@aurorajs.dev/catalyst-cli 1.1.3 → 2.0.0

package/README.md

@@ -48,7 +48,7 @@ $ npm install -g @aurorajs.dev/catalyst-cli
 $ catalyst COMMAND
 running command...
 $ catalyst (--version)
-@aurorajs.dev/catalyst-cli/1.1.3 darwin-arm64 node-v24.16.0
+@aurorajs.dev/catalyst-cli/2.0.0 darwin-arm64 node-v24.16.0
 $ catalyst --help [COMMAND]
 USAGE
   $ catalyst COMMAND

package/dist/commands/generate/index.js

@@ -1,7 +1,7 @@
 import { Args, Command, Flags } from '@oclif/core';
 import { execFileSync } from 'node:child_process';
 import * as fs from 'node:fs';
-import { loadSchema } from '../../generator/domain/schema-loader.js';
+import { assertRelationshipModulePathsExist, loadSchema, } from '../../generator/domain/schema-loader.js';
 import { loadLockFiles } from '../../generator/engine/lock-file.js';
 import { generateBackModule } from '../../generator/handlers/back.handler.js';
 import { generateFrontModule } from '../../generator/handlers/front.handler.js';
@@ -83,6 +83,7 @@ export default class Generate extends Command {
         const baseDir = flags.target ?? defaultDir;
         const { boundedContextName, moduleName } = this.parseName(flags.name);
         const schema = loadSchema(boundedContextName, moduleName);
+        assertRelationshipModulePathsExist(schema);
         const lockFiles = loadLockFiles(boundedContextName, moduleName, scope);
         const ctx = {
             baseDir,

package/dist/generator/domain/config.js

@@ -284,9 +284,9 @@ export const DRIZZLE_COLUMNS = {
         const length = property.length ?? DEFAULT_TYPE_LENGTH.char;
         return `char('${field}', { length: ${length} })`;
     },
-    // Sequelize incumbent mapped `date` to DataTypes.DATE = TIMESTAMP WITH TIME
-    // ZONE on Postgres — mirror it with withTimezone (parity, not a redesign).
-    date: (property) => `timestamp('${toSnakeCase(property.name)}', { mode: 'string', withTimezone: true })`,
+    // A `date` is a calendar day: no time-of-day, no timezone. `dateTime` is the
+    // instant-bearing type below — the two never emit the same column type.
+    date: (property) => `date('${toSnakeCase(property.name)}', { mode: 'string' })`,
     dateTime(property) {
         const field = toSnakeCase(property.name);
         const withTimezone = property.applyTimezone !== false;

package/dist/generator/domain/custom-field-value.js

@@ -37,7 +37,7 @@ export function getCustomFieldValueFieldSchemaSymbol(schema) {
 }
 /** Relative import specifier (same directory) for the parent module's own Drizzle schema file. */
 export function getParentSchemaImportSpecifier(schema) {
-    return `./${toKebabCase(schema.boundedContextName)}-drizzle-${toKebabCase(schema.moduleName)}.schema`;
+    return `./${toKebabCase(schema.boundedContextName)}-drizzle-${toKebabCase(schema.moduleName)}.schema.js`;
 }
 /** `<bc><Module>Table` — the parent module's own Drizzle pgTable const. */
 export function getParentTableSymbol(schema) {

package/dist/generator/domain/display-field.d.ts

@@ -95,3 +95,27 @@ export declare const getDisplayFieldTemplate: (schema: ModuleDefinitionSchema) =
  *   - **Default (unset)** → returns `'name'`.
  */
 export declare const getDisplayFieldFirstIdentifier: (schema: ModuleDefinitionSchema) => string;
+/**
+ * Convert a `{<identifier>}`-placeholder template (the shape
+ * `getDisplayFieldTemplate` / cross-schema `getTargetDisplayFieldTemplate`
+ * return) into a static Angular interpolation string, substituting each
+ * placeholder with `{{ <rowExpr>.<identifier> }}`. Literal text between
+ * placeholders is emitted verbatim.
+ *
+ * Angular's template parser reads a bare `{`, `}`, or `@` as the start of an
+ * interpolation or a control-flow block (`@if`/`@for`/...), so a literal
+ * segment containing one of those three characters cannot be emitted safely
+ * this way — this function throws, naming the offending template and
+ * character, rather than emit a template Angular cannot parse.
+ *
+ * @param template  a `{<identifier>}`-placeholder template
+ * @param rowExpr   the row reference substituted into each placeholder
+ *                  (e.g. `'option'`)
+ *
+ * @example
+ * templateToAngularInterpolation('{name}', 'option')
+ * // '{{ option.name }}'
+ * templateToAngularInterpolation('{code} - {name}', 'option')
+ * // '{{ option.code }} - {{ option.name }}'
+ */
+export declare const templateToAngularInterpolation: (template: string, rowExpr: string) => string;

