cabloy 5.1.225 → 5.1.227

package/vona/src/suite/a-home/modules/home-user/test/accountPasswordSet.test.ts

@@ -15,7 +15,7 @@ interface IAccountPasswordSetFixture {
   email?: string;
 }
 
-describe('accountPasswordSet.test.ts', { concurrency: false, sequential: true }, () => {
+describe('accountPasswordSet.test.ts', { concurrency: false }, () => {
   const releases: Array<() => void> = [];
 
   before(async () => {
@@ -587,6 +587,7 @@ async function configurePasswordSet(
   return await app.bean.executor.mockCtx(async () => {
     const options =
       app.bean.onion.middlewareSystem.getOnionSlice('a-security:cors').beanOptions.options;
+    assert.ok(options);
     const whiteListPrevious = options.whiteList;
     options.whiteList = Array.isArray(whiteList) ? [...whiteList] : whiteList;
     return () => {

package/vona/src/suite/a-training/modules/training-record/test/record.test.ts

@@ -1,14 +1,13 @@
 import type { DtoRecordCreate, DtoRecordUpdate } from 'vona-module-training-record';
 import type { DtoStudentCreate } from 'vona-module-training-student';
 
-import { ZodMetadata } from '@cabloy/zod-openapi';
 import fse from 'fs-extra';
 import assert from 'node:assert';
 import os from 'node:os';
 import path from 'node:path';
 import { describe, it } from 'node:test';
 import { app } from 'vona-mock';
-import { getTargetDecoratorRules } from 'vona-module-a-openapiutils';
+import { $makeMetadata, getTargetDecoratorRules } from 'vona-module-a-openapiutils';
 
 import { DtoDetailRecordSubjectResItem } from '../src/dto/detailRecordSubjectResItem.tsx';
 import { DtoRecordSelectReq } from '../src/dto/recordSelectReq.tsx';
@@ -31,7 +30,8 @@ describe('record.test.ts', () => {
       assert.equal(subjectComponent.required?.includes('_lineNumber'), false);
 
       const selectReqRules = getTargetDecoratorRules(DtoRecordSelectReq.prototype);
-      const studentIdMetadata = ZodMetadata.getOpenapiMetadata(selectReqRules.studentId!);
+      assert.ok(selectReqRules.studentId);
+      const studentIdMetadata = $makeMetadata(selectReqRules.studentId);
       assert.equal(selectReqRules.studentId?.type, 'optional');
       assert.deepEqual(studentIdMetadata?.filter, {
         table: 'trainingStudent',
@@ -52,13 +52,18 @@ describe('record.test.ts', () => {
         'V31',
       );
       const parameters = controllerApiJson.paths?.['/api/training/record']?.get?.parameters ?? [];
-      const studentIdParameter = parameters.find(parameter => parameter.name === 'studentId');
+      const studentIdParameter = parameters.find(
+        parameter => !('$ref' in parameter) && parameter.name === 'studentId',
+      );
       assert.ok(studentIdParameter);
+      assert.ok(!('$ref' in studentIdParameter));
       assert.equal(studentIdParameter.in, 'query');
       assert.equal(studentIdParameter.required, false);
-      assert.deepEqual(studentIdParameter.schema?.type, ['string', 'null']);
+      assert.ok(studentIdParameter.schema);
+      assert.ok(!('$ref' in studentIdParameter.schema));
+      assert.deepEqual(studentIdParameter.schema.type, ['string', 'null']);
       assert.equal(
-        parameters.some(parameter => parameter.name === 'studentName'),
+        parameters.some(parameter => !('$ref' in parameter) && parameter.name === 'studentName'),
         false,
       );
 
