cabloy 5.1.189 → 5.1.190

package/.cabloy-version

@@ -1 +1 @@
-5.1.189
+5.1.190

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 5.1.190
+
+### Features
+
+- Update application and authentication capabilities.
+
+### Bug Fixes
+
+- Correct test coverage and authentication request handling.
+
+### Improvements
+
+- Simplify `bean.core` by removing obsolete methods.
+- Update application, Passport, OAuth request context, and project documentation.
+
 ## 5.1.189
 
 ### Features

package/CLAUDE.md

@@ -88,6 +88,7 @@ Before inventing a custom implementation path:
 - For replay-safe transient failures, use `@Core.retryable(...)` with an explicit `errorCodes` allowlist. It retries the downstream AOP suffix, so place it closest to the method when it must wrap and retry a `@Core.transaction(...)` boundary; use `ownerOnly: true` for dual-role leaves that must not retry inside a caller-owned transaction; do not retry external side effects or infer retryability from isolation level.
 - Backend tests that use scoped Vona state must own an `app.bean.executor.mockCtx(...)` boundary; every intentionally competing operation must run in a separate `mockCtx(...)`.
 - Do not set `TEST_CONCURRENCY=false` for normal `npm run test` or CI runs: an unset value defaults to concurrent execution. For stateful `node:test` suites, declare `{ concurrency: false }` explicitly. Prove business contention by explicitly launching competing operations and asserting their combined durable outcome, never through runner parallelism or scheduling.
+- Unit tests must not temporarily mutate process-global origin or proxy configuration, including `app.config.server.serve.protocol`, `app.config.server.serve.host`, and `app.proxy`. Model request-origin cases with an explicit `req` fixture, and use the established `AppUtil` loopback fallback for requestless local URLs. Do not introduce a broad origin lock to serialize such tests; retain narrowly scoped locks only for genuinely shared domain state.
 - Unit tests must delete every test-owned persisted resource in `finally`, using precise owned identities and reverse dependency order.
 - Shared durable test or local-development fixtures must be created through the owning module's `meta.version.ts` `seed()` hook and treated as read-only by tests; the managed seed path starts from a newly recreated database rather than repeating against one database.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.189",
+  "version": "5.1.190",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/vona/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli",
-  "version": "1.1.155",
+  "version": "1.1.156",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli",
   "keywords": [

package/vona/packages-cli/cli-set-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli-set-api",
-  "version": "1.1.153",
+  "version": "1.1.154",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli-set-api",
   "keywords": [

package/vona/packages-cli/cli-set-api/toolsIsolate/test.ts

@@ -99,8 +99,8 @@ async function testRun(projectPath: string, coverage: boolean, patterns: string[
       .on('test:coverage', data => {
         outputCoverageReport(data.summary.totals);
       })
-      .on('test:pass', t => {
-        if (t.name === '---done---') {
+      .on('test:pass', data => {
+        if (data.nesting === 0 && data.name === '---done---') {
           void closeApplicationOnce();
         }
       });

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.100",
+  "version": "5.1.101",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/packages-vona/vona-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-core",
-  "version": "5.1.41",
+  "version": "5.1.42",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona",
   "keywords": [

package/vona/packages-vona/vona-core/src/lib/core/application.ts

@@ -72,10 +72,9 @@ export class VonaApplication extends KoaApplication {
     if (req) {
       request = req;
     } else {
-      const port = this.config?.server.listen.port ?? this.meta.env.SERVER_LISTEN_PORT;
-      const hostFallback = port ? `localhost:${port}` : 'localhost';
-      const protocol = (this.config ? this.util.protocol : undefined) || 'http';
-      const host = (this.config ? this.util.host : undefined) || hostFallback;
+      const protocol = 'http';
+      const port = this.meta.env.SERVER_LISTEN_PORT;
+      const host = port ? `localhost:${port}` : 'localhost';
       const hostname = new URL(`${protocol}://${host}`).hostname;
       request = {
         headers: {
@@ -89,12 +88,12 @@ export class VonaApplication extends KoaApplication {
         host,
         hostname,
         protocol,
-        secure: protocol === 'https',
+        secure: false,
         method: 'POST',
         url: '',
         path: '',
         socket: {
-          encrypted: protocol === 'https',
+          encrypted: false,
           remoteAddress: '127.0.0.1',
           remotePort: 7001,
         },

