cabloy 5.1.221 → 5.1.223

package/.cabloy-version

@@ -1 +1 @@
-5.1.221
+5.1.223

package/.github/workflows/vona-test-sqlite3.yml

@@ -93,7 +93,7 @@ jobs:
       - name: init
         run: npm run init
       - name: run isolated test infrastructure gate
-        run: node --test scripts/testClaimProcesses.test.ts scripts/runIsolatedTest.test.ts scripts/testClaimCleanup.test.ts scripts/testProcessGuardianWindows.test.ts vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts vona/packages-vona/vona-core/src/lib/core/testClaimFilesystem.test.ts vona/packages-vona/vona-core/src/lib/framework/bootstrap.test.ts vona/packages-vona/vona-core/src/lib/framework/useApp.test.ts vona/packages-cli/cli-set-api/test/binBuildEntries.test.ts
+        run: node --test scripts/testClaimProcesses.test.ts scripts/runIsolatedTest.test.ts scripts/testClaimCleanup.test.ts scripts/testProcessGuardianWindows.test.ts vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts vona/packages-vona/vona-core/src/lib/core/testClaimFilesystem.test.ts vona/packages-vona/vona-core/src/lib/framework/bootstrap.test.ts vona/packages-vona/vona-core/src/lib/framework/useApp.test.ts vona/packages-cli/cli-set-api/test/binBuildEntries.test.ts vona/packages-cli/cli-set-api/test/binTestPatterns.test.ts
       - name: run A-Pay focused gate
         run: npm run test -- test-pay/test/paymentSession.test.ts test-pay/test/payMock.test.ts test-pay/test/paypalProvider.test.ts test-pay/test/paypalLifecycle.test.ts test-pay/test/stripeProvider.test.ts test-pay/test/stripeLifecycle.test.ts test-pay/test/outbox.test.ts test-pay/test/webhook.test.ts
         working-directory: vona

package/.github/workflows/vona-tsc.yml

@@ -22,6 +22,7 @@ jobs:
           version: '12.14.0'
       - name: init
         run: npm run init
-      - name: tsc
-        run: npm run tsc
-        working-directory: vona
+      - name: typecheck runner tests
+        run: npm run test:typecheck
+      - name: legacy typecheck
+        run: npm run tsc:legacy

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 5.1.223
+
+### Features
+
+- Add a CLI test command.
+
+### Improvements
+
+- Replace ts-node with swc-core.
+- Refactor TypeScript compilation.
+- Update isolated test coverage.
+- Update dependency lockfile.
+
+## 5.1.222
+
+### Features
+
+- Apply feature updates, including MCP-related changes.
+
+### Improvements
+
+- Add end-to-end tests and email-sending tests.
+- Update the pnpm lockfile.
+
 ## 5.1.221
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.221",
+  "version": "5.1.223",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [
@@ -50,8 +50,16 @@
     "contract:generate:isolated": "node scripts/generateOpenapiIsolated.ts",
     "test:docs:e2e": "npm run docs:build && playwright test --config repo-e2e/docs/playwright.config.ts",
     "db:reset": "cd vona && npm run db:reset",
-    "tsc": "npm run tsc:zova && pnpm --dir vona run tsc",
+    "tsc": "npm run tsc:native",
+    "tsc:force": "npm run tsc:zova:native && npm run tsc:vona:native:force",
     "tsc:zova": "pnpm --dir zova run tsc",
+    "tsc:native": "npm run tsc:zova:native && npm run tsc:vona:native",
+    "tsc:legacy": "npm run tsc:zova:legacy && pnpm --dir vona run tsc:legacy",
+    "tsc:zova:native": "node scripts/typecheck.ts native zova --noEmit --incremental false --project tsconfig.vue-tsc.json",
+    "tsc:zova:legacy": "node scripts/typecheck.ts typescript zova --noEmit --incremental false --project tsconfig.vue-tsc.json",
+    "tsc:vona:native": "pnpm --dir vona run tsc:native",
+    "tsc:vona:native:force": "pnpm --dir vona run tsc:native:force",
+    "test:typecheck": "node --test scripts/typecheck.test.ts",
     "deps:vona": "pnpm --dir vona run vona :tools:deps",
     "deps:zova": "pnpm --dir zova run zova :tools:deps",
     "format": "oxfmt --check",
@@ -91,6 +99,7 @@
     "@playwright/test": "^1.62.1",
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^26.1.2",
+    "@typescript/native": "npm:typescript@7.0.2",
     "husky": "^9.1.7",
     "lerna": "^10.0.0",
     "lint-staged": "^17.0.5",

