@aurorajs.dev/catalyst-cli 1.1.3 → 2.0.0

package/dist/templates/frontend/application/src/@aurora/lib/item-label-of.spec.ts

@@ -0,0 +1,45 @@
+import { itemLabelOf } from './item-label-of';
+
+describe('itemLabelOf', () => {
+  it('resolves the default {name} label when no template is given', () => {
+    const options = () => [{ id: 'a', name: 'Foo' }];
+    const toString = itemLabelOf(options);
+
+    expect(toString('a')).toBe('Foo');
+  });
+
+  it('interpolates a multi-placeholder template, substituting each field and the separator between them', () => {
+    const options = () => [{ id: 'a', code: 'AB', name: 'Foo' }];
+    const toString = itemLabelOf(options, '{code} - {name}');
+
+    expect(toString('a')).toBe('AB - Foo');
+  });
+
+  it('treats a bare identifier the same as its curly-wrapped form', () => {
+    const options = () => [{ id: 'a', localName: 'Espanol' }];
+    const toString = itemLabelOf(options, 'localName');
+
+    expect(toString('a')).toBe('Espanol');
+  });
+
+  it('expands a null field to an empty string', () => {
+    const options = () => [{ id: 'a', code: null, name: 'Foo' }];
+    const toString = itemLabelOf(options, '{code} - {name}');
+
+    expect(toString('a')).toBe(' - Foo');
+  });
+
+  it('returns an empty string for a null id', () => {
+    const options = () => [{ id: 'a', name: 'Foo' }];
+    const toString = itemLabelOf(options);
+
+    expect(toString(null)).toBe('');
+  });
+
+  it('returns an empty string when the id is not found in the options list', () => {
+    const options = () => [{ id: 'a', name: 'Foo' }];
+    const toString = itemLabelOf(options);
+
+    expect(toString('missing')).toBe('');
+  });
+});

package/dist/templates/frontend/application/src/@aurora/lib/item-label-of.ts

@@ -1,11 +1,16 @@
+import { expandDisplayFieldTemplate } from './expand-display-field-template';
+
 /**
  * Returns a function that resolves an id to a display label by looking it up
  * in a reactive options list. Designed for `hlm-select` value templates and
  * `hlm-select-multiple` `[itemToString]` bindings, where the form control
  * stores ids but the UI needs the human-readable label.
  *
- * Defaults to the `name` field; pass `labelKey` to use a different string
- * field.
+ * The label is built from a `front.displayField` template — same shape and
+ * expansion rules as `ToOptionsPipe` (see `expandDisplayFieldTemplate`):
+ * identifier shape (`'localName'`) is equivalent to `'{localName}'`; a
+ * multi-placeholder template (`'{code} - {name}'`) interpolates every field.
+ * Defaults to `'{name}'`.
  *
  * @example
  * // Default — T must have `name: string`
@@ -14,21 +19,26 @@
  * @example
  * // Custom label field
  * protected readonly langItemToString = itemLabelOf(this.langOptions, 'localName');
+ *
+ * @example
+ * // Template label
+ * protected readonly permissionItemToString = itemLabelOf(this.permissionOptions, '{code} - {name}');
  */
 export function itemLabelOf<T extends { id: string; name: string }>(
   options: () => T[],
 ): (id: string | null) => string;
-export function itemLabelOf<T extends { id: string }, K extends keyof T & string>(
+export function itemLabelOf<T extends { id: string }>(
   options: () => T[],
-  labelKey: K,
+  template: string,
 ): (id: string | null) => string;
 export function itemLabelOf<T extends { id: string }>(
   options: () => T[],
-  labelKey: keyof T & string = 'name' as keyof T & string,
+  template: string = '{name}',
 ): (id: string | null) => string {
   return (id) => {
     if (!id) return '';
-    const value = options().find((option) => option.id === id)?.[labelKey];
-    return typeof value === 'string' ? value : '';
+    const item = options().find((option) => option.id === id);
+    if (!item) return '';
+    return expandDisplayFieldTemplate(template, item as Record<string, unknown>);
   };
 }

package/dist/templates/frontend/application/src/@aurora/pipes/to-options.pipe.ts

@@ -1,5 +1,6 @@
 import { Pipe, type PipeTransform } from '@angular/core';
 import { type Option } from '../components/types';
+import { expandDisplayFieldTemplate } from '../lib/expand-display-field-template';
 
