cabloy 5.1.203 → 5.1.205

package/vona/packages-vona/vona-core/src/lib/core/testIsolation.ts

@@ -0,0 +1,129 @@
+import fse from 'fs-extra';
+import { createHash } from 'node:crypto';
+import { lstatSync } from 'node:fs';
+import path from 'node:path';
+
+export const TEST_RUN_ID_ENV = 'VONA_TEST_RUN_ID';
+export const TEST_RUN_OWNER_FILE = '.vona-test-owner';
+
+const DATABASE_NAME_MAX_BYTES = 63;
+const APP_NAME_MAX_BYTES = 13;
+const HASH_LENGTH = 10;
+const TIMESTAMP_LENGTH = 15;
+
+export function getDatabaseTestPrefix(appName: string, scope: string): string {
+  const readablePrefix =
+    scope === 'share'
+      ? `vona-test-${appName}-s-`
+      : `vona-test-${appName}-i-${scope.slice('isolate-'.length)}-`;
+  if (Buffer.byteLength(readablePrefix, 'utf8') + TIMESTAMP_LENGTH <= DATABASE_NAME_MAX_BYTES) {
+    return readablePrefix;
+  }
+  let appHead = '';
+  for (const char of appName) {
+    if (Buffer.byteLength(`${appHead}${char}`, 'utf8') > APP_NAME_MAX_BYTES) break;
+    appHead += char;
+  }
+  const scopeKind = scope === 'share' ? 's' : 'i';
+  const namespaceHash = createHash('sha256')
+    .update(`${appName}\0${scope}`)
+    .digest('base64url')
+    .slice(0, HASH_LENGTH);
+  return `vona-test-${appHead}-${scopeKind}-${namespaceHash}-`;
+}
+
+export function assertDisposableDatabaseName(databaseName: string, databasePrefix: string) {
+  if (
+    typeof databaseName !== 'string' ||
+    !databaseName.startsWith(databasePrefix) ||
+    !/^\d{8}-\d{6}$/.test(databaseName.slice(databasePrefix.length)) ||
+    Buffer.byteLength(databaseName, 'utf8') > DATABASE_NAME_MAX_BYTES
+  ) {
+    throw new Error(`Database is outside the disposable namespace: ${databaseName}`);
+  }
+}
+
+export function resolveTestRunId(
+  mode: string,
+  runId: string | undefined = process.env[TEST_RUN_ID_ENV],
+) {
+  if (runId === undefined) return undefined;
+  const match = /^(\d{14})-[a-f0-9]{8}$/.exec(runId);
+  const timestamp = match?.[1];
+  const date = timestamp
+    ? new Date(
+        `${timestamp.slice(0, 4)}-${timestamp.slice(4, 6)}-${timestamp.slice(6, 8)}T${timestamp.slice(8, 10)}:${timestamp.slice(10, 12)}:${timestamp.slice(12, 14)}Z`,
+      )
+    : undefined;
+  if (
+    mode !== 'test' ||
+    !timestamp ||
+    !date ||
+    Number.isNaN(date.getTime()) ||
+    date.toISOString().slice(0, 19).replace(/[-:T]/g, '') !== timestamp
+  ) {
+    throw new Error(
+      `${TEST_RUN_ID_ENV} requires test mode and a UTC timestamp plus eight hex digits`,
+    );
+  }
+  return runId;
+}
+
+export function getTestAppName(runId: string) {
+  resolveTestRunId('test', runId);
+  return `cabtest${runId}`;
+}
+
+export function assertTestAppIdentity(mode: string, runId: string | undefined, appName: string) {
+  const id = resolveTestRunId(mode, runId);
+  if (id && appName !== getTestAppName(id)) {
+    throw new Error('Isolated test APP_NAME does not match its run ID');
+  }
+  return id;
+}
+
+export function getTestRunIdFromEnv(env: NodeJS.ProcessEnv) {
+  return resolveTestRunId(env.META_MODE, env[TEST_RUN_ID_ENV]);
+}
+
+export function assertTestRunOwner(root: string, runId: string) {
+  resolveTestRunId('test', runId);
+  let current = path.resolve(root);
+  while (true) {
+    try {
+      if (lstatSync(current).isSymbolicLink()) {
+        throw new Error(`Isolated test path traverses a symlink: ${current}`);
+      }
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  const marker = path.join(root, TEST_RUN_OWNER_FILE);
+  if (!fse.lstatSync(marker).isFile() || fse.readFileSync(marker, 'utf8') !== `${runId}\n`) {
+    throw new Error(`Isolated test directory has no matching owner: ${root}`);
+  }
+}
+
+export function resolveVonaLocalPaths(
+  projectPath: string,
+  mode: string,
+  runId: string | undefined = process.env[TEST_RUN_ID_ENV],
+) {
+  const id = resolveTestRunId(mode, runId);
+  const generatedDir = id ? `.vona-test-${id}` : '.vona';
+  const dataDir = id ? `.app-test-${id}` : '.app';
+  return {
+    runId: id,
+    generatedDir,
+    dataDir,
+    generatedRoot: path.join(projectPath, generatedDir),
+    dataRoot: path.join(projectPath, dataDir),
+    publicRoot: path.join(projectPath, dataDir, 'public'),
+    runtimeRoot: path.join(projectPath, dataDir, 'runtime'),
+    logsRoot: path.join(projectPath, dataDir, 'logs'),
+    sqliteRoot: path.join(projectPath, dataDir, 'sqlite3'),
+  };
+}