package/repo-agent-governance/managed-assets.json

@@ -18,14 +18,14 @@
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "73e068093dfc88d57dc484582e0c20b1dd5d48bdbe12e860ac6343a64883cf5e",
+      "sha256": "11a02f57b7fbccc004e2a8d9cacb0e2af9e6f9a881e53852b9d74cb6309f4fc3",
       "source": "skills/cabloy-backend-scaffold/references/follow-up-checklist.md",
       "target": ".agents/skills/cabloy-backend-scaffold/references/follow-up-checklist.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "e874fe06a1d9a0c5d50fcb3184e7c616e3f4e0b7d8ebada2f165119110955ede",
+      "sha256": "45ac18019b253a8313b5a229528f6373f1a6814d90f27a70783f787b23936aa0",
       "source": "skills/cabloy-backend-scaffold/SKILL.md",
       "target": ".agents/skills/cabloy-backend-scaffold/SKILL.md"
     },
@@ -81,7 +81,7 @@
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "409edb90ce79c81752dffd3b4ded365e9551259d5fc194859200471d43608f09",
+      "sha256": "2bdeea2869862d1e52300da6b946b4b4cd2489b9271144e94e85d8377175c6af",
       "source": "skills/cabloy-frontend-scaffold/references/follow-up-checklist.md",
       "target": ".agents/skills/cabloy-frontend-scaffold/references/follow-up-checklist.md"
     },
@@ -95,7 +95,7 @@
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "edd0014d787e03f9f37df9e67e42bf14bef9f8ca629e3aa3633d7130364020e7",
+      "sha256": "af5f73b8c1d52bf0bdd0464c9b29c1f9eccdddece2142da73657d164ab927f95",
       "source": "skills/cabloy-frontend-scaffold/SKILL.md",
       "target": ".agents/skills/cabloy-frontend-scaffold/SKILL.md"
     },
@@ -354,14 +354,14 @@
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "73e068093dfc88d57dc484582e0c20b1dd5d48bdbe12e860ac6343a64883cf5e",
+      "sha256": "11a02f57b7fbccc004e2a8d9cacb0e2af9e6f9a881e53852b9d74cb6309f4fc3",
       "source": "skills/cabloy-backend-scaffold/references/follow-up-checklist.md",
       "target": ".claude/skills/cabloy-backend-scaffold/references/follow-up-checklist.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "e874fe06a1d9a0c5d50fcb3184e7c616e3f4e0b7d8ebada2f165119110955ede",
+      "sha256": "45ac18019b253a8313b5a229528f6373f1a6814d90f27a70783f787b23936aa0",
       "source": "skills/cabloy-backend-scaffold/SKILL.md",
       "target": ".claude/skills/cabloy-backend-scaffold/SKILL.md"
     },
@@ -417,7 +417,7 @@
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "409edb90ce79c81752dffd3b4ded365e9551259d5fc194859200471d43608f09",
+      "sha256": "2bdeea2869862d1e52300da6b946b4b4cd2489b9271144e94e85d8377175c6af",
       "source": "skills/cabloy-frontend-scaffold/references/follow-up-checklist.md",
       "target": ".claude/skills/cabloy-frontend-scaffold/references/follow-up-checklist.md"
     },
@@ -431,7 +431,7 @@
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "edd0014d787e03f9f37df9e67e42bf14bef9f8ca629e3aa3633d7130364020e7",
+      "sha256": "af5f73b8c1d52bf0bdd0464c9b29c1f9eccdddece2142da73657d164ab927f95",
       "source": "skills/cabloy-frontend-scaffold/SKILL.md",
       "target": ".claude/skills/cabloy-frontend-scaffold/SKILL.md"
     },
@@ -683,7 +683,7 @@
     {
       "adapter": "cursor",
       "category": "policy",
-      "sha256": "050769a0c11ce7706b6dc0d526aad3ecd9d5a2ca1edd4d3eab699aac5eec9996",
+      "sha256": "b8453cbb90a6b75014615dea5ffb8f8e6b31be1e5c3392c1dc4bc0f4456adb57",
       "source": "policies/repository.md",
       "target": ".cursor/rules/cabloy-governance.mdc"
     },
@@ -704,14 +704,14 @@
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "73e068093dfc88d57dc484582e0c20b1dd5d48bdbe12e860ac6343a64883cf5e",
+      "sha256": "11a02f57b7fbccc004e2a8d9cacb0e2af9e6f9a881e53852b9d74cb6309f4fc3",
       "source": "skills/cabloy-backend-scaffold/references/follow-up-checklist.md",
       "target": ".cursor/skills/cabloy-backend-scaffold/references/follow-up-checklist.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "e874fe06a1d9a0c5d50fcb3184e7c616e3f4e0b7d8ebada2f165119110955ede",
+      "sha256": "45ac18019b253a8313b5a229528f6373f1a6814d90f27a70783f787b23936aa0",
       "source": "skills/cabloy-backend-scaffold/SKILL.md",
       "target": ".cursor/skills/cabloy-backend-scaffold/SKILL.md"
     },
@@ -767,7 +767,7 @@
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "409edb90ce79c81752dffd3b4ded365e9551259d5fc194859200471d43608f09",
+      "sha256": "2bdeea2869862d1e52300da6b946b4b4cd2489b9271144e94e85d8377175c6af",
       "source": "skills/cabloy-frontend-scaffold/references/follow-up-checklist.md",
       "target": ".cursor/skills/cabloy-frontend-scaffold/references/follow-up-checklist.md"
     },
@@ -781,7 +781,7 @@
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "edd0014d787e03f9f37df9e67e42bf14bef9f8ca629e3aa3633d7130364020e7",
+      "sha256": "af5f73b8c1d52bf0bdd0464c9b29c1f9eccdddece2142da73657d164ab927f95",
       "source": "skills/cabloy-frontend-scaffold/SKILL.md",
       "target": ".cursor/skills/cabloy-frontend-scaffold/SKILL.md"
     },
@@ -1005,14 +1005,14 @@
     {
       "adapter": "codex",
       "category": "policy",
-      "sha256": "4056d436da610d0438fe8aa4c873cd23442613de800799b358b1c1a2483d7402",
+      "sha256": "18d072d31b706f8eadda5d757ee3db7d69c4a7ea5e4c14dc33ab3ac307ae89e0",
       "source": "policies/repository.md",
       "target": "AGENTS.md"
     },
     {
       "adapter": "claude",
       "category": "policy",
-      "sha256": "4056d436da610d0438fe8aa4c873cd23442613de800799b358b1c1a2483d7402",
+      "sha256": "18d072d31b706f8eadda5d757ee3db7d69c4a7ea5e4c14dc33ab3ac307ae89e0",
       "source": "policies/repository.md",
       "target": "CLAUDE.md"
     }

