swallowkit 2.0.0-alpha.3 → 2.0.0-alpha.5

package/dist/core/project/boundaries.js

@@ -11,8 +11,10 @@
  * - shared:        マーカー区切りの共有領域。マーカー内は SwallowKit、外は自由。
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BOUNDARY_GUIDANCE = exports.CONVENTION_RULES = exports.OWNERSHIP_POLICIES = void 0;
+exports.BOUNDARY_GUIDANCE = exports.OWNERSHIP_POLICIES = void 0;
+exports.buildConventionRules = buildConventionRules;
 exports.inspectBoundaries = inspectBoundaries;
+const config_1 = require("../config");
 const artifacts_1 = require("./artifacts");
 exports.OWNERSHIP_POLICIES = [
     {
@@ -37,7 +39,7 @@ exports.OWNERSHIP_POLICIES = [
         ownership: "extension-point",
         zone: "shared",
         editPolicy: "edit-outside-markers",
-        howToChange: "SwallowKit appends only inside marked sections (e.g. `# SwallowKit scaffold registrations`). Edit anywhere outside the markers freely; do not remove the markers.",
+        howToChange: "SwallowKit appends at the file-specific extension point: marked sections (e.g. `# SwallowKit scaffold registrations`) or append-only files such as shared/index.ts. Follow the path rule; preserve existing generated entries and any markers.",
     },
     {
         ownership: "metadata",
@@ -46,7 +48,7 @@ exports.OWNERSHIP_POLICIES = [
         howToChange: "Managed entirely by SwallowKit tooling (.swallowkit/). Never hand-edit.",
     },
 ];
-exports.CONVENTION_RULES = [
+const COMMON_LEADING_RULES = [
     {
         pattern: ".swallowkit/",
         zone: "deterministic",
@@ -60,30 +62,58 @@ exports.CONVENTION_RULES = [
         description: "Zod model schemas — the single source of truth. AI/developers author these freely; deterministic generation derives everything else from them.",
     },
     {
-        pattern: "infra/main.bicep",
-        zone: "shared",
-        editPolicy: "edit-outside-markers",
-        description: "SwallowKit inserts container modules; other infrastructure edits are free.",
+        pattern: "infra/migrations/manifest.json",
+        zone: "deterministic",
+        editPolicy: "never-hand-edit",
+        description: "Infrastructure migration ledger with baseline checksums. Updated by scaffold, `swallowkit migrations add-model`, and `swallowkit create-migration`.",
     },
     {
-        pattern: "functions/function_app.py",
-        zone: "shared",
-        editPolicy: "edit-outside-markers",
-        description: "SwallowKit appends blueprint registrations under its marker; other edits are free.",
+        pattern: "infra/migrations/",
+        zone: "ai-authored",
+        editPolicy: "free-edit",
+        description: "Versioned Bicep migrations. Edit a migration only before it is provisioned; never change an applied migration — add a new one with `swallowkit create-migration <slug>`.",
     },
     {
-        pattern: "shared/index.ts",
-        zone: "shared",
-        editPolicy: "edit-outside-markers",
-        description: "SwallowKit appends model exports; other exports may be added freely.",
+        pattern: "infra/",
+        zone: "deterministic",
+        editPolicy: "never-hand-edit",
+        description: "Baseline infrastructure (main.bicep and modules) whose checksums are recorded in infra/migrations/manifest.json. Hand edits block scaffold with baseline-drift; add resources through a new migration instead.",
     },
     {
-        pattern: "*",
-        zone: "ai-authored",
+        pattern: "shared/index.ts",
+        zone: "shared",
         editPolicy: "free-edit",
-        description: "Any path not recorded in the artifact ledger is AI/developer-authored. Business logic, custom pages, custom Functions, and tests belong here.",
+        description: "create-model and scaffold append missing model exports while preserving existing content. No managed markers; manual exports are allowed. Keep exports needed by generated code.",
     },
 ];
+/** Backend files that SwallowKit appends to; C# and TypeScript discover functions without a registration file. */
+const BACKEND_EXTENSION_RULES = {
+    python: [
+        {
+            pattern: "functions/function_app.py",
+            zone: "shared",
+            editPolicy: "edit-outside-markers",
+            description: "SwallowKit appends blueprint registrations under its marker; other edits are free.",
+        },
+        {
+            pattern: "functions/requirements.txt",
+            zone: "shared",
+            editPolicy: "free-edit",
+            description: "SwallowKit appends connector driver requirements when connector models are scaffolded; keep those lines and edit other requirements freely.",
+        },
+    ],
+    csharp: [],
+    typescript: [],
+};
+const FALLBACK_RULE = {
+    pattern: "*",
+    zone: "ai-authored",
+    editPolicy: "free-edit",
+    description: "Any path not recorded in the artifact ledger is AI/developer-authored. Business logic, custom pages, custom Functions, and tests belong here.",
+};
+function buildConventionRules(backendLanguage) {
+    return [...COMMON_LEADING_RULES, ...BACKEND_EXTENSION_RULES[backendLanguage], FALLBACK_RULE];
+}
 const POLICY_BY_OWNERSHIP = new Map(exports.OWNERSHIP_POLICIES.map((policy) => [policy.ownership, policy]));
 exports.BOUNDARY_GUIDANCE = [
     "Author models and business logic freely (ai-authored zone), then let SwallowKit derive CRUD/BFF/UI/infra deterministically via plan/apply.",
@@ -92,7 +122,7 @@ exports.BOUNDARY_GUIDANCE = [
     "In shared-zone files, keep SwallowKit markers intact and edit outside them.",
     "Run `swallowkit machine verify project` after applying changes; use `explain failure` to get repair evidence.",
 ];
-function inspectBoundaries(projectRoot = process.cwd()) {
+function inspectBoundaries(projectRoot = process.cwd(), backendLanguage = (0, config_1.getBackendLanguage)()) {
     const inspected = (0, artifacts_1.inspectArtifacts)(projectRoot);
     const artifacts = inspected.artifacts.map((artifact) => {
         const policy = POLICY_BY_OWNERSHIP.get(artifact.ownership);
@@ -108,8 +138,9 @@ function inspectBoundaries(projectRoot = process.cwd()) {
     return {
         contractVersion: 1,
         summary: "SwallowKit separates deterministic generation (models → CRUD/BFF/UI/infra via plan/apply) from AI free-form authoring (models, business logic, custom code). This contract tells agents which files belong to which side.",
+        backendLanguage,
         ownershipPolicies: exports.OWNERSHIP_POLICIES,
-        conventionRules: exports.CONVENTION_RULES,
+        conventionRules: buildConventionRules(backendLanguage),
         artifacts,
         guidance: exports.BOUNDARY_GUIDANCE,
     };

