cabloy 5.1.187 → 5.1.189

package/vona/src/suite-vendor/a-auth/modules/a-auth/src/lib/utils.ts

@@ -7,3 +7,45 @@ export function getStrategyOauth2Profile<T = IAuthUserProfile>(
 ): T {
   return args[2];
 }
+
+export type TypeOauthRedirectKind =
+  | 'absolute'
+  | 'invalid'
+  | 'missing'
+  | 'non_http'
+  | 'protocol_relative'
+  | 'relative';
+
+export interface IOauthRedirectDiagnostic {
+  redirectKind: TypeOauthRedirectKind;
+  redirectOrigin?: string;
+  redirectProtocol?: string;
+  redirectHost?: string;
+  redirectHostname?: string;
+  redirectPort?: string;
+}
+
+export function getOauthRedirectDiagnostic(redirect: string): IOauthRedirectDiagnostic {
+  if (redirect.startsWith('//')) return { redirectKind: 'protocol_relative' };
+  if (redirect.startsWith('/')) return { redirectKind: 'relative' };
+
+  let url: URL;
+  try {
+    url = new URL(redirect);
+  } catch {
+    return { redirectKind: 'invalid' };
+  }
+
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    return { redirectKind: 'non_http', redirectProtocol: url.protocol };
+  }
+
+  return {
+    redirectKind: 'absolute',
+    redirectOrigin: url.origin,
+    redirectProtocol: url.protocol,
+    redirectHost: url.host,
+    redirectHostname: url.hostname,
+    redirectPort: url.port || undefined,
+  };
+}

package/vona/src/suite-vendor/a-auth/modules/a-auth/src/service/auth.ts

@@ -20,6 +20,7 @@ import type {
 } from '../types/authProvider.ts';
 
 import { StrategyMock } from '../lib/strategyMock.ts';
+import { getOauthRedirectDiagnostic } from '../lib/utils.ts';
 
 @Service()
 export class ServiceAuth extends BeanBase {
@@ -247,10 +248,27 @@ export class ServiceAuth extends BeanBase {
           if (clientOptions.mockUsername) {
             return resolve(jwt);
           }
+          // redirect
+          if (!strategyState.redirect) {
+            this._logOauthRedirectRejected(entityAuthProvider, strategyState, 'redirect_missing');
+            return reject(new Error('redirect not specified'));
+          }
+          if (!strategyState.redirect.startsWith('/')) {
+            const redirectAllowed = !!this.bean.security.checkOrigin(
+              strategyState.redirect,
+              this.app.util.host,
+            );
+            if (!redirectAllowed) {
+              this._logOauthRedirectRejected(
+                entityAuthProvider,
+                strategyState,
+                'origin_disallowed',
+              );
+              return this.app.throw(403);
+            }
+          }
           // code
           const code = await this.bean.passport.createOauthCodeFromOauthAuthToken(jwt.accessToken);
-          // redirect
-          if (!strategyState.redirect) return reject(new Error('redirect not specified'));
           const redirectUrl = combineQueries(strategyState.redirect, {
             [this.scope.config.oauthCodeField]: code,
           });
@@ -266,6 +284,46 @@ export class ServiceAuth extends BeanBase {
     });
   }
 