@@ -93,7 +98,7 @@ describe('record.test.ts', () => {
     await app.bean.executor.mockCtx(async () => {
       const studentData: DtoStudentCreate = {
         name: '__Student__',
-        description: 'This is a student for record test',
+        content: { descriptionMarkdown: 'This is a student for record test' },
         mobile: '13812345678',
         level: 1,
         trainingRecords: [],

package/vona/src/suite/a-training/modules/training-student/test/student.test.ts

@@ -106,13 +106,20 @@ describe('student.test.ts', { concurrency: false }, () => {
       );
       const operation = apiJson.paths?.['/api/training/student/bulk/delete']?.post;
       assert.equal(operation?.operationId, 'TrainingStudent_deleteBulk');
-      const requestSchema = operation?.requestBody?.content?.['application/json']?.schema as any;
-      const requestSchemaRef = requestSchema?.$ref;
-      assert.ok(requestSchemaRef);
+      const requestBody = operation?.requestBody;
+      assert.ok(requestBody);
+      assert.ok(!('$ref' in requestBody));
+      const requestSchema = requestBody.content['application/json']?.schema;
+      assert.ok(requestSchema && '$ref' in requestSchema);
+      const requestSchemaRef = requestSchema.$ref;
+      assert.ok(typeof requestSchemaRef === 'string');
       const requestSchemaName = requestSchemaRef.replace('#/components/schemas/', '');
-      const component = apiJson.components?.schemas?.[requestSchemaName] as any;
-      assert.equal(component?.properties?.ids?.minItems, 1);
-      assert.equal(component?.properties?.ids?.maxItems, 100);
+      const component = apiJson.components?.schemas?.[requestSchemaName];
+      assert.ok(component && !('$ref' in component));
+      const idsSchema = component.properties?.ids;
+      assert.ok(idsSchema && !('$ref' in idsSchema));
+      assert.equal(idsSchema.minItems, 1);
+      assert.equal(idsSchema.maxItems, 100);
     });
   });
 
@@ -562,17 +569,22 @@ describe('student.test.ts', { concurrency: false }, () => {
       await app.bean.passport.signinMock();
       let studentId: string | undefined;
       try {
-        studentId = await app.bean.executor.performAction('post', '/training/student', {
-          body: { name: '__DeleteBulkIdempotent__', mobile: '13891234567', level: 1 },
-        });
+        const createdStudentId = await app.bean.executor.performAction(
+          'post',
+          '/training/student',
+          {
+            body: { name: '__DeleteBulkIdempotent__', mobile: '13891234567', level: 1 },
+          },
+        );
+        studentId = createdStudentId;
         const deleted = await app.bean.executor.performAction(
           'post',
           '/training/student/bulk/delete',
-          { body: { ids: [studentId, studentId, '-1'] } },
+          { body: { ids: [createdStudentId, createdStudentId, '-1'] } },
         );
         assert.equal(deleted, null);
         assert.equal(
-          await app.scope('training-student').model.student.getById(studentId),
+          await app.scope('training-student').model.student.getById(createdStudentId),
           undefined,
         );
       } finally {

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-rbac",
-  "version": "5.0.13",
+  "version": "5.0.15",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/test/rbacCatalogGuard.test.ts

@@ -182,7 +182,11 @@ describe('rbacCatalogGuard.test.ts', { concurrency: false }, () => {
 
   it('rejects class-level RBAC decoration', () => {
     class Controller {}
-    assert.throws(() => Passport.rbac()(Controller), /must decorate an action/);
+    // Deliberately misuse the method decorator as a class decorator to test runtime rejection.
+    assert.throws(
+      () => (Passport.rbac() as unknown as ClassDecorator)(Controller),
+      /must decorate an action/,
+    );
   });
 
   it('resolves aliases to the terminal same-controller grant identity', () => {

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-ssr",
-  "version": "5.1.34",
+  "version": "5.1.35",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/test/ssrMenuVisibility.test.ts

@@ -12,7 +12,7 @@ function createMenus() {
   return [
     { name: 'test:public', title: 'Public', group: 'root' },
     { name: 'test:dynamic', title: 'Dynamic', roles: [], group: 'root' },
-    { name: 'test:static', title: 'Static', roles: ['member'] },
+    { name: 'test:static', title: 'Static', roles: ['registeredUser'] },
   ] as any;
 }
 
@@ -20,7 +20,7 @@ describe('ssrMenuVisibility.test.ts', () => {
   it('distinguishes public, dynamic-only, and static leaves', () => {
     const menus = createMenus();
     assert.deepEqual(
-      resolveSsrMenuVisibilityDefault(menus, roles => roles.includes('member')),
+      resolveSsrMenuVisibilityDefault(menus, roles => roles.includes('registeredUser')),
       [menus[0], menus[2]],
     );
     assert.deepEqual(
@@ -44,7 +44,7 @@ describe('ssrMenuVisibility.test.ts', () => {
       {
         name: 'test:private',
         title: 'Private',
-        roles: ['member'],
+        roles: ['registeredUser'],
         policyRevision: 'private',
         associationState: 'private',
       },

package/vona/src/suite-vendor/a-cabloy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-cabloy",
-  "version": "5.1.64",
+  "version": "5.1.66",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",
@@ -10,7 +10,7 @@
     "vona-module-a-cabloy": "workspace:^",
     "vona-module-a-layoutprofile": "^5.0.2",
     "vona-module-a-markdown": "^5.0.3",
-    "vona-module-a-rbac": "^5.0.13",
+    "vona-module-a-rbac": "^5.0.15",
     "vona-module-a-socket": "workspace:^",
     "vona-module-a-ssr": "workspace:^",
     "vona-module-a-ssrhmr": "workspace:^"

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.65",
+  "version": "5.1.66",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-metrics/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-metrics",
-  "version": "5.0.5",
+  "version": "5.0.6",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-vona/modules/a-metrics/test/middlewareSystem.health.test.ts

@@ -110,16 +110,21 @@ function fixture() {
 }
 
 function withServerEnv(callback: () => Promise<void>) {
-  const names = ['META_MODE', 'VONA_TEST_RUN_ID', 'VONA_TEST_READY_KEY'] as const;
-  const old = names.map(name => process.env[name]);
+  const old = {
+    META_MODE: process.env.META_MODE,
+    VONA_TEST_RUN_ID: process.env.VONA_TEST_RUN_ID,
+    VONA_TEST_READY_KEY: process.env.VONA_TEST_READY_KEY,
+  };
   process.env.META_MODE = 'test';
   process.env.VONA_TEST_RUN_ID = runId;
   process.env.VONA_TEST_READY_KEY = key;
   return callback().finally(() => {
-    for (const [index, name] of names.entries()) {
-      if (old[index] === undefined) delete process.env[name];
-      else process.env[name] = old[index];
-    }
+    if (old.META_MODE === undefined) Reflect.deleteProperty(process.env, 'META_MODE');
+    else process.env.META_MODE = old.META_MODE;
+    if (old.VONA_TEST_RUN_ID === undefined) delete process.env.VONA_TEST_RUN_ID;
+    else process.env.VONA_TEST_RUN_ID = old.VONA_TEST_RUN_ID;
+    if (old.VONA_TEST_READY_KEY === undefined) delete process.env.VONA_TEST_READY_KEY;
+    else process.env.VONA_TEST_READY_KEY = old.VONA_TEST_READY_KEY;
   });
 }
 
@@ -276,15 +281,31 @@ describe('authenticated managed shutdown', { concurrency: false }, () => {
     });
   }
 
