cabloy 5.1.242 → 5.1.243

package/.cabloy-version

@@ -1 +1 @@
-5.1.242
+5.1.243

package/.github/workflows/vona-test-sqlite3.yml

@@ -94,7 +94,7 @@ jobs:
         run: npm run init
       - name: run isolated test infrastructure gate
         # Bound concurrent PowerShell/Add-Type cold starts on Windows runners.
-        run: node --test ${{ runner.os == 'Windows' && '--test-concurrency=2' || '' }} scripts/testClaimProcesses.test.ts scripts/runIsolatedTest.test.ts scripts/testClaimCleanup.test.ts scripts/testProcessGuardianWindows.test.ts vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts vona/packages-vona/vona-core/src/lib/core/testClaimFilesystem.test.ts vona/packages-vona/vona-core/src/lib/framework/bootstrap.test.ts vona/packages-vona/vona-core/src/lib/framework/useApp.test.ts vona/packages-cli/cli-set-api/test/binBuildEntries.test.ts vona/packages-cli/cli-set-api/test/binTestPatterns.test.ts
+        run: node --test ${{ runner.os == 'Windows' && '--test-concurrency=2' || '' }} scripts/testClaimProcesses.test.ts scripts/runIsolatedTest.test.ts scripts/testClaimCleanup.test.ts scripts/testProcessGuardianWindows.test.ts vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts vona/packages-vona/vona-core/src/lib/core/testClaimFilesystem.test.ts vona/packages-vona/vona-core/src/lib/framework/bootstrap.test.ts vona/packages-vona/vona-core/src/lib/framework/useApp.test.ts vona/packages-cli/cli-set-api/test/binBuildEntries.test.ts vona/packages-cli/cli-set-api/test/binBuildFreshInputs.test.ts vona/packages-cli/cli-set-api/test/binTestPatterns.test.ts
       - name: run A-Pay focused gate
         run: npm run test -- test-pay/test/paymentSession.test.ts test-pay/test/payMock.test.ts test-pay/test/paypalProvider.test.ts test-pay/test/paypalLifecycle.test.ts test-pay/test/stripeProvider.test.ts test-pay/test/stripeLifecycle.test.ts test-pay/test/outbox.test.ts test-pay/test/webhook.test.ts
         working-directory: vona

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 5.1.243
+
+### Bug Fixes
+
+- Fix warning logging.
+- Fix logout in demonstration mode.
+- Fix Rollup build caching.
+
+### Improvements
+
+- Update the demonstration mode guide.
+
 ## 5.1.242
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.242",
+  "version": "5.1.243",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/repo-docs/backend/demonstration-mode-guide.md

@@ -80,10 +80,13 @@ The Guard depends on Passport-resolved account state, so it makes this decision
 
 ## Exempt authentication routes
 
-Demonstration Mode deliberately does not apply to the standard authentication and OAuth routes below. This keeps sign-in, sign-out, registration, account association and migration, OAuth callbacks, and token flows available while the write policy is active.
+Demonstration Mode deliberately does not apply to the standard authentication and OAuth routes below. This keeps sign-in, registration, account association and migration, OAuth callbacks, and token flows available while the write policy is active.
+
+In Cabloy Basic, and Cabloy Start, `POST /home/user/passport/logout` is **not exempt**. While Demonstration Mode is enabled, only authenticated, active, non-anonymous whitelisted users may log out; other users receive `403` with `demo-demonstration:1001`.
+
+This prevents ordinary visitors sharing a demo account from revoking other visitors' logins. Whitelisted users remain able to log out. The underlying logout semantics are unchanged: logout revokes the shared login state for the current account and authentication record, not just the current browser session. When Demonstration Mode is disabled, this Guard does not restrict logout.
 
 ```text
-/home/user/passport/logout
 /home/user/passport/register
 /home/user/passport/login
 /home/user/passport/login/:module/:providerName/:clientName?

package/vona/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli",
-  "version": "1.1.173",
+  "version": "1.1.174",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli",
   "keywords": [

package/vona/packages-cli/cli-set-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli-set-api",
-  "version": "1.1.171",
+  "version": "1.1.172",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli-set-api",
   "keywords": [

package/vona/packages-cli/cli-set-api/src/lib/bean/cli.bin.build.ts

@@ -203,6 +203,13 @@ export class CliBinBuild extends BeanCliBase {
 
     const sourceMap = process.env.BUILD_SOURCEMAP === 'true';
 
+    // Explicit roots bypass the application's .vona exclusion and prevent stale emit-cache fallback.
+    const tsconfig = path.join(projectPath, '.vona/tsconfig.build.json');
+    await fse.writeJson(tsconfig, {
+      extends: '../tsconfig.json',
+      files: ['./bootstrap.ts', './app.ts', './env.ts', './config.ts', './modules-meta.ts'],
+    });
+
     const replaceValues = generateConfigDefine(env, ['NODE_ENV', 'META_MODE', 'META_FLAVOR']);
     for (const relativeName in modulesMeta.modules) {
       const module = modulesMeta.modules[relativeName];
@@ -265,11 +272,15 @@ export class CliBinBuild extends BeanCliBase {
       json(),
       commonjs(),
       typescript({
+        tsconfig,
         module: 'nodenext',
         compilerOptions: {
           noCheck: true,
+          noEmit: false,
           declaration: false,
+          declarationMap: false,
           composite: false,
+          incremental: false,
           sourceMap,
         },
         outputToFilesystem: false,

package/vona/packages-cli/cli-set-api/test/binBuildFreshInputs.test.ts

@@ -0,0 +1,152 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const buildUrl = new URL('../src/lib/bean/cli.bin.build.ts', import.meta.url).href;
+
+// Keep the actual bundler and transpilers; only isolate CLI initialization.
+const source = `
+  import assert from 'node:assert/strict';
+  import { readFileSync, readdirSync, writeFileSync } from 'node:fs';
+  import { registerHooks } from 'node:module';
+  import { join } from 'node:path';
+  import { pathToFileURL } from 'node:url';
+  const buildUrl = ${JSON.stringify(buildUrl)};
+  const projectPath = process.argv[1];
+  registerHooks({
+    resolve(specifier, context, nextResolve) {
+      if (context.parentURL === buildUrl) {
+        const mock = specifier === '@cabloy/cli'
+          ? 'export class BeanCliBase {}'
+          : specifier === './toolsBin/generateVonaMeta.ts'
+            ? 'export function generateVonaMeta() { throw new Error("Unexpected generation"); }'
+            : undefined;
+        if (mock) return { url: 'data:text/javascript,' + encodeURIComponent(mock), shortCircuit: true };
+      }
+      return nextResolve(specifier, context);
+    },
+  });
+  const { CliBinBuild } = await import(buildUrl);
+  const cli = Object.create(CliBinBuild.prototype);
+  const cachePath = process.argv[2];
+  const poisoned = readFileSync(cachePath, 'utf8');
+  for (const [index, flavor] of ['normal', 'ci', 'normal'].entries()) {
+    const env = {
+      META_MODE: 'prod',
+      META_FLAVOR: flavor,
+      SERVER_LISTEN_DISABLE: flavor === 'ci' ? 'true' : '',
+      generation: index,
+    };
+    writeFileSync(join(projectPath, '.vona/env.ts'),
+      'export default ' + JSON.stringify(env) + ' as const;');
+    writeFileSync(join(projectPath, '.vona/config.ts'),
+      'export default { generation: ' + index + ' };');
+    const outDir = join(projectPath, 'dist/build-' + index);
+    await cli._rollup(projectPath, env, { modules: {} }, outDir);
+    const app = await import(pathToFileURL(join(outDir, 'app.js')).href);
+    assert.deepEqual(app.env, env, 'must compile current generated environment, not cached CI output');
+    assert.deepEqual(await app.config(), { generation: index });
+    assert.equal(app.view, 'fresh-view', 'must retain inherited JSX and legacy decorator compilation');
+    assert.equal(readFileSync(cachePath, 'utf8'), poisoned, 'legacy cache must remain in place');
+    if (process.env.BUILD_SOURCEMAP === 'true') {
+      const maps = readdirSync(outDir).filter(name => name.endsWith('.js.map'));
+      assert.ok(maps.length > 0);
+      assert.ok(maps.some(name =>
+        JSON.parse(readFileSync(join(outDir, name), 'utf8')).sources
+          .some(source => source.endsWith('/.vona/env.ts'))));
+    }
+  }
+`;
+
+for (const sourceMap of [false, true]) {
+  test(`production build uses fresh generated inputs despite CI cache (sourceMap=${sourceMap})`, () => {
+    const projectPath = realpathSync(mkdtempSync(join(tmpdir(), 'vona-bin-build-fresh-')));
+    try {
+      mkdirSync(join(projectPath, '.vona'));
+      mkdirSync(join(projectPath, 'src/backend'), { recursive: true });
+      symlinkSync(
+        fileURLToPath(new URL('../../../node_modules', import.meta.url)),
+        join(projectPath, 'node_modules'),
