@aurorajs.dev/catalyst-cli 1.0.1 → 1.1.3

package/dist/templates/frontend/application/src/@aurora/pipes/validation-message.pipe.ts

@@ -1,5 +1,5 @@
 import { inject, InjectionToken, Pipe, type PipeTransform } from '@angular/core';
-import { type ValidationErrors } from '@angular/forms';
+import { ValidationError } from '@angular/forms/signals';
 import { TranslocoService } from '@jsverse/transloco';
 
 /**
@@ -26,11 +26,21 @@ export interface ValidationMessageRule {
 export type ValidationMessageRules = Record<string, ValidationMessageRule>;
 
 /**
- * Default rules for built-in Angular validators.
+ * Default rules for built-in validators.
+ *
+ * Covers BOTH form systems so messages survive the gradual Signal Forms
+ * migration: classic Reactive Forms emit lowercase keys (`minlength`,
+ * `maxlength`) carrying a `requiredLength` payload, while Signal Forms
+ * (`@angular/forms/signals`) emit `kind`-cased keys (`minLength`, `maxLength`)
+ * whose limit lives on a same-named property. The `required`, `min`, `max`,
+ * `email` and `pattern` keys are shared verbatim — both systems agree on the
+ * casing and on where the numeric limit sits.
+ *
  * Override or extend via `provideValidationMessages()`.
  */
 export const DEFAULT_VALIDATION_RULES: ValidationMessageRules = {
   required: { key: 'Validations.Required' },
+  // Classic Reactive Forms keys.
   minlength: {
     key: 'Validations.MinLength',
     params: (err: { requiredLength: number }) => ({ min: err.requiredLength }),
@@ -39,6 +49,15 @@ export const DEFAULT_VALIDATION_RULES: ValidationMessageRules = {
     key: 'Validations.MaxLength',
     params: (err: { requiredLength: number }) => ({ max: err.requiredLength }),
   },
+  // Signal Forms keys (validation error `kind`).
+  minLength: {
+    key: 'Validations.MinLength',
+    params: (err: { minLength: number }) => ({ min: err.minLength }),
+  },
+  maxLength: {
+    key: 'Validations.MaxLength',
+    params: (err: { maxLength: number }) => ({ max: err.maxLength }),
+  },
   min: {
     key: 'Validations.Min',
     params: (err: { min: number }) => ({ min: err.min }),
@@ -75,15 +94,44 @@ export function provideValidationMessages(rules: ValidationMessageRules) {
   };
 }
 
+/** Loose structural shape — for unit-test fixtures and dynamic param access. */
+interface LooseValidationError {
+  kind: string;
+  [key: string]: unknown;
+}
+
+/**
+ * A Signal Forms (`@angular/forms/signals`) validation error: a `kind` (the
+ * validator that failed, e.g. `'required'`, `'maxLength'`) plus its payload
+ * (e.g. `maxLength: 64`).
+ *
+ * A UNION on purpose. `ValidationError.WithFieldTree` is what `field().errors()`
+ * yields in form templates — a SEALED type with no index signature. A type
+ * without its own index signature is NOT assignable to a loose
+ * `{ [key: string]: unknown }` (even when every property would satisfy
+ * `unknown`), so a loose supertype alone breaks the template type-check;
+ * `WithFieldTree` alone breaks the unit tests (plain `{ kind, maxLength }`
+ * fixtures don't satisfy the sealed shape). The union accepts both. `message`
+ * is read through a local `as { message?: string }` cast (Signal Forms types it
+ * `string | LogicFn<…>`, not assignable to a narrow `string`).
+ */
+export type FormValidationError = ValidationError.WithFieldTree | LooseValidationError;
+
 /**
- * Impure pipe that resolves the first validation error to a translated message.
- * Uses the `validations` nested key in the global transloco scope.
+ * Impure pipe that resolves a single Signal Forms validation error to a
+ * translated message, reusing the same `VALIDATION_MESSAGE_RULES` as the
+ * classic {@link ValidationMessageLegacyPipe}. The schema declares only the rules
+ * (no message); the message is keyed off `error.kind` and translated via
+ * transloco — so i18n stays in one place and stays reactive to language change.
+ *
+ * Falls back to the schema-provided `error.message` (if any), then to the
+ * generic `Validations.Default` key.
  *
  * @example
  * ```html
- * <hlm-field-error>
- *   {{ signalForm.get('name')?.errors | validationMessage }}
- * </hlm-field-error>
+ * @for (error of form.name().errors(); track error.kind) {
+ *   <hlm-field-error [validator]="error.kind">{{ error | validationMessage }}</hlm-field-error>
+ * }
  * ```
  */
 @Pipe({ name: 'validationMessage', pure: false })
@@ -91,32 +139,60 @@ export class ValidationMessagePipe implements PipeTransform {
   private readonly transloco = inject(TranslocoService);
   private readonly rules = inject(VALIDATION_MESSAGE_RULES);
 
-  private lastErrors: ValidationErrors | null = null;
+  // Cache fields — mirrors the memoization in ValidationMessageLegacyPipe.
+  // Cache key: (error object reference, active language, resolved params signature).
+  // The params signature detects mutations on the same error object reference
+  // (e.g. a dynamically-updated maxLength) that would produce a stale message
+  // if only the reference and language were compared.
+  private lastError: FormValidationError | null = null;
   private lastLang = '';
+  private lastParamsSig = '';
   private lastMessage = '';
 
-  transform(errors: ValidationErrors | null | undefined): string {
-    if (!errors) {
+  transform(error: FormValidationError | null | undefined): string {
+    if (!error) {
+      this.lastError = null;
+      this.lastLang = '';
+      this.lastParamsSig = '';
       this.lastMessage = '';
-      this.lastErrors = null;
       return '';
     }
 
     const lang = this.transloco.getActiveLang();
-    if (errors === this.lastErrors && lang === this.lastLang) return this.lastMessage;
-    this.lastErrors = errors;
-    this.lastLang = lang;
+    const rule = this.rules[error.kind];
 
-    const firstKey = Object.keys(errors)[0];
-    const rule = this.rules[firstKey];
+    // params() and JSON.stringify() can both throw for custom validators
+    // (e.g. BigInt values or circular references passed via provideValidationMessages).
+    // A throw here would propagate into Angular change detection and crash the view.
+    // Fall back to a reference-only sentinel so the cache still invalidates on
+    // new error objects; the translate() call below will still resolve the message.
+    let params: Record<string, unknown>;
+    let paramsSig: string;
+    try {
+      params = rule?.params ? rule.params(error) : {};
+      paramsSig = JSON.stringify(params);
+    } catch {
+      params = {};
+      paramsSig = `__unserializable__${String(error)}`;
+    }
 
-    if (rule) {
-      const params = rule.params ? rule.params(errors[firstKey]) : {};
-      this.lastMessage = this.transloco.translate(rule.key, params);
-    } else {
-      this.lastMessage = this.transloco.translate('Validations.Default');
+    if (error === this.lastError && lang === this.lastLang && paramsSig === this.lastParamsSig) {
+      return this.lastMessage;
     }
 
+    const message: string = rule
+      ? (this.transloco.translate(rule.key, params) ?? '')
+      : ((error as { message?: string }).message ??
+        this.transloco.translate('Validations.Default') ??
+        '');
+
+    // Assign cache fields ONLY after translate() succeeds — avoids poisoning
+    // the cache if translate() throws for any reason.
+    this.lastError = error;
+    this.lastLang = lang;
+    this.lastParamsSig = paramsSig;
+    this.lastMessage = message;
+
     return this.lastMessage;
   }
 }

package/dist/templates/frontend/application/src/@aurora/query-dsl/index.ts

@@ -0,0 +1,32 @@
+/**
+ * Barrel-shim of the Aurora Query DSL — re-exports the vocabulary + statement
+ * types from their canonical upstream home, `@aurorajs.dev/core-front` (F5
+ * upstreaming; the local definitions this shim replaces were the F4
+ * merge-window stopgap). Builders, composables and hand-written call sites
+ * keep importing from `@aurora/query-dsl` (HR-BARRELS-002) — only this shim
+ * knows the source package, keeping `@aurora` the frontend's stable port
+ * surface (HR-PORTS-001).
+ */
+export {
+  AGGREGATE_FUNCTION,
+  LOGICAL_OPERATOR,
+  ORDER_DIRECTION,
+  WHERE_OPERATOR,
+} from '@aurorajs.dev/core-front';
+export type {
+  AggregateField,
+  AggregateFunction,
+  AggregationBlock,
+  FieldWhere,
+  LogicalOperator,
+  LogicalWhere,
+  OrderClause,
+  OrderDirection,
+  QueryStatement,
+  RelationNode,
+  RelationsBlock,
+  ScalarValue,
+  WhereClause,
+  WhereLeaf,
+  WhereOperator,
+} from '@aurorajs.dev/core-front';

package/dist/templates/frontend/application/src/@aurora/query-dsl/query-statement.spec.ts