+  private _logOauthRedirectRejected(
+    entityAuthProvider: EntityAuthProvider,
+    strategyState: IAuthenticateStrategyState,
+    reason: 'origin_disallowed' | 'redirect_missing',
+  ) {
+    const redirectDiagnostic = strategyState.redirect
+      ? getOauthRedirectDiagnostic(strategyState.redirect)
+      : { redirectKind: 'missing' as const };
+    const onionCors = this.bean.onion.middlewareSystem.getOnionSlice('a-security:cors');
+    const whiteList = onionCors?.beanOptions.options?.whiteList;
+    const whiteListEntries =
+      typeof whiteList === 'string' ? whiteList.split(',').filter(Boolean) : whiteList;
+    this.$logger.warn('OAuth callback final redirect rejected', {
+      event: 'auth.oauth_final_redirect_rejected',
+      stage: 'redirect_validation',
+      outcome: 'rejected',
+      reason,
+      authProviderId: entityAuthProvider.id,
+      providerName: entityAuthProvider.providerName,
+      clientName: entityAuthProvider.clientName,
+      intention: strategyState.intention ?? 'login',
+      instanceName: strategyState.instanceName,
+      mockMode: !!strategyState.clientOptions?.mockUsername,
+      requestHost: this.app.util.host,
+      requestProtocol: this.app.util.protocol,
+      serveHost: this.ctx.config.server.serve.host || null,
+      serveProtocol: this.ctx.config.server.serve.protocol || null,
+      proxyEnabled: this.app.proxy,
+      hostMatches:
+        redirectDiagnostic.redirectHost === undefined
+          ? undefined
+          : redirectDiagnostic.redirectHost === this.app.util.host,
+      whiteListConfigured: Array.isArray(whiteList) ? whiteList.length > 0 : !!whiteList,
+      whiteListKind: Array.isArray(whiteList) ? 'array' : typeof whiteList,
+      whiteListEntryCount: Array.isArray(whiteListEntries) ? whiteListEntries.length : 0,
+      whiteListWildcard: whiteList === '*',
+      ...redirectDiagnostic,
+    });
+  }
+
   public async getStrategyConstructable(
     beanAuthProvider: IAuthProviderVerify & IAuthProviderStrategy,
     clientOptions: IAuthProviderClientOptions,

package/vona/src/suite-vendor/a-auth/modules/a-auth/test/authCallbackRedirect.test.ts

@@ -0,0 +1,44 @@
+import assert from 'node:assert';
+import { describe, it } from 'node:test';
+
+import { getOauthRedirectDiagnostic } from '../src/lib/utils.ts';
+
+describe('authCallbackRedirect.test.ts', () => {
+  it('keeps absolute redirect diagnostics free of sensitive URL components', () => {
+    const code = 'oauth-authorization-code-sentinel';
+    const state = 'oauth-state-sentinel';
+    const token = 'oauth-token-sentinel';
+    const redirect = `https://user:password@app.example.test:8443/auth/callback?code=${code}&state=${state}&token=${token}#fragment-sentinel`;
+
+    const diagnostic = getOauthRedirectDiagnostic(redirect);
+    const serialized = JSON.stringify(diagnostic);
+
+    assert.deepEqual(diagnostic, {
+      redirectKind: 'absolute',
+      redirectOrigin: 'https://app.example.test:8443',
+      redirectProtocol: 'https:',
+      redirectHost: 'app.example.test:8443',
+      redirectHostname: 'app.example.test',
+      redirectPort: '8443',
+    });
+    for (const value of [code, state, token, 'user', 'password', 'callback', 'fragment-sentinel']) {
+      assert.equal(serialized.includes(value), false);
+    }
+  });
+
+  it('classifies redirect shapes without retaining raw values', () => {
+    assert.deepEqual(getOauthRedirectDiagnostic('/home/base/authCallback?token=secret'), {
+      redirectKind: 'relative',
+    });
+    assert.deepEqual(getOauthRedirectDiagnostic('//app.example.test/authCallback?token=secret'), {
+      redirectKind: 'protocol_relative',
+    });
+    assert.deepEqual(getOauthRedirectDiagnostic('https://[invalid'), {
+      redirectKind: 'invalid',
+    });
+    assert.deepEqual(getOauthRedirectDiagnostic('javascript:alert(secret)'), {
+      redirectKind: 'non_http',
+      redirectProtocol: 'javascript:',
+    });
+  });
+});

package/vona/src/suite-vendor/a-auth/modules/a-auth/test/oauthRequestContext.test.ts