package/dist/core/project/boundaries.js.map

@@ -1 +1 @@
-{"version":3,"file":"boundaries.js","sourceRoot":"","sources":["../../../src/core/project/boundaries.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAuIH,8CAwBC;AA5JD,2CAA+C;AA6ClC,QAAA,kBAAkB,GAAsB;IACnD;QACE,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,2BAA2B;QACvC,WAAW,EACT,6MAA6M;KAChN;IACD;QACE,SAAS,EAAE,gBAAgB;QAC3B,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,WAAW;QACvB,WAAW,EAAE,mFAAmF;KACjG;IACD;QACE,SAAS,EAAE,YAAY;QACvB,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,WAAW;QACvB,WAAW,EACT,oJAAoJ;KACvJ;IACD;QACE,SAAS,EAAE,iBAAiB;QAC5B,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,sBAAsB;QAClC,WAAW,EACT,mKAAmK;KACtK;IACD;QACE,SAAS,EAAE,UAAU;QACrB,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,yEAAyE;KACvF;CACF,CAAC;AAEW,QAAA,gBAAgB,GAAuB;IAClD;QACE,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,uFAAuF;KACrG;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,WAAW;QACvB,WAAW,EACT,gJAAgJ;KACnJ;IACD;QACE,OAAO,EAAE,kBAAkB;QAC3B,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,4EAA4E;KAC1F;IACD;QACE,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,oFAAoF;KAClG;IACD;QACE,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,sEAAsE;KACpF;IACD;QACE,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,WAAW;QACvB,WAAW,EACT,+IAA+I;KAClJ;CACF,CAAC;AAEF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,0BAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAU,CAAC,CAAC,CAAC;AAEhG,QAAA,iBAAiB,GAAa;IACzC,4IAA4I;IAC5I,qGAAqG;IACrG,qLAAqL;IACrL,6EAA6E;IAC7E,+GAA+G;CAChH,CAAC;AAEF,SAAgB,iBAAiB,CAAC,cAAsB,OAAO,CAAC,GAAG,EAAE;IACnE,MAAM,SAAS,GAAG,IAAA,4BAAgB,EAAC,WAAW,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAuB,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACzE,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,aAAa;YACnC,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,WAAW;YAC7C,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,eAAe,EAAE,CAAC;QAClB,OAAO,EACL,2NAA2N;QAC7N,iBAAiB,EAAE,0BAAkB;QACrC,eAAe,EAAE,wBAAgB;QACjC,SAAS;QACT,QAAQ,EAAE,yBAAiB;KAC5B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"boundaries.js","sourceRoot":"","sources":["../../../src/core/project/boundaries.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA+JH,oDAEC;AAYD,8CA4BC;AAvMD,sCAA+C;AAG/C,2CAA+C;AA+ClC,QAAA,kBAAkB,GAAsB;IACnD;QACE,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,2BAA2B;QACvC,WAAW,EACT,6MAA6M;KAChN;IACD;QACE,SAAS,EAAE,gBAAgB;QAC3B,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,WAAW;QACvB,WAAW,EAAE,mFAAmF;KACjG;IACD;QACE,SAAS,EAAE,YAAY;QACvB,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,WAAW;QACvB,WAAW,EACT,oJAAoJ;KACvJ;IACD;QACE,SAAS,EAAE,iBAAiB;QAC5B,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,sBAAsB;QAClC,WAAW,EACT,gPAAgP;KACnP;IACD;QACE,SAAS,EAAE,UAAU;QACrB,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,yEAAyE;KACvF;CACF,CAAC;AAEF,MAAM,oBAAoB,GAAuB;IAC/C;QACE,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,uFAAuF;KACrG;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,WAAW;QACvB,WAAW,EACT,gJAAgJ;KACnJ;IACD;QACE,OAAO,EAAE,gCAAgC;QACzC,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EACT,qJAAqJ;KACxJ;IACD;QACE,OAAO,EAAE,mBAAmB;QAC5B,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,WAAW;QACvB,WAAW,EACT,0KAA0K;KAC7K;IACD;QACE,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EACT,gNAAgN;KACnN;IACD;QACE,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,WAAW;QACvB,WAAW,EAAE,kLAAkL;KAChM;CACF,CAAC;AAEF,kHAAkH;AAClH,MAAM,uBAAuB,GAAgD;IAC3E,MAAM,EAAE;QACN;YACE,OAAO,EAAE,2BAA2B;YACpC,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,sBAAsB;YAClC,WAAW,EAAE,oFAAoF;SAClG;QACD;YACE,OAAO,EAAE,4BAA4B;YACrC,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,WAAW;YACvB,WAAW,EAAE,6IAA6I;SAC3J;KACF;IACD,MAAM,EAAE,EAAE;IACV,UAAU,EAAE,EAAE;CACf,CAAC;AAEF,MAAM,aAAa,GAAqB;IACtC,OAAO,EAAE,GAAG;IACZ,IAAI,EAAE,aAAa;IACnB,UAAU,EAAE,WAAW;IACvB,WAAW,EACT,+IAA+I;CAClJ,CAAC;AAEF,SAAgB,oBAAoB,CAAC,eAAgC;IACnE,OAAO,CAAC,GAAG,oBAAoB,EAAE,GAAG,uBAAuB,CAAC,eAAe,CAAC,EAAE,aAAa,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,0BAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAU,CAAC,CAAC,CAAC;AAEhG,QAAA,iBAAiB,GAAa;IACzC,4IAA4I;IAC5I,qGAAqG;IACrG,qLAAqL;IACrL,6EAA6E;IAC7E,+GAA+G;CAChH,CAAC;AAEF,SAAgB,iBAAiB,CAC/B,cAAsB,OAAO,CAAC,GAAG,EAAE,EACnC,kBAAmC,IAAA,2BAAkB,GAAE;IAEvD,MAAM,SAAS,GAAG,IAAA,4BAAgB,EAAC,WAAW,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAuB,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACzE,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,aAAa;YACnC,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,WAAW;YAC7C,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,eAAe,EAAE,CAAC;QAClB,OAAO,EACL,2NAA2N;QAC7N,eAAe;QACf,iBAAiB,EAAE,0BAAkB;QACrC,eAAe,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACtD,SAAS;QACT,QAAQ,EAAE,yBAAiB;KAC5B,CAAC;AACJ,CAAC"}

package/dist/core/project/capabilities.d.ts

@@ -48,6 +48,7 @@ export interface CapabilitiesContract {
     sharedModels: {
         idFieldRule: string;
         buildNote: string;
+        nativeSchemaMapping: string[];
     };
     seeding: {
         createTemplates: string;
@@ -59,6 +60,7 @@ export interface CapabilitiesContract {
         defaultChecks: string[];
         optInChecks: string[];
         customChecks: string;
+        backendBuild: string;
     };
 }
 export declare function inspectCapabilities(): CapabilitiesContract;

package/dist/core/project/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../src/core/project/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE;QACT,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,iBAAiB,EAAE,0BAA0B,EAAE,CAAC;IAChD,cAAc,EAAE;QACd,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,SAAS,EAAE,sBAAsB,EAAE,CAAC;QACpC,qBAAqB,EAAE;YACrB,SAAS,EAAE,MAAM,CAAC;YAClB,aAAa,EAAE,MAAM,CAAC;YACtB,eAAe,EAAE,OAAO,CAAC;SAC1B,CAAC;KACH,CAAC;IACF,aAAa,EAAE;QACb,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,YAAY,EAAE;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,OAAO,EAAE;QACP,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE;QACZ,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,wBAAgB,mBAAmB,IAAI,oBAAoB,CAyI1D"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../src/core/project/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE;QACT,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,iBAAiB,EAAE,0BAA0B,EAAE,CAAC;IAChD,cAAc,EAAE;QACd,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,SAAS,EAAE,sBAAsB,EAAE,CAAC;QACpC,qBAAqB,EAAE;YACrB,SAAS,EAAE,MAAM,CAAC;YAClB,aAAa,EAAE,MAAM,CAAC;YACtB,eAAe,EAAE,OAAO,CAAC;SAC1B,CAAC;KACH,CAAC;IACF,aAAa,EAAE;QACb,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,YAAY,EAAE;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,mBAAmB,EAAE,MAAM,EAAE,CAAC;KAC/B,CAAC;IACF,OAAO,EAAE;QACP,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE;QACZ,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,wBAAgB,mBAAmB,IAAI,oBAAoB,CAkK1D"}