@@ -0,0 +1,94 @@
+import type { QueryStatement } from '.';
+import { LOGICAL_OPERATOR, ORDER_DIRECTION, WHERE_OPERATOR } from '.';
+
+/**
+ * Contract spec for the frontend-local Aurora Query DSL vocabulary and types
+ * (design D1: local in `@aurora`, no `@aurorajs.dev/core-front` release).
+ *
+ * The vocabulary and grammar MUST mirror the server-side source of truth
+ * (`packages/core-back/src/domain/persistence/query-dsl/`): bare operator
+ * keys, `and`/`or`/`not` connectors, `order: [{ field, dir }]` with dot-paths,
+ * and the recursive `relations` node. The type-level assertions below are the
+ * anti-theater anchor: they fail the (type-checked) test build if the types
+ * regress to the Sequelize shapes (`[Operator.x]`, `[['col','DIR']]`,
+ * `$assoc.col$`).
+ */
+describe('aurora query DSL vocabulary', () => {
+  it('exposes exactly the bare where-operator keys of the server DSL', () => {
+    expect(WHERE_OPERATOR).toEqual({
+      I_LIKE: 'iLike',
+      EQ: 'eq',
+      NE: 'ne',
+      GT: 'gt',
+      GTE: 'gte',
+      LT: 'lt',
+      LTE: 'lte',
+      IN: 'in',
+      NOT_IN: 'notIn',
+      BETWEEN: 'between',
+      IS_NULL: 'isNull',
+      CONTAINS: 'contains',
+      OVERLAP: 'overlap',
+    });
+  });
+
+  it('exposes exactly the bare logical connectors', () => {
+    expect(LOGICAL_OPERATOR).toEqual({
+      AND: 'and',
+      OR: 'or',
+      NOT: 'not',
+    });
+  });
+
+  it('exposes lowercase order directions', () => {
+    expect(ORDER_DIRECTION).toEqual({
+      ASC: 'asc',
+      DESC: 'desc',
+    });
+  });
+});
+
+describe('QueryStatement type contract', () => {
+  it('accepts the canonical DSL statement shape (compile-time anchor)', () => {
+    // `satisfies` makes this a compile-time contract: if the local types drift
+    // from the server grammar, the test BUILD fails before any assertion runs.
+    const statement = {
+      where: {
+        and: [
+          { name: { iLike: '%tag%' } },
+          { isActive: { eq: true } },
+          { id: { in: ['a', 'b'] } },
+          // Relation key nested in `where` = EXISTS filter on the parent rows.
+          { role: { name: { iLike: '%admin%' } } },
+          { or: [{ code: { eq: 'X' } }, { not: { deletedAt: { isNull: false } } }] },
+        ],
+      },
+      // `relations` shapes the loaded children WITHOUT filtering parents.
+      relations: {
+        role: true,
+        account: { relations: { user: true }, limit: 5, order: [{ field: 'name', dir: 'asc' }] },
+      },
+      // Dot-path in `field` is the DSL form for ordering by a relation column.
+      order: [
+        { field: 'role.name', dir: 'asc' },
+        { field: 'rowId', dir: 'desc' },
+      ],
+      limit: 10,
+      offset: 0,
+    } satisfies QueryStatement;
+
+    expect(statement.order[0]).toEqual({ field: 'role.name', dir: 'asc' });
+    expect(statement.relations.role).toBe(true);
+  });
+
+  // The "rejects the legacy Sequelize shapes at the type level" negative
+  // assertions used to live HERE as `@ts-expect-error` lines — but this file
+  // runs through the Angular unit-test builder (esbuild transform), which
+  // strips types before execution. `@ts-expect-error` is a `tsc` directive:
+  // it was never actually type-checked by the test runner, so the test always
+  // passed regardless of whether the DSL types rejected the legacy shapes
+  // (decorative coverage, F4 round1 ITEM 4). The negatives now live in
+  // `query-statement.type-contract.ts` — a plain `.ts` module (not
+  // `.spec.ts`) that IS type-checked, by `ng build` and by
+  // `tsc -p tsconfig.app.json --noEmit`.
+});

package/dist/templates/frontend/application/src/@aurora/query-dsl/query-statement.type-contract.ts

