feat(#195): Java per-capability origin validation + native typing (cross-port parity)

Mirrors the committed TS reference (63943d0 validation, aff49ce typing) into the Java port.

- ExpressionAttribute.java: the closed expression-node grammar as validateExprNode
  (structural, fail-closed) + inferExprType (entity-aware, bottom-up) over the verbatim
  Map tree, reusing FilterOps for the shared op vocabulary + per-subtype legality bands
  (mirrors TS keeping the grammar beside the attr, not in validateValue).
- ValidationPhase.java: the per-capability rules in validateOriginNode — any/all (boolean
  non-array; @filter required; @Of forbidden; @via required + to-many), collect (isArray;
  @Of required + #185 element-type preservation; @distinct/@orderby collect-only + mutually
  exclusive; @orderby resolves on @Of), the inverse rule, origin.computed (grammar →
  ERR_UNKNOWN_EXPR_NODE; inference vs base effective fields; mismatch → ERR_COMPUTED_TYPE_MISMATCH),
  origin.first (@Of required + type-preserving; not @required; @via inference; @orderby) —
  reusing the existing origin-path helpers.
- ErrorCode.java: ERR_UNKNOWN_EXPR_NODE + ERR_COMPUTED_TYPE_MISMATCH.
- SpringDtoGenerator.java: originGuaranteedNonNull → @NotNull on any/all/collect DTO
  components; first + computed stay nullable.
- OriginCapabilityValidationTest.java (new): 20 tests mirroring the TS suite.

Verified: mvn -pl metadata test 1161 run / 0 fail (incl. the 20 + the 3 #195 fixtures +
registry-conformance); codegen-spring 168 / 0 (incl. a real-javac DTO compile-run). Error
CODES identical to TS. Divergence (behavioral parity holds): Java validation is eager-throw
vs TS accumulate-all — same inputs accepted/rejected, only simultaneous-error count differs;
rule ordering matches so the first-thrown equals the TS-targeted error.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NGQ7oSuNcjhsMHWwZzhBwr

Author: dmealing

server/java/codegen-spring/src/main/java/com/metaobjects/generator/spring/SpringDtoGenerator.java

@@ -12,6 +12,8 @@
 import com.metaobjects.identity.MetaIdentity;
 import com.metaobjects.loader.MetaDataLoader;
 import com.metaobjects.object.MetaObject;
+import com.metaobjects.origin.AggregateOrigin;
+import com.metaobjects.origin.MetaOrigin;
 import com.metaobjects.validator.ArrayValidator;
 import com.metaobjects.validator.LengthValidator;
 import com.metaobjects.validator.MetaValidator;
@@ -634,6 +636,31 @@ public static boolean isRequired(MetaField<?> field) {
         return attrBool(field, MetaField.ATTR_REQUIRED) || hasValidator(field, RequiredValidator.class);
     }
 
+    /**
+     * #195 — a field whose value is derived by an {@code origin.aggregate}
+     * {@code @agg:any|all|collect} is COALESCE-guaranteed non-null in the synthesized
+     * view (any&rarr;false, all&rarr;true, collect&rarr;empty-array), so its read type
+     * is non-null even when the field is not {@code @required}. Drives {@code @NotNull}
+     * in {@link #validationAnnotations} so a projection DTO's read shape agrees with its
+     * view column — adopters no longer handle a null that never occurs.
+     *
+     * <p>{@code origin.first} is deliberately NOT here (an empty related set selects no
+     * row &rarr; null); {@code origin.computed} nullability is expression-dependent, so
+     * it stays the conservative nullable default. Mirrors the TS
+     * {@code originGuaranteedNonNull} (codegen-ts {@code column-mapper}).</p>
+     */
+    public static boolean originGuaranteedNonNull(MetaField<?> field) {
+        // ADR-0039: own — origin.* never inherits (ADR-0029), so an own-only read is correct.
+        for (MetaData c : field.getChildren(MetaData.class, false)) {
+            if (!(c instanceof MetaOrigin)) continue;
+            if (!AggregateOrigin.SUBTYPE_AGGREGATE.equals(c.getSubType())) continue;
+            String agg = ((MetaOrigin) c).getAgg();
+            return MetaOrigin.AGG_ANY.equals(agg) || MetaOrigin.AGG_ALL.equals(agg)
+                || MetaOrigin.AGG_COLLECT.equals(agg);
+        }
+        return false;
+    }
+
     /**
      * Build the space-joined jakarta.validation annotation string for a record
      * component from the field's constraint metadata — both field attrs
@@ -667,7 +694,11 @@ public static String validationAnnotations(MetaField<?> field) {
         // @required NON-ARRAY string is enforced by @Size(min>=1) in the string-length arm
         // below — NOT @NotBlank, which trims and would wrongly reject a whitespace-only value.
         // A @required array keeps @NotNull only (no @NotEmpty).
-        if (required) {
+        // #195: an origin.aggregate any/all/collect field is COALESCE-guaranteed non-null on
+        // read (any→false / all→true / collect→[]), so it is @NotNull even when not @required
+        // (the non-empty @Size(min=1) floor below stays keyed on @required only — such fields
+        // are boolean or array, never a non-array string).
+        if (required || originGuaranteedNonNull(field)) {
             out.add("@NotNull");
         }
 

server/java/codegen-spring/src/test/java/com/metaobjects/generator/spring/SpringProjectionDtoCompileRunTest.java

@@ -150,6 +150,89 @@ public void projectionDtoCompilesAndNoWriteSurfaceIsEmitted() throws Exception {
         compile(gen);
     }
 
+    /**
+     * #195 native typing — a projection field derived by {@code origin.aggregate}
+     * {@code @agg:any|all|collect} is COALESCE-guaranteed non-null on read, so its DTO
+     * component is {@code @NotNull}; an {@code origin.first} (empty set → null) and
+     * an {@code origin.computed} (expression-dependent nullability) component stay nullable
+     * (no {@code @NotNull}). Mirrors the TS {@code originGuaranteedNonNull} change.
+     */
+    private static final String NULLABILITY_FIXTURE = """
+        {
+          "metadata.root": { "package": "acme::sessions", "children": [
+            { "object.entity": { "name": "Session", "children": [
+                { "source.rdb": { "@table": "sessions" } },
+                { "field.long": { "name": "id" } },
+                { "relationship.association": { "name": "turns", "@objectRef": "Turn", "@cardinality": "many" } },
+                { "identity.primary": { "name": "pk", "@fields": ["id"], "@generation": "increment" } }
+            ] } },
+            { "object.entity": { "name": "Turn", "children": [
+                { "source.rdb": { "@table": "turns" } },
+                { "field.long": { "name": "id" } },
+                { "field.boolean": { "name": "success" } },
+                { "field.string": { "name": "label" } },
+                { "field.timestamp": { "name": "createdAt" } },
+                { "identity.primary": { "name": "pk", "@fields": ["id"], "@generation": "increment" } }
+            ] } },
+            { "object.projection": { "name": "SessionSummary", "children": [
+                { "source.rdb": { "@table": "v_session", "@kind": "view" } },
+                { "field.long": { "name": "id", "extends": "Session.id" } },
+                { "field.string": { "name": "labelsCollect", "isArray": true, "children": [
+                    { "origin.aggregate": { "@agg": "collect", "@of": "Turn.label", "@via": "Session.turns" } } ] } },
+                { "field.boolean": { "name": "anyError", "children": [
+                    { "origin.aggregate": { "@agg": "any", "@via": "Session.turns", "@filter": { "success": false } } } ] } },
+                { "field.string": { "name": "latestLabel", "children": [
+                    { "origin.first": { "@of": "Turn.label", "@via": "Session.turns", "@orderBy": ["createdAt:desc"] } } ] } },
+                { "field.boolean": { "name": "computedFlag", "children": [
+                    { "origin.computed": { "@expr": { "op": "isNotNull", "arg": { "field": "id" } } } } ] } },
+                { "identity.primary": { "name": "pk", "extends": "Session.pk" } }
+            ] } }
+          ] }
+        }
+        """;
+
+    @Test
+    public void originAnyAllCollectFieldsAreNotNull_firstAndComputedStayNullable() throws Exception {
+        Path gen = tmp.newFolder("gen-nullability").toPath();
+        Path ws  = tmp.newFolder("ws-nullability").toPath();
+        MetaDataLoader loader = SpringTestFixtures.loadFixture(ws, "nullability", NULLABILITY_FIXTURE);
+
+        MetaObject summary = loader.getMetaObjectByName("acme::sessions::SessionSummary");
+        assertNotNull("projection must load", summary);
+
+        Map<String, String> args = new HashMap<>();
+        args.put("outputDir", gen.toString());
+        SpringDtoGenerator dtoGen = new SpringDtoGenerator();
+        dtoGen.setArgs(args);
+        dtoGen.execute(loader);
+
+        Path dto = gen.resolve("acme/sessions/SessionSummaryDto.java");
+        assertTrue("expected SessionSummaryDto.java at " + dto, Files.exists(dto));
+        String src = Files.readString(dto);
+
+        // collect + any → COALESCE-guaranteed non-null → @NotNull on the component.
+        assertTrue("collect field must be @NotNull; saw:\n" + src, componentIsNotNull(src, "labelsCollect"));
+        assertTrue("any-predicate field must be @NotNull; saw:\n" + src, componentIsNotNull(src, "anyError"));
+        // first (empty set → null) + computed (expression-dependent) → stay nullable.
+        assertFalse("first field must stay nullable (no @NotNull); saw:\n" + src, componentIsNotNull(src, "latestLabel"));
+        assertFalse("computed field must stay nullable (no @NotNull); saw:\n" + src, componentIsNotNull(src, "computedFlag"));
+
+        compile(gen);
+    }
+
+    /** True iff the DTO record component for {@code fieldName} (one line ending in the
+     *  name, optionally comma-terminated) carries {@code @NotNull}. */
+    private static boolean componentIsNotNull(String src, String fieldName) {
+        for (String line : src.split("\n")) {
+            String t = line.trim();
+            if (t.equals(fieldName) || t.equals(fieldName + ",")
+                    || t.endsWith(" " + fieldName) || t.endsWith(" " + fieldName + ",")) {
+                return t.contains("@NotNull");
+            }
+        }
+        throw new AssertionError("no DTO component line found for field '" + fieldName + "' in:\n" + src);
+    }
+
     /**
      * Compile every generated {@code .java} under {@code gen} with the in-process
      * JDK compiler ({@code render}/{@code om} are on the test classpath). Fails

server/java/metadata/src/main/java/com/metaobjects/ErrorCode.java

@@ -364,6 +364,24 @@ public enum ErrorCode {
      */
     ERR_INVALID_INDEX,
 
+    /**
+     * #195: an {@code origin.computed} {@code @expr} tree contains a node whose
+     * kind/op/fn is not in the closed expression grammar (field/value refs,
+     * comparisons sharing the filter op vocabulary, {@code isNull}/{@code isNotNull},
+     * {@code and}/{@code or}/{@code not}, {@code coalesce}). Fail-closed per ADR-0023;
+     * the detail names the offending token.
+     */
+    ERR_UNKNOWN_EXPR_NODE,
+
+    /**
+     * #195: an {@code origin.computed} {@code @expr} tree's inferred root type does
+     * not equal the carrying field's declared {@code field.<subType>}. A computed
+     * column's type is DERIVED from its expression, never asserted (no {@code @convert}
+     * escape), so a mismatch is a hard load error (sibling of
+     * {@code ERR_PASSTHROUGH_TYPE_MISMATCH}).
+     */
+    ERR_COMPUTED_TYPE_MISMATCH,
+
     /** An internal loader error with no stable error code. */
     ERR_UNKNOWN,
 }