cabloy 5.1.114 → 5.1.116

package/.cabloy-version

@@ -1 +1 @@
-5.1.114
+5.1.116

package/.github/workflows/vona-test-mysql.yml

@@ -35,16 +35,12 @@ jobs:
       - name: init
         run: npm run init
       - name: run Commerce lifecycle gate
-        run: >-
-          DATABASE_DEFAULT_CLIENT=mysql DATABASE_CLIENT_MYSQL_HOST=127.0.0.1 DATABASE_CLIENT_MYSQL_PASSWORD=root npm run vona :bin:test --
-          commerce-trade/test/stockBalance.test.ts
-          commerce-trade/test/stockReservation.test.ts
-          commerce-trade/test/stockAudit.test.ts
-          commerce-promotion/test/couponReservation.test.ts
-          commerce-payment/test/paymentAttempt.test.ts
-          commerce-trade/test/checkoutReservation.test.ts
-          commerce-trade/test/reservationExpiry.test.ts
-          --flavor=normal
+        run: |
+          DATABASE_DEFAULT_CLIENT=mysql DATABASE_CLIENT_MYSQL_HOST=127.0.0.1 DATABASE_CLIENT_MYSQL_PASSWORD=root npm run vona :bin:test -- commerce-trade/test/stockBalance.test.ts commerce-trade/test/stockReservation.test.ts commerce-trade/test/stockAudit.test.ts --flavor=normal
+          DATABASE_DEFAULT_CLIENT=mysql DATABASE_CLIENT_MYSQL_HOST=127.0.0.1 DATABASE_CLIENT_MYSQL_PASSWORD=root npm run vona :bin:test -- commerce-promotion/test/couponReservation.test.ts commerce-payment/test/paymentAttempt.test.ts --flavor=normal
+          DATABASE_DEFAULT_CLIENT=mysql DATABASE_CLIENT_MYSQL_HOST=127.0.0.1 DATABASE_CLIENT_MYSQL_PASSWORD=root npm run vona :bin:test -- commerce-trade/test/checkoutReservation.test.ts commerce-trade/test/checkoutTransaction.test.ts --flavor=normal
+          DATABASE_DEFAULT_CLIENT=mysql DATABASE_CLIENT_MYSQL_HOST=127.0.0.1 DATABASE_CLIENT_MYSQL_PASSWORD=root npm run vona :bin:test -- commerce-trade/test/orderSnapshot.test.ts --flavor=normal
+          DATABASE_DEFAULT_CLIENT=mysql DATABASE_CLIENT_MYSQL_HOST=127.0.0.1 DATABASE_CLIENT_MYSQL_PASSWORD=root npm run vona :bin:test -- commerce-trade/test/reservationExpiry.test.ts --flavor=normal
         working-directory: vona
       - run: DATABASE_DEFAULT_CLIENT=mysql DATABASE_CLIENT_MYSQL_HOST=127.0.0.1 DATABASE_CLIENT_MYSQL_PASSWORD=root npm run test
         working-directory: vona

