cabloy 5.1.243 → 5.1.244

package/.cabloy-version

@@ -1 +1 @@
-5.1.243
+5.1.244

package/.github/workflows/vona-test-sqlite3.yml

@@ -94,7 +94,7 @@ jobs:
         run: npm run init
       - name: run isolated test infrastructure gate
         # Bound concurrent PowerShell/Add-Type cold starts on Windows runners.
-        run: node --test ${{ runner.os == 'Windows' && '--test-concurrency=2' || '' }} scripts/testClaimProcesses.test.ts scripts/runIsolatedTest.test.ts scripts/testClaimCleanup.test.ts scripts/testProcessGuardianWindows.test.ts vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts vona/packages-vona/vona-core/src/lib/core/testClaimFilesystem.test.ts vona/packages-vona/vona-core/src/lib/framework/bootstrap.test.ts vona/packages-vona/vona-core/src/lib/framework/useApp.test.ts vona/packages-cli/cli-set-api/test/binBuildEntries.test.ts vona/packages-cli/cli-set-api/test/binBuildFreshInputs.test.ts vona/packages-cli/cli-set-api/test/binTestPatterns.test.ts
+        run: node --test ${{ runner.os == 'Windows' && '--test-concurrency=2' || '' }} scripts/testClaimProcesses.test.ts scripts/runIsolatedTest.test.ts scripts/testClaimCleanup.test.ts scripts/testProcessGuardianWindows.test.ts vona/packages-vona/vona-core/src/lib/core/testClaim.test.ts vona/packages-vona/vona-core/src/lib/core/testClaimFilesystem.test.ts vona/packages-vona/vona-core/src/lib/framework/bootstrap.test.ts vona/packages-vona/vona-core/src/lib/framework/useApp.test.ts vona/packages-cli/cli-set-api/test/binBuildEntries.test.ts vona/packages-cli/cli-set-api/test/binBuildFreshInputs.test.ts vona/packages-cli/cli-set-api/test/binTestPatterns.test.ts vona/packages-utils/babel-plugin-vona-bean-module/src/index.test.ts
       - name: run A-Pay focused gate
         run: npm run test -- test-pay/test/paymentSession.test.ts test-pay/test/payMock.test.ts test-pay/test/paypalProvider.test.ts test-pay/test/paypalLifecycle.test.ts test-pay/test/stripeProvider.test.ts test-pay/test/stripeLifecycle.test.ts test-pay/test/outbox.test.ts test-pay/test/webhook.test.ts
         working-directory: vona

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 5.1.244
+
+### Features
+
+- Add `ZButton` and `AUTH_TOKEN_MODE`.
+
+### Bug Fixes
+
+- Fix Babel plugin compatibility on Windows.
+
+### Improvements
+
+- Refactor `mcp.tool` to `Mcp.tool`.
+
 ## 5.1.243
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.243",
+  "version": "5.1.244",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/repo-agent-governance/managed-assets.json

@@ -95,7 +95,7 @@
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "0324ce1fb9a9b7b2074f60b8252c62b124f5804b808be8146ebb2ccb8762b38b",
+      "sha256": "fb81da315c743a45ced77d6e7c10be25f521d72de7f14d4e7b4a8037716b2b31",
       "source": "skills/cabloy-frontend-scaffold/SKILL.md",
       "target": ".agents/skills/cabloy-frontend-scaffold/SKILL.md"
     },
@@ -431,7 +431,7 @@
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "0324ce1fb9a9b7b2074f60b8252c62b124f5804b808be8146ebb2ccb8762b38b",
+      "sha256": "fb81da315c743a45ced77d6e7c10be25f521d72de7f14d4e7b4a8037716b2b31",
       "source": "skills/cabloy-frontend-scaffold/SKILL.md",
       "target": ".claude/skills/cabloy-frontend-scaffold/SKILL.md"
     },
@@ -683,7 +683,7 @@
     {
       "adapter": "cursor",
       "category": "policy",
-      "sha256": "a41379c32f2ab77a691b282d13d3ad1fd2887e14694109f2afa43974a438cbee",
+      "sha256": "ad91c94c7dd07f24ef3580c991b34439721902413051843a3445ca903979f5a3",
       "source": "policies/repository.md",
       "target": ".cursor/rules/cabloy-governance.mdc"
     },
@@ -781,7 +781,7 @@
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "0324ce1fb9a9b7b2074f60b8252c62b124f5804b808be8146ebb2ccb8762b38b",
+      "sha256": "fb81da315c743a45ced77d6e7c10be25f521d72de7f14d4e7b4a8037716b2b31",
       "source": "skills/cabloy-frontend-scaffold/SKILL.md",
       "target": ".cursor/skills/cabloy-frontend-scaffold/SKILL.md"
     },
@@ -1005,14 +1005,14 @@
     {
       "adapter": "codex",
       "category": "policy",
-      "sha256": "19b84cff474c23e561ba0cf532ff343da56febab3c484a4eb42912f9b9d8c6d3",
+      "sha256": "deb64df2f792d1c28dec0727e1a70871c7a96445eceb8a65155977fc77cbde62",
       "source": "policies/repository.md",
       "target": "AGENTS.md"
     },
     {
       "adapter": "claude",
       "category": "policy",
-      "sha256": "19b84cff474c23e561ba0cf532ff343da56febab3c484a4eb42912f9b9d8c6d3",
+      "sha256": "deb64df2f792d1c28dec0727e1a70871c7a96445eceb8a65155977fc77cbde62",
       "source": "policies/repository.md",
       "target": "CLAUDE.md"
     }