package/dist/generator/domain/display-field.js

@@ -121,3 +121,45 @@ export const getDisplayFieldFirstIdentifier = (schema) => {
     const match = ref.template.match(PLACEHOLDER_FIRST_RE);
     return match ? match[1] : 'name';
 };
+const UNSAFE_ANGULAR_LITERAL_RE = /[{}@]/;
+/**
+ * Convert a `{<identifier>}`-placeholder template (the shape
+ * `getDisplayFieldTemplate` / cross-schema `getTargetDisplayFieldTemplate`
+ * return) into a static Angular interpolation string, substituting each
+ * placeholder with `{{ <rowExpr>.<identifier> }}`. Literal text between
+ * placeholders is emitted verbatim.
+ *
+ * Angular's template parser reads a bare `{`, `}`, or `@` as the start of an
+ * interpolation or a control-flow block (`@if`/`@for`/...), so a literal
+ * segment containing one of those three characters cannot be emitted safely
+ * this way — this function throws, naming the offending template and
+ * character, rather than emit a template Angular cannot parse.
+ *
+ * @param template  a `{<identifier>}`-placeholder template
+ * @param rowExpr   the row reference substituted into each placeholder
+ *                  (e.g. `'option'`)
+ *
+ * @example
+ * templateToAngularInterpolation('{name}', 'option')
+ * // '{{ option.name }}'
+ * templateToAngularInterpolation('{code} - {name}', 'option')
+ * // '{{ option.code }} - {{ option.name }}'
+ */
+export const templateToAngularInterpolation = (template, rowExpr) => {
+    let result = '';
+    let cursor = 0;
+    for (const match of template.matchAll(PLACEHOLDER_GLOBAL_RE)) {
+        const literal = template.slice(cursor, match.index);
+        assertAngularSafeLiteral(literal, template);
+        result += literal + `{{ ${rowExpr}.${match[1]} }}`;
+        cursor = match.index + match[0].length;
+    }
+    const trailing = template.slice(cursor);
+    assertAngularSafeLiteral(trailing, template);
+    return result + trailing;
+};
+function assertAngularSafeLiteral(literal, template) {
+    if (UNSAFE_ANGULAR_LITERAL_RE.test(literal)) {
+        throw new Error(`front.displayField template '${template}' has a '{', '}', or '@' outside a {<field>} placeholder — Angular would parse it as an interpolation or a control-flow block. Remove it or rephrase the template.`);
+    }
+}

package/dist/generator/domain/i18n-table.js

@@ -53,7 +53,7 @@ export function getI18nTableAggregateName(schema) {
 }
 /** Relative import specifier (same directory) for the parent module's own Drizzle schema file. */
 export function getI18nTableParentSchemaImportSpecifier(schema) {
-    return `./${toKebabCase(schema.boundedContextName)}-drizzle-${toKebabCase(schema.moduleName)}.schema`;
+    return `./${toKebabCase(schema.boundedContextName)}-drizzle-${toKebabCase(schema.moduleName)}.schema.js`;
 }
 /** `<bc><Module>Table` — the parent module's own Drizzle pgTable const. */
 export function getI18nTableParentTableSymbol(schema) {

package/dist/generator/domain/model.d.ts

@@ -123,6 +123,13 @@ export interface Property {
     arrayOptions?: PropertyArrayOptions;
     /** SQL `AUTO_INCREMENT` for numeric primary keys. */
     autoIncrement?: boolean;
+    /**
+     * The client instantiates this property ONLY at creation — writable on a
+     * create, rejected on an update (add-create-only-property-semantics).
+     * Mutually exclusive with `readOnly` on the same property: the loader
+     * rejects declaring both at load time.
+     */
+    createOnly?: boolean;
     /** Two-element tuple `[precision, scale]` for `decimal` types. */
     decimals?: number[];
     /** Literal default value emitted in the DTO / column definition. */
@@ -152,7 +159,14 @@ export interface Property {
     name: string;
     nullable?: boolean;
     primaryKey?: boolean;
-    readonly?: boolean;
+    /**
+     * No client ever writes this property, in any operation
+     * (non-editable-field-codegen). Canonical spelling
+     * (add-create-only-property-semantics) — the loader normalizes the
+     * deprecated `readonly:` YAML key to this before any other code reads it,
+     * so downstream of `loadSchema` only `readOnly` exists on `Property`.
+     */
+    readOnly?: boolean;
     /** Relationship metadata when `type` is `relationship`. */
     relationship?: PropertyRelationship;
     type: PropertyType;