package/.github/workflows/vona-test-pg.yml

@@ -35,16 +35,12 @@ jobs:
       - name: init
         run: npm run init
       - name: run Commerce stock contention gate
-        run: >-
-          DATABASE_DEFAULT_CLIENT=pg npm run vona :bin:test --
-          commerce-trade/test/stockBalance.test.ts
-          commerce-trade/test/stockReservation.test.ts
-          commerce-trade/test/stockAudit.test.ts
-          commerce-promotion/test/couponReservation.test.ts
-          commerce-payment/test/paymentAttempt.test.ts
-          commerce-trade/test/checkoutReservation.test.ts
-          commerce-trade/test/reservationExpiry.test.ts
-          --flavor=normal
+        run: |
+          DATABASE_DEFAULT_CLIENT=pg npm run vona :bin:test -- commerce-trade/test/stockBalance.test.ts commerce-trade/test/stockReservation.test.ts commerce-trade/test/stockAudit.test.ts --flavor=normal
+          DATABASE_DEFAULT_CLIENT=pg npm run vona :bin:test -- commerce-promotion/test/couponReservation.test.ts commerce-payment/test/paymentAttempt.test.ts --flavor=normal
+          DATABASE_DEFAULT_CLIENT=pg npm run vona :bin:test -- commerce-trade/test/checkoutReservation.test.ts commerce-trade/test/checkoutTransaction.test.ts --flavor=normal
+          DATABASE_DEFAULT_CLIENT=pg npm run vona :bin:test -- commerce-trade/test/orderSnapshot.test.ts --flavor=normal
+          DATABASE_DEFAULT_CLIENT=pg npm run vona :bin:test -- commerce-trade/test/reservationExpiry.test.ts --flavor=normal
         working-directory: vona
       - run: DATABASE_DEFAULT_CLIENT=pg npm run test
         working-directory: vona

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 5.1.116
+
+### Features
+
+- Update platform capabilities and integrations.
+
+### Bug Fixes
+
+- Stabilize Commerce trade transactions and associated tests.
+
+### Improvements
+
+- Update address ownership test coverage.
+
+## 5.1.115
+
+### Improvements
+
+- Refresh the Zova lockfile and core patch dependencies.
+
 ## 5.1.114
 
 ### Features

package/cabloy-docs/backend/orm-mutation-guide.md

@@ -29,6 +29,32 @@ await this.scope.model.post.delete({ id: 1 });
 
 These operations are the clearest fit when the caller already knows the exact write intent.
 
+## Field presence in insert and update
+
+For normal writable fields, insert and update intentionally interpret field presence differently:
+
+| Field state                | `insert`                                           | `update`                         |
+| -------------------------- | -------------------------------------------------- | -------------------------------- |
+| Field is absent            | Leave the column to normal insert/default behavior | Leave the stored value unchanged |
+| Own field with `undefined` | Leave the column to normal insert/default behavior | Write SQL `NULL`                 |
+| `null`                     | Write SQL `NULL`                                   | Write SQL `NULL`                 |
+
+An own `undefined` means the property exists on the JavaScript object but its value is `undefined`, such as `{ title: undefined }`. This lets an update distinguish an omitted field from an intentional clear:
+
+```typescript
+await this.scope.model.post.update({
+  id,
+  title: undefined, // write SQL NULL
+  // stars is absent, so its stored value is unchanged
+});
+```
+
+### JSON columns
+
+JSON columns follow the same field-presence rules. Non-null values are persisted as JSON. An explicit `null` writes SQL `NULL`, not a JSON literal `null`. On update, an own `undefined` also clears the column to SQL `NULL`.
+
+A JSON request body normally omits object properties whose value is `undefined`. This distinction therefore most often applies to in-process TypeScript model calls or server-side payload construction.
+
 ## Conditional update and delete paths
 
