cabloy 5.1.230 → 5.1.232

package/vona/pnpm-lock.yaml

@@ -174,7 +174,7 @@ overrides:
   zod: npm:@cabloy/zod@4.3.8
 
 patchedDependencies:
-  zova-core@5.1.93: 144450bd7a567a6067e5857c0cf4c780981b7e90bc48745c09e1696a9b6f1b97
+  zova-core@5.1.94: 144450bd7a567a6067e5857c0cf4c780981b7e90bc48745c09e1696a9b6f1b97
 
 importers:
 
@@ -737,11 +737,11 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.174
-        version: 5.1.174(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.175
+        version: 5.1.175(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
       zova-jsx:
-        specifier: ^1.1.93
-        version: 1.1.93(typescript@5.9.3)
+        specifier: ^1.1.94
+        version: 1.1.94(typescript@5.9.3)
       zova-module-a-api:
         specifier: ^5.1.22
         version: 5.1.22
@@ -752,8 +752,8 @@ importers:
         specifier: ^5.1.36
         version: 5.1.36
       zova-module-a-behavior:
-        specifier: ^5.1.26
-        version: 5.1.26
+        specifier: ^5.1.27
+        version: 5.1.27
       zova-module-a-behaviors:
         specifier: ^5.1.22
         version: 5.1.22
@@ -785,8 +785,8 @@ importers:
         specifier: ^5.1.38
         version: 5.1.38(vue@3.5.43(typescript@5.9.3))
       zova-module-a-openapi:
-        specifier: ^5.1.57
-        version: 5.1.57
+        specifier: ^5.1.58
+        version: 5.1.58
       zova-module-a-pay:
         specifier: ^5.0.9
         version: 5.0.9
@@ -818,11 +818,11 @@ importers:
         specifier: ^5.1.44
         version: 5.1.44(vue@3.5.43(typescript@5.9.3))
       zova-module-a-zod:
-        specifier: ^5.1.37
-        version: 5.1.37
+        specifier: ^5.1.38
+        version: 5.1.38
       zova-module-a-zova:
-        specifier: ^5.1.111
-        version: 5.1.111(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.112
+        version: 5.1.112(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
       zova-module-pay-mock:
         specifier: ^5.0.5
         version: 5.0.5
@@ -866,11 +866,11 @@ importers:
         specifier: npm:@cabloy/zod@4.3.8
         version: '@cabloy/zod@4.3.8'
       zova:
-        specifier: ^5.1.174
-        version: 5.1.174(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.175
+        version: 5.1.175(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
       zova-jsx:
-        specifier: ^1.1.93
-        version: 1.1.93(typescript@5.9.3)
+        specifier: ^1.1.94
+        version: 1.1.94(typescript@5.9.3)
       zova-module-a-api:
         specifier: ^5.1.22
         version: 5.1.22
@@ -881,8 +881,8 @@ importers:
         specifier: ^5.1.36
         version: 5.1.36
       zova-module-a-behavior:
-        specifier: ^5.1.26
-        version: 5.1.26
+        specifier: ^5.1.27
+        version: 5.1.27
       zova-module-a-behaviors:
         specifier: ^5.1.22
         version: 5.1.22
@@ -914,8 +914,8 @@ importers:
         specifier: ^5.1.38
         version: 5.1.38(vue@3.5.43(typescript@5.9.3))
       zova-module-a-openapi:
-        specifier: ^5.1.57
-        version: 5.1.57
+        specifier: ^5.1.58
+        version: 5.1.58
       zova-module-a-pay:
         specifier: ^5.0.9
         version: 5.0.9
@@ -947,11 +947,11 @@ importers:
         specifier: ^5.1.44
         version: 5.1.44(vue@3.5.43(typescript@5.9.3))
       zova-module-a-zod:
-        specifier: ^5.1.37
-        version: 5.1.37
+        specifier: ^5.1.38
+        version: 5.1.38
       zova-module-a-zova:
-        specifier: ^5.1.111
-        version: 5.1.111(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+        specifier: ^5.1.112
+        version: 5.1.112(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
       zova-module-pay-mock:
         specifier: ^5.0.5
         version: 5.0.5
@@ -1933,7 +1933,7 @@ importers:
         specifier: workspace:^
         version: link:modules/a-auth
       vona-module-auth-oauth:
-        specifier: ^5.0.12
+        specifier: ^5.0.13
         version: link:modules/auth-oauth
       vona-module-auth-simple:
         specifier: workspace:^
@@ -1990,7 +1990,7 @@ importers:
         specifier: ^5.0.3
         version: link:modules/a-markdown
       vona-module-a-rbac:
-        specifier: ^5.0.15
+        specifier: ^5.0.16
         version: link:modules/a-rbac
       vona-module-a-socket:
         specifier: workspace:^
@@ -9415,9 +9415,15 @@ packages:
   zova-core@5.1.93:
     resolution: {integrity: sha512-4UukkCdDVSDzX7eLGnu3gfvUVKcE80xZ98/8LmbaIJ0NDz9Chsr2W4Zfz2B+DzvhHSiyOSXMtrlTLbIkieyCMg==}
 
