swallowkit 2.0.0-alpha.3 → 2.0.0-alpha.5

package/src/core/project/boundaries.ts

@@ -10,7 +10,9 @@
  * - shared:        マーカー区切りの共有領域。マーカー内は SwallowKit、外は自由。
  */
 
+import { getBackendLanguage } from "../config";
 import { ArtifactOwnership } from "../operations/file-session";
+import { BackendLanguage } from "../../types";
 import { inspectArtifacts } from "./artifacts";
 
 export type BoundaryZone = "deterministic" | "ai-authored" | "shared";
@@ -48,6 +50,8 @@ export interface BoundaryArtifact {
 export interface BoundariesContract {
   contractVersion: number;
   summary: string;
+  /** backend.language the convention rules were resolved for */
+  backendLanguage: BackendLanguage;
   ownershipPolicies: OwnershipPolicy[];
   /** 台帳に載っていないパスの既定規約 */
   conventionRules: BoundaryPathRule[];
@@ -82,7 +86,7 @@ export const OWNERSHIP_POLICIES: OwnershipPolicy[] = [
     zone: "shared",
     editPolicy: "edit-outside-markers",
     howToChange:
-      "SwallowKit appends only inside marked sections (e.g. `# SwallowKit scaffold registrations`). Edit anywhere outside the markers freely; do not remove the markers.",
+      "SwallowKit appends at the file-specific extension point: marked sections (e.g. `# SwallowKit scaffold registrations`) or append-only files such as shared/index.ts. Follow the path rule; preserve existing generated entries and any markers.",
   },
   {
     ownership: "metadata",
@@ -92,7 +96,7 @@ export const OWNERSHIP_POLICIES: OwnershipPolicy[] = [
   },
 ];
 
-export const CONVENTION_RULES: BoundaryPathRule[] = [
+const COMMON_LEADING_RULES: BoundaryPathRule[] = [
   {
     pattern: ".swallowkit/",
     zone: "deterministic",
@@ -107,32 +111,66 @@ export const CONVENTION_RULES: BoundaryPathRule[] = [
       "Zod model schemas — the single source of truth. AI/developers author these freely; deterministic generation derives everything else from them.",
   },
   {
-    pattern: "infra/main.bicep",
-    zone: "shared",
-    editPolicy: "edit-outside-markers",
-    description: "SwallowKit inserts container modules; other infrastructure edits are free.",
+    pattern: "infra/migrations/manifest.json",
+    zone: "deterministic",
+    editPolicy: "never-hand-edit",
+    description:
+      "Infrastructure migration ledger with baseline checksums. Updated by scaffold, `swallowkit migrations add-model`, and `swallowkit create-migration`.",
   },
   {
-    pattern: "functions/function_app.py",
-    zone: "shared",
-    editPolicy: "edit-outside-markers",
-    description: "SwallowKit appends blueprint registrations under its marker; other edits are free.",
+    pattern: "infra/migrations/",
+    zone: "ai-authored",
+    editPolicy: "free-edit",
+    description:
+      "Versioned Bicep migrations. Edit a migration only before it is provisioned; never change an applied migration — add a new one with `swallowkit create-migration <slug>`.",
   },
   {
-    pattern: "shared/index.ts",
-    zone: "shared",
-    editPolicy: "edit-outside-markers",
-    description: "SwallowKit appends model exports; other exports may be added freely.",
+    pattern: "infra/",
+    zone: "deterministic",
+    editPolicy: "never-hand-edit",
+    description:
+      "Baseline infrastructure (main.bicep and modules) whose checksums are recorded in infra/migrations/manifest.json. Hand edits block scaffold with baseline-drift; add resources through a new migration instead.",
   },
   {
-    pattern: "*",
-    zone: "ai-authored",
+    pattern: "shared/index.ts",
+    zone: "shared",
     editPolicy: "free-edit",
-    description:
-      "Any path not recorded in the artifact ledger is AI/developer-authored. Business logic, custom pages, custom Functions, and tests belong here.",
+    description: "create-model and scaffold append missing model exports while preserving existing content. No managed markers; manual exports are allowed. Keep exports needed by generated code.",
   },
 ];
 
