectVersion) });
+    expect(decision.action).toBe("serve");
+    if (decision.action !== "serve") return;
+    expect(decision.context).toMatchObject({ mcpVersion: selfVersion, projectVersion, selection: "running-version", delegated: false, warnings: [] });
+  });
+
+  it("serves the launcher when SwallowKit is not installed in the project", () => {
+    const decision = decideMcpLaunch({ selfVersion: "1.1.2", selfPackageRoot, env: { SWALLOWKIT_MCP_VERSION: "latest" }, project: null });
+    expect(decision).toMatchObject({ action: "serve", context: { projectVersion: null, warnings: [], selection: "running-version" } });
+  });
+
+  it("honors an explicit pin and warns, without delegating, when the pin is older than the project", () => {
+    const decision = decideMcpLaunch({
+      selfVersion: "2.0.0-alpha.3",
+      selfPackageRoot,
+      env: { SWALLOWKIT_MCP_VERSION: "2.0.0-alpha.3" },
+      project: project("2.0.0-alpha.4"),
+      execCommand: "pnpm exec",
+    });
+    expect(decision.action).toBe("serve");
+    if (decision.action !== "serve") return;
+    expect(decision.context.selection).toBe("pinned");
+    expect(decision.context.warnings[0]).toMatch(/^mcp-older-than-project: swallowkit-mcp 2\.0\.0-alpha\.3 is older than the project's swallowkit 2\.0\.0-alpha\.4/);
+    expect(decision.context.nextActions.map((action) => action.command)).toEqual([
+      "pnpm exec swallowkit machine inspect capabilities",
+      "pnpm exec swallowkit configure-mcp",
+    ]);
+  });
+
+  it("does not delegate again inside a delegated process", () => {
+    const decision = decideMcpLaunch({
+      selfVersion: "2.0.0-alpha.3",
+      selfPackageRoot,
+      env: { SWALLOWKIT_MCP_VERSION: "latest", [MCP_DELEGATED_FROM_ENV]: "1.1.2" },
+      project: project("2.0.0-alpha.3"),
+    });
+    expect(decision).toMatchObject({
+      action: "serve",
+      context: { selection: "project-version", delegated: true, delegatedFrom: "1.1.2", mcpVersion: "2.0.0-alpha.3" },
+    });
+  });
+
+  it("warns instead of delegating when the newer project install has no MCP entrypoint", () => {
+    const decision = decideMcpLaunch({ selfVersion: "1.1.2", selfPackageRoot, env: {}, project: project("2.0.0-alpha.3", null) });
+    expect(decision.action).toBe("serve");
+    if (decision.action === "serve") expect(decision.context.warnings).toHaveLength(1);
+  });
+
+  it("reports a pinned launcher once published latest catches up", () => {
+    const context = {
+      mcpVersion: "2.0.0-alpha.3", requestedVersion: "2.0.0-alpha.3", projectVersion: "2.0.0-alpha.3",
+      selection: "pinned" as const, delegated: false, warnings: [], nextActions: [],
+    };
+    expect(buildPinnedUpdateNotice(context, "1.1.2")).toBeNull();
+    expect(buildPinnedUpdateNotice(context, null)).toBeNull();
+    const notice = buildPinnedUpdateNotice(context, "2.0.0", "pnpm exec");
+    expect(notice?.warning).toMatch(/pinned to 2\.0\.0-alpha\.3, but published latest is 2\.0\.0/);
+    expect(notice?.nextAction.command).toBe("pnpm exec swallowkit configure-mcp");
+    expect(buildPinnedUpdateNotice({ ...context, selection: "running-version" }, "2.0.0")).toBeNull();
+  });
+
+  it("finds the project-installed package and its MCP entrypoint", () => {
+    const directory = createProject("2.0.0-alpha.3");
+    const empty = createProject(null);
+    try {
+      const install = resolveProjectSwallowKit(directory);
+      expect(install?.version).toBe("2.0.0-alpha.3");
+      expect(install?.mcpEntrypoint).toBe(path.join(fs.realpathSync(directory), "node_modules", "swallowkit", "dist", "mcp", "index.js"));
+      expect(resolveProjectSwallowKit(empty)).toBeNull();
+    } finally {
+      fs.rmSync(directory, { recursive: true, force: true });
+      fs.rmSync(empty, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("MCP launcher version in .mcp.json", () => {
+  it.each([
+    ["2.0.0-alpha.3", "1.1.2", "2.0.0-alpha.3"],
+    ["2.0.0-alpha.3", "2.0.0", "latest"],
+    ["2.0.0-alpha.3", "2.0.0-alpha.3", "latest"],
+    ["1.1.2", "1.1.2", "latest"],
+    ["1.1.1", "1.1.2", "latest"],
+    ["2.0.0-alpha.3", null, "2.0.0-alpha.3"],
