cabloy 5.1.242 → 5.1.244

package/vona/packages-utils/babel-plugin-vona-bean-module/src/index.test.ts

@@ -14,3 +14,30 @@ test('excludes timestamped generated Vona roots from bean module transforms', ()
   );
   assert.equal(isValidBeanModuleFile('/project/vona/src/module/foo/src/index.ts'), true);
 });
+
+for (const relativePath of [
+  'src/boot/app/index.ts',
+  '.zova/app/index.ts',
+  'src/backend/view.tsx',
+  '.vona/app.ts',
+]) {
+  for (const separator of ['/', '\\']) {
+    test(`excludes ${relativePath} with ${JSON.stringify(separator)} separators`, () => {
+      const fileName = `/project/vona-bin-build-fresh-a1b2c3/${relativePath}`.replaceAll(
+        '/',
+        separator,
+      );
+      assert.equal(isValidBeanModuleFile(fileName), false);
+    });
+  }
+}
+
+for (const separator of ['/', '\\']) {
+  test(`includes module source with ${JSON.stringify(separator)} separators`, () => {
+    const fileName = '/project/vona/src/module/test-fixture/src/service/main.ts'.replaceAll(
+      '/',
+      separator,
+    );
+    assert.equal(isValidBeanModuleFile(fileName), true);
+  });
+}

package/vona/packages-utils/babel-plugin-vona-bean-module/src/index.ts

@@ -95,6 +95,7 @@ function __createDecoratorNode(beanInfo) {
 
 export function isValidBeanModuleFile(fileName?: string | null) {
   if (!fileName) return false;
+  fileName = fileName.replace(/\\/g, '/');
   if (/[\\/].vona-test-\d{14}-[a-f0-9]{8}[\\/]/.test(fileName)) return false;
   return !['src/boot/app/', '.zova/app/', 'src/backend/', '.vona/'].some(item => {
     return fileName.includes(item);

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.121",
+  "version": "5.1.123",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/packages-vona/vona-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-core",
-  "version": "5.1.52",
+  "version": "5.1.53",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona",
   "keywords": [

package/vona/packages-vona/vona-core/src/lib/core/application.ts

@@ -90,8 +90,8 @@ export class VonaApplication extends KoaApplication {
         protocol,
         secure: false,
         method: 'POST',
-        url: '',
-        path: '',
+        url: '/',
+        path: '/',
         socket: {
           encrypted: false,
           remoteAddress: '127.0.0.1',

package/vona/packages-vona/vona-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-mock",
-  "version": "6.1.52",
+  "version": "6.1.53",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona mock",
   "keywords": [

package/vona/src/suite/a-demo/modules/demo-demonstration/src/bean/guard.demonstration.ts

@@ -30,7 +30,6 @@ export interface IGuardOptionsDemonstration extends IDecoratorGuardOptionsGlobal
   methodsForWrite,
   usernameWhitelist: parseUsernameWhitelist(app.meta.env.DEMONSTRATION_USERNAME_WHITELIST),
   ignore: [
-    '/home/user/passport/logout',
     '/home/user/passport/register',
     '/home/user/passport/login',
     '/home/user/passport/login/:module/:providerName/:clientName?',
@@ -59,6 +58,14 @@ export class GuardDemonstration extends BeanBase implements IGuardExecute {
       return next();
     }
 
+    if (
+      method === 'POST' &&
+      this.ctx.route?.routePathRaw === '/home/user/passport/logout' &&
+      this.bean.passport.authTokenMode === 'session'
+    ) {
+      return next();
+    }
+
     const user = this.bean.passport.currentUser;
     if (
       this.bean.passport.isAuthenticated &&

package/vona/src/suite/a-demo/modules/demo-demonstration/test/guardDemonstration.test.ts

@@ -8,6 +8,7 @@ const guardBeanName = 'demo-demonstration.guard.demonstration';
 const businessRoute = {
   controllerBeanFullName: 'test.controller.business',
   action: 'write',
+  routePathRaw: '/test/business/write',
 };
 
 function guard() {
@@ -29,7 +30,7 @@ function isGuardEnabledForRoute(routePathRaw: string, enable = true): boolean {
   return app.bean.onion.checkOnionOptionsEnabled({ ...options, enable }, routePathRaw);
 }
 
