cabloy 5.1.105 → 5.1.107

package/.cabloy-version

@@ -1 +1 @@
-5.1.105
+5.1.107

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 5.1.107
+
+### Features
+
+- Localize persisted home roles.
+- Define response contracts for resource mutations, including null responses.
+- Secure generated CRUD actions.
+
+### Improvements
+
+- Clarify built-in role configuration.
+
+## 5.1.106
+
+### Improvements
+
+- Refresh the Zova lockfile and update the Vona Zova Core patch.
+
 ## 5.1.105
 
 ### Features

package/cabloy-docs/backend/backend-resource-module-contract-chain.md

@@ -143,6 +143,7 @@ Representative source facts from this file:
 - the class is decorated with `@Controller<IControllerOptionsStudent>('student')`
 - the class is also decorated with `@Resource()`
 - CRUD actions are declared with `@Web.post()`, `@Web.get()`, `@Web.get(':id')`, `@Web.patch(':id')`, and `@Web.delete(':id')`
+- the standard CRUD actions and the `summary` / `deleteForce` management actions explicitly use `@Passport.systemAdmin()`
 - request shapes use `@Arg.body(...)`, `@Arg.param(...)`, and `@Arg.filter(...)`
 - actions delegate to `this.scope.service.student`
 

package/cabloy-docs/backend/controller-aop-guide.md

@@ -99,6 +99,18 @@ Typical jobs include:
 
 These shorthands still map back to the generic aspect model.
 
+### Passport inheritance and action policy
+
+The global Passport guard is the baseline for controller actions: without a local Passport decorator, an action requires an authenticated and activated user. It is not public.
+
+Use a local Passport or domain guard when an action needs a policy beyond that baseline:
+
+- use `@Passport.public()` only when anonymous access is intentional
+- use `@Passport.systemAdmin()`, `@Passport.roleName(...)`, or a domain-specific guard when access needs additional restriction
+- leave an action without a local Passport guard when authenticated-and-activated access is intentionally sufficient
+
+The CRUD generator applies `@Passport.systemAdmin()` to each generated CRUD action rather than to the controller class. This keeps the administrative default explicit while allowing a future custom action to deliberately inherit the baseline or define its own policy.
+
 For the underlying auth, passport, and user-access model, see [Auth Guide](/backend/auth-guide) and [User Access Guide](/backend/user-access-guide).
 
 ## Interceptor

package/cabloy-docs/backend/controller-guide.md

@@ -148,11 +148,11 @@ Representative pattern:
 
 ```typescript
 @Web.patch('updateUser/:id')
-updateUser(
+async updateUser(
   @Arg.param('id') id: TableIdentity,
   @Arg.body(v.object(DtoUserUpdate)) user: DtoUserUpdate,
-) {
-  return this.scope.model.user.update(user, { where: { id } });
+): Promise<void> {
+  await this.scope.service.user.update(id, user);
 }
 ```
 
@@ -208,6 +208,48 @@ A practical rule is:
 - use return-type inference when the contract is obvious and simple
 - use explicit `@Api.body(...)` when the response shape needs more control or the inference boundary becomes unclear
 
+## Resource mutation response contract
+
+Standard resource `update` and `delete` actions are command-style actions. Their public contract is successful completion, not an implicit persistence-model payload.
+
+Representative pattern:
+
+```typescript
+import { z } from 'zod';
+
+@Web.patch(':id')
+@Api.body(z.null())
+@Passport.systemAdmin()
+async update(
+  @Arg.param('id', v.tableIdentity()) id: TableIdentity,
+  @Arg.body() student: DtoStudentUpdate,
+): Promise<void> {
+  await this.scope.service.student.update(id, student);
+}
+```
+
+Use `await` without `return` at the controller boundary. A service or model may still return mutation data for internal orchestration, but that data is not automatically a stable public representation of the resource.
+
+`Promise<void>` expresses the controller's command semantics, while `@Api.body(z.null())` explicitly supplies the response schema that runtime reflection cannot recover from `Promise<void>`. It makes the existing no-payload response visible to emitted OpenAPI and generated SDK consumers.
+
+For a standard JSON action, Vona maps this no-result controller completion to its normal HTTP `200` success wrapper:
+
+```typescript
+{
+  code: 0,
+  message: 'success',
+  data: null,
+}
+```
+
+This is Vona's default resource-mutation convention. It does not use HTTP `204 No Content`, so consumers can keep one uniform success-envelope protocol.
+
+### When a mutation should return data
+
+Return data only when it is an intentional consumer-facing contract, such as an updated response DTO, a version token, or a job handle. Declare that shape explicitly with `@Api.body(...)`; add `@Core.serializer()` when the response depends on serializer transforms, exclusions, getters, or replacements. Do not forward raw ORM or service mutation results merely because the delegated method returns a value.
+
+`create` and read actions commonly expose an identity or DTO and therefore use their own explicit response contracts. For generated resource defaults, see [CRUD Workflow](/backend/crud-workflow#generated-mutation-response-default). For action-level verification, see [Unit Testing](/backend/unit-testing#testing-controllers-through-actions). When a declared response shape changes, follow the [Backend OpenAPI to Frontend SDK](/fullstack/openapi-to-sdk) contract loop.
+
 ## Response wrapper behavior
 
