cabloy 5.1.220 → 5.1.221

package/.cabloy-version

@@ -1 +1 @@
-5.1.220
+5.1.221

package/.github/workflows/agent-governance.yml

@@ -17,9 +17,9 @@ jobs:
       PNPM_CONFIG_MINIMUM_RELEASE_AGE: 0
     steps:
       - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - uses: actions/setup-node@v6
         with:
           node-version: 24

package/.github/workflows/create-cabloy.yml

@@ -35,9 +35,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: 24
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: start Redis on macOS
         if: runner.os == 'macOS'
         shell: bash

package/.github/workflows/docs-pages.yml

@@ -29,9 +29,9 @@ jobs:
       PNPM_CONFIG_MINIMUM_RELEASE_AGE: 0
     steps:
       - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - uses: actions/setup-node@v6
         with:
           node-version: 24

package/.github/workflows/playwright-e2e.yml

@@ -28,9 +28,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: 24
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: start Redis on macOS
         if: runner.os == 'macOS'
         shell: bash
@@ -136,9 +136,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: 24
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: start Redis on macOS
         if: runner.os == 'macOS'
         shell: bash

package/.github/workflows/vona-cov-pg.yml

@@ -29,9 +29,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: init
         run: npm run init
       - name: cov

package/.github/workflows/vona-test-crud.yml

@@ -22,9 +22,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: init
         run: npm run init
       - run: npm run vona :create:module demo-student2 -- --suite --ci

package/.github/workflows/vona-test-mysql.yml

@@ -29,9 +29,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: init
         run: npm run init
       - name: run Commerce lifecycle gate

package/.github/workflows/vona-test-pg.yml

@@ -29,9 +29,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: init
         run: npm run init
       - name: run A-Pay focused gate

package/.github/workflows/vona-test-sqlite3.yml

@@ -29,9 +29,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: start Redis on macOS
         if: runner.os == 'macOS'
         shell: bash

package/.github/workflows/vona-tsc.yml

@@ -17,9 +17,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: init
         run: npm run init
       - name: tsc

package/.github/workflows/zova-ui.yml

@@ -17,9 +17,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         with:
-          version: 11.5.2
+          version: '12.14.0'
       - name: init
         run: npm run init
       - name: suite

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 5.1.221
+
+### Features
+
+- Incorporate updates from MCP.
+- Incorporate updates from the specification.
+
+### Improvements
+
+- Update pnpm.
+
 ## 5.1.220
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.220",
+  "version": "5.1.221",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [
@@ -106,7 +106,8 @@
     "typescript": "^5.9.3"
   },
   "engines": {
-    "node": ">=24.4.0"
+    "node": ">=24.4.0",
+    "pnpm": ">=11.5.2"
   },
-  "packageManager": "pnpm@11.5.2"
+  "packageManager": "pnpm@12.14.0"
 }

package/repo-docs/frontend/openapi-sdk-guide.md

@@ -73,6 +73,8 @@ npm run contract:generate:isolated -- training-student
 
 The isolated command uses the same generator and preserves module ownership validation, but manages a disposable service, claim, and test resources without starting Playwright. Generated files under `zova/src/**` are shared workspace output, not run-owned temporary files; serialize concurrent SDK generation and do not expect automatic rollback.
 