package/repo-agent-governance/policies/repository.md

@@ -59,6 +59,7 @@ Before inventing a custom implementation path:
 - For Cabloy Start, apply the same reverse-chain logic but resolve the Start-specific flavor names and generated-output paths from the active Start repo before recommending commands.
 - Treat legacy docs as input material, not as unquestioned truth. When docs conflict with source code, prefer current source code.
 - For frontend work, assume Cabloy Basic and Cabloy Start share a frontend engineering layer but may diverge in UI layer, frontend flavors, suite/module availability, SSR site baselines, project assets, and generated outputs.
+- In Cabloy Basic and Cabloy Start, prefer `ZButton` for button actions rather than rebuilding its loading, disabled, duplicate-click, and error handling with native elements. Return or await the complete async action through `onPerform`; use `mutateAsync()` rather than `mutate()` when the button owns mutation-error feedback. Keep navigation as links and use native buttons or lower-level behaviors only for a defined interaction need; preserve form-wide or shared lifecycle ownership. See [Behavior Guide](repo-docs/frontend/behavior-guide.md#perform-a-standalone-asynchronous-button-action).
 - For Zova frontend analysis, do not default to generic Vue reinterpretation first. Read the code through Zova’s controller / bean / IoC architecture before mapping it to Vue concepts.
 - For Zova source-reading or Vue-vs-Zova explanation tasks, start from the frontend reading guides and source-reading map in `repo-docs/frontend/` before doing framework-neutral reinterpretation.
 - In Zova application TypeScript/TSX source, authored or generated, relative imports and exports must name the actual source target: `.ts` for `.ts` targets and `.tsx` for `.tsx` targets, including type-only imports, tests, frontend entry/config source, and generated metadata. CLI templates and generators must preserve this convention in generated application source; regenerate generated consumers rather than hand-editing them. Preserve the existing source-suffix convention in `zova/packages-utils/**` and `zova/packages-zova/**`. Keep bare package names, assets, real JavaScript targets, compiled runtime loaders, and package exports unchanged; do not apply a repository-wide suffix replacement or extend this application-source rule to Vona, dependencies, or build artifacts.

package/repo-agent-governance/skills/cabloy-frontend-scaffold/SKILL.md

@@ -202,6 +202,8 @@ In that case, surface this operational sequence:
 
 ### Component and interaction follow-up
 
+For both Cabloy Basic and Cabloy Start, prefer `ZButton` for button actions when creating or modifying an interaction, including existing menu actions. Do not reconstruct its action lifecycle with native elements by default. Keep navigation as links; use native buttons or lower-level behaviors only for a defined interaction need, and preserve form-wide or shared lifecycle ownership. Resolve the component import and styling from the active edition.
+
 Check whether the feature needs:
 