+  zova-core@5.1.94:
+    resolution: {integrity: sha512-puo3pqa4/ngwZj//Md457XMloZ4FRaoJlmwf+zyPyxKL7GoV81BaJeUPi9szzY8aM9EkoWXBhSVA0cp6mTXBhw==}
+
   zova-jsx@1.1.93:
     resolution: {integrity: sha512-DU50tS3v5a2x7PIJak4Qnw8ZL3dFqR25lknqYUE4UDI8vdP8dajlTWOzcSb6+q0xlNaji6detWhZpj1Q+tb37A==}
 
+  zova-jsx@1.1.94:
+    resolution: {integrity: sha512-4QGgNE5J32PXYCgHBt8JBrTRp8CXADgZzIBUsovQmKfIwtMY6DK5+zPQeWBVqHoV5vK95RKhRPwdAKFGOLupeg==}
+
   zova-module-a-api@5.1.22:
     resolution: {integrity: sha512-6KHDm/Kw7dwu3/3R+eM8WR0UBv4b73ksAd9yL44cS7d5KS9o97PD0RDkwep+ziMdod1DvRMHu5QJbvp7DmKIVA==}
 
@@ -9430,6 +9436,9 @@ packages:
   zova-module-a-behavior@5.1.26:
     resolution: {integrity: sha512-gvsonG3yIwH6mcEW/NNyaw9LCJK7WjKAW3pDYkhH+kipOe3TLPgmCQFz2FM0UZIwtopbRsR12exs7Sx26QqnAg==}
 
+  zova-module-a-behavior@5.1.27:
+    resolution: {integrity: sha512-vXvPHGBs7o95Ed7DFVE3wAqdlYwDcrqCtjxXvgcdCrjTjNji3F31IF4UViG48NmExMeAyzC8CqpvG55BE4GI1Q==}
+
   zova-module-a-behaviors@5.1.22:
     resolution: {integrity: sha512-kpi6KB5XvTYTUWOlQHb27e2+l9JdXDlBOXsaP7qFiWog+owOXdc2wrKbLt2vofXPCRkty+rGXBvNqZh6NUixYg==}
 
@@ -9463,6 +9472,9 @@ packages:
   zova-module-a-openapi@5.1.57:
     resolution: {integrity: sha512-U6gKdYXNlD4wn1zgNUC+P3pg6lq23GZNESLipzVe7Zb7buqCXuEBjGdPa2NPrOuLxwWlZNg7Z4Q+GerBEF2geQ==}
 