+For an explicitly authorized run that must skip historical-claim reaping, use the standalone `--skip-expired-claim-reaping` flag. In this strict lane, generated environment source contains selected keys rather than resolved values, configuration reaches the bootstrap child in memory, service/generator stdout and stderr are discarded, and framework file logging is prevented before transport construction. Failures remain failures with categorical diagnostics and retained current-run claims/resources; there is no automatic retry or fallback to development Swagger. This is not a network or arbitrary-filesystem sandbox, and it does not authorize Provider operations or prove custom seed/logging behavior. See [Strict isolated generation](/reference/repo-scripts#test-isolation-and-development-data) for resource and diagnostic boundaries.
+
 The project-level source resolver accepts `OPENAPI_SOURCE_URL` as a complete OpenAPI document URL. It takes precedence over `API_BASE_URL` for generation only and does not change runtime `OPENAPI_BASE_URL_*` request targets:
 
 ```bash

package/repo-docs/reference/repo-scripts.md

@@ -92,7 +92,11 @@ The wrapper consumes this standalone flag rather than forwarding it to Zova; `--
 
 The opt-in lane requires strict freshness after application configuration and before module loading: run-owned public/runtime/SQLite directories must be absent or empty, shared and static-isolate database namespaces must be absent, and persistent Redis namespaces must be empty. Read-only discovery failures or preexisting resources fail closed rather than authorizing deletion. Startup requires per-application freshness proof to bypass normal test clearing; database preparation rechecks the namespace, never drops existing databases in this lane, and reuses only a database creation recorded by that application.
 
-This still loads environment configuration, initializes newly allocated test databases and Redis/runtime resources, and runs normal module seeds. Successful runs clean only their inventoried current-run resources after verified shutdown; failed runs retain their claim/resources, without automatic generation retry or fallback. Generated consumers remain shared checkout writes. Freshness is a snapshot, **not an exclusive lease**, zero-mutation mode, network sandbox, blanket log-redaction guarantee, or authorization to contact a Provider. Independently configured external resources and Provider operations retain their separate ownership and approval requirements. This shared flag does not extend Basic's separately scoped Windows verification to Start.
+In the strict opt-in lane, generated `env.ts` contains a selected-key projection of the bootstrap process environment, not serialized configuration values. The CLI passes its resolved configuration to the bootstrap child in memory, preserving resolved-value precedence without exposing every inherited environment key through `app.meta.env`. Strict generation requires test mode and matching run-owned directories before configuration loading or generated-file writes. Ordinary dev/build/test and default contract generation keep their existing environment generation behavior.
+
+Strict service and generator stdout/stderr are discarded, not captured for later redaction. Framework logger access bypasses client configuration and transport construction; direct file-transport construction fails before filesystem or rotation access. Parent failures report categorical stages instead of raw child errors, causes or response bodies. Windows output still drains through the native bridges into discard streams; this implementation policy and synthetic coverage are not native Windows runtime verification. Custom filesystem writers, external logging sinks and seed behavior remain outside this framework diagnostic boundary: it is not a universal secret sandbox or secret scanner.
+
+This still loads environment configuration, initializes newly allocated test databases and Redis/runtime resources, and runs normal module seeds. Successful runs clean only their inventoried current-run resources after verified shutdown; failed runs retain their claim/resources, without automatic generation retry or fallback. Discarded diagnostics are not recoverable from a retained claim. Generated consumers remain shared checkout writes. Freshness is a snapshot, **not an exclusive lease**, zero-mutation mode, network sandbox, blanket log-redaction guarantee, or authorization to contact a Provider. Independently configured external resources and Provider operations retain their separate ownership and approval requirements. This shared flag does not extend Basic's separately scoped Windows verification to Start.
 
 For Vona integrated SSR, the allocated E2E origin is supplied to Zova at runtime as server `SSR_API_BASE_URL` and browser `API_BASE_URL`. Do not edit Zova `.env` files or rebuild solely to match the test port. The current root `npm run test:e2e` consumes prebuilt frontend artifacts; refresh affected SSR/REST output and synchronize dependencies when their inputs change. See [Runtime API origins in Vona integrated SSR](/fullstack/ssr-entry-modes#runtime-api-origins-in-vona-integrated-ssr) for configuration overrides and scope.
 

package/scripts/generateOpenapiIsolated.ts

@@ -7,6 +7,7 @@ import {
   withIsolatedVona,
   withIsolatedRun,
 } from './runIsolatedTest.ts';
+import { strictGenerationFailure } from './strictGenerationDiagnostics.ts';
 
 const OPENAPI_VERSION = 'V31';
 const SOURCE_TIMEOUT_MS = 30_000;
@@ -78,6 +79,15 @@ export async function validateOpenapiSource(source: string) {
 }
 
 export async function generateOpenapiIsolated(args: string[]) {
+  const strict = args.some(arg => /^--skip-expired-claim-reaping(?:=|$)/.test(arg));
+  try {
+    return await generateOpenapiIsolatedInternal(args);
+  } catch (error) {
+    throw strict ? strictGenerationFailure('run', error) : error;
+  }
+}
+
+async function generateOpenapiIsolatedInternal(args: string[]) {
   const { generatorArgs, skipExpiredClaimReaping } = parseIsolatedOpenapiArgs(args);
   const command = getOpenapiGeneratorCommand(generatorArgs);
   if (process.env.E2E_BASE_URL !== undefined) {
@@ -104,5 +114,12 @@ export async function generateOpenapiIsolated(args: string[]) {
 }
 
 if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
-  await generateOpenapiIsolated(process.argv.slice(2));
+  const args = process.argv.slice(2);
+  try {
+    await generateOpenapiIsolated(args);
+  } catch (error) {
+    if (!args.some(arg => /^--skip-expired-claim-reaping(?:=|$)/.test(arg))) throw error;
+    console.error(strictGenerationFailure('run', error).message);
+    process.exitCode = 1;
+  }
 }

package/scripts/runIsolatedTest.test.ts

@@ -46,6 +46,7 @@ import {
   waitForReady,
   withIsolatedRun,
 } from './runIsolatedTest.ts';
+import { StrictGenerationError } from './strictGenerationDiagnostics.ts';
 
 const isolationSource = resolve(
   ROOT_DIR,
@@ -367,7 +368,14 @@ for (const marker of ['__CABLOY_BASIC__', '__CABLOY_START__']) {
             root,
             { skipExpiredClaimReaping: true },
           ),
-          /generator failed/,
+          error => {
+            assert.ok(error instanceof StrictGenerationError);
+            assert.equal(error.stage, 'run');
+            assert.equal(error.message, 'Strict contract generation failed: run');
+            assert.doesNotMatch(error.stack ?? '', /generator failed/);
+            assert.equal(error.cause, undefined);
+            return true;
+          },
         );
         assert.equal((await loadTestClaim(claimPath)).status, 'failed');
         assert.equal(existsSync(dataRoot), true);

package/scripts/runIsolatedTest.ts

@@ -14,6 +14,13 @@ import {
   sendTestClaimEvent,
   startTestClaimBroker,
 } from '../vona/packages-vona/vona-core/src/lib/core/testClaim.ts';
+import {
+  discardNativeOutput,
+  guardianStdio,
+  reportIsolatedDiagnostic,
+  strictGenerationFailure,
+  usesStrictGeneration,
+} from './strictGenerationDiagnostics.ts';
 import {
   cleanTestClaim,
   parseTestClaimTtlSeconds,
@@ -94,7 +101,16 @@ export async function startOwnedProcess(
   cwd: string,
   env: NodeJS.ProcessEnv,
 ): Promise<OwnedProcess> {
-  if (process.platform === 'win32') return startWindowsOwnedProcess(command, args, cwd, env);
+  const strict = usesStrictGeneration(env);
+  if (process.platform === 'win32') {
+    return startWindowsOwnedProcess(
+      command,
+      args,
+      cwd,
+      env,
+      strict ? discardNativeOutput() : undefined,
+    );
+  }
   const processId = randomUUID();
   const managed = hasTestClaimTransport(env);
   const registration = { id: processId, role: 'guardian', stage: 'pending' as const };
@@ -102,7 +118,7 @@ export async function startOwnedProcess(
   const guardian: ChildProcess = spawn(process.execPath, [GUARDIAN_FILE], {
     cwd: ROOT_DIR,
     env,
-    stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
+    stdio: guardianStdio(strict),
     detached: true,
   });
   let drained: GuardianResult | undefined;
@@ -335,9 +351,15 @@ export async function withIsolatedVona<T>(
   callback: () => Promise<T>,
   dependencies: IsolatedVonaDependencies = { start: startOwnedProcess, ready: waitForReady },
 ): Promise<T> {
+  const strict = usesStrictGeneration(env);
   const readyKey = randomBytes(32).toString('hex');
   const command = getIsolatedVonaCommand(port, env, readyKey);
-  const server = await dependencies.start(command.command, command.args, command.cwd, command.env);
+  let server: OwnedProcess;
+  try {
+    server = await dependencies.start(command.command, command.args, command.cwd, command.env);
+  } catch (error) {
+    throw strict ? strictGenerationFailure('startup') : error;
+  }
   let stopping = false;
   let exitedEarly = false;
   void server.wait().then(
@@ -351,7 +373,9 @@ export async function withIsolatedVona<T>(
   let interrupted = false;
   const onInterrupt = () => {
     interrupted = true;
-    void server.stop().catch(console.error);
+    void server
+      .stop()
+      .catch(error => reportIsolatedDiagnostic(strict, 'interrupt-stop-failed', error));
   };
   process.on('SIGINT', onInterrupt);
   process.on('SIGTERM', onInterrupt);
@@ -398,19 +422,22 @@ export async function withIsolatedVona<T>(
     if (interrupted) throw new Error('Isolated Vona run interrupted');
     result = await callback();
   } catch (error) {
-    operationError = toError(error);
+    operationError = strict
+      ? strictGenerationFailure(ready ? 'operation' : 'startup', error)
+      : toError(error);
   } finally {
     stopping = true;
     try {
       await shutdown();
     } catch (error) {
-      shutdownError = toError(error);
+      shutdownError = strict ? strictGenerationFailure('shutdown') : toError(error);
     } finally {
       process.off('SIGINT', onInterrupt);
       process.off('SIGTERM', onInterrupt);
     }
   }
   if (operationError && shutdownError) {
+    if (strict) throw strictGenerationFailure('operation-and-shutdown');
     throw new AggregateError(
       [operationError, shutdownError],
       'Isolated Vona operation and shutdown failed',
@@ -427,11 +454,19 @@ export async function runIsolatedProcess(
   cwd: string,
   env: NodeJS.ProcessEnv,
 ) {
-  const child = await startOwnedProcess(command, args, cwd, env);
+  const strict = usesStrictGeneration(env);
+  let child: OwnedProcess;
+  try {
+    child = await startOwnedProcess(command, args, cwd, env);
+  } catch (error) {
+    throw strict ? strictGenerationFailure('generator') : error;
+  }
   let interrupted = false;
   const onInterrupt = () => {
     interrupted = true;
-    void child.stop().catch(console.error);
+    void child
+      .stop()
+      .catch(error => reportIsolatedDiagnostic(strict, 'interrupt-stop-failed', error));
   };
   process.on('SIGINT', onInterrupt);
   process.on('SIGTERM', onInterrupt);
@@ -440,6 +475,8 @@ export async function runIsolatedProcess(
     if (result.failed || interrupted || result.result?.code !== 0) {
       throw new Error(`Isolated test exited: ${result.result?.signal ?? result.result?.code}`);
     }
+  } catch (error) {
+    throw strict ? strictGenerationFailure('generator') : error;
   } finally {
     process.off('SIGINT', onInterrupt);
     process.off('SIGTERM', onInterrupt);
@@ -576,6 +613,20 @@ export async function withIsolatedRun<T>(
   rootDir = ROOT_DIR,
   options: IsolatedRunOptions = {},
 ): Promise<T> {
+  try {
+    return await withIsolatedRunInternal(kind, callback, rootDir, options);
+  } catch (error) {
+    throw options.skipExpiredClaimReaping ? strictGenerationFailure('preparation', error) : error;
+  }
+}
+
+async function withIsolatedRunInternal<T>(
+  kind: 'unit' | 'cov' | 'e2e' | 'contract',
+  callback: (context: IsolatedRunContext) => Promise<T>,
+  rootDir: string,
+  options: IsolatedRunOptions,
+): Promise<T> {
+  const strict = options.skipExpiredClaimReaping === true;
   resolveCabloyEdition(rootDir);
   const vonaDir = resolve(rootDir, 'vona');
   await reapBeforeIsolatedRun(kind, vonaDir, options);
@@ -632,21 +683,33 @@ export async function withIsolatedRun<T>(
     await broker?.update({ type: 'status', status: 'failed' }).catch(() => {
       console.error('Could not record failed test status; claim retained');
     });
-    throw error;
+    throw strict ? strictGenerationFailure('run', error) : error;
   } finally {
     if (!completed) {
-      console.error(`Isolated test claim and resources retained for inspection: ${claimPath}`);
+      reportIsolatedDiagnostic(
+        strict,
+        'failed-resources-retained',
+        `Isolated test claim and resources retained for inspection: ${claimPath}`,
+      );
     }
     await broker?.close();
   }
-  const cleanup = await cleanTestClaim(claimPath, {
-    projectPath: vonaDir,
-    isInactive: claim => isTestClaimInactive(claim, true),
-    warn: message => console.error(message),
-  });
-  if (cleanup.status !== 'cleaned') {
-    console.error(`Isolated test claim retained for inspection: ${claimPath}`);
-    throw new Error('Isolated test succeeded but resource cleanup did not complete');
+  try {
+    const cleanup = await cleanTestClaim(claimPath, {
+      projectPath: vonaDir,
+      isInactive: claim => isTestClaimInactive(claim, true),
+      warn: message => reportIsolatedDiagnostic(strict, 'cleanup-warning', message),
+    });
+    if (cleanup.status !== 'cleaned') {
+      reportIsolatedDiagnostic(
+        strict,
+        'cleanup-incomplete-claim-retained',
+        `Isolated test claim retained for inspection: ${claimPath}`,
+      );
+      throw new Error('Isolated test succeeded but resource cleanup did not complete');
+    }
+  } catch (error) {
+    throw strict ? strictGenerationFailure('cleanup') : error;
   }
   return result as T;
 }