package/vona/packages-vona/vona-core/src/lib/utils/util.ts

@@ -61,12 +61,17 @@ export class AppUtil extends BeanSimple {
 
   get protocol() {
     const config = this.ctx ? this.ctx.config : this.app.config;
-    return config.server.serve.protocol || this.ctx?.protocol;
+    return config.server.serve.protocol || this.ctx?.protocol || 'http';
   }
 
   get host() {
     const config = this.ctx ? this.ctx.config : this.app.config;
-    return config.server.serve.host || this.ctx?.host;
+    let host = config.server.serve.host || this.ctx?.host;
+    if (!host) {
+      const port = this.app.meta.env.SERVER_LISTEN_PORT;
+      host = port ? `localhost:${port}` : 'localhost';
+    }
+    return host;
   }
 
   getAbsoluteUrl(path?: string) {

package/vona/packages-vona/vona-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-mock",
-  "version": "6.1.41",
+  "version": "6.1.42",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona mock",
   "keywords": [

package/vona/src/suite/a-commerce/modules/commerce-catalog/src/service/product.ts

@@ -17,11 +17,11 @@ import type { EntityProduct } from '../entity/product.tsx';
 import type { ModelProduct } from '../model/product.ts';
 
 const serializationRetryOptions = {
-  retries: 3,
-  factor: 1,
+  retries: 6,
+  factor: 2,
   minTimeout: 10,
-  maxTimeout: 10,
-  randomize: false,
+  maxTimeout: 160,
+  randomize: true,
   errorCodes: [
     '40001',
     'ER_LOCK_DEADLOCK',

package/vona/src/suite/a-commerce/modules/commerce-catalog/test/productContent.test.ts

@@ -243,7 +243,7 @@ describe('productContent.test.ts', { concurrency: false }, () => {
         return product.id;
       });
 
-      await Promise.all(
+      const results = await Promise.allSettled(
         markdowns.map(descriptionMarkdown =>
           runInMockCtx(async () => {
             await app.scope('commerce-catalog').service.product.update(productId, {
@@ -252,10 +252,17 @@ describe('productContent.test.ts', { concurrency: false }, () => {
           }),
         ),
       );
+      assert.deepEqual(
+        results.map(result => result.status),
+        ['fulfilled', 'fulfilled'],
+      );
 
       await runInMockCtx(async () => {
-        const stored = await app.scope('commerce-catalog').model.productContent.get({ productId });
-        assert.ok(stored);
+        const storeds = await app.scope('commerce-catalog').model.productContent.select({
+          where: { productId },
+        });
+        assert.equal(storeds.length, 1);
+        const stored = storeds[0]!;
         assert.ok(markdowns.includes(stored.descriptionMarkdown!));
         assert.equal(
           stored.descriptionHtml,

package/vona/src/suite/a-commerce/modules/commerce-payment/src/bean/payScene.commerceOrder.ts

@@ -23,7 +23,9 @@ import 'vona-module-a-ssr';
       input.candidate.clientName,
     );
     const server = _ctx.app.config.server.serve;
-    const hasPublicServer = !!(server.protocol && server.host);
+    const hasCallbackOrigin = _ctx.app.meta.isTest
+      ? !!(_ctx.app.util.protocol && _ctx.app.util.host)
+      : !!(server.protocol && server.host);
     if (input.candidate.key === 'paypal') {
       const options = clientOptions as IPayProviderPaypalClientOptions;
       return !!(
@@ -31,12 +33,12 @@ import 'vona-module-a-ssr';
         options.secretCredential.clientSecret &&
         options.webhookId &&
         options.merchantReference &&
-        hasPublicServer
+        hasCallbackOrigin
       );
     }
     if (input.candidate.key === 'stripe') {
       const options = clientOptions as IPayProviderStripeClientOptions;
-      return !!(options.secretCredential && options.secretWebhook && hasPublicServer);
+      return !!(options.secretCredential && options.secretWebhook && hasCallbackOrigin);
     }
     return false;
   },

package/vona/src/suite/a-home/modules/home-index/src/bean/meta.printTip.ts

@@ -8,7 +8,7 @@ export class MetaPrintTip extends BeanBase implements IMetaPrintTipExecute {
   async execute(): Promise<TypeMetaPrintTipResult> {
     return {
       title: 'home',
-      message: this.bean.core.getAbsoluteUrl(),
+      message: this.app.util.getAbsoluteUrl(),
     };
   }
 }

package/vona/src/suite/a-home/modules/home-user/test/accountPasswordReset.test.ts

@@ -248,38 +248,30 @@ describe('accountPasswordReset.test.ts', { concurrency: false }, () => {
     }
   });
 
-  it('uses the canonical host for an exact same-origin consumer without a whitelist entry', async () => {
+  it('uses the fallback origin for an exact same-origin consumer without a whitelist entry', async () => {
     let fixture: IAccountPasswordResetFixture | undefined;
     let restoreConfig: (() => void) | undefined;
-    let serve: typeof app.config.server.serve | undefined;
-    let servePrevious: { protocol?: string; host?: string } | undefined;
     try {
       fixture = await createFixture({ simpleAuth: true });
       restoreConfig = await configurePasswordReset([]);
-      await app.bean.executor.mockCtx(async () => {
-        serve = app.ctx.config.server.serve;
-        servePrevious = { ...serve };
-        (serve as any).host = 'canonical.example.test';
-      });
 
-      const sameOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.util.host}/home/user/password-reset`;
-      });
+      const port = app.meta.env.SERVER_LISTEN_PORT;
+      const fallbackOrigin = `http://${port ? `localhost:${port}` : 'localhost'}`;
+      const sameOriginConsumerUrl = `${fallbackOrigin}/home/user/password-reset`;
       const issued = await issuePasswordResetLink(fixture, sameOriginConsumerUrl);
-      assert.equal(issued.origin, new URL(sameOriginConsumerUrl).origin);
+      assert.equal(issued.origin, fallbackOrigin);
       assert.equal(issued.path, '/home/user/password-reset');
       assert.equal(issued.search, `?token=${issued.token}`);
 
       await clearPasswordResetState(fixture.userId);
       await clearPasswordResetRecipientCooldown(fixture.email);
-      const requestOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-reset`;
-      });
-      await requestPasswordReset(fixture.email, requestOriginConsumerUrl);
+      await requestPasswordReset(
+        fixture.email,
+        'https://request.example.test/home/user/password-reset',
+      );
       await assertNoPasswordResetState(fixture.userId);
       await assertNoPasswordResetRecipientCooldown(fixture.email);
     } finally {
-      if (serve && servePrevious) Object.assign(serve, servePrevious);
       restoreConfig?.();
       if (fixture) await removeFixture(fixture);
     }

package/vona/src/suite/a-home/modules/home-user/test/accountPasswordSet.test.ts

@@ -453,36 +453,28 @@ describe('accountPasswordSet.test.ts', { concurrency: false, sequential: true },
     }
   });
 
-  it('uses the canonical host for an exact same-origin consumer without a whitelist entry', async () => {
+  it('uses the fallback origin for an exact same-origin consumer without a whitelist entry', async () => {
     let fixture: IAccountPasswordSetFixture | undefined;
     let restoreConfig: (() => void) | undefined;
-    let serve: typeof app.config.server.serve | undefined;
-    let servePrevious: { protocol?: string; host?: string } | undefined;
     try {
       fixture = await createFixture();
       restoreConfig = await configurePasswordSet([]);
-      await app.bean.executor.mockCtx(async () => {
-        serve = app.ctx.config.server.serve;
-        servePrevious = { ...serve };
-        (serve as any).host = 'canonical.example.test';
-      });
 
-      const sameOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.util.host}/home/user/password-set`;
-      });
+      const port = app.meta.env.SERVER_LISTEN_PORT;
+      const fallbackOrigin = `http://${port ? `localhost:${port}` : 'localhost'}`;
+      const sameOriginConsumerUrl = `${fallbackOrigin}/home/user/password-set`;
       const issued = await issuePasswordSetLink(fixture, sameOriginConsumerUrl);
-      assert.equal(issued.origin, new URL(sameOriginConsumerUrl).origin);
+      assert.equal(issued.origin, fallbackOrigin);
       assert.equal(issued.path, '/home/user/password-set');
       assert.equal(issued.search, `?token=${issued.token}`);
 
       await clearPasswordSetState(fixture.userId);
-      const requestOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-set`;
-      });
-      await issuePasswordSetLinkRejected(fixture, requestOriginConsumerUrl);
+      await issuePasswordSetLinkRejected(
+        fixture,
+        'https://request.example.test/home/user/password-set',
+      );
       await assertNoPasswordSetState(fixture.userId);
     } finally {
-      if (serve && servePrevious) Object.assign(serve, servePrevious);
       restoreConfig?.();
       if (fixture) await removeFixture(fixture);
     }

package/vona/src/suite-vendor/a-auth/modules/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-auth",
-  "version": "5.1.24",
+  "version": "5.1.25",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-auth/modules/a-auth/src/controller/passport.ts

@@ -15,7 +15,7 @@ export class ControllerPassport extends BeanBase {
   @Aspect.guardGlobal('a-user:passport', { public: true })
   @Api.exclude()
   async callback() {
-    const code = this.ctx.query.code as string;
+    // const code = this.ctx.query.code as string;
     const stateQuery = this.ctx.query.state as string;
     if (!stateQuery) this.app.throw(403);
     const strategyState: IAuthenticateStrategyState = (await this.bean.jwt
@@ -23,7 +23,7 @@ export class ControllerPassport extends BeanBase {
       .verify(stateQuery)) as unknown as IAuthenticateStrategyState;
     return await this.bean.executor.newCtx(
       async () => {
-        this.ctx.request.query = { code, state: stateQuery };
+        // this.ctx.request.query = { code, state: stateQuery };
         return await this.scope.service.auth.authCallback(strategyState);
       },
       {
@@ -31,6 +31,8 @@ export class ControllerPassport extends BeanBase {
         tz: strategyState.tz,
         instanceName: strategyState.instanceName,
         instance: true,
+        req: this.ctx.req,
+        res: this.ctx.res,
       },
     );
   }

package/vona/src/suite-vendor/a-auth/modules/a-auth/test/oauthRequestContext.test.ts

@@ -3,169 +3,146 @@ import { after, before, describe, it } from 'node:test';
 import { acquireTestLock, app } from 'vona-mock';
 
 describe('oauthRequestContext.test.ts', { concurrency: false }, () => {
-  const releases: Array<() => void> = [];
+  let release: () => void;
 
   before(async () => {
-    releases.push(await acquireTestLock('a-security'));
+    release = await acquireTestLock('a-security');
   });
 
   after(() => {
-    for (const release of releases.reverse()) release();
+    release();
   });
+
   it('passes the callback request through an isolated context without rewriting it', async () => {
     await app.bean.executor.mockCtx(async () => {
-      const proxyPrevious = app.proxy;
-      app.proxy = true;
-      try {
-        const req = {
-          method: 'GET',
-          url: '/api/auth/passport/callback?a=1&b=2',
-          headers: {
-            'host': 'origin.internal.test',
-            'x-forwarded-host': 'demo.example.test',
-            'x-forwarded-proto': 'https',
-            'user-agent': 'oauth-callback-test',
-          },
-          httpVersionMajor: 1,
-          socket: {
-            remoteAddress: '192.0.2.10',
-            remotePort: 443,
-          },
-        };
-        const originalUrl = req.url;
-        const originalHeaders = { ...req.headers };
-        const outerContext = app.ctx;
-        const result = await app.bean.executor.newCtx(
-          async () => {
-            return {
-              context: app.ctx,
-              request: app.ctx.req,
-              method: app.ctx.method,
-              host: app.ctx.host,
-              protocol: app.ctx.protocol,
-              secure: app.ctx.secure,
-              query: app.ctx.request.query,
-              userAgent: app.ctx.get('user-agent'),
-            };
-          },
-          {
-            instanceName: outerContext.instanceName!,
-            req,
-          },
-        );
+      const req = {
+        method: 'GET',
+        url: '/api/auth/passport/callback?a=1&b=2',
+        headers: {
+          'host': 'demo.example.test',
+          'user-agent': 'oauth-callback-test',
+        },
+        httpVersionMajor: 1,
+        socket: {
+          encrypted: true,
+          remoteAddress: '192.0.2.10',
+          remotePort: 443,
+        },
+      };
+      const originalUrl = req.url;
+      const originalHeaders = { ...req.headers };
+      const outerContext = app.ctx;
+      const result = await app.bean.executor.newCtx(
+        async () => {
+          return {
+            context: app.ctx,
+            request: app.ctx.req,
+            method: app.ctx.method,
+            host: app.ctx.host,
+            protocol: app.ctx.protocol,
+            secure: app.ctx.secure,
+            query: app.ctx.request.query,
+            userAgent: app.ctx.get('user-agent'),
+          };
+        },
+        {
+          instanceName: outerContext.instanceName!,
+          req,
+        },
+      );
 
-        assert.notEqual(result.context, outerContext);
-        assert.equal(result.request, req);
-        assert.equal(result.method, 'GET');
-        assert.equal(result.host, 'demo.example.test');
-        assert.equal(result.protocol, 'https');
-        assert.equal(result.secure, true);
-        assert.deepEqual(result.query, { a: '1', b: '2' });
-        assert.equal(result.userAgent, 'oauth-callback-test');
-        assert.equal(req.url, originalUrl);
-        assert.deepEqual(req.headers, originalHeaders);
-        assert.equal(app.ctx, outerContext);
-      } finally {
-        app.proxy = proxyPrevious;
-      }
+      assert.notEqual(result.context, outerContext);
+      assert.equal(result.request, req);
+      assert.equal(result.method, 'GET');
+      assert.equal(result.host, 'demo.example.test');
+      assert.equal(result.protocol, 'https');
+      assert.equal(result.secure, true);
+      assert.deepEqual(result.query, { a: '1', b: '2' });
+      assert.equal(result.userAgent, 'oauth-callback-test');
+      assert.equal(req.url, originalUrl);
+      assert.deepEqual(req.headers, originalHeaders);
+      assert.equal(app.ctx, outerContext);
     });
   });
 
-  it('logs rejected redirects against the canonical server origin', async () => {
-    await app.bean.executor.mockCtx(async () => {
-      const proxyPrevious = app.proxy;
-      const serve = app.ctx.config.server.serve;
-      const servePrevious = { ...serve };
-      app.proxy = true;
-      (serve as any).host = 'canonical.example.test';
-      (serve as any).protocol = 'http';
-      try {
-        const req = {
-          method: 'GET',
-          url: '/api/auth/passport/callback',
-          headers: {
-            'host': 'origin.internal.test',
-            'x-forwarded-host': 'edge.example.test',
-            'x-forwarded-proto': 'https',
-          },
-          httpVersionMajor: 1,
-          socket: {
-            remoteAddress: '192.0.2.10',
-            remotePort: 443,
-          },
-        };
-        await app.bean.executor.newCtx(
-          async () => {
-            assert.equal(app.ctx.host, 'edge.example.test');
-            assert.equal(app.ctx.protocol, 'https');
-            assert.equal(app.util.host, 'canonical.example.test');
-            assert.equal(app.util.protocol, 'http');
+  it('logs rejected redirects against the effective request origin', async () => {
+    const req = {
+      method: 'GET',
+      url: '/api/auth/passport/callback',
+      headers: {
+        host: 'edge.example.test',
+      },
+      httpVersionMajor: 1,
+      socket: {
+        encrypted: true,
+        remoteAddress: '192.0.2.10',
+        remotePort: 443,
+      },
+    };
+    await app.bean.executor.mockCtx(
+      async () => {
+        assert.equal(app.ctx.host, 'edge.example.test');
+        assert.equal(app.ctx.protocol, 'https');
+        assert.equal(app.util.host, 'edge.example.test');
+        assert.equal(app.util.protocol, 'https');
 
-            const service = app.scope('a-auth').service.auth;
-            const logger = (service as any).$logger;
-            const warnPrevious = logger.warn;
-            const warnings: unknown[][] = [];
-            logger.warn = (...args: unknown[]) => warnings.push(args);
-            try {
-              (service as any)._logOauthRedirectRejected(
-                {
-                  id: -1,
-                  providerName: 'auth-oauth:oauth',
-                  clientName: 'github',
-                },
-                {
-                  authProviderId: -1,
-                  instanceName: app.ctx.instanceName!,
-                  locale: app.ctx.locale,
-                  redirect: 'https://edge.example.test/oauth/callback',
-                },
-                'origin_disallowed',
-              );
-            } finally {
-              logger.warn = warnPrevious;
-            }
+        const service = app.scope('a-auth').service.auth;
+        const logger = (service as any).$logger;
+        const warnPrevious = logger.warn;
+        const warnings: unknown[][] = [];
+        logger.warn = (...args: unknown[]) => warnings.push(args);
+        try {
+          (service as any)._logOauthRedirectRejected(
+            {
+              id: -1,
+              providerName: 'auth-oauth:oauth',
+              clientName: 'github',
+            },
+            {
+              authProviderId: -1,
+              instanceName: app.ctx.instanceName!,
+              locale: app.ctx.locale,
+              redirect: 'https://redirect.example.test/oauth/callback',
+            },
+            'origin_disallowed',
+          );
+        } finally {
+          logger.warn = warnPrevious;
+        }
 
-            assert.equal(warnings.length, 1);
-            assert.equal(warnings[0][0], 'OAuth callback final redirect rejected');
-            const diagnostic = warnings[0][1] as Record<string, unknown>;
-            assert.deepEqual(
-              {
-                event: diagnostic.event,
-                stage: diagnostic.stage,
-                outcome: diagnostic.outcome,
-                reason: diagnostic.reason,
-                requestHost: diagnostic.requestHost,
-                requestProtocol: diagnostic.requestProtocol,
-                serveHost: diagnostic.serveHost,
-                serveProtocol: diagnostic.serveProtocol,
-                proxyEnabled: diagnostic.proxyEnabled,
-                redirectHost: diagnostic.redirectHost,
-                hostMatches: diagnostic.hostMatches,
-              },
-              {
-                event: 'auth.oauth_final_redirect_rejected',
-                stage: 'redirect_validation',
-                outcome: 'rejected',
-                reason: 'origin_disallowed',
-                requestHost: 'canonical.example.test',
-                requestProtocol: 'http',
-                serveHost: 'canonical.example.test',
-                serveProtocol: 'http',
-                proxyEnabled: true,
-                redirectHost: 'edge.example.test',
-                hostMatches: false,
-              },
-            );
+        assert.equal(warnings.length, 1);
+        assert.equal(warnings[0][0], 'OAuth callback final redirect rejected');
+        const diagnostic = warnings[0][1] as Record<string, unknown>;
+        assert.deepEqual(
+          {
+            event: diagnostic.event,
+            stage: diagnostic.stage,
+            outcome: diagnostic.outcome,
+            reason: diagnostic.reason,
+            requestHost: diagnostic.requestHost,
+            requestProtocol: diagnostic.requestProtocol,
+            serveHost: diagnostic.serveHost,
+            serveProtocol: diagnostic.serveProtocol,
+            proxyEnabled: diagnostic.proxyEnabled,
+            redirectHost: diagnostic.redirectHost,
+            hostMatches: diagnostic.hostMatches,
           },
           {
-            instanceName: app.ctx.instanceName!,
-            req,
+            event: 'auth.oauth_final_redirect_rejected',
+            stage: 'redirect_validation',
+            outcome: 'rejected',
+            reason: 'origin_disallowed',
+            requestHost: 'edge.example.test',
+            requestProtocol: 'https',
+            serveHost: null,
+            serveProtocol: null,
+            proxyEnabled: false,
+            redirectHost: 'redirect.example.test',
+            hostMatches: false,
           },
         );
-      } finally {
-        app.proxy = proxyPrevious;
-        Object.assign(serve, servePrevious);
-      }
-    });
+      },
+      { req },
+    );
   });
 });

package/vona/src/suite-vendor/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-auth",
-  "version": "5.1.28",
+  "version": "5.1.29",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/vona/src/suite-vendor/a-pay/modules/a-pay/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-pay",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-pay/modules/a-pay/src/service/paymentCallback.ts

@@ -88,7 +88,7 @@ export class ServicePaymentCallback extends BeanBase {
 
   private _assertTrustedOrigin() {
     const { protocol, host } = this.app.config.server.serve;
-    if (!protocol || !host) {
+    if (!this.app.meta.isTest && (!protocol || !host)) {
       this.app.throw(503, 'payment callbacks require configured server serve protocol and host');
     }
   }

package/vona/src/suite-vendor/a-pay/modules/pay-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-pay-mock",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-pay/modules/pay-paypal/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-pay-paypal",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-pay/modules/pay-stripe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-pay-stripe",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-pay/package.json

@@ -1,15 +1,15 @@
 {
   "name": "vona-suite-a-pay",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "",
   "author": "",
   "files": [],
   "type": "module",
   "dependencies": {
-    "vona-module-a-pay": "^5.0.8",
-    "vona-module-pay-mock": "^5.0.8",
-    "vona-module-pay-paypal": "^5.0.8",
-    "vona-module-pay-stripe": "^5.0.8"
+    "vona-module-a-pay": "^5.0.9",
+    "vona-module-pay-mock": "^5.0.9",
+    "vona-module-pay-paypal": "^5.0.9",
+    "vona-module-pay-stripe": "^5.0.9"
   },
   "title": "a-pay"
 }

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.55",
+  "version": "5.1.56",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-core/src/bean/bean.core.ts

@@ -5,23 +5,7 @@ import type { TypeContextFetch } from '../types/fetch.ts';
 
 @Bean()
 export class BeanCore extends BeanBase {
-  get protocol() {
-    return this.app.util.protocol;
-  }
-
-  get host() {
-    return this.app.util.host;
-  }
-
   get fetch(): TypeContextFetch {
     return this.ctx.state.fetch ?? globalThis.fetch;
   }
-
-  getAbsoluteUrl(path?: string) {
-    return this.app.util.getAbsoluteUrl(path);
-  }
-
-  getAbsoluteUrlByApiPath(path: string) {
-    return this.app.util.getAbsoluteUrlByApiPath(path);
-  }
 }

package/vona/src/suite-vendor/a-vona/modules/a-core/src/bean/meta.runtime.ts

@@ -12,8 +12,8 @@ export interface TypeMetaRuntimeResult {
 export class MetaRuntime extends BeanBase implements IMetaRuntimeExecute {
   async execute(): Promise<TypeMetaRuntimeResult> {
     return {
-      protocol: this.bean.core.protocol,
-      host: this.bean.core.host,
+      protocol: this.app.util.protocol,
+      host: this.app.util.host,
     };
   }
 }

package/vona/src/suite-vendor/a-vona/modules/a-ormdialect/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-ormdialect",
-  "version": "5.1.17",
+  "version": "5.1.18",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-ormdialect/src/bean/databaseDialect.betterSqlite3.ts

@@ -98,6 +98,7 @@ export class DatabaseDialectBetterSqlite3 extends ServiceDatabaseDialectBase {
 }
 
 async function sqlite3_afterCreate(conn) {
+  conn.pragma('busy_timeout = 5000');
   const pragma: { journal_mode: string }[] = conn.pragma('journal_mode');
   if (pragma[0]?.journal_mode?.toLocaleLowerCase() !== 'wal') {
     conn.pragma('journal_mode = wal');

package/vona/src/suite-vendor/a-vona/modules/a-security/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-security",
-  "version": "5.1.14",
+  "version": "5.1.15",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-security/test/origin.test.ts

@@ -1,8 +1,18 @@
 import assert from 'node:assert';
-import { describe, it } from 'node:test';
-import { app } from 'vona-mock';
+import { after, before, describe, it } from 'node:test';
+import { acquireTestLock, app } from 'vona-mock';
 
 describe('origin.test.ts', { concurrency: false }, () => {
+  let release: () => void;
+
+  before(async () => {
+    release = await acquireTestLock('a-security');
+  });
+
+  after(() => {
+    release();
+  });
+
   it('keeps normal CORS separate from exact credential-link authorization', async () => {
     await withWhiteList('*', async () => {
       assert.equal(

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.91",
+  "version": "5.1.92",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",