 - props contract review
@@ -209,7 +211,7 @@ Check whether the feature needs:
 - generic component conversion
 - style/theme/icon updates
 - wrapper usage review
-- async interaction ownership: for a button-only action, return or await the complete action through `ZButton onPerform`, choose one error presentation owner rather than combining its generic alert with local query/error UI, and do not mirror the same lifecycle with button-local `loading` / `disabled` state; retain explicit state only for independently initiated or broader shared work
+- async interaction ownership: for a button-only action, return or await the complete action through `ZButton onPerform`; when the button owns mutation-error feedback, use `mutateAsync()` rather than `mutate()`, which consumes the rejection; choose one error presentation owner rather than combining its generic alert with local query/error UI, and do not mirror the same lifecycle with button-local `loading` / `disabled` state; retain explicit state only for independently initiated or broader shared work
 - business row actions that require additional input: prefer a compact trigger and a focused dialog unless deliberate inline editing is intended; follow the [TableCell dialog pattern](../../../repo-docs/frontend/table-cell-cookbook.md#collect-input-for-a-business-row-action-in-a-dialog) for schema-backed forms where suitable, existing mutation ownership, success-only closure, failure input retention, and dialog-scoped E2E verification
 - async-loading or controllerRef implications
 
@@ -224,7 +226,7 @@ Check whether the feature needs:
 - SSR or route-path verification
 - hydration-time initial-render equivalence when SSR, private state, browser-only state, or async model state changes
 - edition-specific flavor, SSR site baseline, and project-asset verification
-- interaction failure-path verification when `ZButton onPerform` owns a query action: a failed refetch reaches exactly the intended `onError`, generic alert, or local error UI, and button loading resets
+- interaction failure-path verification when `ZButton onPerform` owns a query or mutation action: a failed refetch or mutation reaches exactly the intended `onError`, generic alert, or local error UI, and button loading resets
 
 ### SSR theme review reminder
 

package/repo-docs/backend/auth-guide.md

@@ -131,6 +131,54 @@ The `home-user` module exposes out-of-the-box Passport APIs for common account f
 
 In the current repo implementation, these flows live in `home-user/src/controller/passport.ts`, where register/login call `bean.auth.authenticate(...)`, OAuth login uses provider/module path parameters, and token-oriented follow-up endpoints stay concentrated in one controller surface.
 
+## Auth-token mode
+
+The auth-token mode selects how Vona issues, stores, reuses, and refreshes server-side authentication state. By default, logins for the same user and authentication record share one token identity. Applications that need independently managed login sessions can select `session` mode. Ordinary logout revocation follows the selected mode; this is not a logout-only setting.
+
+Set the backend environment value to one of `auth` or `session`:
+
+```dotenv
+AUTH_TOKEN_MODE=session
+```
+
+The default is `auth`. The equivalent typed project-config override is:
+
+```typescript
+import type { VonaConfigOptional } from 'vona';
+
+const config: VonaConfigOptional = {
+  modules: {
+    'a-user': {
+      authToken: {
+        mode: 'session',
+      },
+    },
+  },
+};
+```
+
+The setting is `modules['a-user'].authToken.mode`. Backend code can read the validated effective value through the read-only `bean.passport.authTokenMode` getter. See [Config Guide](/backend/config-guide) for configuration layering.
+
+### Authentication-record mode: `auth`
+
+`auth` preserves the existing behavior: server-side tokens are stored by user and authentication record. With the default signin strategy, separate logins for that pair reuse the same token identity and extend its lifetime. Logout revokes their shared login state, rather than only the requesting browser's login. It does not mean every authentication method associated with the user is revoked.
+
+### Login-session mode: `session`
+
+`session` gives each successful login a fresh session identity in the existing auth-token `token` field. Logout revokes that login's server-side state without revoking independent logins using the same user and authentication record. Token refresh preserves the session identity; receiving a refreshed JWT does not create a new login session.
+
+This is **per login, not per tab**. Tabs or clients that share the same credential share the same session and are signed out together. A separate login creates an independent session.
+
+Session mode requires stateful auth tokens. It is incompatible with `authToken.stateless: true`, including provider/client overrides that select stateless tokens. The refresh strategy `authToken.strategy.refreshAuthToken: 'reissue'` is also unsupported in session mode: refresh must retain the existing session identity rather than replace it. Keep the default `refresh` strategy unless the application has a specific reason to use `reuse`.
+
+The narrower revocation in session mode applies to ordinary logout, not account-wide security operations. Password changes, password resets, and initial password setup retain their broader security invalidation behavior; they do not become session-only operations.
+
+### Switching modes
+
+Treat a change between `auth` and `session` as a coordinated deployment change. All workers serving the same application must use the same effective mode; do not run mixed modes against shared token state. Restart the workers together and require users to log in again. Existing credentials are not transparently migrated between modes.
+
+For shared demonstration deployments, session mode also lets ordinary visitors log out without revoking other visitors' independent logins. See [Demonstration Mode Guide](/backend/demonstration-mode-guide#logout-policy).
+
 ## Registration and password recovery in Cabloy Basic
 
