cabloy 5.1.187 → 5.1.189

package/.cabloy-version

@@ -1 +1 @@
-5.1.187
+5.1.189

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 5.1.189
+
+### Features
+
+- Add anonymous context creation support.
+- Add home user functionality.
+- Add application host utility access through the context.
+- Add authentication enhancements.
+- Update core feature behavior.
+
+## 5.1.188
+
+### Bug Fixes
+
+- Enforce database name length limits.
+- Correct markdown task list item rendering.
+
+### Improvements
+
+- Refactor the layout implementation.
+- Update SSR CSS collection handling.
+
 ## 5.1.187
 
 ### Improvements

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.187",
+  "version": "5.1.189",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/repo-docs/backend/runtime-and-flavors.md

@@ -133,7 +133,7 @@ Use this page as the runtime-facing overview, then inspect the current app confi
 
 When configured, `SERVER_SERVE_PROTOCOL` and `SERVER_SERVE_HOST` define Vona's canonical public origin for backend APIs and backend-hosted SSR sites. If either serve value is not configured, Vona resolves the effective protocol and host from the current proxy-aware request context; background work that needs a stable backend public origin should configure both serve values explicitly.
 
-A browser consumer can be deployed on a different origin and pathname. Account password-set and password-reset delivery therefore does not derive its destination from `SERVER_SERVE_*`, SSR Site metadata, `publicPath`, `siteId`, `Referer`, or browser-selected mount data: Zova supplies the complete token-free absolute public page URL, and Vona validates only HTTP(S), absence of userinfo/query/fragment, and an exact trusted origin. `checkOriginExact` permits the exact current origin when protocol, host, and effective port all match; request or proxy Host values are not a general cross-origin allowlist and cannot authorize lookalike, suffix, alternate-scheme, or alternate-port destinations. Other production consumer origins must exactly match an explicit `a-security:cors` `whiteList` entry. In `dev/test`, exact credential-link authorization additionally accepts different ports only when both API and consumer hostnames are loopback (`localhost`, `127.0.0.1`, or `::1`). Vona preserves the frontend pathname and alone adds the raw token as the `token` URL query parameter. Query transport reaches the initial request; Referrer-Policy and Vona, edge, or APM query-log redaction are intentionally outside this flow's current scope. Normal CORS defaults to an empty `whiteList`; configure `CORS_WHITE_LIST` with the permitted browser origins, or explicitly configure `a-security:cors`. In `dev/test`, loopback requests may cross ports; elsewhere, cross-origin CORS requires an allowed entry. Normal CORS wildcard and suffix matching remain available when configured but are not credential-link authorization.
+A browser consumer can be deployed on a different origin and pathname. Account password-set and password-reset delivery does not derive its destination from SSR Site metadata, `publicPath`, `siteId`, `Referer`, or browser-selected mount data: Zova supplies the complete token-free absolute public page URL, and Vona validates only HTTP(S), absence of userinfo/query/fragment, and an exact trusted origin. Production origin checks supply `app.util.host` as their same-host authority: when configured, `SERVER_SERVE_HOST` is the canonical host; otherwise Vona falls back to the current proxy-aware request host. `checkOriginExact` permits an origin whose protocol, canonical/fallback host, and effective port match; request or proxy Host values are not a general cross-origin allowlist and cannot authorize lookalike, suffix, alternate-scheme, or alternate-port destinations when a canonical host is configured. Other production consumer origins must exactly match an explicit `a-security:cors` `whiteList` entry. This change supplies the canonical host only; `checkOriginExact` continues to obtain the protocol from the active request context. In `dev/test`, exact credential-link authorization additionally accepts different ports only when both API and consumer hostnames are loopback (`localhost`, `127.0.0.1`, or `::1`). Vona preserves the frontend pathname and alone adds the raw token as the `token` URL query parameter. Query transport reaches the initial request; Referrer-Policy and Vona, edge, or APM query-log redaction are intentionally outside this flow's current scope. Normal CORS defaults to an empty `whiteList`; configure `CORS_WHITE_LIST` with the permitted browser origins, or explicitly configure `a-security:cors`. In `dev/test`, loopback requests may cross ports; elsewhere, cross-origin CORS requires an allowed entry. Normal CORS wildcard and suffix matching remain available when configured but are not credential-link authorization.
 
