cabloy 5.1.189 → 5.1.191

package/.cabloy-version

@@ -1 +1 @@
-5.1.189
+5.1.191

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 5.1.191
+
+### Features
+
+- Update functionality with the latest enhancements.
+
+### Improvements
+
+- Refresh the demo and documentation in the README and index pages.
+
+## 5.1.190
+
+### Features
+
+- Update application and authentication capabilities.
+
+### Bug Fixes
+
+- Correct test coverage and authentication request handling.
+
+### Improvements
+
+- Simplify `bean.core` by removing obsolete methods.
+- Update application, Passport, OAuth request context, and project documentation.
+
 ## 5.1.189
 
 ### Features

package/CLAUDE.md

@@ -88,6 +88,7 @@ Before inventing a custom implementation path:
 - For replay-safe transient failures, use `@Core.retryable(...)` with an explicit `errorCodes` allowlist. It retries the downstream AOP suffix, so place it closest to the method when it must wrap and retry a `@Core.transaction(...)` boundary; use `ownerOnly: true` for dual-role leaves that must not retry inside a caller-owned transaction; do not retry external side effects or infer retryability from isolation level.
 - Backend tests that use scoped Vona state must own an `app.bean.executor.mockCtx(...)` boundary; every intentionally competing operation must run in a separate `mockCtx(...)`.
 - Do not set `TEST_CONCURRENCY=false` for normal `npm run test` or CI runs: an unset value defaults to concurrent execution. For stateful `node:test` suites, declare `{ concurrency: false }` explicitly. Prove business contention by explicitly launching competing operations and asserting their combined durable outcome, never through runner parallelism or scheduling.
+- Unit tests must not temporarily mutate process-global origin or proxy configuration, including `app.config.server.serve.protocol`, `app.config.server.serve.host`, and `app.proxy`. Model request-origin cases with an explicit `req` fixture, and use the established `AppUtil` loopback fallback for requestless local URLs. Do not introduce a broad origin lock to serialize such tests; retain narrowly scoped locks only for genuinely shared domain state.
 - Unit tests must delete every test-owned persisted resource in `finally`, using precise owned identities and reverse dependency order.
 - Shared durable test or local-development fixtures must be created through the owning module's `meta.version.ts` `seed()` hook and treated as read-only by tests; the managed seed path starts from a newly recreated database rather than repeating against one database.
 

package/README.md

@@ -4,7 +4,7 @@
 [![npm version](https://img.shields.io/npm/v/cabloy.svg?style=flat-square&label=cabloy)](https://www.npmjs.com/package/cabloy)
 [![npm downloads](https://img.shields.io/npm/dm/cabloy?color=orange&label=downloads)](https://www.npmjs.com/package/cabloy)
 [![Docs](https://img.shields.io/badge/docs-cabloy-4f46e5.svg?style=flat-square)](https://cabloy.com)
-[![Demo](https://img.shields.io/badge/demo-cabloy.com-059669.svg?style=flat-square)](https://cabloy.com)
+[![Demo](https://img.shields.io/badge/demo-cabloy.com-059669.svg?style=flat-square)](https://cabloy.com/demo)
 
 Cabloy is a Node.js fullstack framework for AI vibe coding, with AI Spec-Driven Development for traceable, evidence-backed delivery.
 
@@ -12,7 +12,7 @@ Cabloy is a Node.js fullstack framework for AI vibe coding, with AI Spec-Driven
 
 Instead of stitching separate backend and frontend stacks together, Cabloy keeps their contracts, tooling, and guidance connected in one repository. [AI Spec-Driven Development](https://cabloy.com/ai/ai-spec-driven-development) provides the disciplined path from confirmed Specs to evidence-backed delivery; its precise engineering method is Traceable Spec Delivery. Vona is its backend framework and runtime layer, and Zova is its frontend framework and application layer. Cabloy Basic and Cabloy Start are related, complete edition baselines built on that shared architecture; see [Editions Overview](https://cabloy.com/editions/overview) for their deliberate differences.
 
