swallowkit 2.0.0-alpha.3 → 2.0.0-alpha.5

package/src/__tests__/plan-apply.test.ts

@@ -2,10 +2,12 @@ import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import * as childProcess from "child_process";
+import * as ts from "typescript";
 import { EventEmitter } from "events";
 import { runMachineCli } from "../machine";
 import { getCSharpSchemaModelPath } from "../core/scaffold/native-schema-generator";
 import { initializeLegacyMigrations } from "../core/operations/migration-generator";
+import { addModelContainerMigration } from "../core/operations/model-migration";
 import {
   MIGRATION_MANIFEST_PATH,
   createMigrationManifest,
@@ -211,6 +213,7 @@ describe("plan / apply / drift / verify machine commands", () => {
       }),
       warnings: [],
     });
+
     expect(response.data.diagnostics).toEqual([]);
     expect(response.data.operations).toEqual(
       expect.arrayContaining([
@@ -229,6 +232,115 @@ describe("plan / apply / drift / verify machine commands", () => {
     ).toBe(true);
   });
 
+  it.each(["typescript", "csharp", "python"] as const)(
+    "blocks %s scaffold with an explicit authPolicy until authentication is configured",
+    async (language) => {
+      if (language === "typescript") createProjectFixture(tempDir);
+      else createNativeBackendFixture(tempDir, language);
+      fs.appendFileSync(path.join(tempDir, "shared", "models", "todo.ts"), "\nexport const authPolicy = { roles: ['admin'] };\n");
+      const reset = mockSuccessfulNativeCodegen();
+      try {
+        const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+        expect(plan.response).toMatchObject({
+          ok: false, status: "blocked", error: { code: "auth-policy-without-auth" },
+          nextActions: [expect.objectContaining({ command: expect.stringContaining("plan auth") })],
+        });
+        expect(fs.existsSync(path.join(tempDir, ".swallowkit", "state", "plans"))).toBe(false);
+        const generate = await runMachine(machineArgs("generate", "scaffold", "todo", "--api-only", "--skip-infra"));
+        expect(generate.response).toMatchObject({ ok: false, status: "blocked", error: { code: "auth-policy-without-auth" } });
+        expect(fs.existsSync(path.join(tempDir, "functions", "Crud"))).toBe(false);
+        expect(fs.readFileSync(path.join(tempDir, "shared", "index.ts"), "utf-8")).toBe("export {};\n");
+      } finally {
+        reset();
+      }
+    }
+  );
+
+  it("blocks an explicit role policy when the provider is none", async () => {
+    createProjectFixture(tempDir);
+    fs.unlinkSync(path.join(tempDir, "swallowkit.config.js"));
+    writeFile(path.join(tempDir, "swallowkit.config.json"), JSON.stringify({ auth: { provider: "none" } }));
+    fs.appendFileSync(path.join(tempDir, "shared", "models", "todo.ts"), "\nexport const authPolicy = { roles: ['admin'] };\n");
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.response).toMatchObject({ status: "blocked", error: { code: "auth-policy-without-auth" } });
+  });
+
+  it("appends a manually authored model export during plan/apply scaffold without duplicating it", async () => {
+    createProjectFixture(tempDir);
+    const indexPath = path.join(tempDir, "shared", "index.ts");
+    const originalIndex = "// Custom exports are preserved.\nexport {};\n";
+    fs.writeFileSync(indexPath, originalIndex);
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.response.data.operations).toContainEqual(expect.objectContaining({
+      path: "shared/index.ts", action: "append", ownership: "extension-point", conflict: false,
+    }));
+    expect(fs.readFileSync(indexPath, "utf-8")).toBe(originalIndex);
+    const apply = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+    expect(apply.response.ok).toBe(true);
+    expect(fs.readFileSync(indexPath, "utf-8")).toBe(`${originalIndex}export { Todo } from './models/todo';\n`);
+    const repeat = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(repeat.response.data.operations.filter((op: { path: string; action: string }) =>
+      op.path === "shared/index.ts" && op.action !== "skip")).toEqual([]);
+  });
+
+  it.each<["typescript" | "csharp" | "python", "nextjs" | "react"]>([
+    ["typescript", "nextjs"], ["csharp", "react"], ["python", "react"],
+  ])("validates auth prerequisites in %s/%s before plan and apply", async (language, frontend) => {
+    if (language === "typescript") createProjectFixture(tempDir);
+    else createNativeBackendFixture(tempDir, language);
+    fs.unlinkSync(path.join(tempDir, "swallowkit.config.js"));
+    const configPath = path.join(tempDir, "swallowkit.config.json");
+    const config = { backend: { language }, frontend: { framework: frontend },
+      auth: { schemes: { admin: { provider: "swa" } }, authorization: {
+        defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"], roles: ["admin"] } },
+      } },
+    };
+    writeFile(configPath, JSON.stringify(config));
+    const modelPath = path.join(tempDir, "shared", "models", "todo.ts");
+    writeFile(modelPath, `${createModelSource("Todo")}\nexport const authPolicy = { roles: ['admin'] };`);
+    const reset = mockSuccessfulNativeCodegen();
+    try {
+      const invalid = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+      expect(invalid.response).toMatchObject({ status: "blocked", error: { code: "auth-policy-requires-named-policy" } });
+      writeFile(modelPath, `${createModelSource("Todo")}\nexport const authPolicy = { policy: 'adminOnly' };`);
+      const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+      expect(plan.response.status).toBe("complete");
+      writeFile(configPath, JSON.stringify({ ...config, auth: undefined }));
+      const stale = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+      expect(stale.response).toMatchObject({ status: "blocked", error: { code: "stale-plan" } });
+      const direct = await runMachine(machineArgs("apply", "scaffold", "todo", "--api-only", "--skip-infra"));
+      expect(direct.response).toMatchObject({ status: "blocked", error: { code: "auth-policy-without-auth" } });
+      expect(fs.readFileSync(path.join(tempDir, "shared", "index.ts"), "utf-8")).toBe("export {};\n");
+    } finally { reset(); }
+  });
+
+  it.each([
+    ['export { Todo } from "./models/todo";\n', false],
+    ["export * from './models/todo';\n", false],
+    ["export type { Todo } from './models/todo';\n", true],
+    ["export type { Todo, displayName } from './models/todo';\n", true],
+    ["export { type Todo } from './models/todo';\n", true],
+    ["export { Todo as MyTodo } from './models/todo';", true],
+  ])("preserves existing exports and handles syntax variations: %s", async (content, append) => {
+    createProjectFixture(tempDir);
+    const indexPath = path.join(tempDir, "shared", "index.ts");
+    fs.writeFileSync(indexPath, content);
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.response.data.operations.some((op: { path: string; action: string }) =>
+      op.path === "shared/index.ts" && op.action === "append")).toBe(append);
+    expect(fs.readFileSync(indexPath, "utf-8")).toBe(content);
+
+    const apply = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+    expect(apply.response.ok).toBe(true);
+    // The shared package must still compile: no duplicate Todo binding, and Todo is usable as a value.
+    writeFile(path.join(tempDir, "shared", "consumer.ts"), "import { Todo } from './index';\nexport const parsed: Todo = Todo.parse({ id: '1', name: 'x' });\n");
+    const program = ts.createProgram([indexPath, path.join(tempDir, "shared", "consumer.ts")], {
+      strict: true, noEmit: true, skipLibCheck: true, module: ts.ModuleKind.ESNext, target: ts.ScriptTarget.ES2020,
+      moduleResolution: ts.ModuleResolutionKind.Bundler,
+    });
+    expect(ts.getPreEmitDiagnostics(program).map((d) => ts.flattenDiagnosticMessageText(d.messageText, "\n"))).toEqual([]);
+  });
+
   it("updates a ledger-unregistered legacy manifest without approval and preserves baseline identity", async () => {
     createProjectFixture(tempDir);
     createInfrastructureFixture(tempDir);
@@ -380,6 +492,64 @@ describe("plan / apply / drift / verify machine commands", () => {
     }));
   });
 
+  it("plans and applies with --skip-infra without touching infra/, then adds only the migration later", async () => {
+    createProjectFixture(tempDir);
+    createInfrastructureFixture(tempDir);
+    saveMigrationManifest(createMigrationManifest(tempDir, { legacy: false, projectId: "new-project" }), tempDir);
+    const snapshotInfra = () => {
+      const files: Record<string, string> = {};
+      const visit = (directory: string) => {
+        for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+          const absolute = path.join(directory, entry.name);
+          if (entry.isDirectory()) visit(absolute);
+          else files[path.relative(tempDir, absolute).replace(/\\/g, "/")] = fs.readFileSync(absolute, "utf-8");
+        }
+      };
+      visit(path.join(tempDir, "infra"));
+      return files;
+    };
+    const before = snapshotInfra();
+
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.exitCode).toBe(0);
+    expect(plan.response.data.options.skipInfra).toBe(true);
+    expect(plan.response.data.operations.filter((operation: { path: string }) => operation.path.startsWith("infra/"))).toEqual([]);
+    expect(plan.response.data.warnings).toEqual(expect.arrayContaining([
+      expect.stringMatching(/^infra-skipped: The Cosmos DB container migration for Todo was not generated/),
+    ]));
+    expect(plan.response.nextActions).toContainEqual(expect.objectContaining({ command: "swallowkit migrations add-model todo" }));
+
+    const apply = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+    expect(apply.exitCode).toBe(0);
+    expect(apply.response.data.createdFiles.filter((file: string) => file.startsWith("infra/"))).toEqual([]);
+    expect(apply.response.nextActions).toContainEqual(expect.objectContaining({ command: "swallowkit migrations add-model todo" }));
+    expect(snapshotInfra()).toEqual(before);
+
+    const verify = await runMachine(machineArgs("verify", "project", "--checks", "structure,drift"));
+    expect(verify.exitCode).toBe(0);
+    expect(verify.response.data.summary.done).toBe(true);
+    const drift = await runMachine(machineArgs("inspect", "drift"));
+    expect(drift.response.data.findings.filter((finding: { severity: string }) => finding.severity !== "info")).toEqual([]);
+
+    const dryRun = await addModelContainerMigration("todo", { dryRun: true });
+    expect(dryRun.operations.map((operation) => operation.path)).toEqual([
+      "infra/migrations/0001-create-todo-container/main.bicep",
+      MIGRATION_MANIFEST_PATH.replace(/\\/g, "/"),
+    ]);
+    expect(snapshotInfra()).toEqual(before);
+
+    const added = await addModelContainerMigration("todo");
+    expect(added.migration).toEqual({ version: 1, template: "infra/migrations/0001-create-todo-container/main.bicep" });
+    expect(fs.readFileSync(path.join(tempDir, added.migration!.template), "utf-8")).toContain("'/id'");
+    expect(loadMigrationManifest(tempDir).migrations).toEqual([
+      expect.objectContaining({ version: 1, source: "model", sourceModel: "Todo" }),
+    ]);
+    const again = await addModelContainerMigration("todo");
+    expect(again.operations.every((operation) => operation.action === "skip")).toBe(true);
+    const verifyAfter = await runMachine(machineArgs("verify", "project", "--checks", "structure,drift"));
+    expect(verifyAfter.response.data.summary.done).toBe(true);
+  });
+
   it.each([
     {
       name: "invalid manifest",

package/src/__tests__/schema-analysis.test.ts

@@ -0,0 +1,329 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { parseModelFile } from "../core/scaffold/model-parser";
+import { generateOpenApiDocument } from "../core/scaffold/openapi-generator";
+import { generateListPage, generateFormComponent } from "../core/scaffold/ui-generator";
+import { generateLanguageSchemaArtifacts, getPythonRegexWarnings, toPythonRegex } from "../core/scaffold/native-schema-generator";
+import { generateDetailPage } from "../core/scaffold/ui-generator";
+import { spawnSync } from "child_process";
+import { FileOperationSession } from "../core/operations/file-session";
+import { buildUserScopedDataWarning } from "../cli/commands/scaffold";
+import { inspectCapabilities } from "../core/project/capabilities";
+
+const repoRoot = path.resolve(__dirname, "..", "..");
+
+function model(name: string, fields: string, extra = ""): string {
+  const pascal = name.replace(/(^|-)([a-z])/g, (_, __, char: string) => char.toUpperCase());
+  return `import { z } from 'zod/v4';
+export const ${pascal} = z.object({
+  id: z.string(),
+${fields}
+});
+export type ${pascal} = z.infer<typeof ${pascal}>;
+${extra}`;
+}
+
+describe("foreign-key inference", () => {
+  let root: string;
+  const write = (name: string, source: string) => {
+    const file = path.join(root, "shared", "models", `${name}.ts`);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, source);
+    return file;
+  };
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-fk-"));
+  });
+  afterEach(() => fs.rmSync(root, { recursive: true, force: true }));
+
+  it("does not treat userId as a foreign key when no User model exists", async () => {
+    const info = await parseModelFile(write("probe-item", model("probe-item", "  userId: z.string(),\n  title: z.string(),", "export const partitionKey = '/userId';\n")));
+    const userId = info.fields.find((field) => field.name === "userId")!;
+    expect(userId.isForeignKey).toBeUndefined();
+    expect(userId.referencedModel).toBeUndefined();
+    expect(info.parserWarnings).toEqual([]);
+
+    const list = generateListPage(info, "@sample/shared");
+    const form = generateFormComponent(info, "@sample/shared");
+    expect(list).not.toMatch(/api\/user|userMap/);
+    expect(form).not.toMatch(/api\/user|userOptions/);
+    const schema = JSON.parse(generateOpenApiDocument([info], info)).components.schemas;
+    expect(schema.ProbeItem.properties.userId).toEqual({ type: "string" });
+    expect(Object.keys(schema)).toEqual(["ProbeItem"]);
+  });
+
+  it("infers a foreign key when the referenced model exists", async () => {
+    write("category", model("category", "  name: z.string(),"));
+    const info = await parseModelFile(write("todo", model("todo", "  categoryId: z.string(),")));
+    expect(info.fields.find((field) => field.name === "categoryId")).toMatchObject({ isForeignKey: true, referencedModel: "Category" });
+    expect(generateListPage(info, "@sample/shared")).toContain("/api/category");
+  });
+
+  it("supports explicit references, opt-out, and warns about missing targets", async () => {
+    write("user", model("user", "  name: z.string(),"));
+    const info = await parseModelFile(write("post", model(
+      "post",
+      "  authorId: z.string(),\n  userId: z.string(),\n  reviewerId: z.string(),\n  tagIds: z.array(z.string()),",
+      "export const references = { authorId: 'User', userId: false, reviewerId: 'Reviewer', tagIds: 'Tag', missingId: 'User' };\n"
+    )));
+    const field = (name: string) => info.fields.find((candidate) => candidate.name === name)!;
+    expect(field("authorId")).toMatchObject({ isForeignKey: true, referencedModel: "User" });
+    expect(field("userId").isForeignKey).toBeUndefined();
+    expect(field("reviewerId").isForeignKey).toBeUndefined();
+    expect(field("tagIds").isForeignKey).toBeUndefined();
+    expect(info.parserWarnings).toEqual([
+      "reference-model-not-found: Post.reviewerId references Reviewer, but shared/models has no Reviewer model; it is treated as a plain field.",
+      "reference-field-unsupported: Post.tagIds must be a single string id to reference Tag.",
+      "reference-field-not-found: Post.references declares missingId, but the schema has no such field.",
+    ]);
+  });
+
+  it("declares one lookup per referenced model when several fields reference it", async () => {
+    write("user", model("user", "  name: z.string(),"));
+    const info = await parseModelFile(write("review", model(
+      "review",
+      "  authorId: z.string(),\n  reviewerId: z.string(),",
+      "export const references = { authorId: 'User', reviewerId: 'User' };\n"
+    )));
+    const count = (source: string, text: string) => source.split(text).length - 1;
+    for (const source of [generateListPage(info, "@sample/shared"), generateDetailPage(info, "@sample/shared")]) {
+      expect(count(source, "const [userMap, setUserMap]")).toBe(1);
+      expect(count(source, "fetch('/api/user')")).toBe(1);
+      expect(source).toContain("userMap[item.authorId]".replace("item", source.includes("ListPage") ? "item" : "review"));
+    }
+    const form = generateFormComponent(info, "@sample/shared");
+    expect(count(form, "const [userOptions, setUserOptions]")).toBe(1);
+    expect(count(form, "fetch('/api/user')")).toBe(1);
+    expect(form).toContain('id="authorId"');
+    expect(form).toContain('id="reviewerId"');
+  });
+
+  it("documents the references declaration in capabilities", () => {
+    expect(inspectCapabilities().modelDeclarations.map((declaration) => declaration.name)).toContain("references");
+  });
+});
+
+describe("dynamic schema evaluation metadata", () => {
+  let root: string;
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-dynamic-"));
+    fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({ name: "sample", type: "module" }));
+    fs.mkdirSync(path.join(root, "node_modules"), { recursive: true });
+    fs.symlinkSync(path.join(repoRoot, "node_modules", "zod"), path.join(root, "node_modules", "zod"), "junction");
+  });
+  afterEach(() => fs.rmSync(root, { recursive: true, force: true }));
+
+  it("extracts formats, integers, constraints, and inline objects from Zod v4 at runtime", async () => {
+    const file = path.join(root, "shared", "models", "probe-item.ts");
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    // startsWith() is outside the static subset, which forces runtime evaluation.
+    fs.writeFileSync(file, model("probe-item", [
+      "  userId: z.string().startsWith('u'),",
+      "  title: z.string().min(1).max(5),",
+      "  code: z.string().regex(/^a\\d$/i),",
+      "  tags: z.array(z.string().min(2)).min(1),",
+      "  score: z.number().gt(0).lte(1),",
+      "  edge: z.number().gt(0).min(0).lt(1).max(1),",
+      "  count: z.int(),",
+      "  publishedAt: z.iso.datetime().optional(),",
+      "  createdAt: z.string().optional(),",
+      "  nested: z.object({ x: z.string() }).optional(),",
+    ].join("\n")));
+
+    const info = await parseModelFile(file);
+    const field = (name: string) => info.fields.find((candidate) => candidate.name === name)!;
+    expect(info.parserMode).toBe("dynamic");
+    expect(field("userId").isForeignKey).toBeUndefined();
+    expect(field("title").constraints).toEqual({ minLength: 1, maxLength: 5 });
+    expect(field("code").constraints).toEqual({ pattern: "^a\\d$", patternFlags: "i" });
+    expect(field("tags")).toMatchObject({ isArray: true, constraints: { minLength: 2, minItems: 1 } });
+    expect(field("score").constraints).toEqual({ minimum: 0, exclusiveMinimum: true, maximum: 1 });
+    expect(field("edge").constraints).toEqual({ minimum: 0, exclusiveMinimum: true, maximum: 1, exclusiveMaximum: true });
+    expect(field("count").isInteger).toBe(true);
+    expect(field("publishedAt")).toMatchObject({ format: "date-time", isOptional: true });
+    expect(field("createdAt").format).toBeUndefined();
+    expect(field("nested")).toMatchObject({ type: "object", isOptional: true, objectFields: [expect.objectContaining({ name: "x", type: "string" })] });
+  });
+
+  it("extracts the same metadata from Zod v3 schemas", async () => {
+    const file = path.join(root, "shared", "models", "legacy-item.ts");
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, model("legacy-item", [
+      "  title: z.string().startsWith('t').min(2),",
+      "  score: z.number().int().positive(),",
+      "  publishedAt: z.string().datetime().optional(),",
+      "  kind: z.enum(['a', 'b']),",
+      "  nested: z.object({ x: z.string().max(3) }),",
+    ].join("\n")).replace("from 'zod/v4'", "from 'zod'"));
+
+    const info = await parseModelFile(file);
+    const field = (name: string) => info.fields.find((candidate) => candidate.name === name)!;
+    expect(info.parserMode).toBe("dynamic");
+    expect(field("title").constraints).toEqual({ minLength: 2 });
+    expect(field("score")).toMatchObject({ isInteger: true, constraints: { minimum: 0, exclusiveMinimum: true } });
+    expect(field("publishedAt").format).toBe("date-time");
+    expect(field("kind").enumValues).toEqual(["a", "b"]);
+    expect(field("nested").objectFields).toEqual([expect.objectContaining({ name: "x", constraints: { maxLength: 3 } })]);
+  });
+});
+
+describe("Python schema assets", () => {
+  let root: string;
+  const originalCwd = process.cwd();
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-python-schema-"));
+  });
+  afterEach(() => {
+    process.chdir(originalCwd);
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it("keeps declared types and constraints instead of guessing from names", async () => {
+    const file = path.join(root, "shared", "models", "probe-item.ts");
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, model("probe-item", [
+      "  title: z.string().min(1),",
+      "  code: z.string().regex(/^a\\d$/i).optional(),",
+      "  tags: z.array(z.string().min(2)).max(3),",
+      "  score: z.number().min(0).max(1),",
+      "  count: z.number().int(),",
+      "  publishedAt: z.iso.datetime().optional(),",
+      "  createdAt: z.string().optional(),",
+      "  nested: z.object({ x: z.string() }).optional(),",
+    ].join("\n")));
+    const info = await parseModelFile(file);
+    process.chdir(root);
+    await generateLanguageSchemaArtifacts([info], info, "functions", "python", new FileOperationSession("commit", root));
+    const modelsDir = path.join(root, "functions", "generated", "python-models", "backend_models", "models");
+    const source = fs.readFileSync(path.join(modelsDir, "probe_item.py"), "utf8");
+
+    expect(source).toContain("created_at: Optional[StrictStr] = Field(default=None, alias=\"createdAt\")");
+    expect(source).toContain("published_at: Optional[datetime] = Field(default=None, alias=\"publishedAt\")");
+    expect(source).toContain("title: StrictStr = Field(min_length=1)");
+    expect(source).toContain("tags: List[Annotated[StrictStr, Field(min_length=2)]] = Field(max_length=3)");
+    expect(source).toContain("score: Union[StrictFloat, StrictInt] = Field(ge=0, le=1)");
+    expect(source).toContain("count: StrictInt");
+    expect(source).toContain("nested: Optional[ProbeItemNested] = Field(default=None)");
+    expect(source).toContain('re.search("^a\\\\d$", item, re.IGNORECASE)');
+    expect(source).toContain("return self.model_dump_json(by_alias=True, exclude_none=True)");
+    expect(fs.readFileSync(path.join(modelsDir, "probe_item_nested.py"), "utf8")).toContain("class ProbeItemNested(BaseModel):");
+  });
+});
+
+describe("Python regex translation", () => {
+  it("translates JavaScript named groups and back-references", () => {
+    expect(toPythonRegex("^(?<code>[A-Z]+)-\\k<code>$")).toEqual({ pattern: "^(?P<code>[A-Z]+)-(?P=code)$" });
+    expect(toPythonRegex("^a\\d$", "i")).toEqual({ pattern: "^a\\d$" });
+  });
+
+  it.each([
+    ["\\p{L}+", "", /Unicode property/],
+    ["(?<=a)b", "", /lookbehind/],
+    ["[^]", "", /empty character classes/],
+    ["\\u{1F600}", "u", /flag\(s\) u|code point/],
+    ["abc", "y", /flag\(s\) y/],
+  ])("reports %s /%s as not enforceable", (pattern, flags, reason) => {
+    const result = toPythonRegex(pattern, flags);
+    expect("unsupported" in result && result.unsupported).toMatch(reason);
+  });
+
+  it("skips unenforceable patterns with a warning and validates raw strings before conversion", async () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-python-regex-"));
+    const originalCwd = process.cwd();
+    try {
+      const file = path.join(root, "shared", "models", "regex-item.ts");
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      fs.writeFileSync(file, model("regex-item", [
+        "  code: z.string().regex(/^(?<code>[A-Z]+)$/),",
+        "  letters: z.string().regex(/^\\p{L}+$/u),",
+        "  when: z.string().datetime().regex(/Z$/),",
+      ].join("\n")));
+      const info = await parseModelFile(file);
+      expect(getPythonRegexWarnings(info)).toEqual([
+        expect.stringMatching(/^python-regex-not-enforced: RegexItem\.letters uses Unicode property escapes/),
+      ]);
+      process.chdir(root);
+      const session = new FileOperationSession("commit", root);
+      await generateLanguageSchemaArtifacts([info], info, "functions", "python", session);
+      expect(session.warnings).toEqual(getPythonRegexWarnings(info));
+      const source = fs.readFileSync(path.join(root, "functions", "generated", "python-models", "backend_models", "models", "regex_item.py"), "utf8");
+      expect(source).toContain('re.search("^(?P<code>[A-Z]+)$", item, 0)');
+      expect(source).not.toContain("letters_validate_pattern");
+      expect(source).toContain("@field_validator('when', mode='before')");
+      expect(source).toContain("if isinstance(item, str) and not re.search");
+    } finally {
+      process.chdir(originalCwd);
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+});
+
+const pydanticPython = ["python", "python3"].find((command) => spawnSync(command, ["-c", "import pydantic"], { stdio: "ignore" }).status === 0);
+const itWithPydantic = pydanticPython ? it : it.skip;
+
+describe("generated Python model runtime", () => {
+  itWithPydantic("accepts valid regex and timestamp values and rejects invalid ones", async () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-python-runtime-"));
+    const originalCwd = process.cwd();
+    try {
+      const file = path.join(root, "shared", "models", "regex-item.ts");
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      fs.writeFileSync(file, model("regex-item", [
+        "  code: z.string().regex(/^(?<code>[A-Z]+)$/),",
+        "  when: z.iso.datetime().regex(/Z$/),",
+        "  tags: z.array(z.string().regex(/^t/)),",
+      ].join("\n")));
+      const info = await parseModelFile(file);
+      process.chdir(root);
+      await generateLanguageSchemaArtifacts([info], info, "functions", "python", new FileOperationSession("commit", root));
+      process.chdir(originalCwd);
+      const script = [
+        "import sys",
+        "sys.path.insert(0, 'generated/python-models')",
+        "from backend_models.models.regex_item import RegexItem",
+        "ok = {'id': '1', 'code': 'ABC', 'when': '2024-05-06T07:08:09Z', 'tags': ['t1']}",
+        "RegexItem.from_dict(ok)",
+        "for bad in ({**ok, 'code': 'abc'}, {**ok, 'when': '2024-05-06T07:08:09+09:00'}, {**ok, 'tags': ['x']}):",
+        "    try:",
+        "        RegexItem.from_dict(bad)",
+        "    except ValueError:",
+        "        continue",
+        "    raise SystemExit('accepted ' + repr(bad))",
+        "print('ok')",
+      ].join("\n");
+      const run = spawnSync(pydanticPython!, ["-c", script], { cwd: path.join(root, "functions"), encoding: "utf8" });
+      if (run.status !== 0) throw new Error(`${run.stdout}\n${run.stderr}`);
+      expect(run.stdout.trim()).toBe("ok");
+    } finally {
+      process.chdir(originalCwd);
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  }, 60000);
+});
+
+describe("user-scoped data warning", () => {
+  const info = (partitionKey: string, fields: string[]) => ({
+    name: "ProbeItem",
+    partitionKey,
+    fields: fields.map((name) => ({ name, type: "string", isOptional: false, isArray: false })),
+  }) as unknown as Parameters<typeof buildUserScopedDataWarning>[0];
+
+  it("warns when the partition key is a per-user id and auth is not configured", () => {
+    expect(buildUserScopedDataWarning(info("/userId", ["id", "userId"]), undefined))
+      .toMatch(/^user-scoped-data-without-auth: ProbeItem\.userId is the partition key and looks like a per-user owner id/);
+    expect(buildUserScopedDataWarning(info("/userId", ["id", "userId"]), { provider: "none" })).toBeDefined();
+  });
+
+  it("warns for owner-like fields that are not the partition key", () => {
+    expect(buildUserScopedDataWarning(info("/id", ["id", "learnerId"]), undefined))
+      .toMatch(/ProbeItem\.learnerId looks like a per-user owner id/);
+  });
+
+  it("stays quiet when authentication is configured or nothing looks user-scoped", () => {
+    expect(buildUserScopedDataWarning(info("/userId", ["id", "userId"]), { provider: "swa" })).toBeUndefined();
+    expect(buildUserScopedDataWarning(info("/userId", ["id", "userId"]), { schemes: { admin: { provider: "swa" } } } as never)).toBeUndefined();
+    expect(buildUserScopedDataWarning(info("/tenantId", ["id", "tenantId", "categoryId"]), undefined)).toBeUndefined();
+  });
+});

package/src/cli/commands/add-auth.ts

@@ -428,7 +428,7 @@ export async function addAuthCommand(options: AddAuthOptions) {
 
   // 10. Install dependencies
   console.log("\n Installing auth dependencies...");
-  await installAuthDependencies(cwd, backendLanguage, rdbProvider, session);
+  installAuthDependenciesSync(cwd, backendLanguage, rdbProvider, session);
   await finalize();
 
   console.log("\n Authentication setup complete!");
@@ -458,7 +458,8 @@ function findObjectEnd(content: string, open: number): number {
 function updateConfigWithNamedScheme(cwd: string, scheme: string, provider: AuthProvider, session: FileOperationSession, allowedProviders?: string[]): void {
   const jsPath = path.join(cwd, "swallowkit.config.js");
   const jsonPath = path.join(cwd, "swallowkit.config.json");
-  const configPath = session.fileExists(jsPath) ? jsPath : jsonPath;
+  // Match loadConfig precedence: swallowkit.config.json wins when both files exist.
+  const configPath = session.fileExists(jsonPath) ? jsonPath : jsPath;
   if (!session.fileExists(configPath)) throw new Error("swallowkit.config.js or swallowkit.config.json is required");
   const swaProviders = provider === "swa" ? normalizeSwaProviders(allowedProviders) : undefined;
   if (configPath.endsWith(".json")) {
@@ -510,6 +511,11 @@ function addNamedScheme(cwd: string, scheme: string, provider: AuthProvider, lan
   // Validate/update config before creating files, so duplicate names stop safely.
   updateConfigWithNamedScheme(cwd, scheme, provider, session, allowedProviders);
   const slug = scheme.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").toLowerCase();
+  if (provider === "custom-jwt") {
+    // The scheme's JWT helper needs the same token/password/driver packages as single-provider custom-jwt.
+    const connector = getConnectorDefinition(defaultCustomJwtConfig().userConnector) as RdbConnectorConfig | undefined;
+    installAuthDependenciesSync(cwd, language, connector?.provider ?? "mysql", session);
+  }
   if (language === "typescript") {
     const dir = path.join(cwd, "functions", "src", "auth", "schemes", slug);
     if (provider === "external-token") writeIfMissing(session, path.join(dir, "verifier.ts"), generateExternalTokenVerifierTS());
@@ -689,9 +695,14 @@ function generateFunctionsAuth(
     const functionAppPath = path.join(functionsDir, "function_app.py");
     if (session.fileExists(functionAppPath)) {
       const content = session.readFile(functionAppPath);
-      const authImport = "from blueprints.auth import bp as auth_bp";
+      const authImport = "from blueprints.auth import auth_bp";
       const authRegister = "app.register_blueprint(auth_bp)";
-      if (!content.includes(authImport)) {
+      // Earlier releases imported a non-existent `bp`; repair it in place when re-running.
+      const legacyImport = "from blueprints.auth import bp as auth_bp";
+      if (content.includes(legacyImport)) {
+        session.writeFile(functionAppPath, content.replace(legacyImport, authImport), extensionMeta);
+        console.log(` Updated: functions/function_app.py (fixed auth blueprint import)`);
+      } else if (!content.includes(authImport)) {
         const marker = "# SwallowKit scaffold registrations";
         if (content.includes(marker)) {
           const updated = content.replace(
@@ -742,6 +753,24 @@ function generateBFFAuth(cwd: string, projectName: string, sharedPackageName: st
 }
 
 function updateConfigWithAuth(cwd: string, provider: AuthProvider, config: CustomJwtConfig, session: FileOperationSession, allowedProviders?: string[]): void {
+  const jsonPath = path.join(cwd, "swallowkit.config.json");
+  if (session.fileExists(jsonPath)) {
+    // loadConfig reads swallowkit.config.json first, so it is the effective configuration.
+    const value = JSON.parse(session.readFile(jsonPath));
+    if (value.auth) {
+      console.log("  'auth' section already exists in swallowkit.config.json");
+      return;
+    }
+    value.auth = {
+      provider,
+      ...(provider === "custom-jwt" ? { customJwt: { ...config, jwtSecretEnv: config.jwtSecretEnv || "JWT_SECRET", tokenExpiry: config.tokenExpiry || "24h" } } : {}),
+      ...(provider === "swa" ? { swa: { allowedProviders: normalizeSwaProviders(allowedProviders), roleSource: "swa-roles" } } : {}),
+      authorization: { defaultPolicy: provider === "none" ? "anonymous" : "authenticated" },
+    };
+    session.writeFile(jsonPath, JSON.stringify(value, null, 2) + "\n", extensionMeta);
+    console.log(` Updated: swallowkit.config.json`);
+    return;
+  }
   const configPath = path.join(cwd, "swallowkit.config.js");
   if (!session.fileExists(configPath)) {
     console.warn("  swallowkit.config.js not found. Please add auth config manually.");
@@ -786,7 +815,8 @@ function updateConfigWithAuth(cwd: string, provider: AuthProvider, config: Custo
     provider: '${provider}',
 ${providerSettings}
     authorization: {
-      defaultPolicy: 'authenticated',
+      // Disabled auth has no scheme to authenticate against; 'authenticated' would fail validateConfig.
+      defaultPolicy: '${provider === "none" ? "anonymous" : "authenticated"}',
     },
   },
 `;
@@ -821,7 +851,7 @@ function updateEnvironmentFiles(cwd: string, session: FileOperationSession): voi
   }
 }
 
-async function installAuthDependencies(cwd: string, backendLanguage: BackendLanguage, provider: "mysql" | "postgres" | "sqlserver" = "mysql", session: FileOperationSession): Promise<void> {
+function installAuthDependenciesSync(cwd: string, backendLanguage: BackendLanguage, provider: "mysql" | "postgres" | "sqlserver" = "mysql", session: FileOperationSession): void {
   if (backendLanguage === "typescript") {
     const funcPkgPath = path.join(cwd, "functions", "package.json");
     if (session.fileExists(funcPkgPath)) {