 The Home Login experience uses the Passport registration flow for new users. Registration collects the standard username, email, password, confirmation, and CAPTCHA fields, then continues through the ordinary signed-in navigation flow after it succeeds.

package/repo-docs/backend/demonstration-mode-guide.md

@@ -68,7 +68,7 @@ The Guard protects these HTTP methods:
 - `DELETE`
 - `PUT`
 
-Other methods pass through this Guard unchanged. A protected request is allowed only for an eligible whitelisted user. All other protected requests are rejected with:
+Other methods pass through this Guard unchanged. Apart from the built-in authentication routes and the conditional [logout policy](#logout-policy), a protected request is allowed only for an eligible whitelisted user. All other protected requests are rejected with:
 
 | Field                  | Value                                             |
 | ---------------------- | ------------------------------------------------- |
@@ -82,10 +82,6 @@ The Guard depends on Passport-resolved account state, so it makes this decision
 
 Demonstration Mode deliberately does not apply to the standard authentication and OAuth routes below. This keeps sign-in, registration, account association and migration, OAuth callbacks, and token flows available while the write policy is active.
 
-In Cabloy Basic, and Cabloy Start, `POST /home/user/passport/logout` is **not exempt**. While Demonstration Mode is enabled, only authenticated, active, non-anonymous whitelisted users may log out; other users receive `403` with `demo-demonstration:1001`.
-
-This prevents ordinary visitors sharing a demo account from revoking other visitors' logins. Whitelisted users remain able to log out. The underlying logout semantics are unchanged: logout revokes the shared login state for the current account and authentication record, not just the current browser session. When Demonstration Mode is disabled, this Guard does not restrict logout.
-
 ```text
 /home/user/passport/register
 /home/user/passport/login
@@ -100,6 +96,27 @@ This prevents ordinary visitors sharing a demo account from revoking other visit
 
 These are route templates used by the built-in authentication flows. They are not a general mechanism for bypassing Demonstration Mode on arbitrary URLs.
 
+## Logout policy
+
+Logout is deliberately absent from the unconditional authentication-route exemptions. While Demonstration Mode is enabled, its behavior depends on the validated effective `bean.passport.authTokenMode`:
+
+- **`auth` (default):** `POST /home/user/passport/logout` remains a protected write. Only authenticated, active, non-anonymous whitelisted users may continue; other users receive `403` with `demo-demonstration:1001`. This prevents ordinary visitors sharing a demo account and authentication record from revoking other visitors' logins.
+- **`session`:** the Guard lets `POST /home/user/passport/logout` continue regardless of whitelist membership because logout revokes only the requesting login session. Normal Passport authentication, account-state checks, and other authorization policies still apply. This is not an authentication bypass.
+
+To enable independent logins in a shared demo deployment:
+
+```dotenv
+AUTH_TOKEN_MODE=session
+```
+
+The supported values are `auth` and `session`; the default is `auth`. The equivalent typed project-config setting is `modules['a-user'].authToken.mode`.
+
+Session mode creates a fresh identity for each login in the existing auth-token `token` field, and token refresh preserves that identity. Tabs sharing a credential share one session: logging out from one signs out the others. This is **per login, not per tab**.
+
