@ultimat3/cli 1.2.0 → 3.0.0

package/src/templates/admin-page.ts

@@ -0,0 +1,103 @@
+// `x g admin:page <name>` — a screen the admin derives from nothing: a reconciliation fixer, a
+// proxy health board, a deploy button. What the template has to get right is what it does NOT
+// emit: no `defineRoute`, because `pages:` is the one thing that puts a page in the admin's route
+// table and `guardedPage()` is the one thing that decides it. A scaffold that wrote a route
+// declaration here would hand back the unguarded second way in that seam exists to close.
+
+import { catalogJson } from './catalog-json';
+import { catalogPath, resolveLocales } from './locales';
+import type { GeneratedFile } from './naming';
+import { camel, kebab, pascal } from './naming';
+
+/** Where an admin lives when the caller does not say. `x new` scaffolds this layout. */
+export const DEFAULT_ADMIN_PAGE_DIR = 'apps/admin/src/pages';
+
+export interface AdminPageOptions {
+  /** The permission the page's own work needs. `admin:read` is composed in front of it. */
+  readonly permission: string;
+  /**
+   * Directory the page lands in, app-root-relative and POSIX — the same `--at` `x g island` takes,
+   * and for the same reason: an app's admin is wherever its `defineAdmin` is, which no generator
+   * can derive. `apps/admin/app/admin/` is as real a layout as the scaffold's, and a hardcoded
+   * destination means every such app moves the two files by hand after every run.
+   */
+  readonly dir?: string;
+  readonly locales?: readonly string[];
+}
+
+const titleKeyFor = (name: string): string => `admin.${name}.title`;
+
+const pageSource = (name: string, permission: string, dir: string): string => {
+  const Name = pascal(name);
+  const declaration = camel(name);
+  return `// Admin page: /${name}. An ORDINARY component — there is no \`defineRoute\` here, deliberately:
+// \`pages:\` is what puts this in the admin's route table and \`guardedPage()\` is what decides it,
+// so a route declaration in this file would be a second, unguarded way in.
+//
+// Wire it in once, and add \`navGroup\` to link it in the sidebar — this file is ${dir}/${name}.tsx,
+// so the specifier is relative to wherever \`defineAdmin\` lives:
+//   import { ${declaration}Page } from './${name}';
+//   defineAdmin({ …, pages: […, ${declaration}Page] })
+
+import type { AdminCustomPage, AdminPageProps } from '@ultimat3/admin';
+import { t } from '@ultimat3/i18n';
+
+export function ${Name}Page(props: AdminPageProps) {
+  return (
+    <section>
+      <h1>{t('${titleKeyFor(name)}')}</h1>
+      <p>{props.url}</p>
+    </section>
+  );
+}
+
+export const ${declaration}Page: AdminCustomPage = {
+  path: '/${name}',
+  titleKey: '${titleKeyFor(name)}',
+  // At least one, never empty: an empty list is X_ADMIN_PAGE_UNGUARDED at declaration time, which
+  // is the whole reason the permission is a required field and not an optional one.
+  permissions: ['${permission}'],
+  component: ${Name}Page,
+};
+`;
+};
+
+const pageTest = (name: string, permission: string): string => {
+  const declaration = camel(name);
+  return `// The ${name} admin page is guarded and owns no route of its own — the two facts that separate an
+// admin screen from a page, and the two an edit here is most likely to break.
+import { expect, unitTest } from '@ultimat3/testing';
+import { ${declaration}Page } from './${name}';
+
+// Both facts the frame reads off the declaration, so both are decidable without a request: a path
+// that is not rooted is X_ADMIN_PAGE_PATH_INVALID, and no permission at all is
+// X_ADMIN_PAGE_UNGUARDED — a page that would render for anyone who can open the admin.
+unitTest('the ${name} admin page is rooted and guarded', () => {
+  expect(${declaration}Page.path.startsWith('/')).toBe(true);
+  expect(${declaration}Page.permissions).toContain('${permission}');
+});
+
+unitTest('the ${name} admin page declares no route of its own', () => {
+  // \`pages:\` is the only way in. A \`config\` export here would be a route the frame never guards.
+  expect('config' in ${declaration}Page).toBe(false);
+});
+`;
+};
+
+export function adminPageFiles(
+  rawName: string,
+  options: AdminPageOptions,
+): readonly GeneratedFile[] {
+  const name = kebab(rawName);
+  // Trailing slashes trimmed exactly as `islandFiles` does — one `--at`, one normalization.
+  const dir = (options.dir ?? DEFAULT_ADMIN_PAGE_DIR).replace(/\/+$/, '');
+  return [
+    { path: `${dir}/${name}.tsx`, contents: pageSource(name, options.permission, dir) },
+    { path: `${dir}/${name}.test.ts`, contents: pageTest(name, options.permission) },
+    ...resolveLocales(options.locales).map((locale) => ({
+      path: catalogPath(locale),
+      contents: catalogJson({ [titleKeyFor(name)]: pascal(name) }),
+      merge: 'json' as const,
+    })),
+  ];
+}

package/src/templates/admin.ts

@@ -11,8 +11,8 @@ import { names } from './naming';
 const resourceSource = (
   feature: NameSet,
 ): string => `// Admin override for ${feature.pluralKebab}. Everything not set here — fields, operations,
-// detail layout — is derived from the entity. Wire this in once:
-//   import { ${feature.camel}AdminResource } from '${'@'}app/web/app/${feature.kebab}/admin/resource';
+// detail layout — is derived from the entity. Wire it in once, importing ${feature.camel}AdminResource
+// through this app's own tsconfig path alias for apps/web/app/${feature.kebab}/admin/resource:
 //   defineAdmin({ entities: [..., ${feature.camel}], resources: { ${feature.table}: ${feature.camel}AdminResource } })
 
 import type { AdminResourceOptions, AdminRow } from '@ultimat3/admin';
@@ -26,13 +26,17 @@ export const ${feature.camel}AdminResource: AdminResourceOptions<AdminRow> = {
 
 const resourceTest = (
   feature: NameSet,
-): string => `import { expect, unitTest } from '@ultimat3/testing';
+): string => `// The ${feature.kebab} admin override says what the entity cannot derive: a title key, the list
+// columns, a bounded page size. Everything unset here is derived, and needs no test.
+import { expect, unitTest } from '@ultimat3/testing';
 import { ${feature.camel}AdminResource } from './resource';
 
-unitTest('${feature.camel}AdminResource sets a title key and bounded list fields', () => {
-  expect(${feature.camel}AdminResource.titleKey).toBe('admin.${feature.kebab}.title');
-  expect(${feature.camel}AdminResource.listFields?.length).toBeGreaterThan(0);
-  expect(${feature.camel}AdminResource.pageSize).toBeGreaterThan(0);
+const resource = ${feature.camel}AdminResource;
+
+unitTest('${feature.camel}AdminResource sets a title key and list fields', () => {
+  expect(resource.titleKey).toBe('admin.${feature.kebab}.title');
+  expect(resource.listFields?.length).toBeGreaterThan(0);
+  expect(resource.pageSize).toBeGreaterThan(0);
 });
 `;
 