package/dist/core/project/capabilities.js

@@ -47,6 +47,18 @@ function inspectCapabilities() {
                 required: false,
                 description: "Role-based access control metadata applied to the generated CRUD Functions. `roles` guards all operations; `read`/`write` guard per-operation; `policy` references a named authorization policy from swallowkit.config auth.authorization.policies.",
                 format: "export const authPolicy = { roles: ['admin'] };\n// or per-operation:\nexport const authPolicy = { read: ['user'], write: ['admin'] };\n// or a named policy:\nexport const authPolicy = { policy: 'adminOnly' };",
+                notes: [
+                    "An explicit authPolicy without configured authentication blocks plan/apply/generate scaffold with auth-policy-without-auth before any artifacts are written. Run plan auth, apply auth, then re-plan scaffold. An empty {} declaration keeps the existing behavior: no explicit policy.",
+                    "With named auth.schemes, define auth.authorization.policies selecting schemes and roles, then reference them via policy or read/write names. A role-only declaration cannot select a named scheme and blocks with auth-policy-requires-named-policy; it is supported by legacy single-provider authentication.",
+                    "Conversely, single-provider authentication (auth.provider) supports role lists only. Referencing a named policy (authPolicy.policy, read/write names, or a named auth.authorization.defaultPolicy) blocks with auth-named-policy-requires-named-scheme; add a named scheme first.",
+                ],
+            },
+            {
+                name: "references",
+                required: false,
+                description: "Explicit foreign keys used by generated UI lookups. Without it, a string field named <model>Id is treated as a foreign key only when shared/models contains that model (userId -> User only if user.ts exists). Map a field to false to disable inference. References to missing models are ignored with a reference-model-not-found warning.",
+                format: "export const references = { authorId: 'User', legacyId: false };",
+                notes: ["Only single string id fields can reference a model.", "No lookup UI, fetch, or OpenAPI reference is generated for fields that do not reference an existing model."],
             },
             {
                 name: "connectorConfig",
@@ -109,14 +121,23 @@ function inspectCapabilities() {
             ],
             notGuaranteed: [
                 "Owner scoping: generated CRUD does NOT restrict rows to the authenticated principal. Any authenticated caller passing the policy can read/write any document.",
+                "Without authentication, plan scaffold reports user-scoped-data-without-auth when the partition key or an owner-like field (userId, learnerId, ownerId, ...) suggests per-user data.",
             ],
             guidance: [
-                "For multi-user data where users may only touch their own records, add ai-authored custom endpoints that derive the scoping key (e.g. learnerId) from the verified principal — never from the request body — and restrict generated write endpoints to admin roles or disable them.",
+                "Configure authentication via plan/apply auth before declaring authPolicy. For multi-user data where users may only touch their own records, add ai-authored custom endpoints that derive the scoping key (e.g. learnerId) from the verified principal — never from the request body — and restrict generated write endpoints to admin roles or disable them.",
             ],
         },
         sharedModels: {
             idFieldRule: "id: z.string() (required). createdAt/updatedAt: z.string().optional(). The backend owns their values.",
-            buildNote: "verify typecheck resolves the shared package from its built dist/. SwallowKit rebuilds shared automatically during verify; when typechecking manually, build the shared package first (errors like \"no exported member\" usually mean a stale dist).",
+            nativeSchemaMapping: [
+                "C#/Python schema assets derive types from Zod, never from field names: z.string() -> string/str (including createdAt/updatedAt).",
+                "Date types only when declared: z.iso.datetime() -> DateTime/datetime, z.iso.date() -> DateOnly/date, z.date() -> DateTime/datetime.",
+                "z.number() -> double / float|int; z.number().int() or z.int() -> long / int.",
+                "Inline z.object({...}) fields become named classes <Model><Field> (e.g. ProbeItemNested); imported model schemas keep their own class.",
+                "min/max/length/nonempty/regex/int/gt/gte/lt/lte/positive/nonnegative and array min/max are enforced by C# IValidatableObject.Validate and Python Field bounds/validators. Regexes use search semantics like Zod.",
+                "String formats (email/uuid/url), refinements, and transforms are not re-implemented natively; the BFF Zod schemas remain the authoritative validation.",
+            ],
+            buildNote: "create-model and plan/apply scaffold append missing model exports to shared/index.ts, including manually authored models. Manual exports are allowed (no markers); existing content is preserved. verify typecheck resolves the shared package from its built dist/. SwallowKit rebuilds shared automatically during verify; when typechecking manually, build shared first.",
         },
         seeding: {
             createTemplates: "swallowkit create-dev-seeds <environment> — writes dev-seeds/<environment>/<model>.json templates.",
@@ -127,15 +148,18 @@ function inspectCapabilities() {
             "inspect project | entities | routes | artifacts | boundaries | infra | drift | capabilities",
             "validate project",
             "generate model <names...> | generate scaffold <model>",
-            "plan scaffold <models...> | plan auth --provider <p> [--scheme <name>] [--allowed-providers <csv>] | plan provision -g <rg> --location <loc> --swa-location <loc> [--adopt-existing --baseline 0 --what-if] [--reconcile --what-if]",
-            "apply scaffold [models...] --plan <id> [--approve] | apply auth --plan <id> [--approve] | apply provision --plan <id> --approve",
+            "plan scaffold <models...> [--api-only] [--skip-infra] | plan auth --provider <p> [--scheme <name>] [--allowed-providers <csv>] | plan provision -g <rg> --location <loc> --swa-location <loc> [--adopt-existing --baseline 0 --what-if] [--reconcile --what-if]",
+            "apply scaffold [models...] --plan <id> [--approve] [--skip-infra] | apply auth --plan <id> [--approve] | apply provision --plan <id> --approve",
             "verify project [--checks <ids>] [--compact]",
             "explain failure [--check <id>]",
+            "(regular CLI) migrations add-model <model> [--dry-run] — generate only the container migration after scaffold --skip-infra",
+            "(regular CLI) configure-mcp [--version auto|latest|<semver>] — re-select the MCP launcher version in .mcp.json",
         ],
         verifyChecks: {
-            defaultChecks: ["structure", "drift", "typecheck"],
+            defaultChecks: ["structure", "drift", "typecheck", "backend-build"],
             optInChecks: ["build", "lint", "test"],
             customChecks: "swallowkit.config verify.checks: [{ id, command, title?, timeoutMs? }]",
+            backendBuild: "Runs dotnet build in functions/ (C#), the project tsc --noEmit (TypeScript), or Python 3 compileall (syntax only, using functions/.venv before PATH). Missing toolchains are skip with a reason, not proof of validation. Root build scripts do not replace backend-build; use --checks \"structure,drift,typecheck,backend-build,build\" for both.",
         },
     };
 }

package/dist/core/project/capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../../src/core/project/capabilities.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA6DH,kDAyIC;AApMD,2CAAqD;AA2DrD,SAAgB,mBAAmB;IACjC,OAAO;QACL,eAAe,EAAE,CAAC;QAClB,iBAAiB,EAAE,IAAA,8BAAoB,GAAE;QACzC,SAAS,EAAE;YACT,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YAC9B,OAAO,EAAE,QAAQ;YACjB,aAAa,EAAE,wHAAwH;YACvI,iBAAiB,EAAE,kLAAkL;YACrM,WAAW,EAAE,uKAAuK;SACrL;QACD,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,gQAAgQ;gBAClQ,MAAM,EACJ,2LAA2L;aAC9L;YACD;gBACE,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,uEAAuE;gBACpF,MAAM,EAAE,oCAAoC;aAC7C;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,mJAAmJ;gBACrJ,MAAM,EAAE,2CAA2C;gBACnD,KAAK,EAAE,CAAC,2EAA2E,CAAC;aACrF;YACD;gBACE,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,qPAAqP;gBACvP,MAAM,EACJ,mNAAmN;aACtN;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,gJAAgJ;gBAClJ,MAAM,EACJ,8IAA8I;aACjJ;SACF;QACD,cAAc,EAAE;YACd,eAAe,EAAE;gBACf,kMAAkM;gBAClM,kGAAkG;gBAClG,gJAAgJ;gBAChJ,+HAA+H;gBAC/H,oHAAoH;gBACpH,sFAAsF;aACvF;YACD,KAAK,EAAE;gBACL,yIAAyI;gBACzI,sGAAsG;gBACtG,gHAAgH;aACjH;YACD,SAAS,EAAE;gBACT;oBACE,QAAQ,EAAE,YAAY;oBACtB,WAAW,EAAE,0FAA0F;oBACvG,cAAc,EAAE,CAAC,kDAAkD,EAAE,sDAAsD,CAAC;iBAC7H;gBACD;oBACE,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,8FAA8F;oBAC3G,cAAc,EAAE;wBACd,6IAA6I;qBAC9I;iBACF;gBACD;oBACE,QAAQ,EAAE,gBAAgB;oBAC1B,WAAW,EAAE,+GAA+G;oBAC5H,cAAc,EAAE;wBACd,mFAAmF;wBACnF,sEAAsE;qBACvE;iBACF;gBACD;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,wCAAwC;oBACrD,cAAc,EAAE,EAAE;iBACnB;aACF;YACD,qBAAqB,EAAE;gBACrB,SAAS,EACP,kMAAkM;gBACpM,aAAa,EACX,kUAAkU;gBACpU,eAAe,EAAE,IAAI;aACtB;SACF;QACD,aAAa,EAAE;YACb,UAAU,EAAE;gBACV,yFAAyF;gBACzF,yCAAyC;aAC1C;YACD,aAAa,EAAE;gBACb,+JAA+J;aAChK;YACD,QAAQ,EAAE;gBACR,oRAAoR;aACrR;SACF;QACD,YAAY,EAAE;YACZ,WAAW,EAAE,uGAAuG;YACpH,SAAS,EACP,uPAAuP;SAC1P;QACD,OAAO,EAAE;YACP,eAAe,EAAE,oGAAoG;YACrH,UAAU,EAAE,iHAAiH;YAC7H,KAAK,EAAE,CAAC,yFAAyF,CAAC;SACnG;QACD,eAAe,EAAE;YACf,6FAA6F;YAC7F,kBAAkB;YAClB,uDAAuD;YACvD,qOAAqO;YACrO,iIAAiI;YACjI,6CAA6C;YAC7C,gCAAgC;SACjC;QACD,YAAY,EAAE;YACZ,aAAa,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC;YAClD,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;YACtC,YAAY,EAAE,wEAAwE;SACvF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../../src/core/project/capabilities.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA+DH,kDAkKC;AA/ND,2CAAqD;AA6DrD,SAAgB,mBAAmB;IACjC,OAAO;QACL,eAAe,EAAE,CAAC;QAClB,iBAAiB,EAAE,IAAA,8BAAoB,GAAE;QACzC,SAAS,EAAE;YACT,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YAC9B,OAAO,EAAE,QAAQ;YACjB,aAAa,EAAE,wHAAwH;YACvI,iBAAiB,EAAE,kLAAkL;YACrM,WAAW,EAAE,uKAAuK;SACrL;QACD,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,gQAAgQ;gBAClQ,MAAM,EACJ,2LAA2L;aAC9L;YACD;gBACE,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,uEAAuE;gBACpF,MAAM,EAAE,oCAAoC;aAC7C;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,mJAAmJ;gBACrJ,MAAM,EAAE,2CAA2C;gBACnD,KAAK,EAAE,CAAC,2EAA2E,CAAC;aACrF;YACD;gBACE,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,qPAAqP;gBACvP,MAAM,EACJ,mNAAmN;gBACrN,KAAK,EAAE;oBACL,yRAAyR;oBACzR,gTAAgT;oBAChT,mRAAmR;iBACpR;aACF;YACD;gBACE,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,+UAA+U;gBACjV,MAAM,EAAE,kEAAkE;gBAC1E,KAAK,EAAE,CAAC,qDAAqD,EAAE,4GAA4G,CAAC;aAC7K;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,gJAAgJ;gBAClJ,MAAM,EACJ,8IAA8I;aACjJ;SACF;QACD,cAAc,EAAE;YACd,eAAe,EAAE;gBACf,kMAAkM;gBAClM,kGAAkG;gBAClG,gJAAgJ;gBAChJ,+HAA+H;gBAC/H,oHAAoH;gBACpH,sFAAsF;aACvF;YACD,KAAK,EAAE;gBACL,yIAAyI;gBACzI,sGAAsG;gBACtG,gHAAgH;aACjH;YACD,SAAS,EAAE;gBACT;oBACE,QAAQ,EAAE,YAAY;oBACtB,WAAW,EAAE,0FAA0F;oBACvG,cAAc,EAAE,CAAC,kDAAkD,EAAE,sDAAsD,CAAC;iBAC7H;gBACD;oBACE,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,8FAA8F;oBAC3G,cAAc,EAAE;wBACd,6IAA6I;qBAC9I;iBACF;gBACD;oBACE,QAAQ,EAAE,gBAAgB;oBAC1B,WAAW,EAAE,+GAA+G;oBAC5H,cAAc,EAAE;wBACd,mFAAmF;wBACnF,sEAAsE;qBACvE;iBACF;gBACD;oBACE,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,wCAAwC;oBACrD,cAAc,EAAE,EAAE;iBACnB;aACF;YACD,qBAAqB,EAAE;gBACrB,SAAS,EACP,kMAAkM;gBACpM,aAAa,EACX,kUAAkU;gBACpU,eAAe,EAAE,IAAI;aACtB;SACF;QACD,aAAa,EAAE;YACb,UAAU,EAAE;gBACV,yFAAyF;gBACzF,yCAAyC;aAC1C;YACD,aAAa,EAAE;gBACb,+JAA+J;gBAC/J,qLAAqL;aACtL;YACD,QAAQ,EAAE;gBACR,8VAA8V;aAC/V;SACF;QACD,YAAY,EAAE;YACZ,WAAW,EAAE,uGAAuG;YACpH,mBAAmB,EAAE;gBACnB,kIAAkI;gBAClI,qIAAqI;gBACrI,8EAA8E;gBAC9E,wIAAwI;gBACxI,kNAAkN;gBAClN,wJAAwJ;aACzJ;YACD,SAAS,EACP,8WAA8W;SACjX;QACD,OAAO,EAAE;YACP,eAAe,EAAE,oGAAoG;YACrH,UAAU,EAAE,iHAAiH;YAC7H,KAAK,EAAE,CAAC,yFAAyF,CAAC;SACnG;QACD,eAAe,EAAE;YACf,6FAA6F;YAC7F,kBAAkB;YAClB,uDAAuD;YACvD,iQAAiQ;YACjQ,gJAAgJ;YAChJ,6CAA6C;YAC7C,gCAAgC;YAChC,4HAA4H;YAC5H,gHAAgH;SACjH;QACD,YAAY,EAAE;YACZ,aAAa,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,CAAC;YACnE,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;YACtC,YAAY,EAAE,wEAAwE;YACtF,YAAY,EAAE,qVAAqV;SACpW;KACF,CAAC;AACJ,CAAC"}

package/dist/core/project/mcp-config.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Project-scoped MCP launcher version management.
+ *
+ * `.mcp.json` intentionally resolves `swallowkit@latest` so that projects created
+ * with older releases still get the current stable tools. A prerelease project can
+ * be newer than `latest`; in that case the launcher is pinned to the project
+ * version until a stable release that understands project-aware delegation catches up.
+ */
+export declare const MCP_CONFIG_PATH = ".mcp.json";
+export declare const MCP_VERSION_ENV = "SWALLOWKIT_MCP_VERSION";
+export declare const MCP_LATEST = "latest";
+export interface McpPinDecision {
+    version: string;
+    reason: string;
+}
+/**
+ * Decide the SWALLOWKIT_MCP_VERSION value for a project that uses `projectVersion`.
+ * Uses `latest` unless the project version is newer than the published `latest`.
+ * When the registry could not be reached, prereleases are pinned conservatively.
+ */
+export declare function resolveMcpPinVersion(projectVersion: string, publishedLatest: string | null): McpPinDecision;
+export declare function lookupPublishedLatestVersion(packageName: string, timeoutMs?: number): string | null;
+export declare function readMcpConfigVersion(projectDir: string): string | null;
+/** Update only the SwallowKit MCP version in .mcp.json, preserving all other content. */
+export declare function writeMcpConfigVersion(projectDir: string, version: string): void;
+//# sourceMappingURL=mcp-config.d.ts.map