-describe('guardDemonstration.test.ts', () => {
+describe('guardDemonstration.test.ts', { concurrency: false }, () => {
   it('parses a trimmed, deduplicated username whitelist and exposes localized errors', async () => {
     assert.deepEqual(parseUsernameWhitelist(' admin, demo, ,admin '), ['admin', 'demo']);
     assert.deepEqual(parseUsernameWhitelist(undefined), []);
@@ -101,11 +102,84 @@ describe('guardDemonstration.test.ts', () => {
     });
   });
 
-  it('excludes only the configured authentication and OAuth route paths', () => {
+  it('allows non-whitelisted logout only in session auth-token mode', async t => {
+    await app.bean.executor.mockCtx(async () => {
+      const passport = app.bean.passport;
+      await passport.signinMock('admin');
+      try {
+        setRequest('POST', { ...businessRoute, routePathRaw: '/home/user/passport/logout' });
+        for (const authTokenMode of ['auth', 'session'] as const) {
+          const getter = t.mock.getter(passport, 'authTokenMode', () => authTokenMode);
+          try {
+            let continued = false;
+            const [result, err] = await catchError(() =>
+              guard().execute(
+                { enable: true, methodsForWrite: ['POST'], usernameWhitelist: [] } as any,
+                async () => {
+                  continued = true;
+                  return true;
+                },
+              ),
+            );
+            if (authTokenMode === 'session') {
+              assert.ifError(err);
+              assert.equal(result, true);
+              assert.equal(continued, true);
+            } else {
+              assert.equal(err?.code, 'demo-demonstration:1001');
+              assert.equal(err?.status, 403);
+              assert.equal(continued, false);
+            }
+          } finally {
+            getter.mock.restore();
+          }
+        }
+      } finally {
+        await passport.signout();
+      }
+    });
+  });
+
+  it('keeps other writes protected in session mode', async t => {
+    await app.bean.executor.mockCtx(async () => {
+      const passport = app.bean.passport;
+      await passport.signinMock('admin');
+      try {
+        const getter = t.mock.getter(passport, 'authTokenMode', () => 'session' as const);
+        try {
+          for (const [method, routePathRaw] of [
+            ['POST', businessRoute.routePathRaw],
+            ['DELETE', '/home/user/passport/logout'],
+            ['POST', '/home/user/passport/logout/'],
+          ]) {
+            setRequest(method, { ...businessRoute, routePathRaw });
+            let continued = false;
+            const [_, err] = await catchError(() =>
+              guard().execute(
+                { enable: true, methodsForWrite: ['POST', 'DELETE'], usernameWhitelist: [] } as any,
+                async () => {
+                  continued = true;
+                  return true;
+                },
+              ),
+            );
+            assert.equal(err?.code, 'demo-demonstration:1001');
+            assert.equal(err?.status, 403);
+            assert.equal(continued, false);
+          }
+        } finally {
+          getter.mock.restore();
+        }
+      } finally {
+        await passport.signout();
+      }
+    });
+  });
+
+  it('exempts the configured authentication and OAuth routes but still selects logout', () => {
     for (const routePathRaw of [
       '/home/user/passport/login',
       '/home/user/passport/login/:module/:providerName/:clientName?',
-      '/home/user/passport/logout',
       '/home/user/passport/register',
       '/home/user/passport/associate/:module/:providerName/:clientName?',
       '/home/user/passport/migrate/:module/:providerName/:clientName?',
@@ -116,6 +190,8 @@ describe('guardDemonstration.test.ts', () => {
     ]) {
       assert.equal(isGuardEnabledForRoute(routePathRaw), false);
     }
+    assert.equal(isGuardEnabledForRoute('/home/user/passport/logout'), true);
+    assert.equal(isGuardEnabledForRoute('/home/user/passport/logout', false), false);
     assert.equal(isGuardEnabledForRoute('/test/business/write'), true);
   });
 });

package/vona/src/suite/a-home/modules/home-user/test/passportSession.test.ts

@@ -0,0 +1,380 @@
+import type { IJwtToken, IPayloadData } from 'vona-module-a-jwt';
+import type { IAuthTokenConfig, TypeAuthTokenMode } from 'vona-module-a-user';
+
+import assert from 'node:assert/strict';
+import { describe, it, mock } from 'node:test';
+import { app } from 'vona-mock';
+import { $getAuthTokenMode, $parseAuthTokenMode } from 'vona-module-a-user';
+
+interface ITestPayloadData extends IPayloadData {
+  token: string;
+}
+
+interface IFixture {
+  userId: string;
+  authId: string;
+  name: string;
+}
+
+const unauthorized = (error: { code?: number }) => error.code === 401;
+
+describe('passportSession.test.ts', { concurrency: false }, () => {
+  it('defaults to auth and rejects invalid modes, stateless sessions and reissue refresh', async () => {
+    assert.equal($parseAuthTokenMode(undefined), 'auth');
+    for (const mode of ['auth', 'session'] as const) {
+      assert.equal($parseAuthTokenMode(mode), mode);
+    }
+    for (const value of ['', 'Session', 'all', null, true, 1]) {
+      assert.throws(() => $parseAuthTokenMode(value), /auth or session/);
+    }
+    await withMode(undefined, async () => {
+      const config = app.ctx.config.modules['a-user'].authToken;
+      assert.equal($getAuthTokenMode(config), 'auth');
+      assert.equal(app.bean.passport.authTokenMode, 'auth');
+    });
+    await withMode('session', async () => {
+      const config = app.ctx.config.modules['a-user'].authToken;
+      assert.equal($getAuthTokenMode(config), 'session');
+      assert.equal(app.bean.passport.authTokenMode, 'session');
+      assert.throws(() => $getAuthTokenMode({ ...config, stateless: true }), /stateful/);
+      assert.throws(
+        () =>
+          $getAuthTokenMode({
+            ...config,
+            strategy: { ...config.strategy, refreshAuthToken: 'reissue' },
+          }),
+        /reissue/,
+      );
+    });
+    await withMode(
+      'session',
+      async () => {
+        assert.throws(() => app.bean.passport.authTokenMode, /stateful/);
+      },
+      { stateless: true },
+    );
+    await withMode(
+      'session',
+      async () => {
+        assert.throws(() => app.bean.passport.authTokenMode, /reissue/);
+      },
+      { strategy: { signin: 'refresh', refreshAuthToken: 'reissue' } },
+    );
+  });
+
+  it('auth mode keeps the shared credential token and logout revokes both logins', async () => {
+    await withFixture(async fixture => {
+      const a = await login('auth', fixture);
+      const b = await login('auth', fixture);
+      const payloadA = await verify('auth', a.accessToken);
+      const payloadB = await verify('auth', b.accessToken);
+      assert.equal(payloadA.token, payloadB.token);
+      await logout('auth', a.accessToken);
+      await rejectedPair('auth', a);
+      await rejectedPair('auth', b);
+    });
+  });
+
+  it('session logins are independent; refresh, reuse and derived tokens retain their session', async () => {
+    await withFixture(async fixture => {
+      const a = await login('session', fixture);
+      const b = await login('session', fixture);
+      const payloadA = await verify('session', a.accessToken);
+      const payloadB = await verify('session', b.accessToken);
+      assert.match(
+        payloadA.token,
+        /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,
+      );
+      assert.notEqual(payloadA.token, payloadB.token);
+      await withMode('session', async () => {
+        const cache = app.scope('a-user').cacheRedis.authToken;
+        assert.equal(
+          await cache.get(`${fixture.userId}:${fixture.authId}:${payloadA.token}`),
+          payloadA.token,
+        );
+        assert.equal(
+          await cache.get(`${fixture.userId}:${fixture.authId}:${payloadB.token}`),
+          payloadB.token,
+        );
+      });
+      let refreshed = a;
+      for (const strategy of ['refresh', 'reuse'] as const) {
+        refreshed = await withMode(
+          'session',
+          async () => {
+            const jwt = await app.bean.passport.refreshAuthToken(refreshed.refreshToken);
+            assert.equal(
+              (app.ctx.state.passportPayloadData as ITestPayloadData | undefined)?.token,
+              payloadA.token,
+            );
+            return jwt;
+          },
+          { strategy: { signin: 'refresh', refreshAuthToken: strategy } },
+        );
+        assert.equal((await verify('session', refreshed.accessToken)).token, payloadA.token);
+        assert.equal(
+          (await verify('session', refreshed.refreshToken, 'refresh')).token,
+          payloadA.token,
+        );
+      }
+      const derived: [string, 'access' | 'oauth' | 'code'][] = [];
+      for (const create of [
+        () => app.bean.passport.createTempAuthToken(),
+        () => app.bean.passport.createOauthAuthToken(),
+        () => app.bean.passport.createOauthCode(),
