@ultimat3/cli 21.0.0 → 22.0.0

package/src/templates/action.ts

@@ -15,15 +15,19 @@ import { wrapImport } from './wrap';
  * (ai-maxxing's `fleet`, with `HostNotFoundError` and `SessionNotFoundError`) declares the errors
  * it has and not this one. Importing it anyway is a file that fails at import.
  */
-const missingLookup = (feature: NameSet): string =>
-  `    // No lookup by id: ../errors declares no ${feature.pascal}NotFoundError, and a row that is not
+const missingLookup = (feature: NameSet, entity: boolean): string =>
+  entity
+    ? `    // No lookup by id: ../errors declares no ${feature.pascal}NotFoundError, and a row that is not
     // there needs one to be thrown for it. Declare it there — the shape \`x g resource\` writes —
-    // then read the row through ../repo and throw it when the read answers nothing.`;
+    // then read the row through ../repo and throw it when the read answers nothing.`
+    : `    // No lookup by id: this feature has no entity, and a generator writing into a slice never
+    // invents one. \`x g entity ${feature.kebab}\` declares the table; this body is yours until then.`;
 
 const actionSource = (
   name: NameSet,
   feature: NameSet,
   lookup: boolean,
+  entity: boolean,
 ): string => `// ${name.camel}: one mutation, server-authoritative. Input is validated before the handler runs
 // and the policy is the same object the MCP tool and the HTTP route evaluate.
 // \`t\` comes from @ultimat3/action, not @ultimat3/schema: an action file imports one package.
@@ -40,14 +44,15 @@ export const ${name.camel} = action({
   output: t.object({ id: t.uuid${lookup ? ', title: t.string' : ''} }),
   policy: can${feature.pascal}Write,
   cache: { invalidates: [${feature.camel}Tag] },
-  mcp: { expose: true, description: '${name.raw} — edit this description' },
+  // No \`mcp\`: a tool's description is what an agent reads to decide to call it, and a placeholder
+  // there is worse than no tool. Write one, then \`mcp: { expose: true, description: '…' }\`.
   async handle({ input }) {
 ${
   lookup
     ? `    const row = await repo.byId(input.id);
     if (row === undefined) throw new ${feature.pascal}NotFoundError({ id: input.id });
     return { id: row.id, title: row.title };`
-    : `${missingLookup(feature)}
+    : `${missingLookup(feature, entity)}
     return { id: input.id };`
 }
   },
@@ -58,6 +63,7 @@ const mutatorSource = (
   name: NameSet,
   feature: NameSet,
   lookup: boolean,
+  entity: boolean,
 ): string => `// ${name.camel}: an action with an optimistic local twin. The local half runs against the client
 // store immediately; the server half is authoritative and reconciles on conflict.
 
@@ -74,7 +80,7 @@ export const ${name.camel} = mutator({
   input: t.object({ id: t.uuid, orgId: t.uuid, title: t.string }),
   output: t.object({ id: t.uuid, title: t.string }),
   policy: can${feature.pascal}Write,
-  mcp: { expose: true, description: '${name.raw} — edit this description' },
+  // No \`mcp\` until a real description is written: see \`x g action\`.
   // tx.table(name) rather than tx.${feature.plural}: the typed accessor exists only once the app
   // augments LocalTables, and generated code cannot assume that has happened yet. The name is the
   // entity's snake_case table, so the local twin and the server row live under one key.
@@ -90,7 +96,7 @@ ${
     ? `    const row = await repo.byId(input.id);
     if (row === undefined) throw new ${feature.pascal}NotFoundError({ id: input.id });
     return { id: row.id, title: input.title };`
-    : `${missingLookup(feature)}
+    : `${missingLookup(feature, entity)}
     return { id: input.id, title: input.title };`
 }
   },
@@ -190,11 +196,10 @@ contractTest('${name.camel} denies a foreign org', async () => {
   expect(denied).toBeUltimateError('X_FORBIDDEN');
 });
 