@@ -0,0 +1,171 @@
+import assert from 'node:assert';
+import { after, before, describe, it } from 'node:test';
+import { acquireTestLock, app } from 'vona-mock';
+
+describe('oauthRequestContext.test.ts', { concurrency: false }, () => {
+  const releases: Array<() => void> = [];
+
+  before(async () => {
+    releases.push(await acquireTestLock('a-security'));
+  });
+
+  after(() => {
+    for (const release of releases.reverse()) release();
+  });
+  it('passes the callback request through an isolated context without rewriting it', async () => {
+    await app.bean.executor.mockCtx(async () => {
+      const proxyPrevious = app.proxy;
+      app.proxy = true;
+      try {
+        const req = {
+          method: 'GET',
+          url: '/api/auth/passport/callback?a=1&b=2',
+          headers: {
+            'host': 'origin.internal.test',
+            'x-forwarded-host': 'demo.example.test',
+            'x-forwarded-proto': 'https',
+            'user-agent': 'oauth-callback-test',
+          },
+          httpVersionMajor: 1,
+          socket: {
+            remoteAddress: '192.0.2.10',
+            remotePort: 443,
+          },
+        };
+        const originalUrl = req.url;
+        const originalHeaders = { ...req.headers };
+        const outerContext = app.ctx;
+        const result = await app.bean.executor.newCtx(
+          async () => {
+            return {
+              context: app.ctx,
+              request: app.ctx.req,
+              method: app.ctx.method,
+              host: app.ctx.host,
+              protocol: app.ctx.protocol,
+              secure: app.ctx.secure,
+              query: app.ctx.request.query,
+              userAgent: app.ctx.get('user-agent'),
+            };
+          },
+          {
+            instanceName: outerContext.instanceName!,
+            req,
+          },
+        );
+
+        assert.notEqual(result.context, outerContext);
+        assert.equal(result.request, req);
+        assert.equal(result.method, 'GET');
+        assert.equal(result.host, 'demo.example.test');
+        assert.equal(result.protocol, 'https');
+        assert.equal(result.secure, true);
+        assert.deepEqual(result.query, { a: '1', b: '2' });
+        assert.equal(result.userAgent, 'oauth-callback-test');
+        assert.equal(req.url, originalUrl);
+        assert.deepEqual(req.headers, originalHeaders);
+        assert.equal(app.ctx, outerContext);
+      } finally {
+        app.proxy = proxyPrevious;
+      }
+    });
+  });
+
+  it('logs rejected redirects against the canonical server origin', async () => {
+    await app.bean.executor.mockCtx(async () => {
+      const proxyPrevious = app.proxy;
+      const serve = app.ctx.config.server.serve;
+      const servePrevious = { ...serve };
+      app.proxy = true;
+      (serve as any).host = 'canonical.example.test';
+      (serve as any).protocol = 'http';
+      try {
+        const req = {
+          method: 'GET',
+          url: '/api/auth/passport/callback',
+          headers: {
+            'host': 'origin.internal.test',
+            'x-forwarded-host': 'edge.example.test',
+            'x-forwarded-proto': 'https',
+          },
+          httpVersionMajor: 1,
+          socket: {
+            remoteAddress: '192.0.2.10',
+            remotePort: 443,
+          },
+        };
+        await app.bean.executor.newCtx(
+          async () => {
+            assert.equal(app.ctx.host, 'edge.example.test');
+            assert.equal(app.ctx.protocol, 'https');
+            assert.equal(app.util.host, 'canonical.example.test');
+            assert.equal(app.util.protocol, 'http');
+
+            const service = app.scope('a-auth').service.auth;
+            const logger = (service as any).$logger;
+            const warnPrevious = logger.warn;
+            const warnings: unknown[][] = [];
+            logger.warn = (...args: unknown[]) => warnings.push(args);
+            try {
+              (service as any)._logOauthRedirectRejected(
+                {
+                  id: -1,
+                  providerName: 'auth-oauth:oauth',
+                  clientName: 'github',
+                },
+                {
+                  authProviderId: -1,
+                  instanceName: app.ctx.instanceName!,
+                  locale: app.ctx.locale,
+                  redirect: 'https://edge.example.test/oauth/callback',
+                },
+                'origin_disallowed',
+              );
+            } finally {
+              logger.warn = warnPrevious;
+            }
+
+            assert.equal(warnings.length, 1);
+            assert.equal(warnings[0][0], 'OAuth callback final redirect rejected');
+            const diagnostic = warnings[0][1] as Record<string, unknown>;
+            assert.deepEqual(
+              {
+                event: diagnostic.event,
+                stage: diagnostic.stage,
+                outcome: diagnostic.outcome,
+                reason: diagnostic.reason,
+                requestHost: diagnostic.requestHost,
+                requestProtocol: diagnostic.requestProtocol,
+                serveHost: diagnostic.serveHost,
+                serveProtocol: diagnostic.serveProtocol,
+                proxyEnabled: diagnostic.proxyEnabled,
+                redirectHost: diagnostic.redirectHost,
+                hostMatches: diagnostic.hostMatches,
+              },
+              {
+                event: 'auth.oauth_final_redirect_rejected',
+                stage: 'redirect_validation',
+                outcome: 'rejected',
+                reason: 'origin_disallowed',
+                requestHost: 'canonical.example.test',
+                requestProtocol: 'http',
+                serveHost: 'canonical.example.test',
+                serveProtocol: 'http',
+                proxyEnabled: true,
+                redirectHost: 'edge.example.test',
+                hostMatches: false,
+              },
+            );
+          },
+          {
+            instanceName: app.ctx.instanceName!,
+            req,
+          },
+        );
+      } finally {
+        app.proxy = proxyPrevious;
+        Object.assign(serve, servePrevious);
+      }
+    });
+  });
+});