+        () => app.bean.passport.createOauthCodeFromOauthAuthToken(a.accessToken),
+      ]) {
+        const token = await withMode('session', async () => {
+          await app.bean.passport.checkAuthToken(a.accessToken);
+          return await create();
+        });
+        derived.push([
+          token,
+          derived.length === 1 ? 'oauth' : derived.length >= 2 ? 'code' : 'access',
+        ]);
+      }
+      for (const [token, client] of derived) {
+        assert.equal((await verify('session', token, client)).token, payloadA.token);
+      }
+      const exchanged = await withMode('session', () =>
+        app.bean.passport.createAuthTokenFromOauthCode(derived[2][0]),
+      );
+      assert.equal((await verify('session', exchanged.accessToken)).token, payloadA.token);
+      await logout('session', refreshed.accessToken);
+      await rejectedPair('session', a);
+      await rejectedPair('session', refreshed);
+      await rejectedPair('session', exchanged);
+      for (const [token, client] of derived) {
+        await withMode('session', () =>
+          assert.rejects(() => app.bean.passport.checkAuthToken(token, client), unauthorized),
+        );
+      }
+      await withMode('session', () =>
+        assert.rejects(
+          () => app.bean.passport.createAuthTokenFromOauthCode(derived[2][0]),
+          unauthorized,
+        ),
+      );
+      await withMode('session', () =>
+        assert.rejects(
+          () => app.bean.passport.createOauthCodeFromOauthAuthToken(a.accessToken),
+          unauthorized,
+        ),
+      );
+      await verify('session', b.accessToken);
+      await verify('session', b.refreshToken, 'refresh');
+    });
+  });
+
+  it('logout at the refresh boundary cannot resurrect a deleted session', async () => {
+    await withFixture(async fixture => {
+      const a = await login('session', fixture);
+      const b = await login('session', fixture);
+      const refreshed = await withMode('session', async () => {
+        const redisToken = app.scope('a-user').service.redisToken;
+        const refresh = redisToken.refresh.bind(redisToken);
+        const boundary = mock.method(
+          redisToken,
+          'refresh',
+          async (payload: IPayloadData, ttl?: number) => {
+            // A separate request deletes the record after verification, before TTL extension.
+            await logout('session', a.accessToken);
+            await refresh(payload, ttl);
+          },
+        );
+        try {
+          const jwt = await app.bean.passport.refreshAuthToken(a.refreshToken);
+          assert.equal(boundary.mock.callCount(), 1);
+          return jwt;
+        } finally {
+          boundary.mock.restore();
+        }
+      });
+      await rejectedPair('session', a);
+      await rejectedPair('session', refreshed);
+      await verify('session', b.accessToken);
+      await verify('session', b.refreshToken, 'refresh');
+    });
+  });
+
+  it('requires verified payload state for session signout and rejects effective stateless overrides', async () => {
+    await withFixture(async fixture => {
+      const jwt = await login('session', fixture);
+      await withMode('session', async () => {
+        const verified = await app.bean.passport.checkAuthToken(jwt.accessToken);
+        assert.ok(verified);
+        assert.equal(app.ctx.state.passportPayloadData, verified.payloadData);
+        await app.bean.passport.setCurrent(verified.passport);
+        assert.equal(app.ctx.state.passportPayloadData, undefined);
+        await assert.rejects(() => app.bean.passport.signout(), unauthorized);
+      });
+      await verify('session', jwt.accessToken);
+      await withMode('session', async () => {
+        const verified = await app.bean.passport.checkAuthToken(jwt.accessToken);
+        assert.ok(verified);
+        await assert.rejects(
+          () => app.bean.passport.signin(verified.passport, { authToken: { stateless: true } }),
+          /stateful/,
+        );
+      });
+      await withMode('session', () =>
+        assert.rejects(
+          () =>
+            app.bean.auth.authenticate('auth-simple:simple', {
+              clientName: 'default',
+              state: { intention: 'login' },
+              clientOptions: {
+                username: fixture.name,
+                password: 'initial-password',
+                authTokenOptions: { stateless: true },
+              },
+            }),
+          /stateful/,
+        ),
+      );
+    });
+  });
+
+  it('kickOut removes all user token shapes independently of mode without prefix collisions', async () => {
+    await withFixture(async fixture => {
+      const a = await login('session', fixture);
+      const b = await login('session', fixture);
+      const auth = await login('auth', fixture);
+      const keys = [
+        `${fixture.userId}:owned-auth`,
+        `${fixture.userId}:owned-auth:owned-session`,