 /**
  * Adapts a `T[]` into the `Option[]` shape consumed by the search-select family
@@ -25,13 +26,9 @@ export class ToOptionsPipe implements PipeTransform {
     template: string = '{name}',
   ): Option[] {
     if (!items) return [];
-    const expr = /\{/.test(template) ? template : `{${template}}`;
     return items.flatMap((item) => {
       if (!item?.id) return [];
-      const label = expr.replace(/\{(\w+)\}/g, (_, key) => {
-        const value = (item as Record<string, unknown>)[key];
-        return value == null ? '' : String(value);
-      });
+      const label = expandDisplayFieldTemplate(template, item as Record<string, unknown>);
       return [{ value: item.id, label }];
     });
   }

package/dist/templates/frontend/application/src/app/app.config.ts

@@ -7,6 +7,7 @@ import {
   provideBrowserGlobalErrorListeners,
 } from '@angular/core';
 import { provideRouter } from '@angular/router';
+import { provideCalendarI18n } from '@aurora/lib';
 import { HealthService } from '@aurora/modules/health';
 import { provideTransloco, TranslocoService } from '@jsverse/transloco';
 import { provideSpartanHlm } from '@spartan-ng/helm/utils';
@@ -23,6 +24,7 @@ export const appConfig: ApplicationConfig = {
   providers: [
     provideBrowserGlobalErrorListeners(),
     provideSpartanHlm(),
+    provideCalendarI18n(environment.calendar.weekStartsOn),
     provideRouter(routes),
     provideHttpClient(withXhr()),
     provideTransloco({

package/dist/templates/frontend/application/src/environments/environment.dev.ts

@@ -13,6 +13,9 @@ export const environment: Environment = {
     fallback: 'es',
     langs: ['es', 'en'],
   },
+  calendar: {
+    weekStartsOn: 1,
+  },
   oAuth: {
     applicationCode: 'aurora',
     applicationSecret: 'aurora-dev-secret',

package/dist/templates/frontend/application/src/environments/environment.local.ts

@@ -13,6 +13,9 @@ export const environment: Environment = {
     fallback: 'es',
     langs: ['es', 'en'],
   },
+  calendar: {
+    weekStartsOn: 1,
+  },
   oAuth: {
     applicationCode: 'aurora',
     applicationSecret: 'aurora-dev-secret',

package/dist/templates/frontend/application/src/environments/environment.prod.ts

@@ -13,6 +13,9 @@ export const environment: Environment = {
     fallback: 'es',
     langs: ['es', 'en'],
   },
+  calendar: {
+    weekStartsOn: 1,
+  },
   oAuth: {
     applicationCode: 'aurora',
     applicationSecret: 'aurora-dev-secret',

package/dist/templates/frontend/application/src/environments/environment.qa.ts

@@ -13,6 +13,9 @@ export const environment: Environment = {
     fallback: 'es',
     langs: ['es', 'en'],
   },
+  calendar: {
+    weekStartsOn: 1,
+  },
   oAuth: {
     applicationCode: 'aurora',
     applicationSecret: 'aurora-dev-secret',

package/dist/templates/frontend/application/src/environments/environment.ts

@@ -13,6 +13,9 @@ export const environment: Environment = {
     fallback: 'es',
     langs: ['es', 'en'],
   },
+  calendar: {
+    weekStartsOn: 1,
+  },
   oAuth: {
     applicationCode: 'aurora',
     applicationSecret: 'aurora-dev-secret',