-[Documentation](https://cabloy.com) · [npm](https://www.npmjs.com/package/cabloy) · [Web Demo](https://cabloy.com) · [Admin Demo](https://cabloy.com/admin) · [GitHub](https://github.com/cabloy/cabloy)
+[Documentation](https://cabloy.com) · [npm](https://www.npmjs.com/package/cabloy) · [Demo](https://cabloy.com/demo) · [GitHub](https://github.com/cabloy/cabloy)
 
 ## Fullstack Principles
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.189",
+  "version": "5.1.191",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/repo-docs/.vitepress/config.mjs

@@ -245,6 +245,7 @@ export default defineConfig({
           { text: 'Frontend (Zova)', link: '/frontend/introduction', activeMatch: '^/frontend/' },
         ],
       },
+      { text: 'Demo', link: '/demo' },
       { text: 'Blogs', link: '/blogs/', activeMatch: '^/blogs/' },
       { text: 'Editions', link: '/editions/overview', activeMatch: '^/editions/' },
       { text: 'AI Development', link: '/ai/introduction', activeMatch: '^/ai/' },

package/repo-docs/demo.md

@@ -0,0 +1,12 @@
+---
+title: Demo
+---
+
+# Demo
+
+Explore the Cabloy demonstration sites:
+
+| Site       | URL                                                              |
+| ---------- | ---------------------------------------------------------------- |
+| Web site   | [https://demo.cabloy.com/](https://demo.cabloy.com/)             |
+| Admin site | [https://demo.cabloy.com/admin/](https://demo.cabloy.com/admin/) |

package/repo-docs/index.md

@@ -9,6 +9,9 @@ hero:
     - theme: brand
       text: Get Started
       link: /fullstack/quickstart
+    - theme: alt
+      text: Demo
+      link: /demo
     - theme: alt
       text: Editions
       link: /editions/overview

package/vona/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli",
-  "version": "1.1.155",
+  "version": "1.1.156",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli",
   "keywords": [

package/vona/packages-cli/cli-set-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli-set-api",
-  "version": "1.1.153",
+  "version": "1.1.154",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli-set-api",
   "keywords": [

package/vona/packages-cli/cli-set-api/toolsIsolate/test.ts

@@ -99,8 +99,8 @@ async function testRun(projectPath: string, coverage: boolean, patterns: string[
       .on('test:coverage', data => {
         outputCoverageReport(data.summary.totals);
       })
-      .on('test:pass', t => {
-        if (t.name === '---done---') {
+      .on('test:pass', data => {
+        if (data.nesting === 0 && data.name === '---done---') {
           void closeApplicationOnce();
         }
       });

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.100",
+  "version": "5.1.101",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/packages-vona/vona-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-core",
-  "version": "5.1.41",
+  "version": "5.1.42",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona",
   "keywords": [

package/vona/packages-vona/vona-core/src/lib/core/application.ts

@@ -72,10 +72,9 @@ export class VonaApplication extends KoaApplication {
     if (req) {
       request = req;
     } else {
-      const port = this.config?.server.listen.port ?? this.meta.env.SERVER_LISTEN_PORT;
-      const hostFallback = port ? `localhost:${port}` : 'localhost';
-      const protocol = (this.config ? this.util.protocol : undefined) || 'http';
-      const host = (this.config ? this.util.host : undefined) || hostFallback;
+      const protocol = 'http';
+      const port = this.meta.env.SERVER_LISTEN_PORT;
+      const host = port ? `localhost:${port}` : 'localhost';
       const hostname = new URL(`${protocol}://${host}`).hostname;
       request = {
         headers: {
@@ -89,12 +88,12 @@ export class VonaApplication extends KoaApplication {
         host,
         hostname,
         protocol,
-        secure: protocol === 'https',
+        secure: false,
         method: 'POST',
         url: '',
         path: '',
         socket: {
-          encrypted: protocol === 'https',
+          encrypted: false,
           remoteAddress: '127.0.0.1',
           remotePort: 7001,
         },

package/vona/packages-vona/vona-core/src/lib/utils/util.ts

@@ -61,12 +61,17 @@ export class AppUtil extends BeanSimple {
 
   get protocol() {
     const config = this.ctx ? this.ctx.config : this.app.config;
-    return config.server.serve.protocol || this.ctx?.protocol;
+    return config.server.serve.protocol || this.ctx?.protocol || 'http';
   }
 
   get host() {
     const config = this.ctx ? this.ctx.config : this.app.config;
-    return config.server.serve.host || this.ctx?.host;
+    let host = config.server.serve.host || this.ctx?.host;
+    if (!host) {
+      const port = this.app.meta.env.SERVER_LISTEN_PORT;
+      host = port ? `localhost:${port}` : 'localhost';
+    }
+    return host;
   }
 
   getAbsoluteUrl(path?: string) {

package/vona/packages-vona/vona-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-mock",
-  "version": "6.1.41",
+  "version": "6.1.42",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona mock",
   "keywords": [

package/vona/src/suite/a-commerce/modules/commerce-catalog/src/service/product.ts

@@ -17,11 +17,11 @@ import type { EntityProduct } from '../entity/product.tsx';
 import type { ModelProduct } from '../model/product.ts';
 
 const serializationRetryOptions = {
-  retries: 3,
-  factor: 1,
+  retries: 6,
+  factor: 2,
   minTimeout: 10,
-  maxTimeout: 10,
-  randomize: false,
+  maxTimeout: 160,
+  randomize: true,
   errorCodes: [
     '40001',
     'ER_LOCK_DEADLOCK',

package/vona/src/suite/a-commerce/modules/commerce-catalog/test/productContent.test.ts

@@ -243,7 +243,7 @@ describe('productContent.test.ts', { concurrency: false }, () => {
         return product.id;
       });
 
-      await Promise.all(
+      const results = await Promise.allSettled(
         markdowns.map(descriptionMarkdown =>
           runInMockCtx(async () => {
             await app.scope('commerce-catalog').service.product.update(productId, {
@@ -252,10 +252,17 @@ describe('productContent.test.ts', { concurrency: false }, () => {
           }),
         ),
       );
+      assert.deepEqual(
+        results.map(result => result.status),
+        ['fulfilled', 'fulfilled'],
+      );
 
       await runInMockCtx(async () => {
-        const stored = await app.scope('commerce-catalog').model.productContent.get({ productId });
-        assert.ok(stored);
+        const storeds = await app.scope('commerce-catalog').model.productContent.select({
+          where: { productId },
+        });
+        assert.equal(storeds.length, 1);
+        const stored = storeds[0]!;
         assert.ok(markdowns.includes(stored.descriptionMarkdown!));
         assert.equal(
           stored.descriptionHtml,

package/vona/src/suite/a-commerce/modules/commerce-payment/src/bean/payScene.commerceOrder.ts

@@ -23,7 +23,9 @@ import 'vona-module-a-ssr';
       input.candidate.clientName,
     );
     const server = _ctx.app.config.server.serve;
-    const hasPublicServer = !!(server.protocol && server.host);
+    const hasCallbackOrigin = _ctx.app.meta.isTest
+      ? !!(_ctx.app.util.protocol && _ctx.app.util.host)
+      : !!(server.protocol && server.host);
     if (input.candidate.key === 'paypal') {
       const options = clientOptions as IPayProviderPaypalClientOptions;
       return !!(
@@ -31,12 +33,12 @@ import 'vona-module-a-ssr';
         options.secretCredential.clientSecret &&
         options.webhookId &&
         options.merchantReference &&
-        hasPublicServer
+        hasCallbackOrigin
       );
     }
     if (input.candidate.key === 'stripe') {
       const options = clientOptions as IPayProviderStripeClientOptions;
-      return !!(options.secretCredential && options.secretWebhook && hasPublicServer);
+      return !!(options.secretCredential && options.secretWebhook && hasCallbackOrigin);
     }
     return false;
   },

package/vona/src/suite/a-home/modules/home-index/src/bean/meta.printTip.ts

@@ -8,7 +8,7 @@ export class MetaPrintTip extends BeanBase implements IMetaPrintTipExecute {
   async execute(): Promise<TypeMetaPrintTipResult> {
     return {
       title: 'home',
-      message: this.bean.core.getAbsoluteUrl(),
+      message: this.app.util.getAbsoluteUrl(),
     };
   }
 }

package/vona/src/suite/a-home/modules/home-user/test/accountPasswordReset.test.ts

@@ -248,38 +248,30 @@ describe('accountPasswordReset.test.ts', { concurrency: false }, () => {
     }
   });
 
-  it('uses the canonical host for an exact same-origin consumer without a whitelist entry', async () => {
+  it('uses the fallback origin for an exact same-origin consumer without a whitelist entry', async () => {
     let fixture: IAccountPasswordResetFixture | undefined;
     let restoreConfig: (() => void) | undefined;
-    let serve: typeof app.config.server.serve | undefined;
-    let servePrevious: { protocol?: string; host?: string } | undefined;
     try {
       fixture = await createFixture({ simpleAuth: true });
       restoreConfig = await configurePasswordReset([]);
-      await app.bean.executor.mockCtx(async () => {
-        serve = app.ctx.config.server.serve;
-        servePrevious = { ...serve };
-        (serve as any).host = 'canonical.example.test';
-      });
 
-      const sameOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.util.host}/home/user/password-reset`;
-      });
+      const port = app.meta.env.SERVER_LISTEN_PORT;
+      const fallbackOrigin = `http://${port ? `localhost:${port}` : 'localhost'}`;
+      const sameOriginConsumerUrl = `${fallbackOrigin}/home/user/password-reset`;
       const issued = await issuePasswordResetLink(fixture, sameOriginConsumerUrl);
-      assert.equal(issued.origin, new URL(sameOriginConsumerUrl).origin);
+      assert.equal(issued.origin, fallbackOrigin);
       assert.equal(issued.path, '/home/user/password-reset');
       assert.equal(issued.search, `?token=${issued.token}`);
 
       await clearPasswordResetState(fixture.userId);
       await clearPasswordResetRecipientCooldown(fixture.email);
-      const requestOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-reset`;
-      });
-      await requestPasswordReset(fixture.email, requestOriginConsumerUrl);
+      await requestPasswordReset(
+        fixture.email,
+        'https://request.example.test/home/user/password-reset',
+      );
       await assertNoPasswordResetState(fixture.userId);
       await assertNoPasswordResetRecipientCooldown(fixture.email);
     } finally {
-      if (serve && servePrevious) Object.assign(serve, servePrevious);
       restoreConfig?.();
       if (fixture) await removeFixture(fixture);
     }

package/vona/src/suite/a-home/modules/home-user/test/accountPasswordSet.test.ts

@@ -453,36 +453,28 @@ describe('accountPasswordSet.test.ts', { concurrency: false, sequential: true },
     }
   });
 
-  it('uses the canonical host for an exact same-origin consumer without a whitelist entry', async () => {
+  it('uses the fallback origin for an exact same-origin consumer without a whitelist entry', async () => {
     let fixture: IAccountPasswordSetFixture | undefined;
     let restoreConfig: (() => void) | undefined;
-    let serve: typeof app.config.server.serve | undefined;
-    let servePrevious: { protocol?: string; host?: string } | undefined;
     try {
       fixture = await createFixture();
       restoreConfig = await configurePasswordSet([]);
-      await app.bean.executor.mockCtx(async () => {
-        serve = app.ctx.config.server.serve;
-        servePrevious = { ...serve };
-        (serve as any).host = 'canonical.example.test';
-      });
 
-      const sameOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.util.host}/home/user/password-set`;
-      });
+      const port = app.meta.env.SERVER_LISTEN_PORT;
+      const fallbackOrigin = `http://${port ? `localhost:${port}` : 'localhost'}`;
+      const sameOriginConsumerUrl = `${fallbackOrigin}/home/user/password-set`;
       const issued = await issuePasswordSetLink(fixture, sameOriginConsumerUrl);
-      assert.equal(issued.origin, new URL(sameOriginConsumerUrl).origin);
+      assert.equal(issued.origin, fallbackOrigin);
       assert.equal(issued.path, '/home/user/password-set');
       assert.equal(issued.search, `?token=${issued.token}`);
 
       await clearPasswordSetState(fixture.userId);
-      const requestOriginConsumerUrl = await app.bean.executor.mockCtx(async () => {
-        return `${app.ctx.protocol}://${app.ctx.host}/home/user/password-set`;
-      });
-      await issuePasswordSetLinkRejected(fixture, requestOriginConsumerUrl);
+      await issuePasswordSetLinkRejected(
+        fixture,
+        'https://request.example.test/home/user/password-set',
+      );
       await assertNoPasswordSetState(fixture.userId);
     } finally {
-      if (serve && servePrevious) Object.assign(serve, servePrevious);
       restoreConfig?.();
       if (fixture) await removeFixture(fixture);
     }

package/vona/src/suite-vendor/a-auth/modules/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-auth",
-  "version": "5.1.24",
+  "version": "5.1.25",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-auth/modules/a-auth/src/controller/passport.ts

@@ -15,7 +15,7 @@ export class ControllerPassport extends BeanBase {
   @Aspect.guardGlobal('a-user:passport', { public: true })
   @Api.exclude()
   async callback() {
-    const code = this.ctx.query.code as string;
+    // const code = this.ctx.query.code as string;
     const stateQuery = this.ctx.query.state as string;
     if (!stateQuery) this.app.throw(403);
     const strategyState: IAuthenticateStrategyState = (await this.bean.jwt
@@ -23,7 +23,7 @@ export class ControllerPassport extends BeanBase {
       .verify(stateQuery)) as unknown as IAuthenticateStrategyState;
     return await this.bean.executor.newCtx(
       async () => {
-        this.ctx.request.query = { code, state: stateQuery };
+        // this.ctx.request.query = { code, state: stateQuery };
         return await this.scope.service.auth.authCallback(strategyState);
       },
       {
@@ -31,6 +31,8 @@ export class ControllerPassport extends BeanBase {
         tz: strategyState.tz,
         instanceName: strategyState.instanceName,
         instance: true,
+        req: this.ctx.req,
+        res: this.ctx.res,
       },
     );
   }