swallowkit 2.0.0-alpha.7 → 2.0.0-alpha.9

package/src/cli/commands/init.ts

@@ -1825,10 +1825,12 @@ ${pmCmd.exec} swallowkit provision --resource-group <rg-name>
 
 This creates:
 - Static Web App (\`swa-${projectName}\`)
-- Azure Functions (\`func-${projectName}\`)
-- Cosmos DB (\`cosmos-${projectName}\`)
+- Azure Functions (\`func-${projectName}-<suffix>\`)
+- Cosmos DB (\`cosmos-${projectName}-<suffix>\`)
 - Storage Account
 
+Cosmos DB and Function App names must be globally unique, so they include a short suffix derived from the resource group. When provisioning completes, the command prints the actual resource names and the CI/CD settings to use.
+
 You will be prompted to select Azure regions:
 1. **Primary location**: For Functions and Cosmos DB (default: Japan East)
 2. **Static Web App location**: Limited availability (default: East Asia)
@@ -1844,12 +1846,12 @@ ${cicdChoice === 'github' ? `#### GitHub Actions
 
 2. Get Function App publish profile:
    \`\`\`bash
-   az webapp deployment list-publishing-profiles --name func-${projectName} --resource-group <rg-name> --xml
+   az webapp deployment list-publishing-profiles --name <functions-app-name> --resource-group <rg-name> --xml
    \`\`\`
 
 3. Add secrets to GitHub repository:
    - \`AZURE_STATIC_WEB_APPS_API_TOKEN\`: SWA deployment token (from step 1)
-   - \`AZURE_FUNCTIONAPP_NAME\`: \`func-${projectName}\`
+   - \`AZURE_FUNCTIONAPP_NAME\`: Functions app name printed by \`swallowkit provision\` (\`func-${projectName}-<suffix>\`)
    - \`AZURE_FUNCTIONAPP_PUBLISH_PROFILE\`: Functions publish profile (from step 2)
 
 4. Push to \`main\` branch to trigger deployment (or use **Actions** → **Run workflow** for manual deployment)` : cicdChoice === 'azure' ? `#### Azure Pipelines
@@ -1871,8 +1873,10 @@ az staticwebapp deploy --name swa-${projectName} --resource-group <rg-name> --ap
 \`\`\`bash
 cd functions
 ${pmCmd.run} build
-func azure functionapp publish func-${projectName}
-\`\`\``}
+func azure functionapp publish <functions-app-name>
+\`\`\`
+
+Use the Functions app name printed by \`swallowkit provision\`.`}
 
 ## 🔧 Available Commands
 
@@ -2049,6 +2053,14 @@ param cosmosDbMode string = '${azureConfig.cosmosDbMode}'
 @description('Enable VNet integration')
 param enableVNet bool = ${enableVNet}
 
+// Cosmos DB account and Function App names are globally unique across Azure.
+// A suffix derived from the resource group keeps names stable for redeployments
+// to the same resource group while avoiding collisions with other environments
+// and with names Azure still reserves after a previous resource group is deleted.
+var resourceSuffix = take(uniqueString(resourceGroup().id, projectName), 6)
+var cosmosAccountName = 'cosmos-\${take(toLower(projectName), 30)}-\${resourceSuffix}'
+var functionsAppName = 'func-\${take(projectName, 40)}-\${resourceSuffix}'
+
 // Shared Log Analytics Workspace (in Functions region for data residency)
 module logAnalytics 'modules/loganalytics.bicep' = {
   name: 'logAnalytics'
@@ -2102,7 +2114,7 @@ module vnet 'modules/vnet.bicep' = if (enableVNet) {
 module cosmosDbFreeTier 'modules/cosmosdb-freetier.bicep' = if (cosmosDbMode == 'freetier') {
   name: 'cosmosDb'
   params: {
-    accountName: 'cosmos-\${projectName}'
+    accountName: cosmosAccountName
     databaseName: '\${projectName}Database'
     location: location
     publicNetworkAccess: enableVNet ? 'Disabled' : 'Enabled'
@@ -2112,7 +2124,7 @@ module cosmosDbFreeTier 'modules/cosmosdb-freetier.bicep' = if (cosmosDbMode ==
 module cosmosDbServerless 'modules/cosmosdb-serverless.bicep' = if (cosmosDbMode == 'serverless') {
   name: 'cosmosDb'
   params: {
-    accountName: 'cosmos-\${projectName}'
+    accountName: cosmosAccountName
     databaseName: '\${projectName}Database'
     location: location
     publicNetworkAccess: enableVNet ? 'Disabled' : 'Enabled'
@@ -2136,7 +2148,7 @@ module cosmosPrivateEndpoint 'modules/private-endpoint-cosmos.bicep' = if (enabl
 module functionsFlex 'modules/functions-flex.bicep' = {
   name: 'functionsApp'
     params: {
-      name: 'func-\${projectName}'
+      name: functionsAppName
       location: location
       storageAccountName: 'stg\${uniqueString(resourceGroup().id, projectName)}'
       appInsightsConnectionString: appInsightsFunctions.outputs.connectionString

package/src/cli/commands/provision.ts

@@ -170,8 +170,8 @@ export function formatProvisionResult(result: ApplyProvisionResult): string {
     lines.push(formatAzureDiagnostic(diagnostic));
   }
   if (result.status !== "complete") {
-    lines.push(`Check/wait: swallowkit provision --status ${result.runId} --wait-seconds 300`);
-    if (result.outcome !== "failed") lines.push(`Resume: swallowkit provision --resume ${result.runId}`);
+    lines.push(`Check status: swallowkit provision --status ${result.runId}`);
+    if (result.outcome !== "failed") lines.push(`Resume and wait until completion: swallowkit provision --resume ${result.runId}`);
     if (result.outcome !== "failed") lines.push("Azure may continue after Ctrl+C or process termination. No Azure cancellation or deletion is performed.");
     else lines.push("Azure reported a terminal failure. Correct its cause before explicitly deploying again; resuming does not repair a failed deployment.");
   }
@@ -222,7 +222,7 @@ export function createProvisionCommand(): Command {
     .option("--status <runId>", "Read an existing execution checkpoint and Azure deployment state without writes")
     .option("--resume <runId>", "Continue the original execution without resubmitting attempted deployments")
     .option("--resume-deployment <name>", "Recover an older untracked baseline deployment after verifying its template and parameters")
-    .option("--wait-seconds <seconds>", "Bounded state wait, 0-3600 seconds (default: 300; status: 0)")
+    .addOption(new Option("--wait-seconds <seconds>", "Optional limit on waiting, 0-3600 seconds (default: wait until Azure finishes; status: 0)").hideHelp())
     .action(async (options: ProvisionCliOptions) => {
       try {
         ensureSwallowKitProject("provision");
@@ -261,6 +261,7 @@ export function createProvisionCommand(): Command {
             planId: options.resume,
             approve: true,
             waitSeconds,
+            waitUntilComplete: waitSeconds === undefined,
           });
           console.log(formatProvisionResult(result));
           await printProvisionSetup(result);
@@ -315,11 +316,13 @@ export function createProvisionCommand(): Command {
 
         console.log(`\n${describeProvisionAction(preview)}`);
         console.log("Deploying Azure infrastructure. Azure resources may incur charges.");
+        console.log("Waiting for the Azure deployment to finish. This often takes 10-20 minutes; resource information and CI/CD settings are shown when it completes.");
 
         const result = await executeProvisionPlan(preview, {
           approve: true,
           retryHint: INTERACTIVE_PROVISION_RETRY_HINT,
           waitSeconds,
+          waitUntilComplete: waitSeconds === undefined,
         });
         console.log(formatProvisionResult(result));
         await printProvisionSetup(result);

package/src/core/operations/migration-generator.ts

@@ -152,6 +152,19 @@ param location string
   return migration;
 }
 
+const SUFFIXED_COSMOS_ACCOUNT_NAME = "'cosmos-${take(toLower(projectName), 30)}-${take(uniqueString(resourceGroup().id, projectName), 6)}'";
+const LEGACY_COSMOS_ACCOUNT_NAME = "'cosmos-${projectName}'";
+
+// Projects initialized before resource-group suffixes keep their original
+// account name so model migrations target the account their baseline created.
+function cosmosAccountNameExpression(session: FileOperationSession): string {
+  const mainBicep = path.join(session.rootDirectory, "infra", "main.bicep");
+  if (session.fileExists(mainBicep) && /var\s+resourceSuffix\s*=/.test(session.readFile(mainBicep))) {
+    return SUFFIXED_COSMOS_ACCOUNT_NAME;
+  }
+  return LEGACY_COSMOS_ACCOUNT_NAME;
+}
+
 export function generateModelContainerMigration(
   model: { name: string; partitionKey: string },
   session: FileOperationSession = new FileOperationSession("commit")
@@ -175,7 +188,7 @@ param projectName string
 param location string
 
 resource cosmosAccount 'Microsoft.DocumentDB/databaseAccounts@2023-11-15' existing = {
-  name: 'cosmos-\${projectName}'
+  name: ${cosmosAccountNameExpression(session)}
 }
 
 resource database 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2023-11-15' existing = {

package/src/core/operations/provision-deployment.ts

@@ -4,6 +4,8 @@ import { AzureCliDiagnostic, azureCliDiagnostic, redactAzureText } from "../../u
 export const DEPLOYMENT_QUERY = "{id:id,name:name,state:properties.provisioningState,correlationId:properties.correlationId,templateHash:properties.templateHash,timestamp:properties.timestamp,error:properties.error}";
 export const DEFAULT_PROVISION_WAIT_SECONDS = 300;
 export const MAX_PROVISION_WAIT_SECONDS = 3_600;
+/** Consecutive transient state-read failures tolerated while the human CLI waits for a terminal state. */
+export const UNBOUNDED_WAIT_TRANSIENT_RETRIES = 24;
 
 export interface DeploymentReference {
   subscription: string;
@@ -116,9 +118,15 @@ export async function waitForAzureDeployment(
     onObservation?: (observation: DeploymentObservation) => void;
     secretValues?: readonly string[];
     queryTimeoutMs?: number;
+    /**
+     * Consecutive non-terminal "unknown" reads (query failure, not yet visible) to keep polling through.
+     * Required for an unbounded deadline so a missing deployment cannot be polled forever.
+     */
+    transientRetries?: number;
   }
 ): Promise<DeploymentObservation> {
   let observation: DeploymentObservation;
+  let unknownReads = 0;
   do {
     const remaining = options.deadline - Date.now();
     // Even when the wait budget is exhausted, one bounded read can identify an accepted submission.
@@ -130,7 +138,15 @@ export async function waitForAzureDeployment(
     if (observation.state !== "unknown") reference = observation.reference;
     options.onObservation?.(observation);
     if (observation.state === "Succeeded" || observation.state === "Failed" || observation.state === "Canceled") return observation;
-    if (observation.state === "unknown" && observation.reason !== "not-yet-observed" && observation.reason !== "not-found") return observation;
+    if (observation.state === "unknown") {
+      unknownReads += 1;
+      const retryable = observation.reason === "not-yet-observed" || observation.reason === "not-found"
+        || (options.transientRetries !== undefined && (observation.reason === "query-failed" || observation.reason === "invalid-response"));
+      if (!retryable) return observation;
+      if (!Number.isFinite(options.deadline) && unknownReads > (options.transientRetries ?? 0)) return observation;
+    } else {
+      unknownReads = 0;
+    }
     if (Date.now() >= options.deadline || options.signal?.aborted) return observation;
     await new Promise<void>((resolve) => {
       const done = () => {

package/src/core/operations/provision-operations.ts

@@ -20,7 +20,7 @@ import { deletePlanState, listProvisionRuns, loadPlanState, loadProvisionRun, lo
 import { hashFileIfExists } from "./file-session";
 import {
   DEFAULT_PROVISION_WAIT_SECONDS, DEPLOYMENT_QUERY, DeploymentObservation, DeploymentReference,
-  MAX_PROVISION_WAIT_SECONDS, queryAzureDeployment, queryDeploymentOperationErrors, waitForAzureDeployment,
+  MAX_PROVISION_WAIT_SECONDS, queryAzureDeployment, queryDeploymentOperationErrors, UNBOUNDED_WAIT_TRANSIENT_RETRIES, waitForAzureDeployment,
 } from "./provision-deployment";
 import {
   MIGRATION_MANIFEST_PATH,
@@ -625,6 +625,8 @@ export interface ApplyProvisionOptions {
   planId: string;
   approve?: boolean;
   waitSeconds?: number;
+  /** Human CLI: keep polling until Azure reaches a terminal state instead of using the bounded wait budget. */
+  waitUntilComplete?: boolean;
 }
 
 export interface ApplyProvisionResult {
@@ -848,7 +850,10 @@ export async function applyProvisionOperation(options: ApplyProvisionOptions): P
     );
   }
 