package/repo-agent-governance/policies/repository.md

@@ -106,4 +106,5 @@ Before inventing a custom implementation path:
 - For docs changes: run the docs build and verify links/navigation where practical.
 - For code-generation or workflow guidance changes: verify that the referenced scripts and command families still exist.
 - For code changes: prefer the narrowest meaningful verification first, then use shared root scripts when broader confidence is needed.
+- Keep frontend and backend verification proportional to the change: cover critical behavior using existing infrastructure, not exhaustive upfront test matrices or bespoke source-evaluation/mock harnesses. Prefer a few critical-flow E2E scenarios for frontend work and the smallest meaningful service/model/API/integration tests for backend work; add focused regressions for actual defects. Preserve applicable security, SSR, data-consistency, migration, and acceptance requirements.
 - Any change to `meta.version.ts` requires running `npm run test` so the test database is reinitialized and schema/data consistency issues surface early.

package/repo-agent-governance/skills/cabloy-backend-scaffold/SKILL.md

@@ -237,7 +237,11 @@ Especially relevant pages include:
 
 Always end with a verification path that matches the scope of the backend change.
 
-Typical shared checks include:
+Prefer focused tests of critical business behavior using the existing Vona testing infrastructure. Choose the smallest meaningful service/model, controller/API, or integration boundary for the changed contract; browser E2E is not the default backend test layer. Avoid exhaustive upfront mock/fake matrices and bespoke harnesses. Add focused regression coverage when actual defects are fixed; targeted unit and framework tests remain useful when they directly prove new or changed behavior.
+
+Keep relevant static checks scope-dependent and preserve applicable authentication/authorization, tenant-isolation, transaction, concurrency, idempotency, migration, and acceptance requirements. These are selected by the affected behavior, not a mandatory matrix for every change. Retain `mockCtx(...)` ownership, test-resource isolation, precise fixture cleanup, and the required `npm run test` after `meta.version.ts` changes. Missing runtime access is a reported gap, not permission to reset resources or invent substitute test machinery. See [Unit Testing](../../../repo-docs/backend/unit-testing.md).
+
+Shared checks, when applicable, include:
 
 - `npm run test`
 - `npm run tsc`

package/repo-agent-governance/skills/cabloy-backend-scaffold/references/follow-up-checklist.md

@@ -79,11 +79,13 @@ When the active edition and installed modules provide `@Passport.rbac(...)` and
 
 ## Verification follow-up
 
-- unit tests
-- `db:reset` or migration verification
-- `npm run test`
-- `npm run tsc`
-- `npm run build`
+- focused critical-business-path tests using existing Vona service/model, controller/API, or integration infrastructure; browser E2E is not the default backend layer
+- focused regressions for actual defects; avoid exhaustive upfront mock/fake matrices and bespoke harnesses
+- applicable authentication/authorization, tenant-isolation, transaction, concurrency, idempotency, migration, and acceptance checks
+- relevant format, lint, and type checks using the smallest supported scope
+- `npm run test`, including the required run after `meta.version.ts` changes
+- migration verification when affected; `db:reset` remains destructive and requires explicit approval
+- `npm run build` only when the affected artifact or acceptance boundary requires it
 
 ## Escalation rule
 

package/repo-agent-governance/skills/cabloy-frontend-scaffold/SKILL.md

@@ -278,7 +278,11 @@ Especially relevant pages include:
 
 Always end with a verification path that matches the scope of the frontend change.
 
-Typical shared checks include:
+For ordinary frontend changes, prefer a few critical user flows through the existing E2E infrastructure, selected by affected behavior with spec names, tags, or `--grep`. Reuse existing scenarios or extend them narrowly; do not require exhaustive isolated-test matrices, extensive fake dependencies, or custom source-evaluation loaders before delivery. When an actual problem is fixed, add focused regression coverage. Targeted unit or framework tests remain useful when they efficiently prove the behavior being changed; this is not a ban on existing tests or managed test-resource isolation.
+
+Keep relevant format, lint, and type checks lightweight and scope-dependent. Prepare only the affected flavor's required artifacts for runtime verification. Preserve applicable route, SSR/hydration, authentication, authorization, contract, and acceptance checks; frontend E2E does not replace server-side enforcement. If runtime verification is unavailable or not authorized, report the gap rather than building a substitute harness. See [Frontend Scripts](../../../repo-docs/frontend/scripts.md) for edition-aware preparation and filtered E2E commands.
+
+Shared checks, when applicable, include:
 
 - `npm run tsc`
 - `npm run build:zova`

package/repo-agent-governance/skills/cabloy-frontend-scaffold/references/follow-up-checklist.md

@@ -42,10 +42,12 @@ After generating or extending a frontend thread, check which follow-up layers ap
 
 ## Verification follow-up
 
-- `npm run tsc`
-- `npm run build:zova`
-- flavor-specific checks
-- route or SSR verification
+- relevant format, lint, and type checks using the smallest supported scope
+- a few affected critical user flows through existing E2E scenarios, selected by spec, tag, or `--grep`
+- focused regressions for actual defects; no exhaustive upfront fake matrices or custom source-evaluation harnesses
+- affected-flavor artifact preparation when runtime verification needs updated output
+- applicable route, SSR/hydration, authentication, authorization, and contract checks; do not replace server-side enforcement with UI coverage
+- report unavailable or unauthorized runtime proof explicitly; do not create substitute test machinery
 
 ## Escalation rule
 

package/repo-docs/backend/unit-testing.md

@@ -4,7 +4,11 @@ This guide explains the most important Vona testing workflows in the Cabloy mono
 
 ## Why testing is emphasized
 
-Test-driven development remains a strong default in the Cabloy monorepo.
+Keep testing proportional to the backend change: cover critical business behavior using the existing Vona testing infrastructure, and add focused regression coverage when actual problems are fixed. Choose the smallest meaningful service/model, controller/API, or integration boundary for the changed contract; browser E2E is not the default backend test layer.
+
+Test-driven development and targeted unit or framework tests remain useful when they clarify and directly prove new or changed behavior. Exhaustive upfront mock/fake matrices and bespoke harnesses are not a delivery prerequisite.
+
+Preserve applicable authentication/authorization, tenant-isolation, transaction, concurrency, idempotency, migration, and acceptance checks without turning them into an unrelated mandatory matrix. The context, fixture, and resource-isolation rules below still apply, including the required `npm run test` after `meta.version.ts` changes. Missing runtime access must be reported, not worked around with unauthorized resets or substitute test machinery.
 
 Vona’s testing story is valuable because it is closely integrated with:
 

package/repo-docs/frontend/scripts.md

@@ -49,6 +49,14 @@ npm run build:zova:commerce:admin
 
 The `dev:zova:*` commands start the Zova development server, which uses `9000` in the Cabloy Basic default environment. Use this Zova standalone SSR entry for page, route, and hydration iteration. It may be used as Vona's development proxy target, but direct access to `9000` does not prove the Vona request boundary or integrated acceptance.
 
+## Proportionate frontend verification
+
+For frontend changes, prefer a few critical user flows through the existing E2E infrastructure, together with relevant lightweight format, lint, and type checks. Select scenarios by the behavior being changed rather than running every spec or building exhaustive isolated-test matrices. Reuse the edition-aware preparation and spec/tag/`--grep` filtering below; prepare only the affected artifacts when they have changed.
+
+Do not introduce custom source-evaluation loaders or extensive fake dependencies by default for ordinary page interactions. When an actual problem is fixed, add a focused regression test that reproduces it. Targeted unit and framework tests remain useful when they provide direct, low-cost proof; comprehensive upfront coverage is not a delivery prerequisite.
+
+This preference does not relax applicable SSR/hydration, authentication, authorization, contract, or acceptance requirements, and UI coverage never replaces server-side enforcement. Managed E2E resource isolation remains required. If runtime verification is unavailable or not authorized, report the gap rather than adding substitute test machinery; live Provider and destructive operations retain their separate authorization boundaries.
+
 ## Vona integrated SSR browser acceptance
 
 The default Basic Web and Admin sites have browser smoke commands that exercise Vona integrated SSR through Vona SSR dispatch at the managed run's dynamically allocated test listener, not through the ordinary Vona development listener (`7102` by default) or the Zova standalone SSR development-server port. Vona supplies the API origin at runtime, so no Zova `.env` change or rebuild is needed solely for the test port; see [Runtime API origins in Vona integrated SSR](/fullstack/ssr-entry-modes#runtime-api-origins-in-vona-integrated-ssr).

package/repo-docs/reference/repo-scripts.md

@@ -44,12 +44,43 @@ Cabloy Basic exposes these shared root scripts:
 - `npm run contract:generate:isolated`
 - `npm run db:reset`
 - `npm run tsc`
+- `npm run tsc:force`
+- `npm run tsc:native`
+- `npm run tsc:legacy`
+- `npm run test:typecheck`
 - `npm run docs:dev`
 - `npm run docs:build`
 - `npm run docs:preview`
 
 `npm run init` prepares all Cabloy Basic SSR and REST artifacts with `npm run build:zova:all`, which sequentially builds the Basic and Commerce flavor batches before Vona initialization. Use `build:zova` or `build:zova:commerce` for focused artifact refreshes; use `build:zova:all` only when every shipped Basic flavor must be prepared.
 
+## TypeScript toolchains in Cabloy Basic
+
+Cabloy Basic keeps two TypeScript toolchains: root `@typescript/native` is the exact npm alias `npm:typescript@7.0.2`, while classic `typescript` 5.9.3 remains available for compiler-API consumers and existing tooling. The alias changes the dependency name, not the executable name: its package still declares `bin.tsc`, not a separate `native` or `tsgo` command.
+
+Use the explicit root commands to select the verification toolchain:
+
+| Root command                         | Scope                                                                                                                              |
+| ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
+| `npm run tsc` / `npm run tsc:native` | Check Zova, then the complete Vona graph, with native TypeScript; reuse Vona incremental results.                                  |
+| `npm run tsc:force`                  | Check the same scopes with native TypeScript, forcing Vona to rebuild.                                                             |
+| `npm run tsc:legacy`                 | Check the same scopes with classic TypeScript.                                                                                     |
+| `npm run tsc:zova:native`            | Check Zova with native TypeScript.                                                                                                 |
+| `npm run tsc:zova:legacy`            | Check Zova with classic TypeScript.                                                                                                |
+| `npm run tsc:vona:native`            | Check the complete Vona graph with native TypeScript, reusing incremental results.                                                 |
+| `npm run tsc:vona:native:force`      | Force native checking of the complete Vona graph.                                                                                  |
+| `npm run test:typecheck`             | Test compiler selection, argument and failure propagation, Vona graph traversal, and installed compiler versions/API availability. |
+
+`scripts/typecheck.ts` delegates to the package-resolving runner in `vona/packages-cli/cli-set-api/src/lib/typescriptRunner.ts`. It resolves `@typescript/native` or `typescript` from the target workspace, reads that package's `bin.tsc`, and invokes it directly with Node. Native Vona checks use the same runner. This avoids relying on `PATH` or a shared `.bin/tsc` name to identify the selected compiler.
+
+Both explicit Zova checks use `tsconfig.vue-tsc.json` with `--noEmit --incremental false`. Native Vona checks retain build mode (`-b`), visiting the project, every local suite, and every standalone local module, rather than replacing that graph with a root-only no-emit check. The default native check omits `--force`; `tsc:force` adds it without changing the traversal scope. Zova's cache policy is unchanged, so the force distinction applies to Vona. The explicit legacy check continues to force a rebuild. Vona's emitted files and build-info artifacts are shared between compiler versions: run native and legacy checks **serially**, and coordinate them with other operations writing the same artifacts. After switching from TS5 back to native, run `npm run tsc:force` before relying on incremental checks. Forced rebuilding prevents one compiler's incremental state from standing in for verification by the other; it does not isolate their output.
+
+Root `npm run tsc` delegates to incremental `tsc:native` for daily development; use `tsc:force` for full forced verification and `tsc:legacy` for comparison or fallback. The nested Vona and Zova `tsc` defaults, frontend `prerun`, build commands, package publish emitters, and REST emitters remain unchanged. Classic TypeScript remains installed for compiler-JavaScript-API consumers, including SWC configuration loading, Rollup integration, and OpenAPI generation; the existing REST native-preview emitter dependency is also retained.
+
+The native alias is installed at the repository root, not in either nested workspace. Run `pnpm install` at the root after updating the checkout; a missing alias fails with an installation diagnostic rather than silently selecting the legacy compiler. A standalone Vona project using `--compiler=native` must install that alias in its project or an ancestor. Do not use a bare root `tsc`/`pnpm exec tsc` to choose a compiler, because both packages declare the same binary name.
+
+The `vona-tsc` CI workflow runs root `npm run test:typecheck`, then root `npm run tsc:force`, after its existing initialization. The root release workflow also runs `tsc:force` before versioning/publishing (excluding changelog-only and GitHub-release-only runs), and its post-release compensation verification uses the same forced entrypoint. These gates retain forced verification even though daily checking is incremental. Check the active repository before assuming the same aliases or commands exist in Cabloy Start.
+
 ## Test isolation and development data {#test-isolation-and-development-data}
 
 <span id="test-isolation-and-development-data-in-cabloy-basic"></span>

package/scripts/release.ts

@@ -586,7 +586,7 @@ function verifyCompensationPatch(dryRun?: boolean): void {
   // eslint-disable-next-line
   console.log('\n✅ Verifying the refreshed zova-core patch...');
   execInherited('pnpm exec tsc -p tsconfig.json --noEmit', dryRun, { cwd: VONA_DIR });
-  execInherited('npm run tsc', dryRun);
+  execInherited('npm run tsc:force', dryRun);
 }
 
 function commitCompensationChanges(targetVersion: string, dryRun?: boolean): void {
@@ -963,6 +963,9 @@ async function release(options: ReleaseOptions): Promise<void> {
   }
 
   runGovernancePreflight(options.dryRun);
+  if (!options.changelogOnly && !options.releaseOnly) {
+    execInherited('npm run tsc:force', options.dryRun);
+  }
 
   // Determine the version to use
   let version: string;

package/scripts/runIsolatedTest.test.ts

@@ -641,7 +641,6 @@ test(
     try {
       const script = `
       import { writeFileSync } from 'node:fs';
-      writeFileSync(process.argv[1], 'ready');
       process.on('SIGINT', () => {
         setTimeout(() => {
           writeFileSync(process.argv[2], 'stopped');
@@ -649,6 +648,7 @@ test(
         }, 150);
       });
       setInterval(() => {}, 1000);
+      writeFileSync(process.argv[1], 'ready');
     `;
       const pending = runIsolatedProcess(
         process.execPath,

package/scripts/typecheck.test.ts

@@ -0,0 +1,199 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import { CliBinTsc } from '../vona/packages-cli/cli-set-api/src/lib/bean/cli.bin.tsc.ts';
+import {
+  resolveTypeScriptCompiler,
+  runTypeScript,
+} from '../vona/packages-cli/cli-set-api/src/lib/typescriptRunner.ts';
+
+const root = fileURLToPath(new URL('../', import.meta.url));
+
+function writeCompiler(root: string, packageName: string, report?: string) {
+  const dir = path.join(root, 'node_modules', packageName);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    path.join(dir, 'package.json'),
+    JSON.stringify({ name: 'typescript', bin: { tsc: 'compiler.cjs' } }),
+  );
+  writeFileSync(
+    path.join(dir, 'compiler.cjs'),
+    `
+    const fs = require('node:fs');
+    if (process.argv[2] === '--fail') process.exit(3);
+    const report = ${JSON.stringify(report)};
+    if (report) fs.appendFileSync(report, JSON.stringify({ cwd: process.cwd(), args: process.argv.slice(2), compiler: ${JSON.stringify(packageName)} }) + '\\n');
+  `,
+  );
+  return path.join(dir, 'compiler.cjs');
+}
+
+test('selects exact packages, preserving compiler argv, cwd and failures', async () => {
+  const dir = realpathSync(mkdtempSync(path.join(tmpdir(), 'cabloy-typecheck-')));
+  try {
+    const projectPath = path.join(dir, 'project with spaces');
+    mkdirSync(projectPath);
+    await assert.rejects(
+      runTypeScript('native', [], { projectPath }),
+      /Cannot resolve @typescript\/native/,
+    );
+    const report = path.join(dir, 'calls.jsonl');
+    const native = writeCompiler(dir, '@typescript/native', report);
+    const legacy = writeCompiler(projectPath, 'typescript');
+    assert.equal(resolveTypeScriptCompiler('native', projectPath), native);
+    assert.equal(resolveTypeScriptCompiler('typescript', projectPath), legacy);
+    const args = ['--project', 'file with spaces.json', 'literal;argument', '$unchanged'];
+    await runTypeScript('native', args, { projectPath });
+    assert.deepEqual(JSON.parse(readFileSync(report, 'utf8')), {
+      cwd: projectPath,
+      args,
+      compiler: '@typescript/native',
+    });
+    await assert.rejects(runTypeScript('native', ['--fail'], { projectPath }), { exitCode: 3 });
+    await assert.rejects(
+      runTypeScript('native', [], { projectPath, cwd: path.join(dir, 'missing') }),
+      { code: 'ENOENT' },
+    );
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('Vona keeps its legacy default and visits the same graph with native', async () => {
+  const dir = realpathSync(mkdtempSync(path.join(tmpdir(), 'cabloy-check-graph-')));
+  try {
+    const report = path.join(dir, 'calls.jsonl');
+    writeCompiler(dir, '@typescript/native', report);
+    const suiteRoot = path.join(dir, 'suite');
+    const moduleRoot = path.join(dir, 'standalone');
+    mkdirSync(suiteRoot);
+    mkdirSync(moduleRoot);
+    const calls: unknown[] = [];
+    const cli = Object.create(CliBinTsc.prototype);
+    Object.defineProperties(cli, {
+      modulesMeta: {
+        value: {
+          suites: {
+            local: { root: suiteRoot, info: { originalName: 'local' } },
+            external: { info: { node_modules: true } },
+          },
+          modulesArray: [
+            { root: moduleRoot, info: { originalName: 'standalone' } },
+            { suite: 'local', info: {} },
+            { info: { node_modules: true } },
+          ],
+        },
+      },
+      helper: {
+        value: {
+          processHelper: {
+            tsc: async (...args: unknown[]) => {
+              calls.push(args);
+            },
+          },
+        },
+      },
+    });
+    await cli._tsc(dir, false);
+    assert.deepEqual(
+      calls,
+      [dir, suiteRoot, moduleRoot].map(cwd => [['-b'], { cwd }]),
+    );
+    for (const force of [false, true]) {
+      for (const builders of [undefined, 1, 2]) {
+        writeFileSync(report, '');
+        await cli._tsc(dir, force, 'native', builders);
+        const nativeCalls = readFileSync(report, 'utf8')
+          .trim()
+          .split('\n')
+          .map(line => JSON.parse(line));
+        const args = force ? ['-b', '--force'] : ['-b'];
+        if (builders !== undefined) args.push('--builders', String(builders));
+        assert.deepEqual(
+          nativeCalls,
+          [dir, suiteRoot, moduleRoot].map(cwd => ({
+            cwd,
+            args,
+            compiler: '@typescript/native',
+          })),
+        );
+      }
+    }
+    assert.equal(calls.length, 3, 'native must not use the legacy binary helper');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('Vona rejects invalid or legacy builder limits before starting compilation', async () => {
+  const cli = Object.create(CliBinTsc.prototype);
+  for (const builders of [0, -1, 1.5, Number.NaN, Infinity, Number.MAX_SAFE_INTEGER + 1]) {
+    await assert.rejects(cli._tsc(root, true, 'native', builders), /positive safe integer/);
+  }
+  await assert.rejects(cli._tsc(root, true, 'typescript', 1), /requires --compiler=native/);
+});
+
+test('root commands retain optional native checks and use legacy in CI', () => {
+  const scripts = JSON.parse(readFileSync(path.join(root, 'package.json'), 'utf8')).scripts;
+  const vonaScripts = JSON.parse(
+    readFileSync(path.join(root, 'vona/package.original.json'), 'utf8'),
+  ).scripts;
+  assert.equal(scripts.tsc, 'npm run tsc:native');
+  assert.equal(scripts['tsc:native'], 'npm run tsc:zova:native && npm run tsc:vona:native');
+  assert.equal(scripts['tsc:force'], 'npm run tsc:zova:native && npm run tsc:vona:native:force');
+  assert.equal(scripts['tsc:vona:native'], 'pnpm --dir vona run tsc:native');
+  assert.equal(scripts['tsc:vona:native:force'], 'pnpm --dir vona run tsc:native:force');
+  assert.equal(
+    vonaScripts['tsc:native'],
+    'npm run prerun && npm run vona :bin:tsc -- --compiler=native',
+  );
+  assert.equal(vonaScripts['tsc:native:force'], `${vonaScripts['tsc:native']} --force`);
+  assert.equal(vonaScripts['tsc:legacy'], 'npm run prerun && npm run vona :bin:tsc -- --force');
+  assert.equal(scripts['tsc:legacy'], 'npm run tsc:zova:legacy && pnpm --dir vona run tsc:legacy');
+  assert.equal(
+    scripts['tsc:zova:legacy'],
+    'node scripts/typecheck.ts typescript zova --noEmit --incremental false --project tsconfig.vue-tsc.json',
+  );
+  const workflow = readFileSync(path.join(root, '.github/workflows/vona-tsc.yml'), 'utf8');
+  assert.match(workflow, /run: npm run tsc:legacy\s*$/m);
+  assert.doesNotMatch(workflow, /run:.*tsc(?::[\w-]+)*native|npm run tsc:force/);
+});
+
+test('release dry-run keeps forced checks before publishing only', () => {
+  for (const [mode, shouldCheck] of [
+    ['--publish-only', true],
+    ['--changelog-only', false],
+    ['--release-only', false],
+  ] as const) {
+    const result = spawnSync(process.execPath, ['scripts/release.ts', '--dry-run', mode], {
+      cwd: root,
+      encoding: 'utf8',
+      timeout: 30_000,
+    });
+    assert.equal(result.error, undefined);
+    assert.equal(result.status, 0, result.stderr);
+    const check = result.stdout.indexOf('[dry-run] npm run tsc:force');
+    assert.equal(check !== -1, shouldCheck, mode);
+    if (shouldCheck) {
+      assert.ok(result.stdout.indexOf('[dry-run] npm publish') > check);
+    }
+  }
+});
+
+test('installation retains TS5 APIs and exact stable native compiler', () => {
+  for (const workspace of ['.', 'vona', 'zova']) {
+    const require = createRequire(path.join(root, workspace, 'package.json'));
+    const ts = require('typescript');
+    assert.equal(ts.version, '5.9.3');
+    assert.equal(typeof ts.createSourceFile, 'function');
+    assert.match(ts.transpileModule('const value: number = 1;', {}).outputText, /value/);
+  }
+  const require = createRequire(path.join(root, 'package.json'));
+  assert.equal(require('@typescript/native/package.json').version, '7.0.2');
+});

package/scripts/typecheck.ts

@@ -0,0 +1,20 @@
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { runTypeScript } from '../vona/packages-cli/cli-set-api/src/lib/typescriptRunner.ts';
+
+const [compiler, workspace, ...args] = process.argv.slice(2);
+if ((compiler !== 'native' && compiler !== 'typescript') || !['vona', 'zova'].includes(workspace)) {
+  console.error(
+    'Usage: node scripts/typecheck.ts <native|typescript> <vona|zova> [compiler arguments]',
+  );
+  process.exitCode = 1;
+} else {
+  const projectPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', workspace);
+  try {
+    await runTypeScript(compiler, args, { projectPath });
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : error);
+    process.exitCode = (error as { exitCode?: number }).exitCode ?? 1;
+  }
+}