cabloy 5.1.193 → 5.1.194

package/.cabloy-version

@@ -1 +1 @@
-5.1.193
+5.1.194

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 5.1.194
+
+### Bug Fixes
+
+- Resolve lint errors in governance contract-loop hooks.
+
+### Improvements
+
+- Update controller-boundary tests.
+
+### Breaking Changes
+
+- Require explicit menu site bindings for SSR.
+
 ## 5.1.193
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.193",
+  "version": "5.1.194",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/repo-agent-governance/adapters/codex/contract-loop-gate.mjs

@@ -17,7 +17,7 @@ function runCodexHook() {
   const evaluated = evaluateCodexEditedFiles(ROOT, extractCodexEditedFiles(payload), payload.cwd);
   if (!evaluated.length) return 0;
   const message = evaluated.map(item => item.message).join('\n\n');
-  // eslint-disable-next-line
+  // eslint-disable-next-line no-console
   console.log(JSON.stringify(formatCodexHookOutput(message)));
   return 0;
 }

package/repo-agent-governance/adapters/cursor/contract-loop-gate.mjs

@@ -19,7 +19,7 @@ function runCursorHook() {
   if (!evaluated) return 0;
   const output = formatCursorHookOutput(evaluated.message, inferCursorHookEvent(payload));
   if (output) {
-    // eslint-disable-next-line
+    // eslint-disable-next-line no-console
     console.log(JSON.stringify(output));
   }
   return 0;

package/repo-agent-governance/managed-assets.json

@@ -592,7 +592,7 @@
     {
       "adapter": "codex",
       "category": "runtime",
-      "sha256": "3f3fcc1824f18bcdc2040d65932a47cb74b477ad21670dae957de61540af0154",
+      "sha256": "7d7bc4472cd7fdfa2a34193117a771445b3b2ac6fddb553c64050f7ae9cf01cc",
       "source": "adapters/codex/contract-loop-gate.mjs",
       "target": ".codex/hooks/contract-loop-gate.mjs"
     },
@@ -606,7 +606,7 @@
     {
       "adapter": "cursor",
       "category": "runtime",
-      "sha256": "da224fb581fde615273af8db4e2bfca513233a83e69a0803442dfec86bbd6ba6",
+      "sha256": "14ec4e6aaf57cd8cdc21b42b8ff865810d79a82f0927a4445b756e41c0e2438a",
       "source": "adapters/cursor/contract-loop-gate.mjs",
       "target": ".cursor/hooks/contract-loop-gate.mjs"
     },

package/repo-agent-governance/tests/governance.test.mjs

@@ -367,6 +367,38 @@ test('contract-loop recognizes supported vendor and suite source paths', () => {
   assert.equal(isCodeFile('/repo/repo-docs/ai/agent-governance.md'), false);
 });
 
+test('Codex patch headers preserve operations, moves, and paths with whitespace', () => {
+  const command = [
+    '*** Begin Patch',
+    '*** Add File:\t vona/src/module/demo/src/dto/new item.ts  ',
+    '*** Update File: vona/src/module/demo/src/service/old.ts',
+    '*** Move to:\t vona/src/module/demo/src/controller/moved item.ts \t',
+    '@@',
+    '+*** Delete File: not-a-header.ts',
+    '*** Delete File: vona/src/module/demo/src/dto/deleted.ts',
+    '*** End Patch',
+  ].join('\r\n');
+  assert.deepEqual(extractCodexEditedFiles({ tool_input: { command } }), [
+    { operation: 'add', filePath: 'vona/src/module/demo/src/dto/new item.ts' },
+    { operation: 'update', filePath: 'vona/src/module/demo/src/controller/moved item.ts' },
+    { operation: 'delete', filePath: 'vona/src/module/demo/src/dto/deleted.ts' },
+  ]);
+});
+
+test('Codex blank file headers do not consume subsequent patch lines', () => {
+  const command = [
+    '*** Add File:',
+    `*** Delete File:${' '.repeat(100_000)}`,
+    '*** Update File:\t ',
+    '*** Add File: vona/src/module/demo/src/dto/valid.ts',
+  ].join('\n');
+  assert.deepEqual(extractCodexEditedFiles({ tool_input: { command } }), [
+    { operation: 'add', filePath: 'vona/src/module/demo/src/dto/valid.ts' },
+  ]);
+  assert.deepEqual(extractCodexEditedFiles({}), []);
+  assert.deepEqual(extractCodexEditedFiles({ tool_input: { command: null } }), []);
+});
+
 test('Codex contract-loop adapter evaluates operation-aware apply_patch paths', () => {
   withFixture(root => {
     const sourcePath = resolve(root, 'vona/src/module/demo/src/controller/demo.ts');

package/repo-agent-governance/tools/contract-loop/hook-runtime.mjs

@@ -176,15 +176,16 @@ export function extractCodexEditedFiles(payload) {
   if (typeof command !== 'string') return [];
   const entries = [];
   let pendingUpdate = null;
-  const headerPattern =
-    /^\*\*\* (Add|Update|Delete) File:\s*(.+?)\s*$|^\*\*\* Move to:\s*(.+?)\s*$/gm;
+  const headerPattern = /^\*\*\* (Add|Update|Delete) File:(.+)$|^\*\*\* Move to:(.+)$/;
 
   const flushUpdate = () => {
     if (pendingUpdate) entries.push(pendingUpdate);
     pendingUpdate = null;
   };
 