+/** Backend files that SwallowKit appends to; C# and TypeScript discover functions without a registration file. */
+const BACKEND_EXTENSION_RULES: Record<BackendLanguage, BoundaryPathRule[]> = {
+  python: [
+    {
+      pattern: "functions/function_app.py",
+      zone: "shared",
+      editPolicy: "edit-outside-markers",
+      description: "SwallowKit appends blueprint registrations under its marker; other edits are free.",
+    },
+    {
+      pattern: "functions/requirements.txt",
+      zone: "shared",
+      editPolicy: "free-edit",
+      description: "SwallowKit appends connector driver requirements when connector models are scaffolded; keep those lines and edit other requirements freely.",
+    },
+  ],
+  csharp: [],
+  typescript: [],
+};
+
+const FALLBACK_RULE: BoundaryPathRule = {
+  pattern: "*",
+  zone: "ai-authored",
+  editPolicy: "free-edit",
+  description:
+    "Any path not recorded in the artifact ledger is AI/developer-authored. Business logic, custom pages, custom Functions, and tests belong here.",
+};
+
+export function buildConventionRules(backendLanguage: BackendLanguage): BoundaryPathRule[] {
+  return [...COMMON_LEADING_RULES, ...BACKEND_EXTENSION_RULES[backendLanguage], FALLBACK_RULE];
+}
+
 const POLICY_BY_OWNERSHIP = new Map(OWNERSHIP_POLICIES.map((policy) => [policy.ownership, policy] as const));
 
 export const BOUNDARY_GUIDANCE: string[] = [
@@ -143,7 +181,10 @@ export const BOUNDARY_GUIDANCE: string[] = [
   "Run `swallowkit machine verify project` after applying changes; use `explain failure` to get repair evidence.",
 ];
 
-export function inspectBoundaries(projectRoot: string = process.cwd()): BoundariesContract {
+export function inspectBoundaries(
+  projectRoot: string = process.cwd(),
+  backendLanguage: BackendLanguage = getBackendLanguage()
+): BoundariesContract {
   const inspected = inspectArtifacts(projectRoot);
 
   const artifacts: BoundaryArtifact[] = inspected.artifacts.map((artifact) => {
@@ -162,8 +203,9 @@ export function inspectBoundaries(projectRoot: string = process.cwd()): Boundari
     contractVersion: 1,
     summary:
       "SwallowKit separates deterministic generation (models → CRUD/BFF/UI/infra via plan/apply) from AI free-form authoring (models, business logic, custom code). This contract tells agents which files belong to which side.",
+    backendLanguage,
     ownershipPolicies: OWNERSHIP_POLICIES,
-    conventionRules: CONVENTION_RULES,
+    conventionRules: buildConventionRules(backendLanguage),
     artifacts,
     guidance: BOUNDARY_GUIDANCE,
   };

package/src/core/project/capabilities.ts

@@ -53,6 +53,7 @@ export interface CapabilitiesContract {
   sharedModels: {
     idFieldRule: string;
     buildNote: string;
+    nativeSchemaMapping: string[];
   };
   seeding: {
     createTemplates: string;
@@ -64,6 +65,7 @@ export interface CapabilitiesContract {
     defaultChecks: string[];
     optInChecks: string[];
     customChecks: string;
+    backendBuild: string;
   };
 }
 