package/vona/src/suite-vendor/a-auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-auth",
-  "version": "5.1.27",
+  "version": "5.1.28",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/vona/src/suite-vendor/a-cabloy/modules/a-socket/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-socket",
-  "version": "5.1.16",
+  "version": "5.1.17",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-cabloy/modules/a-socket/src/bean/socketConnection.cors.ts

@@ -14,7 +14,7 @@ export interface ISocketConnectionOptionsCors extends IDecoratorSocketConnection
 export class SocketConnectionCors extends BeanBase implements ISocketConnectionExecute {
   async enter(ws: WebSocket, _options: ISocketConnectionOptionsCors, next: Next): Promise<void> {
     // cors
-    const origin = this.bean.security.checkOrigin(this.ctx.get('origin'), this.ctx.host);
+    const origin = this.bean.security.checkOrigin(this.ctx.get('origin'), this.app.util.host);
     if (!origin) {
       ws.terminate();
       return;

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-ssr",
-  "version": "5.1.32",
+  "version": "5.1.33",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-cabloy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-cabloy",
-  "version": "5.1.56",
+  "version": "5.1.57",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.54",
+  "version": "5.1.55",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-security/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-security",
-  "version": "5.1.13",
+  "version": "5.1.14",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-security/src/bean/middlewareSystem.cors.ts

@@ -52,5 +52,5 @@ export class MiddlewareSystemCors extends BeanBase implements IMiddlewareSystemE
 }
 
 function _corsOrigin(ctx: VonaContext) {
-  return ctx.app.bean.security.checkOrigin(ctx.get('origin'), ctx.host);
+  return ctx.app.bean.security.checkOrigin(ctx.get('origin'), ctx.app.util.host);
 }

package/vona/src/suite-vendor/a-vona/modules/a-version/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-version",
-  "version": "5.1.16",
+  "version": "5.1.17",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona-module-a-version",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-version/src/lib/databaseTestName.ts

@@ -0,0 +1,47 @@
+import { createHash } from 'node:crypto';
+
+const DATABASE_NAME_MAX_BYTES = 63;
+const APP_NAME_MAX_BYTES = 13;
+const HASH_LENGTH = 10;
+const TIMESTAMP_LENGTH = 15;
+
+export function getDatabaseTestPrefix(appName: string, scope: string): string {
+  const readablePrefix = getReadablePrefix(appName, scope);
+  if (Buffer.byteLength(readablePrefix, 'utf8') + TIMESTAMP_LENGTH <= DATABASE_NAME_MAX_BYTES) {
+    return readablePrefix;
+  }
+
+  const appHead = truncateUtf8(appName, APP_NAME_MAX_BYTES);
+  const scopeKind = scope === 'share' ? 's' : 'i';
+  const namespaceHash = hash(`${appName}\0${scope}`);
+  return `vona-test-${appHead}-${scopeKind}-${namespaceHash}-`;
+}
+
+export function createDatabaseTestName(databasePrefix: string, timestamp: string): string {
+  const databaseName = `${databasePrefix}${timestamp}`;
+  if (Buffer.byteLength(databaseName, 'utf8') > DATABASE_NAME_MAX_BYTES) {
+    throw new Error(`test database name exceeds ${DATABASE_NAME_MAX_BYTES} bytes`);
+  }
+  return databaseName;
+}
+
+function getReadablePrefix(appName: string, scope: string): string {
+  if (scope === 'share') return `vona-test-${appName}-s-`;
+  return `vona-test-${appName}-i-${scope.slice('isolate-'.length)}-`;
+}
+
+function hash(value: string): string {
+  return createHash('sha256').update(value).digest('base64url').slice(0, HASH_LENGTH);
+}
+
+function truncateUtf8(value: string, maxBytes: number): string {
+  let result = '';
+  let bytes = 0;
+  for (const char of value) {
+    const charBytes = Buffer.byteLength(char, 'utf8');
+    if (bytes + charBytes > maxBytes) break;
+    result += char;
+    bytes += charBytes;
+  }
+  return result;
+}

package/vona/src/suite-vendor/a-vona/modules/a-version/src/service/database.ts

@@ -7,6 +7,8 @@ import { DateTime } from 'luxon';
 import { BeanBase } from 'vona';
 import { Service } from 'vona-module-a-bean';
 
+import { createDatabaseTestName, getDatabaseTestPrefix } from '../lib/databaseTestName.ts';
+
 const __separator = '-';
 const __timeFormat = `yyyyMMdd${__separator}HHmmss`;
 
@@ -20,8 +22,8 @@ export class ServiceDatabase extends BeanBase {
     instanceName?: keyof IInstanceRecord,
     configInstanceBase?: ConfigInstanceBase,
   ) {
-    const prefix = configInstanceBase?.isolate ? `isolate${__separator}${instanceName}` : 'share';
-    return `vona${__separator}test${__separator}${this.app.name}${__separator}${prefix}${__separator}`;
+    const scope = configInstanceBase?.isolate ? `isolate${__separator}${instanceName}` : 'share';
+    return getDatabaseTestPrefix(this.app.name, scope);
   }
 
   public async databaseInitStartup() {
@@ -60,7 +62,10 @@ export class ServiceDatabase extends BeanBase {
     configInstanceBase?: ConfigInstanceBase,
   ) {
     const databasePrefix = this.getDatabasePrefix(instanceName, configInstanceBase);
-    const databaseName = `${databasePrefix}${DateTime.now().toFormat(__timeFormat)}`;
+    const databaseName = createDatabaseTestName(
+      databasePrefix,
+      DateTime.now().toFormat(__timeFormat),
+    );
     return await client.connection.schema.createDatabase(databaseName);
   }
 