-  for (const match of command.matchAll(headerPattern)) {
+  for (const line of command.split(/\r?\n/)) {
+    const match = headerPattern.exec(line);
+    if (!match) continue;
     const [, verb, sourcePath, destinationPath] = match;
     if (destinationPath !== undefined) {
       if (pendingUpdate) pendingUpdate.filePath = destinationPath.trim();

package/repo-docs/backend/menu-authorization.md

@@ -18,6 +18,7 @@ An SSR menu item can declare `roles` metadata:
     link: 'presetResource',
     roles: ['systemAdmin'],
   },
+  site: 'basic-siteadmin:admin',
 })
 ```
 

package/repo-docs/backend/menu-guide.md

@@ -57,9 +57,16 @@ In the current repo implementation, the out-of-the-box menu controller is public
 
 ## SSR Site targeting
 
-`@SsrMenu(...)` and `@SsrMenuGroup(...)` use `site` to select the SSR Site onion(s) that receive the declaration. It is a navigation-composition filter, not a site-admission, role-visibility, or backend-authorization decision.
+`@SsrMenu(...)` and `@SsrMenuGroup(...)` require an explicit `site` to select the SSR Site onion(s) that receive the declaration. It is a navigation-composition filter, not a site-admission, role-visibility, or backend-authorization decision.
 
-Use `site` for navigation owned by one SSR Site or deliberately exclusive to a known subset of sites:
+- Use a site string or an array of site strings to target known SSR Sites.
+- Omission, `undefined`, `null`, and empty or whitespace-only strings are invalid, including blank entries in an array.
+- `site: []` is valid and explicitly means no sites receive the declaration.
+- Sharing requires an explicit array of intended sites; there is no wildcard or implicit all-sites scope.
+- Menu and group declarations are independently scoped. A menu does not inherit its group's `site`; declare the intended sites on both.
+- `locale` remains optional: omitting it leaves the declaration unrestricted by locale.
+
+Use a single site string for navigation owned by one SSR Site:
 
 ```typescript
 @SsrMenu({
@@ -69,11 +76,11 @@ Use `site` for navigation owned by one SSR Site or deliberately exclusive to a k
     roles: ['systemAdmin'],
   },
   // This Basic Admin-owned entry intentionally targets one SSR Site.
-  site: ['basic-siteadmin:admin'],
+  site: 'basic-siteadmin:admin',
 })
 ```
 
-For a shared module declaration intended for every compatible SSR Admin site, omit `site`:
+For a shared module declaration, list every intended compatible SSR Admin site explicitly:
 
 ```typescript
 @SsrMenu({
@@ -82,11 +89,15 @@ For a shared module declaration intended for every compatible SSR Admin site, om
     link: 'presetResource',
     roles: ['systemAdmin'],
   },
-  // No `site`: the shared declaration is available to compatible SSR Admin sites.
+  // Share only with these explicitly selected SSR Sites.
+  site: ['basic-siteadmin:admin', 'commerce-siteadmin:commerceAdmin'],
 })
 ```
 
-Do not bind a shared Admin menu or menu group to the current/default Admin site merely to keep a new independent site's navigation narrow. Isolate an independent site through its enabled module composition and site-owned menus/groups. When a shared capability needs genuinely different navigation contracts per site, use an explicit, approved site-specific composition or owner instead of narrowing the shared declaration by default.
+Choose the site list from the intended navigation contract, not merely the current/default Admin site. Isolate an independent site through its enabled module composition and site-owned menus/groups. When a shared capability needs genuinely different navigation contracts per site, use an explicit, approved site-specific composition or owner.
+
+> [!WARNING]
+> This is a breaking change for declarations that previously omitted `site` to reach all sites. Migrate each menu and group to an explicit site string or array, or use `site: []` when it should reach no sites. Add future shared sites to the array deliberately; omission is no longer a sharing mechanism.
 
 `site` is distinct from a role's `siteIds`, menu `roles` or role-menu associations, and Passport/RBAC authorization:
 
@@ -140,6 +151,6 @@ When editing SSR menu behavior, ask:
 2. is there a default fallback menu that should remain available?
 3. does the menu contract belong in backend API design, frontend route design, or both?
 4. does the active edition affect the menu structure or public path assumptions?
-5. is this declaration site-owned or deliberately site-exclusive (specify `site`), or shared across compatible SSR Admin sites (omit `site`)?
+5. does every menu and group declare its own explicit `site` string or array, with all intended shared sites listed and `[]` used only when no sites should receive it?
 
 That helps AI keep menu behavior aligned with Cabloy’s shared SSR architecture.

package/repo-docs/blogs/cabloy-fullstack-resource-addressing/index.md

@@ -219,6 +219,7 @@ The Student SSR menu supplies that context:
       },
     },
   },
+  site: ['basic-siteadmin:admin'],
 })
 export class SsrMenuStudent extends BeanBase {}
 ```

package/repo-e2e/config/playwright.config.ts

@@ -21,7 +21,7 @@ export default defineConfig({
     : {
         command: 'node repo-e2e/scripts/startE2eVona.ts',
         cwd: E2E_ROOT_DIR,
-        url: `${baseURL}/`,
+        url: `${baseURL}/health/ready`,
         timeout: 180_000,
         reuseExistingServer: false,
         stdout: 'pipe',

package/repo-e2e/scripts/startE2eVona.ts

@@ -2,13 +2,17 @@ import type { ChildProcess } from 'node:child_process';
 
 import { spawn } from 'node:child_process';
 