@@ -108,6 +110,19 @@ export function inspectCapabilities(): CapabilitiesContract {
           "Role-based access control metadata applied to the generated CRUD Functions. `roles` guards all operations; `read`/`write` guard per-operation; `policy` references a named authorization policy from swallowkit.config auth.authorization.policies.",
         format:
           "export const authPolicy = { roles: ['admin'] };\n// or per-operation:\nexport const authPolicy = { read: ['user'], write: ['admin'] };\n// or a named policy:\nexport const authPolicy = { policy: 'adminOnly' };",
+        notes: [
+          "An explicit authPolicy without configured authentication blocks plan/apply/generate scaffold with auth-policy-without-auth before any artifacts are written. Run plan auth, apply auth, then re-plan scaffold. An empty {} declaration keeps the existing behavior: no explicit policy.",
+          "With named auth.schemes, define auth.authorization.policies selecting schemes and roles, then reference them via policy or read/write names. A role-only declaration cannot select a named scheme and blocks with auth-policy-requires-named-policy; it is supported by legacy single-provider authentication.",
+          "Conversely, single-provider authentication (auth.provider) supports role lists only. Referencing a named policy (authPolicy.policy, read/write names, or a named auth.authorization.defaultPolicy) blocks with auth-named-policy-requires-named-scheme; add a named scheme first.",
+        ],
+      },
+      {
+        name: "references",
+        required: false,
+        description:
+          "Explicit foreign keys used by generated UI lookups. Without it, a string field named <model>Id is treated as a foreign key only when shared/models contains that model (userId -> User only if user.ts exists). Map a field to false to disable inference. References to missing models are ignored with a reference-model-not-found warning.",
+        format: "export const references = { authorId: 'User', legacyId: false };",
+        notes: ["Only single string id fields can reference a model.", "No lookup UI, fetch, or OpenAPI reference is generated for fields that do not reference an existing model."],
       },
       {
         name: "connectorConfig",
@@ -174,15 +189,24 @@ export function inspectCapabilities(): CapabilitiesContract {
       ],
       notGuaranteed: [
         "Owner scoping: generated CRUD does NOT restrict rows to the authenticated principal. Any authenticated caller passing the policy can read/write any document.",
+        "Without authentication, plan scaffold reports user-scoped-data-without-auth when the partition key or an owner-like field (userId, learnerId, ownerId, ...) suggests per-user data.",
       ],
       guidance: [
-        "For multi-user data where users may only touch their own records, add ai-authored custom endpoints that derive the scoping key (e.g. learnerId) from the verified principal — never from the request body — and restrict generated write endpoints to admin roles or disable them.",
+        "Configure authentication via plan/apply auth before declaring authPolicy. For multi-user data where users may only touch their own records, add ai-authored custom endpoints that derive the scoping key (e.g. learnerId) from the verified principal — never from the request body — and restrict generated write endpoints to admin roles or disable them.",
       ],
     },
     sharedModels: {
       idFieldRule: "id: z.string() (required). createdAt/updatedAt: z.string().optional(). The backend owns their values.",
+      nativeSchemaMapping: [
+        "C#/Python schema assets derive types from Zod, never from field names: z.string() -> string/str (including createdAt/updatedAt).",
+        "Date types only when declared: z.iso.datetime() -> DateTime/datetime, z.iso.date() -> DateOnly/date, z.date() -> DateTime/datetime.",
+        "z.number() -> double / float|int; z.number().int() or z.int() -> long / int.",
+        "Inline z.object({...}) fields become named classes <Model><Field> (e.g. ProbeItemNested); imported model schemas keep their own class.",
+        "min/max/length/nonempty/regex/int/gt/gte/lt/lte/positive/nonnegative and array min/max are enforced by C# IValidatableObject.Validate and Python Field bounds/validators. Regexes use search semantics like Zod.",
+        "String formats (email/uuid/url), refinements, and transforms are not re-implemented natively; the BFF Zod schemas remain the authoritative validation.",
+      ],
       buildNote:
-        "verify typecheck resolves the shared package from its built dist/. SwallowKit rebuilds shared automatically during verify; when typechecking manually, build the shared package first (errors like \"no exported member\" usually mean a stale dist).",
+        "create-model and plan/apply scaffold append missing model exports to shared/index.ts, including manually authored models. Manual exports are allowed (no markers); existing content is preserved. verify typecheck resolves the shared package from its built dist/. SwallowKit rebuilds shared automatically during verify; when typechecking manually, build shared first.",
     },
     seeding: {
       createTemplates: "swallowkit create-dev-seeds <environment> — writes dev-seeds/<environment>/<model>.json templates.",
@@ -193,15 +217,18 @@ export function inspectCapabilities(): CapabilitiesContract {
       "inspect project | entities | routes | artifacts | boundaries | infra | drift | capabilities",
       "validate project",
       "generate model <names...> | generate scaffold <model>",
-      "plan scaffold <models...> | plan auth --provider <p> [--scheme <name>] [--allowed-providers <csv>] | plan provision -g <rg> --location <loc> --swa-location <loc> [--adopt-existing --baseline 0 --what-if] [--reconcile --what-if]",
-      "apply scaffold [models...] --plan <id> [--approve] | apply auth --plan <id> [--approve] | apply provision --plan <id> --approve",
+      "plan scaffold <models...> [--api-only] [--skip-infra] | plan auth --provider <p> [--scheme <name>] [--allowed-providers <csv>] | plan provision -g <rg> --location <loc> --swa-location <loc> [--adopt-existing --baseline 0 --what-if] [--reconcile --what-if]",
+      "apply scaffold [models...] --plan <id> [--approve] [--skip-infra] | apply auth --plan <id> [--approve] | apply provision --plan <id> --approve",
       "verify project [--checks <ids>] [--compact]",
       "explain failure [--check <id>]",
+      "(regular CLI) migrations add-model <model> [--dry-run] — generate only the container migration after scaffold --skip-infra",
+      "(regular CLI) configure-mcp [--version auto|latest|<semver>] — re-select the MCP launcher version in .mcp.json",
     ],
     verifyChecks: {
-      defaultChecks: ["structure", "drift", "typecheck"],
+      defaultChecks: ["structure", "drift", "typecheck", "backend-build"],
       optInChecks: ["build", "lint", "test"],
       customChecks: "swallowkit.config verify.checks: [{ id, command, title?, timeoutMs? }]",
+      backendBuild: "Runs dotnet build in functions/ (C#), the project tsc --noEmit (TypeScript), or Python 3 compileall (syntax only, using functions/.venv before PATH). Missing toolchains are skip with a reason, not proof of validation. Root build scripts do not replace backend-build; use --checks \"structure,drift,typecheck,backend-build,build\" for both.",
     },
   };
 }

package/src/core/project/mcp-config.ts

@@ -0,0 +1,84 @@
+/**
+ * Project-scoped MCP launcher version management.
+ *
+ * `.mcp.json` intentionally resolves `swallowkit@latest` so that projects created
+ * with older releases still get the current stable tools. A prerelease project can
+ * be newer than `latest`; in that case the launcher is pinned to the project
+ * version until a stable release that understands project-aware delegation catches up.
+ */
+
+import { spawnSync } from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { compareSemver, isPrerelease, parseSemver } from "../../utils/semver";
+
+export const MCP_CONFIG_PATH = ".mcp.json";
+export const MCP_VERSION_ENV = "SWALLOWKIT_MCP_VERSION";
+export const MCP_LATEST = "latest";
+
+export interface McpPinDecision {
+  version: string;
+  reason: string;
+}
+
+/**
+ * Decide the SWALLOWKIT_MCP_VERSION value for a project that uses `projectVersion`.
+ * Uses `latest` unless the project version is newer than the published `latest`.
+ * When the registry could not be reached, prereleases are pinned conservatively.
+ */
+export function resolveMcpPinVersion(projectVersion: string, publishedLatest: string | null): McpPinDecision {
+  if (!parseSemver(projectVersion)) {
+    return { version: MCP_LATEST, reason: `Project version ${projectVersion} is not a valid semantic version.` };
+  }
+  if (publishedLatest && parseSemver(publishedLatest)) {
+    const comparison = compareSemver(projectVersion, publishedLatest)!;
+    return comparison > 0
+      ? { version: projectVersion, reason: `Project version ${projectVersion} is newer than published latest ${publishedLatest}.` }
+      : { version: MCP_LATEST, reason: `Published latest ${publishedLatest} is the same as or newer than project version ${projectVersion}.` };
+  }
+  return isPrerelease(projectVersion)
+    ? { version: projectVersion, reason: `Published latest is unknown; prerelease ${projectVersion} is pinned so MCP matches the project.` }
+    : { version: MCP_LATEST, reason: "Published latest is unknown; stable projects keep latest." };
+}
+
+export function lookupPublishedLatestVersion(packageName: string, timeoutMs = 15000): string | null {
+  // Run outside the project so its devEngines/packageManager policy does not reject npm.
+  const result = spawnSync("npm", ["view", `${packageName}@latest`, "version"], {
+    cwd: os.tmpdir(),
+    encoding: "utf8",
+    timeout: timeoutMs,
+    shell: process.platform === "win32",
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+  if (result.error || result.status !== 0) return null;
+  const version = String(result.stdout).trim().split(/\s+/).pop() ?? "";
+  return parseSemver(version) ? version : null;
+}
+
+export function readMcpConfigVersion(projectDir: string): string | null {
+  const configPath = path.join(projectDir, MCP_CONFIG_PATH);
+  if (!fs.existsSync(configPath)) return null;
+  try {
+    const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
+    const value = config?.mcpServers?.swallowkit?.env?.[MCP_VERSION_ENV];
+    return typeof value === "string" ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Update only the SwallowKit MCP version in .mcp.json, preserving all other content. */
+export function writeMcpConfigVersion(projectDir: string, version: string): void {
+  const configPath = path.join(projectDir, MCP_CONFIG_PATH);
+  if (!fs.existsSync(configPath)) {
+    throw new Error(`${MCP_CONFIG_PATH} was not found. Run this command from a SwallowKit project root.`);
+  }
+  const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
+  const server = config?.mcpServers?.swallowkit;
+  if (!server || typeof server !== "object") {
+    throw new Error(`${MCP_CONFIG_PATH} does not define mcpServers.swallowkit.`);
+  }
+  server.env = { ...(server.env ?? {}), [MCP_VERSION_ENV]: version };
+  fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
+}

package/src/core/project/react-project.ts

@@ -407,7 +407,7 @@ live in \`functions/local.settings.json\`. Keep their secrets out of source cont
 \`\`\`sh
 ${pm} run build
 ${cmd.exec} swallowkit machine verify project
-${cmd.exec} swallowkit machine verify project --checks structure,drift,typecheck,build
+${cmd.exec} swallowkit machine verify project --checks "structure,drift,typecheck,backend-build,build"
 \`\`\`
 
 The build compiles shared schemas, checks the SPA, builds static assets, and

package/src/core/project/workflows.ts

@@ -52,9 +52,23 @@ Goal: add a data model and derive CRUD/BFF/UI/infra deterministically.
 1. Create the model file (deterministic template):
    \`${runCmd} swallowkit machine generate model <name> --overwrite never\`
 2. Edit \`shared/models/<name>.ts\` — add domain fields (free-form authoring).
+   - Native C#/Python types follow Zod, not names: \`z.iso.datetime()\` for dates, \`z.number().int()\` for integers.
+   - \`<model>Id\` fields reference a model only when it exists in \`shared/models\`; otherwise declare
+     \`export const references = { fieldId: 'Model' }\` (or \`false\` to opt out).
 3. Compute the change plan (writes nothing):
    \`${runCmd} swallowkit machine plan scaffold <name>\`
    - \`status: "requires-human"\` → review \`data.conflicts\`; only proceed with \`--approve\` if overwriting is intended.
+   - Must not change Bicep/infrastructure? Add \`--skip-infra\` to plan and apply. Nothing under \`infra/\` changes and
+     the plan warns \`infra-skipped\`; later run \`${runCmd} swallowkit migrations add-model <name>\` to add only the container migration.
+   - Read \`data.warnings\`. \`user-scoped-data-without-auth\` means generated CRUD would expose every user's documents;
+     add auth (\`swallowkit-add-auth\`) and owner-scoped ai-authored endpoints before exposing the model.
+   - \`auth-policy-without-auth\` blocks generation before file writes: configure authentication with plan/apply auth,
+     then re-plan. Do not remove a required policy to bypass this prerequisite.
+     For named \`auth.schemes\`, define named authorization policies selecting schemes/roles and reference them from
+     \`authPolicy.policy\` or read/write names; role-only declarations block with \`auth-policy-requires-named-policy\`.
+     Single-provider \`auth.provider\` supports role lists only; named policies block with \`auth-named-policy-requires-named-scheme\`.
+   - Scaffold appends missing exports to \`shared/index.ts\` for hand-authored models too.
+     Manual exports are allowed; no managed markers exist in that file.
 4. Apply:
    \`${runCmd} swallowkit machine apply scaffold --plan <planId>\`
 5. Verify:
@@ -153,7 +167,7 @@ the scoping key from the verified principal, never from the request body.
     title: "Verify and repair loop",
     skillName: "swallowkit-verify-repair",
     skillDescription:
-      "Converge a SwallowKit project to a verified state: run structure/drift/typecheck (and build/lint/test) checks, read evidence with explain failure, repair, and repeat. Use after any code or schema change, when verification fails, when the build/lint/tests are broken, or before finishing a task.",
+      "Converge a SwallowKit project to a verified state: run structure/drift/typecheck/backend-build (and build/lint/test) checks, read evidence with explain failure, repair, and repeat. Use after any code or schema change, when verification fails, when the build/lint/tests are broken, or before finishing a task.",
     content: `# Workflow: Verify and repair
 