+Session mode requires stateful tokens and does not support the refresh strategy `reissue`. Password changes, password resets, and initial password setup retain their broader security invalidation behavior. Switching auth-token modes requires coordinated workers and a new login; do not mix modes across workers or expect existing credentials to migrate automatically. See [Auth-token mode](/backend/auth-guide#auth-token-mode) for typed configuration and deployment guidance.
+
+The conditional allowance applies only to `POST` on the exact built-in route template `/home/user/passport/logout`. It does not exempt other write methods or business routes. When Demonstration Mode is disabled, this Guard does not restrict logout, but the configured auth-token mode still determines revocation behavior.
+
 ## Deploy with the `a-demo` suite
 
 The `demo-demonstration` module is included in the current project's `a-demo` suite; no separate package installation is required.

package/repo-docs/backend/openapi-guide.md

@@ -50,7 +50,7 @@ This is important because OpenAPI is treated as a first-class framework service,
 
 ## MCP mapping and normal ingress admission
 
-In Cabloy Basic, method/class `@mcp.tool()` metadata opts registered Controller Actions into MCP mapping using their existing request/response contracts. It is independent of ordinary OpenAPI publication: `@Api.exclude()` is not an MCP authorization boundary, and publishing an HTTP action does not opt it into MCP. Decorator opt-in alone does **not** expose an action on normal `/mcp`.
+In Cabloy Basic, method/class `@Mcp.tool()` metadata opts registered Controller Actions into MCP mapping using their existing request/response contracts. It is independent of ordinary OpenAPI publication: `@Api.exclude()` is not an MCP authorization boundary, and publishing an HTTP action does not opt it into MCP. Decorator opt-in alone does **not** expose an action on normal `/mcp`.
 
 Normal shared ingress is owned by `cabloy-mcp` and accepts recognized dev/test/prod modes through the same OAuth and business-authorization boundary. Production is not rejected solely by mode; unknown modes, not-ready, closing, disabled or invalid required authority configuration still fail closed. Dedicated protected audit, audit-delivery gating and deployment-wide fine-grained quotas are deferred for this two-read MVP, not delivered capabilities or production prerequisites. Enabled-by-default behavior is unchanged: only literal `CABLOY_MCP_ENABLED=false` disables it. Construction admission permits exactly `training-student.controller.student` actions `lookup` and `summary`, for both listing and known-name direct calls. Optional training absent means an empty catalog, without fallback. The three synthetic catalog tools and anonymous standalone entry belong only to the `mcp-test` launcher, not shared `/mcp`.
 

package/repo-docs/frontend/behavior-guide.md

@@ -339,6 +339,8 @@ This is a clean example of attaching a behavior to a native element through a ge
 
 ### Perform a standalone asynchronous button action
 
+Both Cabloy Basic and Cabloy Start provide `ZButton`. Prefer it for button actions, including menu actions, rather than rebuilding its action lifecycle with native elements. Keep navigation as links, and use native buttons or lower-level behaviors only when a specific interaction requires them. Resolve component imports and styling from the active edition; the implementation details below describe Cabloy Basic.
+
 Cabloy Basic's `ZButton` attaches the `basic-button:perform` behavior to its native button. `BehaviorPerform` owns the button-local lifecycle for an action passed through `onPerform`:
 
 - loading presentation and `aria-busy`
@@ -363,6 +365,16 @@ Pass the complete interaction promise through `onPerform`. For a button-only act
 </ZButton>
 ```
 
+For a model mutation whose failure should reach the button's error boundary, return or await `mutateAsync()`:
+
+```tsx
+<ZButton onPerform={() => this.$passport.logout().mutateAsync()}>
+  {this.scope.locale.Logout()}
+</ZButton>
+```
+
+`mutate()` returns `void` and consumes the rejection, so even `await mutation.mutate()` cannot deliver that failure to the button's error boundary. `mutateAsync()` returns the complete mutation promise and rejects on failure. Keep success-only navigation and authentication cleanup in the owning mutation; do not move them into `finally` or clear authentication before the request succeeds.
+
 Returning the complete promise is not enough when an API reports its failure as a result value. When a `ZButton` owns the generic error path for a query refetch, await a refetch that rejects on failure:
 
 ```tsx

package/repo-e2e/specs/home-user-account.spec.ts

@@ -1,4 +1,4 @@
-import type { APIRequestContext, Page, TestInfo } from '@playwright/test';
+import type { APIRequestContext, Page, Route, TestInfo } from '@playwright/test';
 
 import path from 'node:path';
 
@@ -636,6 +636,101 @@ test(
   },
 );
 
+for (const flavor of ['web', 'admin'] as const) {
+  test(
+    `ATP-ACCOUNT-LOGOUT-${flavor.toUpperCase()}-01: rejected logout shows an error and preserves authentication`,
+    { tag: ['@account', `@${flavor}`, '@flow'] },
+    async ({ page, request }, testInfo) => {
+      let account: RegisteredAccount | undefined;
+      const logoutRoute = (url: URL) => url.pathname === '/api/home/user/passport/logout';
+      const errorMessage = 'This operation is forbidden in demonstration mode';
+      let rejectedRequests = 0;
+      const rejectLogout = async (route: Route) => {
+        if (route.request().method() !== 'POST') return route.continue();
+        rejectedRequests++;
+        await route.fulfill({
+          status: 403,
+          contentType: 'application/json',
+          body: JSON.stringify({ code: 'demo-demonstration:1001', message: errorMessage }),
+        });
+      };
+      try {
+        if (flavor === 'web') {
+          account = await registerAccountUser(request, testInfo, registered => {
+            account = registered;
+          });
+        }
+        const pageErrors = collectPageErrors(page);
+        const consoleErrors = collectConsoleErrors(page, [
+          /server responded with a status of 403/i,
+        ]);
+        const loginPath = flavor === 'admin' ? '/admin/login' : '/login';
+        await page.goto(loginPath, { waitUntil: 'load' });
+        await expect(page.locator('html')).toHaveAttribute('data-zova-hydrated', flavor);
+        await page.getByPlaceholder('Your Username').fill(account?.username ?? 'admin');
+        await page.getByPlaceholder('Your Password').fill(account?.password ?? '123456');
+        await expect(page.getByPlaceholder('Please input captcha')).not.toHaveValue('');
+        const loginResponse = waitForApiResponse(page, 'POST', passportLoginApiPath);
+        await page.getByRole('button', { name: 'Login', exact: true }).click();
+        expect((await loginResponse).ok()).toBeTruthy();
+        await expect(page).not.toHaveURL(new RegExp(`${loginPath}(?:\\?|$)`));
+        const signedInUrl = page.url();
+        const token = (await page.context().cookies()).find(
+          cookie => cookie.name === 'token',
+        )?.value;
+        expect(token).toBeTruthy();
+        const userMenu = page
+          .locator('details')
+          .filter({ has: page.getByText('Logout', { exact: true }) });
+        await expect(userMenu).toHaveCount(1);
+        const logout = userMenu.getByText('Logout', { exact: true });
+        await page.route(logoutRoute, rejectLogout);
+        for (let attempt = 1; attempt <= 2; attempt++) {
+          await userMenu.locator('summary').click();
+          await logout.click();
+          const dialog = page.getByRole('dialog');
+          await expect(dialog).toHaveCount(1);
+          await expect(dialog).toBeVisible();
+          await expect(dialog).toContainText(errorMessage);
+          await expect(userMenu).not.toHaveAttribute('open', '');
+          await expect(logout).not.toHaveAttribute('aria-busy', 'true');
+          expect(rejectedRequests).toBe(attempt);
+          expect(page.url()).toBe(signedInUrl);
+          expect(
+            (await page.context().cookies()).find(cookie => cookie.name === 'token')?.value,
+          ).toBe(token);
+          await dialog.getByRole('button', { name: 'Close', exact: true }).click();
+          await expect(dialog).toHaveCount(0);
+        }
+        await userMenu.locator('summary').click();
