swallowkit 2.0.0-alpha.4 → 2.0.0-alpha.6

package/src/cli/commands/add-auth.ts

@@ -428,7 +428,7 @@ export async function addAuthCommand(options: AddAuthOptions) {
 
   // 10. Install dependencies
   console.log("\n Installing auth dependencies...");
-  await installAuthDependencies(cwd, backendLanguage, rdbProvider, session);
+  installAuthDependenciesSync(cwd, backendLanguage, rdbProvider, session);
   await finalize();
 
   console.log("\n Authentication setup complete!");
@@ -458,7 +458,8 @@ function findObjectEnd(content: string, open: number): number {
 function updateConfigWithNamedScheme(cwd: string, scheme: string, provider: AuthProvider, session: FileOperationSession, allowedProviders?: string[]): void {
   const jsPath = path.join(cwd, "swallowkit.config.js");
   const jsonPath = path.join(cwd, "swallowkit.config.json");
-  const configPath = session.fileExists(jsPath) ? jsPath : jsonPath;
+  // Match loadConfig precedence: swallowkit.config.json wins when both files exist.
+  const configPath = session.fileExists(jsonPath) ? jsonPath : jsPath;
   if (!session.fileExists(configPath)) throw new Error("swallowkit.config.js or swallowkit.config.json is required");
   const swaProviders = provider === "swa" ? normalizeSwaProviders(allowedProviders) : undefined;
   if (configPath.endsWith(".json")) {
@@ -510,6 +511,11 @@ function addNamedScheme(cwd: string, scheme: string, provider: AuthProvider, lan
   // Validate/update config before creating files, so duplicate names stop safely.
   updateConfigWithNamedScheme(cwd, scheme, provider, session, allowedProviders);
   const slug = scheme.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").toLowerCase();
+  if (provider === "custom-jwt") {
+    // The scheme's JWT helper needs the same token/password/driver packages as single-provider custom-jwt.
+    const connector = getConnectorDefinition(defaultCustomJwtConfig().userConnector) as RdbConnectorConfig | undefined;
+    installAuthDependenciesSync(cwd, language, connector?.provider ?? "mysql", session);
+  }
   if (language === "typescript") {
     const dir = path.join(cwd, "functions", "src", "auth", "schemes", slug);
     if (provider === "external-token") writeIfMissing(session, path.join(dir, "verifier.ts"), generateExternalTokenVerifierTS());
@@ -689,9 +695,14 @@ function generateFunctionsAuth(
     const functionAppPath = path.join(functionsDir, "function_app.py");
     if (session.fileExists(functionAppPath)) {
       const content = session.readFile(functionAppPath);
-      const authImport = "from blueprints.auth import bp as auth_bp";
+      const authImport = "from blueprints.auth import auth_bp";
       const authRegister = "app.register_blueprint(auth_bp)";
-      if (!content.includes(authImport)) {
+      // Earlier releases imported a non-existent `bp`; repair it in place when re-running.
+      const legacyImport = "from blueprints.auth import bp as auth_bp";
+      if (content.includes(legacyImport)) {
+        session.writeFile(functionAppPath, content.replace(legacyImport, authImport), extensionMeta);
+        console.log(` Updated: functions/function_app.py (fixed auth blueprint import)`);
+      } else if (!content.includes(authImport)) {
         const marker = "# SwallowKit scaffold registrations";
         if (content.includes(marker)) {
           const updated = content.replace(
@@ -742,6 +753,24 @@ function generateBFFAuth(cwd: string, projectName: string, sharedPackageName: st
 }
 
 function updateConfigWithAuth(cwd: string, provider: AuthProvider, config: CustomJwtConfig, session: FileOperationSession, allowedProviders?: string[]): void {
+  const jsonPath = path.join(cwd, "swallowkit.config.json");
+  if (session.fileExists(jsonPath)) {
+    // loadConfig reads swallowkit.config.json first, so it is the effective configuration.
+    const value = JSON.parse(session.readFile(jsonPath));
+    if (value.auth) {
+      console.log("  'auth' section already exists in swallowkit.config.json");
+      return;
+    }
+    value.auth = {
+      provider,
+      ...(provider === "custom-jwt" ? { customJwt: { ...config, jwtSecretEnv: config.jwtSecretEnv || "JWT_SECRET", tokenExpiry: config.tokenExpiry || "24h" } } : {}),
+      ...(provider === "swa" ? { swa: { allowedProviders: normalizeSwaProviders(allowedProviders), roleSource: "swa-roles" } } : {}),
+      authorization: { defaultPolicy: provider === "none" ? "anonymous" : "authenticated" },
+    };
+    session.writeFile(jsonPath, JSON.stringify(value, null, 2) + "\n", extensionMeta);
+    console.log(` Updated: swallowkit.config.json`);
+    return;
+  }
   const configPath = path.join(cwd, "swallowkit.config.js");
   if (!session.fileExists(configPath)) {
     console.warn("  swallowkit.config.js not found. Please add auth config manually.");
@@ -786,7 +815,8 @@ function updateConfigWithAuth(cwd: string, provider: AuthProvider, config: Custo
     provider: '${provider}',
 ${providerSettings}
     authorization: {
-      defaultPolicy: 'authenticated',
+      // Disabled auth has no scheme to authenticate against; 'authenticated' would fail validateConfig.
+      defaultPolicy: '${provider === "none" ? "anonymous" : "authenticated"}',
     },
   },
 `;
@@ -821,7 +851,7 @@ function updateEnvironmentFiles(cwd: string, session: FileOperationSession): voi
   }
 }
 
-async function installAuthDependencies(cwd: string, backendLanguage: BackendLanguage, provider: "mysql" | "postgres" | "sqlserver" = "mysql", session: FileOperationSession): Promise<void> {
+function installAuthDependenciesSync(cwd: string, backendLanguage: BackendLanguage, provider: "mysql" | "postgres" | "sqlserver" = "mysql", session: FileOperationSession): void {
   if (backendLanguage === "typescript") {
     const funcPkgPath = path.join(cwd, "functions", "package.json");
     if (session.fileExists(funcPkgPath)) {

package/src/cli/commands/init.ts

@@ -1,4 +1,4 @@
-import * as fs from "fs";
+import * as fs from "fs";
 import * as path from "path";
 import { spawn, execSync } from "child_process";
 import prompts from "prompts";
@@ -1214,7 +1214,7 @@ export async function register() {
   createAiAgentFiles(projectDir, projectName, backendLanguage, pm, frontend);
 }
 
-async function createSharedPackage(projectDir: string, projectName: string) {
+export async function createSharedPackage(projectDir: string, projectName: string) {
   console.log('📦 Creating shared workspace package for Zod models...\n');
 
   const sharedDir = path.join(projectDir, 'shared');
@@ -1254,7 +1254,7 @@ async function createSharedPackage(projectDir: string, projectName: string) {
   // shared/index.ts (empty re-export file, scaffold will add entries)
   fs.writeFileSync(
     path.join(sharedDir, 'index.ts'),
-    `// Shared Zod models — auto-managed by SwallowKit scaffold command\n// Do not edit the export list below manually\n`
+    `// Shared Zod models. SwallowKit create-model/scaffold append missing model exports.\n// You may add exports manually; existing exports and comments are preserved. No managed markers.\n`
   );
 
   // shared/.gitignore
@@ -1266,7 +1266,7 @@ async function createSharedPackage(projectDir: string, projectName: string) {
   console.log('✅ Shared package created\n');
 }
 
-async function createAzureFunctionsProject(
+export async function createAzureFunctionsProject(
   projectDir: string,
   pm: PackageManager = 'pnpm',
   backendLanguage: BackendLanguage = 'typescript'

package/src/cli/commands/provision.ts

@@ -3,10 +3,15 @@ import prompts from "prompts";
 import { ensureSwallowKitProject } from "../../core/config";
 import {
   INTERACTIVE_PROVISION_RETRY_HINT,
+  ApplyProvisionResult,
   ProvisionPlanData,
+  applyProvisionOperation,
   executeProvisionPlan,
+  inspectProvisionOperation,
   planProvisionOperation,
 } from "../../core/operations/provision-operations";
+import { MachineCommandError } from "../../machine/errors";
+import { formatAzureDiagnostic } from "../../utils/azure-diagnostics";
 