 Goal: converge the project to a verified state after any change.
@@ -161,14 +175,16 @@ Goal: converge the project to a verified state after any change.
 ## Loop
 
 1. \`${runCmd} swallowkit machine verify project\`
-   - default checks: structure, drift, typecheck (+ project-specific checks from swallowkit.config \`verify.checks\`)
-   - opt-in heavier checks: \`--checks structure,drift,typecheck,build,lint,test\`
+   - default checks: structure, drift, typecheck, backend-build (+ project-specific checks from swallowkit.config \`verify.checks\`)
+   - backend-build: standalone C# \`dotnet build\`, TypeScript \`tsc --noEmit\`, Python 3 \`compileall\` (syntax only).
+     Missing toolchains are skipped with a reason, not proof of a working backend. Restore them and re-run.
+   - opt-in heavier checks: \`--checks "structure,drift,typecheck,backend-build,build,lint,test"\` (quote CSV in PowerShell)
 2. If \`summary.done\` is false:
    - \`${runCmd} swallowkit machine explain failure\` → evidence (logTail, findings, violations) and suggestedActions per check.
    - Repair:
      - \`drift\` failures → follow each finding's \`repairAction\` (usually re-run plan/apply scaffold).
      - \`structure\` failures → follow \`suggestedFix\` per violation.
-     - \`typecheck\`/\`build\`/\`lint\`/\`test\` failures → fix the code in ai-authored files.
+     - \`typecheck\`/\`backend-build\`/\`build\`/\`lint\`/\`test\` failures → fix the source code, not generated artifacts.
 3. Repeat until \`summary.done: true\`.
 
 ## Exit criteria
@@ -247,7 +263,9 @@ under \`.github/skills/\` so skills-aware agents load them automatically.
 
 - **ai-authored** (write freely): \`shared/models/\`, business logic, custom pages/components, tests.
 - **deterministic** (never hand-edit): artifacts generated by SwallowKit (see \`.swallowkit/artifacts.json\`) and \`.swallowkit/\` metadata. Change models/config and regenerate via plan/apply.
-- **shared** (edit outside markers): \`infra/main.bicep\`, \`functions/function_app.py\`, \`shared/index.ts\`.
+- **shared**: \`shared/index.ts\` allows manual exports (no markers; SwallowKit appends missing entries).
+  For Python \`functions/function_app.py\`, edit outside the registration marker.
+- **infrastructure**: baseline \`infra/\` files are checksum-locked by \`infra/migrations/manifest.json\`; add resources as new migrations (\`swallowkit create-migration <slug>\`, \`swallowkit migrations add-model <model>\`).
 
 Full machine-readable contract: \`${runCmd} swallowkit machine inspect boundaries\`
 `,