package/dist/generator/domain/property-filters.d.ts

@@ -2,7 +2,7 @@ import type { AdditionalApi, Property } from './model.js';
 export { getAdditionalApiFileName, getClassNameAdditionalApi, getResolverNameAdditionalApi, } from '../utils/additional-api.js';
 export { type ColumnSizing, getColumnSizingForProperty, } from './column-width.js';
 export { getDialogWidthClass } from './dialog-width.js';
-export { getDisplayField, getDisplayFieldExpr, getDisplayFieldFirstIdentifier, } from './display-field.js';
+export { getDisplayField, getDisplayFieldExpr, getDisplayFieldFirstIdentifier, templateToAngularInterpolation, } from './display-field.js';
 export { getFormHtmlId } from './form-id.js';
 export { getStandardOperationNames, type StandardOperationNames, } from './operation-names.js';
 export { getPivotFrontendExcludedFiles, getPivotFrontendKeptFiles, isPivotAggregate, } from './pivot.js';
@@ -15,6 +15,17 @@ declare function readQueryFilter(props: Property[]): Property[];
 export declare const hasProperties: (props: Property[]) => boolean;
 export declare const hasI18nProperties: (props: Property[]) => boolean;
 export declare const hasEnumProperties: (props: Property[]) => boolean;
+/**
+ * Whether the aggregate declares at least one `createOnly: true` property
+ * (add-create-only-property-semantics). Every write handler now declares its
+ * `@ApplySchema` operation unconditionally (mandatory-schema-decorator-operation),
+ * so this predicate no longer drives any backend decorator emission. Its two
+ * remaining callers are the frontend form templates
+ * (`__module_name__-form.component.ts.eta`, `__module_name__-form-embed.component.ts.eta`),
+ * which use it to decide which controls to lock in `edit` mode — a genuinely
+ * conditional question about the aggregate's own properties.
+ */
+export declare const hasCreateOnlyProperties: (props: Property[]) => boolean;
 export declare const hasBooleanProperties: (props: Property[]) => boolean;
 export declare const hasDateProperties: (props: Property[]) => boolean;
 export declare const hasTimestampProperties: (props: Property[]) => boolean;
@@ -46,6 +57,36 @@ export declare const getMaxLengthProperties: (props: Property[]) => Property[];
 export declare const getMinLengthProperties: (props: Property[]) => Property[];
 export declare const getIndexesProperties: (props: Property[]) => Property[];
 export declare const getPrimaryKeyProperties: (props: Property[]) => Property[];
+/** The aggregate's tenant-scoping column, as resolved by {@link getTenantProperty}. */
+export interface TenantProperty {
+    /** Whether the column holds a SET of tenants (`overlap`) vs a single value (`in`). */
+    isArray: boolean;
+    /** The property's declared name — `tenantId` or `tenantIds`. */
+    name: string;
+    /**
+     * Whether the column is nullable (item B, add-tenant-scope-decorators). A NULL tenant
+     * value means "visible to all tenants" — `@TenantConstraint({ nullable: true })` emits the
+     * `isNull`-guarded disjunction instead of the bare predicate.
+     */
+    nullable: boolean;
+}
+/**
+ * Resolves a `hasTenant: true` aggregate's tenant-scoping property (design D8,
+ * add-tenant-scope-decorators). Matches by EXACT name, `tenantId` checked
+ * BEFORE `tenantIds` — never by prefix: `cliter/message/message.aurora.yaml`
+ * declares both `tenantIds` and `tenantRecipientIds`, and a prefix match would
+ * resolve non-deterministically to whichever the schema happened to list
+ * first, silently scoping the whole aggregate by the wrong column.
+ *
+ * The shape (`isArray`) is read from the property's declared `type`, never
+ * guessed from its name — `type: 'array'` is the only signal.
+ *
+ * Returns `undefined` when neither name is declared; the CALLER (the
+ * generation step that composes template data, not this file) is responsible
+ * for aborting when a `hasTenant: true` module resolves nothing here — a file
+ * of pure predicates must never throw mid-render.
+ */
+export declare function getTenantProperty(props: Property[]): TenantProperty | undefined;
 export declare const getValueObjectsProperties: (props: Property[]) => Property[];
 export declare const getWithoutTimestampsProperties: (props: Property[]) => Property[];
 export declare const getWithoutDeletedAtProperties: (props: Property[]) => Property[];
@@ -66,6 +107,20 @@ export declare const getWithRelationshipOneToOneProperties: (props: Property[])
 export declare const getWithRelationshipOneToOneWithFieldProperties: (props: Property[]) => Property[];
 export declare const getWithRelationshipOneToOneWithoutFieldProperties: (props: Property[]) => Property[];
 export declare const getWithRelationshipManyToOneProperties: (props: Property[]) => Property[];
+/**
+ * True when a relationship property owns a physical FK column reachable by
+ * fetching the target's display value: many-to-one, or one-to-one WITH