+        process.platform === 'win32' ? 'junction' : 'dir',
+      );
+      writeFileSync(join(projectPath, 'package.json'), JSON.stringify({ type: 'module' }));
+      writeFileSync(
+        join(projectPath, 'tsconfig.base.json'),
+        JSON.stringify({
+          compilerOptions: {
+            target: 'ES2020',
+            module: 'NodeNext',
+            moduleResolution: 'NodeNext',
+            incremental: true,
+            composite: true,
+            declaration: true,
+            declarationMap: false,
+            jsx: 'react',
+            jsxFactory: 'h',
+            experimentalDecorators: true,
+            emitDecoratorMetadata: true,
+            skipLibCheck: true,
+          },
+        }),
+      );
+      writeFileSync(
+        join(projectPath, 'tsconfig.json'),
+        JSON.stringify({
+          extends: './tsconfig.base.json',
+          compilerOptions: { noEmit: true, composite: false, declaration: false },
+          exclude: ['.vona', 'dist', 'node_modules'],
+        }),
+      );
+      writeFileSync(
+        join(projectPath, 'src/backend/view.tsx'),
+        `function h(tag: string) { return tag; }
+function mark(target: any) { target.value = 'fresh-view'; }
+@mark
+class View { static value: string; }
+export const view = <fixture /> === 'fixture' ? View.value : 'invalid';`,
+      );
+      writeFileSync(
+        join(projectPath, '.vona/app.ts'),
+        `export { default as env } from './env.ts';
+export { view } from '../src/backend/view.tsx';
+export async function config() { return (await import('./config.ts')).default; }`,
+      );
+      writeFileSync(join(projectPath, '.vona/bootstrap.ts'), "export { env } from './app.ts';");
+      writeFileSync(join(projectPath, '.vona/modules-meta.ts'), 'export default {};');
+      const cachePath = join(
+        projectPath,
+        '.rollup.cache',
+        join(projectPath, '.vona/env.js').replace(/^([a-z]+):/i, '$1'),
+      );
+      mkdirSync(dirname(cachePath), { recursive: true });
+      writeFileSync(
+        cachePath,
+        'export default { META_MODE: "prod", META_FLAVOR: "ci", SERVER_LISTEN_DISABLE: "true", generation: "poisoned" };',
+      );
+      const result = spawnSync(
+        process.execPath,
+        ['--input-type=module', '--eval', source, projectPath, cachePath],
+        {
+          cwd: projectPath,
+          encoding: 'utf8',
+          timeout: 60_000,
+          env: {
+            ...process.env,
+            BUILD_MINIFY: 'false',
+            BUILD_SOURCEMAP: String(sourceMap),
+          },
+        },
+      );
+      assert.ifError(result.error);
+      assert.equal(result.signal, null, result.stderr);
+      assert.equal(result.status, 0, result.stderr);
+      assert.doesNotMatch(result.stderr, /\[plugin typescript\]/i, result.stderr);
+    } finally {
+      rmSync(projectPath, { recursive: true, force: true });
+    }
+  });
+}

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.121",
+  "version": "5.1.122",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/packages-vona/vona-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-core",
-  "version": "5.1.52",
+  "version": "5.1.53",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona",
   "keywords": [

package/vona/packages-vona/vona-core/src/lib/core/application.ts

@@ -90,8 +90,8 @@ export class VonaApplication extends KoaApplication {
         protocol,
         secure: false,
         method: 'POST',
-        url: '',
-        path: '',
+        url: '/',
+        path: '/',
         socket: {
           encrypted: false,
           remoteAddress: '127.0.0.1',

package/vona/packages-vona/vona-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-mock",
-  "version": "6.1.52",
+  "version": "6.1.53",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona mock",
   "keywords": [

package/vona/src/suite/a-demo/modules/demo-demonstration/src/bean/guard.demonstration.ts

@@ -30,7 +30,7 @@ export interface IGuardOptionsDemonstration extends IDecoratorGuardOptionsGlobal
   methodsForWrite,
   usernameWhitelist: parseUsernameWhitelist(app.meta.env.DEMONSTRATION_USERNAME_WHITELIST),
   ignore: [
-    '/home/user/passport/logout',
+    // '/home/user/passport/logout',
     '/home/user/passport/register',
     '/home/user/passport/login',
     '/home/user/passport/login/:module/:providerName/:clientName?',

package/vona/src/suite/a-demo/modules/demo-demonstration/test/guardDemonstration.test.ts

@@ -29,7 +29,7 @@ function isGuardEnabledForRoute(routePathRaw: string, enable = true): boolean {
   return app.bean.onion.checkOnionOptionsEnabled({ ...options, enable }, routePathRaw);
 }
 
-describe('guardDemonstration.test.ts', () => {
+describe('guardDemonstration.test.ts', { concurrency: false }, () => {
   it('parses a trimmed, deduplicated username whitelist and exposes localized errors', async () => {
     assert.deepEqual(parseUsernameWhitelist(' admin, demo, ,admin '), ['admin', 'demo']);
     assert.deepEqual(parseUsernameWhitelist(undefined), []);
@@ -101,11 +101,10 @@ describe('guardDemonstration.test.ts', () => {
     });
   });
 
-  it('excludes only the configured authentication and OAuth route paths', () => {
+  it('exempts the configured authentication and OAuth routes but protects logout', () => {
     for (const routePathRaw of [
       '/home/user/passport/login',
       '/home/user/passport/login/:module/:providerName/:clientName?',
-      '/home/user/passport/logout',
       '/home/user/passport/register',
       '/home/user/passport/associate/:module/:providerName/:clientName?',
       '/home/user/passport/migrate/:module/:providerName/:clientName?',
@@ -116,6 +115,8 @@ describe('guardDemonstration.test.ts', () => {
     ]) {
       assert.equal(isGuardEnabledForRoute(routePathRaw), false);
     }
+    assert.equal(isGuardEnabledForRoute('/home/user/passport/logout'), true);
+    assert.equal(isGuardEnabledForRoute('/home/user/passport/logout', false), false);
     assert.equal(isGuardEnabledForRoute('/test/business/write'), true);
   });
 });

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.68",
+  "version": "5.1.69",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.112",
+  "version": "5.1.113",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",