package/vona/src/suite-vendor/a-vona/modules/a-version/test/databaseName.test.ts

@@ -0,0 +1,72 @@
+import assert from 'node:assert';
+import { describe, it } from 'node:test';
+
+import { createDatabaseTestName, getDatabaseTestPrefix } from '../src/lib/databaseTestName.ts';
+
+const timestamp = '20260923-104500';
+
+describe('databaseTestName', () => {
+  it('keeps a short shared app name readable with its shared marker', () => {
+    const prefix = getDatabaseTestPrefix('cabloy-start', 'share');
+    const databaseName = createDatabaseTestName(prefix, timestamp);
+
+    assert.equal(prefix, 'vona-test-cabloy-start-s-');
+    assert.equal(databaseName, 'vona-test-cabloy-start-s-20260923-104500');
+    assert.ok(Buffer.byteLength(databaseName, 'utf8') <= 63);
+  });
+
+  it('keeps a short isolated app name readable with its isolate identity', () => {
+    const sharedPrefix = getDatabaseTestPrefix('cabloy-start', 'share');
+    const isolatedPrefix = getDatabaseTestPrefix('cabloy-start', 'isolate-isolateTest');
+
+    assert.equal(isolatedPrefix, 'vona-test-cabloy-start-i-isolateTest-');
+    assert.notEqual(sharedPrefix, isolatedPrefix);
+  });
+
+  it('uses the readable format through 63 bytes and the fallback at 64 bytes', () => {
+    const readableAppName = 'a'.repeat(35);
+    const fallbackAppName = `${readableAppName}a`;
+    const readablePrefix = getDatabaseTestPrefix(readableAppName, 'share');
+    const fallbackPrefix = getDatabaseTestPrefix(fallbackAppName, 'share');
+    const readableName = createDatabaseTestName(readablePrefix, timestamp);
+    const fallbackName = createDatabaseTestName(fallbackPrefix, timestamp);
+
+    assert.equal(readablePrefix, `vona-test-${readableAppName}-s-`);
+    assert.equal(Buffer.byteLength(readableName, 'utf8'), 63);
+    assert.match(fallbackPrefix, /^vona-test-a{13}-s-[\w-]{10}-$/);
+    assert.ok(Buffer.byteLength(fallbackName, 'utf8') <= 63);
+  });
+
+  it('uses UTF-8 byte length and preserves code points in the fallback', () => {
+    const readableAppName = '商'.repeat(11);
+    const fallbackAppName = `${readableAppName}店`;
+    const readablePrefix = getDatabaseTestPrefix(readableAppName, 'share');
+    const fallbackPrefix = getDatabaseTestPrefix(fallbackAppName, 'share');
+    const fallbackName = createDatabaseTestName(fallbackPrefix, timestamp);
+
+    assert.equal(readablePrefix, `vona-test-${readableAppName}-s-`);
+    assert.match(fallbackPrefix, /^vona-test-商{4}-s-[\w-]{10}-$/);
+    assert.ok(!fallbackPrefix.includes('�'));
+    assert.ok(Buffer.byteLength(fallbackName, 'utf8') <= 63);
+  });
+
+  it('distinguishes fallback namespaces with the same visible app head and distinct scopes', () => {
+    const appHead = 'same-readable';
+    const first = getDatabaseTestPrefix(
+      `${appHead}-worktree-one-that-overflows`,
+      'isolate-isolateTest',
+    );
+    const second = getDatabaseTestPrefix(
+      `${appHead}-worktree-two-that-overflows`,
+      'isolate-isolateTest',
+    );
+    const third = getDatabaseTestPrefix(
+      `${appHead}-worktree-one-that-overflows`,
+      'isolate-isolatePeerTest',
+    );
+
+    assert.notEqual(first, second);
+    assert.notEqual(first, third);
+    assert.match(first, /-i-[\w-]{10}-$/);
+  });
+});

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.89",
+  "version": "5.1.91",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/zova/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-cli",
-  "version": "1.2.110",
+  "version": "1.2.111",
   "gitHead": "6f675a8cc46d596142c591c28a40cc4d82fcc6cc",
   "description": "zova cli",
   "keywords": [
@@ -44,7 +44,7 @@
     "@cabloy/process-helper": "^3.1.8",
     "fs-extra": "^11.3.5",
     "semver": "^7.6.2",
-    "zova-cli-set-front": "^1.2.108"
+    "zova-cli-set-front": "^1.2.109"
   },
   "devDependencies": {
     "clean-package": "^2.2.0",

package/zova/packages-cli/cli-set-front/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-cli-set-front",
-  "version": "1.2.108",
+  "version": "1.2.109",
   "gitHead": "6f675a8cc46d596142c591c28a40cc4d82fcc6cc",
   "description": "zova cli-set-front",
   "keywords": [
@@ -70,7 +70,7 @@
     "vite": "^8.0.14",
     "yaml": "^2.8.3",
     "zova-openapi": "^1.1.17",
-    "zova-vite": "^1.1.46"
+    "zova-vite": "^1.1.47"
   },
   "devDependencies": {
     "clean-package": "^2.2.0",

package/zova/packages-utils/zova-vite/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-vite",
-  "version": "1.1.46",
+  "version": "1.1.47",
   "gitHead": "09d901d17140a80ee0764211b441cda72fd94663",
   "description": "zova vite",
   "keywords": [

package/zova/packages-utils/zova-vite/src/collect-css-ssr.ts

@@ -58,11 +58,13 @@ function _collectCss(
     }
   });
 
-  styles.forEach((content, id) => {
-    result = result.concat(
-      `<style vite-css-module-id="${hashCode(id)}">${(content || '').replaceAll('\n', '')}</style>`,
-    );
-  });
+  Array.from(styles.entries())
+    .reverse()
+    .forEach(([id, content]) => {
+      result = result.concat(
+        `<style vite-css-module-id="${hashCode(id)}">${(content || '').replaceAll('\n', '')}</style>`,
+      );
+    });
 
   return result;
 }