+ * `field` (BelongsTo — the inverse HasOne nav has no `field` and no column).
+ * SINGLE source of truth for "does this property need its target requested
+ * via the Aurora Query DSL `relations` node" — the frontend columns,
+ * resolver and list templates all consult this instead of each re-deriving
+ * the same check (T-122: resolver/list only recognized many-to-one, so a
+ * one-to-one+field column from `columns.ts` was never actually requested
+ * from the server and rendered blank).
+ */
+export declare const isForeignKeyRelationshipProperty: (p: Property) => boolean;
+export declare const getWithForeignKeyRelationshipProperties: (props: Property[]) => Property[];
+export declare const hasForeignKeyRelationshipProperties: (props: Property[]) => boolean;
 export declare const getWithRelationshipOneToManyProperties: (props: Property[]) => Property[];
 export declare const getPrimaryKeyPropertiesFromPivotTable: (props: Property[]) => Property[];
 export declare const getCreateControllerProperties: typeof crudFilter;
@@ -104,6 +159,29 @@ export declare const getPostmanRestUpdateProperties: typeof baseWriteFilter;
 export declare function getI18nSearchableProperties(props: Property[], avoid?: string[]): Property[];
 export declare const getGridFieldsProperties: (props: Property[]) => Property[];
 export declare const getFormDetailFieldsProperties: (props: Property[]) => Property[];
+/**
+ * True when `dispatchField` (`partials/form/form-body.eta`) has a branch
+ * matching this property — i.e. the property, once it reaches the form
+ * body's dispatch step, emits actual markup instead of the empty string.
+ * Widget branches are checked first, mirroring `dispatchField`'s own
+ * if/else order: a widget hit shadows the scalar-type branches.
+ */
+export declare function hasFormFieldDispatchBranch(property: Property): boolean;
+/**
+ * The SINGLE source of truth for "this property emits markup inside the
+ * form" (harden-frontend-form-field-emission-parity). Combines the gate
+ * `form-body.eta` applies BEFORE dispatch (allowlist, bare-id, the two
+ * detail-shell-only widgets) with {@link hasFormFieldDispatchBranch} — the
+ * dispatch step itself. Both `form-body.eta`'s `isRenderableField` and the
+ * form component templates' `renderedFields`/`relationalFields` MUST consume
+ * this one predicate: before this change each side re-implemented its own
+ * subset, and a one-to-many relationship property with no widget (allowed
+ * through the component templates' narrower filter, rejected by
+ * `isAllowProperty`'s one-to-many default here) passed one side and not the
+ * other — the component declared imports (`FormField`, `ValidationMessagePipe`,
+ * `HlmFieldImports`) for a `<form>` that rendered nothing.
+ */
+export declare function isFormFieldRenderable(moduleName: string, property: Property): boolean;
 /**
  * SPEC-12: returns the visible+sorted form fields belonging to a single tab.
  * Builds on `getFormDetailFieldsProperties` (which already excludes timestamps,
@@ -122,6 +200,27 @@ export declare const getTabsFromProperties: (props: Property[]) => string[];
  * `widget.tab`.
  */
 export declare const hasFormTabsProperties: (props: Property[]) => boolean;
+/**
+ * The set of properties the form body ACTUALLY emits, tab dimension included.
+ * `form-body.eta`'s tabbed branch draws fields GROUPED PER TAB
+ * (`getFormDetailFieldsPropertiesForTab`), so a renderable field with no
+ * `widget.tab` — or one naming a tab the aggregate does not declare — gets no
+ * control there. The form component templates gate their conditional imports
+ * on this set: counting such a field would import (`HlmSwitchImports`, …) for
+ * a control that never renders. With `useFormTabs` false the tab dimension
+ * does not apply and this is the plain {@link isFormFieldRenderable} filter.
+ */
+export declare function getEmittedFormFields(moduleName: string, props: Property[], useFormTabs: boolean): Property[];
+/**
+ * The properties ONE tab actually emits — the source of `tabMeta.fieldNames`
+ * in both form templates, which feeds `<tab>HasErrors()` and
+ * `findFirstTabWithErrors()`. It consults {@link isFormFieldRenderable}, the
+ * same predicate `form-body.eta` dispatches through, so a tab never reports
+ * an error for a control the user cannot see: a property with no dispatch
+ * branch (a bare `jsonb`, say) and a `GRID_SELECT_MULTIPLE_ELEMENTS` widget
+ * (which renders outside the form, in the detail shell) are both excluded.
+ */
+export declare const getEmittedFormFieldsForTab: (moduleName: string, props: Property[], tabId: string) => Property[];
 export declare const getFormGroupFieldsProperties: (props: Property[]) => Property[];
 export declare const getFormGroupFieldsIsNotI18nProperties: (props: Property[]) => Property[];
 export declare const getSelectWidgetsProperties: (props: Property[]) => Property[];

