cabloy 5.1.154 → 5.1.156

package/repo-docs/fullstack/edition-collaboration-differences.md

@@ -26,7 +26,7 @@ The most important differences show up in:
 - frontend flavor names
 - frontend module composition
 - admin/web SSR site baselines
-- edition-specific private value-add content and project assets in Cabloy Start
+- Start-specific value-add content and project assets
 - potentially different generated output paths or integration details
 
 ## Cabloy Basic
@@ -38,7 +38,7 @@ In the current public monorepo, Basic examples commonly align with:
 
 ## Cabloy Start
 
-In the sibling private repo, Start examples commonly align with:
+In the sibling public Start repository, examples commonly align with:
 
 - Vuetify-oriented frontend assumptions
 - Start-specific Zova flavors such as `cabloyStartAdmin` and `cabloyStartWeb`

package/repo-docs/fullstack/introduction.md

@@ -61,9 +61,13 @@ Use this path when the task depends on edition boundaries, UI assumptions, or cr
 
 ## Shared architecture
 
-- **Vona** provides the backend framework capabilities.
-- **Zova** provides the frontend framework capabilities.
-- The root repository coordinates the two through shared scripts, shared terminology, and a shared release story.
+Cabloy coordinates its backend and frontend layers as one fullstack system:
+
+- **Vona** provides the backend framework and runtime capabilities.
+- **Zova** provides the frontend framework and application capabilities.
+- Root scripts, shared terminology, and CLI-first workflows keep the layers aligned within each edition repository.
+
+Cabloy Basic and Cabloy Start are related, complete edition baselines built on this shared architecture, not alternatives to the Vona and Zova layers. They intentionally compose UI, flavors, modules, SSR sites, and project assets differently. See [Editions Overview](/editions/overview) for the complete relationship and edition differences.
 
 This combination keeps backend and frontend development close enough for code sharing, workflow reuse, and AI vibe coding workflows.
 

package/repo-docs/fullstack/openapi-to-sdk.md

@@ -204,7 +204,7 @@ If the endpoint still belongs to an existing business resource, prefer keeping `
 
 ## Cabloy Start workflow
 
-In the sibling private Start repo, the same collaboration idea applies, but the frontend flavor names differ.
+In the sibling public Start repository, the same collaboration idea applies, but the frontend flavor names differ.
 
 Representative Start-specific flavors include:
 

package/repo-docs/fullstack/quickstart.md

@@ -73,9 +73,9 @@ npm run dev:zova:web   # http://localhost:9000/
 
 ### Cabloy Start
 
-Cabloy Start is the private commercial edition. Instead of `npm create cabloy`, purchase access to the licensed private repository, clone that source directly, and run `npm run init`. Then use the frontend commands provided by that edition. Do not assume the Cabloy Basic flavor names apply to Cabloy Start.
+Cabloy Start is the public MIT-licensed edition maintained in its own repository. Instead of `npm create cabloy`, clone its public repository directly and run `npm run init`. Then use the frontend commands provided by that edition. Do not assume the Cabloy Basic flavor names apply to Cabloy Start.
 
-For the full Start onboarding details, including the access and initialization flow, read [Cabloy Start](/editions/cabloy-start).
+For the full Start onboarding and initialization flow, read [Cabloy Start](/editions/cabloy-start).
 
 If you are not sure which edition you are using or which one to choose, read:
 
@@ -123,7 +123,7 @@ Keep additional project-owned browser specs under other filenames in `repo-e2e/s
 
 ### Cabloy Start repository baseline
 
-Cabloy Start is checked out from the licensed private repository rather than created through `npm create cabloy`. Its E2E baseline is maintained in that repository:
+Cabloy Start is cloned from its separate public repository rather than created through `npm create cabloy`. Its E2E baseline is maintained in that repository:
 
 ```text
 repo-e2e/config/
@@ -131,7 +131,7 @@ repo-e2e/scripts/
 repo-e2e/specs/
 ```
 
-The public Cabloy upgrade flow does not synchronize or repair those private Start E2E files, its root E2E scripts, or `@playwright/test`. Keep project-owned browser scenarios in the flat `repo-e2e/specs/` directory under distinct filenames, for example `repo-e2e/specs/my-project.spec.ts`.
+The public Cabloy upgrade flow does not synchronize or repair those Start-owned E2E files, its root E2E scripts, or `@playwright/test`. Keep project-owned browser scenarios in the flat `repo-e2e/specs/` directory under distinct filenames, for example `repo-e2e/specs/my-project.spec.ts`.
 
 Prepare and run the managed Start baseline locally with:
 

package/repo-docs/fullstack/vona-zova-integration.md

@@ -51,7 +51,7 @@ cd zova && npm run build:rest:cabloyBasicWeb
 
 ## Cabloy Start
 
-Cabloy Start is the private commercial edition. It lives in a licensed sibling repository rather than a subdirectory here, but the same integration idea applies.
+Cabloy Start is the public MIT-licensed edition. It lives in a separate sibling repository rather than a subdirectory here, but the same integration idea applies.
 
 Its root script surface uses Start-specific flavors such as:
 

package/repo-docs/index.md

@@ -35,7 +35,7 @@ features:
 
 Cabloy is a Node.js fullstack framework for AI vibe coding. It brings backend and frontend work into one system, with bidirectional type sync, CLI-first workflows, and source-grounded docs and skills for people and AI agents.
 
-Start with the [Contract Loop Playbook](/fullstack/contract-loop-playbook) to understand bidirectional type sync, then use the [Fullstack CLI](/fullstack/cli) and [AI Development](/ai/introduction) guides to follow the current repository. Vona, Zova, and suite-based modules provide the aligned architecture behind that workflow, while Cabloy Basic and Cabloy Start share the same fullstack core but diverge by edition.
+Start with the [Contract Loop Playbook](/fullstack/contract-loop-playbook) to understand bidirectional type sync, then use the [Fullstack CLI](/fullstack/cli) and [AI Development](/ai/introduction) guides to follow the current repository. Cabloy coordinates Vona and Zova as its backend and frontend layers, while Cabloy Basic and Cabloy Start are related, complete edition baselines built on that shared architecture. See [Editions Overview](/editions/overview) for the relationship and deliberate edition differences.
 
 ## What you can do here
 

package/repo-docs/reference/glossary.md

@@ -2,23 +2,25 @@
 
 ## Cabloy
 
-The fullstack framework and monorepo direction that combines backend and frontend workflows.
+The coordinated Node.js fullstack system that combines backend and frontend workflows.
 
 ## Vona
 
-The backend framework in the Cabloy ecosystem.
+Cabloy's backend framework and runtime layer.
 
 ## Zova
 
-The frontend framework in the Cabloy ecosystem.
+Cabloy's frontend framework and application layer.
 
 ## Cabloy Basic
 
-The public framework/reference edition for the shared Cabloy architecture.
+The public reference and community edition baseline for the shared Cabloy architecture, created with `npm create cabloy`.
 
 ## Cabloy Start
 
-The private commercial edition, provided as a licensed sibling repository with different UI, module, and project-baseline choices.
+The public MIT-licensed business-system edition baseline for the shared Cabloy architecture, maintained in a sibling repository and initialized with `npm run init` after cloning.
+
+Vona and Zova describe architectural layers; Cabloy Basic and Cabloy Start describe complete edition baselines built with those layers.
 
 ## Edition detection
 
@@ -35,4 +37,5 @@ Use the glossary together with:
 - [Fullstack Introduction](/fullstack/introduction)
 - [Backend (Vona)](/backend/introduction)
 - [Frontend (Zova)](/frontend/introduction)
+- [Editions Overview](/editions/overview)
 - [Package Map](/reference/package-map)

package/repo-docs/reference/introduction.md

@@ -42,6 +42,6 @@ Use this path when you need to find where packages, backend directories, fronten
 
 ## Edition impact
 
-Cabloy Start keeps the same high-level workflow pattern while using different frontend flavors such as `cabloyStartAdmin` and `cabloyStartWeb`, plus its own SSR site baselines and project assets in the licensed private repository.
+Cabloy Start keeps the same high-level workflow pattern while using different frontend flavors such as `cabloyStartAdmin` and `cabloyStartWeb`, plus its own SSR site baselines and project assets in its separate public repository.
 
 When documenting or automating flavor-specific commands, always confirm the active repo first.

package/repo-docs/reference/repo-scripts.md

@@ -4,7 +4,15 @@ Use this page as the compact lookup surface for root scripts in Cabloy Basic and
 
 For the broader Reference landing page, see [Reference Introduction](/reference/introduction).
 
-Always start with the active repository's root `package.json`. Cabloy Basic is the public generated-project baseline; Cabloy Start is the licensed private repository and has its own root command surface.
+Always start with the active repository's root `package.json`. Cabloy Basic is the public generated-project baseline; Cabloy Start is the public MIT-licensed edition in its own repository and has its own root command surface.
+
+## Generated workspace manifests
+
+The tracked root `package.json` is the primary command surface. The tracked `vona/package.original.json` and `zova/package.original.json` files are durable bootstrap manifest inputs. Their sibling `vona/package.json` and `zova/package.json` files are ignored generated working dependency closures, not durable edit targets.
+
+Root `npm run init` runs `scripts/init.ts`, which restores each generated workspace manifest from its `package.original.json` input before running dependency generation. During Vona initialization, it also seeds generated `.zova-rest` workspace dependencies before the first install and dependency-tool run. Direct edits to either ignored workspace manifest are overwritten by the next root initialization.
+
+Run root `npm run init` deliberately after a fresh clone, recovery of generated workspace state, or a framework upgrade. Do not treat it as an automatic follow-up for narrow changes.
 
 ## Cabloy Basic entrypoints
 
@@ -112,9 +120,9 @@ repo-e2e/specs/a-commerce.spec.ts
 
 It also reconciles the two framework E2E scripts and the `@playwright/test` development dependency. Keep additional project browser specs under other filenames in `repo-e2e/specs`; the upgrader updates only the listed framework files. The current fresh baseline is required and is not repaired for unsupported legacy project layouts.
 
-### Cabloy Start private repository
+### Cabloy Start repository
 
-The Start E2E baseline is maintained in the private repository:
+The Start E2E baseline is maintained in the separate Start repository:
 
 ```text
 repo-e2e/config/
@@ -122,7 +130,7 @@ repo-e2e/scripts/
 repo-e2e/specs/
 ```
 
-The public-package upgrade flow does not source or reconcile the private Start baseline, its root E2E scripts, or `@playwright/test`. Keep project browser tests in the flat `repo-e2e/specs/` directory under distinct filenames, for example `repo-e2e/specs/my-project.spec.ts`.
+The public-package upgrade flow does not source or reconcile the Start-owned baseline, its root E2E scripts, or `@playwright/test`. Keep project browser tests in the flat `repo-e2e/specs/` directory under distinct filenames, for example `repo-e2e/specs/my-project.spec.ts`.
 
 ## SSR browser checks
 

package/test-results/.last-run.json

@@ -1,6 +1,4 @@
 {
-  "status": "failed",
-  "failedTests": [
-    "0d2518050eca8cd1231a-03158dd238416d7c8c3e"
-  ]
+  "status": "passed",
+  "failedTests": []
 }

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.89",
+  "version": "5.1.90",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/packages-vona/vona-shared/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-shared",
-  "version": "1.1.7",
+  "version": "1.1.8",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [
@@ -8,15 +8,15 @@
     "vona",
     "vue3"
   ],
-  "homepage": "https://github.com/cabloy/vona#readme",
+  "homepage": "https://github.com/vonajs/vona#readme",
   "bugs": {
-    "url": "https://github.com/cabloy/vona/issues"
+    "url": "https://github.com/vonajs/vona/issues"
   },
   "license": "MIT",
   "author": "zhennann",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/cabloy/vona.git"
+    "url": "git+https://github.com/vonajs/vona.git"
   },
   "files": [
     "dist"

package/vona/pnpm-lock.yaml

@@ -615,8 +615,8 @@ importers:
         specifier: ^5.0.5
         version: 5.0.5
       zova-module-rest-resource:
-        specifier: ^5.1.47
-        version: 5.1.47
+        specifier: ^5.1.48
+        version: 5.1.49
 
   .zova-rest/cabloy-basic-web:
     dependencies:
@@ -1610,7 +1610,7 @@ importers:
         specifier: ^5.0.3
         version: link:modules/a-markdown
       vona-module-a-rbac:
-        specifier: ^5.0.1
+        specifier: ^5.0.2
         version: link:modules/a-rbac
       vona-module-a-socket:
         specifier: workspace:^
@@ -9052,6 +9052,9 @@ packages:
   zova-module-rest-resource@5.1.47:
     resolution: {integrity: sha512-/LBZxfD/ULG+sQVuGnC+aqRe32O4qJesaKZF5IHNCuhuRwLzqvUIpijoyA890R7Ah5kHGxcnqaScW8DYkmf+RA==}
 
+  zova-module-rest-resource@5.1.49:
+    resolution: {integrity: sha512-tLf3BLov4GnV1QPivvLro6T2sNdriDZ8vZMsghuUN7dl+PRCG2pI0q9hBCrqe2faRSIcVUXowwnEbEynmaM7Zg==}
+
   zova-suite-a-zova@5.1.152:
     resolution: {integrity: sha512-P/dcMb2fcMpnmDMlrgvpddWUbupnvohD1Jp60VYWoqI0JcWMlYTJvWQWrwszDqiMvMiOTH5mmQBTws0KzbsXpA==}
 
@@ -15541,6 +15544,8 @@ snapshots:
 
   zova-module-rest-resource@5.1.47: {}
 
+  zova-module-rest-resource@5.1.49: {}
+
   zova-suite-a-zova@5.1.152(typescript@5.9.3)(vue@3.5.39(typescript@5.9.3)):
     dependencies:
       zova-module-a-api: 5.1.22

package/vona/src/suite/a-home/modules/home-user/src/bean/meta.redlock.ts

@@ -8,7 +8,8 @@ export type TypeRedlockLockResource =
   | `homeUser.account.passwordSetCandidate.${string}`
   | `homeUser.account.passwordResetConsume.${string}`
   | `homeUser.account.activationMutation.${string}`
-  | `homeUser.account.activationConsume.${string}`;
+  | `homeUser.account.activationConsume.${string}`
+  | `homeUser.roleMembership.${string}`;
 export type TypeRedlockLockIsolateResource = never;
 
 @Meta()

package/vona/src/suite/a-home/modules/home-user/src/service/roleAdapter.ts

@@ -1,8 +1,9 @@
 import type { TableIdentity } from 'table-identity';
-import type { IRole, IRoleAdapter } from 'vona-module-a-user';
+import type { IRole, IRoleAdapter, IRoleMembershipReplaceResult } from 'vona-module-a-user';
 
 import { BeanBase } from 'vona';
 import { Service } from 'vona-module-a-bean';
+import { Core } from 'vona-module-a-core';
 
 @Service()
 export class ServiceRoleAdapter extends BeanBase implements IRoleAdapter {
@@ -19,11 +20,119 @@ export class ServiceRoleAdapter extends BeanBase implements IRoleAdapter {
     return user?.roles;
   }
 
-  async addUserId(id: TableIdentity, userId: TableIdentity): Promise<TableIdentity> {
-    let roleUser = await this.scope.model.roleUser.get({ userId, roleId: id });
-    if (!roleUser) {
-      roleUser = await this.scope.model.roleUser.insert({ userId, roleId: id });
+  async addUserId(id: TableIdentity, userId: TableIdentity): Promise<boolean> {
+    return await this.withUserMembershipLock(
+      userId,
+      async () => await this.addUserIdInTransaction(id, userId),
+    );
+  }
+
+  async removeUserId(id: TableIdentity, userId: TableIdentity): Promise<boolean> {
+    return await this.withUserMembershipLock(
+      userId,
+      async () => await this.removeUserIdInTransaction(id, userId),
+    );
+  }
+
+  async replaceUserRoleIds(
+    userId: TableIdentity,
+    roleIds: TableIdentity[],
+    options?: { preserveRoleIds?: TableIdentity[] },
+  ): Promise<IRoleMembershipReplaceResult> {
+    const requestedRoleIds = this.uniqueIds(roleIds);
+    const preserveRoleIds = this.uniqueIds(options?.preserveRoleIds ?? []);
+    return await this.withUserMembershipLock(
+      userId,
+      async () =>
+        await this.replaceUserRoleIdsInTransaction(userId, requestedRoleIds, preserveRoleIds),
+    );
+  }
+
+  @Core.transaction()
+  private async addUserIdInTransaction(id: TableIdentity, userId: TableIdentity): Promise<boolean> {
+    const existing = await this.scope.model.roleUser.get({ userId, roleId: id });
+    if (existing) return false;
+    await this.scope.model.roleUser.insert({ userId, roleId: id });
+    return true;
+  }
+
+  @Core.transaction()
+  private async removeUserIdInTransaction(
+    id: TableIdentity,
+    userId: TableIdentity,
+  ): Promise<boolean> {
+    const memberships = await this.scope.model.roleUser.select({ where: { userId, roleId: id } });
+    if (!memberships.length) return false;
+    await this.scope.model.roleUser.deleteBulk(memberships.map(item => item.id));
+    return true;
+  }
+
+  @Core.transaction()
+  private async replaceUserRoleIdsInTransaction(
+    userId: TableIdentity,
+    requestedRoleIds: TableIdentity[],
+    preserveRoleIds: TableIdentity[],
+  ): Promise<IRoleMembershipReplaceResult> {
+    const memberships = await this.scope.model.roleUser.select({ where: { userId } });
+    const membershipsByRoleId = new Map<string, (typeof memberships)[number]>();
+    const duplicateMembershipIds: TableIdentity[] = [];
+    for (const membership of memberships) {
+      const key = String(membership.roleId);
+      if (membershipsByRoleId.has(key)) {
+        duplicateMembershipIds.push(membership.id);
+      } else {
+        membershipsByRoleId.set(key, membership);
+      }
+    }
+
+    const requestedRoleIdsByKey = this.idsByKey(requestedRoleIds);
+    const preserveRoleIdsByKey = this.idsByKey(preserveRoleIds);
+    const desiredRoleIdsByKey = new Map(requestedRoleIdsByKey);
+    for (const [key, roleId] of preserveRoleIdsByKey) {
+      if (membershipsByRoleId.has(key)) desiredRoleIdsByKey.set(key, roleId);
     }
-    return roleUser.id;
+
+    const removedRoleIds: TableIdentity[] = [];
+    const obsoleteMembershipIds = [...duplicateMembershipIds];
+    for (const [key, membership] of membershipsByRoleId) {
+      if (!desiredRoleIdsByKey.has(key)) {
+        obsoleteMembershipIds.push(membership.id);
+        removedRoleIds.push(membership.roleId);
+      }
+    }
+    if (obsoleteMembershipIds.length) {
+      await this.scope.model.roleUser.deleteBulk(obsoleteMembershipIds);
+    }
+
+    const addedRoleIds: TableIdentity[] = [];
+    for (const [key, roleId] of requestedRoleIdsByKey) {
+      if (!membershipsByRoleId.has(key)) {
+        await this.scope.model.roleUser.insert({ userId, roleId });
+        addedRoleIds.push(roleId);
+      }
+    }
+    return { addedRoleIds, removedRoleIds };
+  }
+
+  private async withUserMembershipLock<RESULT>(
+    userId: TableIdentity,
+    operation: () => Promise<RESULT>,
+  ): Promise<RESULT> {
+    return await this.scope.redlock.lock(
+      `homeUser.roleMembership.${encodeURIComponent(String(userId))}`,
+      operation,
+    );
+  }
+
+  private uniqueIds(ids: TableIdentity[]): TableIdentity[] {
+    return [...this.idsByKey(ids).entries()]
+      .toSorted(([left], [right]) => left.localeCompare(right))
+      .map(([, id]) => id);
+  }
+
+  private idsByKey(ids: TableIdentity[]): Map<string, TableIdentity> {
+    const values = new Map<string, TableIdentity>();
+    for (const id of ids) values.set(String(id), id);
+    return values;
   }
 }

package/vona/src/suite/a-home/modules/home-user/test/role.test.ts

@@ -1,8 +1,8 @@
 import assert from 'node:assert';
-import { describe, it } from 'node:test';
+import { describe, it, mock } from 'node:test';
 import { app } from 'vona-mock';
 
-describe('role.test.ts', () => {
+describe('role.test.ts', { concurrency: false }, () => {
   it('action:roleSeedAndPassport', async () => {
     await app.bean.executor.mockCtx(async () => {
       const scope = app.scope('home-user');
@@ -41,4 +41,165 @@ describe('role.test.ts', () => {
       assert.equal(passportSystemAdmin?.builtin, true);
     });
   });
+
+  it('bean:role emits only actual membership changes', async () => {
+    let userId: string | undefined;
+    let roleId: string | undefined;
+    const events: unknown[] = [];
+    const event = app.scope('a-user').event.roleMembershipChanged;
+    const originalEmit = event.emit.bind(event);
+    const emitMock = mock.method(event, 'emit', async data => {
+      events.push(data);
+      return await originalEmit(data);
+    });
+    try {
+      await app.bean.executor.mockCtx(async () => {
+        const role = await app.scope('home-user').model.role.insert({
+          name: `home-user-role-${crypto.randomUUID()}`,
+          title: 'Home User Role',
+          siteIds: ['admin'],
+          builtin: false,
+        });
+        roleId = String(role.id);
+        const user = await app.bean.user.register({
+          name: `home-user-role-member-${crypto.randomUUID()}`,
+        });
+        userId = String(user.id);
+
+        assert.equal(await app.bean.role.addUserId(role.id, user.id), true);
+        assert.equal(await app.bean.role.addUserId(role.id, user.id), false);
+
+        const memberships = await app.scope('home-user').model.roleUser.select({
+          where: { userId: user.id, roleId: role.id },
+        });
+        assert.equal(memberships.length, 1);
+        assert.deepEqual(events, [{ userIds: [user.id], roleIds: [role.id] }]);
+
+        assert.equal(await app.bean.role.removeUserId(role.id, user.id), true);
+        assert.equal(await app.bean.role.removeUserId(role.id, user.id), false);
+        assert.deepEqual(events, [
+          { userIds: [user.id], roleIds: [role.id] },
+          { userIds: [user.id], roleIds: [role.id] },
+        ]);
+      });
+    } finally {
+      try {
+        await app.bean.executor.mockCtx(async () => {
+          const homeUser = app.scope('home-user');
+          if (userId) {
+            await homeUser.model.roleUser.delete({ userId });
+            await app.bean.user.removeById(userId);
+          }
+          if (roleId) await homeUser.model.role.deleteById(roleId);
+        });
+      } finally {
+        emitMock.mock.restore();
+      }
+    }
+  });
+
+  it('bean:role rolls back membership and policy invalidation together', async () => {
+    let userId: string | undefined;
+    let roleId: string | undefined;
+    try {
+      await app.bean.executor.mockCtx(async () => {
+        const homeUser = app.scope('home-user');
+        const role = await homeUser.model.role.insert({
+          name: `home-user-rollback-${crypto.randomUUID()}`,
+          title: 'Home User Rollback Role',
+          siteIds: ['admin'],
+          builtin: false,
+        });
+        roleId = String(role.id);
+        const user = await app.bean.user.register({
+          name: `home-user-role-rollback-${crypto.randomUUID()}`,
+        });
+        userId = String(user.id);
+
+        await assert.rejects(async () => {
+          await app.bean.database.current.transaction.begin(async () => {
+            await app.bean.role.addUserId(role.id, user.id);
+            throw new Error('rollback role membership');
+          });
+        }, /rollback role membership/);
+
+        assert.equal(
+          await homeUser.model.roleUser.get({ userId: user.id, roleId: role.id }),
+          undefined,
+        );
+      });
+    } finally {
+      await app.bean.executor.mockCtx(async () => {
+        const homeUser = app.scope('home-user');
+        if (userId) {
+          await homeUser.model.roleUser.delete({ userId });
+          await app.bean.user.removeById(userId);
+        }
+        if (roleId) await homeUser.model.role.deleteById(roleId);
+      });
+    }
+  });
+
+  it('bean:role replaces a membership set with one change event', async () => {
+    let userId: string | undefined;
+    const roleIds: string[] = [];
+    const events: unknown[] = [];
+    const event = app.scope('a-user').event.roleMembershipChanged;
+    const originalEmit = event.emit.bind(event);
+    const emitMock = mock.method(event, 'emit', async data => {
+      events.push(data);
+      return await originalEmit(data);
+    });
+    try {
+      await app.bean.executor.mockCtx(async () => {
+        const homeUser = app.scope('home-user');
+        const roles = await Promise.all(
+          ['a', 'b', 'c'].map(async suffix => {
+            const role = await homeUser.model.role.insert({
+              name: `home-user-replace-${suffix}-${crypto.randomUUID()}`,
+              title: `Home User Role ${suffix}`,
+              siteIds: ['admin'],
+              builtin: false,
+            });
+            roleIds.push(String(role.id));
+            return role;
+          }),
+        );
+        const user = await app.bean.user.register({
+          name: `home-user-role-replace-${crypto.randomUUID()}`,
+        });
+        userId = String(user.id);
+        await app.bean.role.addUserId(roles[0].id, user.id);
+        await app.bean.role.addUserId(roles[1].id, user.id);
+        events.length = 0;
+
+        const result = await app.bean.role.replaceUserRoleIds(user.id, [roles[1].id, roles[2].id]);
+        assert.deepEqual(result, { addedRoleIds: [roles[2].id], removedRoleIds: [roles[0].id] });
+        assert.deepEqual(events, [{ userIds: [user.id], roleIds: [roles[0].id, roles[2].id] }]);
+
+        const memberships = await homeUser.model.roleUser.select({ where: { userId: user.id } });
+        assert.deepEqual(
+          memberships.map(item => String(item.roleId)).toSorted(),
+          [String(roles[1].id), String(roles[2].id)].toSorted(),
+        );
+        await app.bean.role.replaceUserRoleIds(user.id, [roles[1].id, roles[2].id]);
+        assert.equal(events.length, 1);
+      });
+    } finally {
+      try {
+        await app.bean.executor.mockCtx(async () => {
+          const homeUser = app.scope('home-user');
+          if (userId) {
+            await homeUser.model.roleUser.delete({ userId });
+            await app.bean.user.removeById(userId);
+          }
+          for (const roleId of roleIds.reverse()) {
+            await homeUser.model.role.deleteById(roleId);
+          }
+        });
+      } finally {
+        emitMock.mock.restore();
+      }
+    }
+  });
 });

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-rbac",
-  "version": "5.0.2",
+  "version": "5.0.3",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/.metadata/index.ts

@@ -109,6 +109,32 @@ declare module 'vona-module-a-event' {
   }
 }
 /** event: end */
+/** eventListener: begin */
+export * from '../bean/eventListener.roleMembershipChanged.ts';
+
+import { type IDecoratorEventListenerOptions } from 'vona-module-a-event';
+declare module 'vona-module-a-event' {
+
+    export interface IEventListenerRecord {
+      'a-rbac:roleMembershipChanged': IDecoratorEventListenerOptions;
+    }
+
+
+}
+declare module 'vona-module-a-rbac' {
+
+        export interface EventListenerRoleMembershipChanged {
+          /** @internal */
+          get scope(): ScopeModuleARbac;
+        }
+
+          export interface EventListenerRoleMembershipChanged {
+            get $beanFullName(): 'a-rbac.eventListener.roleMembershipChanged';
+            get $onionName(): 'a-rbac:roleMembershipChanged';
+            get $onionOptions(): IDecoratorEventListenerOptions;
+          }
+}
+/** eventListener: end */
 /** config: begin */
 export * from '../config/config.ts';
 import type { config } from '../config/config.ts';

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/bean/eventListener.roleMembershipChanged.ts

@@ -0,0 +1,25 @@
+import type { IEventExecute, NextEvent } from 'vona-module-a-event';
+import type {
+  TypeEventRoleMembershipChangedData,
+  TypeEventRoleMembershipChangedResult,
+} from 'vona-module-a-user';
+
+import { BeanBase } from 'vona';
+import { EventListener } from 'vona-module-a-event';
+
+type TypeEventData = TypeEventRoleMembershipChangedData;
+type TypeEventResult = TypeEventRoleMembershipChangedResult;
+
+@EventListener({ match: 'a-user:roleMembershipChanged' })
+export class EventListenerRoleMembershipChanged
+  extends BeanBase
+  implements IEventExecute<TypeEventData, TypeEventResult>
+{
+  async execute(
+    data: TypeEventData,
+    next: NextEvent<TypeEventData, TypeEventResult>,
+  ): Promise<TypeEventResult> {
+    await this.scope.event.policyInvalidated.emit({ kind: 'role' });
+    return await next(data);
+  }
+}