 Write operations do not have to target one row only by primary key.
@@ -56,7 +82,7 @@ await this.scope.model.post.delete({
 });
 ```
 
-That matters because the mutation layer still participates in the same structured query language used by select operations.
+That matters because the mutation layer still participates in the same structured query language used by select operations. In `options.where`, an absent field, an own `undefined`, and `Op.omit` all omit that condition; `null` requests SQL `IS NULL`. See [ORM Select Guide](/backend/orm-select-guide#absent-undefined-and-null-in-where) for the detailed query contract.
 
 ## Bulk mutation operations
 
@@ -87,9 +113,12 @@ Instead of forcing callers to choose insert/update/delete up front, Vona can inf
 
 Representative logic:
 
-- no `id` → insert
-- `id` present → update
-- `id` present and `deleted: true` → delete
+- `id` absent, `undefined`, or `null` → insert
+- non-nullish `id` → update
+- non-nullish `id` and `deleted: true` → delete
+- `deleted: true` without a non-nullish `id` → ignore the item because no deletion target exists
+
+A non-nullish identity is neither `null` nor `undefined`. `mutate` chooses by that usable identity value, not merely by whether the `id` key exists.
 
 Representative pattern:
 
@@ -182,13 +211,10 @@ The important rule is:
 
 There is also a useful argument-handling rule to remember:
 
-- default `eq` magic methods such as `getByName()` or `selectByName()` treat an omitted argument as `null`
-- non-`eq` magic methods such as `getByNameEqI()` require an explicit value and throw if the argument is omitted
-
-This aligns magic-method behavior with the current ORM `where` semantics:
+- default `eq` magic methods such as `getByName()` or `selectByName()` treat an omitted or `undefined` argument as `null`
+- non-`eq` magic methods such as `getByNameEqI()` require a concrete value and throw when the argument is omitted or `undefined`
 
-- `Op.omit` means omit a condition explicitly
-- `null` means SQL `IS NULL`
+This is argument adaptation performed by the convenience method. It differs from a direct structured `where` object, where `{ name: undefined }` omits the condition. Use `Op.omit` to make direct condition omission explicit, and use `null` to request SQL `IS NULL`.
 
 That means mutation should stay conceptually grounded in the standard model methods even when convenience wrappers are present.
 

package/cabloy-docs/backend/orm-select-guide.md

@@ -122,29 +122,34 @@ A practical operator-family reading is:
 - composition/subquery: `_and_`, `_or_`, `_not_`, `_exists_`, `_notExists_`
 - identifier helper: `_ref_`
 
-### Omitting a condition with `Op.omit`
+### Absent, `undefined`, and `null` in `where`
 
-Use `Op.omit` when you want to express omission explicitly at the call site. `Op.omit` is defined as `undefined`, but using the named constant makes the business meaning of the query object clearer.
+A direct `where` object distinguishes omitted conditions from SQL `NULL` checks:
+
+| Field value                | Meaning                           |
+| -------------------------- | --------------------------------- |
+| Field is absent            | Do not add a condition            |
+| Own field with `undefined` | Do not add a condition            |
+| `Op.omit`                  | Explicitly do not add a condition |
+| `null`                     | Match SQL `NULL` with `IS NULL`   |
+
+An own `undefined` means the property exists on the JavaScript object but its value is `undefined`, such as `{ title: undefined }`. It has the same query result as an absent field, while `Op.omit` is the readable way to make that omission intentional in a dynamically composed query.
 
 Representative pattern:
 
 ```typescript
 import { Op } from 'vona-module-a-orm';
 
-const where = {
-  title: { _includes_: 'ai' },
-  stars: { _gt_: 20 },
-};
-
 await this.scope.model.post.select({
   where: {
-    ...where,
-    stars: Op.omit,
+    title: undefined, // omitted
+    stars: Op.omit, // explicitly omitted
+    publishedAt: null, // SQL IS NULL
   },
 });
 ```
 
-This lets a query builder remove one condition cleanly without rebuilding the whole `where` object by hand, while `null` remains available for SQL `IS NULL` semantics.
+The same direct-`where` rule applies to filters used by mutation, aggregate, and group operations.
 
 That distinction also matters at the request-contract layer: omitting a nullable filter and passing a real `null` are different operations. When a query DTO needs `IS NULL` behavior from frontend query params, the parsing contract must explicitly preserve `null` instead of collapsing it to omission.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.114",
+  "version": "5.1.116",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.79",
+  "version": "5.1.80",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/pnpm-lock.yaml

@@ -16,7 +16,7 @@ overrides:
   zod: npm:@cabloy/zod@4.3.8
 
 patchedDependencies:
-  zova-core@5.1.78: ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce
+  zova-core@5.1.79: ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce
 
 importers:
 
@@ -534,11 +534,11 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.139
-        version: 5.1.139(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+        specifier: ^5.1.140
+        version: 5.1.140(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
       zova-jsx:
-        specifier: ^1.1.78
-        version: 1.1.78(typescript@5.9.3)
+        specifier: ^1.1.79
+        version: 1.1.79(typescript@5.9.3)
       zova-module-a-api:
         specifier: ^5.1.21
         version: 5.1.21
@@ -606,11 +606,11 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.139
-        version: 5.1.139(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+        specifier: ^5.1.140
+        version: 5.1.140(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
       zova-jsx:
-        specifier: ^1.1.78
-        version: 1.1.78(typescript@5.9.3)
+        specifier: ^1.1.79
+        version: 1.1.79(typescript@5.9.3)
       zova-module-a-api:
         specifier: ^5.1.21
         version: 5.1.21
@@ -678,11 +678,11 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.139
-        version: 5.1.139(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+        specifier: ^5.1.140
+        version: 5.1.140(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
       zova-jsx:
-        specifier: ^1.1.78
-        version: 1.1.78(typescript@5.9.3)
+        specifier: ^1.1.79
+        version: 1.1.79(typescript@5.9.3)
       zova-module-a-api:
         specifier: ^5.1.21
         version: 5.1.21
@@ -750,11 +750,11 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.139
-        version: 5.1.139(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+        specifier: ^5.1.140
+        version: 5.1.140(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
       zova-jsx:
-        specifier: ^1.1.78
-        version: 1.1.78(typescript@5.9.3)
+        specifier: ^1.1.79
+        version: 1.1.79(typescript@5.9.3)
       zova-module-a-api:
         specifier: ^5.1.21
         version: 5.1.21
@@ -8236,11 +8236,11 @@ packages:
     peerDependencies:
       zod: ^3.25.28 || ^4
 
-  zova-core@5.1.78:
-    resolution: {integrity: sha512-PWvgOujRI1k7TpsJy1G8/Wf7W+/Rm6QbGHPNwcRjgDz4PhTg9z8UN1hfIO1Gg37IAI2hIrK8kqHhFRayROQHgQ==}
+  zova-core@5.1.79:
+    resolution: {integrity: sha512-q04JWAjwa5x0py9/FCFPX9I8cNA4zzZ/Z+8mm2mVsRBMqDFcafwVqNumOAkZ+DuA10b4YIoncyQKYz5PhhmBUw==}
 
-  zova-jsx@1.1.78:
-    resolution: {integrity: sha512-KToLi7h2uElT4ULd5QSXfLNqSA3PaeRKJ4IHNMEJU1xiH02j2u0KCd7iVYK54mQC1QYphan3Z/YXFuW0odPx8w==}
+  zova-jsx@1.1.79:
+    resolution: {integrity: sha512-iFp9UpW/3Cbaq0H25xyR04LYyaqB2wlAGOL1dEL7OyuIzHI0IHcBwfZRbRGy7ewgDVHit2ULG03kO1sSjjPuWQ==}
 
   zova-module-a-api@5.1.21:
     resolution: {integrity: sha512-qjm/hfjC4/+7Ap/uzJfBzV0PwRlp2idEmEKwCZYxquaXq6QtJBbTWTznw1iukT4lkJZip2KFkjOvXTzdvZA2UA==}
@@ -8314,17 +8314,17 @@ packages:
   zova-module-a-zod@5.1.36:
     resolution: {integrity: sha512-4gEjxJBelVOA84aP2XWSNSmzQr+AYh14Ha5QCj9yZIpSnEajSgYLoyLw4dwiVcscuEw7xAAOOnWbZS9uXSpJzg==}
 
-  zova-module-a-zova@5.1.93:
-    resolution: {integrity: sha512-pZ7JGNvDoSLdgbQZLj/LtppDWinpd6W+u0WYQvXLuJH3Hnf0Satcpz5fQS+zseJLxm5jhXjmG3ngoYoOfv72RQ==}
+  zova-module-a-zova@5.1.94:
+    resolution: {integrity: sha512-c2qbu3YiNYRSMpprPkBbZ9RaQ9KKF4Y/cEumDJaCpPoZEbJClI/WBZMrY/ZpG9Rsp/87DJ63Vkbu+iSTOh7csg==}
 
   zova-module-rest-resource@5.1.42:
     resolution: {integrity: sha512-eMWhc4428U5Hs4BHqFJoF7yaH+bK8t71scIrCnpLbQS7M80lNkoHxY9s/Kl4i8Uo3+lVWbSbuaXWtR+zVLNqpA==}
 
-  zova-suite-a-zova@5.1.138:
-    resolution: {integrity: sha512-KiX37VxKcZxEi+inDva3iTpeA90vNlEGxBvLqDMPgBYIpkiX8iAoGZmEHhV5iKtbvFoq3gcbGAki+iO6R8mtCw==}
+  zova-suite-a-zova@5.1.139:
+    resolution: {integrity: sha512-LZzCJOXj6njLL91cBgyzThRo+1aOvkBag1XIq4QR6R28t2mrFEdhnvPXBIqcvPpalyZJYwwD+8H/eyE2V/biNg==}
 
-  zova@5.1.139:
-    resolution: {integrity: sha512-6gA4pfdrSv6ZLp/aeE2nZx8Tu6KwKpuHrIbmZ3zrdHazYRkz51l4y//fBLk45lIfiR7uCIlKb9ziFdvOQQ3F7A==}
+  zova@5.1.140:
+    resolution: {integrity: sha512-T8x4YEvkX32lGeeP5rgw7/Y4au10gxqaIHl2nvZlD5Cn9EoLvHfEENpPov8a4cWeQtActoxSTNb3D3WYHE/zpg==}
 
   zwitch@1.0.5:
     resolution: {integrity: sha512-V50KMwwzqJV0NpZIZFwfOD5/lyny3WlSzRiXgA0G7VUnRlqttta1L6UQIHzd6EuBY/cHGfwTIck7w1yH6Q5zUw==}
@@ -14143,7 +14143,7 @@ snapshots:
     dependencies:
       zod: '@cabloy/zod@4.3.8'
 
-  zova-core@5.1.78(patch_hash=ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce)(typescript@5.9.3):
+  zova-core@5.1.79(patch_hash=ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce)(typescript@5.9.3):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
       '@cabloy/extend': link:packages-utils/extend
@@ -14172,14 +14172,14 @@ snapshots:
     transitivePeerDependencies:
       - typescript
 
-  zova-jsx@1.1.78(typescript@5.9.3):
+  zova-jsx@1.1.79(typescript@5.9.3):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
       '@cabloy/utils': link:packages-utils/utils
       '@cabloy/word-utils': 2.1.14
       typestyle: 2.4.0
       vue: 3.5.39(typescript@5.9.3)
-      zova-core: 5.1.78(patch_hash=ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce)(typescript@5.9.3)
+      zova-core: 5.1.79(patch_hash=ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce)(typescript@5.9.3)
     transitivePeerDependencies:
       - typescript
 
@@ -14281,7 +14281,7 @@ snapshots:
       '@cabloy/zod-query': link:packages-utils/zod-query
       zod: '@cabloy/zod@4.3.8'
 
-  zova-module-a-zova@5.1.93(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
+  zova-module-a-zova@5.1.94(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
       '@cabloy/deps': link:packages-utils/deps
@@ -14292,14 +14292,14 @@ snapshots:
       '@cabloy/word-utils': 2.1.14
       defu: 6.1.7
       luxon: 3.7.2
-      zova-jsx: 1.1.78(typescript@5.9.3)
+      zova-jsx: 1.1.79(typescript@5.9.3)
     transitivePeerDependencies:
       - typescript
       - vue
 
   zova-module-rest-resource@5.1.42: {}
 
-  zova-suite-a-zova@5.1.138(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
+  zova-suite-a-zova@5.1.139(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
     dependencies:
       zova-module-a-api: 5.1.21
       zova-module-a-app: 5.1.25
@@ -14325,7 +14325,7 @@ snapshots:
       zova-module-a-style: 5.1.32
       zova-module-a-table: 5.1.37(vue@3.5.39(typescript@5.9.3))
       zova-module-a-zod: 5.1.36
-      zova-module-a-zova: 5.1.93(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+      zova-module-a-zova: 5.1.94(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - debug
@@ -14333,10 +14333,10 @@ snapshots:
       - typescript
       - vue
 
-  zova@5.1.139(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
+  zova@5.1.140(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
     dependencies:
-      zova-core: 5.1.78(patch_hash=ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce)(typescript@5.9.3)
-      zova-suite-a-zova: 5.1.138(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
+      zova-core: 5.1.79(patch_hash=ff659aa5f659be32501f56841b72f148c24acf1546f79cce551586e27fcde2ce)(typescript@5.9.3)
+      zova-suite-a-zova: 5.1.139(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - debug

package/vona/pnpm-workspace.yaml

@@ -53,4 +53,4 @@ allowBuilds:
   vue-demi: true
 
 patchedDependencies:
-  zova-core@5.1.78: patches/zova-core@5.1.78.patch
+  zova-core@5.1.79: patches/zova-core@5.1.79.patch

package/vona/src/suite/a-commerce/modules/commerce-catalog/test/sku.test.ts

@@ -26,7 +26,7 @@ async function viewSku(id: TableIdentity): Promise<EntitySku> {
   });
 }
 
-describe('sku.test.ts', () => {
+describe('sku.test.ts', { concurrency: false }, () => {
   it('action:sku', async () => {
     await app.bean.executor.mockCtx(async () => {
       await app.bean.passport.signinMock();

package/vona/src/suite/a-commerce/modules/commerce-member/test/addressOwnership.test.ts

@@ -91,7 +91,10 @@ describe('address.test.ts', () => {
         true,
       );
 
-      const update: DtoAddressUpdate = { ...addressData, city: 'Oakland', addressLine2: undefined };
+      const { addressLine2: _, ...update } = {
+        ...addressData,
+        city: 'Oakland',
+      } satisfies DtoAddressUpdate;
       assert.equal(
         await performAs(customerA.token, 'patch', `${actionPath}/:id`, {
           params: { id: addressId },

package/vona/src/suite/a-commerce/modules/commerce-promotion/src/dto/couponIssue.tsx

@@ -14,7 +14,7 @@ export class DtoCouponIssue {
   @Api.field(v.required(), v.tableIdentity())
   userId: TableIdentity;
 
-  @Api.field(v.required(), v.min(1), v.max(100))
+  @Api.field(v.required(), v.min(1), v.max(80))
   correlationId: string;
 
   @Api.field(v.required(), v.min(1), v.max(255))

package/vona/src/suite/a-commerce/modules/commerce-promotion/src/service/coupon.ts

@@ -42,7 +42,7 @@ const serializationRetryOptions = {
   minTimeout: 0,
   maxTimeout: 0,
   randomize: false,
-  errorCodes: ['40001'],
+  errorCodes: ['40001', 'ER_LOCK_DEADLOCK', 'ER_LOCK_WAIT_TIMEOUT'],
   ownerOnly: true,
 };
 
@@ -52,6 +52,9 @@ export class ServiceCoupon extends BeanBase {
   @Core.retryable(serializationRetryOptions)
   async issue(command: ICouponIssueCommand): Promise<EntityCouponGrant> {
     this._assertCommand(command);
+    if (command.correlationId.length > 80) {
+      this.app.throw(400, 'coupon issuance correlationId is too long');
+    }
     const template = await this.scope.model.couponTemplate.getByIdForUpdate(command.templateId);
     if (!template) this.app.throw(404, 'coupon template not found');
     this._assertTemplateIssuable(template);

package/vona/src/suite/a-commerce/modules/commerce-promotion/test/couponReservation.test.ts

@@ -39,14 +39,29 @@ describe('couponReservation.test.ts', { concurrency: false }, () => {
             minSpendCents: 1000,
             validFrom: new Date(Date.now() - 1_000),
             validUntil: new Date(Date.now() + 60_000),
-            totalIssueLimit: 1,
+            totalIssueLimit: 2,
             totalUsageLimit: 1,
-            perCustomerIssueLimit: 1,
+            perCustomerIssueLimit: 3,
             issuedCount: 0,
             redeemedCount: 0,
           })
         ).id as number;
         const coupon = app.scope('commerce-promotion').service.coupon;
+        const [, issuanceLengthError] = await catchError(() =>
+          coupon.issue({
+            templateId: fixture.templateId!,
+            userId: customer.id,
+            correlationId: 'x'.repeat(81),
+            reason: 'test overlong issue correlation',
+          }),
+        );
+        assert.equal(issuanceLengthError?.code, 400);
+        assert.equal(
+          await app
+            .scope('commerce-promotion')
+            .model.couponGrant.get({ couponCode: 'x'.repeat(81) }),
+          undefined,
+        );
         const grant = await coupon.issue({
           templateId: fixture.templateId,
           userId: customer.id,
@@ -56,6 +71,20 @@ describe('couponReservation.test.ts', { concurrency: false }, () => {
         fixture.grantId = grant.id as number;
         assert.equal(grant.state, 'available');
         assert.equal(grant.discountCentsSnapshot, 500);
+        const exactLimitGrant = await coupon.issue({
+          templateId: fixture.templateId,
+          userId: customer.id,
+          correlationId: 'a'.repeat(80),
+          reason: 'test exact issue correlation limit',
+        });
+        assert.equal(exactLimitGrant.couponCode.length, 80);
+        await app.scope('commerce-promotion').model.couponAudit.delete({
+          couponGrantId: exactLimitGrant.id,
+        });
+        await app.scope('commerce-promotion').model.couponGrant.delete({ id: exactLimitGrant.id });
+        await app.scope('commerce-promotion').model.couponTemplate.updateById(fixture.templateId, {
+          issuedCount: 1,
+        });
 
         const [_, belowMinimumError] = await catchError(() =>
           coupon.reserve({
@@ -95,6 +124,25 @@ describe('couponReservation.test.ts', { concurrency: false }, () => {
           reason: 'test reserve',
         });
         assert.equal(replay.couponGrant.id, grant.id);
+        const [, wrongCustomerError] = await catchError(() =>
+          coupon.reserve({
+            couponGrantId: grant.id,
+            userId: customer.id + 10_000,
+            orderId: 100_001,
+            eligibleSubtotalCents: 1_200,
+            currency: 'USD',
+            correlationId: `reserve-wrong-customer-${suffix}`,
+            reason: 'test wrong customer',
+          }),
+        );
+        assert.equal(wrongCustomerError?.code, 404);
+        const reserveAuditsBeforeRelease = await app
+          .scope('commerce-promotion')
+          .model.couponAudit.select({ where: { couponGrantId: grant.id } });
+        assert.deepEqual(
+          reserveAuditsBeforeRelease.map(item => item.operation),
+          ['issue', 'reserve'],
+        );
 
         const released = await coupon.release({
           couponGrantId: grant.id,
@@ -103,6 +151,12 @@ describe('couponReservation.test.ts', { concurrency: false }, () => {
           reason: 'test release',
         });
         assert.equal(released.state, 'available');
+        const releasedPersisted = await app
+          .scope('commerce-promotion')
+          .model.couponGrant.getById(grant.id);
+        assert.equal(releasedPersisted?.reservationOrderId, null);
+        assert.equal(releasedPersisted?.reservationCorrelationId, null);
+        assert.equal(releasedPersisted?.reservedAt, null);
         const releaseReplay = await coupon.release({
           couponGrantId: grant.id,
           orderId: 100_001,
@@ -124,6 +178,35 @@ describe('couponReservation.test.ts', { concurrency: false }, () => {
           reason: 'test reserve again',
         });
         assert.equal(reservedAgain.discountCents, 500);
+        const anotherGrant = await coupon.issue({
+          templateId: fixture.templateId,
+          userId: customer.id,
+          correlationId: `issue-another-${suffix}`,
+          reason: 'test second grant',
+        });
+        const [, secondCouponError] = await catchError(() =>
+          coupon.reserve({
+            couponGrantId: anotherGrant.id,
+            userId: customer.id,
+            orderId: 100_002,
+            eligibleSubtotalCents: 1_200,
+            currency: 'USD',
+            correlationId: `reserve-another-${suffix}`,
+            reason: 'test second coupon',
+          }),
+        );
+        assert.equal(secondCouponError?.code, 409);
+        assert.equal(
+          (await app.scope('commerce-promotion').model.couponGrant.getById(anotherGrant.id))?.state,
+          'available',
+        );
+        await app.scope('commerce-promotion').model.couponAudit.delete({
+          couponGrantId: anotherGrant.id,
+        });
+        await app.scope('commerce-promotion').model.couponGrant.delete({ id: anotherGrant.id });
+        await app.scope('commerce-promotion').model.couponTemplate.updateById(fixture.templateId, {
+          issuedCount: 1,
+        });
         const redeemed = await coupon.redeem({
           couponGrantId: grant.id,
           orderId: 100_002,

package/vona/src/suite/a-commerce/modules/commerce-trade/src/service/cart.ts

@@ -10,6 +10,16 @@ import type { DtoCartUpdateItem } from '../dto/cartUpdateItem.tsx';
 import type { DtoCartView } from '../dto/cartView.tsx';
 import type { EntityCart } from '../entity/cart.tsx';
 
+const serializationRetryOptions = {
+  retries: 1,
+  factor: 1,
+  minTimeout: 0,
+  maxTimeout: 0,
+  randomize: false,
+  errorCodes: ['40001', 'ER_LOCK_DEADLOCK', 'ER_LOCK_WAIT_TIMEOUT'],
+  ownerOnly: true,
+};
+
 @Service()
 export class ServiceCart extends BeanBase {
   async current(): Promise<DtoCartView> {
@@ -18,6 +28,7 @@ export class ServiceCart extends BeanBase {
   }
 
   @Core.transaction({ isolationLevel: 'SERIALIZABLE' })
+  @Core.retryable(serializationRetryOptions)
   async addItem(command: DtoCartAddItem): Promise<DtoCartView> {
     await this._assertSellableSku(command.skuId, command.quantity);
     const cart = await this._getOrCreateCurrentCart();
@@ -40,6 +51,7 @@ export class ServiceCart extends BeanBase {
   }
 
   @Core.transaction({ isolationLevel: 'SERIALIZABLE' })
+  @Core.retryable(serializationRetryOptions)
   async updateItem(id: TableIdentity, command: DtoCartUpdateItem): Promise<DtoCartView> {
     const cart = await this._getCurrentCartForUpdate();
     if (!cart) return { items: [] };
@@ -51,6 +63,7 @@ export class ServiceCart extends BeanBase {
   }
 
   @Core.transaction({ isolationLevel: 'SERIALIZABLE' })
+  @Core.retryable(serializationRetryOptions)
   async deleteItem(id: TableIdentity): Promise<DtoCartView> {
     const cart = await this._getCurrentCartForUpdate();
     if (!cart) return { items: [] };
@@ -60,6 +73,7 @@ export class ServiceCart extends BeanBase {
   }
 
   @Core.transaction({ isolationLevel: 'SERIALIZABLE' })
+  @Core.retryable(serializationRetryOptions)
   async clear(): Promise<DtoCartView> {
     const cart = await this._getCurrentCartForUpdate();
     if (!cart) return { items: [] };