-contractTest('${name.camel} projects one tool and one operation', () => {
-  // Same policy object on both surfaces — an MCP call cannot reach a different authz path.
-  expect(target.tool().policy).toBe(target.policy);
-  expect(target.tool().description).not.toBe('');
+// No MCP tool until it is described: a placeholder description misleads the agent reading it.
+contractTest('${name.camel} projects one operation and no tool', () => {
   expect(target.openapi().operationId).toBe('${name.camel}');
+  expect(target.mcp?.expose ?? false).toBe(false);
 });
 `;
 
@@ -207,6 +212,12 @@ export interface ActionOptions extends FeatureTarget {
    * `sliceExports` finds it there.
    */
   readonly sliceErrors?: string;
+  /**
+   * The slice's `entity.ts`, or absent when the feature has none. Absent, the action reads no row
+   * and the generator writes no entity — only `x g entity` and `x g resource` create a feature's
+   * data. `x g resource` passes the entity it is writing in the same run.
+   */
+  readonly sliceEntity?: string;
 }
 
 export function actionFiles(rawName: string, target: ActionOptions): readonly GeneratedFile[] {
@@ -214,19 +225,22 @@ export function actionFiles(rawName: string, target: ActionOptions): readonly Ge
   const feature = names(target.feature);
   const dir = `${target.surfaceDir}/${target.feature}/actions`;
   const isMutator = target.mutator === true;
+  const entity = target.sliceEntity !== undefined;
   const lookup =
-    target.sliceErrors === undefined ||
-    sliceExports(target.sliceErrors, `${feature.pascal}NotFoundError`);
+    entity &&
+    (target.sliceErrors === undefined ||
+      sliceExports(target.sliceErrors, `${feature.pascal}NotFoundError`));
   return [
     // The three slice modules this action's source imports — `../errors`, `../policy`, `../repo`
     // (which comes with `../entity`, its row type). Composed rather than assumed: `x g action`
     // into a slice no `x g resource` had created emitted all three imports and wrote none of them.
-    ...sliceFoundation(target, ['entity', 'policy', 'errors']),
+    // With no entity, only the policy: a lookup-free body imports neither ../errors nor ../repo.
+    ...sliceFoundation(target, entity ? ['entity', 'policy', 'errors'] : ['policy']),
     {
       path: `${dir}/${name.kebab}.ts`,
       contents: isMutator
-        ? mutatorSource(name, feature, lookup)
-        : actionSource(name, feature, lookup),
+        ? mutatorSource(name, feature, lookup, entity)
+        : actionSource(name, feature, lookup, entity),
     },
     // TWO test files, because the gate types a test by its FILENAME and this declaration owes two
     // suites: the input parse is a `unit` assertion and the three projections are `contract` ones.

package/src/templates/entity.ts

@@ -68,7 +68,7 @@ const repoSource = (name: NameSet, table: string): string => {
   const row = name.pascal;
   const byIdCall = wrapList(
     '  ',
-    `const row = await db().one<${row}>(`,
+    'const row = await db().one<Physical>(',
     [`sql\`select * from ${table} where id = \${id}\``],
     ');',
   );
@@ -90,32 +90,37 @@ const repoSource = (name: NameSet, table: string): string => {
 // join the caller's transaction without knowing one is open.
 
 import { db, sql } from '@ultimat3/db';
-import { dbDrift, newId } from '@ultimat3/entity';
-import type { ${name.pascal} } from './entity';
+import { dbDrift, decodeRow, newId } from '@ultimat3/entity';
+${wrapImport([`type ${name.pascal}`, name.camel], './entity')}
+
+// What \`select *\` answers: snake_case columns, and money as three of them. Never cast to the row
+// type — \`decodeRow\` is the entity's own reading of it, so \`price\` is a Money again.
+type Physical = Readonly<Record<string, unknown>>;
 
 export async function byId(id: string): Promise<${name.pascal} | undefined> {
 ${byIdCall}
-  return row ?? undefined;
+  return row === null ? undefined : decodeRow(${name.camel}, row);
 }
 
 ${listSignature}
   // Ordered and bounded: an unordered page is a different page on every request.
-  return db().query<${name.pascal}>(
+  const rows = await db().query<Physical>(
     sql\`select * from ${table} where org_id = \${orgId} order by created_at desc limit \${limit}\`,
   );
+  return rows.map((row) => decodeRow(${name.camel}, row));
 }
 