-  for (const [name, value] of [
-    ['META_MODE', 'dev'],
-    ['VONA_TEST_RUN_ID', '20261014010203-d4e5f6a7'],
-    ['VONA_TEST_READY_KEY', 'not-a-key'],
-  ] as const) {
+  const invalidServerEnv: [string, () => void][] = [
+    [
+      'META_MODE',
+      () => {
+        process.env.META_MODE = 'dev';
+      },
+    ],
+    [
+      'VONA_TEST_RUN_ID',
+      () => {
+        process.env.VONA_TEST_RUN_ID = '20261014010203-d4e5f6a7';
+      },
+    ],
+    [
+      'VONA_TEST_READY_KEY',
+      () => {
+        process.env.VONA_TEST_READY_KEY = 'not-a-key';
+      },
+    ],
+  ];
+  for (const [name, change] of invalidServerEnv) {
     test(`shutdown requires matching server-only ${name}`, async () => {
       await withServerEnv(async () => {
         const f = fixture();
-        process.env[name] = value;
+        change();
         await f.execute();
         assert.equal(f.ctx.status, 404);
         assert.equal(f.ctx.res.listenerCount('finish'), 0);

package/vona/src/suite-vendor/a-vona/modules/a-openapi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-openapi",
-  "version": "5.1.24",
+  "version": "5.1.25",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-openapi/src/types/permissions.ts

@@ -31,7 +31,9 @@ export interface IOpenapiPermissionActionRbac {
 export type IOpenapiPermissionAction = boolean | IOpenapiPermissionActionRbac;
 
 export type IOpenapiPermissionModeActionActions = {
-  [K in keyof IResourceTableActionRecord]?: IOpenapiPermissionAction; // IResourceTableActionRecord[K];
+  [K in keyof IResourceTableActionRecord]?: IOpenapiPermissionAction;
+} & {
+  [action: string]: IOpenapiPermissionAction | undefined;
 };
 
 export interface IOpenapiPermissions {

package/vona/src/suite-vendor/a-vona/modules/a-orm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-orm",
-  "version": "5.1.36",
+  "version": "5.1.38",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "db",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-orm/src/lib/bean.model/bean.model_crud_inner.ts

@@ -5,6 +5,8 @@ import { isNil } from '@cabloy/utils';
 import { cast } from 'vona';
 
 import type {
+  IBuildModelCountParams,
+  IBuildModelSelectParams,
   IModelCountParams,
   IModelGetOptionsGeneral,
   IModelIncrementParams,
@@ -63,7 +65,9 @@ export class BeanModelCrudInner<TRecord extends {}> extends BeanModelView<TRecor
     return result;
   }
 
-  protected async _select<T extends IModelSelectParams<TRecord>>(
+  protected async _select<
+    T extends IModelSelectParams<TRecord> | IBuildModelSelectParams<TRecord, undefined, never>,
+  >(
     table?: keyof ITableRecord,
     params?: T,
     options?: IModelMethodOptionsGeneral,
@@ -141,7 +145,7 @@ export class BeanModelCrudInner<TRecord extends {}> extends BeanModelView<TRecor
 
   protected async _count(
     table?: keyof ITableRecord,
-    params?: IModelCountParams<TRecord>,
+    params?: IModelCountParams<TRecord> | IBuildModelCountParams<TRecord, undefined, never>,
     options?: IModelMethodOptionsGeneral,
   ): Promise<string | undefined> {
     // table

package/vona/src/suite-vendor/a-vona/modules/a-orm/src/lib/bean.model/bean.model_crud_table.ts

@@ -1,10 +1,10 @@
 import type { TableIdentity } from 'table-identity';
 
 import type {
-  IModelCountParams,
+  IBuildModelCountParams,
+  IBuildModelSelectParams,
   IModelGetOptionsGeneral,
   IModelMethodOptionsGeneral,
-  IModelSelectParams,
   IModelUpdateOptionsGeneral,
   ITableRecord,
   TypeModelWhere,
@@ -23,7 +23,7 @@ export class BeanModelCrudTable<TRecord extends {}> extends BeanModelCrudInner<T
 
   async select(
     table: keyof ITableRecord,
-    params?: Omit<IModelSelectParams<TRecord>, 'include' | 'with'>,
+    params?: Omit<IBuildModelSelectParams<TRecord, undefined, never>, 'include' | 'with'>,
     options?: IModelMethodOptionsGeneral,
   ): Promise<TRecord[]> {
     return await this._select(table, params, options);
@@ -39,7 +39,7 @@ export class BeanModelCrudTable<TRecord extends {}> extends BeanModelCrudInner<T
 