-  const result = await executeProvisionPlan(plan, { approve: options.approve, waitSeconds: options.waitSeconds, retryHint: MACHINE_RETRY_HINT, projectRoot });
+  const result = await executeProvisionPlan(plan, {
+    approve: options.approve, waitSeconds: options.waitSeconds, waitUntilComplete: options.waitUntilComplete,
+    retryHint: MACHINE_RETRY_HINT, projectRoot,
+  });
   if (result.status === "complete") {
     try { deletePlanState(plan.planId, projectRoot); } catch {
       result.warnings.push("Azure and migration bookkeeping completed, but the old preview could not be removed. The completed execution checkpoint prevents replay.");
@@ -863,11 +868,17 @@ export async function applyProvisionOperation(options: ApplyProvisionOptions): P
  */
 export async function executeProvisionPlan(
   plan: ProvisionPlanData,
-  options: { approve?: boolean; retryHint?: string; projectRoot?: string; waitSeconds?: number; signal?: AbortSignal; pollIntervalMs?: number } = {}
+  options: {
+    approve?: boolean; retryHint?: string; projectRoot?: string; waitSeconds?: number;
+    /** Human CLI only: no overall deadline; each az call stays bounded and the checkpoint stays resumable. */
+    waitUntilComplete?: boolean;
+    signal?: AbortSignal; pollIntervalMs?: number;
+  } = {}
 ): Promise<ApplyProvisionResult> {
   const projectRoot = options.projectRoot ?? process.cwd();
   const retryHint = options.retryHint ?? MACHINE_RETRY_HINT;
-  const waitSeconds = validateWaitSeconds(options.waitSeconds);
+  const waitUntilComplete = options.waitUntilComplete === true && options.waitSeconds === undefined;
+  const waitSeconds = waitUntilComplete ? 0 : validateWaitSeconds(options.waitSeconds);
   if (!options.approve) {
     throw new MachineCommandError(
       "approval-required",
@@ -937,7 +948,7 @@ export async function executeProvisionPlan(
   options.signal?.addEventListener("abort", externalAbort, { once: true });
   if (options.signal?.aborted) controller.abort();
   const signal = controller.signal;
-  const deadline = Date.now() + waitSeconds * 1_000;
+  const deadline = waitUntilComplete ? Number.POSITIVE_INFINITY : Date.now() + waitSeconds * 1_000;
   const persist = () => {
     if (!run) return;
     run.warnings = run.warnings.slice(-20);
@@ -958,6 +969,7 @@ export async function executeProvisionPlan(
       ...(signal.aborted ? {} : { signal }),
       ...(signal.aborted ? { queryTimeoutMs: 5_000 } : {}),
       pollIntervalMs: options.pollIntervalMs,
+      ...(waitUntilComplete ? { transientRetries: UNBOUNDED_WAIT_TRANSIENT_RETRIES } : {}),
       secretValues,
       onObservation: (value) => {
         run!.observation = value;

package/src/core/project/capabilities.ts

@@ -233,7 +233,7 @@ export function inspectCapabilities(): CapabilitiesContract {
       "(regular CLI) configure-mcp [--version auto|latest|<semver>] — re-select the MCP launcher version in .mcp.json",
     ],
     provisioning: {
-      execution: "Submit Bicep once with az deployment group create --no-wait, then bounded state polling (default 300 seconds, configurable 0-3600). Azure CLI invocations are bounded separately. Warning-only stderr with exit 0 is not a failure; output capture limits do not terminate az.",
+      execution: "Submit Bicep once with az deployment group create --no-wait, then bounded state polling (default 300 seconds, configurable 0-3600) for machine/MCP; the human `swallowkit provision` command waits until Azure reaches a terminal state. Azure CLI invocations are bounded separately. Warning-only stderr with exit 0 is not a failure; output capture limits do not terminate az.",
       completion: "status complete/outcome succeeded requires Azure Succeeded plus verified migration tags and local ledger completion. Running/Accepted -> in-progress; unreadable/not-found state -> blocked/outcome unknown; bookkeeping interruption after Azure Succeeded -> blocked/outcome partial; Failed/Canceled -> failed with Azure causes.",
       tracking: "Approved runs persist before Azure writes under .swallowkit/state/provision/. runId equals the original planId and preserves the subscription, RG, deployment ID/correlation, fingerprints and migration state. inspect provision is read-only; apply provision --plan resumes without re-submitting attempted deployments. Ctrl+C/termination may leave Azure running; never cancel/delete without explicit consent.",
       recovery: "For an older untracked baseline, plan provision --resume-deployment <name> compares the existing ARM template and non-secure parameters to the local Bicep/parameters. It observes that deployment and only tags/records it after Succeeded. Mismatches, unreadable evidence, secure parameters or non-baseline migrations block; do not use reconcile just to repair bookkeeping.",