 ${insertSignature}
   // Money is three physical columns — integer minor units, the ISO code, and the scale, never a
   // float. \`scale ?? null\`: an amount at the currency's own minor unit carries no scale at all,
   // and writing \`0\` for it would claim whole units — a 100x reinterpretation of the price.
-  const created = await db().one<${name.pascal}>(sql\`
+  const created = await db().one<Physical>(sql\`
     insert into ${table} (id, org_id, title, price_minor, price_currency, price_scale)
     values (\${newId()}, \${row.orgId}, \${row.title}, \${row.price.minor}, \${row.price.currency},
             \${row.price.scale ?? null})
     returning *\`);
   if (created === null) throw dbDrift('${table}', 'id');
-  return created;
+  return decodeRow(${name.camel}, created);
 }
 `;
 };

package/src/templates/index.ts

@@ -45,7 +45,7 @@ export { entryFiles } from './scaffold-entries';
 export { errorPageFiles, PWA_COLORS } from './scaffold-errors';
 // The nine guards `x new` ships, distinct from `guardFiles` above, which is `x g guard <name>`.
 export { scaffoldGuardFiles } from './scaffold-guards';
-export { i18nIndex } from './scaffold-i18n';
+export { i18nIndex, localeEntry, localeImport } from './scaffold-i18n';
 export { repoFiles } from './scaffold-repo';
 export { shellFiles } from './scaffold-shell';
 export { siteFiles } from './scaffold-site';

package/src/templates/job.ts

@@ -3,11 +3,12 @@
 // both; the generated test pins them through a real driver, because a key that is not stable is a
 // job that runs twice and a tenant that is not declared is a job that reads the wrong org's rows.
 
-import { stripComments } from '../ts-scan';
+import { stripComments } from '@ultimat3/core';
 import type { FeatureTarget } from './entity';
 import type { GeneratedFile, NameSet } from './naming';
 import { names } from './naming';
 import { sliceExports, sliceFoundation } from './slice-foundation';
+import { wrapList } from './wrap';
 
 const jobSource = (
   name: NameSet,
@@ -69,7 +70,8 @@ export const ${name.camel} = job({
   retry: { attempts: 5, backoff: 'exponential' },
   async run({ step }) {
     await step.run('process', async () => {
-      // TODO: this job's own work.
+      // This job's own work. No table is read here: this feature has no entity, and a generator
+      // writing into a slice never invents one — \`x g entity\` declares it.
     });
     return { processed: true };
   },
@@ -117,7 +119,7 @@ export const ${name.camel} = task({
   tz: 'UTC',
   // No org in the payload: the job this enqueues declares \`tenant: 'none'\`, because this
   // feature's entity names no tenant column (or has none yet).
-  enqueue: () => [[${jobName.camel}, { id: '00000000-0000-4000-8000-000000000001' }]],
+${wrapList('  ', 'enqueue: () => [', [`[${jobName.camel}, { id: '00000000-0000-4000-8000-000000000001' }]`], '],')}
 });
 `;
 
@@ -291,9 +293,10 @@ export interface JobOptions extends FeatureTarget {
 }
 
 /**
- * Whether `x g job`/`x g task` may assume the tenant-scoped shape: an `entity.ts` this feature
- * does not have yet is about to be scaffolded fresh by `sliceFoundation` below, tenant-scoped by
- * default — so absent counts as scoped. One that exists is trusted over that default: it declares
+ * Whether `x g job`/`x g task` may assume the tenant-scoped shape. A feature with no `entity.ts` is
+ * NOT: only `x g entity` and `x g resource` create a feature's data, and counting absent as scoped
+ * made `x g task nightly` lay down an `entity('nightlies', { title, price })` that the `drift` step
+ * then demanded a migration for. One that exists is trusted: it declares
  * a real, non-`'none'` `tenant`, AND its `repo.ts` actually exports the `byId`/`listByOrg` pair the
  * tenant-scoped body calls. Both have to hold — an entity that still names `tenant: 'orgId'` after
  * an author trimmed `listByOrg` out of `repo.ts` (or never generated one) is not a slice this job
@@ -303,7 +306,7 @@ export function isTenantScopedSlice(
   sliceEntity: string | undefined,
   sliceRepo: string | undefined,
 ): boolean {
-  if (sliceEntity === undefined) return true;
+  if (sliceEntity === undefined) return false;
   const declaresTenant = /\btenant\s*:\s*'(?!none')[^']+'/.test(stripComments(sliceEntity));
   if (!declaresTenant) return false;
   if (sliceRepo === undefined) return true;