+  zova-module-a-openapi@5.1.58:
+    resolution: {integrity: sha512-n+L5N9QB/F0P4FuhkDaHm7rHpMpAAc/5W0HEkC2WzCZsTiWBy75dMT8HwvwyXgpoJ4wrz/neoFWo0qKDnelveA==}
+
   zova-module-a-pay@5.0.9:
     resolution: {integrity: sha512-Chl6EKp30HBOGFCJXbla2/lS19WhzQyTZwgYmsL3nnG9Vt2TeUlb82vsYCVuDcy0cgmxVaWjPF7dzKL/r3Pfng==}
 
@@ -9496,9 +9508,15 @@ packages:
   zova-module-a-zod@5.1.37:
     resolution: {integrity: sha512-rXHN9rKbum9w3gDSnC/pIusG2d2FGJOcIauf8jrbT96f+Olk4Q3iV3t2V92mxiLCh9kMvBJPfcOgJFW7pRB5Fw==}
 
+  zova-module-a-zod@5.1.38:
+    resolution: {integrity: sha512-DSAghiWoukNKYPEMLldup4as+xw6XdbpsHtxGKui1IuaaMub42NrPGD9HsHL9EjfzJPAOg1y+St80nhHCigHSA==}
+
   zova-module-a-zova@5.1.111:
     resolution: {integrity: sha512-hJulIPEzWyiKfSClYFVxr3oek49kGOO1Boe2j4Meh9bP7SBHOnvDhbc8FrC9yIM6XhmAiGF39OAbW79ynQowDQ==}
 
+  zova-module-a-zova@5.1.112:
+    resolution: {integrity: sha512-9fIjrumlmSwBetltTTrUpE5Y1veQHE/Yi8BNOGKKGWUkPg/bieUiMv+PcqiDB0LrixeerimOkDDCNSMGyX0nDw==}
+
   zova-module-pay-mock@5.0.5:
     resolution: {integrity: sha512-PFbNz1g2MDVp3NdvKV37WFzHTQ2awSPTD5iexkkOOloAaItmt/KYoV7xadM46wHUCSQZcZQ1SZdgDaUFev+R4Q==}
 
@@ -9514,9 +9532,15 @@ packages:
   zova-suite-a-zova@5.1.173:
     resolution: {integrity: sha512-B+VM8hlw/+rWs5ml2NhrMnzetnNvyp9GXpixlwl+OSY/xvymWLsO2AtANQLchtWgJCNp76NWaArfu4tkgZzrvA==}
 
+  zova-suite-a-zova@5.1.174:
+    resolution: {integrity: sha512-cNbRy63DDb7m7jR8O5mbtfJYD7sFYti6pfJlI7Qe0cvxQcNRu+6LaoxYZqqkFcRN2NpGp+qNxf4IPBOJB7CDvg==}
+
   zova@5.1.174:
     resolution: {integrity: sha512-3HrQpilMfkVuEDw7O/6RV9bB7aPkPLyrVKUYVrJEN/PX/rqg2bW9NRiW1CCzaXAfH4kDymnvYSEjKYLoVKa7rA==}
 
+  zova@5.1.175:
+    resolution: {integrity: sha512-C9xYw09xwpleenULNYfHGTtHa4vYcNjvLJLWzxGevkaAFLQ2WVXJvWIOIzgdV0lIx/h7YGS3WRhpDNwei3zhHA==}
+
   zwitch@1.0.5:
     resolution: {integrity: sha512-V50KMwwzqJV0NpZIZFwfOD5/lyny3WlSzRiXgA0G7VUnRlqttta1L6UQIHzd6EuBY/cHGfwTIck7w1yH6Q5zUw==}
 
@@ -15862,7 +15886,38 @@ snapshots:
 
   yocto-queue@0.1.0: {}
 
-  zova-core@5.1.93(patch_hash=144450bd7a567a6067e5857c0cf4c780981b7e90bc48745c09e1696a9b6f1b97)(typescript@5.9.3):
+  zova-core@5.1.93(typescript@5.9.3):
+    dependencies:
+      '@cabloy/compose': link:packages-utils/compose
+      '@cabloy/extend': link:packages-utils/extend
+      '@cabloy/json5': link:packages-utils/json5
+      '@cabloy/localeutil': link:packages-utils/localeutil
+      '@cabloy/logger': 1.1.25
+      '@cabloy/module-info': 2.0.3
+      '@cabloy/utils': link:packages-utils/utils
+      '@cabloy/vue-compiler-sfc': 3.5.14
+      '@cabloy/vue-reactivity': 3.5.16
+      '@cabloy/vue-router': 4.4.18(vue@3.5.43(typescript@5.9.3))
+      '@cabloy/vue-runtime-core': 3.5.57
+      '@cabloy/vue-runtime-dom': 3.5.13
+      '@cabloy/vue-server-renderer': 3.5.18(vue@3.5.43(typescript@5.9.3))
+      '@cabloy/word-utils': 2.1.14
+      '@cabloy/zod-errors-custom': link:packages-utils/zod-errors-custom
+      '@cabloy/zod-openapi': link:packages-utils/zod-openapi
+      '@cabloy/zod-query': link:packages-utils/zod-query
+      '@types/js-cookie': 3.0.6
+      '@types/ms': 2.1.0
+      '@vue/shared': 3.5.36
+      deep-equal: 2.2.3
+      ms: 2.1.3
+      reflect-metadata: 0.2.2
+      vue: 3.5.43(typescript@5.9.3)
+      vue-plugin-render-freeze: 2.0.4(vue@3.5.43(typescript@5.9.3))
+      zod: '@cabloy/zod@4.3.8'
+    transitivePeerDependencies:
+      - typescript
+
+  zova-core@5.1.94(patch_hash=144450bd7a567a6067e5857c0cf4c780981b7e90bc48745c09e1696a9b6f1b97)(typescript@5.9.3):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
       '@cabloy/extend': link:packages-utils/extend
@@ -15900,7 +15955,18 @@ snapshots:
       '@cabloy/word-utils': 2.1.14
       typestyle: 2.4.0
       vue: 3.5.43(typescript@5.9.3)
-      zova-core: 5.1.93(patch_hash=144450bd7a567a6067e5857c0cf4c780981b7e90bc48745c09e1696a9b6f1b97)(typescript@5.9.3)
+      zova-core: 5.1.93(typescript@5.9.3)
+    transitivePeerDependencies:
+      - typescript
+
+  zova-jsx@1.1.94(typescript@5.9.3):
+    dependencies:
+      '@cabloy/compose': link:packages-utils/compose
+      '@cabloy/utils': link:packages-utils/utils
+      '@cabloy/word-utils': 2.1.14
+      typestyle: 2.4.0
+      vue: 3.5.43(typescript@5.9.3)
+      zova-core: 5.1.94(patch_hash=144450bd7a567a6067e5857c0cf4c780981b7e90bc48745c09e1696a9b6f1b97)(typescript@5.9.3)
     transitivePeerDependencies:
       - typescript
 
@@ -15914,6 +15980,8 @@ snapshots:
 
   zova-module-a-behavior@5.1.26: {}
 
+  zova-module-a-behavior@5.1.27: {}
+
   zova-module-a-behaviors@5.1.22: {}
 
   zova-module-a-command@5.1.35: {}
@@ -15963,6 +16031,12 @@ snapshots:
       openapi3-ts: 4.6.1
       typestyle: 2.4.0
 
+  zova-module-a-openapi@5.1.58:
+    dependencies:
+      '@cabloy/json-schema-to-zod': 2.6.5
+      openapi3-ts: 4.6.1
+      typestyle: 2.4.0
+
   zova-module-a-pay@5.0.9: {}
 
   zova-module-a-rbac@5.0.1: {}
@@ -16006,6 +16080,13 @@ snapshots:
       '@cabloy/zod-query': link:packages-utils/zod-query
       zod: '@cabloy/zod@4.3.8'
 