+        const accountResponse = waitForApiResponse(page, 'GET', accountApiPath);
+        await userMenu.getByText('Account Settings', { exact: true }).click();
+        expect((await accountResponse).ok()).toBeTruthy();
+        await expect(page.getByRole('heading', { name: 'Account Settings' })).toBeVisible();
+        await page.unroute(logoutRoute, rejectLogout);
+        if (flavor === 'web') {
+          await userMenu.locator('summary').click();
+          const logoutResponse = waitForApiResponse(page, 'POST', '/api/home/user/passport/logout');
+          await logout.click();
+          expect((await logoutResponse).ok()).toBeTruthy();
+          await expect(page).toHaveURL(/\/login(?:\?|$)/);
+          await expect(page.getByText('Logout', { exact: true })).toHaveCount(0);
+          expect(
+            (await page.context().cookies()).find(cookie => cookie.name === 'token')?.value,
+          ).toBeFalsy();
+          await page.goto(accountPath, { waitUntil: 'load' });
+          await expect(page).toHaveURL(/\/login(?:\?|$)/);
+        }
+        expect(pageErrors).toEqual([]);
+        expect(consoleErrors).toEqual([]);
+      } finally {
+        if (!page.isClosed()) await page.unroute(logoutRoute, rejectLogout);
+        if (account) await removeAccountFixture(request, account);
+      }
+    },
+  );
+}
+
 test(
   'ATP-ACCOUNT-ADMIN-01: Account Settings precedes Logout and reaches the shared page',
   { tag: ['@account', '@admin'] },
@@ -663,8 +758,8 @@ test(
     await expect(userMenu).toHaveCount(1);
     const summary = userMenu.locator('summary');
     await summary.click();
-    const links = userMenu.locator('ul > li > a');
-    await expect(links).toHaveText(['Account Settings', 'Logout']);
+    const actions = userMenu.locator('ul > li > a, ul > li > button');
+    await expect(actions).toHaveText(['Account Settings', 'Logout']);
 
     const accountResponse = page.waitForResponse(response => {
       const url = new URL(response.url());

package/vona/env/.env

@@ -94,6 +94,8 @@ HOME_USER_BUILTIN_ROLE_SYSTEM_ADMIN_SITE_IDS = *
 
 # auth
 
+AUTH_TOKEN_MODE = auth
+
 AUTH_USEMOCKFORDEV = true
 AUTH_GITHUB_CLIENTID =
 AUTH_GITHUB_CLIENTSECRET =

package/vona/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli",
-  "version": "1.1.174",
+  "version": "1.1.175",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli",
   "keywords": [

package/vona/packages-cli/cli-set-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli-set-api",
-  "version": "1.1.172",
+  "version": "1.1.173",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli-set-api",
   "keywords": [

package/vona/packages-utils/babel-plugin-vona-bean-module/package.json

@@ -1,6 +1,6 @@
 {
   "name": "babel-plugin-vona-bean-module",
-  "version": "1.1.9",
+  "version": "1.1.10",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "babel-plugin-vona-bean-module",
   "keywords": [

package/vona/packages-utils/babel-plugin-vona-bean-module/src/index.test.ts

@@ -14,3 +14,30 @@ test('excludes timestamped generated Vona roots from bean module transforms', ()
   );
   assert.equal(isValidBeanModuleFile('/project/vona/src/module/foo/src/index.ts'), true);
 });
+
+for (const relativePath of [
+  'src/boot/app/index.ts',
+  '.zova/app/index.ts',
+  'src/backend/view.tsx',
+  '.vona/app.ts',
+]) {
+  for (const separator of ['/', '\\']) {
+    test(`excludes ${relativePath} with ${JSON.stringify(separator)} separators`, () => {
+      const fileName = `/project/vona-bin-build-fresh-a1b2c3/${relativePath}`.replaceAll(
+        '/',
+        separator,
+      );
+      assert.equal(isValidBeanModuleFile(fileName), false);
+    });
+  }
+}
+
+for (const separator of ['/', '\\']) {
+  test(`includes module source with ${JSON.stringify(separator)} separators`, () => {
+    const fileName = '/project/vona/src/module/test-fixture/src/service/main.ts'.replaceAll(
+      '/',
+      separator,
+    );
+    assert.equal(isValidBeanModuleFile(fileName), true);
+  });
+}

package/vona/packages-utils/babel-plugin-vona-bean-module/src/index.ts

@@ -95,6 +95,7 @@ function __createDecoratorNode(beanInfo) {
 
 export function isValidBeanModuleFile(fileName?: string | null) {
   if (!fileName) return false;
+  fileName = fileName.replace(/\\/g, '/');
   if (/[\\/].vona-test-\d{14}-[a-f0-9]{8}[\\/]/.test(fileName)) return false;
   return !['src/boot/app/', '.zova/app/', 'src/backend/', '.vona/'].some(item => {
     return fileName.includes(item);

package/vona/packages-vona/vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona",
-  "version": "5.1.122",