 export function describeProvisionAction(plan: Pick<ProvisionPlanData, "mode" | "resourceGroup" | "location" | "pendingMigrations">): string {
   switch (plan.mode) {
@@ -18,6 +23,8 @@ export function describeProvisionAction(plan: Pick<ProvisionPlanData, "mode" | "
       return `The existing resource group ${plan.resourceGroup} will be recorded as SwallowKit baseline 0. Nothing will be deployed.`;
     case "reconcile":
       return `infra/main.bicep will be redeployed to ${plan.resourceGroup}. Template-managed settings may be reset.`;
+    case "recover":
+      return `The existing baseline deployment in ${plan.resourceGroup} will be observed and its migration tag/ledger completed after Azure Succeeded. Bicep will not be submitted again.`;
     default:
       return `Resource group ${plan.resourceGroup}:`;
   }
@@ -44,7 +51,7 @@ const SWA_REGIONS = [
 ];
 
 interface ProvisionCliOptions {
-  resourceGroup: string;
+  resourceGroup?: string;
   subscription?: string;
   location?: string;
   swaLocation?: string;
@@ -53,6 +60,34 @@ interface ProvisionCliOptions {
   baseline?: string;
   reconcile?: boolean;
   approve?: boolean;
+  resume?: string;
+  status?: string;
+  resumeDeployment?: string;
+  waitSeconds?: string;
+}
+
+export function formatProvisionResult(result: ApplyProvisionResult): string {
+  const outcome = result.outcome === "succeeded" ? "✅ Provisioning completed, including migration tags and the local ledger."
+    : result.outcome === "in-progress" ? "⏳ Azure deployment is still in progress. The local wait ended; this is not an Azure failure."
+      : result.outcome === "partial" ? "⚠️ Provisioning is partially complete. Finish migration bookkeeping from the checkpoint; do not redeploy the baseline."
+        : result.outcome === "failed" ? "❌ Azure deployment reached a failed/cancelled terminal state."
+          : "⚠️ Azure deployment result is unknown. A local az interruption does not prove an Azure failure.";
+  const lines = [outcome, `Run: ${result.runId}; resource group: ${result.resourceGroup}`];
+  if (result.deployment) {
+    const reference = result.deployment.reference;
+    lines.push(`Deployment: ${reference.name}; subscription: ${reference.subscription}; state: ${result.deployment.state}${reference.id ? `; ID: ${reference.id}` : ""}`);
+    for (const error of result.deployment.errors) lines.push(`${error.code}: ${error.message}`);
+  }
+  for (const warning of result.warnings) lines.push(`Warning: ${warning}`);
+  for (const diagnostic of result.diagnostics.filter((entry) => entry.failureKind || entry.outputTruncated)) {
+    lines.push(formatAzureDiagnostic(diagnostic));
+  }
+  if (result.status !== "complete") {
+    lines.push(`Check/wait: swallowkit provision --status ${result.runId} --wait-seconds 300`);
+    lines.push(`Resume after approval: swallowkit provision --resume ${result.runId} --approve`);
+    lines.push("Azure may continue after Ctrl+C or process termination. No Azure cancellation or deletion is performed.");
+  }
+  return lines.join("\n");
 }
 
 async function resolveLocations(options: ProvisionCliOptions): Promise<{ location: string; swaLocation: string }> {
@@ -86,7 +121,7 @@ async function resolveLocations(options: ProvisionCliOptions): Promise<{ locatio
 
 export const provisionCommand = new Command("provision")
   .description("Bootstrap, adopt, migrate, or explicitly reconcile Azure resources")
-  .requiredOption("-g, --resource-group <name>", "Resource group name")
+  .option("-g, --resource-group <name>", "Resource group name (required for a new preview)")
   .option("--subscription <id>", "Azure subscription ID")
   .option("--location <region>", "Primary location for Functions and Cosmos DB")
   .option("--swa-location <region>", "Static Web App location")
@@ -95,8 +130,34 @@ export const provisionCommand = new Command("provision")
   .option("--baseline <version>", "Baseline version for adoption (currently 0)")
   .option("--reconcile", "Explicitly redeploy infra/main.bicep", false)
   .option("--approve", "Run the displayed Azure commands without the confirmation prompt", false)
+  .option("--status <runId>", "Read an existing execution checkpoint and Azure deployment state without writes")
+  .option("--resume <runId>", "Resume an approved checkpoint without resubmitting attempted deployments")
+  .option("--resume-deployment <name>", "Recover an older untracked baseline deployment after verifying its template and parameters")
+  .option("--wait-seconds <seconds>", "Bounded state wait, 0-3600 seconds (default: 300; status: 0)")
   .action(async (options: ProvisionCliOptions) => {
     ensureSwallowKitProject("provision");
+    const waitSeconds = options.waitSeconds === undefined ? undefined : Number(options.waitSeconds);
+    if ((options.resume && options.status) || ((options.resume || options.status) && (options.resourceGroup || options.resumeDeployment || options.reconcile || options.adoptExisting || options.subscription || options.location || options.swaLocation || options.whatIf || options.baseline !== undefined))) {
+      throw new MachineCommandError("invalid-arguments", "Use --status or --resume with the checkpoint ID alone; its original Azure target and reviewed files are preserved.", undefined, "blocked");
+    }
+    if (options.status) {
+      const result = await inspectProvisionOperation({ planId: options.status, waitSeconds });
+      console.log(formatProvisionResult(result));
+      if (result.status === "blocked" || result.status === "failed") process.exitCode = 1;
+      return;
+    }
+    if (options.resume) {
+      let approved = options.approve === true;
+      if (!approved && process.stdin.isTTY && process.stdout.isTTY) {
+        const answer = await prompts({ type: "confirm", name: "approved", message: "Resume the original reviewed run and finish pending steps? This requires explicit approval.", initial: false });
+        approved = answer.approved === true;
+      }
+      const result = await applyProvisionOperation({ planId: options.resume, approve: approved, waitSeconds });
+      console.log(formatProvisionResult(result));
+      if (result.status === "blocked" || result.status === "failed") process.exitCode = 1;
+      return;
+    }
+    if (!options.resourceGroup) throw new MachineCommandError("invalid-arguments", "New provision previews require --resource-group.", undefined, "blocked");
     const locations = await resolveLocations(options);
     const baseline = options.baseline === undefined ? undefined : Number(options.baseline);
     // Preview in memory: the same Azure checks as the agent workflow, but no saved plan file.
@@ -109,6 +170,7 @@ export const provisionCommand = new Command("provision")
       adoptExisting: options.adoptExisting,
       baseline,
       reconcile: options.reconcile,
+      resumeDeployment: options.resumeDeployment,
     }, { persist: false });
 
     for (const warning of preview.warnings) console.warn(`Warning: ${warning}`);
@@ -126,7 +188,7 @@ export const provisionCommand = new Command("provision")
     }
 
     if (preview.mode === "adoption-required") {
-      throw new Error('Existing resource group requires: migrations init --legacy-baseline, then provision --adopt-existing --baseline 0 --what-if.');
+      throw new Error('The existing resource group has no migration tag. For an interrupted baseline use --resume-deployment <original-name> to verify/observe it without redeploying. Legacy adoption applies only to a legacy manifest; do not replace an existing manifest.');
     }
 
     if (preview.mode === "noop") {
@@ -156,5 +218,7 @@ export const provisionCommand = new Command("provision")
       return;
     }
 
-    const result = await executeProvisionPlan(preview, { approve: true, retryHint: INTERACTIVE_PROVISION_RETRY_HINT });
-    console.log(`✅ Provisioning completed. ${result.executedCommands.length} Azure CLI command(s) ran.`);  });
+    const result = await executeProvisionPlan(preview, { approve: true, retryHint: INTERACTIVE_PROVISION_RETRY_HINT, waitSeconds });
+    console.log(formatProvisionResult(result));
+    if (result.status === "blocked" || result.status === "failed") process.exitCode = 1;
+  });

package/src/cli/commands/scaffold.ts

@@ -54,6 +54,7 @@ import {
 } from "../../core/operations/file-session";
 import { generateModelContainerMigration } from "../../core/operations/migration-generator";
 import { recordSessionOperations } from "../../core/project/artifacts";
+import { updateSharedIndex } from "../../core/operations/create-model";
 
 const SCAFFOLD_GENERATOR = "scaffold";
 
@@ -158,6 +159,11 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
     session.setSchemaAnalysis(schemaAnalysis);
     console.log(`✅ Model parsed: ${modelInfo.name} (${modelInfo.schemaName})`);
 
+    // Validate policy prerequisites before any generated artifacts are written.
+    resolveAuthPolicy(modelInfo, getAuthConfig());
+    for (const configName of ["swallowkit.config.js", "swallowkit.config.json", ".swallowkitrc.json"]) {
+      session.registerInput(path.join(process.cwd(), configName));
+    }
     const userScopeWarning = buildUserScopedDataWarning(modelInfo, getAuthConfig());
     if (userScopeWarning) {
       session.addWarning(userScopeWarning);
@@ -217,6 +223,8 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
       console.log("ℹ️  --api-only skips UI generation only; Functions, BFF routes, OpenAPI, and native schema assets are still updated.");
     }
 
+    updateSharedIndex(modelPath, modelInfo.schemaName, session);
+
     // 5. Generate BFF callFunction helper
     await generateCallFunctionHelper(session, apiDir);
 
@@ -332,10 +340,43 @@ function applyExternalTokenFetchToGeneratedUi(modelInfo: ModelInfo, session: Fil
 export function resolveAuthPolicy(modelInfo: ModelInfo, authConfig: AuthConfig | undefined): ModelAuthPolicy | undefined {
   // モデルに明示的な authPolicy がある場合はそれを使用
   if (modelInfo.authPolicy) {
+    if (!isAuthenticationConfigured(authConfig)) {
+      throw new MachineCommandError(
+        "auth-policy-without-auth",
+        `Model '${modelInfo.name}' declares authPolicy, but authentication is not configured. No artifacts were written. Run plan auth and apply auth before scaffolding this model.`,
+        { model: modelInfo.name },
+        "blocked",
+        [{
+          command: "swallowkit machine plan auth --provider <custom-jwt|swa|external-token>",
+          description: "Choose an authentication provider, review and apply its plan, then re-plan scaffold.",
+        }]
+      );
+    }
     const normalized = normalizeAuthConfig(authConfig);
+    const usesNamedPolicy = Boolean(modelInfo.authPolicy.policy ||
+      typeof modelInfo.authPolicy.read === "string" || typeof modelInfo.authPolicy.write === "string");
+    // Guards resolve each operation independently: a string selects the named router, an array (or
+    // the roles fallback) selects the single-provider helper. Named schemes only have the router.
+    const operationIsNamed = (selected: string | string[] | undefined) =>
+      typeof selected === "string" || (selected === undefined && Boolean(modelInfo.authPolicy!.policy));
+    const everyOperationNamed = operationIsNamed(modelInfo.authPolicy.read) && operationIsNamed(modelInfo.authPolicy.write) &&
+      !modelInfo.authPolicy.roles;
+    if (authConfig?.schemes && !authConfig.provider && !everyOperationNamed) {
+      throw new MachineCommandError(
+        "auth-policy-requires-named-policy",
+        `Model '${modelInfo.name}' declares an authPolicy whose read or write operation does not resolve to a named policy, but authentication uses named schemes. Use authPolicy = { policy: '<name>' } or name both read and write policies (role arrays are not supported with named schemes); no artifacts were written.`,
+        { model: modelInfo.name },
+        "blocked",
+        [{
+          command: "swallowkit machine inspect capabilities",
+          description: "Define a named authorization policy selecting the required schemes/roles, reference it from the model, then re-plan scaffold.",
+        }]
+      );
+    }
     for (const policyName of [modelInfo.authPolicy.policy, typeof modelInfo.authPolicy.read === 'string' ? modelInfo.authPolicy.read : undefined, typeof modelInfo.authPolicy.write === 'string' ? modelInfo.authPolicy.write : undefined].filter((value): value is string => Boolean(value))) {
       if (!normalized?.authorization.policies[policyName]) throw new Error(`Model '${modelInfo.name}' references undefined auth policy '${policyName}'. Define auth.authorization.policies.${policyName}.`);
     }
+    if (usesNamedPolicy) assertNamedSchemesConfigured(modelInfo.name, "authPolicy", authConfig);
     return modelInfo.authPolicy;
   }
 
@@ -350,12 +391,35 @@ export function resolveAuthPolicy(modelInfo: ModelInfo, authConfig: AuthConfig |
     return {}; // 空のポリシー = 認証のみ、ロール制限なし
   }
 