+        `${fixture.userId}0:owned-auth:neighbor`,
+      ];
+      try {
+        await withMode('session', async () => {
+          const cache = app.scope('a-user').cacheRedis.authToken;
+          for (const key of keys) await cache.set('owned-token', key);
+        });
+        await withMode('auth', async () => {
+          const user = await app.bean.user.findOneById(fixture.userId);
+          assert.ok(user);
+          await app.bean.passport.kickOut(user);
+        });
+        await rejectedPair('session', a);
+        await rejectedPair('session', b);
+        await rejectedPair('auth', auth);
+        await withMode('session', async () => {
+          const cache = app.scope('a-user').cacheRedis.authToken;
+          assert.equal(await cache.get(keys[0]), undefined);
+          assert.equal(await cache.get(keys[1]), undefined);
+          assert.equal(await cache.get(keys[2]), 'owned-token');
+        });
+      } finally {
+        await withMode('session', async () => {
+          for (const key of keys) await app.scope('a-user').cacheRedis.authToken.del(key);
+        });
+      }
+    });
+  });
+});
+
+async function withMode<T>(
+  mode: TypeAuthTokenMode | undefined,
+  callback: () => Promise<T>,
+  overrides: Partial<IAuthTokenConfig> = {},
+): Promise<T> {
+  return await app.bean.executor.mockCtx(async () => {
+    const config = app.ctx.config;
+    Object.defineProperty(app.ctx, 'config', {
+      configurable: true,
+      value: {
+        ...config,
+        modules: {
+          ...config.modules,
+          'a-user': {
+            ...config.modules['a-user'],
+            authToken: { ...config.modules['a-user'].authToken, mode, ...overrides },
+          },
+        },
+      },
+    });
+    return await callback();
+  });
+}
+
+async function login(mode: TypeAuthTokenMode, fixture: IFixture): Promise<IJwtToken> {
+  return await withMode(mode, async () => {
+    const jwt = await app.bean.auth.authenticate('auth-simple:simple', {
+      clientName: 'default',
+      state: { intention: 'login' },
+      clientOptions: { username: fixture.name, password: 'initial-password' },
+    });
+    assert.ok(jwt);
+    assert.ok((app.ctx.state.passportPayloadData as ITestPayloadData | undefined)?.token);
+    return jwt;
+  });
+}
+
+async function verify(
+  mode: TypeAuthTokenMode,
+  token: string,
+  client: 'access' | 'refresh' | 'oauth' | 'code' = 'access',
+): Promise<ITestPayloadData> {
+  return await withMode(mode, async () => {
+    const verified = await app.bean.passport.checkAuthToken(token, client);
+    assert.ok(verified);
+    assert.equal(app.ctx.state.passportPayloadData, verified.payloadData);
+    return verified.payloadData as ITestPayloadData;
+  });
+}
+
+async function rejectedPair(mode: TypeAuthTokenMode, jwt: IJwtToken) {
+  await withMode(mode, () =>
+    assert.rejects(() => app.bean.passport.checkAuthToken(jwt.accessToken), unauthorized),
+  );
+  await withMode(mode, () =>
+    assert.rejects(() => app.bean.passport.refreshAuthToken(jwt.refreshToken), unauthorized),
+  );
+}
+
+async function logout(mode: TypeAuthTokenMode, accessToken: string) {
+  await withMode(mode, async () => {
+    await app.bean.passport.checkAuthToken(accessToken);
+    await app.bean.passport.signout();
+    assert.equal(app.ctx.state.passportPayloadData, undefined);
+    assert.equal(app.bean.passport.current, undefined);
+  });
+}
+
+async function withFixture(callback: (fixture: IFixture) => Promise<void>) {
+  let userId: string | undefined;
+  let authSimpleId: string | undefined;
+  try {
+    const fixture = await app.bean.executor.mockCtx(async () => {
+      const name = `passport-session-${crypto.randomUUID()}`;
+      const user = await app.bean.user.register({ name }, true);
+      userId = user.id.toString();
+      const authSimple = await app
+        .scope('auth-simple')
+        .service.authSimple.createForUser(user.id, 'initial-password');
+      assert.ok(authSimple);
+      authSimpleId = authSimple.id.toString();
+      const provider = await app.bean.authProvider.get({
+        providerName: 'auth-simple:simple',
+        clientName: 'default',
+      });
+      const auth = await app
+        .scope('a-auth')
+        .model.auth.get({ userId: user.id, authProviderId: provider.id });
+      assert.ok(auth);
+      return { userId, authId: auth.id.toString(), name };
+    });
+    await callback(fixture);
+  } finally {
+    if (userId) {
+      await app.bean.executor.mockCtx(async () => {
+        const user = await app.bean.user.findOneById(userId!);
+        if (user) await app.bean.passport.kickOut(user);
+        await app.scope('a-auth').model.auth.delete({ userId });
+        if (authSimpleId) await app.scope('auth-simple').model.authSimple.deleteById(authSimpleId);
+        await app.scope('home-user').model.roleUser.delete({ userId });
+        await app.bean.user.removeById(userId!);
+      });
+    }
+  }
+}

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-rbac",
-  "version": "5.0.18",
+  "version": "5.0.19",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-cabloy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-cabloy",
-  "version": "5.1.70",
+  "version": "5.1.71",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",
@@ -10,7 +10,7 @@
     "vona-module-a-cabloy": "workspace:^",
     "vona-module-a-layoutprofile": "^5.0.2",
     "vona-module-a-markdown": "^5.0.3",
-    "vona-module-a-rbac": "^5.0.18",
+    "vona-module-a-rbac": "^5.0.19",
     "vona-module-a-socket": "workspace:^",
     "vona-module-a-ssr": "workspace:^",
     "vona-module-a-ssrhmr": "workspace:^"

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.68",
+  "version": "5.1.69",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-openapiutils/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-openapiutils",
-  "version": "5.1.23",
+  "version": "5.1.24",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-openapiutils/src/lib/decorator/mcp.ts

@@ -11,7 +11,7 @@ function tool(options: IMcpToolOptions): MethodDecorator;
 function tool(options: IMcpToolOptions = {}): ClassDecorator & MethodDecorator {
   return function (target: object, prop?: MetadataKey, descriptor?: PropertyDescriptor) {
     if (prop === undefined && options.name !== undefined) {
-      throw new Error('mcp.tool name is only valid on a controller action');
+      throw new Error('Mcp.tool name is only valid on a controller action');
     }
     // An options object, including an empty one, is the explicit opt-in marker.
     const metadata = appMetadata.getOwnMetadataMap(
@@ -25,4 +25,4 @@ function tool(options: IMcpToolOptions = {}): ClassDecorator & MethodDecorator {
   } as ClassDecorator & MethodDecorator;
 }
 
-export const mcp = { tool };
+export const Mcp = { tool };

package/vona/src/suite-vendor/a-vona/modules/a-permission/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-permission",
-  "version": "5.1.35",
+  "version": "5.1.36",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-user/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-user",
-  "version": "5.1.26",
+  "version": "5.1.27",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [