@aurorajs.dev/catalyst-cli 1.0.2 → 2.0.0

package/dist/templates/backend/application/src/@config/drizzle/aurora-drizzle-schema.spec.ts

@@ -0,0 +1,238 @@
+// F3 cutover (group 12.1) — the schema/relations assembly point that
+// `DrizzleConfigModule.forRoot()` needs. Every per-BC `<bc>.relations.ts` is
+// `@aurora-catalyst-generated`; this file is the ONE hand-written junction
+// that merges them for the single @Global Drizzle connection.
+//
+// LOCATION (group 12.2): moved out of `@aurora/persistence/` into
+// `@config/drizzle/` — see the co-located `aurora-drizzle-schema.ts` header
+// for the HR-PORTS-001 rationale.
+//
+// CROSS-BC PIN (`generate-cross-bc-drizzle-relations`, tasks.md 7.1): the
+// `CROSS_BC_INVENTORY` table below and its two data-driven suites pin the
+// cross-BC shape — entry count per table AND the union invariant — BEFORE
+// the `crossBcRelations` block becomes generator-owned (task 7.3/7.4). They
+// are written to hold UNCHANGED once that regeneration lands: the generator
+// is expected to reproduce this exact same declared content from the same
+// YAML inputs, not a different one. If a regen ever changes what these pin,
+// that is a signal to look, not to update the pin to match.
+//
+// ONE deliberate exception, added after looking: regenerating `hub/app`
+// (task 7.3) added `hubApp.accounts`, taking the inventory from 16 entries to
+// 17 across the same 13 tables. It is not drift — it is the silent-column
+// runtime failure T-4.1 measured. It was declared in `cliter/**` with no entry
+// here, no human ever hand-wrote it, and the generator does. The pin was
+// updated because the CORRECT content changed, and the union invariant is what
+// caught it — exactly as intended.
+import {
+  businessPartnerPortalRelations,
+  businessPartnerPortalSchema,
+} from '@app/business-partner-portal/business-partner-portal.relations.js';
+import { commonSchema } from '@app/common/common.relations.js';
+import { dashboardRelations, dashboardSchema } from '@app/dashboard/dashboard.relations.js';
+import { hubRelations, hubSchema } from '@app/hub/hub.relations.js';
+import { iamRelations, iamSchema } from '@app/iam/iam.relations.js';
+import { lacremSchema } from '@app/lacrem/lacrem.relations.js';
+import { oAuthRelations, oAuthSchema } from '@app/o-auth/o-auth.relations.js';
+import { partnerSchema } from '@app/partner/partner.relations.js';
+import {
+  productionPlanningRelations,
+  productionPlanningSchema,
+} from '@app/production-planning/production-planning.relations.js';
+import { reportingRelations, reportingSchema } from '@app/reporting/reporting.relations.js';
+import { sapIntegrationSchema } from '@app/sap-integration/sap-integration.relations.js';
+import { toolsSchema } from '@app/tools/tools.relations.js';
+
+import { auroraDrizzleRelations, auroraDrizzleSchema } from './aurora-drizzle-schema.js';
+
+/**
+ * Canonical inventory of every declared cross-BC relation, measured against
+ * `backend/src/@config/drizzle/aurora-drizzle-schema.ts`: **13 tables, 17
+ * entries**, the count `hubApp.accounts` took it to when task 7.3 regenerated
+ * its module.
+ *
+ * It started at 13 tables / 16 entries — the hand-written block before that
+ * regeneration, matching the "16 resolve because someone remembered" figure
+ * `proposal.md` measured in T-4.1. Both measurements are kept: the delta
+ * between them IS the defect this change closes.
+ *
+ * `ownRelations` is the per-BC relations object (e.g. `hubRelations.hubApp`)
+ * the cross-BC entries are merged INTO — used below to assert the union, not
+ * just the cross-BC half.
+ */
+const CROSS_BC_INVENTORY: {
+  crossBc: readonly { label: string; targetKey: keyof typeof auroraDrizzleSchema }[];
+  ownRelations: { relations: Record<string, unknown> };
+  tableKey: keyof typeof auroraDrizzleRelations;
+}[] = [
+  {
+    crossBc: [
+      { label: 'accounts', targetKey: 'iamAccount' },
+      { label: 'application', targetKey: 'oAuthApplication' },
+    ],
+    ownRelations: hubRelations.hubApp,
+    tableKey: 'hubApp',
+  },
+  { crossBc: [{ label: 'account', targetKey: 'iamAccount' }], ownRelations: hubRelations.hubAppAccount, tableKey: 'hubAppAccount' },
+  { crossBc: [{ label: 'client', targetKey: 'oAuthClient' }], ownRelations: iamRelations.iamAccount, tableKey: 'iamAccount' },
+  {
+    crossBc: [
+      { label: 'account', targetKey: 'iamAccount' },
+      { label: 'role', targetKey: 'iamRole' },
+    ],
+    ownRelations: dashboardRelations.dashboardLayout,
+    tableKey: 'dashboardLayout',
+  },
+  {
+    crossBc: [
+      { label: 'account', targetKey: 'iamAccount' },
+      { label: 'impersonatorAccount', targetKey: 'iamAccount' },
+    ],
+    ownRelations: oAuthRelations.oAuthCredential,
+    tableKey: 'oAuthCredential',
+  },
+  { crossBc: [{ label: 'favorites', targetKey: 'iamAccount' }], ownRelations: reportingRelations.reportingReport, tableKey: 'reportingReport' },
+  {
+    crossBc: [{ label: 'account', targetKey: 'iamAccount' }],
+    ownRelations: reportingRelations.reportingReportFavorite,
+    tableKey: 'reportingReportFavorite',
+  },
+  {
+    crossBc: [{ label: 'tenant', targetKey: 'iamTenant' }],
+    ownRelations: businessPartnerPortalRelations.businessPartnerPortalBusinessPartner,
+    tableKey: 'businessPartnerPortalBusinessPartner',
+  },
+  {
+    crossBc: [
+      { label: 'tenant', targetKey: 'iamTenant' },
+      { label: 'account', targetKey: 'iamAccount' },
+    ],
+    ownRelations: businessPartnerPortalRelations.businessPartnerPortalPartnerContact,
+    tableKey: 'businessPartnerPortalPartnerContact',
+  },
+  {
+    crossBc: [{ label: 'tenant', targetKey: 'iamTenant' }],
+    ownRelations: businessPartnerPortalRelations.businessPartnerPortalSupplierDocument,
+    tableKey: 'businessPartnerPortalSupplierDocument',
+  },
+  {
+    crossBc: [{ label: 'account', targetKey: 'iamAccount' }],
+    ownRelations: productionPlanningRelations.productionPlanningProductionOrderPositionEvent,
+    tableKey: 'productionPlanningProductionOrderPositionEvent',
+  },
+  {
+    crossBc: [{ label: 'account', targetKey: 'iamAccount' }],
+    ownRelations: productionPlanningRelations.productionPlanningAccountProductionOrderPosition,
+    tableKey: 'productionPlanningAccountProductionOrderPosition',
+  },
+  {
+    crossBc: [{ label: 'accounts', targetKey: 'iamAccount' }],
+    ownRelations: productionPlanningRelations.productionPlanningProductionOrderPosition,
+    tableKey: 'productionPlanningProductionOrderPosition',
+  },
+];
+
+describe('auroraDrizzleSchema / auroraDrizzleRelations', () => {
+  const perBcSchemas: Record<string, unknown>[] = [
+    commonSchema,
+    toolsSchema,
+    iamSchema,
+    oAuthSchema,
+    hubSchema,
+    dashboardSchema,
+    reportingSchema,
+    lacremSchema,
+    sapIntegrationSchema,
+    partnerSchema,
+    businessPartnerPortalSchema,
+    productionPlanningSchema,
+  ];
+
+  it('merges every BC schema without key collisions', () => {
+    const expectedKeyCount = perBcSchemas.reduce(
+      (sum, schema) => sum + Object.keys(schema).length,
+      0,
+    );
+
+    expect(Object.keys(auroraDrizzleSchema)).toHaveLength(expectedKeyCount);
+  });
+
+  it('preserves table object identity per BC (spread never clones/overwrites)', () => {
+    for (const schema of perBcSchemas) {
+      for (const [tableKey, table] of Object.entries(schema)) {
+        expect(auroraDrizzleSchema[tableKey as keyof typeof auroraDrizzleSchema]).toBe(table);
+      }
+    }
+  });
+
+  it('merges relations across BCs, preserving each declared relation', () => {
+    // iam: iamAccount -> roles/tenants/user (iam.relations.ts)
+    expect(auroraDrizzleRelations.iamAccount.relations.roles).toBeDefined();
+    expect(auroraDrizzleRelations.iamAccount.relations.user).toBeDefined();
+    // hub: hubAppAccount -> app (hub.relations.ts)
+    expect(auroraDrizzleRelations.hubAppAccount.relations.app).toBeDefined();
+    // o-auth: oAuthApplicationClient carries relations too
+    expect(auroraDrizzleRelations.oAuthApplicationClient.relations).toBeDefined();
+  });
+
+  it('does not silently drop a BC on relations merge (same key-count invariant)', () => {
+    const relationsKeyCount = Object.keys(auroraDrizzleRelations).length;
+    const schemaKeyCount = Object.keys(auroraDrizzleSchema).length;
+
+    expect(relationsKeyCount).toBe(schemaKeyCount);
+  });
+
+  // Cross-BC relations the task-13 sweep missed, plus hubApp.application and
+  // reportingReportFavorite.account (previously pinned by two separate,
+  // ad-hoc tests — folded in here so there is ONE canonical inventory,
+  // `CROSS_BC_INVENTORY` above, instead of two sources of truth that could
+  // drift apart). Each one is declared in its aggregate's `*.aurora.yaml`
+  // AND exposed by the generated GraphQL type, so any `relations: { <field>:
+  // true }` read (e.g. the frontend detail views) crashes
+  // `assertKnownRelations` with "Unknown relation" without its entry.
+  it.each(CROSS_BC_INVENTORY.flatMap(({ crossBc, tableKey }) => crossBc.map((entry) => [tableKey, entry.label, entry.targetKey] as const)))(
+    'declares the CROSS-BC %s.%s relation targeting %s',
+    (tableKey, label, targetKey) => {
+      const tableConfig = auroraDrizzleRelations[tableKey] as unknown as {
+        relations: Record<string, { sourceTable: unknown; targetTable: unknown }>;
+      };
+      const relation = tableConfig.relations[label];
+
+      expect(relation).toBeDefined();
+      expect(relation.targetTable).toBe(auroraDrizzleSchema[targetKey]);
+      expect(relation.sourceTable).toBe(auroraDrizzleSchema[tableKey]);
+    },
+  );
+
+  // 16 was T-4.1's measured figure — the entries that resolved because a
+  // human had remembered to hand-write them. The other one, `hubApp.accounts`,
+  // is the one nobody wrote and the generator now does; it closes the
+  // silent-column failure T-4.1 measured. The count is pinned so a FURTHER
+  // change has to be deliberate, not so it can never move.
+  it('pins the TOTAL cross-BC entry count at 17 across 13 tables (T-4.1 measured 16 hand-written, plus the one the generator adds)', () => {
+    expect(CROSS_BC_INVENTORY).toHaveLength(13);
+    const totalEntries = CROSS_BC_INVENTORY.reduce((sum, { crossBc }) => sum + crossBc.length, 0);
+    expect(totalEntries).toBe(17);
+  });
+
+  // The union invariant (design.md D2, spec.md "a module's own-BC entries
+  // and its cross-BC entries do not overwrite each other"): for EVERY table
+  // carrying a cross-BC entry, the merged relations object must contain the
+  // COMPLETE union of its own-BC relations (by reference — never cloned or
+  // replaced) AND its cross-BC ones, with NO extra or missing key. A "some
+  // own relations survived" smoke check would miss a silently dropped own
+  // relation or an accidental extra cross-BC entry; comparing the exact key
+  // COUNT catches both.
+  it.each(CROSS_BC_INVENTORY.map(({ crossBc, ownRelations, tableKey }) => [tableKey, ownRelations, crossBc] as const))(
+    'keeps %s\'s own-BC relations intact (by reference) when its cross-BC entries are merged in',
+    (tableKey, ownRelations, crossBc) => {
+      const merged = (auroraDrizzleRelations[tableKey] as unknown as { relations: Record<string, unknown> })
+        .relations;
+
+      for (const [ownLabel, ownRelation] of Object.entries(ownRelations.relations)) {
+        expect(merged[ownLabel]).toBe(ownRelation);
+      }
+
+      expect(Object.keys(merged)).toHaveLength(Object.keys(ownRelations.relations).length + crossBc.length);
+    },
+  );
+});

package/dist/templates/backend/application/src/@config/drizzle/aurora-drizzle-schema.ts

@@ -0,0 +1,335 @@
+/**
+ * F3 cutover (group 12.1) — the schema/relations assembly point that feeds
+ * `DrizzleConfigModule.forRoot({ schema, relations })`, forwarded by
+ * `CoreModule.forRoot()` (`@aurora/core.module.ts`).
+ *
+ * `ICriteria` is bound `@Global` (see `criteria-config.module.ts`): ONE
+ * Drizzle engine serves the whole app, so it needs ONE merged schema and ONE
+ * merged relations config, assembled from every BC's `@aurora-catalyst-generated`
+ * `<bc>.relations.ts` (regenerated per-BC in groups 2-10).
+ *
+ * Merge strategy: a plain object spread. Every per-BC schema/relations key is
+ * BC-prefixed by the CLI (`iamAccount`, `oAuthCredential`, `hubApp`, ...), so
+ * collisions across BCs are not expected — `aurora-drizzle-schema.spec.ts`
+ * pins the key-count invariant so a future collision fails loudly (silently
+ * dropped table) instead of silently.
+ *
+ * `queue-manager` has no aggregate modules (task 10.3) — nothing to merge.
+ *
+ * LOCATION (group 12.2, HR-PORTS-001 fix — decisión del usuario 2026-07-04):
+ * lives in `@config/`, NOT `@aurora/`. This file imports from all 9 BCs
+ * (`@app/**`) — inside `@aurora/**` that would be exactly the upward
+ * inversion HR-PORTS-001 forbids (`@aurora → @app`), and would break the
+ * doctrine that `@aurora` must be wholesale-replaceable (delete & paste) with
+ * ZERO app-specific knowledge. `@config/` is app territory — same tier as
+ * `app.module.ts` — and already hosts other cross-cutting DI wiring
+ * (`@config/mailer`, `@config/bullmq`). `app.module.ts` imports this file and
+ * passes `{ schema, relations }` into `CoreModule.forRoot()`; `@aurora/`
+ * itself only ever sees the opaque `DrizzleConfigModuleOptions` shape.
+ */
+import {
+  businessPartnerPortalRelations,
+  businessPartnerPortalSchema,
+} from '@app/business-partner-portal/business-partner-portal.relations.js';
+import { commonRelations, commonSchema } from '@app/common/common.relations.js';
+import { dashboardRelations, dashboardSchema } from '@app/dashboard/dashboard.relations.js';
+import { hubRelations, hubSchema } from '@app/hub/hub.relations.js';
+import { iamRelations, iamSchema } from '@app/iam/iam.relations.js';
+import { lacremRelations, lacremSchema } from '@app/lacrem/lacrem.relations.js';
+import { oAuthRelations, oAuthSchema } from '@app/o-auth/o-auth.relations.js';
+import { partnerRelations, partnerSchema } from '@app/partner/partner.relations.js';
+import {
+  productionPlanningRelations,
+  productionPlanningSchema,
+} from '@app/production-planning/production-planning.relations.js';
+import { reportingRelations, reportingSchema } from '@app/reporting/reporting.relations.js';
+import {
+  sapIntegrationRelations,
+  sapIntegrationSchema,
+} from '@app/sap-integration/sap-integration.relations.js';
+import { toolsRelations, toolsSchema } from '@app/tools/tools.relations.js';
+import { defineRelationsPart } from 'drizzle-orm';
+
+export const auroraDrizzleSchema = {
+  ...commonSchema,
+  ...toolsSchema,
+  ...iamSchema,
+  ...oAuthSchema,
+  ...hubSchema,
+  ...dashboardSchema,
+  ...reportingSchema,
+  ...lacremSchema,
+  ...sapIntegrationSchema,
+  ...partnerSchema,
+  ...businessPartnerPortalSchema,
+  ...productionPlanningSchema,
+};
+
+/**
+ * CROSS-BC relations (`generate-cross-bc-drizzle-relations`) — GENERATED,
+ * upserted per entry by `packages/cli`'s `upsertCrossBcRelationEntry`
+ * (`src/generator/utils/relations-file.ts`), triggered whenever a module on
+ * either end of a declared relation is (re)generated
+ * (`selectRelevantCrossBcCandidates` + `CodeWriter.declareBackSchemaInBcRelations`,
+ * design.md D1–D3). It was hand-written before this change; every entry
+ * below is still editable by hand and reconciled through `.origin` like any
+ * other generated artifact (HR-CODEGEN-001) — the generator is a source of
+ * upserts, not the only writer.
+ *
+ * UPDATED, not deleted — the measured constraint this comment has always
+ * recorded is still exactly why these entries live here and nowhere else:
+ * the CLI-generated per-BC `<bc>.relations.ts` files each call
+ * `defineRelations` over their OWN schema, so a relation whose target table
+ * belongs to another BC is inexpressible there. Under Sequelize these were
+ * covered by the kept-alive cross-BC model associations; the Drizzle engine
+ * needs them declared against the MERGED schema instead. Missing entries
+ * crash every eager-load of that relation in `PgDialect.buildRelationalQuery`
+ * with "Cannot read properties of undefined (reading 'targetTable')".
+ *
+ * WHY A SINGLE ASSEMBLY POINT IS STILL IRREDUCIBLE, even now that the
+ * entries are generator-owned: RQB v2's `relations` object is resolved ONCE,
+ * as a complete per-table union, at the SAME call site that declares the
+ * schema it resolves against (`defineRelations`/`defineRelationsPart`
+ * against `auroraDrizzleSchema`). There is no per-model side-channel the way
+ * `sequelize-typescript`'s decorators gave one — a Sequelize model declared
+ * its own associations independently, anywhere, and `sequelize-typescript`
+ * collected them globally at bootstrap. Drizzle has no equivalent: nothing
+ * short of editing this file's `crossBcRelations` object can add a relation
+ * to the merged config, so generating either endpoint of a cross-BC pair
+ * upserts INTO this file rather than emitting a self-sufficient fragment
+ * elsewhere. Removing this assembly point is therefore not on the table for
+ * any future change unless Drizzle's RQB itself grows that side-channel.
+ *
+ * THE SINGLE-DATABASE ASSUMPTION, stated openly rather than buried: this
+ * entire mechanism — and the hand-written block it replaced — is possible
+ * only because every bounded context's tables live in ONE Postgres database
+ * behind ONE Drizzle engine (`ICriteria` bound `@Global`). A database-level
+ * join across contexts cannot survive a context being split into its own
+ * datastore: every cross-BC relation declared here would break at once, with
+ * no incremental migration path — this file's imports from all BCs (`@app/**`)
+ * are exactly the coupling a context split would have to unwind first. This
+ * change does not create that coupling; generating the entries mechanically,
+ * instead of by hand, makes it CHEAPER to add more of it. Treat any future
+ * context extraction as a change that must revisit every entry below.
+ *
+ * The exhaustive per-entry bullet list this comment used to carry (naming
+ * each relation and the GraphQL read driving it, task 13 sweep + F3 fix-up +
+ * 2026-07-05 full-YAML sweep) has been REMOVED rather than kept stale: a
+ * hand-maintained index of a generator-owned block drifts the moment a new
+ * cross-BC relation is added via YAML + regen without a human also updating
+ * this comment, which is precisely the kind of silent, unmeasured claim this
+ * project's conventions forbid. The canonical, always-current inventory is
+ * `cliter/**\/*.aurora.yaml`'s `relationship:` declarations whose `modulePath`
+ * names a different bounded context — cross-referenced against
+ * `backend/src/@config/drizzle/aurora-drizzle-schema.spec.ts`'s
+ * `CROSS_BC_INVENTORY`, which pins the count and shape measured at the time
+ * of this change (13 tables, 17 entries, of which `hubApp.accounts` is the one
+ * the generator adds rather than a human — the runtime failure T-4.1 measured)
+ * and is expected to grow as new cross-BC relations are declared and generated.
+ */
+const crossBcRelations = defineRelationsPart(auroraDrizzleSchema, (r) => ({
+  hubApp: {
+    accounts: r.many.iamAccount({
+      from: r.hubApp.id.through(r.hubAppAccount.appId),
+      to: r.iamAccount.id.through(r.hubAppAccount.accountId),
+    }),
+    application: r.one.oAuthApplication({
+      from: r.hubApp.applicationId,
+      to: r.oAuthApplication.id,
+    }),
+  },
+  hubAppAccount: {
+    account: r.one.iamAccount({
+      from: r.hubAppAccount.accountId,
+      to: r.iamAccount.id,
+    }),
+  },
+  iamAccount: {
+    client: r.one.oAuthClient({
+      from: r.iamAccount.clientId,
+      to: r.oAuthClient.id,
+    }),
+  },
+  dashboardLayout: {
+    account: r.one.iamAccount({
+      from: r.dashboardLayout.accountId,
+      to: r.iamAccount.id,
+    }),
+    role: r.one.iamRole({
+      from: r.dashboardLayout.roleId,
+      to: r.iamRole.id,
+    }),
+  },
+  oAuthCredential: {
+    account: r.one.iamAccount({
+      from: r.oAuthCredential.accountId,
+      to: r.iamAccount.id,
+    }),
+    impersonatorAccount: r.one.iamAccount({
+      from: r.oAuthCredential.impersonatorAccountId,
+      to: r.iamAccount.id,
+    }),
+  },
+  reportingReport: {
+    favorites: r.many.iamAccount({
+      from: r.reportingReport.id.through(r.reportingReportFavorite.reportId),
+      to: r.iamAccount.id.through(r.reportingReportFavorite.accountId),
+    }),
+  },
+  reportingReportFavorite: {
+    account: r.one.iamAccount({
+      from: r.reportingReportFavorite.accountId,
+      to: r.iamAccount.id,
+    }),
+  },
+  businessPartnerPortalBusinessPartner: {
+    tenant: r.one.iamTenant({
+      from: r.businessPartnerPortalBusinessPartner.tenantId,
+      to: r.iamTenant.id,
+    }),
+  },
+  businessPartnerPortalPartnerContact: {
+    tenant: r.one.iamTenant({
+      from: r.businessPartnerPortalPartnerContact.tenantId,
+      to: r.iamTenant.id,
+    }),
+    account: r.one.iamAccount({
+      from: r.businessPartnerPortalPartnerContact.accountId,
+      to: r.iamAccount.id,
+    }),
+  },
+  businessPartnerPortalSupplierDocument: {
+    tenant: r.one.iamTenant({
+      from: r.businessPartnerPortalSupplierDocument.tenantId,
+      to: r.iamTenant.id,
+    }),
+  },
+  productionPlanningProductionOrderPositionEvent: {
+    account: r.one.iamAccount({
+      from: r.productionPlanningProductionOrderPositionEvent.accountId,
+      to: r.iamAccount.id,
+    }),
+  },
+  productionPlanningAccountProductionOrderPosition: {
+    account: r.one.iamAccount({
+      from: r.productionPlanningAccountProductionOrderPosition.accountId,
+      to: r.iamAccount.id,
+    }),
+  },
+  productionPlanningProductionOrderPosition: {
+    accounts: r.many.iamAccount({
+      from: r.productionPlanningProductionOrderPosition.id.through(
+        r.productionPlanningAccountProductionOrderPosition.productionOrderPositionId,
+      ),
+      to: r.iamAccount.id.through(r.productionPlanningAccountProductionOrderPosition.accountId),
+    }),
+  },
+}));
+
+export const auroraDrizzleRelations = {
+  ...commonRelations,
+  ...toolsRelations,
+  ...iamRelations,
+  ...oAuthRelations,
+  ...hubRelations,
+  ...dashboardRelations,
+  ...reportingRelations,
+  ...lacremRelations,
+  ...sapIntegrationRelations,
+  ...partnerRelations,
+  ...businessPartnerPortalRelations,
+  ...productionPlanningRelations,
+  // Deep-merge the cross-BC entries: EXTEND the per-BC relations map, never
+  // replace the whole tablesConfig entry (hubApp keeps its per-BC relations).
+  hubApp: {
+    ...hubRelations.hubApp,
+    relations: {
+      ...hubRelations.hubApp.relations,
+      ...crossBcRelations.hubApp.relations,
+    },
+  },
+  hubAppAccount: {
+    ...hubRelations.hubAppAccount,
+    relations: {
+      ...hubRelations.hubAppAccount.relations,
+      ...crossBcRelations.hubAppAccount.relations,
+    },
+  },
+  iamAccount: {
+    ...iamRelations.iamAccount,
+    relations: {
+      ...iamRelations.iamAccount.relations,
+      ...crossBcRelations.iamAccount.relations,
+    },
+  },
+  dashboardLayout: {
+    ...dashboardRelations.dashboardLayout,
+    relations: {
+      ...dashboardRelations.dashboardLayout.relations,
+      ...crossBcRelations.dashboardLayout.relations,
+    },
+  },
+  oAuthCredential: {
+    ...oAuthRelations.oAuthCredential,
+    relations: {
+      ...oAuthRelations.oAuthCredential.relations,
+      ...crossBcRelations.oAuthCredential.relations,
+    },
+  },
+  reportingReport: {
+    ...reportingRelations.reportingReport,
+    relations: {
+      ...reportingRelations.reportingReport.relations,
+      ...crossBcRelations.reportingReport.relations,
+    },
+  },
+  reportingReportFavorite: {
+    ...reportingRelations.reportingReportFavorite,
+    relations: {
+      ...reportingRelations.reportingReportFavorite.relations,
+      ...crossBcRelations.reportingReportFavorite.relations,
+    },
+  },
+  businessPartnerPortalBusinessPartner: {
+    ...businessPartnerPortalRelations.businessPartnerPortalBusinessPartner,
+    relations: {
+      ...businessPartnerPortalRelations.businessPartnerPortalBusinessPartner.relations,
+      ...crossBcRelations.businessPartnerPortalBusinessPartner.relations,
+    },
+  },
+  businessPartnerPortalPartnerContact: {
+    ...businessPartnerPortalRelations.businessPartnerPortalPartnerContact,
+    relations: {
+      ...businessPartnerPortalRelations.businessPartnerPortalPartnerContact.relations,
+      ...crossBcRelations.businessPartnerPortalPartnerContact.relations,
+    },
+  },
+  businessPartnerPortalSupplierDocument: {
+    ...businessPartnerPortalRelations.businessPartnerPortalSupplierDocument,
+    relations: {
+      ...businessPartnerPortalRelations.businessPartnerPortalSupplierDocument.relations,
+      ...crossBcRelations.businessPartnerPortalSupplierDocument.relations,
+    },
+  },
+  productionPlanningProductionOrderPositionEvent: {
+    ...productionPlanningRelations.productionPlanningProductionOrderPositionEvent,
+    relations: {
+      ...productionPlanningRelations.productionPlanningProductionOrderPositionEvent.relations,
+      ...crossBcRelations.productionPlanningProductionOrderPositionEvent.relations,
+    },
+  },
+  productionPlanningAccountProductionOrderPosition: {
+    ...productionPlanningRelations.productionPlanningAccountProductionOrderPosition,
+    relations: {
+      ...productionPlanningRelations.productionPlanningAccountProductionOrderPosition.relations,
+      ...crossBcRelations.productionPlanningAccountProductionOrderPosition.relations,
+    },
+  },
+  productionPlanningProductionOrderPosition: {
+    ...productionPlanningRelations.productionPlanningProductionOrderPosition,
+    relations: {
+      ...productionPlanningRelations.productionPlanningProductionOrderPosition.relations,
+      ...crossBcRelations.productionPlanningProductionOrderPosition.relations,
+    },
+  },
+};

package/dist/templates/backend/application/src/@config/drizzle/aurora-field-schemas.spec.ts

@@ -0,0 +1,92 @@
+/**
+ * guard-masked-properties-in-query-dsl, task 7.1 — mirrors the count-invariant pattern of
+ * `aurora-drizzle-schema.spec.ts`. Two invariants:
+ *
+ *  1. COVERAGE — the map registers EVERY aggregate, not only the ones declaring a masked property.
+ *     That is the whole point of the map: the guard follows a relation edge through the PARENT's
+ *     schema, so an unregistered parent leaves every masked child behind it queryable.
+ *  2. INVENTORY — the four aggregates that DO declare a masked property still resolve to a schema
+ *     declaring the expected property names, decided by the framework's own `isMaskedPropertyType`
+ *     rather than by a second hand-written copy of the type list or of the predicate.
+ *
+ * `scripts/contracts/masked-property-guard.test.ts` (task 9) owns the general completeness check
+ * against the repositories on disk; this spec pins the CONCRETE inventory for this repository.
+ */
+import { IamUserFieldSchema } from '@app/iam/user/index.js';
+import { OAuthAccessTokenFieldSchema } from '@app/o-auth/access-token/index.js';
+import { OAuthApplicationFieldSchema } from '@app/o-auth/application/index.js';
+import { OAuthRefreshTokenFieldSchema } from '@app/o-auth/refresh-token/index.js';
+import { FieldSchema, isMaskedPropertyType } from '@aurorajs.dev/core-back';
+
+import { auroraFieldSchemas } from './aurora-field-schemas.js';
+
+/** Scalar (non-relation) entries whose declared type is masked, by declaration order. */
+function maskedNames(schema: FieldSchema[]): string[] {
+  return schema
+    .filter((field) => field.type !== 'relation')
+    .filter((field) => isMaskedPropertyType(field.type))
+    .map((field) => field.name);
+}
+
+describe('auroraFieldSchemas', () => {
+  it('registers every aggregate the application exposes, not only the ones declaring a masked property', () => {
+    // 60 field-schema files, one per aggregate.
+    // `CommonCountryI18n` is the only repository with no field schema of its own (the CLI folds
+    // i18n columns into the parent's schema), so it cannot be registered — the contract test
+    // pins it as the single reviewed exception.
+    expect(Object.keys(auroraFieldSchemas)).toHaveLength(60);
+  });
+
+  it('registers aggregates that declare NO masked property but are parents on a path to one', () => {
+    // Each of these was an exploited bypass while only the declaring four were registered:
+    // a read on the parent reached the masked child through a relation the guard never walked.
+    for (const parent of [
+      'OAuthCredential',
+      'IamAccount',
+      'OAuthClient',
+      'HubApp',
+      'OAuthApplicationClient',
+    ]) {
+      expect(auroraFieldSchemas[parent]).toBeDefined();
+      expect(maskedNames(auroraFieldSchemas[parent])).toEqual([]);
+    }
+  });
+
+  it('registers IamUser with password, twoFactorAuthenticationSecret and rememberToken masked', () => {
+    expect(auroraFieldSchemas.IamUser).toBe(IamUserFieldSchema);
+    expect(maskedNames(auroraFieldSchemas.IamUser)).toEqual([
+      'password',
+      'twoFactorAuthenticationSecret',
+      'rememberToken',
+    ]);
+  });
+
+  it('registers OAuthApplication with secret masked', () => {
+    expect(auroraFieldSchemas.OAuthApplication).toBe(OAuthApplicationFieldSchema);
+    expect(maskedNames(auroraFieldSchemas.OAuthApplication)).toEqual(['secret']);
+  });
+
+  it('registers OAuthAccessToken with token masked', () => {
+    expect(auroraFieldSchemas.OAuthAccessToken).toBe(OAuthAccessTokenFieldSchema);
+    expect(maskedNames(auroraFieldSchemas.OAuthAccessToken)).toEqual(['token']);
+  });
+
+  it('registers OAuthRefreshToken with token masked', () => {
+    expect(auroraFieldSchemas.OAuthRefreshToken).toBe(OAuthRefreshTokenFieldSchema);
+    expect(maskedNames(auroraFieldSchemas.OAuthRefreshToken)).toEqual(['token']);
+  });
+
+  it('exactly four aggregates declare a masked property of their own', () => {
+    const declaring = Object.entries(auroraFieldSchemas)
+      .filter(([, schema]) => maskedNames(schema).length > 0)
+      .map(([name]) => name)
+      .sort();
+
+    expect(declaring).toEqual([
+      'IamUser',
+      'OAuthAccessToken',
+      'OAuthApplication',
+      'OAuthRefreshToken',
+    ]);
+  });
+});