   async count(
     table: keyof ITableRecord,
-    params?: IModelCountParams<TRecord>,
+    params?: IBuildModelCountParams<TRecord, undefined, never>,
     options?: IModelMethodOptionsGeneral,
   ): Promise<string | undefined> {
     return await this._count(table, params, options);

package/vona/src/suite-vendor/a-vona/modules/a-orm/src/types/dto/dtoMutate.ts

@@ -65,14 +65,16 @@ export type TypeDtoMutateRelationResult<
   TTopLevel extends boolean | undefined = undefined,
   TColumns = undefined,
   REFKEY = undefined,
-> = TypeDtoMutateRelationResultEntity<
-  TRecord,
-  TColumns extends string | string[] ? TColumns : TypeUtilGetParamsColumns<TOptionsRelation>,
-  TMutateTypeTopLevel,
-  TColumnsOmitDefault,
-  TTopLevel,
-  REFKEY
-> &
+> = (TOptionsRelation extends { dtoClass: Constructable<infer TDto> }
+  ? TypeDtoMutateRelationResultDto<TDto, TMutateTypeTopLevel, TTopLevel, REFKEY>
+  : TypeDtoMutateRelationResultEntity<
+      TRecord,
+      TColumns extends string | string[] ? TColumns : TypeUtilGetParamsColumns<TOptionsRelation>,
+      TMutateTypeTopLevel,
+      TColumnsOmitDefault,
+      TTopLevel,
+      REFKEY
+    >) &
   (TModel extends BeanModelMeta
     ? OmitNever<
         TypeDtoMutateRelationResultMergeInclude<
@@ -158,6 +160,17 @@ type TypeDtoMutateRelationResultMergeWithRelation<
         >
       : never;
 
+// Relation options supply the default dtoClass; an include wrapper may override it.
+type TypeUtilGetDtoMutateRelationParams<Relation, IncludeWrapper> = IncludeWrapper extends {
+  dtoClass: Constructable<unknown>;
+}
+  ? IncludeWrapper
+  : TypeUtilGetRelationOptions<Relation> extends {
+        dtoClass: infer TDtoClass extends Constructable<unknown>;
+      }
+    ? (IncludeWrapper extends {} ? IncludeWrapper : {}) & { dtoClass: TDtoClass }
+    : IncludeWrapper;
+
 type TypeUtilGetDtoMutateRelationEntityByType<
   TMutateTypeTopLevel extends TypeDtoMutateType,
   Relation,
@@ -167,7 +180,7 @@ type TypeUtilGetDtoMutateRelationEntityByType<
   TypeUtilGetRelationEntity<Relation>,
   TypeUtilGetRelationType<Relation>,
   TypeUtilGetRelationModel<Relation>,
-  IncludeWrapper,
+  TypeUtilGetDtoMutateRelationParams<Relation, IncludeWrapper>,
   TypeUtilGetColumnsFromRelationAndIncludeWrapper<Relation, IncludeWrapper>,
   TypeUtilGetRelationKey<Relation>
 >;
@@ -211,6 +224,22 @@ type TypeUtilGetDtoMutateEntityByType<
             >
           | undefined;
 
+// dtoClass supplies its own fields, so neither columns nor default entity omissions apply.
+// Nested mutations still remove the parent key and patch identity/deletion fields that exist.
+type TypeDtoMutateRelationResultDto<
+  TDto,
+  TMutateTypeTopLevel extends TypeDtoMutateType,
+  TTopLevel extends boolean | undefined,
+  REFKEY,
+> = TTopLevel extends false
+  ? Omit<
+      TMutateTypeTopLevel extends 'create'
+        ? Omit<TDto, 'id' | 'deleted'>
+        : Partial<Pick<TDto, Extract<keyof TDto, 'id' | 'deleted'>>> & Omit<TDto, 'id' | 'deleted'>,
+      Extract<keyof TDto, REFKEY>
+    >
+  : TDto;
+
 type TypeDtoMutateRelationResultEntity<
   TRecord,
   Columns = undefined,

package/vona/src/suite-vendor/a-vona/modules/a-orm/src/types/relationsGroup.ts

@@ -5,6 +5,8 @@ import type {
   TypeUtilGetParamsColumns,
   TypeUtilGetParamsGroups,
   TypeUtilGetRelationOptionsGroups,
+  TypeUtilEntitySelector,
+  TypeUtilPrepareColumns,
 } from './relations.ts';
 import type {
   TypeModelAggrRelationResultAggr,
@@ -21,9 +23,9 @@ export type TypeModelGroupRelationResult<TRecord, TOptions> = TypeModelGroupRela
   TypeUtilGetParamsColumns<TOptions>
 >;
 
-export type TypeModelGroupRelationResultGroups<TRecord, Aggrs, Groups, Columns> = Groups extends
-  | string
-  | string[]
+export type TypeModelGroupRelationResultGroups<TRecord, Aggrs, Groups, Columns> = [Groups] extends [
+  string | string[],
+]
   ? TypeModelGroupRelationResultGroupsObject<TRecord, Groups, Columns> &
       (Aggrs extends {}
         ? TypeRecordAggrsValuesToObject<
@@ -36,11 +38,11 @@ export type TypeModelGroupRelationResultGroups<TRecord, Aggrs, Groups, Columns>
         : {})
   : {}; // not use undefined
 
-export type TypeModelGroupRelationResultGroupsObject<TRecord, Groups, Columns> = Columns extends
-  | string
-  | string[]
-  ? { [K in TypeUtilAggrPrepareColumns<Columns>]: K extends keyof TRecord ? TRecord[K] : never }
-  : Groups extends string | string[]
+export type TypeModelGroupRelationResultGroupsObject<TRecord, Groups, Columns> = [Columns] extends [
+  string | string[],
+]
+  ? TypeUtilEntitySelector<TRecord, TypeUtilPrepareColumns<Columns>>
+  : [Groups] extends [string | string[]]
     ? { [K in TypeUtilAggrPrepareColumns<Groups>]: K extends keyof TRecord ? TRecord[K] : never }
     : {};
 
@@ -68,8 +70,8 @@ export type TypeModelSelectGroupParamsColumns<
   TypeModelAggrRelationResultAggrsToNumberType<TypeModelAggrRelationResultAggrs<Aggrs>>;
 
 export type TypeModelAggrRelationResultAggrsToNumberType<Columns> = {
-  [K in keyof Columns]: string;
-}; // not use BigNumber or number | string
+  [K in keyof Columns]: number | string;
+};
 
 export type TypeUtilGetGroupsFromRelationAndIncludeWrapper<
   Relation,

package/vona/src/suite-vendor/a-vona/modules/a-orm/test/dtoMutate.types.test.ts

@@ -0,0 +1,129 @@
+import type { TableIdentity } from 'table-identity';
+
+import type { BeanModelMeta } from '../src/lib/bean.model/bean.model_meta.ts';
+import type { TypeDtoMutateResult } from '../src/types/dto/dtoMutate.ts';
+import type { TypeSymbolKeyModelOptions } from '../src/types/relations.ts';
+
+// Normalize intersections inside relation arrays before comparing complete shapes.
+type Normalize<T> = T extends Date ? T : T extends object ? { [K in keyof T]: Normalize<T[K]> } : T;
+type Equal<A, B> =
+  (<T>() => T extends Normalize<A> ? 1 : 2) extends <T>() => T extends Normalize<B> ? 1 : 2
+    ? true
+    : false;
+function expectType<_T extends true>() {}
+
+type Entity = {
+  id: TableIdentity;
+  iid: number;
+  deleted: boolean;
+  createdAt: Date;
+  updatedAt: Date;
+  parentId: TableIdentity;
+  entityOnly: string;
+};
+declare class CustomDto {
+  id: TableIdentity;
+  parentId: TableIdentity;
+  createdAt: Date;
+  custom: string[];
+  optional?: number;
+}
+type Model<Relations = {}> = BeanModelMeta<Entity> & {
+  [K in TypeSymbolKeyModelOptions]: { relations: Relations };
+};
+type ChildModel = Model;
+type ParentModel = Model<{
+  children: {
+    type: 'hasMany';
+    model: new () => ChildModel;
+    key: 'parentId';
+    options: { columns: ['entityOnly']; dtoClass: typeof CustomDto };
+  };
+}>;
+
+// Compile-time regressions, included in the normal Vona typecheck without loading the app.
+function checkDtoMutationTypes() {
+  type Params = { dtoClass: typeof CustomDto; columns: ['entityOnly'] };
+  expectType<
+    Equal<TypeDtoMutateResult<ChildModel, Params, 'create', 'createdAt', true>, CustomDto>
+  >();
+  expectType<Equal<TypeDtoMutateResult<ChildModel, Params, 'update', 'id', true>, CustomDto>>();
+  expectType<
+    Equal<TypeDtoMutateResult<ChildModel, Params, 'mutate', undefined, true>, CustomDto>
+  >();
+
+  type IncludedCreate = TypeDtoMutateResult<
+    ParentModel,
+    { include: { children: true } },
+    'create',
+    undefined,
+    true
+  >;
+  expectType<
+    Equal<IncludedCreate['children'], Array<Omit<CustomDto, 'id' | 'parentId'>> | undefined>
+  >();
+
+  type IncludedUpdate = TypeDtoMutateResult<
+    ParentModel,
+    { include: { children: { columns: ['entityOnly'] } } },
+    'update',
+    undefined,
+    true
+  >;
+  // The existing id becomes optional; absent deleted is not invented, and parentId is removed.
+  expectType<
+    Equal<
+      IncludedUpdate['children'],
+      | Array<{
+          id?: TableIdentity;
+          createdAt: Date;
+          custom: string[];
+          optional?: number;
+        }>
+      | undefined
+    >
+  >();
+
+  // dtoClass supplied by an include wrapper also overrides the entity without relation defaults.
+  type IncludedOverride = TypeDtoMutateResult<
+    Model<{ children: { type: 'hasOne'; model: new () => ChildModel; key: 'parentId' } }>,
+    { include: { children: Params } },
+    'mutate',
+    undefined,
+    true
+  >;
+  expectType<
+    Equal<IncludedOverride['children'], NonNullable<IncludedUpdate['children']>[number] | undefined>
+  >();
+
+  // The no-dtoClass path retains its default omissions and relation/column inference.
+  expectType<
+    Equal<
+      TypeDtoMutateResult<ChildModel, undefined, 'create', undefined, true>,
+      Pick<Entity, 'parentId' | 'entityOnly'>
+    >
+  >();
+  type DefaultNested = TypeDtoMutateResult<
+    ChildModel,
+    {
+      with: {
+        children: {
+          type: 'hasMany';
+          model: new () => ChildModel;
+          key: 'parentId';
+          options: { columns: ['entityOnly'] };
+        };
+      };
+    },
+    'update',
+    undefined,
+    true
+  >;
+  expectType<
+    Equal<
+      DefaultNested['children'],
+      Array<{ entityOnly: string; id?: TableIdentity; deleted?: boolean }> | undefined
+    >
+  >();
+}
+void checkDtoMutationTypes;

package/vona/src/suite-vendor/a-vona/modules/a-permission/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-permission",
-  "version": "5.1.29",
+  "version": "5.1.31",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-security/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-security",
-  "version": "5.1.15",
+  "version": "5.1.16",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [