swallowkit 2.0.0-alpha.4 → 2.0.0-alpha.5

package/src/__tests__/mcp.test.ts

@@ -8,6 +8,21 @@ const builtMcpEntrypoint = path.resolve(__dirname, "..", "..", "dist", "mcp", "i
 const itWhenBuiltEntrypointExists = fs.existsSync(builtMcpEntrypoint) ? it : it.skip;
 
 describe("SwallowKit MCP tool definitions", () => {
+  it("preserves blocked auth prerequisites and nextActions as structured MCP errors", async () => {
+    const nextActions = [{ command: "swallowkit machine plan auth --provider swa", description: "Configure auth first." }];
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({ ok: false, command: "plan-scaffold", status: "blocked",
+        error: { code: "auth-policy-without-auth", message: "Authentication is not configured." }, nextActions }),
+      stderr: "", exitCode: 1,
+    }));
+    const tool = buildSwallowKitToolDefinitions(runner).find(candidate => candidate.name === "swallowkit_plan_scaffold")!;
+    const result = await tool.handler({ model: "probe-item" });
+    expect(result.isError).toBe(true);
+    expect(JSON.parse(result.content[0].text)).toMatchObject({
+      status: "blocked", error: { code: "auth-policy-without-auth" }, nextActions,
+      metadata: { swallowkitVersion: expect.any(String) },
+    });
+  });
   it("delegates inspect_project to the machine CLI", async () => {
     const runner = jest.fn(async () => ({
       stdout: JSON.stringify({

package/src/__tests__/multi-auth.test.ts

@@ -1,6 +1,7 @@
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
+import { spawnSync } from "child_process";
 import { addAuthCommand } from "../cli/commands/add-auth";
 import { createUIAuthOptions } from "../cli/commands/scaffold";
 import {
@@ -9,12 +10,12 @@ import {
   generateNamedAuthRouterPython,
   generateNamedAuthRouterTS,
 } from "../core/scaffold/auth-generator";
-import { normalizeAuthConfig } from "../core/config";
+import { normalizeAuthConfig, validateConfig } from "../core/config";
 import { parseAuthPolicy } from "../core/scaffold/model-parser";
 import { createBasicModelInfo } from "./fixtures";
 import { generateCSharpAzureFunctionsCRUD, generateCompactAzureFunctionsCRUD, generatePythonAzureFunctionsCRUD } from "../core/scaffold/functions-generator";
 import { generateAuthLayout, generateNewPage } from "../core/scaffold/ui-generator";
-import { AuthConfig } from "../types";
+import { AuthConfig, SwallowKitConfig } from "../types";
 
 const namedAuthConfig: AuthConfig = {
   schemes: {
@@ -57,10 +58,24 @@ describe("named authentication routers", () => {
   it("generates valid branch structure for an SWA-only Python router", () => {
     const swaOnly = normalizeAuthConfig({ schemes: { admin: { provider: "swa", swa: { allowedProviders: ["github"] } } }, authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] } } } })!;
     const python = generateNamedAuthRouterPython(swaOnly);
-    expect(python).toContain('        if PROVIDERS[scheme] == "swa":');
-    expect(python).not.toContain('        elif PROVIDERS[scheme] == "swa":');
+    expect(python).toContain('\n    if PROVIDERS[scheme] == "swa":');
+    expect(python).not.toContain('\n    elif PROVIDERS[scheme] == "swa":');
     expect(python).toContain("ALLOWED_PROVIDERS");
     expect(generateNamedAuthRouterCSharp(swaOnly)).toContain("AllowedProviders[scheme]");
+    expect(generateNamedAuthRouterCSharp(swaOnly)).not.toContain("using Functions.Auth.Schemes;");
+  });
+
+  const pythonCommand = ["python3", "python"].find(command => spawnSync(command, ["--version"], { encoding: "utf-8" }).status === 0);
+  (pythonCommand ? it : it.skip).each([false, true])("compiles named Python auth router syntax (external schemes: %s)", (external) => {
+    const config = external ? auth : normalizeAuthConfig({
+      schemes: { admin: { provider: "swa" } },
+      authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] } } },
+    })!;
+    const result = spawnSync(pythonCommand!, ["-c", "import ast,sys; ast.parse(sys.stdin.read())"], {
+      encoding: "utf-8", input: generateNamedAuthRouterPython(config),
+    });
+    expect(result.stderr).toBe("");
+    expect(result.status).toBe(0);
   });
 
   it("emits Array.Empty<string>() instead of untyped new[] { } for empty C# arrays (CS0826)", () => {
@@ -157,4 +172,100 @@ describe("add-auth named scheme CLI", () => {
     new Function("module", content)(configModule);
     expect((configModule.exports as { auth: { schemes: { admin: { provider: string } } } }).auth.schemes.admin.provider).toBe("swa");
   });
+
+  it("writes named schemes to swallowkit.config.json when both config files exist (loadConfig precedence)", async () => {
+    const js = "module.exports = { backend: { language: 'typescript' } };\n";
+    fs.writeFileSync(path.join(root, "swallowkit.config.js"), js);
+    await addAuthCommand({ scheme: "admin", provider: "swa" });
+    expect(JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8")).auth.schemes.admin.provider).toBe("swa");
+    expect(fs.readFileSync(path.join(root, "swallowkit.config.js"), "utf-8")).toBe(js);
+  });
+
+  it.each(["json", "js"] as const)("disables auth in a %s config with an anonymous default that passes validation", async (format) => {
+    fs.rmSync(path.join(root, "swallowkit.config.json"));
+    if (format === "json") fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "typescript" } }));
+    else fs.writeFileSync(path.join(root, "swallowkit.config.js"), "module.exports = {\n  backend: { language: 'typescript' },\n}\n");
+    await addAuthCommand({ provider: "none" });
+    let config: SwallowKitConfig;
+    if (format === "json") {
+      config = JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8"));
+    } else {
+      const configModule = { exports: {} as SwallowKitConfig };
+      new Function("module", fs.readFileSync(path.join(root, "swallowkit.config.js"), "utf-8"))(configModule);
+      config = configModule.exports;
+    }
+    expect(config.auth).toMatchObject({ provider: "none", authorization: { defaultPolicy: "anonymous" } });
+    expect(validateConfig(config)).toEqual({ valid: true, errors: [] });
+  });
+
+  it("records single-provider auth in swallowkit.config.json instead of silently skipping it", async () => {
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "typescript" } }));
+    fs.mkdirSync(path.join(root, "app"), { recursive: true });
+    fs.writeFileSync(path.join(root, "app", "layout.tsx"), "export default function L({ children }: any) { return <html><body>{children}</body></html>; }\n");
+    await addAuthCommand({ provider: "swa", allowedProviders: ["github"] });
+    expect(JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8")).auth).toEqual({
+      provider: "swa",
+      swa: { allowedProviders: ["github"], roleSource: "swa-roles" },
+      authorization: { defaultPolicy: "authenticated" },
+    });
+  });
+
+  it.each(["typescript", "csharp", "python"] as const)("declares %s backend dependencies for a named custom-jwt scheme", async (language) => {
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language } }));
+    fs.mkdirSync(path.join(root, "functions"), { recursive: true });
+    if (language === "typescript") fs.writeFileSync(path.join(root, "functions", "package.json"), JSON.stringify({ name: "functions", dependencies: {} }));
+    if (language === "csharp") fs.writeFileSync(path.join(root, "functions", "App.Functions.csproj"), "<Project>\n  <ItemGroup>\n  </ItemGroup>\n</Project>\n");
+    if (language === "python") fs.writeFileSync(path.join(root, "functions", "requirements.txt"), "azure-functions\n");
+    await addAuthCommand({ scheme: "staff", provider: "custom-jwt" });
+    if (language === "typescript") {
+      expect(JSON.parse(fs.readFileSync(path.join(root, "functions", "package.json"), "utf-8")).dependencies).toEqual(expect.objectContaining({ jsonwebtoken: expect.any(String), bcryptjs: expect.any(String) }));
+    } else if (language === "csharp") {
+      const csproj = fs.readFileSync(path.join(root, "functions", "App.Functions.csproj"), "utf-8");
+      expect(csproj).toContain('Include="System.IdentityModel.Tokens.Jwt"');
+      expect(csproj).toContain('Include="BCrypt.Net-Next"');
+    } else {
+      expect(fs.readFileSync(path.join(root, "functions", "requirements.txt"), "utf-8")).toMatch(/PyJWT[\s\S]*bcrypt/);
+    }
+  });
+});
+
+describe("Python custom-jwt blueprint registration", () => {
+  const originalCwd = process.cwd();
+  let root: string;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-py-auth-"));
+    fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({ name: "fixture" }));
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "python" } }));
+    fs.mkdirSync(path.join(root, "shared"), { recursive: true });
+    fs.writeFileSync(path.join(root, "shared", "package.json"), JSON.stringify({ name: "@fixture/shared" }));
+    fs.mkdirSync(path.join(root, "functions"), { recursive: true });
+    fs.mkdirSync(path.join(root, "app"), { recursive: true });
+    fs.writeFileSync(path.join(root, "app", "layout.tsx"), "export default function L({ children }: any) { return <html><body>{children}</body></html>; }\n");
+    process.chdir(root);
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  const register = (body: string) => fs.writeFileSync(path.join(root, "functions", "function_app.py"), body);
+
+  it("imports the blueprint object the generated module actually defines", async () => {
+    register("import azure.functions as func\napp = func.FunctionApp()\n# SwallowKit scaffold registrations\n");
+    await addAuthCommand({ provider: "custom-jwt" });
+    const blueprint = fs.readFileSync(path.join(root, "functions", "blueprints", "auth.py"), "utf-8");
+    const app = fs.readFileSync(path.join(root, "functions", "function_app.py"), "utf-8");
+    expect(blueprint).toMatch(/^auth_bp = func\.Blueprint\(\)$/m);
+    expect(app).toContain("from blueprints.auth import auth_bp\napp.register_blueprint(auth_bp)");
+  });
+
+  it("repairs the broken import written by earlier releases without duplicating the registration", async () => {
+    register("import azure.functions as func\napp = func.FunctionApp()\nfrom blueprints.auth import bp as auth_bp\napp.register_blueprint(auth_bp)\n# SwallowKit scaffold registrations\n");
+    await addAuthCommand({ provider: "custom-jwt" });
+    const app = fs.readFileSync(path.join(root, "functions", "function_app.py"), "utf-8");
+    expect(app).not.toContain("import bp as auth_bp");
+    expect(app.match(/app\.register_blueprint\(auth_bp\)/g)).toHaveLength(1);
+  });
 });