package/src/templates/policy.ts

@@ -4,7 +4,7 @@
 
 import type { GeneratedFile, NameSet } from './naming';
 import { names } from './naming';
-import { wrapList } from './wrap';
+import { wrapImport, wrapList } from './wrap';
 
 /** Biome would rewrap this itself, so the generator emits the already-formatted form. */
 const permissionSet = (feature: NameSet): string =>
@@ -65,6 +65,15 @@ export const can${feature.pascal}Write = can<${feature.pascal}Scope>(
   '${feature.kebab}:write',
   ({ actor, input }) => actor !== null && actor.orgId === input.orgId,
 );
+
+/**
+ * Create takes no org from its input — the row is written under the actor's own — so the tenancy
+ * rule is that the actor HAS one. Same grant as write.
+ */
+export const can${feature.pascal}Create = can(
+  '${feature.kebab}:write',
+  ({ actor }) => actor !== null && typeof actor.orgId === 'string' && actor.orgId !== '',
+);
 `;
 
 const policyTest = (
@@ -73,7 +82,7 @@ const policyTest = (
 // only read. A policy whose tests all pass is a policy nobody has tried to get past.
 import { testActor } from '@ultimat3/policy';
 import { expect, unitTest } from '@ultimat3/testing';
-import { can${feature.pascal}Read, can${feature.pascal}Write } from './policy';
+${wrapImport([`can${feature.pascal}Create`, `can${feature.pascal}Read`, `can${feature.pascal}Write`], './policy')}
 
 const org = '00000000-0000-4000-8000-000000000002';
 const otherOrg = '00000000-0000-4000-8000-000000000009';
@@ -108,9 +117,18 @@ unitTest('${feature.camel} write denies the read-only actor', async () => {
   await expect(can${feature.pascal}Write).not.toDenyPolicy({ actor: writer, input });
 });
 
+unitTest('${feature.camel} create denies the read-only and the orgless actor', async () => {
+  const orgless = testActor('orgless', { permissions: [read, write] }).actor;
+  await expect(can${feature.pascal}Create).toDenyPolicy({ actor: null, input: {} });
+  await expect(can${feature.pascal}Create).toDenyPolicy({ actor: reader, input: {} });
+  await expect(can${feature.pascal}Create).toDenyPolicy({ actor: orgless, input: {} });
+  await expect(can${feature.pascal}Create).not.toDenyPolicy({ actor: writer, input: {} });
+});
+
 unitTest('${feature.camel} rules name the permission they require', () => {
   expect(can${feature.pascal}Read.permissions).toEqual(['${feature.kebab}:read']);
   expect(can${feature.pascal}Write.permissions).toEqual(['${feature.kebab}:write']);
+  expect(can${feature.pascal}Create.permissions).toEqual(['${feature.kebab}:write']);
 });
 `;
 