-  if (defaultPolicy !== 'anonymous') return { policy: defaultPolicy };
+  if (defaultPolicy !== 'anonymous') {
+    assertNamedSchemesConfigured(modelInfo.name, `auth.authorization.defaultPolicy '${defaultPolicy}'`, authConfig);
+    return { policy: defaultPolicy };
+  }
 
   // defaultPolicy が 'anonymous' なら認証不要
   return undefined;
 }
 
+/**
+ * Named authorization policies are enforced by the generated multi-scheme router and scheme-specific
+ * client contexts, which exist only for named auth.schemes. A single-provider configuration
+ * (auth.provider) has no router, so referencing a named policy would generate code that cannot build.
+ */
+function assertNamedSchemesConfigured(modelName: string, source: string, authConfig: AuthConfig | undefined): void {
+  if (Object.keys(authConfig?.schemes ?? {}).some((name) => name !== "default")) return;
+  throw new MachineCommandError(
+    "auth-named-policy-requires-named-scheme",
+    `Model '${modelName}' uses a named authorization policy via ${source}, but authentication is configured with a single auth.provider. ` +
+      `Named policies require named auth.schemes; no artifacts were written. Use role lists (authPolicy = { roles: [...] } or read/write role arrays) with auth.provider, or add a named scheme.`,
+    { model: modelName, source },
+    "blocked",
+    [{
+      command: "swallowkit machine plan auth --provider <swa|external-token|custom-jwt> --scheme <name>",
+      description: "Add a named scheme and reference it from auth.authorization.policies, or switch the model to role lists; then re-plan scaffold.",
+    }]
+  );
+}
+
 /**
  * モデルファイルのパスを解決
  */

package/src/cli/index.ts

@@ -6,6 +6,7 @@ import * as path from "path";
 import { Command } from "commander";
 import { initCommand, devCommand, devSeedsCommand, scaffoldCommand, createModelCommand } from "./commands";
 import { provisionCommand } from "./commands/provision";
+import { AzureCliDiagnostic, formatAzureDiagnostic } from "../utils/azure-diagnostics";
 import { createMigrationCommand } from "./commands/create-migration";
 import { migrationsCommand } from "./commands/migrations";
 import { configureMcpCommand } from "./commands/configure-mcp";
@@ -223,8 +224,8 @@ export function createProgram(devCommandOverride: Command = devCommand): Command
 
   program
     .command("verify")
-    .description("Run verification checks (structure, drift, typecheck)")
-    .option("--checks <ids>", "Comma-separated check ids to run (structure,drift,typecheck)")
+    .description("Run verification checks (structure, drift, typecheck, backend-build)")
+    .option("--checks <ids>", "Comma-separated check ids (structure,drift,typecheck,backend-build,build,lint,test); quote CSV values in PowerShell")
     .action(async (options) => {
       await runVerifyCommand({ checks: options.checks });
     });
@@ -365,7 +366,16 @@ export function formatCliError(error: unknown): string {
     if (details && typeof details === "object") {
       if (typeof details.nextAction === "string") lines.push(`   Next: ${details.nextAction}`);
       if (Array.isArray(details.changedFiles)) lines.push(`   Changed files: ${details.changedFiles.join(", ")}`);
+      if (typeof details.runId === "string") lines.push(`   Run: ${details.runId}`);
+      if (details.deployment && typeof details.deployment === "object") {
+        const deployment = details.deployment as { state?: string; reference?: { name?: string; id?: string; resourceGroup?: string; subscription?: string } };
+        lines.push(`   Deployment: ${deployment.reference?.id ?? deployment.reference?.name ?? "unknown"}; state: ${deployment.state ?? "unknown"}`);
+      }
+      if (Array.isArray(details.diagnostics)) {
+        for (const diagnostic of details.diagnostics as AzureCliDiagnostic[]) lines.push(formatAzureDiagnostic(diagnostic));
+      }
     }
+    for (const action of error.nextActions ?? []) lines.push(`   Next: ${action.command} — ${action.description}`);
     return lines.join("\n");
   }
   if (error instanceof Error) {

package/src/core/operations/create-model.ts

@@ -1,4 +1,5 @@
 import * as path from "path";
+import * as ts from "typescript";
 import { ensureSwallowKitProject, loadConfig } from "../config";
 import { toPascalCase } from "../scaffold/model-parser";
 import { syncProjectManifest } from "../project/manifest";
@@ -90,21 +91,58 @@ export const connectorConfig = {
 `;
 }
 