package/src/__tests__/plan-apply.test.ts

@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import * as childProcess from "child_process";
+import * as ts from "typescript";
 import { EventEmitter } from "events";
 import { runMachineCli } from "../machine";
 import { getCSharpSchemaModelPath } from "../core/scaffold/native-schema-generator";
@@ -212,6 +213,7 @@ describe("plan / apply / drift / verify machine commands", () => {
       }),
       warnings: [],
     });
+
     expect(response.data.diagnostics).toEqual([]);
     expect(response.data.operations).toEqual(
       expect.arrayContaining([
@@ -230,6 +232,115 @@ describe("plan / apply / drift / verify machine commands", () => {
     ).toBe(true);
   });
 
+  it.each(["typescript", "csharp", "python"] as const)(
+    "blocks %s scaffold with an explicit authPolicy until authentication is configured",
+    async (language) => {
+      if (language === "typescript") createProjectFixture(tempDir);
+      else createNativeBackendFixture(tempDir, language);
+      fs.appendFileSync(path.join(tempDir, "shared", "models", "todo.ts"), "\nexport const authPolicy = { roles: ['admin'] };\n");
+      const reset = mockSuccessfulNativeCodegen();
+      try {
+        const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+        expect(plan.response).toMatchObject({
+          ok: false, status: "blocked", error: { code: "auth-policy-without-auth" },
+          nextActions: [expect.objectContaining({ command: expect.stringContaining("plan auth") })],
+        });
+        expect(fs.existsSync(path.join(tempDir, ".swallowkit", "state", "plans"))).toBe(false);
+        const generate = await runMachine(machineArgs("generate", "scaffold", "todo", "--api-only", "--skip-infra"));
+        expect(generate.response).toMatchObject({ ok: false, status: "blocked", error: { code: "auth-policy-without-auth" } });
+        expect(fs.existsSync(path.join(tempDir, "functions", "Crud"))).toBe(false);
+        expect(fs.readFileSync(path.join(tempDir, "shared", "index.ts"), "utf-8")).toBe("export {};\n");
+      } finally {
+        reset();
+      }
+    }
+  );
+
+  it("blocks an explicit role policy when the provider is none", async () => {
+    createProjectFixture(tempDir);
+    fs.unlinkSync(path.join(tempDir, "swallowkit.config.js"));
+    writeFile(path.join(tempDir, "swallowkit.config.json"), JSON.stringify({ auth: { provider: "none" } }));
+    fs.appendFileSync(path.join(tempDir, "shared", "models", "todo.ts"), "\nexport const authPolicy = { roles: ['admin'] };\n");
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.response).toMatchObject({ status: "blocked", error: { code: "auth-policy-without-auth" } });
+  });
+
+  it("appends a manually authored model export during plan/apply scaffold without duplicating it", async () => {
+    createProjectFixture(tempDir);
+    const indexPath = path.join(tempDir, "shared", "index.ts");
+    const originalIndex = "// Custom exports are preserved.\nexport {};\n";
+    fs.writeFileSync(indexPath, originalIndex);
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.response.data.operations).toContainEqual(expect.objectContaining({
+      path: "shared/index.ts", action: "append", ownership: "extension-point", conflict: false,
+    }));
+    expect(fs.readFileSync(indexPath, "utf-8")).toBe(originalIndex);
+    const apply = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+    expect(apply.response.ok).toBe(true);
+    expect(fs.readFileSync(indexPath, "utf-8")).toBe(`${originalIndex}export { Todo } from './models/todo';\n`);
+    const repeat = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(repeat.response.data.operations.filter((op: { path: string; action: string }) =>
+      op.path === "shared/index.ts" && op.action !== "skip")).toEqual([]);
+  });
+
+  it.each<["typescript" | "csharp" | "python", "nextjs" | "react"]>([
+    ["typescript", "nextjs"], ["csharp", "react"], ["python", "react"],
+  ])("validates auth prerequisites in %s/%s before plan and apply", async (language, frontend) => {
+    if (language === "typescript") createProjectFixture(tempDir);
+    else createNativeBackendFixture(tempDir, language);
+    fs.unlinkSync(path.join(tempDir, "swallowkit.config.js"));
+    const configPath = path.join(tempDir, "swallowkit.config.json");
+    const config = { backend: { language }, frontend: { framework: frontend },
+      auth: { schemes: { admin: { provider: "swa" } }, authorization: {
+        defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"], roles: ["admin"] } },
+      } },
+    };
+    writeFile(configPath, JSON.stringify(config));
+    const modelPath = path.join(tempDir, "shared", "models", "todo.ts");
+    writeFile(modelPath, `${createModelSource("Todo")}\nexport const authPolicy = { roles: ['admin'] };`);
+    const reset = mockSuccessfulNativeCodegen();
+    try {
+      const invalid = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+      expect(invalid.response).toMatchObject({ status: "blocked", error: { code: "auth-policy-requires-named-policy" } });
+      writeFile(modelPath, `${createModelSource("Todo")}\nexport const authPolicy = { policy: 'adminOnly' };`);
+      const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+      expect(plan.response.status).toBe("complete");
+      writeFile(configPath, JSON.stringify({ ...config, auth: undefined }));
+      const stale = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+      expect(stale.response).toMatchObject({ status: "blocked", error: { code: "stale-plan" } });
+      const direct = await runMachine(machineArgs("apply", "scaffold", "todo", "--api-only", "--skip-infra"));
+      expect(direct.response).toMatchObject({ status: "blocked", error: { code: "auth-policy-without-auth" } });
+      expect(fs.readFileSync(path.join(tempDir, "shared", "index.ts"), "utf-8")).toBe("export {};\n");
+    } finally { reset(); }
+  });
+
+  it.each([
+    ['export { Todo } from "./models/todo";\n', false],
+    ["export * from './models/todo';\n", false],
+    ["export type { Todo } from './models/todo';\n", true],
+    ["export type { Todo, displayName } from './models/todo';\n", true],
+    ["export { type Todo } from './models/todo';\n", true],
+    ["export { Todo as MyTodo } from './models/todo';", true],
+  ])("preserves existing exports and handles syntax variations: %s", async (content, append) => {
+    createProjectFixture(tempDir);
+    const indexPath = path.join(tempDir, "shared", "index.ts");
+    fs.writeFileSync(indexPath, content);
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.response.data.operations.some((op: { path: string; action: string }) =>
+      op.path === "shared/index.ts" && op.action === "append")).toBe(append);
+    expect(fs.readFileSync(indexPath, "utf-8")).toBe(content);
+
+    const apply = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+    expect(apply.response.ok).toBe(true);
+    // The shared package must still compile: no duplicate Todo binding, and Todo is usable as a value.
+    writeFile(path.join(tempDir, "shared", "consumer.ts"), "import { Todo } from './index';\nexport const parsed: Todo = Todo.parse({ id: '1', name: 'x' });\n");
+    const program = ts.createProgram([indexPath, path.join(tempDir, "shared", "consumer.ts")], {
+      strict: true, noEmit: true, skipLibCheck: true, module: ts.ModuleKind.ESNext, target: ts.ScriptTarget.ES2020,
+      moduleResolution: ts.ModuleResolutionKind.Bundler,
+    });
+    expect(ts.getPreEmitDiagnostics(program).map((d) => ts.flattenDiagnosticMessageText(d.messageText, "\n"))).toEqual([]);
+  });
+
   it("updates a ledger-unregistered legacy manifest without approval and preserves baseline identity", async () => {
     createProjectFixture(tempDir);
     createInfrastructureFixture(tempDir);

package/src/cli/commands/add-auth.ts

@@ -428,7 +428,7 @@ export async function addAuthCommand(options: AddAuthOptions) {
 
   // 10. Install dependencies
   console.log("\n Installing auth dependencies...");
-  await installAuthDependencies(cwd, backendLanguage, rdbProvider, session);
+  installAuthDependenciesSync(cwd, backendLanguage, rdbProvider, session);
   await finalize();
 
   console.log("\n Authentication setup complete!");
@@ -458,7 +458,8 @@ function findObjectEnd(content: string, open: number): number {
 function updateConfigWithNamedScheme(cwd: string, scheme: string, provider: AuthProvider, session: FileOperationSession, allowedProviders?: string[]): void {
   const jsPath = path.join(cwd, "swallowkit.config.js");
   const jsonPath = path.join(cwd, "swallowkit.config.json");
-  const configPath = session.fileExists(jsPath) ? jsPath : jsonPath;
+  // Match loadConfig precedence: swallowkit.config.json wins when both files exist.
+  const configPath = session.fileExists(jsonPath) ? jsonPath : jsPath;
   if (!session.fileExists(configPath)) throw new Error("swallowkit.config.js or swallowkit.config.json is required");
   const swaProviders = provider === "swa" ? normalizeSwaProviders(allowedProviders) : undefined;
   if (configPath.endsWith(".json")) {
@@ -510,6 +511,11 @@ function addNamedScheme(cwd: string, scheme: string, provider: AuthProvider, lan
   // Validate/update config before creating files, so duplicate names stop safely.
   updateConfigWithNamedScheme(cwd, scheme, provider, session, allowedProviders);
   const slug = scheme.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").toLowerCase();
+  if (provider === "custom-jwt") {
+    // The scheme's JWT helper needs the same token/password/driver packages as single-provider custom-jwt.
+    const connector = getConnectorDefinition(defaultCustomJwtConfig().userConnector) as RdbConnectorConfig | undefined;
+    installAuthDependenciesSync(cwd, language, connector?.provider ?? "mysql", session);
+  }
   if (language === "typescript") {
     const dir = path.join(cwd, "functions", "src", "auth", "schemes", slug);
     if (provider === "external-token") writeIfMissing(session, path.join(dir, "verifier.ts"), generateExternalTokenVerifierTS());
@@ -689,9 +695,14 @@ function generateFunctionsAuth(
     const functionAppPath = path.join(functionsDir, "function_app.py");
     if (session.fileExists(functionAppPath)) {
       const content = session.readFile(functionAppPath);
-      const authImport = "from blueprints.auth import bp as auth_bp";
+      const authImport = "from blueprints.auth import auth_bp";
       const authRegister = "app.register_blueprint(auth_bp)";
-      if (!content.includes(authImport)) {
+      // Earlier releases imported a non-existent `bp`; repair it in place when re-running.
+      const legacyImport = "from blueprints.auth import bp as auth_bp";
+      if (content.includes(legacyImport)) {
+        session.writeFile(functionAppPath, content.replace(legacyImport, authImport), extensionMeta);
+        console.log(` Updated: functions/function_app.py (fixed auth blueprint import)`);
+      } else if (!content.includes(authImport)) {
         const marker = "# SwallowKit scaffold registrations";
         if (content.includes(marker)) {
           const updated = content.replace(
@@ -742,6 +753,24 @@ function generateBFFAuth(cwd: string, projectName: string, sharedPackageName: st
 }
 
 function updateConfigWithAuth(cwd: string, provider: AuthProvider, config: CustomJwtConfig, session: FileOperationSession, allowedProviders?: string[]): void {
+  const jsonPath = path.join(cwd, "swallowkit.config.json");
+  if (session.fileExists(jsonPath)) {
+    // loadConfig reads swallowkit.config.json first, so it is the effective configuration.
+    const value = JSON.parse(session.readFile(jsonPath));
+    if (value.auth) {
+      console.log("  'auth' section already exists in swallowkit.config.json");
+      return;
+    }
+    value.auth = {
+      provider,
+      ...(provider === "custom-jwt" ? { customJwt: { ...config, jwtSecretEnv: config.jwtSecretEnv || "JWT_SECRET", tokenExpiry: config.tokenExpiry || "24h" } } : {}),
+      ...(provider === "swa" ? { swa: { allowedProviders: normalizeSwaProviders(allowedProviders), roleSource: "swa-roles" } } : {}),
+      authorization: { defaultPolicy: provider === "none" ? "anonymous" : "authenticated" },
+    };
+    session.writeFile(jsonPath, JSON.stringify(value, null, 2) + "\n", extensionMeta);
+    console.log(` Updated: swallowkit.config.json`);
+    return;
+  }
   const configPath = path.join(cwd, "swallowkit.config.js");
   if (!session.fileExists(configPath)) {
     console.warn("  swallowkit.config.js not found. Please add auth config manually.");
@@ -786,7 +815,8 @@ function updateConfigWithAuth(cwd: string, provider: AuthProvider, config: Custo
     provider: '${provider}',
 ${providerSettings}
     authorization: {
-      defaultPolicy: 'authenticated',
+      // Disabled auth has no scheme to authenticate against; 'authenticated' would fail validateConfig.
+      defaultPolicy: '${provider === "none" ? "anonymous" : "authenticated"}',
     },
   },
 `;
@@ -821,7 +851,7 @@ function updateEnvironmentFiles(cwd: string, session: FileOperationSession): voi
   }
 }
 
-async function installAuthDependencies(cwd: string, backendLanguage: BackendLanguage, provider: "mysql" | "postgres" | "sqlserver" = "mysql", session: FileOperationSession): Promise<void> {
+function installAuthDependenciesSync(cwd: string, backendLanguage: BackendLanguage, provider: "mysql" | "postgres" | "sqlserver" = "mysql", session: FileOperationSession): void {
   if (backendLanguage === "typescript") {
     const funcPkgPath = path.join(cwd, "functions", "package.json");
     if (session.fileExists(funcPkgPath)) {

package/src/cli/commands/init.ts

@@ -1,4 +1,4 @@
-import * as fs from "fs";
+import * as fs from "fs";
 import * as path from "path";
 import { spawn, execSync } from "child_process";
 import prompts from "prompts";
@@ -1214,7 +1214,7 @@ export async function register() {
   createAiAgentFiles(projectDir, projectName, backendLanguage, pm, frontend);
 }
 
-async function createSharedPackage(projectDir: string, projectName: string) {
+export async function createSharedPackage(projectDir: string, projectName: string) {
   console.log('📦 Creating shared workspace package for Zod models...\n');
 
   const sharedDir = path.join(projectDir, 'shared');
@@ -1254,7 +1254,7 @@ async function createSharedPackage(projectDir: string, projectName: string) {
   // shared/index.ts (empty re-export file, scaffold will add entries)
   fs.writeFileSync(
     path.join(sharedDir, 'index.ts'),
-    `// Shared Zod models — auto-managed by SwallowKit scaffold command\n// Do not edit the export list below manually\n`
+    `// Shared Zod models. SwallowKit create-model/scaffold append missing model exports.\n// You may add exports manually; existing exports and comments are preserved. No managed markers.\n`
   );
 
   // shared/.gitignore
@@ -1266,7 +1266,7 @@ async function createSharedPackage(projectDir: string, projectName: string) {
   console.log('✅ Shared package created\n');
 }
 
-async function createAzureFunctionsProject(
+export async function createAzureFunctionsProject(
   projectDir: string,
   pm: PackageManager = 'pnpm',
   backendLanguage: BackendLanguage = 'typescript'

package/src/cli/commands/scaffold.ts

@@ -54,6 +54,7 @@ import {
 } from "../../core/operations/file-session";
 import { generateModelContainerMigration } from "../../core/operations/migration-generator";
 import { recordSessionOperations } from "../../core/project/artifacts";
+import { updateSharedIndex } from "../../core/operations/create-model";
 
 const SCAFFOLD_GENERATOR = "scaffold";
 
@@ -158,6 +159,11 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
     session.setSchemaAnalysis(schemaAnalysis);
     console.log(`✅ Model parsed: ${modelInfo.name} (${modelInfo.schemaName})`);
 
+    // Validate policy prerequisites before any generated artifacts are written.
+    resolveAuthPolicy(modelInfo, getAuthConfig());
+    for (const configName of ["swallowkit.config.js", "swallowkit.config.json", ".swallowkitrc.json"]) {
+      session.registerInput(path.join(process.cwd(), configName));
+    }
     const userScopeWarning = buildUserScopedDataWarning(modelInfo, getAuthConfig());
     if (userScopeWarning) {
       session.addWarning(userScopeWarning);
@@ -217,6 +223,8 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
       console.log("ℹ️  --api-only skips UI generation only; Functions, BFF routes, OpenAPI, and native schema assets are still updated.");
     }
 
+    updateSharedIndex(modelPath, modelInfo.schemaName, session);
+
     // 5. Generate BFF callFunction helper
     await generateCallFunctionHelper(session, apiDir);
 
@@ -332,10 +340,43 @@ function applyExternalTokenFetchToGeneratedUi(modelInfo: ModelInfo, session: Fil
 export function resolveAuthPolicy(modelInfo: ModelInfo, authConfig: AuthConfig | undefined): ModelAuthPolicy | undefined {
   // モデルに明示的な authPolicy がある場合はそれを使用
   if (modelInfo.authPolicy) {
+    if (!isAuthenticationConfigured(authConfig)) {
+      throw new MachineCommandError(
+        "auth-policy-without-auth",
+        `Model '${modelInfo.name}' declares authPolicy, but authentication is not configured. No artifacts were written. Run plan auth and apply auth before scaffolding this model.`,
+        { model: modelInfo.name },
+        "blocked",
+        [{
+          command: "swallowkit machine plan auth --provider <custom-jwt|swa|external-token>",
+          description: "Choose an authentication provider, review and apply its plan, then re-plan scaffold.",
+        }]
+      );
+    }
     const normalized = normalizeAuthConfig(authConfig);
+    const usesNamedPolicy = Boolean(modelInfo.authPolicy.policy ||
+      typeof modelInfo.authPolicy.read === "string" || typeof modelInfo.authPolicy.write === "string");
+    // Guards resolve each operation independently: a string selects the named router, an array (or
+    // the roles fallback) selects the single-provider helper. Named schemes only have the router.
+    const operationIsNamed = (selected: string | string[] | undefined) =>
+      typeof selected === "string" || (selected === undefined && Boolean(modelInfo.authPolicy!.policy));
+    const everyOperationNamed = operationIsNamed(modelInfo.authPolicy.read) && operationIsNamed(modelInfo.authPolicy.write) &&
+      !modelInfo.authPolicy.roles;
+    if (authConfig?.schemes && !authConfig.provider && !everyOperationNamed) {
+      throw new MachineCommandError(
+        "auth-policy-requires-named-policy",
+        `Model '${modelInfo.name}' declares an authPolicy whose read or write operation does not resolve to a named policy, but authentication uses named schemes. Use authPolicy = { policy: '<name>' } or name both read and write policies (role arrays are not supported with named schemes); no artifacts were written.`,
+        { model: modelInfo.name },
+        "blocked",
+        [{
+          command: "swallowkit machine inspect capabilities",
+          description: "Define a named authorization policy selecting the required schemes/roles, reference it from the model, then re-plan scaffold.",
+        }]
+      );
+    }
     for (const policyName of [modelInfo.authPolicy.policy, typeof modelInfo.authPolicy.read === 'string' ? modelInfo.authPolicy.read : undefined, typeof modelInfo.authPolicy.write === 'string' ? modelInfo.authPolicy.write : undefined].filter((value): value is string => Boolean(value))) {
       if (!normalized?.authorization.policies[policyName]) throw new Error(`Model '${modelInfo.name}' references undefined auth policy '${policyName}'. Define auth.authorization.policies.${policyName}.`);
     }
+    if (usesNamedPolicy) assertNamedSchemesConfigured(modelInfo.name, "authPolicy", authConfig);
     return modelInfo.authPolicy;
   }
 
@@ -350,12 +391,35 @@ export function resolveAuthPolicy(modelInfo: ModelInfo, authConfig: AuthConfig |
     return {}; // 空のポリシー = 認証のみ、ロール制限なし
   }
 
-  if (defaultPolicy !== 'anonymous') return { policy: defaultPolicy };
+  if (defaultPolicy !== 'anonymous') {
+    assertNamedSchemesConfigured(modelInfo.name, `auth.authorization.defaultPolicy '${defaultPolicy}'`, authConfig);
+    return { policy: defaultPolicy };
+  }
 
   // defaultPolicy が 'anonymous' なら認証不要
   return undefined;
 }
 
+/**
+ * Named authorization policies are enforced by the generated multi-scheme router and scheme-specific
+ * client contexts, which exist only for named auth.schemes. A single-provider configuration
+ * (auth.provider) has no router, so referencing a named policy would generate code that cannot build.
+ */
+function assertNamedSchemesConfigured(modelName: string, source: string, authConfig: AuthConfig | undefined): void {
+  if (Object.keys(authConfig?.schemes ?? {}).some((name) => name !== "default")) return;
+  throw new MachineCommandError(
+    "auth-named-policy-requires-named-scheme",
+    `Model '${modelName}' uses a named authorization policy via ${source}, but authentication is configured with a single auth.provider. ` +
+      `Named policies require named auth.schemes; no artifacts were written. Use role lists (authPolicy = { roles: [...] } or read/write role arrays) with auth.provider, or add a named scheme.`,
+    { model: modelName, source },
+    "blocked",
+    [{
+      command: "swallowkit machine plan auth --provider <swa|external-token|custom-jwt> --scheme <name>",
+      description: "Add a named scheme and reference it from auth.authorization.policies, or switch the model to role lists; then re-plan scaffold.",
+    }]
+  );
+}
+
 /**
  * モデルファイルのパスを解決
  */

package/src/cli/index.ts

@@ -223,8 +223,8 @@ export function createProgram(devCommandOverride: Command = devCommand): Command
 