+  zova-module-a-zod@5.1.38:
+    dependencies:
+      '@cabloy/zod-errors-custom': link:packages-utils/zod-errors-custom
+      '@cabloy/zod-openapi': link:packages-utils/zod-openapi
+      '@cabloy/zod-query': link:packages-utils/zod-query
+      zod: '@cabloy/zod@4.3.8'
+
   zova-module-a-zova@5.1.111(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
     dependencies:
       '@cabloy/compose': link:packages-utils/compose
@@ -16022,6 +16103,22 @@ snapshots:
       - typescript
       - vue
 
+  zova-module-a-zova@5.1.112(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
+    dependencies:
+      '@cabloy/compose': link:packages-utils/compose
+      '@cabloy/deps': link:packages-utils/deps
+      '@cabloy/json5': link:packages-utils/json5
+      '@cabloy/module-info': 2.0.3
+      '@cabloy/utils': link:packages-utils/utils
+      '@cabloy/vue-router': 4.4.18(vue@3.5.43(typescript@5.9.3))
+      '@cabloy/word-utils': 2.1.14
+      defu: 6.1.7
+      luxon: 3.7.2
+      zova-jsx: 1.1.94(typescript@5.9.3)
+    transitivePeerDependencies:
+      - typescript
+      - vue
+
   zova-module-pay-mock@5.0.5: {}
 
   zova-module-pay-paypal@5.0.2: {}
@@ -16063,9 +16160,42 @@ snapshots:
       - typescript
       - vue
 
+  zova-suite-a-zova@5.1.174(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
+    dependencies:
+      zova-module-a-api: 5.1.22
+      zova-module-a-app: 5.1.26
+      zova-module-a-bean: 5.1.36
+      zova-module-a-behavior: 5.1.27
+      zova-module-a-behaviors: 5.1.22
+      zova-module-a-command: 5.1.35
+      zova-module-a-fetch: 5.1.25(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)
+      zova-module-a-form: 5.1.54(vue@3.5.43(typescript@5.9.3))
+      zova-module-a-icon: 5.1.27
+      zova-module-a-interceptor: 5.1.31
+      zova-module-a-logger: 5.1.28
+      zova-module-a-meta: 5.1.22
+      zova-module-a-model: 5.1.38(vue@3.5.43(typescript@5.9.3))
+      zova-module-a-openapi: 5.1.58
+      zova-module-a-router: 5.1.42
+      zova-module-a-routerstack: 5.1.29
+      zova-module-a-routertabs: 5.1.35
+      zova-module-a-ssr: 5.1.40
+      zova-module-a-ssrhmr: 5.1.23
+      zova-module-a-ssrserver: 5.1.26
+      zova-module-a-style: 5.1.35
+      zova-module-a-table: 5.1.44(vue@3.5.43(typescript@5.9.3))
+      zova-module-a-zod: 5.1.38
+      zova-module-a-zova: 5.1.112(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+    transitivePeerDependencies:
+      - '@vue/composition-api'
+      - debug
+      - supports-color
+      - typescript
+      - vue
+
   zova@5.1.174(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
     dependencies:
-      zova-core: 5.1.93(patch_hash=144450bd7a567a6067e5857c0cf4c780981b7e90bc48745c09e1696a9b6f1b97)(typescript@5.9.3)
+      zova-core: 5.1.93(typescript@5.9.3)
       zova-suite-a-zova: 5.1.173(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
     transitivePeerDependencies:
       - '@vue/composition-api'
@@ -16074,6 +16204,17 @@ snapshots:
       - typescript
       - vue
 
+  zova@5.1.175(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3)):
+    dependencies:
+      zova-core: 5.1.94(patch_hash=144450bd7a567a6067e5857c0cf4c780981b7e90bc48745c09e1696a9b6f1b97)(typescript@5.9.3)
+      zova-suite-a-zova: 5.1.174(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)(vue@3.5.43(typescript@5.9.3))
+    transitivePeerDependencies:
+      - '@vue/composition-api'
+      - debug
+      - supports-color
+      - typescript
+      - vue
+
   zwitch@1.0.5: {}
 
   zwitch@2.0.4: {}

package/vona/pnpm-workspace.yaml

@@ -52,4 +52,4 @@ allowBuilds:
   vue-demi: true
 
 patchedDependencies:
-  zova-core@5.1.93: patches/zova-core@5.1.93.patch
+  zova-core@5.1.94: patches/zova-core@5.1.94.patch

package/vona/src/suite/a-commerce/modules/commerce-trade/src/dto/cartItem.tsx

@@ -29,6 +29,6 @@ export class DtoCartItem {
   @Api.field(v.required(), z.number().int().nonnegative())
   priceCents: number;
 