package/src/templates/resource-create.ts

@@ -0,0 +1,127 @@
+// `x g resource`'s create action: a real insert. It used to be `x g action`'s generic body — read a
+// row by id, throw NotFound — so the route the resource named `create` could never create, and its
+// input was `{ id, orgId }` while the form posted `{ title }`. The input is the entity's own view of
+// the columns a caller supplies; the org comes from the actor, never from the body.
+
+import type { GeneratedFile, NameSet } from './naming';
+import { names } from './naming';
+import { wrapImport, wrapList } from './wrap';
+
+/** The columns a caller supplies: the resource entity's, minus `id`, `orgId` and `createdAt`. */
+export const CREATE_COLUMNS = ['title', 'price'] as const;
+
+const createSource = (
+  feature: NameSet,
+): string => `// create${feature.pascal}: inserts one ${feature.kebab} in the caller's org and returns it.
+// The input is a view of the entity's own columns, so a column added there is one edit here —
+// the list below — and never a second schema to keep in step.
+
+import { action } from '@ultimat3/action';
+import { tenancyActorOrgRequired } from '@ultimat3/entity';
+${wrapImport([`${feature.pascal}View`, feature.camel], '../entity')}
+${wrapImport([`can${feature.pascal}Create`, `${feature.camel}Tag`], '../policy')}
+import * as service from '../service';
+
+/** What a caller supplies. \`id\`, \`orgId\` and \`createdAt\` are the server's to write. */
+${wrapList(
+  '',
+  `export const Create${feature.pascal}Input = ${feature.camel}.$view([`,
+  CREATE_COLUMNS.map((column) => `'${column}'`),
+  ']);',
+)}
+
+export const create${feature.pascal} = action({
+  input: Create${feature.pascal}Input,
+  output: ${feature.pascal}View,
+  policy: can${feature.pascal}Create,
+  cache: { invalidates: [${feature.camel}Tag] },
+  // No \`mcp\`: an MCP tool's description IS what an agent reads to decide to call it, and a
+  // placeholder there is worse than no tool. Write one, then \`mcp: { expose: true, description }\`.
+  async handle({ input, ctx }) {
+    // The tenant is the actor's. The policy already refused an actor with none; this is the same
+    // fact for the type checker, and the framework's own refusal if a caller skips the policy.
+    const orgId = ctx.actor.orgId;
+    if (typeof orgId !== 'string' || orgId === '') {
+      throw tenancyActorOrgRequired({
+        entityName: '${feature.camel}',
+        operation: 'create',
+        actorId: ctx.actor.id,
+        actorKind: ctx.actor.kind,
+      });
+    }
+    return service.create({ ...input, orgId });
+  },
+});
+`;
+
+const ORG = '00000000-0000-4000-8000-000000000002';
+
+const createUnitTest = (
+  feature: NameSet,
+): string => `// create${feature.pascal}: its declared shape and the input it refuses — answered by the
+// declaration alone, so they belong to the \`unit\` step.
+import { expect, unitTest } from '@ultimat3/testing';
+import { create${feature.pascal} } from './create-${feature.kebab}';
+
+const target = create${feature.pascal}.named('create${feature.pascal}');
+const input = { title: 'A ${feature.kebab}', price: { minor: 1200, currency: 'USD' } };
+
+unitTest('create${feature.pascal} is a declared action', () => {
+  expect(target.kind).toBe('action');
+  expect(target.describe().name).toBe('create${feature.pascal}');
+});
+
+unitTest('create${feature.pascal} takes the columns a caller supplies', async () => {
+  await expect(target.input).toAcceptInput(input);
+  await expect(target.input).toRejectInput({ price: input.price });
+});
+`;
+
+const createContractTest = (
+  feature: NameSet,
+): string => `// create${feature.pascal}: the contract every action owes, and the orgless actor it denies before
+// the handler runs — the org a row is written under is the actor's, so an actor with none is refused.
+import { testActor } from '@ultimat3/policy';
+import { contractTest, expect } from '@ultimat3/testing';
+import { create${feature.pascal} } from './create-${feature.kebab}';
+
+const target = create${feature.pascal}.named('create${feature.pascal}');
+const input = { title: 'A ${feature.kebab}', price: { minor: 1200, currency: 'USD' } };
+
+// Holds the grant and belongs to no org: the denial is the predicate deciding, not the grant.
+const orgless = testActor('orgless', { permissions: ['${feature.kebab}:write'] }).actor;
+// And one that holds both, so the refusal above is not simply "every actor is refused".
+const writer = testActor('writer', {
+  orgId: '${ORG}',
+  permissions: ['${feature.kebab}:write'],
+}).actor;
+
+contractTest('create${feature.pascal} passes the action contract', async () => {
+  for (const contract of target.contract()) await contract.run();
+});
+
+contractTest('create${feature.pascal} needs an actor with an org', async () => {
+  expect(await target.as(orgless, input).catch((error: unknown) => error)).toBeUltimateError(
+    'X_FORBIDDEN',
+  );
+  await expect(target.policy).not.toDenyPolicy({ actor: writer, input });
+});
+
+contractTest('create${feature.pascal} projects one operation', () => {
+  expect(target.openapi().operationId).toBe('create${feature.pascal}');
+});
+`;
+
+/** The create action and its two suites, under `<slice>/actions/create-<feature>`. */
+export function resourceCreateFiles(rawName: string, sliceDir: string): readonly GeneratedFile[] {
+  const feature = names(rawName);
+  const dir = `${sliceDir}/actions`;
+  return [
+    { path: `${dir}/create-${feature.kebab}.ts`, contents: createSource(feature) },
+    { path: `${dir}/create-${feature.kebab}.test.ts`, contents: createUnitTest(feature) },
+    {
+      path: `${dir}/create-${feature.kebab}.contract.test.ts`,
+      contents: createContractTest(feature),
+    },
+  ];
+}

package/src/templates/resource-form-island.ts

@@ -32,12 +32,14 @@ const formIslandSource = (
 // the PAGE, which is one directory across from this one:
 //   const ${feature.pascal}Form = island({
 //     src: '${specifier}',
-//     props: ['endpoint', 'locale', 'labels'],
+//     props: ['endpoint', 'locale', 'currency', 'labels'],
 //   });
-//   <${feature.pascal}Form endpoint={derivePath('create${feature.pascal}').path} locale={locale} labels={labels} />
+//   <${feature.pascal}Form endpoint={derivePath('create${feature.pascal}').path} locale={locale}
+//     currency="USD" labels={labels} />
 // A string has no import edge, so the page's bundle graph stays the page's (axiom 6).
 
 import { clientTransport } from '@ultimat3/core';
+import { fromDecimal } from '@ultimat3/money';
 import { Button, Form, Input, setSolidRuntime, UiProvider } from '@ultimat3/ui';
 import type { JSX } from 'solid-js';
 import {
@@ -58,8 +60,11 @@ export interface ${feature.pascal}FormProps {
   readonly endpoint: string;
   /** The request's own locale. A browser has no ambient one the server ever agreed to. */
   readonly locale: string;
+  /** The ISO code the price is entered in. The amount is typed as a decimal and sent as minor units. */
+  readonly currency: string;
   readonly labels: {
     readonly title: string;
+    readonly price: string;
     readonly submit: string;
     readonly saved: string;
     readonly retry: string;
@@ -78,14 +83,23 @@ type SaveState = 'idle' | 'saved' | 'failed';
  */
 function ${feature.pascal}FormBody(props: ${feature.pascal}FormProps): JSX.Element {
   const [title, setTitle] = createSignal('');
+  const [amount, setAmount] = createSignal('');
   const [state, setState] = createSignal<SaveState>('idle');
 
   // A refusal and a request that never got a response both REJECT here — the transport turns a
   // non-2xx into its code and an offline \`fetch\` into X_CLIENT_TRANSPORT_FAILED — and both are the
   // outcome \`retry\` exists for. Without the catch the rejection escapes \`void send()\` unhandled.
+  // The body is the create action's input: the entity's own columns, the price as integer minor
+  // units. \`fromDecimal\` reads the typed digits as a string, never a float, and refuses what is not
+  // a number — the same \`retry\` state, because the server would refuse it too.
   const send = async (): Promise<void> => {
     try {
-      await clientTransport({ method: 'POST', url: props.endpoint, body: { title: title() } });
+      const price = fromDecimal(amount(), props.currency);
+      await clientTransport({
+        method: 'POST',
+        url: props.endpoint,
+        body: { title: title(), price },
+      });
       setState('saved');
     } catch {
       setState('failed');
@@ -110,6 +124,12 @@ function ${feature.pascal}FormBody(props: ${feature.pascal}FormProps): JSX.Eleme
         value={title()}
         onInput={(event) => setTitle(event.currentTarget.value)}
       />
+      <Input
+        aria-label={props.labels.price}
+        inputmode="decimal"
+        value={amount()}
+        onInput={(event) => setAmount(event.currentTarget.value)}
+      />
       <Button type="submit">{props.labels.submit}</Button>
       <p data-role="status" role="status" aria-live="polite">
         {status()}
@@ -174,7 +194,13 @@ const APP_ROOT = join(import.meta.dir, ${upToAppRoot(dir)});
 const ISLAND = '${dir}/${feature.kebab}-form.island.tsx';
 const ENDPOINT = '/api/${feature.kebab}/create-${feature.kebab}';
 
-const LABELS = { title: 'Title', submit: 'Save', saved: 'Saved', retry: 'Try again' };
+const LABELS = {
+  title: 'Title',
+  price: 'Price',
+  submit: 'Save',
+  saved: 'Saved',
+  retry: 'Try again',
+};
 
 const calls: { url: string; body: Record<string, unknown> }[] = [];
 
@@ -191,7 +217,7 @@ beforeAll(async () => {
     build: buildIslands,
     root: APP_ROOT,
     file: ISLAND,
-    props: { endpoint: ENDPOINT, locale: 'en', labels: LABELS },
+    props: { endpoint: ENDPOINT, locale: 'en', currency: 'USD', labels: LABELS },
     // What the server rendered inside the island's wrapper. \`mount\` replaces it.
     shell: '<p>Loading</p>',
     globals: {
@@ -244,17 +270,25 @@ describe('the ${feature.kebab} form island', () => {
     expect(mounted.code).not.toMatch(/\\bReact\\b/);
   });
 
-  test('the field tracks, and submit posts what was typed', async () => {
-    const field: FakeElement | null = mounted.find('input');
-    expect(field).not.toBeNull();
-    if (field !== null) field.value = 'First ${feature.camel}';
+  test('the fields track, and submit posts the create input', async () => {
+    const title: FakeElement | null = mounted.find('input[aria-label="Title"]');
+    const price: FakeElement | null = mounted.find('input[aria-label="Price"]');
+    expect(title).not.toBeNull();
+    expect(price).not.toBeNull();
+    if (title !== null) title.value = 'First ${feature.camel}';
+    if (price !== null) price.value = '12.50';
     // \`false\` means no handler ran — an island whose onInput never reached the DOM looks
     // identical to a selector typo otherwise.
-    expect(mounted.fire(field, 'input')).toBe(true);
+    expect(mounted.fire(title, 'input')).toBe(true);
+    expect(mounted.fire(price, 'input')).toBe(true);
     expect(mounted.fire('form', 'submit', { preventDefault: () => {} })).toBe(true);
     await statusSettled();
 
-    expect(calls).toEqual([{ url: ENDPOINT, body: { title: 'First ${feature.camel}' } }]);
+    const body = {
+      title: 'First ${feature.camel}',
+      price: { minor: 1250, currency: 'USD' },
+    };
+    expect(calls).toEqual([{ url: ENDPOINT, body }]);
   });
 
   test('the status line answers the response', () => {
@@ -300,10 +334,12 @@ import type { ${feature.pascal}FormProps } from './${feature.kebab}-form.island'
 
 /** What a working render hands the form — the baseline the state below departs from. */
 const BASE = {
-  endpoint: '/api/create-${feature.kebab}',
+  endpoint: '/api/${feature.pluralKebab}/create',
   locale: 'en',
+  currency: 'USD',
   labels: {
     title: 'Title',
+    price: 'Price',
     submit: 'Save',
     saved: 'Saved',
     retry: 'That did not save. Try again.',
@@ -327,6 +363,7 @@ export const ${feature.camel}FormStates = defineIslandStates({
         locale: 'de',
         labels: {
           title: 'Bezeichnung des Beitrags',
+          price: 'Preis',
           submit: 'Änderungen speichern',
           saved: 'Änderungen gespeichert',
           retry: 'Das konnte nicht gespeichert werden. Bitte erneut versuchen.',

package/src/templates/resource.ts

@@ -13,6 +13,7 @@ import type { GeneratedFile, NameSet } from './naming';
 import { names, pascal } from './naming';
 import { policyFiles } from './policy';
 import { queryFiles } from './query';
+import { resourceCreateFiles } from './resource-create';
 import { formIslandFiles } from './resource-form-island';
 import { routeDir, routeFiles } from './route';
 
@@ -178,13 +179,18 @@ export function resourceFiles(rawName: string, target: ResourceOptions): readonl
   // question and only one of them reaches `routeFiles`.
   const pageDir = routeDir('app', feature.pluralKebab);
   const locales = resolveLocales(target.locales);
+  const entity = entityFiles(rawName, slice);
+  // The entity this same call writes, handed to the generators composed below as if it were on
+  // disk: they write into a slice that HAS data, so they read it rather than a neutral body.
+  const sliceEntity = String(entity.find((file) => file.path.endsWith('/entity.ts'))?.contents);
   return [
-    ...entityFiles(rawName, slice),
+    ...entity,
     ...policyFiles(rawName, slice),
-    ...actionFiles(`create-${feature.kebab}`, slice),
-    ...actionFiles(`archive-${feature.kebab}`, slice),
+    // Not `x g action`'s body: a resource's create INSERTS (`resource-create.ts`).
+    ...resourceCreateFiles(rawName, dir),
+    ...actionFiles(`archive-${feature.kebab}`, { ...slice, sliceEntity }),
     ...queryFiles(`${feature.camel}List`, { ...slice, live: true }),
-    ...jobFiles(`reindex-${feature.kebab}`, slice),
+    ...jobFiles(`reindex-${feature.kebab}`, { ...slice, sliceEntity }),
     { path: `${dir}/service.ts`, contents: serviceSource(feature) },
     { path: `${dir}/service.test.ts`, contents: serviceTest(feature) },
     { path: `${dir}/ui.tsx`, contents: uiSource(feature, target.catalogModule) },

package/src/templates/scaffold-app.ts

@@ -7,6 +7,7 @@ import type { GeneratedFile, NameSet } from './naming';
 import { apiFiles } from './scaffold-api';
 import { authFiles } from './scaffold-auth';
 import { dashboardFiles } from './scaffold-dashboard';
+import { demoOrgFiles } from './scaffold-demo-org';
 import { entryFiles } from './scaffold-entries';
 import { errorPageFiles } from './scaffold-errors';
 import { httpFiles } from './scaffold-http';
@@ -309,11 +310,13 @@ export function appFiles(app: NameSet, example: boolean): readonly GeneratedFile
     { path: 'apps/web/shared/global.ts', contents: sharedGlobalModule() },
     { path: 'apps/web/shared/actor.ts', contents: sharedActor() },
     { path: 'apps/web/shared/actor.test.ts', contents: sharedActorTest() },
+    // The one org the dev actor, the seed and the dashboard all name — `scaffold-demo-org.ts`.
+    ...demoOrgFiles(),
     // The app's role map, beside the actor that reads it. `shared/` and not a feature folder:
     // `defineRoles()` merges, so a per-feature call is legal and is how an app ends up with no
     // answer to "which roles exist?" — see `scaffold-roles.ts`.
     ...httpFiles(app),
-    ...rolesFiles(),
+    ...rolesFiles(example),
     { path: 'apps/admin/package.json', contents: adminPackage(app) },
     { path: 'apps/admin/tsconfig.json', contents: tsconfig() },
     // `apps/admin/app/admin/page.tsx`, not `apps/admin/app/page.tsx`: the directory IS the URL,

package/src/templates/scaffold-auth.ts

@@ -35,6 +35,7 @@ const devActor = (
 // Everything downstream — pages, policies, live subscribers, MCP tools — reads what this returns.
 import { type Actor, logger, tryResolveEnvironment } from '@ultimat3/core';
 import { configureAuthenticator, readCookie } from '@ultimat3/http';
+import { DEMO_ORG_ID } from '../../shared/demo-org';
 
 /** Set it to a role from \`apps/web/shared/roles.ts\` to browse as that role. */
 export const DEV_ROLE_COOKIE = '${app.kebab}_dev_role';
@@ -66,7 +67,8 @@ export const devRoleFrom = (cookieHeader: string | null): DevRole => {
 export const devActorFor = (role: DevRole): Actor => ({
   kind: 'user',
   id: 'dev-actor',
-  orgId: 'dev-org',
+  // The seed's org, never an invented string: a generated tenant policy compares it with a uuid.
+  orgId: DEMO_ORG_ID,
   roles: [role],
   // Both required, and both deliberately empty: \`scopes\` is the framework's own escape hatch
   // (\`tenancy:cross\`) and \`permissions\` is a DIRECT grant that bypasses the role map — a