@@ -0,0 +1,38 @@
+import type { OrderClause, QueryStatement } from '.';
+
+/**
+ * Type-level regression anchor for the Aurora Query DSL shapes — NOT a spec
+ * file on purpose.
+ *
+ * The equivalent negative assertions used to live as `@ts-expect-error` lines
+ * inside `query-statement.spec.ts`, but that test runs through the
+ * Angular unit-test builder (`@angular/build:unit-test`, esbuild-based
+ * transform) which strips types before execution — `@ts-expect-error` is a
+ * `tsc` directive, so it was NEVER type-checked there and the "test" always
+ * passed regardless of whether the DSL types actually rejected the legacy
+ * shapes (decorative coverage, F4 round1 ITEM 4).
+ *
+ * This file lives under `src/@aurora/` as a plain `.ts` module (excluded from
+ * `tsconfig.spec.json`, included by `tsconfig.app.json`), so it IS
+ * type-checked — by `ng build` (AOT requires full program type information)
+ * and by `tsc -p tsconfig.app.json --noEmit`. Confirmed empirically: deleting
+ * one `@ts-expect-error` below while keeping its invalid line makes `tsc -p
+ * tsconfig.app.json --noEmit` fail with a real `TS2322`; keeping the directive
+ * while widening the type it guards makes `tsc` fail with "Unused
+ * '@ts-expect-error' directive" — both directions are live, not decorative.
+ *
+ * No runtime behavior, no exports — this module exists purely to be
+ * type-checked. `void` on each binding satisfies `noUnusedLocals`.
+ */
+
+// @ts-expect-error — bracketed operator keys ('[iLike]') are not DSL leaves
+const bracketedWhere = { name: { '[iLike]': '%x%' } } satisfies QueryStatement['where'];
+void bracketedWhere;
+
+// @ts-expect-error — Sequelize order arrays ([['col','DIR']]) are not [{field,dir}]
+const arrayOrder = [['name', 'ASC']] satisfies OrderClause[];
+void arrayOrder;
+
+// @ts-expect-error — 'ASC'/'DESC' uppercase directions are not part of the DSL
+const upperDirOrder = [{ field: 'name', dir: 'ASC' }] satisfies OrderClause[];
+void upperDirOrder;

package/dist/templates/frontend/application/src/app/app.config.ts

@@ -1,4 +1,4 @@
-import { provideHttpClient } from '@angular/common/http';
+import { provideHttpClient, withXhr } from '@angular/common/http';
 import {
   ApplicationConfig,
   inject,
@@ -7,23 +7,29 @@ import {
   provideBrowserGlobalErrorListeners,
 } from '@angular/core';
 import { provideRouter } from '@angular/router';
+import { HealthService } from '@aurora/modules/health';
 import { provideTransloco, TranslocoService } from '@jsverse/transloco';
+import { provideSpartanHlm } from '@spartan-ng/helm/utils';
+import { environment } from 'environments/environment';
 import { forkJoin, lastValueFrom } from 'rxjs';
-import { availableLangs } from '../../transloco.config';
 import { routes } from './app.routes';
 import { provideAurora } from './aurora.provider';
+import { buildTranslocoLangConfig } from './transloco-lang.factory';
 import { TranslocoHttpLoader } from './transloco-loader';
 
+const translocoLangConfig = buildTranslocoLangConfig(environment.lang);
+
 export const appConfig: ApplicationConfig = {
   providers: [
     provideBrowserGlobalErrorListeners(),
+    provideSpartanHlm(),
     provideRouter(routes),
-    provideHttpClient(),
+    provideHttpClient(withXhr()),
     provideTransloco({
       config: {
-        availableLangs: [...availableLangs],
-        // TODO: set when we have iam account management ready
-        defaultLang: 'es',
+        availableLangs: translocoLangConfig.availableLangs,
+        defaultLang: translocoLangConfig.defaultLang,
+        fallbackLang: translocoLangConfig.fallbackLang,
         reRenderOnLangChange: true,
         prodMode: !isDevMode(),
         scopes: { keepCasing: true },
@@ -38,6 +44,10 @@ export const appConfig: ApplicationConfig = {
       return lastValueFrom(forkJoin([transloco.load(lang), transloco.load(`navigation/${lang}`)]));
     }),
 
+    // Fetch health data (version + status) from the backend at startup.
+    // The endpoint is public — no auth gate needed.
+    provideAppInitializer(() => inject(HealthService).fetch()),
+
     /* #region customizations */
     provideAurora(),
     /* #endregion customizations */

package/dist/templates/frontend/application/src/app/app.routes.ts

@@ -1,5 +1,5 @@
 import { Routes } from '@angular/router';
-import { authorizationCodeCallbackGuard, noLocalAuthGuard } from '@aurora';
+import { authorizationCodeCallbackGuard, noLocalAuthGuard } from '@aurora/modules/authentication';
 
 export const routes: Routes = [
   // This route is used as the callback URL for the authorization code flow.

package/dist/templates/frontend/application/src/app/app.ts

@@ -1,10 +1,9 @@
-import { ChangeDetectionStrategy, Component } from '@angular/core';
+import { Component } from '@angular/core';
 import { RouterOutlet } from '@angular/router';
 
 @Component({
   selector: 'app-root',
   imports: [RouterOutlet],
-  changeDetection: ChangeDetectionStrategy.OnPush,
   template: '<router-outlet />',
 })
 export class App {}

package/dist/templates/frontend/application/src/app/aurora-widget.providers.ts

@@ -0,0 +1,21 @@
+import type { EnvironmentProviders } from '@angular/core';
+/**
+ * Composition-root aggregator of every bounded context's Aurora widget providers.
+ *
+ * Widgets are a FRAMEWORK primitive — the registry token and `AuroraWidgetDef` contract live in
+ * `@aurora`, and any surface that honours the contract can host them, not just the dashboard page.
+ * Hence this aggregator is named for the framework (`aurora-widget`), deliberately NOT coupled to
+ * the dashboard feature.
+ *
+ * Each BC that publishes widgets exports a `<bc>.widgets.ts` with a `provideWidget(...)` array;
+ * spread them ALL here. `aurora.provider.ts` then registers the whole set with a single
+ * `...auroraWidgetProviders`, so adding a BC's widgets touches only THIS file and the composition
+ * root stays stable.
+ *
+ * Why here (and not inside a BC or in `@aurora`): aggregating across BCs is a composition concern,
+ * and only the composition-root layer may import every BC. Putting it inside one BC would couple
+ * that BC to the others; putting it in `@aurora` would invert the framework→app dependency
+ * (HR-PORTS-001). The cross-BC fan-in belongs at the app root, alongside `aurora.provider.ts`.
+ */
+export const auroraWidgetProviders: EnvironmentProviders[] = [
+];

package/dist/templates/frontend/application/src/app/aurora.provider.spec.ts

@@ -24,8 +24,7 @@ vi.mock('environments/environment', () => ({
   },
 }));
 
-import { authorizationCodeGuard } from '../@aurora/modules/authentication/guards/adapters/authorization-code.guard';
-import { authenticationPasswordGuard } from '../@aurora/modules/authentication/guards/adapters/authentication-password.guard';
+import { authenticationPasswordGuard, authorizationCodeGuard } from '@aurora';
 import { AUTH_STRATEGY } from '../environments/environment.type';
 
 // Import the REAL exported function from the production provider.