package/dist/templates/frontend/application/src/environments/environment.type.ts

@@ -75,6 +75,19 @@ export interface Environment {
      */
     langs: string[];
   };
+  /**
+   * Calendar behaviour of the date pickers (`au-date-picker`, `au-datetime-picker`).
+   * The TEXTS of the calendar follow the active panel language; what is declared
+   * here is a per-project decision the language does not make.
+   */
+  calendar: {
+    /**
+     * First day of the week shown by the calendar: 0 (Sunday) to 6 (Saturday).
+     * Declared per project — the panel language never decides it, so a Spanish
+     * panel and an English panel of the same project start the week on the same day.
+     */
+    weekStartsOn: 0 | 1 | 2 | 3 | 4 | 5 | 6;
+  };
   oAuth: {
     applicationCode: string;
     applicationSecret: string;

package/dist/templates/frontend/packages/hub/public/i18n/hub/en.json

@@ -47,4 +47,4 @@
     "GroupFavorites": "Favorites",
     "GroupAllApps": "All Apps"
   }
-}
+}

package/dist/templates/frontend/packages/hub/public/i18n/hub/es.json

@@ -47,4 +47,4 @@
     "GroupFavorites": "Favoritos",
     "GroupAllApps": "Todas las aplicaciones"
   }
-}
+}

package/dist/templates/frontend/packages/hub/src/app/domains/admin/apps/hub/app/app.columns.ts

@@ -95,21 +95,10 @@ export const getAppStandaloneColumns = (properties?: {
       exportable: true,
       cell: (info) => `${info.getValue<string>() ?? ''}`,
     },
-    /* #region customizations */
-    {
-      accessorFn: (row) => row.application?.name ?? '',
-      id: 'application.name',
-      size: 220,
-      minSize: 140,
-      relation: { association: 'application' },
-      label: () => translator?.translate('hub.app.Application') ?? 'Application',
-      sortable: true,
-      searchable: true,
-      filterable: true,
-      exportable: true,
-      cell: (info) => `${info.getValue<string>() ?? ''}`,
-    },
-    /* #endregion customizations */
+    // No Application column. `hubSanitizeEagerLoads()` strips `relations` from every hub/app read
+    // (BR-HUB-APP-003, blocking) so a client can never eager-load OAuthApplication — the relation
+    // can never resolve here. `code` already IS the OAuth client_id (BR-HUB-APP-013), so the column
+    // added nothing `code` does not already show. See app.cross-context.spec.ts.
     {
       accessorKey: 'isActive',
       id: 'isActive',

package/dist/templates/frontend/packages/hub/src/app/domains/admin/apps/hub/app/app.cross-context.spec.ts

@@ -0,0 +1,56 @@
+/**
+ * A regression guard, and the only one this defect can have.
+ *
+ * `hubApp.application` is a cross-BC relation into `o-auth/application`, and `hubSanitizeEagerLoads()`
+ * strips `relations` from BOTH `queryStatement` and `constraint` on every hub/app read path
+ * (BR-HUB-APP-003, blocking) so a client can never eager-load `OAuthApplication.secret` through the
+ * launchpad. That makes the relation permanently unresolvable here, by design — not a wiring bug — so
+ * unlike the other cross-BC columns cleared in T-4.3, this one is REMOVED rather than kept with a
+ * missing-relation marker. `HubApp.code` already IS the OAuth client_id (BR-HUB-APP-013), so the
+ * column added nothing `code` does not already show. A regeneration restores both the column and the
+ * fragment's navigation selection; without this file nothing fails.
+ */
+import { getRelationsNode } from '@aurora';
+import { print } from 'graphql';
+import { getAppStandaloneColumns } from './app.columns';
+import { hubAppFields } from './data-access/app.graphql';
+
+/** Every relation target that must never be requested from a hub/app read (BR-HUB-APP-003). */
+const FOREIGN_RELATIONS = ['application'];
+
+function declaredRelations(columns: ReturnType<typeof getAppStandaloneColumns>): string {
+  return JSON.stringify(columns.map((column) => column.relation ?? null));
+}
+
+describe('the hub/app module asks for no relation hubSanitizeEagerLoads can never resolve', () => {
+  it('declares no column that pulls the application relation into the pagination', () => {
+    const columns = getAppStandaloneColumns();
+
+    for (const relation of FOREIGN_RELATIONS) {
+      expect(declaredRelations(columns)).not.toContain(relation);
+    }
+    expect(getRelationsNode(columns)).toBeUndefined();
+  });
+
+  // Positive control: a guard whose detector has quietly stopped detecting passes every
+  // negative assertion in this file.
+  it('still detects a relation when a column declares one', () => {
+    const columns = getAppStandaloneColumns();
+    const probe = { id: 'probe', relation: { association: 'probe' } } as (typeof columns)[number];
+
+    expect(getRelationsNode([...columns, probe])).toEqual({ probe: true });
+    expect(declaredRelations([...columns, probe])).toContain('probe');
+  });
+
+  it('selects no application navigation in the fragment every query on the aggregate shares', () => {
+    const fragment = print(hubAppFields);
+
+    for (const relation of FOREIGN_RELATIONS) {
+      expect(fragment).not.toContain(`${relation} {`);
+    }
+  });
+
+  it('keeps the foreign key scalar, which is what code already surfaces as the client_id', () => {
+    expect(print(hubAppFields)).toContain('applicationId');
+  });
+});