-function updateSharedIndex(kebabName: string, pascalName: string, session: FileOperationSession): boolean {
+export function updateSharedIndex(modelPath: string, schemaName: string, session: FileOperationSession): boolean {
   const indexPath = path.join(process.cwd(), "shared", "index.ts");
-
-  if (!session.fileExists(indexPath)) {
-    return false;
+  session.registerInput(indexPath);
+  const content = session.fileExists(indexPath) ? session.readFile(indexPath) : "";
+  const modulePath = `./${path.relative(path.dirname(indexPath), modelPath).replace(/\\/g, "/").replace(/\.ts$/, "")}`;
+  const source = ts.createSourceFile(indexPath, content, ts.ScriptTarget.Latest, true);
+  // Text edits that turn a type-only re-export of this schema into nothing (a value export of the same
+  // name also exports its type); keeping both would be a duplicate-identifier error.
+  const edits: Array<{ start: number; end: number; text: string }> = [];
+  let hasValueExport = false;
+  for (const statement of source.statements) {
+    if (!ts.isExportDeclaration(statement) || !statement.moduleSpecifier || !ts.isStringLiteral(statement.moduleSpecifier)) continue;
+    const exportedPath = statement.moduleSpecifier.text.replace(/\.(ts|js)$/, "");
+    if (exportedPath !== modulePath) continue;
+    if (!statement.exportClause) {
+      if (!statement.isTypeOnly) hasValueExport = true;
+      continue;
+    }
+    if (!ts.isNamedExports(statement.exportClause)) continue;
+    const elements = statement.exportClause.elements;
+    const matches = elements.filter((element) =>
+      element.name.text === schemaName && (element.propertyName?.text ?? element.name.text) === schemaName);
+    for (const element of matches) {
+      if (!statement.isTypeOnly && !element.isTypeOnly) {
+        hasValueExport = true;
+      } else if (!statement.isTypeOnly) {
+        // export { type Todo } -> export { Todo }
+        edits.push({ start: element.getStart(source), end: element.getEnd(), text: schemaName });
+        hasValueExport = true;
+      } else if (elements.length === 1) {
+        let end = statement.getEnd();
+        if (content.slice(end, end + 2) === "\r\n") end += 2;
+        else if (content[end] === "\n") end += 1;
+        edits.push({ start: statement.getStart(source), end, text: "" });
+      } else {
+        const index = elements.indexOf(element);
+        const start = index === 0 ? element.getStart(source) : elements[index - 1].getEnd();
+        const end = index === 0 ? elements[index + 1].getStart(source) : element.getEnd();
+        edits.push({ start, end, text: "" });
+      }
+    }
   }
-
-  const content = session.readFile(indexPath);
-  const exportLine = `export { ${pascalName} } from './models/${kebabName}';`;
-
-  if (content.includes(exportLine)) {
-    return false;
+  let updated = content;
+  for (const edit of edits.sort((left, right) => right.start - left.start)) {
+    updated = `${updated.slice(0, edit.start)}${edit.text}${updated.slice(edit.end)}`;
   }
-
-  session.writeFile(indexPath, `${content}${exportLine}\n`, {
+  if (hasValueExport && updated === content) return false;
+  if (!hasValueExport) {
+    const exportLine = `export { ${schemaName} } from '${modulePath}';`;
+    updated = `${updated}${updated && !updated.endsWith("\n") ? "\n" : ""}${exportLine}\n`;
+  }
+  session.writeFile(indexPath, updated, {
     ownership: "extension-point",
     generator: CREATE_MODEL_GENERATOR,
   });
@@ -172,7 +210,7 @@ export async function createModelOperation(options: CreateModelOperationOptions)
     });
     createdFiles.push(filePath.replace(/\\/g, "/"));
 
-    if (updateSharedIndex(kebabName, pascalName, session)) {
+    if (updateSharedIndex(resolveFromRoot(filePath), pascalName, session)) {
       updatedIndex = true;
     }
   }