 By default, Vona wraps the response body in a standard wrapper object.

package/cabloy-docs/backend/crud-workflow.md

@@ -43,6 +43,20 @@ The generator creates a connected set of files, typically including:
 
 This is exactly why this generator should be the default starting point. It gives a consistent starting shape across the backend thread.
 
+### Generated authorization default
+
+The standard generated CRUD actions (`create`, `select`, `view`, `update`, and `delete`) each use `@Passport.systemAdmin()`. This is an explicit administrative whitelist for the generated Admin resource API, matching the generated SSR menu's `systemAdmin` visibility policy.
+
+The guard is attached to individual actions rather than the controller class. When you add a custom action later, no local Passport guard intentionally means the global authenticated-and-activated baseline applies; it does not mean the action is public. Use `@Passport.public()` to intentionally allow anonymous access, or add a role/domain guard when an action needs stronger restriction.
+
+SSR menu roles control navigation disclosure only. They never authorize a controller action, API, or resource; keep the action guard as the server-side authorization boundary. See [Controller AOP Guide](/backend/controller-aop-guide) and [Menu Guide](/backend/menu-guide).
+
+### Generated mutation response default
+
+Generated resource `update` and `delete` actions are command-style actions. Their controllers use `Promise<void>`, await the service call without forwarding its result, and declare `@Api.body(z.null())` so OpenAPI and generated SDKs describe the normal HTTP `200` success wrapper accurately as `data: null`.
+
+This controller-facing default does not require the service or model mutation method to return `void`. Those lower layers may retain mutation data for internal orchestration. See [Controller Guide](/backend/controller-guide#resource-mutation-response-contract) when a mutation deliberately needs a consumer-facing response payload.
+
 A practical generated-output checklist usually includes:
 
 - controller

package/cabloy-docs/backend/unit-testing.md

@@ -121,13 +121,19 @@ A practical rule is:
 A representative contract-verification pattern is:
 
 ```typescript
-await app.bean.executor.performAction('patch', '/test/rest/product/:id', {
+const updateRes = await app.bean.executor.performAction('patch', '/test/rest/product/:id', {
   params: { id: productId },
   body: dataUpdate,
 });
+assert.equal(updateRes, null);
+
+const deleteRes = await app.bean.executor.performAction('delete', '/test/rest/product/:id', {
+  params: { id: productId },
+});
+assert.equal(deleteRes, null);
 ```
 
-This is a good default because the same test can exercise params, body, route wiring, validation, and response behavior together.
+For standard resource command mutations, these assertions verify the controller-facing no-payload runtime contract. Follow them with a query/read-back assertion to verify the persisted update or deletion. When the API is generated for frontend consumers, add a focused OpenAPI structural assertion that its wrapped response schema declares `data: null`; this verifies SDK-contract fidelity separately from responder behavior. The same test then exercises params, body, route wiring, validation, response behavior, and persistence effects together.
 
 ## Authentication simulation
 

package/cabloy-docs/fullstack/openapi-to-sdk.md

@@ -68,6 +68,7 @@ For the deeper frontend perspective, see:
 If you want the shortest accurate mental model, use this forward chain:
 
 1. backend controller signatures define request and response entry surfaces
+   - command-style mutations that complete with Vona's wrapped `data: null` must declare `@Api.body(z.null())`; `Promise<void>` alone cannot preserve that generic type through runtime reflection
 2. backend DTO and entity fields shape named and shared contract structure
 3. validation rules and `v` helpers refine the machine-readable contract
 4. Vona emits OpenAPI output from those backend declarations

package/cabloy-docs/fullstack/tutorial-2-first-crud.md

@@ -95,6 +95,9 @@ As you inspect the generated files, pay attention to the division of responsibil
 
 This is the backend contract thread that later tutorials will extend with `level`, `mobile`, render metadata, OpenAPI output, and row actions.
 
