@ultimat3/cli 22.14.0 → 23.0.0

package/src/templates/policy.ts

@@ -45,7 +45,7 @@ ${permissionSet(feature)}
 /** What a write invalidates and a read depends on — one tag, both directions. */
 export const ${feature.camel}Tag = tag('${feature.kebab}');
 
-/** What every ${feature.kebab} rule needs to decide. Actions and queries both accept it. */
+/** What a ${feature.kebab} write decides on: the org of the row an action names. */
 export interface ${feature.pascal}Scope {
   readonly orgId: string;
 }
@@ -54,13 +54,17 @@ export interface ${feature.pascal}Scope {
 // never do this" from "you may, but not in that org" — an agent can act on the difference.
 // The predicates below add tenancy only; the grant is never re-checked by hand.
 
-/** Read is org-scoped: an actor sees rows in their own org and nothing else. */
-export const can${feature.pascal}Read = can<${feature.pascal}Scope>(
+/**
+ * Read takes no org from its input: the repo's typed handle scopes every read to the actor's own
+ * org, so the tenancy rule here is that the actor HAS one. A second org check on an input field
+ * would be a second source of tenancy, and the one a caller could set.
+ */
+export const can${feature.pascal}Read = can(
   '${feature.kebab}:read',
-  ({ actor, input }) => actor !== null && actor.orgId === input.orgId,
+  ({ actor }) => actor !== null && typeof actor.orgId === 'string' && actor.orgId !== '',
 );
 
-/** Write is the same tenancy rule on a second permission — grant the two separately in roles. */
+/** Write compares the org the action's input names with the actor's — grant it apart from read. */
 export const can${feature.pascal}Write = can<${feature.pascal}Scope>(
   '${feature.kebab}:write',
   ({ actor, input }) => actor !== null && actor.orgId === input.orgId,
@@ -103,10 +107,13 @@ const reader = testActor('reader', { orgId: org, permissions: [read] }).actor;
 const writer = testActor('writer', { orgId: org, permissions: [read, write] }).actor;
 const outsider = testActor('outsider', { orgId: otherOrg, permissions: [read, write] }).actor;
 
-unitTest('${feature.camel} read denies anonymous and cross-org actors', async () => {
-  await expect(can${feature.pascal}Read).toDenyPolicy({ actor: null, input });
-  await expect(can${feature.pascal}Read).toDenyPolicy({ actor: outsider, input });
-  await expect(can${feature.pascal}Read).not.toDenyPolicy({ actor: reader, input });
+unitTest('${feature.camel} read denies anonymous and orgless actors', async () => {
+  // Which org's rows a reader gets is the handle's, not this rule's: the slice's query test reads
+  // as an actor in another org and gets none of these.
+  const orgless = testActor('orgless', { permissions: [read] }).actor;
+  await expect(can${feature.pascal}Read).toDenyPolicy({ actor: null, input: {} });
+  await expect(can${feature.pascal}Read).toDenyPolicy({ actor: orgless, input: {} });
+  await expect(can${feature.pascal}Read).not.toDenyPolicy({ actor: reader, input: {} });
 });
 
 unitTest('${feature.camel} write denies the read-only actor', async () => {

package/src/templates/query.ts

@@ -3,9 +3,11 @@
 // an unbounded live query is a memory leak that only shows up under load.
 
 import type { FeatureTarget } from './entity';
+import { sortedImports } from './imports';
 import type { GeneratedFile, NameSet } from './naming';
 import { names } from './naming';
-import { sliceFoundation } from './slice-foundation';
+import { PLACEHOLDER_DB_MODULE } from './scaffold-db-client';
+import { sliceFoundation, sliceTakesScaffoldRow } from './slice-foundation';
 import { wrapImport } from './wrap';
 
 /** A live read always fans out fresh, so a TTL on it would only ever be dead configuration. */
@@ -28,18 +30,23 @@ ${wrapImport(
 )}
 import * as repo from '../repo';
 
+// No \`orgId\` in the input, and none in the policy: \`repo.list\` reads through the typed handle,
+// which scopes every read to the ACTOR's org, and a live window is keyed by the subscriber's
+// tenant. One source of tenancy — a parameter would be a second one a caller could set.
 export const ${name.camel} = query({
-  input: t.object({ orgId: t.uuid, limit: t.number.default(50) }),
+  input: t.object({ limit: t.number.default(50) }),
   policy: can${feature.pascal}Read,
   live: ${String(live)},${cacheLine(feature, live)}
   // Opt-in, unlike an action's tool: a read hands rows to an agent, so silence exposes nothing.
   mcp: { expose: true, description: '${name.raw} — edit this description' },
-  sql: ({ orgId, limit }) =>
+  sql: ({ limit }) =>
     // \`feature.table\`, not the kebab plural: \`from()\` quotes the identifier into the SQL text,
     // and the entity created the table as snake_case.
-    from<${feature.pascal}>('${feature.table}', () => repo.listByOrg(orgId, limit))
-      .where({ orgId })
-      .orderBy('createdAt')
+    from<${feature.pascal}>('${feature.table}', () => repo.list(limit))
+      // Newest first — \`repo.list\`'s own order. These two lines are ONE read spelled twice: the
+      // thunk is what the in-memory driver answers and this chain is the SQL Postgres runs, so a
+      // direction that differs here is a bounded page holding different rows on each.
+      .orderBy('createdAt', 'desc')
       // The primary key last is what makes the order TOTAL: \`createdAt\` alone ties, and two
       // rows that tie can swap between evaluations — a bounded read then drops one and repeats
       // the other, and a live subscription patches a row it never sent.
@@ -48,29 +55,42 @@ export const ${name.camel} = query({
 });
 `;
 
-const queryTest = (name: NameSet, feature: NameSet, live: boolean): string => {
+const queryTest = (name: NameSet, feature: NameSet, shape: ReadShape): string => {
+  const { live } = shape;
   const wrapper = live ? 'liveTest' : 'unitTest';
+  // A one-shot query's file carries the read cases too, so it imports what they need; a live
+  // query's declaration suite reads nothing and imports only its own.
+  const subscribes = live && shape.storesRow;
+  const imports = subscribes
+    ? [
+        "import { createContext, frozenClock, runWithContext } from '@ultimat3/core';",
+        `import { afterEach, expect, ${wrapper} } from '@ultimat3/testing';`,
+        `import { driver } from '${shape.dbModule}';`,
+      ]
+    : live
+      ? [`import { expect, ${wrapper} } from '@ultimat3/testing';`]
+      : readImports(shape, ['expect', wrapper]);
+  const repo = shape.storesRow
+    ? `${subscribes ? `\nimport type { ${feature.pascal} } from '../entity';` : ''}\nimport * as repo from '../repo';`
+    : '';
   return `// ${name.camel}: the shape it reads, the policy it asserts, and the actor it refuses. The read is
 // declarative, so what a test can get wrong is the authz, and that is what this pins.
-import { testActor } from '@ultimat3/policy';
-import { sourceFor } from '@ultimat3/query';
-import { expect, ${wrapper} } from '@ultimat3/testing';
+${sortedImports([
+  ...imports,
+  "import { testActor } from '@ultimat3/policy';",
+  subscribes
+    ? "import { registerQuery, sourceFor } from '@ultimat3/query';"
+    : "import { sourceFor } from '@ultimat3/query';",
+])}${repo}
 import { ${name.camel} } from './${name.kebab}';
-
-// A real v4 uuid: the read parses its input the way a request does, so a placeholder that only
-// looks like a uuid would fail before it ever built any SQL.
-const orgId = '00000000-0000-4000-8000-000000000002';
-
+${live && !shape.storesRow ? '' : ORG_LINE}
 // Named here because every projection needs a stable name and this file does not boot the app.
 // At boot \`registerQueries(await import('./${live ? 'live' : 'queries'}'))\` stamps the same name
 // onto the same object.
 const target = ${name.camel}.named('${name.camel}');
 
-// Holds the grant, wrong org — so a denial here is the predicate deciding, not the grant.
-const outsider = testActor('outsider', {
-  orgId: '00000000-0000-4000-8000-000000000009',
-  permissions: ['${feature.kebab}:read'],
-}).actor;
+// Holds the grant and no org — so a denial here is the predicate deciding, not the grant.
+const orgless = testActor('orgless', { permissions: ['${feature.kebab}:read'] }).actor;
 
 ${wrapper}('${name.camel} is a declared ${live ? 'live ' : ''}query', () => {
   expect(target.kind).toBe('query');
@@ -85,7 +105,7 @@ ${wrapper}('${name.camel} is bounded and TOTALLY ordered', async () => {
   // written reason, never a boolean, because a boolean reads exactly like forgetting the policy.
   const source = await sourceFor(
     target,
-    { orgId, limit: 50 },
+    { limit: 50 },
     {
       actor: null,
       unenforced: 'a scaffolded test asserts the SQL text; the policy is asserted separately',
@@ -93,17 +113,18 @@ ${wrapper}('${name.camel} is bounded and TOTALLY ordered', async () => {
   );
   const { sql } = source.toSQL();
   const text = sql.toLowerCase();
-  expect(text).toContain('order by');
+  // Newest first, as \`repo.list\` — the in-memory half of this same read — returns them.
+  expect(text).toContain('order by "createdat" desc');
   expect(text).toContain('limit');
   // "ordered" is not enough. Dropping the id tiebreak still leaves an ORDER BY, so asserting on
   // its presence alone would keep passing while the read went non-deterministic under ties.
   expect(text.slice(text.lastIndexOf('order by'))).toContain('id');
 });
 
-${wrapper}('${name.camel} denies a foreign org before it reads a row', async () => {
+${wrapper}('${name.camel} denies an orgless actor before a read', async () => {
   // \`.as()\` is the one read path with the actor swapped: validate, authorize, then read. The
   // denial lands before any SQL executes, which is why this needs no database.
-  const denied = await target.as(outsider, { orgId, limit: 50 }).catch((error: unknown) => error);
+  const denied = await target.as(orgless, { limit: 50 }).catch((error: unknown) => error);
   expect(denied).toBeUltimateError('X_FORBIDDEN');
 });
 
@@ -112,11 +133,195 @@ ${wrapper}('${name.camel} exposes one MCP tool that reads, and never writes', ()
   expect(target.tool().policy).toBe(target.policy);
   expect(target.tool().mutates).toBe(false);
 });
+${subscribes ? subscribeTest(name, feature) : ''}`;
+};
+
+/**
+ * The REAL subscribe path, with two orgs: a sync node in this process (the `subscribe` fixture),
+ * never `.as(actor)`. `.as()` installs a request context of its own, so a live source that
+ * leaves its tenant to the acting actor — which is what the query above does, through
+ * `repo.list` — read fine there while every real subscriber was answered `X_TENANCY_UNSCOPED`.
+ * Two orgs, a snapshot and a write: the window a subscriber is served from is its own org's.
+ */
+const subscribeTest = (name: NameSet, feature: NameSet): string => `
+// The module's own export under its own name — what \`defineApi\` does at boot — so a subscribe
+// frame naming it reaches this declaration.
+const live = registerQuery('${name.camel}', ${name.camel});
+
+type Row = ${feature.pascal};
+
+const otherOrg = '${OTHER_ORG}';
+
+const readerOf = (org: string) =>
+  testActor('reader', { orgId: org, permissions: ['${feature.kebab}:read'] }).actor;
+
+// The request clock, so \`createdAt\` is an instant this file chose and "newest" is decidable.
+const clock = frozenClock('2026-01-01T00:00:00.000Z');
+
+const store = (org: string, title: string) => {
+  const draft = { orgId: org, title, price: { minor: 0, currency: 'USD' } };
+  const writer = createContext({ actor: testActor('writer', { orgId: org }).actor, clock });
+  return runWithContext(writer, () => repo.insert(draft));
+};
+
+// One store per process: without this, one test's rows are the next test's fixtures.
+afterEach(() => {
+  driver.reset?.();
+});
+
+liveTest('two orgs subscribe: each is sent its own rows and writes', async ({ subscribe }) => {
+  await store(orgId, 'ours');
+  await store(otherOrg, 'theirs');
+  // The REAL subscribe path — a sync node in this process — and never \`.as(actor)\`: that
+  // installs a request context of its own, so a source read with no tenant passes there and is
+  // X_TENANCY_UNSCOPED for every real subscriber.
+  // ONE input for both: which org a window holds is the subscriber's, never a parameter.
+  const input = { limit: 50 };
+  const ours = await subscribe<Row>(live, input, readerOf(orgId));
+  const theirs = await subscribe<Row>(live, input, readerOf(otherOrg));
+  expect(ours.rows().map((row) => row.title)).toEqual(['ours']);
+  expect(theirs.rows().map((row) => row.title)).toEqual(['theirs']);
+
+  // A write after the snapshot reaches its own org's subscriber as a patch — placed first, the
+  // order the declaration names — and nobody else's.
+  clock.advance(1000);
+  await store(orgId, 'ours too');
+  await ours.settled();
+  await theirs.settled();
+  expect(ours.rows().map((row) => row.title)).toEqual(['ours too', 'ours']);
+  expect(theirs.rows().map((row) => row.title)).toEqual(['theirs']);
+  expect(theirs.patches()).toEqual([]);
+});
+`;
+
+const ORG = '00000000-0000-4000-8000-000000000002';
+
+/** The org the reader and its rows belong to — an actor's, never the read's input. */
+const ORG_LINE = `
+// The org the reader and the stored rows belong to: the ACTOR's, never a field of the input.
+const orgId = '${ORG}';
 `;
+const OTHER_ORG = '00000000-0000-4000-8000-000000000009';
+
+/** What the read test may do with the slice the query reads. */
+interface ReadShape {
+  readonly live: boolean;
+  /** The slice still takes the row `x g entity` scaffolds, so the test may store some. */
+  readonly storesRow: boolean;
+  readonly dbModule: string;
+}
+
+/**
+ * Rows, stored and read back: the case that runs the thunk AND the order the declaration puts on
+ * it. Three rows a second apart, a page of two — so an order that is not newest-first, a missing
+ * bound and another org's row each fail it on their own.
+ */
+const storedRowsTest = (): string => `
+const otherOrg = '${OTHER_ORG}';
+
+// The request clock, so \`createdAt\` is an instant this file chose and "newest" is decidable.
+const clock = frozenClock('2026-01-01T00:00:00.000Z');
+
+const store = (owner: string, title: string) => {
+  const draft = { orgId: owner, title, price: { minor: 0, currency: 'USD' } };
+  const writer = createContext({ actor: testActor('writer', { orgId: owner }).actor, clock });
+  return runWithContext(writer, () => repo.insert(draft));
 };
 
+// One store per process: without this, one test's rows are the next test's fixtures.
+afterEach(() => {
+  driver.reset?.();
+});
+
+unitTest('stored rows read back newest first, bounded, and never another org', async () => {
+  for (const title of ['first', 'second', 'third']) {
+    await store(orgId, title);
+    clock.advance(1000);
+  }
+  await store(otherOrg, 'theirs');
+  // The declaration's order over the repo's rows: what the SQL names on Postgres, read here
+  // from the in-memory driver. A page of two is the two NEWEST, on both.
+  const page = await target.as(member, { limit: 2 });
+  expect(page.map((row) => row.title)).toEqual(['third', 'second']);
+  // The same input, an actor in the other org: its own row, and nothing of this org's.
+  const outsider = testActor('outsider', { orgId: otherOrg, permissions: [read] }).actor;
+  const theirs = await target.as(outsider, { limit: 50 });
+  expect(theirs.map((row) => row.title)).toEqual(['theirs']);
+});
+`;
+
+/**
+ * The READ, executed — the half of a query a declaration test never runs. `.as()` is the one read
+ * path: parse, authorize, then read through the repo, which under `bun test` is the in-memory
+ * driver. For a live query this is its own file, because the `.live.test.ts` beside it belongs to
+ * the `live` step and an app's coverage floor counts the unit suite alone.
+ *
+ * Rows are stored only in a slice whose row this generator can spell (`sliceTakesScaffoldRow`):
+ * one an author reshaped has its own columns, and the refusal and the empty read need none.
+ *
+ * Every actor is `testActor(…).actor` — the one fixture builder, and an `Actor`, so the stored-row
+ * case builds its context from it directly.
+ */
+const readCases = (
+  feature: NameSet,
+  shape: ReadShape,
+): string => `// The read grant, named once so every line below fits the formatter's width at any feature name.
+const read = '${feature.kebab}:read';
+
+// A member of the org, holding the read grant and nothing else.
+const member = testActor('member', { orgId, permissions: [read] }).actor;
+
+unitTest('a caller with no grant is refused before the read', async () => {
+  const stranger = testActor('stranger', { orgId }).actor;
+  const refused = await target.as(stranger, { limit: 50 }).catch((error: unknown) => error);
+  expect(refused).toBeUltimateError('X_FORBIDDEN');
+});
+
+unitTest('the read runs as its caller: an org with no rows reads empty', async () => {
+  // Through the policy, the source and the repo — every line of the declaration, against the
+  // in-memory driver.
+  expect(await target.as(member, { limit: 50 })).toEqual([]);
+});
+${shape.storesRow ? storedRowsTest() : ''}`;
+
+/** The imports the read cases need, over whatever the file they land in already imports. */
+const readImports = (shape: ReadShape, testing: readonly string[]): readonly string[] => [
+  ...(shape.storesRow
+    ? ["import { createContext, frozenClock, runWithContext } from '@ultimat3/core';"]
+    : []),
+  `import { ${[...(shape.storesRow ? ['afterEach'] : []), ...testing].join(', ')} } from '@ultimat3/testing';`,
+  ...(shape.storesRow ? [`import { driver } from '${shape.dbModule}';`] : []),
+];
+
+/** A live query's unit half, as its own file: the suite beside it runs on the `live` step. */
+const liveReadTest = (
+  name: NameSet,
+  feature: NameSet,
+  shape: ReadShape,
+): string => `// ${name.camel}, READ: what a caller gets back, through the repo and the in-memory driver. The
+// subscription — the snapshot and the patches a write produces — is the live suite's, next door.
+${sortedImports([...readImports(shape, ['expect', 'unitTest']), "import { testActor } from '@ultimat3/policy';"])}${shape.storesRow ? "\nimport * as repo from '../repo';" : ''}
+import { ${name.camel} } from './${name.kebab}';
+
+const orgId = '${ORG}';
+
+// Named here because every projection needs a stable name and this file does not boot the app.
+const target = ${name.camel}.named('${name.camel}');
+
+${readCases(feature, shape)}`;
+
 export interface QueryOptions extends FeatureTarget {
   readonly live?: boolean;
+  /** Every locale the planted entity's admin labels ship for. Defaults to `['en']`. */
+  readonly locales?: readonly string[];
+  /**
+   * The slice's `entity.ts`, or absent when the feature has none yet. Decides one thing: whether
+   * the unit test may STORE rows (`sliceTakesScaffoldRow`). `x g resource` passes the entity it is
+   * writing in the same run; `x g query` reads the one on disk.
+   */
+  readonly sliceEntity?: string;
+  /** The slice's `repo.ts` as it stands on disk, or absent alongside `sliceEntity`. */
+  readonly sliceRepo?: string;
 }
 
 export function queryFiles(rawName: string, target: QueryOptions): readonly GeneratedFile[] {
@@ -124,17 +329,28 @@ export function queryFiles(rawName: string, target: QueryOptions): readonly Gene
   const feature = names(target.feature);
   const live = target.live === true;
   const dir = `${target.surfaceDir}/${target.feature}/${live ? 'live' : 'queries'}`;
+  const shape: ReadShape = {
+    live,
+    storesRow: sliceTakesScaffoldRow(target, target.sliceEntity, target.sliceRepo),
+    dbModule: target.dbModule ?? PLACEHOLDER_DB_MODULE,
+  };
   return [
     // A read declares the row type it returns (`../entity`), the rule that admits it (`../policy`)
     // and the one module allowed to query the table (`../repo`) — all three are the slice's, and
     // `--live` changes only which directory this file lands in.
-    ...sliceFoundation(target, ['entity', 'policy']),
+    ...sliceFoundation(target, ['entity', 'policy'], target.locales),
     { path: `${dir}/${name.kebab}.ts`, contents: querySource(name, feature, live) },
     // The suffix follows the WRAPPER, which follows `--live`: a `liveTest` in a plain
     // `<name>.test.ts` runs under `unit`, so `x test live` had no files in an app full of them.
     {
       path: `${dir}/${name.kebab}${live ? '.live' : ''}.test.ts`,
-      contents: queryTest(name, feature, live),
+      contents: live
+        ? queryTest(name, feature, shape)
+        : `${queryTest(name, feature, shape)}\n${readCases(feature, shape)}`,
     },
+    // A live read's unit half, in its own file: the suite above runs on the `live` step.
+    ...(live
+      ? [{ path: `${dir}/${name.kebab}.test.ts`, contents: liveReadTest(name, feature, shape) }]
+      : []),
   ];
 }

package/src/templates/resource-create.ts

@@ -3,6 +3,7 @@
 // input was `{ id, orgId }` while the form posted `{ title }`. The input is the entity's own view of
 // the columns a caller supplies; the org comes from the actor, never from the body.
 
+import { sortedImports } from './imports';
 import type { GeneratedFile, NameSet } from './naming';
 import { names } from './naming';
 import { wrapImport, wrapList } from './wrap';
@@ -17,6 +18,7 @@ const createSource = (
 // the list below — and never a second schema to keep in step.
 
 import { action } from '@ultimat3/action';
+import type { Actor } from '@ultimat3/core';
 import { tenancyActorOrgRequired } from '@ultimat3/entity';
 ${wrapImport([`${feature.pascal}View`, feature.camel], '../entity')}
 ${wrapImport([`can${feature.pascal}Create`, `${feature.camel}Tag`], '../policy')}
@@ -30,6 +32,21 @@ ${wrapList(
   ']);',
 )}
 
+/**
+ * The org a row is written under: the actor's, never the body's. The policy already refused an
+ * actor with none, so inside \`handle\` this is that fact for the type checker — and the
+ * framework's own refusal if a caller ever reaches the service around the policy.
+ */
+export const orgOf = (actor: Actor): string => {
+  if (typeof actor.orgId === 'string' && actor.orgId !== '') return actor.orgId;
+  throw tenancyActorOrgRequired({
+    entityName: '${feature.camel}',
+    operation: 'create',
+    actorId: actor.id,
+    actorKind: actor.kind,
+  });
+};
+
 export const create${feature.pascal} = action({
   input: Create${feature.pascal}Input,
   output: ${feature.pascal}View,
@@ -38,18 +55,7 @@ export const create${feature.pascal} = action({
   // No \`mcp\`: an MCP tool's description IS what an agent reads to decide to call it, and a
   // placeholder there is worse than no tool. Write one, then \`mcp: { expose: true, description }\`.
   async handle({ input, ctx }) {
-    // The tenant is the actor's. The policy already refused an actor with none; this is the same
-    // fact for the type checker, and the framework's own refusal if a caller skips the policy.
-    const orgId = ctx.actor.orgId;
-    if (typeof orgId !== 'string' || orgId === '') {
-      throw tenancyActorOrgRequired({
-        entityName: '${feature.camel}',
-        operation: 'create',
-        actorId: ctx.actor.id,
-        actorKind: ctx.actor.kind,
-      });
-    }
-    return service.create({ ...input, orgId });
+    return service.create({ ...input, orgId: orgOf(ctx.actor) });
   },
 });
 `;
@@ -58,13 +64,29 @@ const ORG = '00000000-0000-4000-8000-000000000002';
 
 const createUnitTest = (
   feature: NameSet,
-): string => `// create${feature.pascal}: its declared shape and the input it refuses — answered by the
-// declaration alone, so they belong to the \`unit\` step.
-import { expect, unitTest } from '@ultimat3/testing';
-import { create${feature.pascal} } from './create-${feature.kebab}';
+  dbModule: string,
+): string => `// create${feature.pascal}: its declared shape, the input it refuses, and the row its handler
+// writes — against the in-memory driver, so all three belong to the \`unit\` step.
+${sortedImports([
+  "import { testActor } from '@ultimat3/policy';",
+  "import { afterEach, expect, unitTest } from '@ultimat3/testing';",
+  `import { driver } from '${dbModule}';`,
+])}
+import { create${feature.pascal}, orgOf } from './create-${feature.kebab}';
 
 const target = create${feature.pascal}.named('create${feature.pascal}');
 const input = { title: 'A ${feature.kebab}', price: { minor: 1200, currency: 'USD' } };
+const orgId = '${ORG}';
+
+// Holds the grant and an org: past the policy, so what answers is the handler.
+const grant = ['${feature.kebab}:write'];
+const writer = testActor('writer', { orgId, permissions: grant }).actor;
+const orgless = testActor('orgless', { permissions: grant }).actor;
+
+// One store per process: without this, one test's rows are the next test's fixtures.
+afterEach(() => {
+  driver.reset?.();
+});
 
 unitTest('create${feature.pascal} is a declared action', () => {
   expect(target.kind).toBe('action');
@@ -75,6 +97,24 @@ unitTest('create${feature.pascal} takes the columns a caller supplies', async ()
   await expect(target.input).toAcceptInput(input);
   await expect(target.input).toRejectInput({ price: input.price });
 });
+
+unitTest('the handler writes the row and answers its view', async () => {
+  const created = await target.as(writer, input);
+  expect(created).toMatchObject({ title: input.title, price: input.price });
+  // The view, not the row: the tenant is the caller's context, never the client's data.
+  expect(created).not.toHaveProperty('orgId');
+});
+
+unitTest('orgOf answers the org of the actor, and refuses an actor with none', () => {
+  expect(orgOf(writer)).toBe(orgId);
+  let refused: unknown;
+  try {
+    orgOf(orgless);
+  } catch (error) {
+    refused = error;
+  }
+  expect(refused).toBeUltimateError('X_TENANCY_ACTOR_ORG_REQUIRED');
+});
 `;
 
 const createContractTest = (
@@ -113,12 +153,16 @@ contractTest('create${feature.pascal} projects one operation', () => {
 `;
 
 /** The create action and its two suites, under `<slice>/actions/create-<feature>`. */
-export function resourceCreateFiles(rawName: string, sliceDir: string): readonly GeneratedFile[] {
+export function resourceCreateFiles(
+  rawName: string,
+  sliceDir: string,
+  dbModule: string,
+): readonly GeneratedFile[] {
   const feature = names(rawName);
   const dir = `${sliceDir}/actions`;
   return [
     { path: `${dir}/create-${feature.kebab}.ts`, contents: createSource(feature) },
-    { path: `${dir}/create-${feature.kebab}.test.ts`, contents: createUnitTest(feature) },
+    { path: `${dir}/create-${feature.kebab}.test.ts`, contents: createUnitTest(feature, dbModule) },
     {
       path: `${dir}/create-${feature.kebab}.contract.test.ts`,
       contents: createContractTest(feature),