package/src/templates/backfill.ts

@@ -0,0 +1,212 @@
+// `x g backfill` — a one-pass table sweep. The backfill is a factory over job(), not a ninth
+// primitive, so it inherits .enqueue(), the retry policy, the cancellation and the manifest row.
+// One live run per name: a second enqueue while the pass is going is the same pass.
+
+import type { FeatureTarget } from './entity';
+import type { GeneratedFile, NameSet } from './naming';
+import { names } from './naming';
+import { sliceFoundation } from './slice-foundation';
+import { wrapImport } from './wrap';
+
+/**
+ * What the entity's value export is called inside the generated file. `x g backfill invoice
+ * --feature invoice` is a legal invocation and it emitted `import { invoice } from '../entity'`
+ * beside `export const invoice = backfill(...)` — one name, two declarations, which is
+ * `lint/suspicious/noRedeclare` in the app's own gate and a genuinely ambiguous reference in TS.
+ * Aliased only when it would collide, because every other backfill reads better without one.
+ */
+const entityRef = (name: NameSet, feature: NameSet): string =>
+  name.camel === feature.camel ? `${feature.camel}Entity` : feature.camel;
+
+const entityImport = (name: NameSet, feature: NameSet): string => {
+  const local = entityRef(name, feature);
+  return local === feature.camel ? feature.camel : `${feature.camel} as ${local}`;
+};
+
+/**
+ * The chain accessor, wrapped the way Biome would wrap it. Emitted pre-formatted rather than
+ * always-wrapped because the formatter joins an arrow body back onto one line when it fits — so a
+ * fixed shape is wrong for one name length or the other. Same reason `policy.ts` measures its
+ * `definePermissions` line.
+ */
+const tableLine = (name: NameSet, feature: NameSet): string => {
+  const ref = entityRef(name, feature);
+  const head = `const ${feature.camel}Table = () =>`;
+  const body = `tableFor(${ref}, postgresRepo(${ref}));`;
+  return `${head} ${body}`.length <= 100 ? `${head} ${body}` : `${head}\n  ${body}`;
+};
+
+/**
+ * Working source, never a stub: a generated `throw new Error(…)` carries no `X_*` code and a
+ * generated no-op handler checkpoints a page it never wrote, which reports swept rows nobody
+ * touched. The row projection is the one line an author replaces, and it is exported so the
+ * generated test asserts the WORK rather than only the declaration around it.
+ */
+const backfillSource = (
+  name: NameSet,
+  feature: NameSet,
+): string => `// ${name.camel}: one pass over a chain of rows. The backfill is a job factory, not a ninth
+// primitive, so it inherits .enqueue(), retry, cancellation and the manifest row.
+// \`BackfillBatch\` comes from @ultimat3/jobs, not @ultimat3/schema: a backfill file imports one package.
+
+import type { Ctx } from '@ultimat3/core';
+import { assert, hasScope } from '@ultimat3/core';
+import type { ReadBuilder } from '@ultimat3/entity';
+import { CROSS_TENANT_SCOPE, postgresRepo, tableFor } from '@ultimat3/entity';
+import type { BackfillBatch } from '@ultimat3/jobs';
+import { backfill } from '@ultimat3/jobs';
+import type { ${feature.pascal} } from '../entity';
+import { ${entityImport(name, feature)} } from '../entity';
+
+/** The row this sweep visits, aliased once: every signature below then reads at one width. */
+type Row = ${feature.pascal};
+
+/** The table as a chain — the seam \`database()\` hands an app, so this sweep reads what a query reads. */
+${tableLine(name, feature)}
+
+/**
+ * The rows this pass visits. A one-pass sweep has no single org, so it declares \`tenant: 'none'\`
+ * below — which STRIPS the org from the run rather than inheriting the worker's. That makes
+ * spanning tenants a capability instead of an accident: the actor this worker runs as has to carry
+ * \`tenancy:cross\`, and this is where that is said, before a page is read rather than inside the
+ * plan builder. A single-org sweep is the other shape — declare \`tenant: () => '<org id>'\` and put
+ * \`.where({ orgId: ctx.actor.orgId })\` back.
+ */
+const ${name.camel}Scope = (ctx: Ctx): ReadBuilder<Row> => {
+  assert(
+    hasScope(ctx.actor, CROSS_TENANT_SCOPE),
+    '${name.kebab}: this pass spans every tenant and its actor holds no tenancy:cross',
+    // A generated \`fix:\` is copied and run verbatim, so it names a command this build SHIPS.
+    'x db backfill ${name.kebab} --write --json',
+  );
+  return ${feature.camel}Table();
+};
+
+/**
+ * What the sweep writes for one row. Replace the projection with the change this pass exists to
+ * make, and keep it IDEMPOTENT: a page replays whole when an attempt is cancelled between the last
+ * row and its checkpoint, so the second run of this function must produce the first run's row.
+ */
+export const ${name.camel}Row = (row: Row): Row => ({
+  ...row,
+  title: row.title.trim(),
+});
+
+export const ${name.camel} = backfill({
+  name: '${name.kebab}',
+  // A sweep over a table belongs to no one org, so it declares none — and \`'none'\` STRIPS the org
+  // rather than inheriting the worker's, so a tenant-scoped read inside the pass fails closed
+  // (X_TENANCY_ACTOR_ORG_REQUIRED) instead of reading somebody's rows by accident. A sweep that
+  // genuinely spans tenants says so out loud: its work runs inside \`crossTenant(reason, fn)\`, and
+  // the reason IS the mechanism. A per-org sweep declares its org instead: \`tenant: () => orgId\`,
+  // one enqueue per org.
+  tenant: 'none',
+  source: ({ ctx }): ReadBuilder<Row> => ${name.camel}Scope(ctx),
+  handle: async ({ rows, signal }: BackfillBatch<Row>) => {
+    // One page, in its own durable step, at least once. Write through upsertAll, updateWhere or an
+    // idempotent statement; never count + 1. The signal is the run cancellation composed with this
+    // batch's ceiling, so a cancelled pass stops here instead of writing past its lease.
+    signal.throwIfAborted();
+    const next = rows.map(${name.camel}Row);
+    await ${feature.camel}Table().upsertAll(next, { onConflict: ['id'] });
+  },
+  // How many rows still NEED the change — never how many the sweep visits. Declare it once
+  // \`source\` narrows to the rows that are actually behind (\`.andWhere('publishedAt', 'is', null)\`
+  // and the like): then a dry run cannot lie, and a pass that exhausts its source while this still
+  // answers above zero fails as X_BACKFILL_STALLED instead of writing a completed row nobody can
+  // trust. Left out here because this scaffold re-normalises every row it visits, so a count of
+  // the same chain would never reach zero.
+  // count: ({ ctx }) => ${name.camel}Scope(ctx).andWhere('publishedAt', 'is', null).count(),
+  // batch: 1_000, // rows per step, default. Adjust to balance statement size and retry scope.
+  // rate: 5, // batches per second, default. Raise to sweep faster; there is no unthrottled mode.
+  // retry: { attempts: 5, backoff: 'exponential' },
+  // requires: '20260814120000_add_publish_at', // the migration x db backfill checks first
+  // environments: ['staging', 'production'], // omit for every environment — never implied
+});
+`;
+
+const backfillTest = (
+  name: NameSet,
+  feature: NameSet,
+): string => `// ${name.camel} sweeps rows a user never asked for, so the two facts worth failing on are its
+// durable identity — one live run per name, retried under the same key — and that the row
+// projection it applies is idempotent, because a cancelled attempt replays its page whole.
+
+import { createMemoryDriver, resetJobDriver, setJobDriver } from '@ultimat3/jobs';
+import { afterAll, beforeAll, expect, jobTest } from '@ultimat3/testing';
+import type { ${feature.pascal} } from '../entity';
+${wrapImport([name.camel, `${name.camel}Row`], `./${name.kebab}`)}
+
+// The driver is process-global, so it is installed and released around this file rather than
+// left behind for whichever test happens to run next.
+beforeAll(() => {
+  setJobDriver(createMemoryDriver());
+});
+afterAll(resetJobDriver);
+
+// The durable name this sweep runs under, spelled once — so the assertion below carries the
+// backfill's own name and still fits the formatter width the app's \`lint\` step enforces.
+const expectedKey = '${name.kebab}';
+
+const row = (over: Partial<${feature.pascal}> = {}): ${feature.pascal} => ({
+  id: '00000000-0000-4000-8000-000000000001',
+  orgId: '00000000-0000-4000-8000-000000000002',
+  title: '  needs normalising  ',
+  price: { minor: 1000, currency: 'USD' },
+  createdAt: new Date(0),
+  ...over,
+});
+
+jobTest('${name.camel} declares a durable name and retry policy', () => {
+  expect(${name.camel}.kind).toBe('job');
+  expect(${name.camel}.idempotencyKeyFor({})).toBe(expectedKey);
+  expect(${name.camel}.retry.attempts).toBeGreaterThan(1);
+});
+
+jobTest('${name.camel} uses one key across attempts', () => {
+  const key = ${name.camel}.idempotencyKeyFor({});
+  expect(${name.camel}.idempotencyKeyFor({})).toBe(key);
+});
+
+jobTest('${name.camel} projects itself into the manifest', () => {
+  const described = ${name.camel}.describe();
+  expect(described.queue).toBe('default');
+  expect(described.retry.attempts).toBeGreaterThan(0);
+});
+
+jobTest('${name.camel} actually rewrites the row it is handed', () => {
+  // The declaration alone cannot fail this: a handler that returned without writing would still
+  // enqueue, still checkpoint and still report the page as swept.
+  expect(${name.camel}Row(row()).title).toBe('needs normalising');
+});
+
+jobTest('${name.camel} replays a page idempotently', () => {
+  // At least once is the contract: an attempt cancelled between the last row and its checkpoint
+  // hands this page to the next attempt. Twice through must equal once through.
+  const once = ${name.camel}Row(row());
+  expect(${name.camel}Row(once)).toEqual(once);
+});
+
+jobTest('${name.camel} enqueues once, and dedupes the retry', async () => {
+  // One live run per name, forced or not: a second enqueue while the pass is going is the same pass.
+  // \`.enqueue()\` is the backfill path — the declared job, queued with no scheduler involved.
+  const first = await ${name.camel}.enqueue({});
+  expect(first.deduped).toBe(false);
+  const again = await ${name.camel}.enqueue({});
+  expect(again.deduped).toBe(true);
+});
+`;
+
+export function backfillFiles(rawName: string, target: FeatureTarget): readonly GeneratedFile[] {
+  const name = names(rawName);
+  const feature = names(target.feature);
+  const dir = `${target.surfaceDir}/${target.feature}/backfills`;
+  return [
+    // A sweep is a chain over the entity's own table (`tableFor(entity, postgresRepo(entity))`), so
+    // the entity is what it reads and what its generated test builds rows of. No repo call, but
+    // `repo.ts` rides along with `entity.ts`: it is that file's only reader.
+    ...sliceFoundation(target, ['entity']),
+    { path: `${dir}/${name.kebab}.ts`, contents: backfillSource(name, feature) },
+    { path: `${dir}/${name.kebab}.test.ts`, contents: backfillTest(name, feature) },
+  ];
+}

package/src/templates/entity.ts

@@ -4,6 +4,10 @@
 
 import type { GeneratedFile, NameSet } from './naming';
 import { names } from './naming';
+import { wrapImport, wrapList } from './wrap';
+
+/** The columns that leave the server. One list, read by the declaration and by its test. */
+const VIEW_KEYS: readonly string[] = ["'id'", "'title'", "'price'", "'createdAt'"];
 
 export interface FeatureTarget {
   /** `apps/web/app` or `apps/web/site` — the surface the feature lives in. */
@@ -28,16 +32,18 @@ export const ${name.camel} = entity('${table}', {
     id: uuid().primaryKey(),
     orgId: uuid(),
     title: text({ max: 200 }),
-    // One property, two physical columns: price_minor bigint + price_currency char(3).
-    // Money is integer minor units plus an ISO code, never a float.
+    // One property, three physical columns: price_minor bigint + price_currency char(3) +
+    // the nullable price_scale integer. Money is integer minor units plus an ISO code, never a
+    // float; the scale is what lets an amount name a sub-cent value, and NULL is not 0.
     price: money(),
     // Always timestamptz. Stored UTC; formatted at the edge with an explicit IANA time zone.
     createdAt: timestamp().defaultNow(),
   },
   // Each rule runs in the app on write AND as a Postgres CHECK — one declaration, both sides.
-  invariants: [
-    invariant('${snake}_title_not_blank', (c) => c.title.trimmed().minLength(1)),
-    invariant('${snake}_price_non_negative', (c) => c.price.minor.atLeast(0)),
+  // \`c\` is typed from the columns above: \`c.titel\` is a compile error that names \`title\`.
+  invariants: (c) => [
+    invariant('${snake}_title_not_blank', c.title.trimmed().minLength(1)),
+    invariant('${snake}_price_non_negative', c.price.minor.atLeast(0)),
   ],
   indexes: [{ on: ['orgId', 'createdAt'] }],
 });
@@ -47,14 +53,31 @@ export type ${name.pascal} = typeof ${name.camel}.$row;
 // What leaves the server: an action writes \`output: ${name.pascal}View\` and the shape is the
 // columns', never a second declaration to keep in sync. The tenant column is not in it — an org
 // id is the caller's context, not the client's data.
-export const ${name.pascal}View = ${name.camel}.$view(['id', 'title', 'price', 'createdAt']);
+${wrapList('', `export const ${name.pascal}View = ${name.camel}.$view([`, VIEW_KEYS, ']);')}
 export type ${name.pascal}View = typeof ${name.pascal}View.$row;
 `;
 
-const repoSource = (
-  name: NameSet,
-  table: string,
-): string => `// The only module allowed to query the ${name.pluralKebab} table. Routes call actions and
+const repoSource = (name: NameSet, table: string): string => {
+  const row = name.pascal;
+  const byIdCall = wrapList(
+    '  ',
+    `const row = await db().one<${row}>(`,
+    [`sql\`select * from ${table} where id = \${id}\``],
+    ');',
+  );
+  const listSignature = wrapList(
+    '',
+    'export async function listByOrg(',
+    ['orgId: string', 'limit = 50'],
+    `): Promise<readonly ${row}[]> {`,
+  );
+  const insertSignature = wrapList(
+    '',
+    'export async function insert(',
+    [`row: Omit<${row}, 'id' | 'createdAt'>`],
+    `): Promise<${row}> {`,
+  );
+  return `// The only module allowed to query the ${name.pluralKebab} table. Routes call actions and
 // queries; actions call services; services call this.
 // \`db()\` is the ambient handle: inside a transaction it IS the transaction, so these functions
 // join the caller's transaction without knowing one is open.
@@ -64,43 +87,53 @@ import { dbDrift, newId } from '@ultimat3/entity';
 import type { ${name.pascal} } from './entity';
 
 export async function byId(id: string): Promise<${name.pascal} | undefined> {
-  const row = await db().one<${name.pascal}>(sql\`select * from ${table} where id = \${id}\`);
+${byIdCall}
   return row ?? undefined;
 }
 
-export async function listByOrg(orgId: string, limit = 50): Promise<readonly ${name.pascal}[]> {
+${listSignature}
   // Ordered and bounded: an unordered page is a different page on every request.
   return db().query<${name.pascal}>(
     sql\`select * from ${table} where org_id = \${orgId} order by created_at desc limit \${limit}\`,
   );
 }
 
-export async function insert(row: Omit<${name.pascal}, 'id' | 'createdAt'>): Promise<${name.pascal}> {
-  // Money is two physical columns — integer minor units plus the ISO code, never a float.
+${insertSignature}
+  // Money is three physical columns — integer minor units, the ISO code, and the scale, never a
+  // float. \`scale ?? null\`: an amount at the currency's own minor unit carries no scale at all,
+  // and writing \`0\` for it would claim whole units — a 100x reinterpretation of the price.
   const created = await db().one<${name.pascal}>(sql\`
-    insert into ${table} (id, org_id, title, price_minor, price_currency)
-    values (\${newId()}, \${row.orgId}, \${row.title}, \${row.price.minor}, \${row.price.currency})
+    insert into ${table} (id, org_id, title, price_minor, price_currency, price_scale)
+    values (\${newId()}, \${row.orgId}, \${row.title}, \${row.price.minor}, \${row.price.currency},
+            \${row.price.scale ?? null})
     returning *\`);
   if (created === null) throw dbDrift('${table}', 'id');
   return created;
 }
 `;
+};
 
 const entityTest = (
   name: NameSet,
   snake: string,
   table: string,
-): string => `import { expect, unitTest } from '@ultimat3/testing';
+): string => `// The ${name.kebab} entity's declaration: the table it maps to and the invariants it names. Both
+// are what the migration generator and every query read, so both are worth pinning.
+import { expect, unitTest } from '@ultimat3/testing';
 import type { ${name.pascal} } from './entity';
-import { ${name.pascal}View, ${name.camel} } from './entity';
+${wrapImport([`${name.pascal}View`, name.camel], './entity')}
+
+type Over = Partial<${name.pascal}>;
 
-const row = (over: Partial<${name.pascal}> = {}): ${name.pascal} => ({
+const row = (over: Over = {}): ${name.pascal} => ({
   id: '00000000-0000-4000-8000-000000000001',
   orgId: '00000000-0000-4000-8000-000000000002',
   title: 'valid title',
-  // \`money()\` puts \`MoneyValue\` on the row, whose minor units are bigint — the column is a
-  // Postgres bigint, and a JS number would silently lose precision above 2^53 minor units.
-  price: { minor: 1000n, currency: 'USD' },
+  // \`money()\` puts \`MoneyValue\` on the row — the same type \`@ultimat3/money\`'s \`Money\` is,
+  // so this value goes straight to \`add()\`, \`formatMoney()\` and \`<Money>\` with no conversion.
+  // Integer minor units, never a float; the column is a Postgres bigint and a stored value past
+  // ±2^53 is refused when it is read rather than rounded into the row.
+  price: { minor: 1000, currency: 'USD' },
   createdAt: new Date(0),
   ...over,
 });
@@ -117,24 +150,32 @@ unitTest('${name.camel} describes itself for the manifest', () => {
   // a column added below reaches every one of them without a second declaration.
   const described = ${name.camel}.$describe();
   expect(described.orgScoped).toBe(true);
-  // One \`price\` property, two physical columns: integer minor units plus the ISO code. The
-  // description is where that shows, and it is what fails here if money ever becomes a float.
+  // One \`price\` property, three physical columns: integer minor units, the ISO code, and the
+  // nullable scale. The description is where that shows, and it is what fails here if money ever
+  // becomes a float — or if a migration forgets the scale column and unscales every sub-cent row.
   expect(described.columns.map((column) => column.column)).toContain('price_minor');
   expect(described.columns.map((column) => column.column)).toContain('price_currency');
-  expect(described.invariants.map((rule) => rule.name)).toContain('${snake}_price_non_negative');
+  expect(described.columns.map((column) => column.column)).toContain('price_scale');
+  // Named first: the assertion line carries the entity's own name and stays under the app's
+  // formatter width whatever that name is.
+  const rules = described.invariants.map((rule) => rule.name);
+  expect(rules).toContain('${snake}_price_non_negative');
 });
 
-unitTest('${name.pascal}View projects the row an action returns, without the tenant', () => {
-  expect(${name.pascal}View.$keys).toEqual(['id', 'title', 'price', 'createdAt']);
+unitTest('${name.pascal}View projects the row an action returns', () => {
+  const keys = ${name.pascal}View.$keys;
+  expect(keys).toEqual([${VIEW_KEYS.join(', ')}]);
   // The org id is the caller's context, never the client's data: a view that leaked it would
   // let a response carry a tenant boundary the policy already decided.
-  expect(${name.pascal}View.$keys).not.toContain('orgId');
+  expect(keys).not.toContain('orgId');
 });
 
-unitTest('${name.camel} invariants reject a blank title and a negative price', () => {
+unitTest('${name.camel} invariants reject blank and negative', () => {
+  const blank = row({ title: '   ' });
+  const negative = row({ price: { minor: -1, currency: 'USD' } });
   expect(() => ${name.camel}.$assert(row())).not.toThrow();
-  expect(() => ${name.camel}.$assert(row({ title: '   ' }))).toThrow();
-  expect(() => ${name.camel}.$assert(row({ price: { minor: -1n, currency: 'USD' } }))).toThrow();
+  expect(() => ${name.camel}.$assert(blank)).toThrow();
+  expect(() => ${name.camel}.$assert(negative)).toThrow();
 });
 
 unitTest('${name.camel} parses a row through its own columns', () => {