package/dist/templates/frontend/packages/hub/src/app/domains/admin/apps/hub/app/data-access/app.graphql.ts

@@ -33,25 +33,20 @@ export const hubAppFields: TypedDocumentNode<HubAppFieldsFragment, unknown> = gq
     color
     sort
     applicationId
-    application {
-      id
-      rowId
-      code
-      name
-      isMaster
-    }
     isActive
     createdAt
     updatedAt
   }
 `;
-// Note: `accounts` (the hub_app_account m2m pivot, per-user launchpad preferences) is declared as
-// a relationship in cliter/hub/app.aurora.yaml, but the backend SDL (hub-app.graphql) does not
-// expose an `accounts` field on `HubApp` — same class of schema/backend drift as iam/user's
-// `password` (see account.graphql.ts, user.graphql.ts): a relation the codegen would select given
-// the YAML, that the CURRENT backend does not implement at the API layer. Excluded here to match
-// the pre-regen state (no `accounts` selection existed before); flagged for follow-up alongside
-// the other findings from this regen, not fixed at the schema/backend level here.
+// Note: `accounts` (the hub_app_account m2m pivot, per-user launchpad preferences) IS exposed on
+// `HubApp` by the backend SDL (backend/src/@api/hub/app/graphql/hub-app.graphql:90) — it was added
+// there by hand after this file was written and is not selected here because the launchpad
+// component reads its own per-user preferences through a dedicated hand-written query
+// (`hub-launchpad.component.ts` / `launchpad.graphql.ts`), not through this generic fragment.
+//
+// Note: `application` is NOT selected either, by BR-HUB-APP-003 (blocking): `hubSanitizeEagerLoads()`
+// strips `relations` from every hub/app read, so a client can never eager-load OAuthApplication
+// through this fragment. See app.cross-context.spec.ts.
 
 // default methods
 export const paginationQuery: TypedDocumentNode<

package/dist/templates/frontend/packages/hub/src/app/domains/admin/apps/hub/app/features/app-form.component.ts

@@ -184,7 +184,15 @@ import { type HubApp } from '@src/src/app/aurora.types';
           </hlm-field>
         }
         <!-- #endregion customizations -->
-        <hlm-field class="col-span-12 pt-5 md:col-span-6">
+        <hlm-field class="col-span-12 pt-9 md:col-span-6">
+          <!-- No 'for' on the label: hlm-switch registers the BrnLabelable that BrnLabel
+               reads for [attr.for], and the label also wraps the switch so BrnSwitch finds
+               it via closest(label). A static 'for' would WIN over that binding and could
+               then disagree with the id the switch really renders. -->
+          <!-- has-data-checked:bg-transparent cancels the tint that HlmFieldLabel paints
+               when a checkable control inside it is on. Spartan means that as a card
+               affordance; a switch row does not want it. Neutralized here instead of in
+               the vendored directive, so a Spartan update cannot silently bring it back. -->
           <label
             class="flex items-center has-data-checked:bg-transparent dark:has-data-checked:bg-transparent"
             hlmFieldLabel
@@ -209,6 +217,18 @@ export class AppFormComponent {
   // input would throw NG0950 there. Defaulting to 'new' keeps that early read safe;
   // the real value ('new'|'edit') is always provided by the host before render.
   readonly mode = input<'new' | 'edit'>('new');
+  // createOnly (add-create-only-property-semantics): distinct from `mode`,
+  // which stays the ROUTE/presentation mode — it drives the verb and title
+  // upstream (view-frame.eta, the detail shell's breadcrumb) and is
+  // untouched by this input. `transportMode`, when bound, is the mode this
+  // save actually travels as. The two diverge on an embedded-i18n
+  // aggregate's "create the first translation of an EXISTING row" route
+  // (`new/:id/:langId`): the route mode is 'new', but the row already
+  // exists, so the save goes out as an update. Optional and always
+  // declared (like `mode`) — falls back to `mode()` wherever the caller has
+  // nothing different to report, which is every non-i18n or table-strategy
+  // caller.
+  readonly transportMode = input<'new' | 'edit'>();
 