-  @Api.field(v.required(), z.number().int().positive())
+  @Api.field(v.required(), z.number().int().nonnegative())
   available: number;
 }

package/vona/src/suite/a-commerce/modules/commerce-trade/test/cartOwnership.test.ts

@@ -6,7 +6,10 @@ import { catchError } from '@cabloy/utils';
 import assert from 'node:assert';
 import { randomUUID } from 'node:crypto';
 import { after, before, describe, it } from 'node:test';
+import { appResource } from 'vona';
 import { acquireTestLock, app } from 'vona-mock';
+import { $schema } from 'vona-module-a-openapiutils';
+import { DtoCartItem, DtoCartView } from 'vona-module-commerce-trade';
 
 const actionPath = '/commerce/trade/cart';
 
@@ -39,22 +42,32 @@ async function performAs<
 
 async function registerAndSignin(name: string) {
   const user = await app.bean.user.register({ name }, true);
-  const token = await app.bean.passport.signinMock(name as any);
-  return { token: token.accessToken, user };
+  try {
+    const token = await app.bean.passport.signinMock(name as any);
+    return { token: token.accessToken, user };
+  } catch (error) {
+    await dropUser(user.id as number);
+    throw error;
+  }
 }
 
 async function createSellableSku(suffix: string): Promise<ISellableSkuFixture> {
+  const fixture: Partial<ISellableSkuFixture> = {};
   await app.bean.passport.signinMock();
   try {
-    const categoryId = await app.bean.executor.performAction('post', '/commerce/catalog/category', {
-      body: { name: `cart-category-${suffix}`, published: true },
-    });
-    const productId = await app.bean.executor.performAction('post', '/commerce/catalog/product', {
-      body: { categoryId, title: `cart-product-${suffix}`, published: true },
+    fixture.categoryId = await app.bean.executor.performAction(
+      'post',
+      '/commerce/catalog/category',
+      {
+        body: { name: `cart-category-${suffix}`, published: true },
+      },
+    );
+    fixture.productId = await app.bean.executor.performAction('post', '/commerce/catalog/product', {
+      body: { categoryId: fixture.categoryId, title: `cart-product-${suffix}`, published: true },
     });
-    const skuId = await app.bean.executor.performAction('post', '/commerce/catalog/sku', {
+    fixture.skuId = await app.bean.executor.performAction('post', '/commerce/catalog/sku', {
       body: {
-        productId,
+        productId: fixture.productId,
         code: `cart-sku-${suffix}`,
         priceCents: 100,
         lifecycle: 'active',
@@ -62,28 +75,35 @@ async function createSellableSku(suffix: string): Promise<ISellableSkuFixture> {
     });
     await app.bean.executor.performAction('post', '/commerce/trade/stockBalance/adjustStock', {
       body: {
-        skuId,
+        skuId: fixture.skuId,
         delta: 10,
         reason: `cart stock ${suffix}`,
         correlationId: `cart-stock-${suffix}`,
       },
     });
-    return { categoryId, productId, skuId };
+    return fixture as ISellableSkuFixture;
+  } catch (error) {
+    await dropSellableSku(fixture);
+    throw error;
   } finally {
     await app.bean.passport.signout();
   }
 }
 