-import { E2E_ROOT_DIR } from './e2e.ts';
+import { E2E_LOCAL_BASE_URL, E2E_ROOT_DIR } from './e2e.ts';
 
 const child: ChildProcess = spawn('npm', ['run', 'dev:one'], {
   cwd: E2E_ROOT_DIR,
   detached: process.platform !== 'win32',
   stdio: 'inherit',
-  env: process.env,
+  env: {
+    ...process.env,
+    SERVER_SERVE_PROTOCOL: 'http',
+    SERVER_SERVE_HOST: E2E_LOCAL_BASE_URL.replace(/^https?:\/\//, ''),
+  },
 });
 
 const gracefulShutdownTimeout = 7000;

package/repo-e2e/specs/controller-boundary.spec.ts

@@ -4,6 +4,29 @@ import { expect, test } from '@playwright/test';
 
 const probeErrorMessage = 'Controller boundary probe initialization failed';
 
+async function pauseProbeClock(page: Page) {
+  await page.clock.pauseAt(await page.evaluate(() => Date.now() + 60_000));
+  // Wait for __init__ to schedule its timer, not merely for the boundary timer to start.
+  const timers = await page.evaluateHandle(() => {
+    const scheduled: Record<number, number> = {};
+    window.setTimeout = new Proxy(window.setTimeout, {
+      apply(target, receiver, args) {
+        const delay = args[1];
+        scheduled[delay] = (scheduled[delay] ?? 0) + 1;
+        return Reflect.apply(target, receiver, args);
+      },
+    });
+    return scheduled;
+  });
+  return async (delay: number, action: () => Promise<unknown>) => {
+    const before = await timers.evaluate((scheduled, delay) => scheduled[delay] ?? 0, delay);
+    await action();
+    await expect
+      .poll(() => timers.evaluate((scheduled, delay) => scheduled[delay] ?? 0, delay))
+      .toBe(before + 1);
+  };
+}
+
 function collectPageErrors(page: Page) {
   const errors: Error[] = [];
   page.on('pageerror', error => {
@@ -26,6 +49,7 @@ test(
   'ATP-BASIC-CONTROLLER-BOUNDARY-01: global boundaries render loading, error, and recovery',
   { tag: ['@web', '@flow'] },
   async ({ page, request }) => {
+    await page.clock.install();
     const serverResponse = await request.get('/demo/basic/controllerBoundary');
     expect(serverResponse.ok()).toBeTruthy();
     const serverHtml = await serverResponse.text();
@@ -50,48 +74,63 @@ test(
     await expect(error).toHaveCount(0);
     await expect(ready).toHaveCount(0);
 
-    await page.getByRole('button', { name: 'Mount fast success probe', exact: true }).click();
-    await page.waitForTimeout(400);
+    const startProbe = await pauseProbeClock(page);
+    await startProbe(300, () =>
+      page.getByRole('button', { name: 'Mount fast success probe', exact: true }).click(),
+    );
+    await page.clock.runFor(400);
     await expect(loading).toHaveCount(0);
     await expect(ready).toBeVisible();
     await expect(error).toHaveCount(0);
 
-    await page.getByRole('button', { name: 'Mount fast failing probe', exact: true }).click();
-    await page.waitForTimeout(400);
+    await startProbe(300, () =>
+      page.getByRole('button', { name: 'Mount fast failing probe', exact: true }).click(),
+    );
+    await page.clock.runFor(400);
     await expect(error).toHaveText(probeErrorMessage);
     await expect(loading).toHaveCount(0);
     await expect(ready).toHaveCount(0);
 
-    const delayedSuccessLoading = loading.waitFor({ state: 'visible' });
-    await page.getByRole('button', { name: 'Mount delayed success probe', exact: true }).click();
-    await delayedSuccessLoading;
+    await startProbe(800, () =>
+      page.getByRole('button', { name: 'Mount delayed success probe', exact: true }).click(),
+    );
+    await page.clock.runFor(600);
+    await expect(loading).toBeVisible();
+    await page.clock.runFor(400);
     await expect(ready).toBeVisible();
     await expect(loading).toHaveCount(0);
     await expect(error).toHaveCount(0);
 
-    const failingProbeLoading = loading.waitFor({ state: 'visible' });
-    await page.getByRole('button', { name: 'Mount failing probe', exact: true }).click();
-    await failingProbeLoading;
+    await startProbe(800, () =>
+      page.getByRole('button', { name: 'Mount failing probe', exact: true }).click(),
+    );
+    await page.clock.runFor(600);
+    await expect(loading).toBeVisible();
     await expect.poll(() => loading.evaluate(element => element.tagName)).toBe('DIV');
+    await page.clock.runFor(400);
     await expect(error).toHaveText(probeErrorMessage);
     await expect.poll(() => error.evaluate(element => element.tagName)).toBe('DIV');
     await expect(ready).toHaveCount(0);
     const retry = page.getByRole('button', { name: 'Retry', exact: true });
     await expect(retry).toBeVisible();
 
-    const failedRetryLoading = loading.waitFor({ state: 'visible' });
-    await retry.click();
-    await failedRetryLoading;
+    await startProbe(800, () => retry.click());
+    await page.clock.runFor(600);
+    await expect(loading).toBeVisible();
+    await page.clock.runFor(400);
     await expect(error).toHaveText(probeErrorMessage);
     await expect(retry).toBeVisible();
 
     await page.getByRole('button', { name: 'Prepare probe retry success', exact: true }).click();
-    const successfulRetryLoading = loading.waitFor({ state: 'visible' });
-    await retry.evaluate(button => {
-      button.click();
-      button.click();
-    });
-    await successfulRetryLoading;
+    await startProbe(800, () =>
+      retry.evaluate(button => {
+        button.click();
+        button.click();
+      }),
+    );
+    await page.clock.runFor(600);
+    await expect(loading).toBeVisible();
+    await page.clock.runFor(400);
     await expect(ready).toBeVisible();
     await expect(loading).toHaveCount(0);
     await expect(error).toHaveCount(0);
@@ -105,6 +144,7 @@ test(
   'ATP-BASIC-CONTROLLER-BOUNDARY-06: disposed and stale loads do not surface errors',
   { tag: ['@web', '@flow'] },
   async ({ page }) => {
+    await page.clock.install();
     const pageErrors = collectPageErrors(page);
     const consoleErrors = collectConsoleErrors(page);
     const response = await page.goto('/demo/basic/controllerBoundary', { waitUntil: 'load' });
@@ -116,21 +156,29 @@ test(
     const error = page.locator('.alert.alert-error');
     const ready = page.getByText('Controller boundary probe ready', { exact: true });
 
-    const disposedLoading = loading.waitFor({ state: 'visible' });
-    await page.getByRole('button', { name: 'Mount failing probe', exact: true }).click();
-    await disposedLoading;
+    const startProbe = await pauseProbeClock(page);
+    await startProbe(800, () =>
+      page.getByRole('button', { name: 'Mount failing probe', exact: true }).click(),
+    );
+    await page.clock.runFor(600);
+    await expect(loading).toBeVisible();
     await page.getByRole('button', { name: 'Clear probe', exact: true }).click();
-    await page.waitForTimeout(1_000);
+    await page.clock.runFor(1_000);
     await expect(loading).toHaveCount(0);
     await expect(error).toHaveCount(0);
     await expect(ready).toHaveCount(0);
 
-    const staleLoading = loading.waitFor({ state: 'visible' });
-    await page.getByRole('button', { name: 'Mount failing probe', exact: true }).click();
-    await staleLoading;
-    await page.getByRole('button', { name: 'Mount fast success probe', exact: true }).click();
+    await startProbe(800, () =>
+      page.getByRole('button', { name: 'Mount failing probe', exact: true }).click(),
+    );
+    await page.clock.runFor(600);
+    await expect(loading).toBeVisible();
+    await startProbe(300, () =>
+      page.getByRole('button', { name: 'Mount fast success probe', exact: true }).click(),
+    );
+    await page.clock.runFor(1_000);
     await expect(ready).toBeVisible();
-    await page.waitForTimeout(1_000);
+    await page.clock.runFor(1_000);
     await expect(error).toHaveCount(0);
     await expect(ready).toBeVisible();
 

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.101",
+  "version": "5.1.102",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-ssr",
-  "version": "5.1.33",
+  "version": "5.1.34",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/src/lib/beanSsrSiteBase.ts

@@ -36,6 +36,7 @@ import { ServiceDevProxy } from '../service/devProxy.ts';
 import { ServiceSsrHandler } from '../service/ssrHandler.ts';
 import { SymbolCacheMenus } from './const.ts';
 import { checkSsrBinding } from './ssrMenuEligibility.ts';
+import { validateSsrMenuSite } from './ssrMenuSite.ts';
 import {
   projectPublicSsrMenuGroups,
   projectPublicSsrMenus,
@@ -360,6 +361,7 @@ export class BeanSsrSiteBase<
     for (const ssrMenu of ssrMenus) {
       const siteMenuOptions = ssrMenu.beanOptions
         .options as IDecoratorSsrMenuOptions<IDecoratorSsrSiteOptions>;
+      validateSsrMenuSite(siteMenuOptions?.site, ssrMenu.beanOptions.beanFullName || ssrMenu.name);
       if (!checkSsrBinding(siteOnionName, siteMenuOptions.site)) continue;
       if (!checkSsrBinding(locale, siteMenuOptions.locale)) continue;
       const menusFrom =

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/src/lib/ssrMenu.ts

@@ -1,7 +1,13 @@
-import { createBeanDecorator } from 'vona';
+import { appResource, createBeanDecorator } from 'vona';
 
 import type { IDecoratorSsrMenuOptions } from '../types/ssrMenu.ts';
 
-export function SsrMenu<T extends IDecoratorSsrMenuOptions<any>>(options?: T): ClassDecorator {
-  return createBeanDecorator('ssrMenu', options);
+import { validateSsrMenuSite } from './ssrMenuSite.ts';
+
+export function SsrMenu<T extends IDecoratorSsrMenuOptions<any>>(options: T): ClassDecorator {
+  validateSsrMenuSite(options?.site, 'SsrMenu');
+  return createBeanDecorator('ssrMenu', options, false, target => {
+    const beanOptions = appResource.getBean(target)!;
+    validateSsrMenuSite((beanOptions.options as T).site, beanOptions.beanFullName);
+  });
 }

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/src/lib/ssrMenuEligibility.ts

@@ -9,6 +9,8 @@ import type {
 import type { IDecoratorSsrMenuGroupOptions, ISsrMenuGroupRecord } from '../types/ssrMenuGroup.ts';
 import type { IDecoratorSsrSiteOptions } from '../types/ssrSite.ts';
 
+import { validateSsrMenuSite } from './ssrMenuSite.ts';
+
 export function checkSsrBinding<T>(expect: T, target: T | T[] | null | ''): boolean {
   if (target === undefined || target === null || target === '') return true;
   if (Array.isArray(target)) return target.some(item => item === expect);
@@ -20,6 +22,12 @@ export function resolveSsrMenuCatalog(
   ssrMenus: IOnionSlice<ISsrMenuRecord, keyof ISsrMenuRecord, unknown>[],
   ssrMenuGroups: IOnionSlice<ISsrMenuGroupRecord, keyof ISsrMenuGroupRecord, unknown>[] = [],
 ): ISsrMenuCatalog {
+  for (const ssrMenu of [...ssrMenus, ...ssrMenuGroups]) {
+    const options = ssrMenu.beanOptions.options as
+      | IDecoratorSsrMenuOptions<IDecoratorSsrSiteOptions>
+      | undefined;
+    validateSsrMenuSite(options?.site, ssrMenu.beanOptions.beanFullName || ssrMenu.name);
+  }
   const menus: ISsrMenuCatalog['menus'] = [];
   const groups: ISsrMenuCatalog['groups'] = [];
   for (const { ssrSiteName } of sites) {
@@ -87,6 +95,12 @@ export function resolveSsrMenuEligibility(
   ssrMenuName: string,
   ssrMenus: IOnionSlice<ISsrMenuRecord, keyof ISsrMenuRecord, unknown>[],
 ): ISsrMenuEligibility | undefined {
+  for (const ssrMenu of ssrMenus) {
+    const options = ssrMenu.beanOptions.options as
+      | IDecoratorSsrMenuOptions<IDecoratorSsrSiteOptions>
+      | undefined;
+    validateSsrMenuSite(options?.site, ssrMenu.beanOptions.beanFullName || ssrMenu.name);
+  }
   for (const ssrMenu of ssrMenus) {
     const options = ssrMenu.beanOptions.options as
       | IDecoratorSsrMenuOptions<IDecoratorSsrSiteOptions>

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/src/lib/ssrMenuGroup.ts

@@ -1,9 +1,15 @@
-import { createBeanDecorator } from 'vona';
+import { appResource, createBeanDecorator } from 'vona';
 
 import type { IDecoratorSsrMenuGroupOptions } from '../types/ssrMenuGroup.ts';
 
+import { validateSsrMenuSite } from './ssrMenuSite.ts';
+
 export function SsrMenuGroup<T extends IDecoratorSsrMenuGroupOptions<any>>(
-  options?: T,
+  options: T,
 ): ClassDecorator {
-  return createBeanDecorator('ssrMenuGroup', options);
+  validateSsrMenuSite(options?.site, 'SsrMenuGroup');
+  return createBeanDecorator('ssrMenuGroup', options, false, target => {
+    const beanOptions = appResource.getBean(target)!;
+    validateSsrMenuSite((beanOptions.options as T).site, beanOptions.beanFullName);
+  });
 }

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/src/lib/ssrMenuSite.ts

@@ -0,0 +1,10 @@
+export function validateSsrMenuSite(
+  site: unknown,
+  name: string,
+): asserts site is string | string[] {
+  const isSiteName = (value: unknown) => typeof value === 'string' && !!value.trim();
+  if (Array.isArray(site) ? [...site].every(isSiteName) : isSiteName(site)) return;
+  throw new TypeError(
+    `Should explicitly specify site for ${name}: use an SSR site name or an array of non-empty site names ([] means no sites)`,
+  );
+}

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/src/types/ssrMenu.ts

@@ -96,7 +96,7 @@ export interface IDecoratorSsrMenuOptions<
 > extends IOnionOptionsEnable {
   item?: ISsrMenuItem<SsrSiteOptions['pages'], SsrSiteOptions['icons']>;
   items?: Record<string, ISsrMenuItem<SsrSiteOptions['pages'], SsrSiteOptions['icons']>>;
-  site?: keyof ISsrSiteRecord | (keyof ISsrSiteRecord)[];
+  site: keyof ISsrSiteRecord | (keyof ISsrSiteRecord)[];
   locale?: keyof ILocaleRecord | (keyof ILocaleRecord)[];
 }
 

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/src/types/ssrMenuGroup.ts

@@ -17,7 +17,7 @@ export interface IDecoratorSsrMenuGroupOptions<
   SsrSiteOptions extends IDecoratorSsrSiteOptions,
 > extends IOnionOptionsEnable {
   item?: ISsrMenuGroup<SsrSiteOptions['icons']>;
-  site?: keyof ISsrSiteRecord | (keyof ISsrSiteRecord)[];
+  site: keyof ISsrSiteRecord | (keyof ISsrSiteRecord)[];
   locale?: keyof ILocaleRecord | (keyof ILocaleRecord)[];
 }
 

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/test/ssrMenuEligibility.test.ts

@@ -10,9 +10,10 @@ import {
 function createMenus() {
   return [
     {
-      name: 'test:omitted',
+      name: 'test:shared',
       beanOptions: {
         options: {
+          site: ['test:admin', 'test:web'],
           item: { roles: [] },
           locale: ['en-us'],
         },
@@ -31,14 +32,16 @@ function createMenus() {
       },
     },
     {
-      name: 'test:malformed',
-      beanOptions: {},
+      name: 'test:unbound',
+      beanOptions: {
+        options: { site: [], item: { roles: [] } },
+      },
     },
   ] as any;
 }
 
 describe('ssrMenuEligibility.test.ts', () => {
-  it('matches unset, scalar, or array bindings', () => {
+  it('preserves optional locale matching and scalar or array bindings', () => {
     assert.equal(checkSsrBinding('test:admin', undefined), true);
     assert.equal(checkSsrBinding('test:admin', null), true);
     assert.equal(checkSsrBinding('test:admin', ''), true);
@@ -64,8 +67,8 @@ describe('ssrMenuEligibility.test.ts', () => {
     assert.deepEqual(catalog.menus, [
       {
         ssrSiteName: 'test:admin',
-        ssrMenuName: 'test:omitted',
-        onionName: 'test:omitted',
+        ssrMenuName: 'test:shared',
+        onionName: 'test:shared',
         roles: [],
       },
       {
@@ -82,8 +85,8 @@ describe('ssrMenuEligibility.test.ts', () => {
       },
       {
         ssrSiteName: 'test:web',
-        ssrMenuName: 'test:omitted',
-        onionName: 'test:omitted',
+        ssrMenuName: 'test:shared',
+        onionName: 'test:shared',
         roles: [],
       },
       {
@@ -103,18 +106,75 @@ describe('ssrMenuEligibility.test.ts', () => {
 
   it('resolves final leaves independently of locale', () => {
     const menus = createMenus();
-    assert.deepEqual(resolveSsrMenuEligibility('test:admin', 'test:omitted', menus), {
+    assert.deepEqual(resolveSsrMenuEligibility('test:admin', 'test:shared', menus), {
       ssrSiteName: 'test:admin',
-      ssrMenuName: 'test:omitted',
+      ssrMenuName: 'test:shared',
       rolesDefined: true,
     });
-    assert.deepEqual(resolveSsrMenuEligibility('test:web', 'test:omitted', menus), {
+    assert.deepEqual(resolveSsrMenuEligibility('test:web', 'test:shared', menus), {
       ssrSiteName: 'test:web',
-      ssrMenuName: 'test:omitted',
+      ssrMenuName: 'test:shared',
       rolesDefined: true,
     });
   });
 
+  it('rejects invalid menu and group sites before catalog partitioning or eligibility lookup', () => {
+    const sites = [{ ssrSiteName: 'test:admin', title: 'Admin' }];
+    for (const site of [undefined, null, '', '  ', [''], ['test:admin', null]]) {
+      const invalid = [{ name: 'test:invalid', beanOptions: { options: { site } } }] as any;
+      assert.throws(() => resolveSsrMenuCatalog(sites, invalid), /site for test:invalid/);
+      assert.throws(() => resolveSsrMenuCatalog([], [], invalid), /site for test:invalid/);
+      assert.throws(
+        () =>
+          resolveSsrMenuEligibility('test:admin', 'test:shared', [...createMenus(), ...invalid]),
+        /site for test:invalid/,
+      );
+    }
+    const missing = [{ name: 'test:missingOptions', beanOptions: {} }] as any;
+    assert.throws(() => resolveSsrMenuCatalog(sites, missing), /site for test:missingOptions/);
+    assert.throws(
+      () => resolveSsrMenuEligibility('test:admin', 'test:missing', missing),
+      /site for test:missingOptions/,
+    );
+  });
+
+  it('partitions scalar and shared groups and accepts empty menu or group site arrays', () => {
+    const groups = [
+      { name: 'test:adminGroup', beanOptions: { options: { site: 'test:admin', item: {} } } },
+      {
+        name: 'test:sharedGroup',
+        beanOptions: { options: { site: ['test:admin', 'test:web'], item: {} } },
+      },
+      { name: 'test:unboundGroup', beanOptions: { options: { site: [], item: {} } } },
+    ] as any;
+    const catalog = resolveSsrMenuCatalog(
+      [
+        { ssrSiteName: 'test:admin', title: 'Admin' },
+        { ssrSiteName: 'test:web', title: 'Web' },
+        { ssrSiteName: 'test:future', title: 'Future' },
+      ],
+      createMenus(),
+      groups,
+    );
+    assert.deepEqual(
+      catalog.groups.map(group => [group.ssrSiteName, group.ssrMenuGroupName]),
+      [
+        ['test:admin', 'test:adminGroup'],
+        ['test:admin', 'test:sharedGroup'],
+        ['test:web', 'test:sharedGroup'],
+      ],
+    );
+    assert.equal(
+      catalog.menus.some(menu => menu.ssrMenuName === 'test:unbound'),
+      false,
+    );
+    assert.equal(
+      catalog.menus.some(menu => menu.ssrSiteName === 'test:future'),
+      false,
+    );
+    assert.equal(resolveSsrMenuEligibility('test:web', 'test:unbound', createMenus()), undefined);
+  });
+
   it('distinguishes dynamic/static leaves from public leaves and exact keyed names', () => {
     const menus = createMenus();
     assert.deepEqual(resolveSsrMenuEligibility('test:admin', 'test:keyed#static', menus), {
@@ -130,6 +190,6 @@ describe('ssrMenuEligibility.test.ts', () => {
     assert.equal(resolveSsrMenuEligibility('test:admin', 'test:keyed', menus), undefined);
     assert.equal(resolveSsrMenuEligibility('test:other', 'test:keyed#static', menus), undefined);
     assert.equal(resolveSsrMenuEligibility('test:admin', 'test:missing', menus), undefined);
-    assert.equal(resolveSsrMenuEligibility('test:admin', 'test:malformed', menus), undefined);
+    assert.equal(resolveSsrMenuEligibility('test:admin', 'test:unbound', menus), undefined);
   });
 });

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/test/ssrMenuSite.test.ts

@@ -0,0 +1,90 @@
+import assert from 'node:assert';
+import { describe, it } from 'node:test';
+
+import type { IDecoratorSsrMenuOptions } from '../src/types/ssrMenu.ts';
+import type { IDecoratorSsrMenuGroupOptions } from '../src/types/ssrMenuGroup.ts';
+import type { IDecoratorSsrSiteOptions } from '../src/types/ssrSite.ts';
+
+import { BeanSsrSiteBase } from '../src/lib/beanSsrSiteBase.ts';
+import { SsrMenu } from '../src/lib/ssrMenu.ts';
+import { SsrMenuGroup } from '../src/lib/ssrMenuGroup.ts';
+import { validateSsrMenuSite } from '../src/lib/ssrMenuSite.ts';
+
+function checkSiteTypes() {
+  // @ts-expect-error SSR menus must explicitly bind a site
+  const menu: IDecoratorSsrMenuOptions<IDecoratorSsrSiteOptions> = { item: {} };
+  // @ts-expect-error SSR menu groups must explicitly bind a site
+  const group: IDecoratorSsrMenuGroupOptions<IDecoratorSsrSiteOptions> = { item: {} };
+  // @ts-expect-error SSR menu decorator options are required
+  SsrMenu();
+  // @ts-expect-error SSR menu group decorator options are required
+  SsrMenuGroup();
+  return { menu, group };
+}
+void checkSiteTypes;
+
+function prepareMenus(options: unknown, locale = 'en-us') {
+  const owner = {
+    $onionName: 'test:admin',
+    $scope: { ssr: { service: { ssr: { prepareMenuLink: (link: unknown) => link } } } },
+  };
+  return (BeanSsrSiteBase.prototype as any)._prepareMenusOrGroups.call(owner, locale, [
+    { name: 'test:menu', beanOptions: { options } },
+  ]);
+}
+
+describe('ssrMenuSite.test.ts', () => {
+  it('requires explicit nonblank sites in both decorators, including array entries', () => {
+    for (const site of [
+      undefined,
+      null,
+      '',
+      ' \t ',
+      1,
+      false,
+      {},
+      [''],
+      ['test:admin', undefined],
+      Array.from({ length: 1 }),
+    ]) {
+      assert.throws(() => validateSsrMenuSite(site, 'test:menu'), /site for test:menu/);
+      assert.throws(() => SsrMenu({ site } as any), /site for SsrMenu/);
+      assert.throws(() => SsrMenuGroup({ site } as any), /site for SsrMenuGroup/);
+    }
+    assert.throws(() => SsrMenu(undefined as any), /explicitly specify site/);
+    assert.throws(() => SsrMenu({} as any), /explicitly specify site/);
+    assert.throws(() => SsrMenuGroup(undefined as any), /explicitly specify site/);
+    assert.throws(() => SsrMenuGroup({} as any), /explicitly specify site/);
+  });
+
+  it('accepts scalar sites, explicit sharing, and empty arrays without changing their values', () => {
+    for (const site of ['test:admin', ['test:admin', 'test:web'], []]) {
+      assert.doesNotThrow(() => validateSsrMenuSite(site, 'test:menu'));
+      assert.equal(typeof SsrMenu({ site } as any), 'function');
+      assert.equal(typeof SsrMenuGroup({ site } as any), 'function');
+    }
+  });
+
+  it('validates effective options before rendered menu site or locale filtering', () => {
+    for (const site of [undefined, null, '', '  ', ['']]) {
+      assert.throws(
+        () => prepareMenus({ site, locale: ['zh-cn'], item: {} }),
+        /site for test:menu/,
+      );
+    }
+    assert.throws(() => prepareMenus(undefined), /site for test:menu/);
+  });
+
+  it('preserves optional locale behavior and renders only explicitly bound menus or groups', () => {
+    const expected = [
+      { name: 'test:menu', title: undefined, description: undefined, link: undefined },
+    ];
+    assert.deepEqual(prepareMenus({ site: 'test:admin', item: {} }), expected);
+    assert.deepEqual(prepareMenus({ site: ['test:admin', 'test:web'], item: {} }), expected);
+    assert.deepEqual(prepareMenus({ site: [], item: {} }), []);
+    assert.deepEqual(prepareMenus({ site: 'test:web', item: {} }), []);
+    assert.deepEqual(prepareMenus({ site: 'test:admin', locale: ['zh-cn'], item: {} }), []);
+    assert.deepEqual(prepareMenus({ site: 'test:admin', locale: ['en-us'], item: {} }), expected);
+    assert.deepEqual(prepareMenus({ site: 'test:admin', locale: [], item: {} }), []);
+  });
+});

package/vona/src/suite-vendor/a-cabloy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-cabloy",
-  "version": "5.1.57",
+  "version": "5.1.58",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/vona/src/suite-vendor/a-vona/modules/a-error/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-error",
-  "version": "5.1.13",
+  "version": "5.1.14",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-error/src/lib/onerror.ts

@@ -50,6 +50,15 @@ export function onerror(app: VonaApplication, options?: OnerrorOptions) {
       return;
     }
 
+    // A disconnected request can become unreadable before the body parser observes its abort.
+    if (
+      this.req?.aborted &&
+      !this.writable &&
+      ['request.aborted', 'stream.not.readable'].includes(err.type)
+    ) {
+      return;
+    }
+
     // ignore all padding request stream
     if (this.req) {
       sendToWormhole(this.req);

package/vona/src/suite-vendor/a-vona/modules/a-error/test/onerror.test.ts

@@ -0,0 +1,92 @@
+import type { VonaApplication } from 'vona';
+
+import assert from 'node:assert';
+import { PassThrough } from 'node:stream';
+import { describe, it } from 'node:test';
+
+import { onerror } from '../src/lib/onerror.ts';
+
+function createFixture(aborted: boolean, writable: boolean) {
+  const logged: Error[] = [];
+  const responses: unknown[] = [];
+  const app = { context: {} } as VonaApplication;
+  const options = {
+    all(_err: Error, ctx: any) {
+      ctx.body = 'error response';
+    },
+    log(err: Error) {
+      logged.push(err);
+    },
+  };
+  onerror(app, options);
+  const req = Object.assign(new PassThrough(), { aborted });
+  req.destroy();
+  const ctx = Object.assign(Object.create(app.context), {
+    req,
+    writable,
+    headerSent: false,
+    res: {
+      end(body: unknown) {
+        responses.push(body);
+      },
+    },
+    set() {},
+    accepts() {
+      return 'text';
+    },
+  });
+  return { ctx, logged, responses };
+}
+
+function createBodyError(type: string, status: number) {
+  return Object.assign(new Error(type), { type, status });
+}
+
+describe('onerror.test.ts', () => {
+  for (const [type, status] of [
+    ['stream.not.readable', 500],
+    ['request.aborted', 400],
+  ] as const) {
+    it(`ignores ${type} only for an aborted, unwritable request`, async () => {
+      const { ctx, logged, responses } = createFixture(true, false);
+      await ctx.onerror(createBodyError(type, status));
+      assert.deepEqual(logged, []);
+      assert.deepEqual(responses, []);
+    });
+
+    it(`keeps ${type} visible without confirmed request abortion`, async () => {
+      const { ctx, logged, responses } = createFixture(false, false);
+      const error = createBodyError(type, status);
+      await ctx.onerror(error);
+      assert.deepEqual(logged, [error]);
+      assert.equal(Reflect.get(error, 'headerSent'), true);
+      assert.deepEqual(responses, []);
+    });
+
+    it(`preserves ${type} handling while the response is writable`, async () => {
+      const { ctx, logged, responses } = createFixture(true, true);
+      const error = createBodyError(type, status);
+      await ctx.onerror(error);
+      assert.deepEqual(logged, [error]);
+      assert.equal(ctx.status, status);
+      assert.deepEqual(responses, ['error response']);
+    });
+  }
+
+  it('does not hide unrelated application errors on aborted requests', async () => {
+    const { ctx, logged, responses } = createFixture(true, false);
+    const error = new Error('application failure');
+    await ctx.onerror(error);
+    assert.deepEqual(logged, [error]);
+    assert.deepEqual(responses, []);
+  });
+
+  it('preserves body parsing errors on a writable request', async () => {
+    const { ctx, logged, responses } = createFixture(false, true);
+    const error = createBodyError('entity.parse.failed', 400);
+    await ctx.onerror(error);
+    assert.deepEqual(logged, [error]);
+    assert.equal(ctx.status, 400);
+    assert.deepEqual(responses, ['error response']);
+  });
+});

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.92",
+  "version": "5.1.93",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",