+> [!NOTE]
+> The generated Admin CRUD actions explicitly require the `systemAdmin` role. If this resource should serve another audience, adjust the relevant controller action guards as well as any SSR menu visibility; changing the menu alone does not authorize an API.
+
 ## Verification
 
 1. make sure the local dev workflow is running:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.105",
+  "version": "5.1.107",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/vona/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli",
-  "version": "1.1.129",
+  "version": "1.1.130",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli",
   "keywords": [

package/vona/packages-cli/cli-set-api/cli/templates/tools/crud/boilerplate/src/bean/ssrMenu.{{resourceName}}.ts_

@@ -20,6 +20,7 @@ export interface ISsrMenuOptions<%=argv.resourceNameCapitalize%> extends IDecora
         },
       },
       group: '<%=argv.ssrSiteGroupName%>',
+      roles: ['systemAdmin'],
     },
   },
   site: ['<%=argv.ssrSiteOnionName%>'],

package/vona/packages-cli/cli-set-api/cli/templates/tools/crudBasic/boilerplate/src/controller/{{resourceName}}.ts_

@@ -4,6 +4,8 @@ import type { IDecoratorControllerOptions } from 'vona-module-a-web';
 
 import { BeanBase } from 'vona';
 import { Api, Resource, v } from 'vona-module-a-openapiutils';
+import { z } from 'zod';
+import { Passport } from 'vona-module-a-user';
 import { Arg, Controller, Web } from 'vona-module-a-web';
 
 import type { Model<%=argv.resourceNameCapitalize%> } from '../model/<%=argv.resourceName%>.ts';
@@ -21,29 +23,36 @@ export interface IControllerOptions<%=argv.resourceNameCapitalize%> extends IDec
 export class Controller<%=argv.resourceNameCapitalize%> extends BeanBase {
   @Web.post()
   @Api.body(v.tableIdentity())
+  @Passport.systemAdmin()
   async create(@Arg.body() <%=argv.resourceName%>: Dto<%=argv.resourceNameCapitalize%>Create): Promise<TableIdentity> {
     return (await this.scope.service.<%=argv.resourceName%>.create(<%=argv.resourceName%>)).id;
   }
 
   @Web.get()
   @Api.body(Dto<%=argv.resourceNameCapitalize%>SelectRes)
+  @Passport.systemAdmin()
   async select(@Arg.filter(Dto<%=argv.resourceNameCapitalize%>SelectReq) params: IQueryParams<Model<%=argv.resourceNameCapitalize%>>): Promise<Dto<%=argv.resourceNameCapitalize%>SelectRes> {
     return await this.scope.service.<%=argv.resourceName%>.select(params);
   }
 
   @Web.get(':id')
   @Api.body(v.optional(), v.object(Dto<%=argv.resourceNameCapitalize%>View))
+  @Passport.systemAdmin()
   async view(@Arg.param('id', v.tableIdentity()) id: TableIdentity): Promise<Dto<%=argv.resourceNameCapitalize%>View | undefined> {
     return await this.scope.service.<%=argv.resourceName%>.view(id);
   }
 
   @Web.patch(':id')
-  async update(@Arg.param('id', v.tableIdentity()) id: TableIdentity, @Arg.body() <%=argv.resourceName%>: Dto<%=argv.resourceNameCapitalize%>Update) {
-    return await this.scope.service.<%=argv.resourceName%>.update(id, <%=argv.resourceName%>);
+  @Api.body(z.null())
+  @Passport.systemAdmin()
+  async update(@Arg.param('id', v.tableIdentity()) id: TableIdentity, @Arg.body() <%=argv.resourceName%>: Dto<%=argv.resourceNameCapitalize%>Update): Promise<void> {
+    await this.scope.service.<%=argv.resourceName%>.update(id, <%=argv.resourceName%>);
   }
 