package/vona/packages-vona/vona-core/src/lib/framework/createApp.ts

@@ -5,6 +5,7 @@ import type { BootstrapOptions } from '../../types/interface/bootstrap.ts';
 import type { VonaConfigEnv } from '../../types/utils/env.ts';
 
 import { VonaApplication } from '../core/application.ts';
+import { assertTestAppIdentity } from '../core/testIsolation.ts';
 import { jsxEnhance } from '../utils/jsx-enhance.ts';
 import { prepareEnv } from '../utils/util.ts';
 import { zodEnhance } from '../utils/zod-enhance.ts';
@@ -54,6 +55,7 @@ function __createApp({ modulesMeta, locales, config, env, AppMonkey }: Bootstrap
   jsxEnhance();
   // env
   const env2 = prepareEnv(env);
+  assertTestAppIdentity(env2.META_MODE, env2.VONA_TEST_RUN_ID, env2.APP_NAME ?? '');
   // appInfo
   const appInfo = prepareAppInfo(env2);
   // options

package/vona/packages-vona/vona-core/src/lib/framework/start.ts

@@ -2,6 +2,8 @@ import type { VonaConfig, VonaConfigOptional } from '../../types/index.ts';
 import type { VonaApplication } from '../core/application.ts';
 
 import { EnumAppEvent } from '../../types/index.ts';
+import { assertIsolatedTestConfig } from '../core/isolationGuard.ts';
+import { registerTestClaimResourceInventory } from '../core/testClaim.ts';
 import { ModuleLoader } from '../module/loader.ts';
 import { deepExtend } from '../utils/util.ts';
 
@@ -65,6 +67,8 @@ export class Start {
     // config
     const appConfig = await __prepareConfig(app);
     this.app.config = appConfig as VonaConfig;
+    assertIsolatedTestConfig(app);
+    await registerTestClaimResourceInventory(app);
     this.app.keys = appConfig.server!.keys!;
     this.app.proxy = appConfig.proxy!.enable!;
     this.app.subdomainOffset = appConfig.server!.subdomainOffset!;

package/vona/packages-vona/vona-core/src/lib/framework/useApp.ts

@@ -3,6 +3,7 @@ import path from 'node:path';
 
 import type { VonaApplication } from '../core/application.ts';
 
+import { resolveVonaLocalPaths } from '../core/testIsolation.ts';
 import { pathToHref } from '../utils/util.ts';
 
 export function useApp(): VonaApplication {
@@ -38,7 +39,10 @@ export async function createGeneralApp(
     const testInstance = await import(pathToHref(testFile));
     return await testInstance.appBootstrap;
   } else {
-    const testFile = path.join(projectPath, '.vona/app.ts');
+    const testFile = path.join(
+      resolveVonaLocalPaths(projectPath, process.env.META_MODE).generatedRoot,
+      'app.ts',
+    );
     const testInstance = await import(pathToHref(testFile));
     return await testInstance.createSingleApp();
   }

package/vona/packages-vona/vona-core/src/types/application/app.ts

@@ -42,6 +42,8 @@ export interface VonaApplicationOptions {
   locales: TypeBootstrapOptionsLocales;
   config: TypeBootstrapOptionsConfig;
   env: VonaConfigEnv;
+  /** Internal cleanup-only source configuration resolution; never starts an application. */
+  configResolutionOnly?: boolean;
   AppMonkey?: AppMonkeyConstructable;
 }
 

package/vona/packages-vona/vona-core/src/types/utils/env.ts

@@ -4,6 +4,7 @@ export interface VonaConfigEnv {
   META_FLAVOR: VonaMetaFlavor;
   META_MODE: VonaMetaMode;
   APP_NAME: string | undefined;
+  VONA_TEST_RUN_ID: string | undefined;
   APP_TITLE: string | undefined;
   APP_VERSION: string | undefined;
   SERVER_KEYS: string | undefined;

package/vona/packages-vona/vona-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-mock",
-  "version": "6.1.42",
+  "version": "6.1.44",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona mock",
   "keywords": [

package/vona/pnpm-lock.yaml

@@ -573,8 +573,8 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.166
-        version: 5.1.166(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.167
+        version: 5.1.167(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
       zova-jsx:
         specifier: ^1.1.92
         version: 1.1.92(typescript@5.9.3)
@@ -606,8 +606,8 @@ importers:
         specifier: ^5.1.37
         version: 5.1.37(vue@3.5.43(typescript@5.9.3))
       zova-module-a-openapi:
-        specifier: ^5.1.54
-        version: 5.1.54
+        specifier: ^5.1.55
+        version: 5.1.55
       zova-module-a-pay:
         specifier: ^5.0.9
         version: 5.0.9
@@ -624,8 +624,8 @@ importers:
         specifier: ^5.1.35
         version: 5.1.35
       zova-module-a-table:
-        specifier: ^5.1.43
-        version: 5.1.43(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.44
+        version: 5.1.44(vue@3.5.43(typescript@5.9.3))
       zova-module-pay-mock:
         specifier: ^5.0.5
         version: 5.0.5
@@ -657,8 +657,8 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.166
-        version: 5.1.166(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.167
+        version: 5.1.167(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
       zova-jsx:
         specifier: ^1.1.92
         version: 1.1.92(typescript@5.9.3)
@@ -690,8 +690,8 @@ importers:
         specifier: ^5.1.37
         version: 5.1.37(vue@3.5.43(typescript@5.9.3))
       zova-module-a-openapi:
-        specifier: ^5.1.54
-        version: 5.1.54
+        specifier: ^5.1.55
+        version: 5.1.55
       zova-module-a-pay:
         specifier: ^5.0.9
         version: 5.0.9
@@ -708,8 +708,8 @@ importers:
         specifier: ^5.1.35
         version: 5.1.35
       zova-module-a-table:
-        specifier: ^5.1.43
-        version: 5.1.43(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.44
+        version: 5.1.44(vue@3.5.43(typescript@5.9.3))
       zova-module-pay-mock:
         specifier: ^5.0.5
         version: 5.0.5
@@ -741,8 +741,8 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.166
-        version: 5.1.166(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.167
+        version: 5.1.167(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
       zova-jsx:
         specifier: ^1.1.92
         version: 1.1.92(typescript@5.9.3)
@@ -774,8 +774,8 @@ importers:
         specifier: ^5.1.37
         version: 5.1.37(vue@3.5.43(typescript@5.9.3))
       zova-module-a-openapi:
-        specifier: ^5.1.54
-        version: 5.1.54
+        specifier: ^5.1.55
+        version: 5.1.55
       zova-module-a-pay:
         specifier: ^5.0.9
         version: 5.0.9
@@ -792,8 +792,8 @@ importers:
         specifier: ^5.1.35
         version: 5.1.35
       zova-module-a-table:
-        specifier: ^5.1.43
-        version: 5.1.43(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.44
+        version: 5.1.44(vue@3.5.43(typescript@5.9.3))
       zova-module-pay-mock:
         specifier: ^5.0.5
         version: 5.0.5
@@ -825,8 +825,8 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.166
-        version: 5.1.166(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.167
+        version: 5.1.167(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
       zova-jsx:
         specifier: ^1.1.92
         version: 1.1.92(typescript@5.9.3)
@@ -858,8 +858,8 @@ importers:
         specifier: ^5.1.37
         version: 5.1.37(vue@3.5.43(typescript@5.9.3))
       zova-module-a-openapi:
-        specifier: ^5.1.54
-        version: 5.1.54
+        specifier: ^5.1.55
+        version: 5.1.55
       zova-module-a-pay:
         specifier: ^5.0.9
         version: 5.0.9
@@ -876,8 +876,8 @@ importers:
         specifier: ^5.1.35
         version: 5.1.35
       zova-module-a-table:
-        specifier: ^5.1.43
-        version: 5.1.43(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.44
+        version: 5.1.44(vue@3.5.43(typescript@5.9.3))
       zova-module-pay-mock:
         specifier: ^5.0.5
         version: 5.0.5
@@ -1652,7 +1652,7 @@ importers:
         specifier: ^5.0.3
         version: link:modules/a-markdown
       vona-module-a-rbac:
-        specifier: ^5.0.8
+        specifier: ^5.0.9
         version: link:modules/a-rbac
       vona-module-a-socket:
         specifier: workspace:^
@@ -8938,8 +8938,8 @@ packages:
   zova-module-a-model@5.1.37:
     resolution: {integrity: sha512-Ipas8Lpsi9Jcgu3AbzajgqcBffmg1GeIBOu4UtOyR5fbRDvlxYWXx45rA52oB/zgoC+QvhUVzY36fnNfTJiywg==}
 
-  zova-module-a-openapi@5.1.54:
-    resolution: {integrity: sha512-/ECDbv7P5jHb9kr7gRFwpSIPtPHXg7yPVe8jfUCDx2y0P/Wk/fOEKLBBQLAC8jEwjTesQNXGu9I2WcNb0kL3Pw==}
+  zova-module-a-openapi@5.1.55:
+    resolution: {integrity: sha512-jdbUN4QEAQZvx+EmwaDfIa0Xy5MoNOVYLdLnEl+LbANc6COxkGGSyroFBRXG5S/Av0YWIBUbgahuEpFdL+RYjw==}
 
   zova-module-a-pay@5.0.9:
     resolution: {integrity: sha512-Chl6EKp30HBOGFCJXbla2/lS19WhzQyTZwgYmsL3nnG9Vt2TeUlb82vsYCVuDcy0cgmxVaWjPF7dzKL/r3Pfng==}
@@ -8965,8 +8965,8 @@ packages:
   zova-module-a-style@5.1.35:
     resolution: {integrity: sha512-i73I3wFvdQonj3l4fkovkKBZwSK4s6D4vL3AVfVvFJ4eIboKH2yw0hCILKRzLoESNQ0T+lNS6ozeimvtA4/6DQ==}
 
-  zova-module-a-table@5.1.43:
-    resolution: {integrity: sha512-Q7ZlGF4sNaors+pfwrCMx2Ot2qUfivX6BqvKzT0Em1GcJMXEvmWDMseWZausQUw/h3VOOG3i4hN/RKftrYMYjA==}
+  zova-module-a-table@5.1.44:
+    resolution: {integrity: sha512-wc9tABJ20tVX2RL/9xTfgHgdDnvN9UoJQm8k25Ay/72r9K5WfoRk4dHfgjEQXIgOVyWWXTWkI1SGcvUkqC3JbA==}
 
   zova-module-a-zod@5.1.37:
     resolution: {integrity: sha512-rXHN9rKbum9w3gDSnC/pIusG2d2FGJOcIauf8jrbT96f+Olk4Q3iV3t2V92mxiLCh9kMvBJPfcOgJFW7pRB5Fw==}
@@ -8980,11 +8980,11 @@ packages:
   zova-module-rest-resource@5.1.55:
     resolution: {integrity: sha512-Kk3oJIcxM5EbeTLl+ucJSeI2kT0We8YilXBaX8Z7QWCbZ0fHoQDy/Ac4YsVSWIXUrC2SQ267+nMl3sHXnE9G0Q==}
 
-  zova-suite-a-zova@5.1.165:
-    resolution: {integrity: sha512-hXjFEx9MXrtvPgAv28VF2UbgM45hzz7B7ZAsElJloBNWB3zyz2HUHYxNWDbCrrKfrw5zM3Mbr9i+dzyy3/6LQw==}
+  zova-suite-a-zova@5.1.166:
+    resolution: {integrity: sha512-2mmuMDS4uEvq4x9p/StuBb8E+9Czg7G/S6E9IF2SdwBGmXB6dtcog1rNquvUyNLOujw2UNn2uUyuIY0WPRUc0g==}
 
-  zova@5.1.166:
-    resolution: {integrity: sha512-2qh4Na6G8JYHWIyX7+NNfMLzzgHsheQFUgeH6KVsMp66kxpdR9YSr5Ivz+dJepthtmnlCB7R+WWczhURx4wYYA==}
+  zova@5.1.167:
+    resolution: {integrity: sha512-A0vfiT2eXuKbKW1GxlZNnsZPuPvS/mAHfoaiBsN5Pf4GYOKE/7R9fJIbl9YQzNWkV3LP3vECygqBHg9q2qr9Bw==}
 
   zwitch@1.0.5:
     resolution: {integrity: sha512-V50KMwwzqJV0NpZIZFwfOD5/lyny3WlSzRiXgA0G7VUnRlqttta1L6UQIHzd6EuBY/cHGfwTIck7w1yH6Q5zUw==}
@@ -15158,7 +15158,7 @@ snapshots:
       - '@vue/composition-api'
       - vue
 
-  zova-module-a-openapi@5.1.54:
+  zova-module-a-openapi@5.1.55:
     dependencies:
       '@cabloy/json-schema-to-zod': 2.6.5
       openapi3-ts: 4.6.1
@@ -15191,7 +15191,7 @@ snapshots:
       csx: 10.0.2
       typestyle: 2.4.0
 
-  zova-module-a-table@5.1.43(vue@3.5.43(typescript@5.9.3)):
+  zova-module-a-table@5.1.44(vue@3.5.43(typescript@5.9.3)):
     dependencies:
       '@tanstack/table-core': 8.21.3
       '@tanstack/vue-table': 8.21.3(vue@3.5.43(typescript@5.9.3))
@@ -15225,7 +15225,7 @@ snapshots:
 
   zova-module-rest-resource@5.1.55: {}
 
-  zova-suite-a-zova@5.1.165(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
+  zova-suite-a-zova@5.1.166(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
     dependencies:
       zova-module-a-api: 5.1.22
       zova-module-a-app: 5.1.26
@@ -15240,7 +15240,7 @@ snapshots:
       zova-module-a-logger: 5.1.28
       zova-module-a-meta: 5.1.22
       zova-module-a-model: 5.1.37(vue@3.5.43(typescript@5.9.3))
-      zova-module-a-openapi: 5.1.54
+      zova-module-a-openapi: 5.1.55
       zova-module-a-router: 5.1.41
       zova-module-a-routerstack: 5.1.29
       zova-module-a-routertabs: 5.1.34
@@ -15248,7 +15248,7 @@ snapshots:
       zova-module-a-ssrhmr: 5.1.23
       zova-module-a-ssrserver: 5.1.26
       zova-module-a-style: 5.1.35
-      zova-module-a-table: 5.1.43(vue@3.5.43(typescript@5.9.3))
+      zova-module-a-table: 5.1.44(vue@3.5.43(typescript@5.9.3))
       zova-module-a-zod: 5.1.37
       zova-module-a-zova: 5.1.108(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
     transitivePeerDependencies:
@@ -15258,10 +15258,10 @@ snapshots:
       - typescript
       - vue
 
-  zova@5.1.166(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
+  zova@5.1.167(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
     dependencies:
       zova-core: 5.1.92(patch_hash=144450bd7a567a6067e5857c0cf4c780981b7e90bc48745c09e1696a9b6f1b97)(typescript@5.9.3)
-      zova-suite-a-zova: 5.1.165(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+      zova-suite-a-zova: 5.1.166(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
     transitivePeerDependencies:
       - '@vue/composition-api'
       - debug

package/vona/src/suite/a-commerce/modules/commerce-payment/test/paymentIndexes.test.ts

@@ -1,12 +1,20 @@
 import type { IMetaOptionsIndex } from 'vona-module-a-index';
 
+import { DateTime } from 'luxon';
 import assert from 'node:assert/strict';
 import { randomUUID } from 'node:crypto';
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
+import { lstat, open, rm } from 'node:fs/promises';
 import path from 'node:path';
 import { describe, it } from 'node:test';
-import { appResource } from 'vona';
+import {
+  appResource,
+  assertDisposableDatabaseName,
+  assertIsolatedTestPath,
+  assertTestRunOwner,
+  getDatabaseTestPrefix,
+  registerTestClaimDatabaseCreation,
+  resolveVonaLocalPaths,
+} from 'vona';
 import { app } from 'vona-mock';
 import { ServiceDatabaseAsyncLocalStorage, ServiceDatabaseClient } from 'vona-module-a-orm';
 
@@ -24,6 +32,56 @@ const expectedIndexes = {
   ],
 };
 
+const attemptedCopyNames = new Set<string>();
+
+async function allocateOwnedSqliteCopy(source: ServiceDatabaseClient) {
+  const runId = app.meta.env.VONA_TEST_RUN_ID;
+  assert.ok(runId, 'the isolated SQLite copy requires a test run ID');
+  const paths = resolveVonaLocalPaths(app.projectPath, 'test', runId);
+  assertTestRunOwner(paths.dataRoot, runId);
+  const prefix = getDatabaseTestPrefix(app.name, 'share');
+
+  for (let offset = 0; offset < 3600; offset++) {
+    const timestamp = DateTime.now().plus({ seconds: offset }).toFormat('yyyyMMdd-HHmmss');
+    const databaseName = `${prefix}${timestamp}`;
+    assertDisposableDatabaseName(databaseName, prefix);
+    const filename = path.join(paths.sqliteRoot, `${databaseName}.db`);
+    if (attemptedCopyNames.has(filename)) continue;
+    const reservation = `${filename}.lock`;
+    assertIsolatedTestPath(filename, path.join(paths.sqliteRoot, path.basename(filename)));
+    assertIsolatedTestPath(reservation, path.join(paths.sqliteRoot, path.basename(reservation)));
+    try {
+      const reservationHandle = await open(reservation, 'wx');
+      await reservationHandle.close();
+      try {
+        const exists = await lstat(filename).then(
+          () => true,
+          error => {
+            if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false;
+            throw error;
+          },
+        );
+        if (exists) {
+          await rm(reservation);
+          continue;
+        }
+        attemptedCopyNames.add(filename);
+        await registerTestClaimDatabaseCreation(app, source.clientConfig, databaseName, 'intent');
+        const databaseHandle = await open(filename, 'wx');
+        await databaseHandle.close();
+        await rm(filename);
+        return { filename, paths, reservation };
+      } catch (error) {
+        await rm(reservation, { force: true });
+        if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      }
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+    }
+  }
+  throw new Error('Unable to allocate an owned SQLite copy name');
+}
+
 describe('paymentIndexes.test.ts', { concurrency: false }, () => {
   it('registers all payment indexes without overwriting table keys', () => {
     const options = appResource.getBean('commerce-payment.meta.index')
@@ -85,12 +143,17 @@ describe('paymentIndexes.test.ts', { concurrency: false }, () => {
         t.skip('SQLite-only independent database copy');
         return;
       }
-      const directory = await mkdtemp(path.join(tmpdir(), 'commerce-index-recovery-'));
-      const filename = path.join(directory, 'existing.db');
       const source = app.bean.database.current;
+      const { filename, paths, reservation } = await allocateOwnedSqliteCopy(source.client);
       let client: ServiceDatabaseClient | undefined;
       try {
         await source.connection.raw('VACUUM main INTO ?', [filename]);
+        await registerTestClaimDatabaseCreation(
+          app,
+          source.client.clientConfig,
+          path.basename(filename, '.db'),
+          'created',
+        );
         const selector = `index-recovery-${randomUUID()}`;
         client = app.bean._newBean(ServiceDatabaseClient, selector, {
           client: 'better-sqlite3',
@@ -154,11 +217,11 @@ describe('paymentIndexes.test.ts', { concurrency: false }, () => {
           }
         });
       } finally {
-        try {
-          if (client) await client.connection.destroy();
-        } finally {
-          await rm(directory, { recursive: true, force: true });
-        }
+        if (client) await client.connection.destroy();
+        assertTestRunOwner(paths.dataRoot, paths.runId!);
+        assertIsolatedTestPath(filename, filename);
+        await source.connection.schema.dropDatabase(filename);
+        await rm(reservation, { force: true });
       }
     });
   });

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-rbac",
-  "version": "5.0.8",
+  "version": "5.0.10",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-cabloy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-cabloy",
-  "version": "5.1.59",
+  "version": "5.1.61",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",
@@ -10,7 +10,7 @@
     "vona-module-a-cabloy": "workspace:^",
     "vona-module-a-layoutprofile": "^5.0.2",
     "vona-module-a-markdown": "^5.0.3",
-    "vona-module-a-rbac": "^5.0.8",
+    "vona-module-a-rbac": "^5.0.10",
     "vona-module-a-socket": "workspace:^",
     "vona-module-a-ssr": "workspace:^",
     "vona-module-a-ssrhmr": "workspace:^"

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.56",
+  "version": "5.1.58",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-logger/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-logger",
-  "version": "5.1.13",
+  "version": "5.1.15",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-logger/src/bean/middlewareSystem.httpLog.ts

@@ -8,6 +8,8 @@ import StdSerializers from 'pino-std-serializers';
 import { BeanBase } from 'vona';
 import { MiddlewareSystem } from 'vona-module-a-aspect';
 
+import { redactIsolatedReadyHeader } from '../lib/redactIsolatedReadyHeader.ts';
+
 export interface IMiddlewareSystemOptionsHttpLog extends IDecoratorMiddlewareSystemOptions {}
 
 @MiddlewareSystem<IMiddlewareSystemOptionsHttpLog>()
@@ -16,15 +18,27 @@ export class MiddlewareSystemHttpLog extends BeanBase implements IMiddlewareSyst
     const ctx = this.ctx;
     // start
     const req = StdSerializers.req(ctx.req);
+    req.headers = redactIsolatedReadyHeader(
+      req.headers,
+      ctx.path,
+      this.app.meta.env.VONA_TEST_RUN_ID,
+      'x-vona-test-challenge',
+    );
     this.$loggerChild('req').http(() => JSON.stringify(req));
     const profiler = this.$loggerChild('res').startTimer();
     // next
     await next();
     // end
+    const headers = redactIsolatedReadyHeader(
+      ctx.res.getHeaders(),
+      ctx.path,
+      this.app.meta.env.VONA_TEST_RUN_ID,
+      'x-vona-test-proof',
+    );
     const res = {
       url: ctx.req.url,
       statusCode: ctx.res.statusCode,
-      headers: ctx.res.getHeaders(),
+      headers,
     };
     profiler.done({ level: 'http', message: JSON.stringify(res) });
   }

package/vona/src/suite-vendor/a-vona/modules/a-logger/src/lib/redactIsolatedReadyHeader.test.ts

@@ -0,0 +1,24 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+
+import { redactIsolatedReadyHeader } from './redactIsolatedReadyHeader.ts';
+
+test('redacts isolated readiness challenge and proof without changing live headers', () => {
+  const runId = '20261014010203-a1b2c3d4';
+  const req = { 'x-vona-test-challenge': 'challenge-value', 'accept': 'application/json' };
+  const res = { 'x-vona-test-proof': 'proof-value', 'content-type': 'application/json' };
+  const loggedReq = redactIsolatedReadyHeader(req, '/health/ready', runId, 'x-vona-test-challenge');
+  const loggedRes = redactIsolatedReadyHeader(res, '/health/ready', runId, 'x-vona-test-proof');
+
+  assert.equal(JSON.stringify(loggedReq).includes('challenge-value'), false);
+  assert.equal(JSON.stringify(loggedRes).includes('proof-value'), false);
+  assert.equal(loggedReq.accept, 'application/json');
+  assert.equal(loggedRes['content-type'], 'application/json');
+  assert.equal(req['x-vona-test-challenge'], 'challenge-value');
+  assert.equal(res['x-vona-test-proof'], 'proof-value');
+  assert.equal(redactIsolatedReadyHeader(req, '/health/live', runId, 'x-vona-test-challenge'), req);
+  assert.equal(
+    redactIsolatedReadyHeader(req, '/health/ready', undefined, 'x-vona-test-challenge'),
+    req,
+  );
+});