+    ["1.1.2", null, "latest"],
+  ])("project %s with published latest %s uses %s", (projectVersion, latest, expected) => {
+    expect(resolveMcpPinVersion(projectVersion, latest).version).toBe(expected);
+  });
+
+  it("selects the init value from this CLI version and the registry", () => {
+    const current = getSwallowKitVersion();
+    expect(selectInitialMcpVersion(() => current).version).toBe("latest");
+    expect(selectInitialMcpVersion(() => "0.0.1").version).toBe(current);
+  });
+
+  it("re-selects and preserves the rest of .mcp.json with configure-mcp", () => {
+    const directory = createProject("2.0.0-alpha.3");
+    try {
+      expect(configureMcp({ cwd: directory }, () => "1.1.2")).toMatchObject({ previousVersion: "latest", version: "2.0.0-alpha.3" });
+      expect(readMcpConfigVersion(directory)).toBe("2.0.0-alpha.3");
+      expect(configureMcp({ cwd: directory }, () => "2.0.0")).toMatchObject({ previousVersion: "2.0.0-alpha.3", version: "latest" });
+      expect(configureMcp({ cwd: directory, version: "2.0.0-alpha.3" }).version).toBe("2.0.0-alpha.3");
+      expect(configureMcp({ cwd: directory, version: "latest" }).version).toBe("latest");
+      expect(() => configureMcp({ cwd: directory, version: "next" })).toThrow(/auto/);
+      const config = JSON.parse(fs.readFileSync(path.join(directory, ".mcp.json"), "utf8"));
+      expect(config.mcpServers.swallowkit.args).toEqual(["dlx", "--package", "swallowkit@${SWALLOWKIT_MCP_VERSION}", "swallowkit-mcp"]);
+    } finally {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("built MCP entrypoint version delegation", () => {
+  const runEntrypoint = (cwd: string, env: NodeJS.ProcessEnv, until = /version: .*selection/) =>
+    new Promise<{ stderr: string; code: number | null }>((resolve, reject) => {
+      const child = spawn(process.execPath, [builtMcpEntrypoint], {
+        cwd,
+        env: { ...process.env, SWALLOWKIT_MCP_UPDATE_CHECK: "0", ...env },
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+      let stderr = "";
+      const timer = setTimeout(() => child.kill(), 10000);
+      child.stderr.on("data", (chunk) => {
+        stderr += chunk;
+        if (until.test(stderr)) child.kill();
+      });
+      child.on("error", reject);
+      child.on("close", (code) => {
+        clearTimeout(timer);
+        resolve({ stderr, code });
+      });
+    });
+
+  itWhenBuilt("hands the session to a newer project install", async () => {
+    const directory = createProject("999.0.0-alpha.1", {
+      mcpScript: `process.stderr.write("project-mcp delegatedFrom=" + process.env.${MCP_DELEGATED_FROM_ENV} + "\\n");`,
+    });
+    try {
+      const result = await runEntrypoint(directory, { SWALLOWKIT_MCP_VERSION: "latest" });
+      expect(result.stderr).toContain("delegating to the project-installed swallowkit-mcp 999.0.0-alpha.1");
+      expect(result.stderr).toContain(`project-mcp delegatedFrom=${getSwallowKitVersion()}`);
+      expect(result.code).toBe(0);
+    } finally {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  }, 20000);
+
+  itWhenBuilt("keeps serving when the project install is older or the version is pinned", async () => {
+    const older = createProject("0.0.1", { mcpScript: "process.stderr.write('should-not-run');" });
+    const newer = createProject("999.0.0", { mcpScript: "process.stderr.write('should-not-run');" });
+    try {
+      const fromOlder = await runEntrypoint(older, { SWALLOWKIT_MCP_VERSION: "latest" });
+      expect(fromOlder.stderr).toContain(`version: ${getSwallowKitVersion()} (selection: running-version)`);
+      expect(fromOlder.stderr).not.toContain("should-not-run");
+      const pinned = await runEntrypoint(newer, { SWALLOWKIT_MCP_VERSION: getSwallowKitVersion() }, /mcp-older-than-project/);
+      expect(pinned.stderr).toContain("(selection: pinned)");
+      expect(pinned.stderr).toContain("mcp-older-than-project");
+      expect(pinned.stderr).not.toContain("should-not-run");
+    } finally {
+      fs.rmSync(older, { recursive: true, force: true });
+      fs.rmSync(newer, { recursive: true, force: true });
+    }
+  }, 30000);
+});

package/src/__tests__/mcp.test.ts

@@ -8,6 +8,21 @@ const builtMcpEntrypoint = path.resolve(__dirname, "..", "..", "dist", "mcp", "i
 const itWhenBuiltEntrypointExists = fs.existsSync(builtMcpEntrypoint) ? it : it.skip;
 
 describe("SwallowKit MCP tool definitions", () => {
+  it("preserves blocked auth prerequisites and nextActions as structured MCP errors", async () => {
+    const nextActions = [{ command: "swallowkit machine plan auth --provider swa", description: "Configure auth first." }];
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({ ok: false, command: "plan-scaffold", status: "blocked",
+        error: { code: "auth-policy-without-auth", message: "Authentication is not configured." }, nextActions }),
+      stderr: "", exitCode: 1,
+    }));
+    const tool = buildSwallowKitToolDefinitions(runner).find(candidate => candidate.name === "swallowkit_plan_scaffold")!;
+    const result = await tool.handler({ model: "probe-item" });
+    expect(result.isError).toBe(true);
+    expect(JSON.parse(result.content[0].text)).toMatchObject({
+      status: "blocked", error: { code: "auth-policy-without-auth" }, nextActions,
+      metadata: { swallowkitVersion: expect.any(String) },
+    });
+  });
   it("delegates inspect_project to the machine CLI", async () => {
     const runner = jest.fn(async () => ({
       stdout: JSON.stringify({
@@ -26,10 +41,48 @@ describe("SwallowKit MCP tool definitions", () => {
     expect(runner).toHaveBeenCalledWith(["inspect", "project"]);
     expect(JSON.parse(result.content[0].text)).toEqual({
       manifestSource: "file",
-      metadata: { swallowkitVersion: expect.stringMatching(/^\d+\.\d+\.\d+/) },
+      metadata: {
+        swallowkitVersion: expect.stringMatching(/^\d+\.\d+\.\d+/),
+        mcp: expect.objectContaining({ selection: "running-version", delegated: false }),
+      },
     });
   });
 
+  it("reports delegation, the serving version, and version warnings on every tool", async () => {
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({ ok: true, command: "inspect-entities", data: { entities: [] } }),
+      stderr: "",
+      exitCode: 0,
+    }));
+    const context = {
+      mcpVersion: "2.0.0-alpha.3",
+      requestedVersion: "latest",
+      projectVersion: "2.0.0-alpha.4",
+      selection: "project-version" as const,
+      delegated: true,
+      delegatedFrom: "1.1.2",
+      warnings: ["mcp-older-than-project: example"],
+      nextActions: [{ command: "pnpm exec swallowkit configure-mcp", description: "Re-select." }],
+    };
+    const tools = buildSwallowKitToolDefinitions(runner as MachineCliRunner, context);
+    for (const name of ["swallowkit_inspect_entities", "swallowkit_inspect_capabilities", "swallowkit_inspect_boundaries"]) {
+      const parsed = JSON.parse((await tools.find((tool) => tool.name === name)!.handler({})).content[0].text);
+      expect(parsed.metadata).toEqual({
+        swallowkitVersion: "2.0.0-alpha.3",
+        mcp: {
+          version: "2.0.0-alpha.3",
+          requestedVersion: "latest",
+          projectVersion: "2.0.0-alpha.4",
+          selection: "project-version",
+          delegated: true,
+          delegatedFrom: "1.1.2",
+        },
+        warnings: ["mcp-older-than-project: example"],
+      });
+      expect(parsed.nextActions).toEqual(context.nextActions);
+    }
+  });
+
   it("includes the MCP version in validate_project metadata", async () => {
     const runner = jest.fn(async () => ({
       stdout: JSON.stringify({ ok: true, command: "validate-project", data: { valid: true } }),
@@ -43,7 +96,7 @@ describe("SwallowKit MCP tool definitions", () => {
     const result = await tool!.handler({});
     expect(JSON.parse(result.content[0].text)).toEqual({
       valid: true,
-      metadata: { swallowkitVersion: expect.stringMatching(/^\d+\.\d+\.\d+/) },
+      metadata: expect.objectContaining({ swallowkitVersion: expect.stringMatching(/^\d+\.\d+\.\d+/) }),
     });
   });
 
@@ -78,7 +131,10 @@ describe("SwallowKit MCP tool definitions", () => {
       "app/api",
       "--api-only",
     ]);
-    expect(JSON.parse(result.content[0].text)).toEqual({ createdFiles: ["functions/src/todo.ts"] });
+    expect(JSON.parse(result.content[0].text)).toEqual({
+      createdFiles: ["functions/src/todo.ts"],
+      metadata: expect.objectContaining({ swallowkitVersion: expect.any(String) }),
+    });
   });
 
   it("exposes the agent-loop tools (plan/apply/artifacts/drift/verify/explain)", () => {
@@ -114,6 +170,11 @@ describe("SwallowKit MCP tool definitions", () => {
     const result = await tool!.handler({ model: "todo", apiOnly: true });
 
     expect(runner).toHaveBeenCalledWith(["plan", "scaffold", "todo", "--api-only"]);
+    await tool!.handler({ model: "todo", skipInfra: true });
+    expect(runner).toHaveBeenLastCalledWith(["plan", "scaffold", "todo", "--skip-infra"]);
+    const applyTool = buildSwallowKitToolDefinitions(runner as MachineCliRunner).find((candidate) => candidate.name === "swallowkit_apply_scaffold");
+    await applyTool!.handler({ model: "todo", skipInfra: true });
+    expect(runner).toHaveBeenLastCalledWith(["apply", "scaffold", "todo", "--skip-infra"]);
     const parsed = JSON.parse(result.content[0].text);
     expect(parsed.status).toBe("requires-human");
     expect(parsed.planId).toBe("abc");

package/src/__tests__/multi-auth.test.ts

@@ -1,6 +1,7 @@
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
+import { spawnSync } from "child_process";
 import { addAuthCommand } from "../cli/commands/add-auth";
 import { createUIAuthOptions } from "../cli/commands/scaffold";
 import {
@@ -9,12 +10,12 @@ import {
   generateNamedAuthRouterPython,
   generateNamedAuthRouterTS,
 } from "../core/scaffold/auth-generator";
-import { normalizeAuthConfig } from "../core/config";
+import { normalizeAuthConfig, validateConfig } from "../core/config";
 import { parseAuthPolicy } from "../core/scaffold/model-parser";
 import { createBasicModelInfo } from "./fixtures";
 import { generateCSharpAzureFunctionsCRUD, generateCompactAzureFunctionsCRUD, generatePythonAzureFunctionsCRUD } from "../core/scaffold/functions-generator";
 import { generateAuthLayout, generateNewPage } from "../core/scaffold/ui-generator";
-import { AuthConfig } from "../types";
+import { AuthConfig, SwallowKitConfig } from "../types";
 
 const namedAuthConfig: AuthConfig = {
   schemes: {
@@ -57,10 +58,24 @@ describe("named authentication routers", () => {
   it("generates valid branch structure for an SWA-only Python router", () => {
     const swaOnly = normalizeAuthConfig({ schemes: { admin: { provider: "swa", swa: { allowedProviders: ["github"] } } }, authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] } } } })!;
     const python = generateNamedAuthRouterPython(swaOnly);
-    expect(python).toContain('        if PROVIDERS[scheme] == "swa":');
-    expect(python).not.toContain('        elif PROVIDERS[scheme] == "swa":');
+    expect(python).toContain('\n    if PROVIDERS[scheme] == "swa":');
+    expect(python).not.toContain('\n    elif PROVIDERS[scheme] == "swa":');
     expect(python).toContain("ALLOWED_PROVIDERS");
     expect(generateNamedAuthRouterCSharp(swaOnly)).toContain("AllowedProviders[scheme]");
+    expect(generateNamedAuthRouterCSharp(swaOnly)).not.toContain("using Functions.Auth.Schemes;");
+  });
+
+  const pythonCommand = ["python3", "python"].find(command => spawnSync(command, ["--version"], { encoding: "utf-8" }).status === 0);
+  (pythonCommand ? it : it.skip).each([false, true])("compiles named Python auth router syntax (external schemes: %s)", (external) => {
+    const config = external ? auth : normalizeAuthConfig({
+      schemes: { admin: { provider: "swa" } },
+      authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] } } },
+    })!;
+    const result = spawnSync(pythonCommand!, ["-c", "import ast,sys; ast.parse(sys.stdin.read())"], {
+      encoding: "utf-8", input: generateNamedAuthRouterPython(config),
+    });
+    expect(result.stderr).toBe("");
+    expect(result.status).toBe(0);
   });
 