package/dist/generator/domain/property-filters.js

@@ -9,12 +9,13 @@ import { v4 as uuidv4, v5 as uuidv5 } from 'uuid';
 import { isPathAllowedByExclusions } from '../utils/path-allowed.js';
 import { toCamelCase, toKebabCase } from '../utils/string-utils.js';
 import { DELETED_AT_FIELD, DETAIL_MODE, TIMESTAMP_FIELDS } from './config.js';
-import { isDrizzleColumn, isDrizzleManyRelation, isDrizzleManyToManyRelation, isDrizzleOneRelationInverse, isDrizzleOneRelationOwner, isPivot, isReadonly, isSecretProperty, } from './property-predicates.js';
+import { isAllowProperty } from './property-mappers.js';
+import { isCreateOnly, isDrizzleColumn, isDrizzleManyRelation, isDrizzleManyToManyRelation, isDrizzleOneRelationInverse, isDrizzleOneRelationOwner, isPivot, isReadOnly, isSecretProperty, } from './property-predicates.js';
 import { WidgetType } from './widget-type.js';
 export { getAdditionalApiFileName, getClassNameAdditionalApi, getResolverNameAdditionalApi, } from '../utils/additional-api.js';
 export { getColumnSizingForProperty, } from './column-width.js';
 export { getDialogWidthClass } from './dialog-width.js';
-export { getDisplayField, getDisplayFieldExpr, getDisplayFieldFirstIdentifier, } from './display-field.js';
+export { getDisplayField, getDisplayFieldExpr, getDisplayFieldFirstIdentifier, templateToAngularInterpolation, } from './display-field.js';
 export { getFormHtmlId } from './form-id.js';
 export { getStandardOperationNames, } from './operation-names.js';
 export { getPivotFrontendExcludedFiles, getPivotFrontendKeptFiles, isPivotAggregate, } from './pivot.js';
@@ -53,6 +54,17 @@ function readQueryFilter(props) {
 export const hasProperties = (props) => Array.isArray(props) && props.length > 0;
 export const hasI18nProperties = (props) => props?.some((p) => p.isI18n);
 export const hasEnumProperties = (props) => props?.some((p) => p.type === 'enum');
+/**
+ * Whether the aggregate declares at least one `createOnly: true` property
+ * (add-create-only-property-semantics). Every write handler now declares its
+ * `@ApplySchema` operation unconditionally (mandatory-schema-decorator-operation),
+ * so this predicate no longer drives any backend decorator emission. Its two
+ * remaining callers are the frontend form templates
+ * (`__module_name__-form.component.ts.eta`, `__module_name__-form-embed.component.ts.eta`),
+ * which use it to decide which controls to lock in `edit` mode — a genuinely
+ * conditional question about the aggregate's own properties.
+ */
+export const hasCreateOnlyProperties = (props) => Boolean(props?.some((p) => isCreateOnly(p)));
 export const hasBooleanProperties = (props) => props?.some((p) => p.type === 'boolean');
 export const hasDateProperties = (props) => props?.some((p) => p.type === 'date');
 export const hasTimestampProperties = (props) => props
@@ -97,6 +109,34 @@ export const getIndexesProperties = (props) => props?.filter((p) => p.index && !
 export const getPrimaryKeyProperties = (props) => props
     ?.filter((p) => p.primaryKey)
     .filter((p, i, arr) => arr.findIndex((o) => o.name === p.name) === i);
+/**
+ * Resolves a `hasTenant: true` aggregate's tenant-scoping property (design D8,
+ * add-tenant-scope-decorators). Matches by EXACT name, `tenantId` checked
+ * BEFORE `tenantIds` — never by prefix: `cliter/message/message.aurora.yaml`
+ * declares both `tenantIds` and `tenantRecipientIds`, and a prefix match would
+ * resolve non-deterministically to whichever the schema happened to list
+ * first, silently scoping the whole aggregate by the wrong column.
+ *
+ * The shape (`isArray`) is read from the property's declared `type`, never
+ * guessed from its name — `type: 'array'` is the only signal.
+ *
+ * Returns `undefined` when neither name is declared; the CALLER (the
+ * generation step that composes template data, not this file) is responsible
+ * for aborting when a `hasTenant: true` module resolves nothing here — a file
+ * of pure predicates must never throw mid-render.
+ */
+export function getTenantProperty(props) {
+    const byName = (name) => props?.find((p) => p.name === name);
+    const scalar = byName('tenantId');
+    if (scalar) {
+        return { isArray: scalar.type === 'array', name: scalar.name, nullable: Boolean(scalar.nullable) };
+    }
+    const multi = byName('tenantIds');
+    if (multi) {
+        return { isArray: multi.type === 'array', name: multi.name, nullable: Boolean(multi.nullable) };
+    }
+    return undefined;
+}
 export const getValueObjectsProperties = (props) => props
     ?.filter((p) => excludeOneToMany(p))
     .filter((p) => excludeOneToOneWithoutField(p));
@@ -134,6 +174,21 @@ export const getWithRelationshipOneToOneProperties = (props) => props?.filter((p
 export const getWithRelationshipOneToOneWithFieldProperties = (props) => getWithRelationshipOneToOneProperties(props).filter((p) => Boolean(p.relationship?.field));
 export const getWithRelationshipOneToOneWithoutFieldProperties = (props) => getWithRelationshipOneToOneProperties(props).filter((p) => !p.relationship?.field);
 export const getWithRelationshipManyToOneProperties = (props) => props?.filter((p) => p.relationship?.type === 'many-to-one');
+/**
+ * True when a relationship property owns a physical FK column reachable by
+ * fetching the target's display value: many-to-one, or one-to-one WITH
+ * `field` (BelongsTo — the inverse HasOne nav has no `field` and no column).
+ * SINGLE source of truth for "does this property need its target requested
+ * via the Aurora Query DSL `relations` node" — the frontend columns,
+ * resolver and list templates all consult this instead of each re-deriving
+ * the same check (T-122: resolver/list only recognized many-to-one, so a
+ * one-to-one+field column from `columns.ts` was never actually requested
+ * from the server and rendered blank).
+ */
+export const isForeignKeyRelationshipProperty = (p) => p.relationship?.type === 'many-to-one' ||
+    (p.relationship?.type === 'one-to-one' && Boolean(p.relationship.field));
+export const getWithForeignKeyRelationshipProperties = (props) => props?.filter(isForeignKeyRelationshipProperty);
+export const hasForeignKeyRelationshipProperties = (props) => Boolean(getWithForeignKeyRelationshipProperties(props)?.length);
 export const getWithRelationshipOneToManyProperties = (props) => props?.filter((p) => p.relationship?.type === 'one-to-many');
 export const getPrimaryKeyPropertiesFromPivotTable = (props) => hasPivotProperties(props) ? getPrimaryKeyProperties(props) : [];
 export const getCreateControllerProperties = crudFilter;
@@ -197,12 +252,89 @@ export const getFormDetailFieldsProperties = (props) => props
     .filter((p) => p.name !== 'rowId')
     .filter((p) => !p.widget?.isDetailHidden)
     .filter((p) => !isSecretProperty(p))
-    .filter((p) => !isReadonly(p))
+    .filter((p) => !isReadOnly(p))
     .sort((a, b) => {
     const va = a.widget?.detailSort ?? Number.POSITIVE_INFINITY;
     const vb = b.widget?.detailSort ?? Number.POSITIVE_INFINITY;
     return va - vb;
 });
+/**
+ * Scalar property types with a `dispatchField` branch (`partials/form/form-body.eta`)
+ * that fires independent of `widget.type`.
+ */
+const FORM_SCALAR_DISPATCH_TYPES = new Set([
+    'bigint',
+    'boolean',
+    'char',
+    'date',
+    'dateTime',
+    'decimal',
+    'enum',
+    'float',
+    'int',
+    'password',
+    'smallint',
+    'text',
+    'timestamp',
+    'varchar',
+]);
+/**
+ * Widget types with a `dispatchField` branch, independent of `property.type`.
+ * The union of `WidgetType` minus `GRID_ELEMENTS_MANAGER` (excluded upstream,
+ * before dispatch is ever consulted — see {@link isFormFieldRenderable}).
+ */
+const FORM_WIDGET_DISPATCH_TYPES = new Set([
+    WidgetType.ASYNC_MULTIPLE_SEARCH_SELECT,
+    WidgetType.ASYNC_SEARCH_SELECT,
+    WidgetType.COLOR_PICKER,
+    WidgetType.GRID_SELECT_ELEMENT,
+    WidgetType.GRID_SELECT_MULTIPLE_ELEMENTS,
+    WidgetType.MULTIPLE_SEARCH_SELECT,
+    WidgetType.MULTIPLE_SELECT,
+    WidgetType.SEARCH_SELECT,
+    WidgetType.SELECT,
+]);
+/**
+ * True when `dispatchField` (`partials/form/form-body.eta`) has a branch
+ * matching this property — i.e. the property, once it reaches the form
+ * body's dispatch step, emits actual markup instead of the empty string.
+ * Widget branches are checked first, mirroring `dispatchField`'s own
+ * if/else order: a widget hit shadows the scalar-type branches.
+ */
+export function hasFormFieldDispatchBranch(property) {
+    const widgetType = property.widget?.type;
+    if (widgetType && FORM_WIDGET_DISPATCH_TYPES.has(widgetType))
+        return true;
+    if (property.type === 'array')
+        return property.arrayOptions?.type === 'enum';
+    return FORM_SCALAR_DISPATCH_TYPES.has(property.type);
+}
+/**
+ * The SINGLE source of truth for "this property emits markup inside the
+ * form" (harden-frontend-form-field-emission-parity). Combines the gate
+ * `form-body.eta` applies BEFORE dispatch (allowlist, bare-id, the two
+ * detail-shell-only widgets) with {@link hasFormFieldDispatchBranch} — the
+ * dispatch step itself. Both `form-body.eta`'s `isRenderableField` and the
+ * form component templates' `renderedFields`/`relationalFields` MUST consume
+ * this one predicate: before this change each side re-implemented its own
+ * subset, and a one-to-many relationship property with no widget (allowed
+ * through the component templates' narrower filter, rejected by
+ * `isAllowProperty`'s one-to-many default here) passed one side and not the
+ * other — the component declared imports (`FormField`, `ValidationMessagePipe`,
+ * `HlmFieldImports`) for a `<form>` that rendered nothing.
+ */
+export function isFormFieldRenderable(moduleName, property) {
+    if (!isAllowProperty(moduleName, property))
+        return false;
+    if (property.type === 'id' && !property.widget)
+        return false;
+    if (property.widget?.type === WidgetType.GRID_ELEMENTS_MANAGER)
+        return false;
+    if (property.widget?.type === WidgetType.GRID_SELECT_MULTIPLE_ELEMENTS) {
+        return false;
+    }
+    return hasFormFieldDispatchBranch(property);
+}
 /**
  * SPEC-12: returns the visible+sorted form fields belonging to a single tab.
  * Builds on `getFormDetailFieldsProperties` (which already excludes timestamps,
@@ -235,12 +367,39 @@ export const getTabsFromProperties = (props) => {
  * `widget.tab`.
  */
 export const hasFormTabsProperties = (props) => getTabsFromProperties(props).length > 0;
+/**
+ * The set of properties the form body ACTUALLY emits, tab dimension included.
+ * `form-body.eta`'s tabbed branch draws fields GROUPED PER TAB
+ * (`getFormDetailFieldsPropertiesForTab`), so a renderable field with no
+ * `widget.tab` — or one naming a tab the aggregate does not declare — gets no
+ * control there. The form component templates gate their conditional imports
+ * on this set: counting such a field would import (`HlmSwitchImports`, …) for
+ * a control that never renders. With `useFormTabs` false the tab dimension
+ * does not apply and this is the plain {@link isFormFieldRenderable} filter.
+ */
+export function getEmittedFormFields(moduleName, props, useFormTabs) {
+    const renderable = getFormDetailFieldsProperties(props).filter((p) => isFormFieldRenderable(moduleName, p));
+    if (!useFormTabs)
+        return renderable;
+    const tabIds = new Set(getTabsFromProperties(props));
+    return renderable.filter((p) => typeof p.widget?.tab === 'string' && tabIds.has(p.widget.tab));
+}
+/**
+ * The properties ONE tab actually emits — the source of `tabMeta.fieldNames`
+ * in both form templates, which feeds `<tab>HasErrors()` and
+ * `findFirstTabWithErrors()`. It consults {@link isFormFieldRenderable}, the
+ * same predicate `form-body.eta` dispatches through, so a tab never reports
+ * an error for a control the user cannot see: a property with no dispatch
+ * branch (a bare `jsonb`, say) and a `GRID_SELECT_MULTIPLE_ELEMENTS` widget
+ * (which renders outside the form, in the detail shell) are both excluded.
+ */
+export const getEmittedFormFieldsForTab = (moduleName, props, tabId) => getFormDetailFieldsPropertiesForTab(props, tabId).filter((p) => isFormFieldRenderable(moduleName, p));
 export const getFormGroupFieldsProperties = (props) => props
     ?.filter((p) => excludeTimestamps(p))
     .filter((p) => excludeOneToOneWithoutField(p))
     .filter((p) => p.name !== 'availableLangs' && p.name !== 'rowId' && p.name !== 'meta')
     .filter((p) => !isSecretProperty(p))
-    .filter((p) => !isReadonly(p));
+    .filter((p) => !isReadOnly(p));
 export const getFormGroupFieldsIsNotI18nProperties = (props) => getFormGroupFieldsProperties(props).filter((p) => !p.isI18n);
 const byWidget = (type) => (props) => props?.filter((p) => p.widget?.type === type);
 export const getSelectWidgetsProperties = byWidget(WidgetType.SELECT);

package/dist/generator/domain/property-mappers.d.ts

@@ -105,6 +105,7 @@ export declare function calculateFormGroupCol(property: Property): string;
  */
 export declare function isAllowProperty(moduleName: string, property: Property, options?: {
     allowAutoIncrement?: boolean;
+    allowCreateOnly?: boolean;
     allowManyToManyRelationShip?: boolean;
     allowOneToManyRelationShip?: boolean;
     allowReadonly?: boolean;
@@ -121,13 +122,14 @@ export type FieldSchemaEntry = {
     targetAggregate: string;
     targetModulePath: string;
 } | {
+    createOnly?: boolean;
     decimals?: [number, number];
     enumOptions?: string[];
     kind: 'scalar';
     maxLength?: number;
     name: string;
     nullable?: boolean;
-    readonly?: boolean;
+    readOnly?: boolean;
     rules?: {
         minLength: number;
         translationKey?: string;

package/dist/generator/domain/property-mappers.js

@@ -360,7 +360,7 @@ export function calculateFormGroupCol(property) {
  *   embedded-only early return.
  */
 export function isAllowProperty(moduleName, property, options = {}) {
-    const { allowAutoIncrement = true, allowManyToManyRelationShip = true, allowOneToManyRelationShip = false, allowReadonly = true, i18nStrategy = 'embedded', } = options;
+    const { allowAutoIncrement = true, allowCreateOnly = true, allowManyToManyRelationShip = true, allowOneToManyRelationShip = false, allowReadonly = true, i18nStrategy = 'embedded', } = options;
     if (property.isI18n && i18nStrategy !== 'table') {
         const camelMod = toCamelCase(moduleName);
         return (property.name !== 'id' &&
@@ -372,7 +372,9 @@ export function isAllowProperty(moduleName, property, options = {}) {
     }
     if (property.autoIncrement && !allowAutoIncrement)
         return false;
-    if (property.readonly && !allowReadonly)
+    if (property.readOnly && !allowReadonly)
+        return false;
+    if (property.createOnly && !allowCreateOnly)
         return false;
     if (property.relationship?.type === 'one-to-many')
         return allowOneToManyRelationShip;
@@ -527,8 +529,16 @@ function makeScalarEntry(prop, i18nStrategy = 'embedded') {
     // compile-time-only exclusion from the write contract was MEASURED not to
     // stop a write (design.md, measurements 8-10). Emitted only when `true`,
     // so a property without the flag keeps its entry byte-for-byte identical.
-    if (prop.readonly)
-        entry.readonly = true;
+    // Canonical key ONLY (add-create-only-property-semantics): the loader
+    // already normalized a deprecated `readonly:` YAML spelling into
+    // `prop.readOnly`, so newly generated code never emits the old key.
+    if (prop.readOnly)
+        entry.readOnly = true;
+    // createOnly (add-create-only-property-semantics): same rationale as
+    // readOnly above — the flag must reach the FieldSchema for the
+    // operation-aware runtime rejection to exist.
+    if (prop.createOnly)
+        entry.createOnly = true;
     return entry;
 }
 export function buildFieldSchemaImports(entries) {
@@ -536,7 +546,7 @@ export function buildFieldSchemaImports(entries) {
     for (const entry of entries) {
         if (entry.kind !== 'relation')
             continue;
-        byPath.set(`@app/${entry.targetModulePath}`, `${entry.targetAggregate}FieldSchema`);
+        byPath.set(`@app/${entry.targetModulePath}/domain/index.js`, `${entry.targetAggregate}FieldSchema`);
     }
     return [...byPath.entries()].map(([path, identifier]) => ({
         items: [identifier],

package/dist/generator/domain/property-predicates.d.ts

@@ -8,7 +8,8 @@ export declare const isOneToOne: (p: Property) => boolean;
 export declare const isPrimaryKey: (p: Property) => boolean;
 export declare const isNullable: (p: Property) => boolean;
 export declare const isAutoIncrement: (p: Property) => boolean;
-export declare const isReadonly: (p: Property) => boolean;
+export declare const isReadOnly: (p: Property) => boolean;
+export declare const isCreateOnly: (p: Property) => boolean;
 export declare const isI18n: (p: Property) => boolean;
 export declare const isPivot: (p: Property) => boolean;
 export declare const isBinary: (p: Property) => boolean;

package/dist/generator/domain/property-predicates.js

@@ -8,7 +8,8 @@ export const isOneToOne = (p) => p.relationship?.type === 'one-to-one';
 export const isPrimaryKey = (p) => Boolean(p.primaryKey);
 export const isNullable = (p) => Boolean(p.nullable);
 export const isAutoIncrement = (p) => Boolean(p.autoIncrement);
-export const isReadonly = (p) => Boolean(p.readonly);
+export const isReadOnly = (p) => Boolean(p.readOnly);
+export const isCreateOnly = (p) => Boolean(p.createOnly);
 export const isI18n = (p) => Boolean(p.isI18n);
 export const isPivot = (p) => Boolean(p.aggregateName && p.modulePath);
 export const isBinary = (p) => p.type === 'blob' || p.type === 'blob.medium' || p.type === 'blob.long';