package/src/core/scaffold/auth-generator.ts

@@ -117,8 +117,7 @@ export function generateNamedAuthRouterCSharp(config: NormalizedAuthConfig): str
 using System.Text;
 using System.Text.Json;
 using Microsoft.Azure.Functions.Worker.Http;
-using Functions.Auth.Schemes;
-namespace Functions.Auth;
+${externalCases ? "using Functions.Auth.Schemes;\n" : ""}namespace Functions.Auth;
 public record AuthPrincipal(string Subject, string Scheme, string Issuer, string[] Roles, IReadOnlyDictionary<string, object?> Claims)
 {
     [Obsolete("Use Subject")] public string UserId => Subject;
@@ -171,15 +170,15 @@ ${externalCases}
 export function generateNamedAuthRouterPython(config: NormalizedAuthConfig): string {
   const external = Object.entries(config.schemes).filter(([,s])=>s.provider === "external-token");
   const imports = external.map(([n])=>`from auth.schemes.${schemeSlug(n).replace(/-/g,"_")}.verifier import verify_external_token as verify_${safeIdentifier(n)}, ExternalTokenVerificationError as Error_${safeIdentifier(n)}`).join("\n");
-  const cases = external.map(([n], index)=>`        ${index === 0 ? "if" : "elif"} scheme == ${JSON.stringify(n)}:
-            try:
-                value = verify_${safeIdentifier(n)}(bearer)
-            except Error_${safeIdentifier(n)} as exc:
-                raise AuthError(503 if exc.identity_provider_unavailable else 401, "Identity provider unavailable" if exc.identity_provider_unavailable else "Invalid token")
-            except Exception:
-                raise AuthError(503, "External token verifier unavailable")
-            if not value.get("subject") or not isinstance(value.get("roles"), list): raise AuthError(401, "Invalid external principal")
-            principal = {"subject": value["subject"], "scheme": scheme, "issuer": value.get("issuer", scheme), "roles": value["roles"], "claims": value.get("claims", {}), "userId": value["subject"]}`).join("\n");
+  const cases = external.map(([n], index)=>`    ${index === 0 ? "if" : "elif"} scheme == ${JSON.stringify(n)}:
+        try:
+            value = verify_${safeIdentifier(n)}(bearer)
+        except Error_${safeIdentifier(n)} as exc:
+            raise AuthError(503 if exc.identity_provider_unavailable else 401, "Identity provider unavailable" if exc.identity_provider_unavailable else "Invalid token")
+        except Exception:
+            raise AuthError(503, "External token verifier unavailable")
+        if not value.get("subject") or not isinstance(value.get("roles"), list): raise AuthError(401, "Invalid external principal")
+        principal = {"subject": value["subject"], "scheme": scheme, "issuer": value.get("issuer", scheme), "roles": value["roles"], "claims": value.get("claims", {}), "userId": value["subject"]}`).join("\n");
   return `import base64
 import json
 import azure.functions as func
@@ -199,14 +198,14 @@ def require_auth(req: func.HttpRequest, policy_name: str):
     if len(candidates) != 1: raise AuthError(401, "Authentication required" if not candidates else "Ambiguous credentials")
     scheme = candidates[0]
 ${cases}
-        ${external.length ? "elif" : "if"} PROVIDERS[scheme] == "swa":
-            try:
-                value=json.loads(base64.b64decode(swa).decode("utf-8")); roles=[r for r in value.get("userRoles",[]) if isinstance(r,str)]
-                if not value.get("userId") or "authenticated" not in roles: raise ValueError()
-                if ALLOWED_PROVIDERS[scheme] and value.get("identityProvider") not in ALLOWED_PROVIDERS[scheme]: raise ValueError()
-                principal={"subject":value["userId"],"scheme":scheme,"issuer":"swa:"+value.get("identityProvider", "unknown"),"roles":roles,"claims":value,"userId":value["userId"]}
-            except Exception: raise AuthError(401,"Invalid SWA client principal")
-        else: raise AuthError(401,"Authentication adapter is not configured")
+    ${external.length ? "elif" : "if"} PROVIDERS[scheme] == "swa":
+        try:
+            value=json.loads(base64.b64decode(swa).decode("utf-8")); roles=[r for r in value.get("userRoles",[]) if isinstance(r,str)]
+            if not value.get("userId") or "authenticated" not in roles: raise ValueError()
+            if ALLOWED_PROVIDERS[scheme] and value.get("identityProvider") not in ALLOWED_PROVIDERS[scheme]: raise ValueError()
+            principal={"subject":value["userId"],"scheme":scheme,"issuer":"swa:"+value.get("identityProvider", "unknown"),"roles":roles,"claims":value,"userId":value["userId"]}
+        except Exception: raise AuthError(401,"Invalid SWA client principal")
+    else: raise AuthError(401,"Authentication adapter is not configured")
     require_roles(principal, policy.get("roles", [])); return principal
 def require_roles(principal, roles):
     if roles and not any(role in principal.get("roles",[]) for role in roles): raise AuthError(403,"Insufficient permissions")