   it("emits Array.Empty<string>() instead of untyped new[] { } for empty C# arrays (CS0826)", () => {
@@ -157,4 +172,100 @@ describe("add-auth named scheme CLI", () => {
     new Function("module", content)(configModule);
     expect((configModule.exports as { auth: { schemes: { admin: { provider: string } } } }).auth.schemes.admin.provider).toBe("swa");
   });
+
+  it("writes named schemes to swallowkit.config.json when both config files exist (loadConfig precedence)", async () => {
+    const js = "module.exports = { backend: { language: 'typescript' } };\n";
+    fs.writeFileSync(path.join(root, "swallowkit.config.js"), js);
+    await addAuthCommand({ scheme: "admin", provider: "swa" });
+    expect(JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8")).auth.schemes.admin.provider).toBe("swa");
+    expect(fs.readFileSync(path.join(root, "swallowkit.config.js"), "utf-8")).toBe(js);
+  });
+
+  it.each(["json", "js"] as const)("disables auth in a %s config with an anonymous default that passes validation", async (format) => {
+    fs.rmSync(path.join(root, "swallowkit.config.json"));
+    if (format === "json") fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "typescript" } }));
+    else fs.writeFileSync(path.join(root, "swallowkit.config.js"), "module.exports = {\n  backend: { language: 'typescript' },\n}\n");
+    await addAuthCommand({ provider: "none" });
+    let config: SwallowKitConfig;
+    if (format === "json") {
+      config = JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8"));
+    } else {
+      const configModule = { exports: {} as SwallowKitConfig };
+      new Function("module", fs.readFileSync(path.join(root, "swallowkit.config.js"), "utf-8"))(configModule);
+      config = configModule.exports;
+    }
+    expect(config.auth).toMatchObject({ provider: "none", authorization: { defaultPolicy: "anonymous" } });
+    expect(validateConfig(config)).toEqual({ valid: true, errors: [] });
+  });
+
+  it("records single-provider auth in swallowkit.config.json instead of silently skipping it", async () => {
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "typescript" } }));
+    fs.mkdirSync(path.join(root, "app"), { recursive: true });
+    fs.writeFileSync(path.join(root, "app", "layout.tsx"), "export default function L({ children }: any) { return <html><body>{children}</body></html>; }\n");
+    await addAuthCommand({ provider: "swa", allowedProviders: ["github"] });
+    expect(JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8")).auth).toEqual({
+      provider: "swa",
+      swa: { allowedProviders: ["github"], roleSource: "swa-roles" },
+      authorization: { defaultPolicy: "authenticated" },
+    });
+  });
+
+  it.each(["typescript", "csharp", "python"] as const)("declares %s backend dependencies for a named custom-jwt scheme", async (language) => {
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language } }));
+    fs.mkdirSync(path.join(root, "functions"), { recursive: true });
+    if (language === "typescript") fs.writeFileSync(path.join(root, "functions", "package.json"), JSON.stringify({ name: "functions", dependencies: {} }));
+    if (language === "csharp") fs.writeFileSync(path.join(root, "functions", "App.Functions.csproj"), "<Project>\n  <ItemGroup>\n  </ItemGroup>\n</Project>\n");
+    if (language === "python") fs.writeFileSync(path.join(root, "functions", "requirements.txt"), "azure-functions\n");
+    await addAuthCommand({ scheme: "staff", provider: "custom-jwt" });
+    if (language === "typescript") {
+      expect(JSON.parse(fs.readFileSync(path.join(root, "functions", "package.json"), "utf-8")).dependencies).toEqual(expect.objectContaining({ jsonwebtoken: expect.any(String), bcryptjs: expect.any(String) }));
+    } else if (language === "csharp") {
+      const csproj = fs.readFileSync(path.join(root, "functions", "App.Functions.csproj"), "utf-8");
+      expect(csproj).toContain('Include="System.IdentityModel.Tokens.Jwt"');
+      expect(csproj).toContain('Include="BCrypt.Net-Next"');
+    } else {
+      expect(fs.readFileSync(path.join(root, "functions", "requirements.txt"), "utf-8")).toMatch(/PyJWT[\s\S]*bcrypt/);
+    }
+  });
+});
+
+describe("Python custom-jwt blueprint registration", () => {
+  const originalCwd = process.cwd();
+  let root: string;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-py-auth-"));
+    fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({ name: "fixture" }));
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "python" } }));
+    fs.mkdirSync(path.join(root, "shared"), { recursive: true });
+    fs.writeFileSync(path.join(root, "shared", "package.json"), JSON.stringify({ name: "@fixture/shared" }));
+    fs.mkdirSync(path.join(root, "functions"), { recursive: true });
+    fs.mkdirSync(path.join(root, "app"), { recursive: true });
+    fs.writeFileSync(path.join(root, "app", "layout.tsx"), "export default function L({ children }: any) { return <html><body>{children}</body></html>; }\n");
+    process.chdir(root);
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  const register = (body: string) => fs.writeFileSync(path.join(root, "functions", "function_app.py"), body);
+
+  it("imports the blueprint object the generated module actually defines", async () => {
+    register("import azure.functions as func\napp = func.FunctionApp()\n# SwallowKit scaffold registrations\n");
+    await addAuthCommand({ provider: "custom-jwt" });
+    const blueprint = fs.readFileSync(path.join(root, "functions", "blueprints", "auth.py"), "utf-8");
+    const app = fs.readFileSync(path.join(root, "functions", "function_app.py"), "utf-8");
+    expect(blueprint).toMatch(/^auth_bp = func\.Blueprint\(\)$/m);
+    expect(app).toContain("from blueprints.auth import auth_bp\napp.register_blueprint(auth_bp)");
+  });
+
+  it("repairs the broken import written by earlier releases without duplicating the registration", async () => {
+    register("import azure.functions as func\napp = func.FunctionApp()\nfrom blueprints.auth import bp as auth_bp\napp.register_blueprint(auth_bp)\n# SwallowKit scaffold registrations\n");
+    await addAuthCommand({ provider: "custom-jwt" });
+    const app = fs.readFileSync(path.join(root, "functions", "function_app.py"), "utf-8");
+    expect(app).not.toContain("import bp as auth_bp");
+    expect(app.match(/app\.register_blueprint\(auth_bp\)/g)).toHaveLength(1);
+  });
 });