   // outputs
   readonly save = output<HubApp>();
@@ -223,7 +243,7 @@ export class AppFormComponent {
     url: string;
     description: string;
     icon: string;
-    color: string | null;
+    color: string;
     redirectUri: string;
     isActive: boolean;
   }>(() => {
@@ -240,7 +260,7 @@ export class AppFormComponent {
       url: init?.url ?? '',
       description: init?.description ?? '',
       icon: init?.icon ?? '',
-      color: init?.color ?? null,
+      color: init?.color ?? '',
       /* #region customizations */
       // redirectUri is a create-only provisioning field, never stored on HubApp —
       // always starts empty, never seeded from initial.
@@ -264,6 +284,7 @@ export class AppFormComponent {
     maxLength(path.url, 2046);
 
     maxLength(path.icon, 2046);
+    maxLength(path.color, 8);
 
     /* #region customizations */
     // redirectUri only exists in the create flow.

package/dist/templates/frontend/packages/hub/src/app/domains/admin/apps/hub/app/features/app-list.component.ts

@@ -10,7 +10,6 @@ import {
   DEFAULT_PAGE_SIZE,
   getExportableColumns,
   getFilterableColumns,
-  getRelationsNode,
   getSearchableColumnIds,
   getToggleableColumns,
   HeadSelection,
@@ -128,7 +127,7 @@ import { AppListActionsCell } from './app-list-actions-cell.component';
       >
         <hlm-dialog-content
           *hlmDialogPortal="let ctx"
-          class="max-h-[90vh] overflow-y-auto sm:max-w-2xl"
+          class="max-h-[90vh] w-[min(92vw,42rem)] overflow-y-auto sm:max-w-none"
         >
           <hlm-dialog-header>
             <h3 hlmDialogTitle>
@@ -225,8 +224,7 @@ import { AppListActionsCell } from './app-list-actions-cell.component';
               <pre
                 aria-label="Credentials .env block"
                 class="bg-muted rounded-md px-4 py-3 font-mono text-sm break-all whitespace-pre-wrap"
-                >{{ envBlock() }}</pre
-              >
+                >{{ envBlock() }}</pre>
             </div>
           }
 
@@ -296,7 +294,6 @@ export default class AppListComponent {
   protected readonly exportableColumns = () => getExportableColumns(this.baseColumns);
   protected readonly toggleableColumns = () => getToggleableColumns(this.baseColumns);
   private readonly searchColumns = getSearchableColumnIds(this.baseColumns);
-  private readonly relations = getRelationsNode(this.baseColumns);
   protected readonly columns: DataTableColumnDef<HubApp>[] = [
     {
       id: 'actions',
@@ -336,7 +333,6 @@ export default class AppListComponent {
     columns: this.columns,
     searchableColumnIds: this.searchColumns,
     defaultPageSize: DEFAULT_PAGE_SIZE,
-    relations: () => this.relations,
   });
 
   constructor() {

package/dist/templates/frontend/packages/hub/src/app/domains/admin/apps/hub/hub.routes.ts

@@ -12,7 +12,7 @@
  */
 import type { Routes } from '@angular/router';
 import { permissionGuard } from '@aurora';
-import { appListResolver } from './app/data-access/app.resolvers';
+import { appListResolver } from './app/data-access';
 
 export const hubRoutes: Routes = [
   // Default HUB landing: the app-launcher launchpad (H0 decision: launchpad = post-login landing).

package/dist/templates/frontend/packages/iam/src/app/domains/admin/apps/iam/account/data-access/account.graphql.ts

@@ -65,6 +65,7 @@ export const iamAccountFields: TypedDocumentNode<IamAccountFieldsFragment, unkno
     dApplicationCodes
     dPermissions
     dTenants
+    hasAddChildTenants
     meta
     roles {
       id
@@ -213,7 +214,7 @@ export const deleteMutation: TypedDocumentNode<
   }
   ${iamAccountFields}
 `;
-
+// Queries additionalApis
 export const meAccountQuery: TypedDocumentNode<IamMeAccountQuery, IamMeAccountQueryVariables> = gql`
   query IamMeAccount {
     iamMeAccount {

package/dist/templates/frontend/packages/iam/src/app/domains/admin/apps/iam/account/features/account-form.component.spec.ts

@@ -296,6 +296,34 @@ describe('AccountFormComponent (Signal Forms)', () => {
     });
   });
 
+  // ─── hasAddChildTenants hydration ────────────────────────────────────────
+
+  /**
+   * `hasAddChildTenants` is now a PERSISTED account property (the backend recomputes
+   * `dTenants` from it at every token issuance), not a transient per-request instruction.
+   * The edit form must hydrate it from the loaded account, or every save silently turns
+   * descendant-tenant access off.
+   */
+  describe('hasAddChildTenants hydration', () => {
+    it('hydrates true from the loaded account in edit mode', () => {
+      fixture.componentRef.setInput('mode', 'edit');
+      fixture.componentRef.setInput('initial', {
+        id: 'acc-1',
+        type: IamAccountTypeEnum.USER,
+        username: 'jdoe',
+        email: 'j@example.com',
+        tenants: [{ id: 'tenant-1' }],
+        hasAddChildTenants: true,
+      } as unknown as IamAccount);
+
+      expect(component.signalForm.hasAddChildTenants().value()).toBe(true);
+    });
+
+    it('defaults to false in new mode with no initial value', () => {
+      expect(component.signalForm.hasAddChildTenants().value()).toBe(false);
+    });
+  });
+
   // ─── Username requirement per type ──────────────────────────────────────
 
   describe('Username requirement', () => {

package/dist/templates/frontend/packages/iam/src/app/domains/admin/apps/iam/account/features/account-form.component.ts

@@ -93,9 +93,6 @@ interface AccountFormModel {
   tenantIds: string[];
   hasAddChildTenants: boolean;
   roleIds: string[];
-  dApplicationCodes: string[];
-  dPermissions: Record<string, unknown>;
-  dTenants: string[];
   user: AccountFormUser;
 }
 
@@ -558,13 +555,8 @@ export class AccountFormComponent {
       tags: (init?.tags ?? []).filter((v): v is string => typeof v === 'string'),
       scopes: (init?.scopes ?? []).filter((v): v is string => typeof v === 'string'),
       tenantIds: (init?.tenants ?? []).flatMap((t) => (t?.id ? [t.id] : [])),
-      hasAddChildTenants: false,
+      hasAddChildTenants: init?.hasAddChildTenants ?? false,
       roleIds: (init?.roles ?? []).flatMap((r) => (r?.id ? [r.id] : [])),
-      dApplicationCodes: (init?.dApplicationCodes ?? []).filter(
-        (v): v is string => typeof v === 'string',
-      ),
-      dPermissions: (init?.dPermissions as Record<string, unknown>) ?? {},
-      dTenants: (init?.dTenants ?? []).filter((v): v is string => typeof v === 'string'),
       user: {
         id: (userInit?.['id'] as string | null) ?? null,
         name: (userInit?.['name'] as string) ?? '',

package/dist/templates/frontend/packages/iam/src/app/domains/admin/apps/iam/iam.routes.ts

@@ -8,20 +8,16 @@ import {
   accountDetailResolver,
   accountListResolver,
   accountNewResolver,
-} from './account/data-access/account.resolvers';
+} from './account/data-access';
 import {
   boundedContextDetailResolver,
   boundedContextListResolver,
   boundedContextNewResolver,
-} from './bounded-context/data-access/bounded-context.resolvers';
-import { permissionListResolver } from './permission/data-access/permission.resolvers';
-import {
-  roleDetailResolver,
-  roleListResolver,
-  roleNewResolver,
-} from './role/data-access/role.resolvers';
-import { tagListResolver } from './tag/data-access/tag.resolvers';
-import { tenantListResolver } from './tenant/data-access/tenant.resolvers';
+} from './bounded-context/data-access';
+import { permissionListResolver } from './permission/data-access';
+import { roleDetailResolver, roleListResolver, roleNewResolver } from './role/data-access';
+import { tagListResolver } from './tag/data-access';
+import { tenantListResolver } from './tenant/data-access';
 // iam/user UI standalone retired — see `openspec/specs/iam-account-management-ui/spec.md`.
 // The user lifecycle is now managed via the combined account+user form in `iam/account`.
 // The aggregate's backend APIs remain intact for programmatic use.

package/dist/templates/frontend/packages/iam/src/app/domains/admin/apps/iam/permission/features/permission-form-embed.component.ts

@@ -12,13 +12,7 @@ import { type IamPermission } from '@src/src/app/aurora.types';
 
 @Component({
   selector: 'au-permission-form-embed',
-  imports: [
-    FormField,
-    TranslocoDirective,
-    ValidationMessagePipe,
-    HlmFieldImports,
-    HlmInputImports,
-  ],
+  imports: [FormField, TranslocoDirective, ValidationMessagePipe, HlmFieldImports, HlmInputImports],
   providers: [provideTranslocoScope('iam')],
   template: `
     <ng-container *transloco="let t; scope: 'iam'">
@@ -58,6 +52,13 @@ export class PermissionFormEmbedComponent {
   // inputs
   readonly initial = input<IamPermission | null>(null);
   readonly mode = input.required<'new' | 'edit'>();
+  // createOnly (add-create-only-property-semantics): same rationale as the
+  // standalone form (see __module_name__-form.component.ts.eta) — `mode`
+  // stays the ROUTE/presentation mode, `transportMode` is the mode this
+  // save actually travels as when the two diverge. Optional and always
+  // declared (like `mode`): falls back to `mode()` wherever the caller has
+  // nothing different to report.
+  readonly transportMode = input<'new' | 'edit'>();
   readonly parentValue = input.required<string>();
 
   // outputs

package/dist/templates/frontend/packages/iam/src/app/domains/admin/apps/iam/permission/features/permission-form.component.ts

@@ -84,6 +84,18 @@ export class PermissionFormComponent {
   // inputs
   readonly initial = input<IamPermission | null>(null);
   readonly mode = input.required<'new' | 'edit'>();
+  // createOnly (add-create-only-property-semantics): distinct from `mode`,
+  // which stays the ROUTE/presentation mode — it drives the verb and title
+  // upstream (view-frame.eta, the detail shell's breadcrumb) and is
+  // untouched by this input. `transportMode`, when bound, is the mode this
+  // save actually travels as. The two diverge on an embedded-i18n
+  // aggregate's "create the first translation of an EXISTING row" route
+  // (`new/:id/:langId`): the route mode is 'new', but the row already
+  // exists, so the save goes out as an update. Optional and always
+  // declared (like `mode`) — falls back to `mode()` wherever the caller has
+  // nothing different to report, which is every non-i18n or table-strategy
+  // caller.
+  readonly transportMode = input<'new' | 'edit'>();
 
   // outputs
   readonly save = output<IamPermission>();

package/dist/templates/frontend/packages/iam/src/app/domains/admin/apps/iam/role/data-access/role.graphql.ts

@@ -56,6 +56,7 @@ export const iamRoleFields: TypedDocumentNode<IamRoleFieldsFragment, unknown> =
       dApplicationCodes
       dPermissions
       dTenants
+      hasAddChildTenants
       meta
     }
     createdAt