package/dist/templates/frontend/application/src/app/aurora.provider.ts

@@ -8,19 +8,20 @@ import type { CanActivateFn } from '@angular/router';
 import {
   AUTH_GUARD,
   AuthenticationAuroraAdapterService,
-  authorizationCodeGuard,
   authenticationPasswordGuard,
   AuthenticationService,
+  authorizationCodeGuard,
   CurrentAccountService,
-  LangService,
-  provideApollo,
   provideAuthenticatedInitializer,
   provideAuthentication,
-  provideValidationMessages,
   AnonymousCurrentAccountAdapter,
-} from '@aurora';
+} from '@aurora/modules/authentication';
+import { provideApollo } from '@aurora/modules/graphql';
+import { LangService } from '@aurora/modules/lang';
+import { provideValidationMessages } from '@aurora/pipes';
 import { environment } from 'environments/environment';
 import { AUTH_STRATEGY, type AuthStrategy } from '../environments/environment.type';
+import { auroraWidgetProviders } from './aurora-widget.providers';
 /**
  * Returns the correct authentication guard for the given deploy-time strategy.
  *
@@ -43,6 +44,11 @@ export const provideAurora = (): Array<Provider | EnvironmentProviders> => [
   provideAuthentication(),
   ...provideApollo(),
   { provide: AuthenticationService, useClass: AuthenticationAuroraAdapterService },
+  // Register every BC's Aurora widgets into the widget multi-token with one spread. The per-BC
+  // `provideWidget(...)` arrays are aggregated in `aurora-widget.providers.ts`, so adding a BC's
+  // widgets never touches this composition root. Consumers read them via
+  // `inject(AURORA_WIDGET, { optional: true })`.
+  ...auroraWidgetProviders,
   // Load the current account once the session is established (sign-in or already-valid session on
   // load) — see provideAuthenticatedInitializer. The sidebar just reads the resulting signals.
   provideAuthenticatedInitializer(() => inject(CurrentAccountService).load()),
@@ -55,6 +61,7 @@ export const provideAurora = (): Array<Provider | EnvironmentProviders> => [
     uniqueUsername: { key: 'Validations.UniqueUsername' },
     matchOther: { key: 'Validations.MatchOther' },
     passwordRule: { key: 'Validations.PasswordRule' },
+    absoluteHttpUrl: { key: 'Validations.AbsoluteHttpUrl' },
   }),
   // Non-blocking: kick off lang load at boot. The signal hydrates synchronously
   // from SessionService localStorage; this just refreshes/warms when stale.

package/dist/templates/frontend/application/src/app/domains/admin/home/home.component.ts

@@ -0,0 +1,15 @@
+import { Component } from '@angular/core';
+
+@Component({
+  selector: 'admin-home',
+  template: `
+    <div class="flex flex-1 flex-col items-center justify-center gap-3 py-24 text-center">
+      <h1 class="text-2xl font-semibold tracking-tight">Welcome to your Aurora app</h1>
+      <p class="text-muted-foreground max-w-md text-sm">
+        This is a placeholder home page. Generate your first bounded context with the Aurora
+        Catalyst CLI to replace it.
+      </p>
+    </div>
+  `,
+})
+export default class AdminHome {}

package/dist/templates/frontend/application/src/app/domains/admin/layout/layout.component.ts

@@ -1,4 +1,4 @@
-import { ChangeDetectionStrategy, Component } from '@angular/core';
+import { Component } from '@angular/core';
 import { RouterOutlet } from '@angular/router';
 import { HlmSidebarImports } from '@spartan-ng/helm/sidebar';
 import { HlmToasterImports } from '@spartan-ng/helm/sonner';
@@ -9,7 +9,6 @@ import { SiteHeader } from './site-header';
 @Component({
   selector: 'admin-layout',
   imports: [RouterOutlet, HlmSidebarImports, HlmToasterImports, AppSidebar, SiteHeader],
-  changeDetection: ChangeDetectionStrategy.OnPush,
   template: `
     <app-sidebar>
       <main
@@ -17,7 +16,7 @@ import { SiteHeader } from './site-header';
         hlmSidebarInset
       >
         <app-site-header />
-        <div class="flex flex-1 flex-col px-4 pb-4">
+        <div class="flex min-h-0 flex-1 flex-col px-4 pb-4">
           <router-outlet />
         </div>
       </main>

package/dist/templates/frontend/application/src/app/domains/admin/layout/sidebar/app-sidebar.spec.ts

@@ -0,0 +1,111 @@
+/**
+ * Tests for `AppSidebar`'s consumption of `LandingResolverService.sidebarIntent` — the discriminated
+ * union `{ kind: 'collapse' } | { kind: 'restore'; open: boolean } | null` that lets the framework
+ * (`@aurora`) stay free of any Spartan UI library import while still driving the sidebar: `AppSidebar`
+ * (the sidebar's own root component, already living in the lazy-loaded admin layout) is the consumer.
+ *
+ * - `collapse`: snapshot the CURRENT `HlmSidebarService.open()` value, hand it back via
+ *   `acknowledgeSidebarIntent({ previousOpen })`, THEN force `setOpen(false)` — order matters so the
+ *   resolver records the state from BEFORE this component forces it closed.
+ * - `restore`: apply `setOpen(intent.open)` FIRST, then acknowledge (no snapshot to report back).
+ * - `null`: touch nothing.
+ *
+ * These tests instantiate `AppSidebar` via `TestBed.inject` (constructor + field initializers only,
+ * no template render / no child components) — the same technique `login-form.spec.ts` uses for a
+ * component with a heavy template, so none of `AppSidebar`'s child components (`NavMain`/`NavUser`/
+ * `NavSecondary`) or their own providers need to be satisfied. `TestBed.tick()` flushes the
+ * constructor's `effect()` deterministically (Angular 22.1) — no `setTimeout`-based polling.
+ */
+import '@angular/compiler';
+import { signal } from '@angular/core';
+import { TestBed } from '@angular/core/testing';
+import { CurrentAccountService, HealthService, LandingResolverService } from '@aurora';
+import { TranslocoService } from '@jsverse/transloco';
+import { HlmSidebarService } from '@spartan-ng/helm/sidebar';
+import { of } from 'rxjs';
+import { AppSidebar } from './app-sidebar';
+
+function configureTestBed(sidebarIntent: { kind: 'collapse' } | { kind: 'restore'; open: boolean } | null, sidebarOpen: boolean) {
+  const setOpen = vi.fn();
+  const acknowledgeSidebarIntent = vi.fn();
+
+  TestBed.configureTestingModule({
+    providers: [
+      AppSidebar,
+      {
+        provide: TranslocoService,
+        useValue: { translate: (key: string) => key, selectTranslation: () => of({}) },
+      },
+      { provide: HealthService, useValue: { version: signal(null) } },
+      {
+        provide: CurrentAccountService,
+        useValue: {
+          displayName: signal(''),
+          email: signal(''),
+          permissions: signal([]),
+          permissionsLoaded: signal(true),
+        },
+      },
+      {
+        provide: LandingResolverService,
+        useValue: {
+          sidebarIntent: signal(sidebarIntent),
+          acknowledgeSidebarIntent,
+        },
+      },
+      { provide: HlmSidebarService, useValue: { open: signal(sidebarOpen), setOpen } },
+    ],
+  });
+
+  return { setOpen, acknowledgeSidebarIntent };
+}
+
+function flush(): void {
+  TestBed.tick();
+}
+
+describe('AppSidebar — consumes the landing resolver sidebar intent', () => {
+  it('on {kind:"collapse"}: snapshots the CURRENT open state, acknowledges it, THEN forces the sidebar closed', () => {
+    const { setOpen, acknowledgeSidebarIntent } = configureTestBed({ kind: 'collapse' }, true);
+    const callOrder: string[] = [];
+    acknowledgeSidebarIntent.mockImplementation(() => callOrder.push('ack'));
+    setOpen.mockImplementation(() => callOrder.push('setOpen'));
+
+    TestBed.inject(AppSidebar);
+    flush();
+
+    expect(acknowledgeSidebarIntent).toHaveBeenCalledOnce();
+    expect(acknowledgeSidebarIntent).toHaveBeenCalledWith({ previousOpen: true });
+    expect(setOpen).toHaveBeenCalledOnce();
+    expect(setOpen).toHaveBeenCalledWith(false);
+    // Order matters: the resolver must learn the PRE-force state, not the post-force one.
+    expect(callOrder).toEqual(['ack', 'setOpen']);
+  });
+
+  it('on {kind:"restore", open}: applies setOpen(open) FIRST, then acknowledges with no snapshot', () => {
+    const { setOpen, acknowledgeSidebarIntent } = configureTestBed({ kind: 'restore', open: true }, false);
+    const callOrder: string[] = [];
+    setOpen.mockImplementation(() => callOrder.push('setOpen'));
+    acknowledgeSidebarIntent.mockImplementation(() => callOrder.push('ack'));
+
+    TestBed.inject(AppSidebar);
+    flush();
+
+    expect(setOpen).toHaveBeenCalledOnce();
+    expect(setOpen).toHaveBeenCalledWith(true);
+    expect(acknowledgeSidebarIntent).toHaveBeenCalledOnce();
+    expect(acknowledgeSidebarIntent).toHaveBeenCalledWith();
+    expect(callOrder).toEqual(['setOpen', 'ack']);
+  });
+
+  it('on null: touches neither the sidebar nor the resolver', () => {
+    const { setOpen, acknowledgeSidebarIntent } = configureTestBed(null, true);
+
+    TestBed.inject(AppSidebar);
+    flush();
+
+    // Non-tautological: if the effect ran unconditionally, both would have been called.
+    expect(setOpen).not.toHaveBeenCalled();
+    expect(acknowledgeSidebarIntent).not.toHaveBeenCalled();
+  });
+});