package/dist/core/project/mcp-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config.d.ts","sourceRoot":"","sources":["../../../src/core/project/mcp-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,eAAO,MAAM,eAAe,cAAc,CAAC;AAC3C,eAAO,MAAM,eAAe,2BAA2B,CAAC;AACxD,eAAO,MAAM,UAAU,WAAW,CAAC;AAEnC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAa3G;AAED,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,SAAQ,GAAG,MAAM,GAAG,IAAI,CAYlG;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUtE;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAY/E"}

package/dist/core/project/mcp-config.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * Project-scoped MCP launcher version management.
+ *
+ * `.mcp.json` intentionally resolves `swallowkit@latest` so that projects created
+ * with older releases still get the current stable tools. A prerelease project can
+ * be newer than `latest`; in that case the launcher is pinned to the project
+ * version until a stable release that understands project-aware delegation catches up.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_LATEST = exports.MCP_VERSION_ENV = exports.MCP_CONFIG_PATH = void 0;
+exports.resolveMcpPinVersion = resolveMcpPinVersion;
+exports.lookupPublishedLatestVersion = lookupPublishedLatestVersion;
+exports.readMcpConfigVersion = readMcpConfigVersion;
+exports.writeMcpConfigVersion = writeMcpConfigVersion;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const semver_1 = require("../../utils/semver");
+exports.MCP_CONFIG_PATH = ".mcp.json";
+exports.MCP_VERSION_ENV = "SWALLOWKIT_MCP_VERSION";
+exports.MCP_LATEST = "latest";
+/**
+ * Decide the SWALLOWKIT_MCP_VERSION value for a project that uses `projectVersion`.
+ * Uses `latest` unless the project version is newer than the published `latest`.
+ * When the registry could not be reached, prereleases are pinned conservatively.
+ */
+function resolveMcpPinVersion(projectVersion, publishedLatest) {
+    if (!(0, semver_1.parseSemver)(projectVersion)) {
+        return { version: exports.MCP_LATEST, reason: `Project version ${projectVersion} is not a valid semantic version.` };
+    }
+    if (publishedLatest && (0, semver_1.parseSemver)(publishedLatest)) {
+        const comparison = (0, semver_1.compareSemver)(projectVersion, publishedLatest);
+        return comparison > 0
+            ? { version: projectVersion, reason: `Project version ${projectVersion} is newer than published latest ${publishedLatest}.` }
+            : { version: exports.MCP_LATEST, reason: `Published latest ${publishedLatest} is the same as or newer than project version ${projectVersion}.` };
+    }
+    return (0, semver_1.isPrerelease)(projectVersion)
+        ? { version: projectVersion, reason: `Published latest is unknown; prerelease ${projectVersion} is pinned so MCP matches the project.` }
+        : { version: exports.MCP_LATEST, reason: "Published latest is unknown; stable projects keep latest." };
+}
+function lookupPublishedLatestVersion(packageName, timeoutMs = 15000) {
+    // Run outside the project so its devEngines/packageManager policy does not reject npm.
+    const result = (0, child_process_1.spawnSync)("npm", ["view", `${packageName}@latest`, "version"], {
+        cwd: os.tmpdir(),
+        encoding: "utf8",
+        timeout: timeoutMs,
+        shell: process.platform === "win32",
+        stdio: ["ignore", "pipe", "ignore"],
+    });
+    if (result.error || result.status !== 0)
+        return null;
+    const version = String(result.stdout).trim().split(/\s+/).pop() ?? "";
+    return (0, semver_1.parseSemver)(version) ? version : null;
+}
+function readMcpConfigVersion(projectDir) {
+    const configPath = path.join(projectDir, exports.MCP_CONFIG_PATH);
+    if (!fs.existsSync(configPath))
+        return null;
+    try {
+        const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
+        const value = config?.mcpServers?.swallowkit?.env?.[exports.MCP_VERSION_ENV];
+        return typeof value === "string" ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Update only the SwallowKit MCP version in .mcp.json, preserving all other content. */
+function writeMcpConfigVersion(projectDir, version) {
+    const configPath = path.join(projectDir, exports.MCP_CONFIG_PATH);
+    if (!fs.existsSync(configPath)) {
+        throw new Error(`${exports.MCP_CONFIG_PATH} was not found. Run this command from a SwallowKit project root.`);
+    }
+    const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
+    const server = config?.mcpServers?.swallowkit;
+    if (!server || typeof server !== "object") {
+        throw new Error(`${exports.MCP_CONFIG_PATH} does not define mcpServers.swallowkit.`);
+    }
+    server.env = { ...(server.env ?? {}), [exports.MCP_VERSION_ENV]: version };
+    fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
+}
+//# sourceMappingURL=mcp-config.js.map

package/dist/core/project/mcp-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config.js","sourceRoot":"","sources":["../../../src/core/project/mcp-config.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBH,oDAaC;AAED,oEAYC;AAED,oDAUC;AAGD,sDAYC;AA1ED,iDAA0C;AAC1C,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,+CAA8E;AAEjE,QAAA,eAAe,GAAG,WAAW,CAAC;AAC9B,QAAA,eAAe,GAAG,wBAAwB,CAAC;AAC3C,QAAA,UAAU,GAAG,QAAQ,CAAC;AAOnC;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,cAAsB,EAAE,eAA8B;IACzF,IAAI,CAAC,IAAA,oBAAW,EAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,kBAAU,EAAE,MAAM,EAAE,mBAAmB,cAAc,mCAAmC,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,eAAe,IAAI,IAAA,oBAAW,EAAC,eAAe,CAAC,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,IAAA,sBAAa,EAAC,cAAc,EAAE,eAAe,CAAE,CAAC;QACnE,OAAO,UAAU,GAAG,CAAC;YACnB,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,cAAc,mCAAmC,eAAe,GAAG,EAAE;YAC7H,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAU,EAAE,MAAM,EAAE,oBAAoB,eAAe,iDAAiD,cAAc,GAAG,EAAE,CAAC;IAC7I,CAAC;IACD,OAAO,IAAA,qBAAY,EAAC,cAAc,CAAC;QACjC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,2CAA2C,cAAc,wCAAwC,EAAE;QACxI,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAU,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;AACnG,CAAC;AAED,SAAgB,4BAA4B,CAAC,WAAmB,EAAE,SAAS,GAAG,KAAK;IACjF,uFAAuF;IACvF,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,WAAW,SAAS,EAAE,SAAS,CAAC,EAAE;QAC5E,GAAG,EAAE,EAAE,CAAC,MAAM,EAAE;QAChB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;QACnC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACtE,OAAO,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,SAAgB,oBAAoB,CAAC,UAAkB;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAe,CAAC,CAAC;IAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,uBAAe,CAAC,CAAC;QACrE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,SAAgB,qBAAqB,CAAC,UAAkB,EAAE,OAAe;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAe,CAAC,CAAC;IAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,uBAAe,kEAAkE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC;IAC9C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,uBAAe,yCAAyC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,uBAAe,CAAC,EAAE,OAAO,EAAE,CAAC;IACnE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC"}

package/dist/core/project/react-project.js

@@ -323,7 +323,7 @@ live in \`functions/local.settings.json\`. Keep their secrets out of source cont
 \`\`\`sh
 ${pm} run build
 ${cmd.exec} swallowkit machine verify project
-${cmd.exec} swallowkit machine verify project --checks structure,drift,typecheck,build
+${cmd.exec} swallowkit machine verify project --checks "structure,drift,typecheck,backend-build,build"
 \`\`\`
 
 The build compiles shared schemas, checks the SPA, builds static assets, and

package/dist/core/project/workflows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../../src/core/project/workflows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,MAAM,WAAW,WAAW;IAC1B,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CAgO/D;AAED,eAAO,MAAM,aAAa,QAAwC,CAAC;AACnE,eAAO,MAAM,UAAU,QAAiC,CAAC;AAEzD,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAS9E;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAS9F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAS7E"}
+{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../../src/core/project/workflows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,MAAM,WAAW,WAAW;IAC1B,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CAkP/D;AAED,eAAO,MAAM,aAAa,QAAwC,CAAC;AACnE,eAAO,MAAM,UAAU,QAAiC,CAAC;AAEzD,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAS9E;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAS9F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAS7E"}

package/dist/core/project/workflows.js

@@ -71,9 +71,23 @@ Goal: add a data model and derive CRUD/BFF/UI/infra deterministically.
 1. Create the model file (deterministic template):
    \`${runCmd} swallowkit machine generate model <name> --overwrite never\`
 2. Edit \`shared/models/<name>.ts\` — add domain fields (free-form authoring).
+   - Native C#/Python types follow Zod, not names: \`z.iso.datetime()\` for dates, \`z.number().int()\` for integers.
+   - \`<model>Id\` fields reference a model only when it exists in \`shared/models\`; otherwise declare
+     \`export const references = { fieldId: 'Model' }\` (or \`false\` to opt out).
 3. Compute the change plan (writes nothing):
    \`${runCmd} swallowkit machine plan scaffold <name>\`
    - \`status: "requires-human"\` → review \`data.conflicts\`; only proceed with \`--approve\` if overwriting is intended.
+   - Must not change Bicep/infrastructure? Add \`--skip-infra\` to plan and apply. Nothing under \`infra/\` changes and
+     the plan warns \`infra-skipped\`; later run \`${runCmd} swallowkit migrations add-model <name>\` to add only the container migration.
+   - Read \`data.warnings\`. \`user-scoped-data-without-auth\` means generated CRUD would expose every user's documents;
+     add auth (\`swallowkit-add-auth\`) and owner-scoped ai-authored endpoints before exposing the model.
+   - \`auth-policy-without-auth\` blocks generation before file writes: configure authentication with plan/apply auth,
+     then re-plan. Do not remove a required policy to bypass this prerequisite.
+     For named \`auth.schemes\`, define named authorization policies selecting schemes/roles and reference them from
+     \`authPolicy.policy\` or read/write names; role-only declarations block with \`auth-policy-requires-named-policy\`.
+     Single-provider \`auth.provider\` supports role lists only; named policies block with \`auth-named-policy-requires-named-scheme\`.
+   - Scaffold appends missing exports to \`shared/index.ts\` for hand-authored models too.
+     Manual exports are allowed; no managed markers exist in that file.
 4. Apply:
    \`${runCmd} swallowkit machine apply scaffold --plan <planId>\`
 5. Verify:
@@ -166,7 +180,7 @@ the scoping key from the verified principal, never from the request body.
         fileName: "verify-and-repair.md",
         title: "Verify and repair loop",
         skillName: "swallowkit-verify-repair",
-        skillDescription: "Converge a SwallowKit project to a verified state: run structure/drift/typecheck (and build/lint/test) checks, read evidence with explain failure, repair, and repeat. Use after any code or schema change, when verification fails, when the build/lint/tests are broken, or before finishing a task.",
+        skillDescription: "Converge a SwallowKit project to a verified state: run structure/drift/typecheck/backend-build (and build/lint/test) checks, read evidence with explain failure, repair, and repeat. Use after any code or schema change, when verification fails, when the build/lint/tests are broken, or before finishing a task.",
         content: `# Workflow: Verify and repair
 
 Goal: converge the project to a verified state after any change.
@@ -174,14 +188,16 @@ Goal: converge the project to a verified state after any change.
 ## Loop
 
 1. \`${runCmd} swallowkit machine verify project\`
-   - default checks: structure, drift, typecheck (+ project-specific checks from swallowkit.config \`verify.checks\`)
-   - opt-in heavier checks: \`--checks structure,drift,typecheck,build,lint,test\`
+   - default checks: structure, drift, typecheck, backend-build (+ project-specific checks from swallowkit.config \`verify.checks\`)
+   - backend-build: standalone C# \`dotnet build\`, TypeScript \`tsc --noEmit\`, Python 3 \`compileall\` (syntax only).
+     Missing toolchains are skipped with a reason, not proof of a working backend. Restore them and re-run.
+   - opt-in heavier checks: \`--checks "structure,drift,typecheck,backend-build,build,lint,test"\` (quote CSV in PowerShell)
 2. If \`summary.done\` is false:
    - \`${runCmd} swallowkit machine explain failure\` → evidence (logTail, findings, violations) and suggestedActions per check.
    - Repair:
      - \`drift\` failures → follow each finding's \`repairAction\` (usually re-run plan/apply scaffold).
      - \`structure\` failures → follow \`suggestedFix\` per violation.
-     - \`typecheck\`/\`build\`/\`lint\`/\`test\` failures → fix the code in ai-authored files.
+     - \`typecheck\`/\`backend-build\`/\`build\`/\`lint\`/\`test\` failures → fix the source code, not generated artifacts.
 3. Repeat until \`summary.done: true\`.
 
 ## Exit criteria
@@ -257,7 +273,9 @@ under \`.github/skills/\` so skills-aware agents load them automatically.
 
 - **ai-authored** (write freely): \`shared/models/\`, business logic, custom pages/components, tests.
 - **deterministic** (never hand-edit): artifacts generated by SwallowKit (see \`.swallowkit/artifacts.json\`) and \`.swallowkit/\` metadata. Change models/config and regenerate via plan/apply.
-- **shared** (edit outside markers): \`infra/main.bicep\`, \`functions/function_app.py\`, \`shared/index.ts\`.
+- **shared**: \`shared/index.ts\` allows manual exports (no markers; SwallowKit appends missing entries).
+  For Python \`functions/function_app.py\`, edit outside the registration marker.
+- **infrastructure**: baseline \`infra/\` files are checksum-locked by \`infra/migrations/manifest.json\`; add resources as new migrations (\`swallowkit create-migration <slug>\`, \`swallowkit migrations add-model <model>\`).
 
 Full machine-readable contract: \`${runCmd} swallowkit machine inspect boundaries\`
 `,

package/dist/core/project/workflows.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../../src/core/project/workflows.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBH,8CAgOC;AAMD,8CASC;AAGD,4CASC;AAMD,4CASC;AA/RD,uCAAyB;AACzB,2CAA6B;AAoB7B,SAAgB,iBAAiB,CAAC,MAAc;IAC9C,MAAM,QAAQ,GAAgB;QAC5B,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,mCAAmC;QAC1C,SAAS,EAAE,sBAAsB;QACjC,gBAAgB,EACd,8PAA8P;QAChQ,OAAO,EAAE;;;;;;;;+BAQkB,MAAM;;;;;OAK9B,MAAM;;;OAGN,MAAM;;;OAGN,MAAM;;OAEN,MAAM;mCACsB,MAAM;;kBAEvB,MAAM;;;;;;;;;;;;CAYvB;KACE,CAAC;IAEF,MAAM,WAAW,GAAgB;QAC/B,QAAQ,EAAE,iBAAiB;QAC3B,KAAK,EAAE,iCAAiC;QACxC,SAAS,EAAE,yBAAyB;QACpC,gBAAgB,EACd,wSAAwS;QAC1S,OAAO,EAAE;;;;;;;;OAQN,MAAM;;;OAGN,MAAM;;cAEC,MAAM;eACL,MAAM;;;;;;CAMpB;KACE,CAAC;IAEF,MAAM,OAAO,GAAgB;QAC3B,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,6DAA6D;QACpE,SAAS,EAAE,qBAAqB;QAChC,gBAAgB,EACd,4WAA4W;QAC9W,OAAO,EAAE;;;;;;;;;;;;;kCAaqB,MAAM;;;OAGjC,MAAM;;OAEN,MAAM;;;;;;;;;eASE,MAAM;;;;;;;CAOpB;KACE,CAAC;IAEF,MAAM,YAAY,GAAgB;QAChC,QAAQ,EAAE,sBAAsB;QAChC,KAAK,EAAE,wBAAwB;QAC/B,SAAS,EAAE,0BAA0B;QACrC,gBAAgB,EACd,wSAAwS;QAC1S,OAAO,EAAE;;;;;;OAMN,MAAM;;;;SAIJ,MAAM;;;;;;;;;;;;CAYd;KACE,CAAC;IAEF,MAAM,SAAS,GAAgB;QAC7B,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,2DAA2D;QAClE,SAAS,EAAE,sBAAsB;QACjC,gBAAgB,EACd,kRAAkR;QACpR,OAAO,EAAE;;;;;;;;;;;;;;;;;OAiBN,MAAM;;;OAGN,MAAM;;;qDAGwC,MAAM;;;;OAIpD,MAAM;;;;;;;CAOZ;KACE,CAAC;IAEF,MAAM,KAAK,GAAgB;QACzB,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,4BAA4B;QACnC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;oCAwBuB,MAAM;CACzC;KACE,CAAC;IAEF,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AAC1E,CAAC;AAEY,QAAA,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AACtD,QAAA,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAEzD,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,UAAkB,EAAE,MAAc;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,qBAAa,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4DAA4D;AAC5D,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,OAAO,iBAAiB,CAAC,MAAM,CAAC;SAC7B,MAAM,CAAC,CAAC,GAAG,EAAwE,EAAE,CACpF,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAC/C;SACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,cAAc,GAAG,CAAC,SAAS,kBAAkB,GAAG,CAAC,gBAAgB,gDAAgD,GAAG,CAAC,OAAO,EAAE;KACxI,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,UAAkB,EAAE,MAAc;IACjE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../../src/core/project/workflows.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBH,8CAkPC;AAMD,8CASC;AAGD,4CASC;AAMD,4CASC;AAjTD,uCAAyB;AACzB,2CAA6B;AAoB7B,SAAgB,iBAAiB,CAAC,MAAc;IAC9C,MAAM,QAAQ,GAAgB;QAC5B,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,mCAAmC;QAC1C,SAAS,EAAE,sBAAsB;QACjC,gBAAgB,EACd,8PAA8P;QAChQ,OAAO,EAAE;;;;;;;;+BAQkB,MAAM;;;;;OAK9B,MAAM;;;;;;OAMN,MAAM;;;qDAGwC,MAAM;;;;;;;;;;;OAWpD,MAAM;;OAEN,MAAM;mCACsB,MAAM;;kBAEvB,MAAM;;;;;;;;;;;;CAYvB;KACE,CAAC;IAEF,MAAM,WAAW,GAAgB;QAC/B,QAAQ,EAAE,iBAAiB;QAC3B,KAAK,EAAE,iCAAiC;QACxC,SAAS,EAAE,yBAAyB;QACpC,gBAAgB,EACd,wSAAwS;QAC1S,OAAO,EAAE;;;;;;;;OAQN,MAAM;;;OAGN,MAAM;;cAEC,MAAM;eACL,MAAM;;;;;;CAMpB;KACE,CAAC;IAEF,MAAM,OAAO,GAAgB;QAC3B,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE,6DAA6D;QACpE,SAAS,EAAE,qBAAqB;QAChC,gBAAgB,EACd,4WAA4W;QAC9W,OAAO,EAAE;;;;;;;;;;;;;kCAaqB,MAAM;;;OAGjC,MAAM;;OAEN,MAAM;;;;;;;;;eASE,MAAM;;;;;;;CAOpB;KACE,CAAC;IAEF,MAAM,YAAY,GAAgB;QAChC,QAAQ,EAAE,sBAAsB;QAChC,KAAK,EAAE,wBAAwB;QAC/B,SAAS,EAAE,0BAA0B;QACrC,gBAAgB,EACd,sTAAsT;QACxT,OAAO,EAAE;;;;;;OAMN,MAAM;;;;;;SAMJ,MAAM;;;;;;;;;;;;CAYd;KACE,CAAC;IAEF,MAAM,SAAS,GAAgB;QAC7B,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,2DAA2D;QAClE,SAAS,EAAE,sBAAsB;QACjC,gBAAgB,EACd,kRAAkR;QACpR,OAAO,EAAE;;;;;;;;;;;;;;;;;OAiBN,MAAM;;;OAGN,MAAM;;;qDAGwC,MAAM;;;;OAIpD,MAAM;;;;;;;CAOZ;KACE,CAAC;IAEF,MAAM,KAAK,GAAgB;QACzB,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,4BAA4B;QACnC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;oCA0BuB,MAAM;CACzC;KACE,CAAC;IAEF,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AAC1E,CAAC;AAEY,QAAA,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AACtD,QAAA,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAEzD,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,UAAkB,EAAE,MAAc;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,qBAAa,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4DAA4D;AAC5D,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,OAAO,iBAAiB,CAAC,MAAM,CAAC;SAC7B,MAAM,CAAC,CAAC,GAAG,EAAwE,EAAE,CACpF,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAC/C;SACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,cAAc,GAAG,CAAC,SAAS,kBAAkB,GAAG,CAAC,gBAAgB,gDAAgD,GAAG,CAAC,OAAO,EAAE;KACxI,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,UAAkB,EAAE,MAAc;IACjE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/scaffold/auth-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-generator.d.ts","sourceRoot":"","sources":["../../../src/core/scaffold/auth-generator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEvH,KAAK,WAAW,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAElD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAgD9E;AAeD,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAe/E;AAED,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAU/E;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAmElF;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CA6ClF;AAMD,wBAAgB,kBAAkB,IAAI,MAAM,CA8B3C;AAMD,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,WAAW,GACpB,MAAM,CA+IR;AAMD,wBAAgB,mBAAmB,IAAI,MAAM,CAwE5C;AAMD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,WAAW,GACpB,MAAM,CA+HR;AAMD,wBAAgB,uBAAuB,IAAI,MAAM,CA+GhD;AAMD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,WAAW,GACpB,MAAM,CAiJR;AAMD,wBAAgB,uBAAuB,IAAI,MAAM,CAyEhD;AAMD,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAuChG;AAED,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAUtE;AAED,wBAAgB,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,CA+B1E;AAMD,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAoDzD;AAMD,wBAAgB,iBAAiB,IAAI,MAAM,CA0F1C;AAMD,wBAAgB,mBAAmB,IAAI,MAAM,CA0F5C;AAMD,wBAAgB,+BAA+B,IAAI,MAAM,CA+HxD;AA8GD,gFAAgF;AAChF,wBAAgB,kCAAkC,IAAI,MAAM,CAE3D;AAED,uFAAuF;AACvF,wBAAgB,uCAAuC,IAAI,MAAM,CAEhE;AAED,wBAAgB,uBAAuB,IAAI,MAAM,CAuBhD;AAMD,wBAAgB,4BAA4B,IAAI,MAAM,CAMrD;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CAWnD;AAED,wBAAgB,+BAA+B,IAAI,MAAM,CAIxD;AAED,wBAAgB,gCAAgC,IAAI,MAAM,CAoBzD;AAED,wBAAgB,+BAA+B,IAAI,MAAM,CAQxD;AAED,wBAAgB,6BAA6B,IAAI,MAAM,CAetD;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAQjD;AAED,wBAAgB,mCAAmC,IAAI,MAAM,CAAmV;AAChZ,wBAAgB,iCAAiC,IAAI,MAAM,CAA0sC;AACrwC,wBAAgB,4BAA4B,IAAI,MAAM,CAAwjB;AAC9mB,wBAAgB,mCAAmC,IAAI,MAAM,CAAwR;AACrV,wBAAgB,iCAAiC,IAAI,MAAM,CAAmoC;AAC9rC,wBAAgB,4BAA4B,IAAI,MAAM,CAAqoB;AAC3rB,wBAAgB,2BAA2B,IAAI,MAAM,CAwBpD;AAED,wBAAgB,2BAA2B,IAAI,MAAM,CA+CpD;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,UAAQ,GAAG,MAAM,CAEhE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,EAAE,QAAQ,CAAC,EAAE,YAAY,GAAG,MAAM,CAazH;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAepG;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAcpG"}
+{"version":3,"file":"auth-generator.d.ts","sourceRoot":"","sources":["../../../src/core/scaffold/auth-generator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEvH,KAAK,WAAW,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAElD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAgD9E;AAeD,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAe/E;AAED,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAU/E;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAkElF;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CA6ClF;AAMD,wBAAgB,kBAAkB,IAAI,MAAM,CA8B3C;AAMD,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,WAAW,GACpB,MAAM,CA+IR;AAMD,wBAAgB,mBAAmB,IAAI,MAAM,CAwE5C;AAMD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,WAAW,GACpB,MAAM,CA+HR;AAMD,wBAAgB,uBAAuB,IAAI,MAAM,CA+GhD;AAMD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,WAAW,GACpB,MAAM,CAiJR;AAMD,wBAAgB,uBAAuB,IAAI,MAAM,CAyEhD;AAMD,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAuChG;AAED,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAUtE;AAED,wBAAgB,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,CA+B1E;AAMD,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAoDzD;AAMD,wBAAgB,iBAAiB,IAAI,MAAM,CA0F1C;AAMD,wBAAgB,mBAAmB,IAAI,MAAM,CA0F5C;AAMD,wBAAgB,+BAA+B,IAAI,MAAM,CA+HxD;AA8GD,gFAAgF;AAChF,wBAAgB,kCAAkC,IAAI,MAAM,CAE3D;AAED,uFAAuF;AACvF,wBAAgB,uCAAuC,IAAI,MAAM,CAEhE;AAED,wBAAgB,uBAAuB,IAAI,MAAM,CAuBhD;AAMD,wBAAgB,4BAA4B,IAAI,MAAM,CAMrD;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CAWnD;AAED,wBAAgB,+BAA+B,IAAI,MAAM,CAIxD;AAED,wBAAgB,gCAAgC,IAAI,MAAM,CAoBzD;AAED,wBAAgB,+BAA+B,IAAI,MAAM,CAQxD;AAED,wBAAgB,6BAA6B,IAAI,MAAM,CAetD;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAQjD;AAED,wBAAgB,mCAAmC,IAAI,MAAM,CAAmV;AAChZ,wBAAgB,iCAAiC,IAAI,MAAM,CAA0sC;AACrwC,wBAAgB,4BAA4B,IAAI,MAAM,CAAwjB;AAC9mB,wBAAgB,mCAAmC,IAAI,MAAM,CAAwR;AACrV,wBAAgB,iCAAiC,IAAI,MAAM,CAAmoC;AAC9rC,wBAAgB,4BAA4B,IAAI,MAAM,CAAqoB;AAC3rB,wBAAgB,2BAA2B,IAAI,MAAM,CAwBpD;AAED,wBAAgB,2BAA2B,IAAI,MAAM,CA+CpD;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,UAAQ,GAAG,MAAM,CAEhE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,EAAE,QAAQ,CAAC,EAAE,YAAY,GAAG,MAAM,CAazH;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAepG;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAcpG"}

package/dist/core/scaffold/auth-generator.js

@@ -149,8 +149,7 @@ function generateNamedAuthRouterCSharp(config) {
 using System.Text;
 using System.Text.Json;
 using Microsoft.Azure.Functions.Worker.Http;
-using Functions.Auth.Schemes;
-namespace Functions.Auth;
+${externalCases ? "using Functions.Auth.Schemes;\n" : ""}namespace Functions.Auth;
 public record AuthPrincipal(string Subject, string Scheme, string Issuer, string[] Roles, IReadOnlyDictionary<string, object?> Claims)
 {
     [Obsolete("Use Subject")] public string UserId => Subject;
@@ -202,15 +201,15 @@ ${externalCases}
 function generateNamedAuthRouterPython(config) {
     const external = Object.entries(config.schemes).filter(([, s]) => s.provider === "external-token");
     const imports = external.map(([n]) => `from auth.schemes.${schemeSlug(n).replace(/-/g, "_")}.verifier import verify_external_token as verify_${safeIdentifier(n)}, ExternalTokenVerificationError as Error_${safeIdentifier(n)}`).join("\n");
-    const cases = external.map(([n], index) => `        ${index === 0 ? "if" : "elif"} scheme == ${JSON.stringify(n)}:
-            try:
-                value = verify_${safeIdentifier(n)}(bearer)
-            except Error_${safeIdentifier(n)} as exc:
-                raise AuthError(503 if exc.identity_provider_unavailable else 401, "Identity provider unavailable" if exc.identity_provider_unavailable else "Invalid token")
-            except Exception:
-                raise AuthError(503, "External token verifier unavailable")
-            if not value.get("subject") or not isinstance(value.get("roles"), list): raise AuthError(401, "Invalid external principal")
-            principal = {"subject": value["subject"], "scheme": scheme, "issuer": value.get("issuer", scheme), "roles": value["roles"], "claims": value.get("claims", {}), "userId": value["subject"]}`).join("\n");
+    const cases = external.map(([n], index) => `    ${index === 0 ? "if" : "elif"} scheme == ${JSON.stringify(n)}:
+        try:
+            value = verify_${safeIdentifier(n)}(bearer)
+        except Error_${safeIdentifier(n)} as exc:
+            raise AuthError(503 if exc.identity_provider_unavailable else 401, "Identity provider unavailable" if exc.identity_provider_unavailable else "Invalid token")
+        except Exception:
+            raise AuthError(503, "External token verifier unavailable")
+        if not value.get("subject") or not isinstance(value.get("roles"), list): raise AuthError(401, "Invalid external principal")
+        principal = {"subject": value["subject"], "scheme": scheme, "issuer": value.get("issuer", scheme), "roles": value["roles"], "claims": value.get("claims", {}), "userId": value["subject"]}`).join("\n");
     return `import base64
 import json
 import azure.functions as func
@@ -230,14 +229,14 @@ def require_auth(req: func.HttpRequest, policy_name: str):
     if len(candidates) != 1: raise AuthError(401, "Authentication required" if not candidates else "Ambiguous credentials")
     scheme = candidates[0]
 ${cases}
-        ${external.length ? "elif" : "if"} PROVIDERS[scheme] == "swa":
-            try:
-                value=json.loads(base64.b64decode(swa).decode("utf-8")); roles=[r for r in value.get("userRoles",[]) if isinstance(r,str)]
-                if not value.get("userId") or "authenticated" not in roles: raise ValueError()
-                if ALLOWED_PROVIDERS[scheme] and value.get("identityProvider") not in ALLOWED_PROVIDERS[scheme]: raise ValueError()
-                principal={"subject":value["userId"],"scheme":scheme,"issuer":"swa:"+value.get("identityProvider", "unknown"),"roles":roles,"claims":value,"userId":value["userId"]}
-            except Exception: raise AuthError(401,"Invalid SWA client principal")
-        else: raise AuthError(401,"Authentication adapter is not configured")
+    ${external.length ? "elif" : "if"} PROVIDERS[scheme] == "swa":
+        try:
+            value=json.loads(base64.b64decode(swa).decode("utf-8")); roles=[r for r in value.get("userRoles",[]) if isinstance(r,str)]
+            if not value.get("userId") or "authenticated" not in roles: raise ValueError()
+            if ALLOWED_PROVIDERS[scheme] and value.get("identityProvider") not in ALLOWED_PROVIDERS[scheme]: raise ValueError()
+            principal={"subject":value["userId"],"scheme":scheme,"issuer":"swa:"+value.get("identityProvider", "unknown"),"roles":roles,"claims":value,"userId":value["userId"]}
+        except Exception: raise AuthError(401,"Invalid SWA client principal")
+    else: raise AuthError(401,"Authentication adapter is not configured")
     require_roles(principal, policy.get("roles", [])); return principal
 def require_roles(principal, roles):
     if roles and not any(role in principal.get("roles",[]) for role in roles): raise AuthError(403,"Insufficient permissions")