   program
     .command("verify")
-    .description("Run verification checks (structure, drift, typecheck)")
-    .option("--checks <ids>", "Comma-separated check ids to run (structure,drift,typecheck)")
+    .description("Run verification checks (structure, drift, typecheck, backend-build)")
+    .option("--checks <ids>", "Comma-separated check ids (structure,drift,typecheck,backend-build,build,lint,test); quote CSV values in PowerShell")
     .action(async (options) => {
       await runVerifyCommand({ checks: options.checks });
     });

package/src/core/operations/create-model.ts

@@ -1,4 +1,5 @@
 import * as path from "path";
+import * as ts from "typescript";
 import { ensureSwallowKitProject, loadConfig } from "../config";
 import { toPascalCase } from "../scaffold/model-parser";
 import { syncProjectManifest } from "../project/manifest";
@@ -90,21 +91,58 @@ export const connectorConfig = {
 `;
 }
 
-function updateSharedIndex(kebabName: string, pascalName: string, session: FileOperationSession): boolean {
+export function updateSharedIndex(modelPath: string, schemaName: string, session: FileOperationSession): boolean {
   const indexPath = path.join(process.cwd(), "shared", "index.ts");
-
-  if (!session.fileExists(indexPath)) {
-    return false;
+  session.registerInput(indexPath);
+  const content = session.fileExists(indexPath) ? session.readFile(indexPath) : "";
+  const modulePath = `./${path.relative(path.dirname(indexPath), modelPath).replace(/\\/g, "/").replace(/\.ts$/, "")}`;
+  const source = ts.createSourceFile(indexPath, content, ts.ScriptTarget.Latest, true);
+  // Text edits that turn a type-only re-export of this schema into nothing (a value export of the same
+  // name also exports its type); keeping both would be a duplicate-identifier error.
+  const edits: Array<{ start: number; end: number; text: string }> = [];
+  let hasValueExport = false;
+  for (const statement of source.statements) {
+    if (!ts.isExportDeclaration(statement) || !statement.moduleSpecifier || !ts.isStringLiteral(statement.moduleSpecifier)) continue;
+    const exportedPath = statement.moduleSpecifier.text.replace(/\.(ts|js)$/, "");
+    if (exportedPath !== modulePath) continue;
+    if (!statement.exportClause) {
+      if (!statement.isTypeOnly) hasValueExport = true;
+      continue;
+    }
+    if (!ts.isNamedExports(statement.exportClause)) continue;
+    const elements = statement.exportClause.elements;
+    const matches = elements.filter((element) =>
+      element.name.text === schemaName && (element.propertyName?.text ?? element.name.text) === schemaName);
+    for (const element of matches) {
+      if (!statement.isTypeOnly && !element.isTypeOnly) {
+        hasValueExport = true;
+      } else if (!statement.isTypeOnly) {
+        // export { type Todo } -> export { Todo }
+        edits.push({ start: element.getStart(source), end: element.getEnd(), text: schemaName });
+        hasValueExport = true;
+      } else if (elements.length === 1) {
+        let end = statement.getEnd();
+        if (content.slice(end, end + 2) === "\r\n") end += 2;
+        else if (content[end] === "\n") end += 1;
+        edits.push({ start: statement.getStart(source), end, text: "" });
+      } else {
+        const index = elements.indexOf(element);
+        const start = index === 0 ? element.getStart(source) : elements[index - 1].getEnd();
+        const end = index === 0 ? elements[index + 1].getStart(source) : element.getEnd();
+        edits.push({ start, end, text: "" });
+      }
+    }
   }
-
-  const content = session.readFile(indexPath);
-  const exportLine = `export { ${pascalName} } from './models/${kebabName}';`;
-
-  if (content.includes(exportLine)) {
-    return false;
+  let updated = content;
+  for (const edit of edits.sort((left, right) => right.start - left.start)) {
+    updated = `${updated.slice(0, edit.start)}${edit.text}${updated.slice(edit.end)}`;
   }
-
-  session.writeFile(indexPath, `${content}${exportLine}\n`, {
+  if (hasValueExport && updated === content) return false;
+  if (!hasValueExport) {
+    const exportLine = `export { ${schemaName} } from '${modulePath}';`;
+    updated = `${updated}${updated && !updated.endsWith("\n") ? "\n" : ""}${exportLine}\n`;
+  }
+  session.writeFile(indexPath, updated, {
     ownership: "extension-point",
     generator: CREATE_MODEL_GENERATOR,
   });
@@ -172,7 +210,7 @@ export async function createModelOperation(options: CreateModelOperationOptions)
     });
     createdFiles.push(filePath.replace(/\\/g, "/"));
 
-    if (updateSharedIndex(kebabName, pascalName, session)) {
+    if (updateSharedIndex(resolveFromRoot(filePath), pascalName, session)) {
       updatedIndex = true;
     }
   }