   @Web.delete(':id')
-  async delete(@Arg.param('id', v.tableIdentity()) id: TableIdentity) {
-    return await this.scope.service.<%=argv.resourceName%>.delete(id);
+  @Api.body(z.null())
+  @Passport.systemAdmin()
+  async delete(@Arg.param('id', v.tableIdentity()) id: TableIdentity): Promise<void> {
+    await this.scope.service.<%=argv.resourceName%>.delete(id);
   }
 }

package/vona/packages-cli/cli-set-api/cli/templates/tools/crudBasic/boilerplate/test/{{resourceName}}.test.ts_

@@ -15,7 +15,24 @@ describe('<%=argv.resourceName%>.test.ts', () => {
         name: '__TomNew__',
         description: 'This is a test',
       };
-      // login
+      // role-less authenticated users cannot access generated admin actions
+      await app.bean.passport.signinMock();
+      try {
+        app.bean.passport.current!.roles = [];
+        const actions = ['create', 'select', 'view', 'update', 'delete'];
+        const permissions = await Promise.all(
+          actions.map(action =>
+            app.bean.permission.retrievePermissionAction(
+              '<%=argv.moduleInfo.relativeName%>:<%=argv.resourceName%>',
+              action,
+            ),
+          ),
+        );
+        assert.deepEqual(permissions, actions.map(() => false));
+      } finally {
+        await app.bean.passport.signout();
+      }
+      // login as system admin
       await app.bean.passport.signinMock();
       // create
       const <%=argv.resourceName%>Id = await app.bean.executor.performAction('post', '<%=argv.moduleActionPathRaw%>', { body: data });
@@ -24,15 +41,17 @@ describe('<%=argv.resourceName%>.test.ts', () => {
       const selectRes: Dto<%=argv.resourceNameCapitalize%>SelectRes = await app.bean.executor.performAction('get', '<%=argv.moduleActionPathRaw%>');
       assert.equal(selectRes.list.findIndex(item => item.name === data.name) > -1, true);
       // update
-      await app.bean.executor.performAction('patch', '<%=argv.moduleActionPathRaw%>/:id', {
+      const updateRes = await app.bean.executor.performAction('patch', '<%=argv.moduleActionPathRaw%>/:id', {
         params: { id: <%=argv.resourceName%>Id },
         body: dataUpdate,
       });
+      assert.equal(updateRes, null);
       // findOne
       let <%=argv.resourceName%>: Entity<%=argv.resourceNameCapitalize%> = await app.bean.executor.performAction('get', '<%=argv.moduleActionPathRaw%>/:id', { params: { id: <%=argv.resourceName%>Id } });
       assert.equal(<%=argv.resourceName%>.name, dataUpdate.name);
       // delete
-      await app.bean.executor.performAction('delete', '<%=argv.moduleActionPathRaw%>/:id', { params: { id: <%=argv.resourceName%>.id } });
+      const deleteRes = await app.bean.executor.performAction('delete', '<%=argv.moduleActionPathRaw%>/:id', { params: { id: <%=argv.resourceName%>.id } });
+      assert.equal(deleteRes, null);
       // findOne
       <%=argv.resourceName%> = await app.bean.executor.performAction('get', '<%=argv.moduleActionPathRaw%>/:id', { params: { id: <%=argv.resourceName%>.id } });
       assert.equal(<%=argv.resourceName%>, undefined);

package/vona/packages-cli/cli-set-api/cli/templates/tools/crudStart/boilerplate/src/controller/{{resourceName}}.ts_

@@ -4,6 +4,8 @@ import type { IDecoratorControllerOptions } from 'vona-module-a-web';
 
 import { BeanBase } from 'vona';
 import { Api, Resource, v } from 'vona-module-a-openapiutils';
+import { z } from 'zod';
+import { Passport } from 'vona-module-a-user';
 import { Arg, Controller, Web } from 'vona-module-a-web';
 
 import type { Model<%=argv.resourceNameCapitalize%> } from '../model/<%=argv.resourceName%>.ts';
@@ -21,29 +23,36 @@ export interface IControllerOptions<%=argv.resourceNameCapitalize%> extends IDec
 export class Controller<%=argv.resourceNameCapitalize%> extends BeanBase {
   @Web.post()
   @Api.body(v.tableIdentity())
+  @Passport.systemAdmin()
   async create(@Arg.body() <%=argv.resourceName%>: Dto<%=argv.resourceNameCapitalize%>Create): Promise<TableIdentity> {
     return (await this.scope.service.<%=argv.resourceName%>.create(<%=argv.resourceName%>)).id;
   }
 
   @Web.get()
   @Api.body(Dto<%=argv.resourceNameCapitalize%>SelectRes)
+  @Passport.systemAdmin()
   async select(@Arg.filter(Dto<%=argv.resourceNameCapitalize%>SelectReq) params: IQueryParams<Model<%=argv.resourceNameCapitalize%>>): Promise<Dto<%=argv.resourceNameCapitalize%>SelectRes> {
     return await this.scope.service.<%=argv.resourceName%>.select(params);
   }
 
   @Web.get(':id')
   @Api.body(v.optional(), v.object(Dto<%=argv.resourceNameCapitalize%>View))
+  @Passport.systemAdmin()
   async view(@Arg.param('id', v.tableIdentity()) id: TableIdentity): Promise<Dto<%=argv.resourceNameCapitalize%>View | undefined> {
     return await this.scope.service.<%=argv.resourceName%>.view(id);
   }
 
   @Web.patch(':id')
-  async update(@Arg.param('id', v.tableIdentity()) id: TableIdentity, @Arg.body() <%=argv.resourceName%>: Dto<%=argv.resourceNameCapitalize%>Update) {
-    return await this.scope.service.<%=argv.resourceName%>.update(id, <%=argv.resourceName%>);
+  @Api.body(z.null())
+  @Passport.systemAdmin()
+  async update(@Arg.param('id', v.tableIdentity()) id: TableIdentity, @Arg.body() <%=argv.resourceName%>: Dto<%=argv.resourceNameCapitalize%>Update): Promise<void> {
+    await this.scope.service.<%=argv.resourceName%>.update(id, <%=argv.resourceName%>);
   }
 
   @Web.delete(':id')
-  async delete(@Arg.param('id', v.tableIdentity()) id: TableIdentity) {
-    return await this.scope.service.<%=argv.resourceName%>.delete(id);
+  @Api.body(z.null())
+  @Passport.systemAdmin()
+  async delete(@Arg.param('id', v.tableIdentity()) id: TableIdentity): Promise<void> {
+    await this.scope.service.<%=argv.resourceName%>.delete(id);
   }
 }

package/vona/packages-cli/cli-set-api/cli/templates/tools/crudStart/boilerplate/test/{{resourceName}}.test.ts_

@@ -15,7 +15,24 @@ describe('<%=argv.resourceName%>.test.ts', () => {
         name: '__TomNew__',
         description: 'This is a test',
       };
-      // login
+      // role-less authenticated users cannot access generated admin actions
+      await app.bean.passport.signinMock();
+      try {
+        app.bean.passport.current!.roles = [];
+        const actions = ['create', 'select', 'view', 'update', 'delete'];
+        const permissions = await Promise.all(
+          actions.map(action =>
+            app.bean.permission.retrievePermissionAction(
+              '<%=argv.moduleInfo.relativeName%>:<%=argv.resourceName%>',
+              action,
+            ),
+          ),
+        );
+        assert.deepEqual(permissions, actions.map(() => false));
+      } finally {
+        await app.bean.passport.signout();
+      }
+      // login as system admin
       await app.bean.passport.signinMock();
       // create
       const <%=argv.resourceName%>Id = await app.bean.executor.performAction('post', '<%=argv.moduleActionPathRaw%>', { body: data });
@@ -24,15 +41,17 @@ describe('<%=argv.resourceName%>.test.ts', () => {
       const selectRes: Dto<%=argv.resourceNameCapitalize%>SelectRes = await app.bean.executor.performAction('get', '<%=argv.moduleActionPathRaw%>');
       assert.equal(selectRes.list.findIndex(item => item.name === data.name) > -1, true);
       // update
-      await app.bean.executor.performAction('patch', '<%=argv.moduleActionPathRaw%>/:id', {
+      const updateRes = await app.bean.executor.performAction('patch', '<%=argv.moduleActionPathRaw%>/:id', {
         params: { id: <%=argv.resourceName%>Id },
         body: dataUpdate,
       });
+      assert.equal(updateRes, null);
       // findOne
       let <%=argv.resourceName%>: Entity<%=argv.resourceNameCapitalize%> = await app.bean.executor.performAction('get', '<%=argv.moduleActionPathRaw%>/:id', { params: { id: <%=argv.resourceName%>Id } });
       assert.equal(<%=argv.resourceName%>.name, dataUpdate.name);
       // delete
-      await app.bean.executor.performAction('delete', '<%=argv.moduleActionPathRaw%>/:id', { params: { id: <%=argv.resourceName%>.id } });
+      const deleteRes = await app.bean.executor.performAction('delete', '<%=argv.moduleActionPathRaw%>/:id', { params: { id: <%=argv.resourceName%>.id } });
+      assert.equal(deleteRes, null);
       // findOne
       <%=argv.resourceName%> = await app.bean.executor.performAction('get', '<%=argv.moduleActionPathRaw%>/:id', { params: { id: <%=argv.resourceName%>.id } });
       assert.equal(<%=argv.resourceName%>, undefined);

package/vona/packages-cli/cli-set-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli-set-api",
-  "version": "1.1.127",
+  "version": "1.1.128",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli-set-api",
   "keywords": [

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.74",
+  "version": "5.1.75",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/patches/{zova-core@5.1.77.patch → zova-core@5.1.78.patch}

@@ -32,10 +32,10 @@ index 838e299407218b7bfac469d42a12d6ab59820380..e8b61cc231e39ee3a270ee513ab43ff5
  //# sourceMappingURL=module.d.ts.map
 
 diff --git a/dist/types/utils/env.d.ts b/dist/types/utils/env.d.ts
-index 708c0a584dfec65b8c7ad2d049156f900de49928..a8caacb276794e3ac70591b974f14d6eee3ac302 100644
+index 7eb5fa0c4d5c23e046b1cebb64cf8ce85c0302fa..5f6aa470d4a88262e2108ff086923c673fdfbf67 100644
 --- a/dist/types/utils/env.d.ts
 +++ b/dist/types/utils/env.d.ts
-@@ -34,19 +34,4 @@ export interface ZovaConfigEnv {
+@@ -35,19 +35,4 @@ export interface ZovaConfigEnv {
      MOCK_BUILD: string | undefined;
      MOCK_BUILD_PORT: string | undefined;
  }

package/vona/pnpm-lock.yaml

@@ -16,7 +16,7 @@ overrides:
   zod: npm:@cabloy/zod@4.3.8
 
 patchedDependencies:
-  zova-core@5.1.77: 0f4164c4d2bbb16d671beb5c26759dff37769be0709df941bc7b90b94261ac54
+  zova-core@5.1.78: ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce
 
 importers:
 
@@ -501,11 +501,11 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.134
-        version: 5.1.134(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+        specifier: ^5.1.135
+        version: 5.1.135(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
       zova-jsx:
-        specifier: ^1.1.77
-        version: 1.1.77(typescript@5.9.3)
+        specifier: ^1.1.78
+        version: 1.1.78(typescript@5.9.3)
       zova-module-a-api:
         specifier: ^5.1.21
         version: 5.1.21
@@ -534,8 +534,8 @@ importers:
         specifier: ^5.1.43
         version: 5.1.43
       zova-module-a-router:
-        specifier: ^5.1.29
-        version: 5.1.29
+        specifier: ^5.1.30
+        version: 5.1.30
       zova-module-a-routertabs:
         specifier: ^5.1.33
         version: 5.1.33
@@ -573,11 +573,11 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.134
-        version: 5.1.134(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+        specifier: ^5.1.135
+        version: 5.1.135(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
       zova-jsx:
-        specifier: ^1.1.77
-        version: 1.1.77(typescript@5.9.3)
+        specifier: ^1.1.78
+        version: 1.1.78(typescript@5.9.3)
       zova-module-a-api:
         specifier: ^5.1.21
         version: 5.1.21
@@ -606,8 +606,8 @@ importers:
         specifier: ^5.1.43
         version: 5.1.43
       zova-module-a-router:
-        specifier: ^5.1.29
-        version: 5.1.29
+        specifier: ^5.1.30
+        version: 5.1.30
       zova-module-a-routertabs:
         specifier: ^5.1.33
         version: 5.1.33
@@ -7948,11 +7948,11 @@ packages:
     peerDependencies:
       zod: ^3.25.28 || ^4
 
-  zova-core@5.1.77:
-    resolution: {integrity: sha512-PfB5yaHVZ8U8Fjeyju3m9OGe1PjXH26HTjkA9jvl+KK9l3t/lzdEVP4s03/4zEggvPz7pkwek1heLuMaQRmX/Q==}
+  zova-core@5.1.78:
+    resolution: {integrity: sha512-PWvgOujRI1k7TpsJy1G8/Wf7W+/Rm6QbGHPNwcRjgDz4PhTg9z8UN1hfIO1Gg37IAI2hIrK8kqHhFRayROQHgQ==}
 
-  zova-jsx@1.1.77:
-    resolution: {integrity: sha512-TnjesMVt7wSvwjP4XDOg9m2MacbL5xgMrdLtU9XhhPHm3gYuNV/hzr2vQ788k/z+WWQdHsqRvTy6Ngr/GDr6zg==}
+  zova-jsx@1.1.78:
+    resolution: {integrity: sha512-KToLi7h2uElT4ULd5QSXfLNqSA3PaeRKJ4IHNMEJU1xiH02j2u0KCd7iVYK54mQC1QYphan3Z/YXFuW0odPx8w==}
 
   zova-module-a-api@5.1.21:
     resolution: {integrity: sha512-qjm/hfjC4/+7Ap/uzJfBzV0PwRlp2idEmEKwCZYxquaXq6QtJBbTWTznw1iukT4lkJZip2KFkjOvXTzdvZA2UA==}
@@ -7999,8 +7999,8 @@ packages:
   zova-module-a-openapi@5.1.43:
     resolution: {integrity: sha512-xJKvSPl1AZnH7EpgEd9a3u3IEpJfnou19DKre/7TL1KdiTdfNThLrmmkdP1UNYlUHUgCczcGUwZDdMiE9gdxwA==}
 
-  zova-module-a-router@5.1.29:
-    resolution: {integrity: sha512-7vIXOf0aPUXvZAFC9hM1JQyNwmQAG+EtSbQ1et8+iP6roff8yUhhq50Dw8PFU5eb7hjk1TTxpUFhCTvev5JZqQ==}
+  zova-module-a-router@5.1.30:
+    resolution: {integrity: sha512-pfKeZdZUMTfkjEVZfLHj21UKjKBhTd79rfF4Mr+OLwV4avK8sDPAudseaAInVvh+T/0Ayq5w9fLhzFYeU1If8A==}
 
   zova-module-a-routerstack@5.1.26:
     resolution: {integrity: sha512-uu4tFw2DUruanPR7cojM5p6rvyCIh+tnwPmq7s0jZdg+5XBr+YMy1RGjnE8vPFSLHW8C71hlNbps6VpKvKMiiQ==}
@@ -8026,17 +8026,17 @@ packages:
   zova-module-a-zod@5.1.36:
     resolution: {integrity: sha512-4gEjxJBelVOA84aP2XWSNSmzQr+AYh14Ha5QCj9yZIpSnEajSgYLoyLw4dwiVcscuEw7xAAOOnWbZS9uXSpJzg==}
 
-  zova-module-a-zova@5.1.92:
-    resolution: {integrity: sha512-RxHSKnBDMuBKwx0cJoPOIvq/DV6Xhji2yZ/lBgJTMrWOYVsHux/PbDc+vlAU+Aie2K0RiZ2ytR3mPBpMxpmexg==}
+  zova-module-a-zova@5.1.93:
+    resolution: {integrity: sha512-pZ7JGNvDoSLdgbQZLj/LtppDWinpd6W+u0WYQvXLuJH3Hnf0Satcpz5fQS+zseJLxm5jhXjmG3ngoYoOfv72RQ==}
 
   zova-module-rest-resource@5.1.41:
     resolution: {integrity: sha512-7Y8rLmHdw0pynlWqsyHPWuCWFLwr/0HsNvfef64cPw91LRujf/7OlulVWqH8ZoFNioZZUpfumB+t/+mICoYfFg==}
 
-  zova-suite-a-zova@5.1.133:
-    resolution: {integrity: sha512-N7YSmamP2eV3MBV4RnFXXUlDg9yEcvYkHDxfcgQQFjR1iQyxNbCLO1Ud4Bjcinray2KNrnOF41e+0gn7A6jzRQ==}
+  zova-suite-a-zova@5.1.134:
+    resolution: {integrity: sha512-XwmEGAM6po9GjzGLryGVCKhkVjtI3MXNY85AhQVxxMUOU6S+3dBtF399LzzDdhlKYXbvfwuHB/yDQiS1PbfS5w==}
 
-  zova@5.1.134:
-    resolution: {integrity: sha512-nnieXjXy0+94FKZCT05dGvwASJQ7PiM387r+dToLAuSFRCqgQwaLvYyrOXN2RhKt8Z5nefWDMwA9LPWgBksnLg==}
+  zova@5.1.135:
+    resolution: {integrity: sha512-Avk0YcjocSYpdRUO4A58/yQmeGUoo+bgzbtKZNLCNDit7PSEGMBJZi9p47ct7SNc6LDybhBm7xPf/xioL0Ozdg==}
 
   zwitch@1.0.5:
     resolution: {integrity: sha512-V50KMwwzqJV0NpZIZFwfOD5/lyny3WlSzRiXgA0G7VUnRlqttta1L6UQIHzd6EuBY/cHGfwTIck7w1yH6Q5zUw==}
@@ -13855,7 +13855,7 @@ snapshots:
     dependencies:
       zod: '@cabloy/zod@4.3.8'
 
-  zova-core@5.1.77(patch_hash=0f4164c4d2bbb16d671beb5c26759dff37769be0709df941bc7b90b94261ac54)(typescript@5.9.3):
+  zova-core@5.1.78(patch_hash=ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce)(typescript@5.9.3):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
       '@cabloy/extend': link:packages-utils/extend
@@ -13884,14 +13884,14 @@ snapshots:
     transitivePeerDependencies:
       - typescript
 
-  zova-jsx@1.1.77(typescript@5.9.3):
+  zova-jsx@1.1.78(typescript@5.9.3):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
       '@cabloy/utils': link:packages-utils/utils
       '@cabloy/word-utils': 2.1.14
       typestyle: 2.4.0
       vue: 3.5.39(typescript@5.9.3)
-      zova-core: 5.1.77(patch_hash=0f4164c4d2bbb16d671beb5c26759dff37769be0709df941bc7b90b94261ac54)(typescript@5.9.3)
+      zova-core: 5.1.78(patch_hash=ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce)(typescript@5.9.3)
     transitivePeerDependencies:
       - typescript
 
@@ -13953,7 +13953,7 @@ snapshots:
       openapi3-ts: 4.6.0
       typestyle: 2.4.0
 
-  zova-module-a-router@5.1.29: {}
+  zova-module-a-router@5.1.30: {}
 
   zova-module-a-routerstack@5.1.26: {}
 
@@ -13992,7 +13992,7 @@ snapshots:
       '@cabloy/zod-query': link:packages-utils/zod-query
       zod: '@cabloy/zod@4.3.8'
 
-  zova-module-a-zova@5.1.92(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
+  zova-module-a-zova@5.1.93(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
       '@cabloy/deps': link:packages-utils/deps
@@ -14003,14 +14003,14 @@ snapshots:
       '@cabloy/word-utils': 2.1.14
       defu: 6.1.7
       luxon: 3.7.2
-      zova-jsx: 1.1.77(typescript@5.9.3)
+      zova-jsx: 1.1.78(typescript@5.9.3)
     transitivePeerDependencies:
       - typescript
       - vue
 
   zova-module-rest-resource@5.1.41: {}
 
-  zova-suite-a-zova@5.1.133(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
+  zova-suite-a-zova@5.1.134(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
     dependencies:
       zova-module-a-api: 5.1.21
       zova-module-a-app: 5.1.24
@@ -14027,7 +14027,7 @@ snapshots:
       zova-module-a-meta: 5.1.21
       zova-module-a-model: 5.1.33(vue@3.5.39(typescript@5.9.3))
       zova-module-a-openapi: 5.1.43
-      zova-module-a-router: 5.1.29
+      zova-module-a-router: 5.1.30
       zova-module-a-routerstack: 5.1.26
       zova-module-a-routertabs: 5.1.33
       zova-module-a-ssr: 5.1.29
@@ -14036,7 +14036,7 @@ snapshots:
       zova-module-a-style: 5.1.32
       zova-module-a-table: 5.1.37(vue@3.5.39(typescript@5.9.3))
       zova-module-a-zod: 5.1.36
-      zova-module-a-zova: 5.1.92(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+      zova-module-a-zova: 5.1.93(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - debug
@@ -14044,10 +14044,10 @@ snapshots:
       - typescript
       - vue
 
-  zova@5.1.134(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
+  zova@5.1.135(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
     dependencies:
-      zova-core: 5.1.77(patch_hash=0f4164c4d2bbb16d671beb5c26759dff37769be0709df941bc7b90b94261ac54)(typescript@5.9.3)
-      zova-suite-a-zova: 5.1.133(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+      zova-core: 5.1.78(patch_hash=ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce)(typescript@5.9.3)
+      zova-suite-a-zova: 5.1.134(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - debug