+  "version": "5.1.123",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "Vona is an intuitive, elegant and powerful Node.js framework for rapidly developing enterprise applications of any size",
   "keywords": [

package/vona/src/suite/a-demo/modules/demo-demonstration/src/bean/guard.demonstration.ts

@@ -30,7 +30,6 @@ export interface IGuardOptionsDemonstration extends IDecoratorGuardOptionsGlobal
   methodsForWrite,
   usernameWhitelist: parseUsernameWhitelist(app.meta.env.DEMONSTRATION_USERNAME_WHITELIST),
   ignore: [
-    // '/home/user/passport/logout',
     '/home/user/passport/register',
     '/home/user/passport/login',
     '/home/user/passport/login/:module/:providerName/:clientName?',
@@ -59,6 +58,14 @@ export class GuardDemonstration extends BeanBase implements IGuardExecute {
       return next();
     }
 
+    if (
+      method === 'POST' &&
+      this.ctx.route?.routePathRaw === '/home/user/passport/logout' &&
+      this.bean.passport.authTokenMode === 'session'
+    ) {
+      return next();
+    }
+
     const user = this.bean.passport.currentUser;
     if (
       this.bean.passport.isAuthenticated &&

package/vona/src/suite/a-demo/modules/demo-demonstration/test/guardDemonstration.test.ts

@@ -8,6 +8,7 @@ const guardBeanName = 'demo-demonstration.guard.demonstration';
 const businessRoute = {
   controllerBeanFullName: 'test.controller.business',
   action: 'write',
+  routePathRaw: '/test/business/write',
 };
 
 function guard() {
@@ -101,7 +102,81 @@ describe('guardDemonstration.test.ts', { concurrency: false }, () => {
     });
   });
 
-  it('exempts the configured authentication and OAuth routes but protects logout', () => {
+  it('allows non-whitelisted logout only in session auth-token mode', async t => {
+    await app.bean.executor.mockCtx(async () => {
+      const passport = app.bean.passport;
+      await passport.signinMock('admin');
+      try {
+        setRequest('POST', { ...businessRoute, routePathRaw: '/home/user/passport/logout' });
+        for (const authTokenMode of ['auth', 'session'] as const) {
+          const getter = t.mock.getter(passport, 'authTokenMode', () => authTokenMode);
+          try {
+            let continued = false;
+            const [result, err] = await catchError(() =>
+              guard().execute(
+                { enable: true, methodsForWrite: ['POST'], usernameWhitelist: [] } as any,
+                async () => {
+                  continued = true;
+                  return true;
+                },
+              ),
+            );
+            if (authTokenMode === 'session') {
+              assert.ifError(err);
+              assert.equal(result, true);
+              assert.equal(continued, true);
+            } else {
+              assert.equal(err?.code, 'demo-demonstration:1001');
+              assert.equal(err?.status, 403);
+              assert.equal(continued, false);
+            }
+          } finally {
+            getter.mock.restore();
+          }
+        }
+      } finally {
+        await passport.signout();
+      }
+    });
+  });
+
+  it('keeps other writes protected in session mode', async t => {
+    await app.bean.executor.mockCtx(async () => {
+      const passport = app.bean.passport;
+      await passport.signinMock('admin');
+      try {
+        const getter = t.mock.getter(passport, 'authTokenMode', () => 'session' as const);
+        try {
+          for (const [method, routePathRaw] of [
+            ['POST', businessRoute.routePathRaw],
+            ['DELETE', '/home/user/passport/logout'],
+            ['POST', '/home/user/passport/logout/'],
+          ]) {
+            setRequest(method, { ...businessRoute, routePathRaw });
+            let continued = false;
+            const [_, err] = await catchError(() =>
+              guard().execute(
+                { enable: true, methodsForWrite: ['POST', 'DELETE'], usernameWhitelist: [] } as any,
+                async () => {
+                  continued = true;
+                  return true;
+                },
+              ),
+            );
+            assert.equal(err?.code, 'demo-demonstration:1001');
+            assert.equal(err?.status, 403);
+            assert.equal(continued, false);
+          }
+        } finally {
+          getter.mock.restore();
+        }
+      } finally {
+        await passport.signout();
+      }
+    });
+  });
+
+  it('exempts the configured authentication and OAuth routes but still selects logout', () => {
     for (const routePathRaw of [
       '/home/user/passport/login',
       '/home/user/passport/login/:module/:providerName/:clientName?',