-async function dropSellableSku(fixture: ISellableSkuFixture | undefined) {
+async function dropSellableSku(fixture: Partial<ISellableSkuFixture> | undefined) {
   if (!fixture) return;
   const trade = app.scope('commerce-trade');
   const catalog = app.scope('commerce-catalog');
-  await trade.model.stockAudit.delete({ skuId: fixture.skuId });
-  await trade.model.stockReservation.delete({ skuId: fixture.skuId });
-  await trade.model.stockBalance.delete({ skuId: fixture.skuId });
-  await catalog.model.sku.delete({ id: fixture.skuId });
-  await catalog.model.product.delete({ id: fixture.productId });
-  await catalog.model.category.delete({ id: fixture.categoryId });
+  if (fixture.skuId !== undefined) {
+    await trade.model.stockAudit.delete({ skuId: fixture.skuId });
+    await trade.model.stockReservation.delete({ skuId: fixture.skuId });
+    await trade.model.stockBalance.delete({ skuId: fixture.skuId });
+    await catalog.model.sku.delete({ id: fixture.skuId });
+  }
+  if (fixture.productId !== undefined)
+    await catalog.model.product.delete({ id: fixture.productId });
+  if (fixture.categoryId !== undefined)
+    await catalog.model.category.delete({ id: fixture.categoryId });
 }
 
 async function dropUser(userId: number | undefined) {
@@ -206,6 +226,112 @@ describe('cartOwnership.test.ts', { concurrency: false }, () => {
     });
   });
 
+  it('reads an empty cart without creating business records', async () => {
+    await app.bean.executor.mockCtx(async () => {
+      let customer: Awaited<ReturnType<typeof registerAndSignin>> | undefined;
+      try {
+        customer = await registerAndSignin(`cart-empty-${createTestId()}`);
+        const trade = app.scope('commerce-trade');
+        assert.equal(await trade.model.cart.get({ userId: customer.user.id }), undefined);
+        assert.deepEqual(await performAs(customer.token, 'get', actionPath), { items: [] });
+        assert.deepEqual(await performAs(customer.token, 'get', actionPath), { items: [] });
+        assert.equal(await trade.model.cart.get({ userId: customer.user.id }), undefined);
+      } finally {
+        await app.bean.passport.signout();
+        await dropUser(customer?.user.id as number | undefined);
+      }
+    });
+  });
+
+  it('keeps a sold-out cart DTO-valid without mutating its business records on reads', async () => {
+    await app.bean.executor.mockCtx(async () => {
+      const suffix = createTestId();
+      let sku: ISellableSkuFixture | undefined;
+      let customer: Awaited<ReturnType<typeof registerAndSignin>> | undefined;
+      try {
+        sku = await createSellableSku(suffix);
+        customer = await registerAndSignin(`cart-zero-${suffix}`);
+        const added = await performAs(customer.token, 'post', `${actionPath}/items`, {
+          body: cartItem(sku.skuId),
+        });
+        await app.bean.executor.newCtxIsolate(async () => {
+          await app.bean.passport.signinMock();
+          try {
+            await app.bean.executor.performAction(
+              'post',
+              '/commerce/trade/stockBalance/adjustStock',
+              {
+                body: {
+                  skuId: sku!.skuId,
+                  delta: -10,
+                  reason: `cart depletion ${suffix}`,
+                  correlationId: `cart-deplete-${suffix}`,
+                },
+                innerAccess: false,
+              },
+            );
+          } finally {
+            await app.bean.passport.signout();
+          }
+        });
+        const trade = app.scope('commerce-trade');
+        const before = {
+          cart: await trade.model.cart.getById(added.id),
+          items: await trade.model.cartItem.select({ where: { cartId: added.id } }),
+          stock: await trade.model.stockBalance.get({ skuId: sku.skuId }),
+        };
+        assert.equal(before.stock?.available, 0);
+        const current = await performAs(customer.token, 'get', actionPath);
+        assert.deepEqual(current, {
+          id: added.id,
+          items: [{ ...added.items[0], available: 0 }],
+        });
+        assert.deepEqual(await performAs(customer.token, 'get', actionPath), current);
+        assert.deepEqual(
+          {
+            cart: await trade.model.cart.getById(added.id),
+            items: await trade.model.cartItem.select({ where: { cartId: added.id } }),
+            stock: await trade.model.stockBalance.get({ skuId: sku.skuId }),
+          },
+          before,
+        );
+        assert.deepEqual(await $schema(DtoCartView).parseAsync(current), current);
+        for (const available of [1, 10]) {
+          assert.equal(
+            $schema(DtoCartItem).safeParse({ ...current.items[0], available }).success,
+            true,
+          );
+        }
+        for (const available of [-1, 0.5]) {
+          assert.equal(
+            $schema(DtoCartItem).safeParse({ ...current.items[0], available }).success,
+            false,
+          );
+        }
+        assert.equal(
+          $schema(DtoCartItem).safeParse({ ...current.items[0], available: 1, quantity: 0 })
+            .success,
+          false,
+        );
+        const document = await app.bean.openapi.generateJsonOfClasses(
+          [DtoCartView, DtoCartItem],
+          'V31',
+        );
+        const itemSchema = document.components!.schemas![appResource.getBeanFullName(DtoCartItem)!];
+        assert.ok('properties' in itemSchema);
+        const availableSchema = itemSchema.properties!.available;
+        assert.ok('type' in availableSchema);
+        assert.equal(availableSchema.type, 'integer');
+        assert.equal(availableSchema.minimum, 0);
+        assert.equal(availableSchema.exclusiveMinimum, undefined);
+      } finally {
+        await app.bean.passport.signout();
+        await dropUser(customer?.user.id as number | undefined);
+        await dropSellableSku(sku);
+      }
+    });
+  });
+
   it('treats another instance cart as absent', async () => {
     const suffix = createTestId();
     let itemId!: number;

package/vona/src/suite-vendor/a-auth/modules/auth-oauth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-auth-oauth",
-  "version": "5.0.12",
+  "version": "5.0.13",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-auth/modules/auth-oauth/src/bean/authProvider.oauth.ts

@@ -43,6 +43,7 @@ const app = useApp();
       clientSecret: app.meta.env.AUTH_GITHUB_CLIENTSECRET || 'Shoule specify clientSecret',
     },
   },
+  useMockForDev: app.meta.env.AUTH_USEMOCKFORDEV !== 'false',
 })
 export class AuthProviderOauth extends BeanAuthProviderOauth2Base {
   async strategy(

package/vona/src/suite-vendor/a-auth/modules/auth-oauth/src/types/index.ts

@@ -1,5 +1,6 @@
 declare module 'vona' {
   export interface VonaConfigEnv {
+    AUTH_USEMOCKFORDEV: 'true' | 'false' | undefined;
     AUTH_GITHUB_CLIENTID: string | undefined;
     AUTH_GITHUB_CLIENTSECRET: string | undefined;
   }

package/vona/src/suite-vendor/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-auth",
-  "version": "5.1.29",
+  "version": "5.1.30",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",
@@ -8,7 +8,7 @@
   "type": "module",
   "dependencies": {
     "vona-module-a-auth": "workspace:^",
-    "vona-module-auth-oauth": "^5.0.12",
+    "vona-module-auth-oauth": "^5.0.13",
     "vona-module-auth-simple": "workspace:^"
   },
   "title": "a-auth"

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-rbac",
-  "version": "5.0.15",
+  "version": "5.0.16",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-cabloy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-cabloy",
-  "version": "5.1.66",
+  "version": "5.1.67",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",
@@ -10,7 +10,7 @@
     "vona-module-a-cabloy": "workspace:^",
     "vona-module-a-layoutprofile": "^5.0.2",
     "vona-module-a-markdown": "^5.0.3",
-    "vona-module-a-rbac": "^5.0.15",
+    "vona-module-a-rbac": "^5.0.16",
     "vona-module-a-socket": "workspace:^",
     "vona-module-a-ssr": "workspace:^",
     "vona-module-a-ssrhmr": "workspace:^"