 ## Configure browser CORS origins
 

package/repo-e2e/specs/markdown.spec.ts

@@ -1,4 +1,4 @@
-import type { Page } from '@playwright/test';
+import type { Locator, Page } from '@playwright/test';
 
 import { expect, test } from '@playwright/test';
 
@@ -35,6 +35,49 @@ function expectTableIdentity(value: unknown) {
   expect(['string', 'number']).toContain(typeof value);
 }
 
+async function expectTaskCheckboxLayout(root: Locator) {
+  const layout = await root.locator('ul[data-type="taskList"] li').evaluateAll(taskItems =>
+    taskItems.map(taskItem => {
+      const checkbox = taskItem.querySelector<HTMLInputElement>('label > input[type="checkbox"]');
+      const label = taskItem.querySelector<HTMLElement>('label');
+      const text = taskItem.querySelector<HTMLElement>('div > p');
+      if (!checkbox || !label || !text) return null;
+
+      const checkboxRect = checkbox.getBoundingClientRect();
+      const textRect = text.getBoundingClientRect();
+      const checkboxStyle = getComputedStyle(checkbox);
+      const labelStyle = getComputedStyle(label);
+      const itemStyle = getComputedStyle(taskItem);
+      return {
+        checkboxHeight: checkboxRect.height,
+        checkboxWidth: checkboxRect.width,
+        checkboxCenter: checkboxRect.top + checkboxRect.height / 2,
+        checkboxMarginBlockEnd: checkboxStyle.marginBlockEnd,
+        checkboxMarginBlockStart: checkboxStyle.marginBlockStart,
+        checkboxMarginInlineEnd: checkboxStyle.marginInlineEnd,
+        checkboxMarginInlineStart: checkboxStyle.marginInlineStart,
+        itemDisplay: itemStyle.display,
+        labelDisplay: labelStyle.display,
+        textCenter: textRect.top + Number.parseFloat(getComputedStyle(text).lineHeight) / 2,
+      };
+    }),
+  );
+
+  expect(layout).toHaveLength(2);
+  for (const task of layout) {
+    expect(task).not.toBeNull();
+    expect(task?.itemDisplay).toBe('flex');
+    expect(task?.labelDisplay).toBe('flex');
+    expect(task?.checkboxWidth).toBeGreaterThan(0);
+    expect(task?.checkboxHeight).toBe(task?.checkboxWidth);
+    expect(task?.checkboxMarginBlockStart).toBe('0px');
+    expect(task?.checkboxMarginBlockEnd).toBe('0px');
+    expect(task?.checkboxMarginInlineStart).toBe('0px');
+    expect(task?.checkboxMarginInlineEnd).toBe('0px');
+    expect(Math.abs((task?.checkboxCenter ?? 0) - (task?.textCenter ?? 0))).toBeLessThanOrEqual(2);
+  }
+}
+
 async function login(
   page: Page,
   path: string,
@@ -181,6 +224,7 @@ test(
       await expect(description.locator('input[type="checkbox"]').nth(0)).toBeDisabled();
       await expect(description.locator('input[type="checkbox"]').nth(1)).toBeChecked();
       await expect(description.locator('input[type="checkbox"]').nth(1)).toBeDisabled();
+      await expectTaskCheckboxLayout(description);
       expect(webPageErrors).toEqual([]);
       expect(webConsoleErrors).toEqual([]);
     } finally {
@@ -353,6 +397,7 @@ const product = '${suffix}';
       await expect(editor.locator('input[type="checkbox"]')).toHaveCount(2);
       await expect(editor.locator('input[type="checkbox"]').nth(0)).not.toBeChecked();
       await expect(editor.locator('input[type="checkbox"]').nth(1)).toBeChecked();
+      await expectTaskCheckboxLayout(editor);
       await expect(editor.locator('blockquote')).toHaveCSS('border-left-width', '4px');
       await expect(editor.locator('pre')).toHaveCSS('overflow-x', 'auto');
       await expect(editor.locator('table th').first()).toHaveCSS('font-weight', '600');

package/vona/docker-compose-original/config/nginx/conf.d/nginx.conf

@@ -12,9 +12,9 @@ server {
     proxy_http_version 1.1;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Host $http_host;
+    proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header Host $http_host;
+    proxy_set_header Host $host;
     proxy_set_header X-NginX-Proxy true;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "upgrade";

package/vona/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli",
-  "version": "1.1.154",
+  "version": "1.1.155",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli",
   "keywords": [

package/vona/packages-cli/cli-set-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli-set-api",
-  "version": "1.1.152",
+  "version": "1.1.153",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli-set-api",
   "keywords": [

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.98",
+  "version": "5.1.100",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/packages-vona/vona-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-core",
-  "version": "5.1.40",
+  "version": "5.1.41",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona",
   "keywords": [

package/vona/packages-vona/vona-core/src/lib/core/application.ts

@@ -72,22 +72,29 @@ export class VonaApplication extends KoaApplication {
     if (req) {
       request = req;
     } else {
-      const host = `localhost:${this.meta.env.SERVER_LISTEN_PORT}`;
+      const port = this.config?.server.listen.port ?? this.meta.env.SERVER_LISTEN_PORT;
+      const hostFallback = port ? `localhost:${port}` : 'localhost';
+      const protocol = (this.config ? this.util.protocol : undefined) || 'http';
+      const host = (this.config ? this.util.host : undefined) || hostFallback;
+      const hostname = new URL(`${protocol}://${host}`).hostname;
       request = {
         headers: {
           'host': host,
-          'x-forwarded-for': host,
+          'x-forwarded-for': '127.0.0.1',
+          'x-forwarded-host': host,
+          'x-forwarded-proto': protocol,
         },
         query: {},
         querystring: '',
         host,
-        hostname: 'localhost',
-        protocol: 'http',
-        secure: 'false',
+        hostname,
+        protocol,
+        secure: protocol === 'https',
         method: 'POST',
         url: '',
         path: '',
         socket: {
+          encrypted: protocol === 'https',
           remoteAddress: '127.0.0.1',
           remotePort: 7001,
         },

package/vona/packages-vona/vona-core/src/lib/core/context.ts

@@ -127,7 +127,7 @@ export const contextBase: ContextBase = {
       typeof statusOrOptions === 'number' ? { status: statusOrOptions } : (statusOrOptions ?? {});
     // checkOrigin
     if (!url.startsWith('/') && !options.trustedExternal) {
-      const origin = cast(self.app.bean).security.checkOrigin(url, self.host);
+      const origin = cast(self.app.bean).security.checkOrigin(url, self.app.util.host);
       if (!origin) self.app.throw(403);
     }
     // throw

package/vona/packages-vona/vona-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-mock",
-  "version": "6.1.40",
+  "version": "6.1.41",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona mock",
   "keywords": [

package/vona/pnpm-lock.yaml

@@ -741,11 +741,11 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.164
-        version: 5.1.165(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.166
+        version: 5.1.166(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
       zova-jsx:
-        specifier: ^1.1.90
-        version: 1.1.91(typescript@5.9.3)
+        specifier: ^1.1.92
+        version: 1.1.92(typescript@5.9.3)
       zova-module-a-api:
         specifier: ^5.1.22
         version: 5.1.22
@@ -777,11 +777,11 @@ importers:
         specifier: ^5.1.54
         version: 5.1.54
       zova-module-a-pay:
-        specifier: ^5.0.8
+        specifier: ^5.0.9
         version: 5.0.9
       zova-module-a-router:
-        specifier: ^5.1.39
-        version: 5.1.40
+        specifier: ^5.1.41
+        version: 5.1.41
       zova-module-a-routertabs:
         specifier: ^5.1.34
         version: 5.1.34
@@ -825,11 +825,11 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.164
-        version: 5.1.165(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.166
+        version: 5.1.166(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
       zova-jsx:
-        specifier: ^1.1.90
-        version: 1.1.91(typescript@5.9.3)
+        specifier: ^1.1.92
+        version: 1.1.92(typescript@5.9.3)
       zova-module-a-api:
         specifier: ^5.1.22
         version: 5.1.22
@@ -861,11 +861,11 @@ importers:
         specifier: ^5.1.54
         version: 5.1.54
       zova-module-a-pay:
-        specifier: ^5.0.8
+        specifier: ^5.0.9
         version: 5.0.9
       zova-module-a-router:
-        specifier: ^5.1.39
-        version: 5.1.40
+        specifier: ^5.1.41
+        version: 5.1.41
       zova-module-a-routertabs:
         specifier: ^5.1.34
         version: 5.1.34
@@ -8890,15 +8890,9 @@ packages:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
 
-  zova-core@5.1.91:
-    resolution: {integrity: sha512-5e4EgInhcU7LUMhl6x7oOQnsF2X3lk1HMRvbo882FZrwTB3lvIz/ejOOdpRxoId29hqxvX5HFiKcb9aZi/cHog==}
-
   zova-core@5.1.92:
     resolution: {integrity: sha512-Y6j3YCMlVCZ5f9JGRX79mFRYW96stGgnhTyMmo0LZCD/P3CqjIlNwyL8edK8e/DBzQ+JYFj65CuBf/n/lIcl7Q==}
 
-  zova-jsx@1.1.91:
-    resolution: {integrity: sha512-VIScqEFG6jwzNqjW7MvBvZdLJAqpkzchop6Q/g2ttGBKXMGjyTZnaISrB3gWv/feReGnUb0BFPzDgmrOdFnQgA==}
-
   zova-jsx@1.1.92:
     resolution: {integrity: sha512-cbjpwK8qI3ufIKNXlYuWsbljfIbxZ3ISQXKKXn199V7A4IDRz0CNUmffPHU0EX3uZ1mMvqkt9HUJxaVseFb0qQ==}
 
@@ -8950,9 +8944,6 @@ packages:
   zova-module-a-pay@5.0.9:
     resolution: {integrity: sha512-Chl6EKp30HBOGFCJXbla2/lS19WhzQyTZwgYmsL3nnG9Vt2TeUlb82vsYCVuDcy0cgmxVaWjPF7dzKL/r3Pfng==}
 
-  zova-module-a-router@5.1.40:
-    resolution: {integrity: sha512-X8sOcMqDrNju+J+kjpyRwUkecMdnXIq2MFbl3KLY1lb641sXLEmdJMSJBmVWCrGVBA+kA6nGnI//wtMGXTVIyg==}
-
   zova-module-a-router@5.1.41:
     resolution: {integrity: sha512-oSv4S+9bAx79X8oUBARFKs4n56FNG/bbqdyxP10CXxlVue8WU7CmNKN4ckzLJ2mleVIezijZk/1aHS1Fl5rk+g==}
 
@@ -8980,9 +8971,6 @@ packages:
   zova-module-a-zod@5.1.37:
     resolution: {integrity: sha512-rXHN9rKbum9w3gDSnC/pIusG2d2FGJOcIauf8jrbT96f+Olk4Q3iV3t2V92mxiLCh9kMvBJPfcOgJFW7pRB5Fw==}
 
-  zova-module-a-zova@5.1.107:
-    resolution: {integrity: sha512-apqfQ2DSDd/2witE+qeVXOC5pxG4cqt0hfiXfJVHcfLeius4h9lpnLFQqFswkyAgCaXrcPk329Nq6FGSij8RKw==}
-
   zova-module-a-zova@5.1.108:
     resolution: {integrity: sha512-K6ZmbuKPScDXOmmNuDxrMtoo3n+YTgbf9BSVJcen++CVuHPXNSdr+kQTpOa+B12O+PxUKCfmwwCSh7T9RrjiEA==}
 
@@ -8992,15 +8980,9 @@ packages:
   zova-module-rest-resource@5.1.55:
     resolution: {integrity: sha512-Kk3oJIcxM5EbeTLl+ucJSeI2kT0We8YilXBaX8Z7QWCbZ0fHoQDy/Ac4YsVSWIXUrC2SQ267+nMl3sHXnE9G0Q==}
 
-  zova-suite-a-zova@5.1.164:
-    resolution: {integrity: sha512-0o/mBzx6fiPsPIKEltIRW2Hfntza2Hc8q/n7y+BQYXdoNN3WdvDpE6XrbG5Lu/+AXlHn42n49bgEgawNSYb/Xw==}
-
   zova-suite-a-zova@5.1.165:
     resolution: {integrity: sha512-hXjFEx9MXrtvPgAv28VF2UbgM45hzz7B7ZAsElJloBNWB3zyz2HUHYxNWDbCrrKfrw5zM3Mbr9i+dzyy3/6LQw==}
 
-  zova@5.1.165:
-    resolution: {integrity: sha512-oz67Qkzx+u/xE3hVOkIDEFFr7IwImfWIurmxdSpWA3UuzC+9bVDaDu3CDj/3l0n/0LIYnjmbff66k5gKikYWzg==}
-
   zova@5.1.166:
     resolution: {integrity: sha512-2qh4Na6G8JYHWIyX7+NNfMLzzgHsheQFUgeH6KVsMp66kxpdR9YSr5Ivz+dJepthtmnlCB7R+WWczhURx4wYYA==}
 
@@ -15081,37 +15063,6 @@ snapshots:
 
   yocto-queue@0.1.0: {}
 
-  zova-core@5.1.91(typescript@5.9.3):
-    dependencies:
-      '@cabloy/compose': link:packages-utils/compose
-      '@cabloy/extend': link:packages-utils/extend
-      '@cabloy/json5': link:packages-utils/json5
-      '@cabloy/localeutil': link:packages-utils/localeutil
-      '@cabloy/logger': 1.1.25
-      '@cabloy/module-info': 2.0.3
-      '@cabloy/utils': link:packages-utils/utils
-      '@cabloy/vue-compiler-sfc': 3.5.14
-      '@cabloy/vue-reactivity': 3.5.16
-      '@cabloy/vue-router': 4.4.18(vue@3.5.43(typescript@5.9.3))
-      '@cabloy/vue-runtime-core': 3.5.57
-      '@cabloy/vue-runtime-dom': 3.5.13
-      '@cabloy/vue-server-renderer': 3.5.18(vue@3.5.43(typescript@5.9.3))
-      '@cabloy/word-utils': 2.1.14
-      '@cabloy/zod-errors-custom': link:packages-utils/zod-errors-custom
-      '@cabloy/zod-openapi': link:packages-utils/zod-openapi
-      '@cabloy/zod-query': link:packages-utils/zod-query
-      '@types/js-cookie': 3.0.6
-      '@types/ms': 2.1.0
-      '@vue/shared': 3.5.36
-      deep-equal: 2.2.3
-      ms: 2.1.3
-      reflect-metadata: 0.2.2
-      vue: 3.5.43(typescript@5.9.3)
-      vue-plugin-render-freeze: 2.0.4(vue@3.5.43(typescript@5.9.3))
-      zod: '@cabloy/zod@4.3.8'
-    transitivePeerDependencies:
-      - typescript
-
   zova-core@5.1.92(patch_hash=144450bd7a567a6067e5857c0cf4c780981b7e90bc48745c09e1696a9b6f1b97)(typescript@5.9.3):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
@@ -15143,17 +15094,6 @@ snapshots:
     transitivePeerDependencies:
       - typescript
 
-  zova-jsx@1.1.91(typescript@5.9.3):
-    dependencies:
-      '@cabloy/compose': link:packages-utils/compose
-      '@cabloy/utils': link:packages-utils/utils
-      '@cabloy/word-utils': 2.1.14
-      typestyle: 2.4.0
-      vue: 3.5.43(typescript@5.9.3)
-      zova-core: 5.1.91(typescript@5.9.3)
-    transitivePeerDependencies:
-      - typescript
-
   zova-jsx@1.1.92(typescript@5.9.3):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
@@ -15226,8 +15166,6 @@ snapshots:
 
   zova-module-a-pay@5.0.9: {}
 
-  zova-module-a-router@5.1.40: {}
-
   zova-module-a-router@5.1.41: {}
 
   zova-module-a-routerstack@5.1.29: {}
@@ -15267,22 +15205,6 @@ snapshots:
       '@cabloy/zod-query': link:packages-utils/zod-query
       zod: '@cabloy/zod@4.3.8'
 
-  zova-module-a-zova@5.1.107(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
-    dependencies:
-      '@cabloy/compose': link:packages-utils/compose
-      '@cabloy/deps': link:packages-utils/deps
-      '@cabloy/json5': link:packages-utils/json5
-      '@cabloy/module-info': 2.0.3
-      '@cabloy/utils': link:packages-utils/utils
-      '@cabloy/vue-router': 4.4.18(vue@3.5.43(typescript@5.9.3))
-      '@cabloy/word-utils': 2.1.14
-      defu: 6.1.7
-      luxon: 3.7.2
-      zova-jsx: 1.1.91(typescript@5.9.3)
-    transitivePeerDependencies:
-      - typescript
-      - vue
-
   zova-module-a-zova@5.1.108(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
@@ -15303,39 +15225,6 @@ snapshots:
 
   zova-module-rest-resource@5.1.55: {}
 
-  zova-suite-a-zova@5.1.164(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
-    dependencies:
-      zova-module-a-api: 5.1.22
-      zova-module-a-app: 5.1.26
-      zova-module-a-bean: 5.1.36
-      zova-module-a-behavior: 5.1.26
-      zova-module-a-behaviors: 5.1.22
-      zova-module-a-command: 5.1.35
-      zova-module-a-fetch: 5.1.25
-      zova-module-a-form: 5.1.51(vue@3.5.43(typescript@5.9.3))
-      zova-module-a-icon: 5.1.27
-      zova-module-a-interceptor: 5.1.31
-      zova-module-a-logger: 5.1.28
-      zova-module-a-meta: 5.1.22
-      zova-module-a-model: 5.1.37(vue@3.5.43(typescript@5.9.3))
-      zova-module-a-openapi: 5.1.54
-      zova-module-a-router: 5.1.40
-      zova-module-a-routerstack: 5.1.29
-      zova-module-a-routertabs: 5.1.34
-      zova-module-a-ssr: 5.1.40
-      zova-module-a-ssrhmr: 5.1.23
-      zova-module-a-ssrserver: 5.1.26
-      zova-module-a-style: 5.1.35
-      zova-module-a-table: 5.1.43(vue@3.5.43(typescript@5.9.3))
-      zova-module-a-zod: 5.1.37
-      zova-module-a-zova: 5.1.107(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
-    transitivePeerDependencies:
-      - '@vue/composition-api'
-      - debug
-      - supports-color
-      - typescript
-      - vue
-
   zova-suite-a-zova@5.1.165(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
     dependencies:
       zova-module-a-api: 5.1.22
@@ -15369,17 +15258,6 @@ snapshots:
       - typescript
       - vue
 
-  zova@5.1.165(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
-    dependencies:
-      zova-core: 5.1.91(typescript@5.9.3)
-      zova-suite-a-zova: 5.1.164(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
-    transitivePeerDependencies:
-      - '@vue/composition-api'
-      - debug
-      - supports-color
-      - typescript
-      - vue
-
   zova@5.1.166(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
     dependencies:
       zova-core: 5.1.92(patch_hash=144450bd7a567a6067e5857c0cf4c780981b7e90bc48745c09e1696a9b6f1b97)(typescript@5.9.3)

package/vona/src/suite/a-home/modules/home-user/src/service/account.ts

@@ -601,7 +601,7 @@ export class ServiceAccount extends BeanBase {
       url.password ||
       url.search ||
       url.hash ||
-      this.bean.security.checkOriginExact(url.origin, this.ctx.host) !== url.origin
+      this.bean.security.checkOriginExact(url.origin, this.app.util.host) !== url.origin
     ) {
       this.app.throw(503, `account ${purpose} consumer URL is invalid`);
     }

package/vona/src/suite/a-home/modules/home-user/test/accountPasswordReset.test.ts

@@ -248,21 +248,38 @@ describe('accountPasswordReset.test.ts', { concurrency: false }, () => {
     }
   });
 
-  it('allows an exact same-origin consumer without a whitelist entry', async () => {
+  it('uses the canonical host for an exact same-origin consumer without a whitelist entry', async () => {
     let fixture: IAccountPasswordResetFixture | undefined;
     let restoreConfig: (() => void) | undefined;
+    let serve: typeof app.config.server.serve | undefined;
+    let servePrevious: { protocol?: string; host?: string } | undefined;
     try {
       fixture = await createFixture({ simpleAuth: true });
       restoreConfig = await configurePasswordReset([]);
+      await app.bean.executor.mockCtx(async () => {
+        serve = app.ctx.config.server.serve;
+        servePrevious = { ...serve };
+        (serve as any).host = 'canonical.example.test';
+      });
 
       const sameOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-reset`;
+        return `${app.ctx.protocol}://${app.util.host}/home/user/password-reset`;
       });
       const issued = await issuePasswordResetLink(fixture, sameOriginConsumerUrl);
       assert.equal(issued.origin, new URL(sameOriginConsumerUrl).origin);
       assert.equal(issued.path, '/home/user/password-reset');
       assert.equal(issued.search, `?token=${issued.token}`);
+
+      await clearPasswordResetState(fixture.userId);
+      await clearPasswordResetRecipientCooldown(fixture.email);
+      const requestOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
+        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-reset`;
+      });
+      await requestPasswordReset(fixture.email, requestOriginConsumerUrl);
+      await assertNoPasswordResetState(fixture.userId);
+      await assertNoPasswordResetRecipientCooldown(fixture.email);
     } finally {
+      if (serve && servePrevious) Object.assign(serve, servePrevious);
       restoreConfig?.();
       if (fixture) await removeFixture(fixture);
     }
@@ -706,9 +723,11 @@ async function assertNoPasswordResetRecipientCooldown(email: string) {
 }
 
 async function clearPasswordResetState(userId: string): Promise<void> {
-  const digest = await app.scope('home-user').cacheRedis.passwordResetCurrent.get(userId as any);
-  if (digest) await app.scope('home-user').cacheRedis.passwordReset.del(digest);
-  await app.scope('home-user').cacheRedis.passwordResetCurrent.del(userId as any);
+  await app.bean.executor.mockCtx(async () => {
+    const digest = await app.scope('home-user').cacheRedis.passwordResetCurrent.get(userId as any);
+    if (digest) await app.scope('home-user').cacheRedis.passwordReset.del(digest);
+    await app.scope('home-user').cacheRedis.passwordResetCurrent.del(userId as any);
+  });
 }
 
 async function assertNoPasswordResetState(userId: string, digest?: string): Promise<void> {

package/vona/src/suite/a-home/modules/home-user/test/accountPasswordSet.test.ts

@@ -453,21 +453,36 @@ describe('accountPasswordSet.test.ts', { concurrency: false, sequential: true },
     }
   });
 
-  it('allows an exact same-origin consumer without a whitelist entry', async () => {
+  it('uses the canonical host for an exact same-origin consumer without a whitelist entry', async () => {
     let fixture: IAccountPasswordSetFixture | undefined;
     let restoreConfig: (() => void) | undefined;
+    let serve: typeof app.config.server.serve | undefined;
+    let servePrevious: { protocol?: string; host?: string } | undefined;
     try {
       fixture = await createFixture();
       restoreConfig = await configurePasswordSet([]);
+      await app.bean.executor.mockCtx(async () => {
+        serve = app.ctx.config.server.serve;
+        servePrevious = { ...serve };
+        (serve as any).host = 'canonical.example.test';
+      });
 
       const sameOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-set`;
+        return `${app.ctx.protocol}://${app.util.host}/home/user/password-set`;
       });
       const issued = await issuePasswordSetLink(fixture, sameOriginConsumerUrl);
       assert.equal(issued.origin, new URL(sameOriginConsumerUrl).origin);
       assert.equal(issued.path, '/home/user/password-set');
       assert.equal(issued.search, `?token=${issued.token}`);
+
+      await clearPasswordSetState(fixture.userId);
+      const requestOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
+        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-set`;
+      });
+      await issuePasswordSetLinkRejected(fixture, requestOriginConsumerUrl);
+      await assertNoPasswordSetState(fixture.userId);
     } finally {
+      if (serve && servePrevious) Object.assign(serve, servePrevious);
       restoreConfig?.();
       if (fixture) await removeFixture(fixture);
     }
@@ -784,9 +799,11 @@ async function getCacheTtl(cacheName: 'passwordSet' | 'passwordSetCurrent', key:
 }
 
 async function clearPasswordSetState(userId: string): Promise<void> {
-  const digest = await app.scope('home-user').cacheRedis.passwordSetCurrent.get(userId);
-  if (digest) await app.scope('home-user').cacheRedis.passwordSet.del(digest);
-  await app.scope('home-user').cacheRedis.passwordSetCurrent.del(userId);
+  await app.bean.executor.mockCtx(async () => {
+    const digest = await app.scope('home-user').cacheRedis.passwordSetCurrent.get(userId);
+    if (digest) await app.scope('home-user').cacheRedis.passwordSet.del(digest);
+    await app.scope('home-user').cacheRedis.passwordSetCurrent.del(userId);
+  });
 }
 
 async function assertNoPasswordSetState(userId: string, digest?: string): Promise<void> {

package/vona/src/suite-vendor/a-auth/modules/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-auth",
-  "version": "5.1.23",
+  "version": "5.1.24",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [