cabloy 5.1.247 → 5.1.249

package/zova/package.original.json

@@ -31,7 +31,6 @@
     "format:fix": "oxfmt --write",
     "lint": "oxlint",
     "lint:fix": "oxlint --fix",
-    "docs:fix": "textlint --fix ./packages-docs/**/*.md",
     "dev:ssr:admin": "npm run prerun && quasar dev --mode ssr --flavor admin",
     "build:ssr:admin": "npm run prerun && quasar build --mode ssr --flavor admin",
     "preview:ssr:admin": "concurrently \"node ./dist-mock/index.js\" \"node ./dist/ssr-admin/index.js\"",
@@ -89,11 +88,6 @@
     "vite": "^8.3.4",
     "vite-plugin-fake-server-turbo": "^3.0.18",
     "zova-vite": "workspace:^",
-    "textlint": "^15.7.0",
-    "textlint-rule-en-no-mixed-period": "^3.0.2",
-    "textlint-rule-ja-no-mixed-period": "^3.0.2",
-    "textlint-rule-ja-space-between-half-and-full-width": "^2.4.2",
-    "textlint-rule-period-in-list-item": "^1.0.1",
     "oxfmt": "^0.74.0",
     "oxlint": "^1.89.0"
   },

package/zova/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-cli",
-  "version": "1.2.122",
+  "version": "1.2.123",
   "gitHead": "6f675a8cc46d596142c591c28a40cc4d82fcc6cc",
   "description": "zova cli",
   "keywords": [
@@ -44,7 +44,7 @@
     "@cabloy/process-helper": "^3.1.9",
     "fs-extra": "^11.3.5",
     "semver": "^7.6.2",
-    "zova-cli-set-front": "^1.2.120"
+    "zova-cli-set-front": "^1.2.121"
   },
   "devDependencies": {
     "clean-package": "^2.2.0",

package/zova/packages-cli/cli-set-front/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-cli-set-front",
-  "version": "1.2.120",
+  "version": "1.2.121",
   "gitHead": "6f675a8cc46d596142c591c28a40cc4d82fcc6cc",
   "description": "zova cli-set-front",
   "keywords": [
@@ -70,7 +70,7 @@
     "vite": "^8.3.4",
     "yaml": "^2.8.3",
     "zova-openapi": "^1.1.17",
-    "zova-vite": "^1.1.51"
+    "zova-vite": "^1.1.52"
   },
   "devDependencies": {
     "clean-package": "^2.2.0",

package/zova/packages-utils/zova-vite/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-vite",
-  "version": "1.1.51",
+  "version": "1.1.52",
   "gitHead": "09d901d17140a80ee0764211b441cda72fd94663",
   "description": "zova vite",
   "keywords": [

package/zova/packages-utils/zova-vite/src/teleports.ts

@@ -5,6 +5,13 @@ export function collectTeleports(html, teleports) {
 export function renderTeleports(teleports) {
   if (!teleports) return '';
   return Object.entries(teleports).reduce((all, [key, value]) => {
+    // This serializer creates dedicated containers, not arbitrary CSS selector targets.
+    const target = /^#[a-z_][\w-]*/i.exec(key);
+    if (!target || target[0] !== key) {
+      throw new Error(
+        `Unsupported SSR Teleport target ${JSON.stringify(key)}. Only simple #id targets are supported (ASCII letter or underscore first, then letters, digits, underscores, or hyphens). Use a dedicated Teleport container, not body.`,
+      );
+    }
     return `${all}<div id="${key.slice(1)}">${value}</div>`;
   }, '');
 }

package/zova/packages-utils/zova-vite/test/teleports.test.ts

@@ -0,0 +1,114 @@
+import { createSSRApp, h, Teleport } from '@cabloy/vue-runtime-dom';
+import { renderToString } from '@cabloy/vue-server-renderer';
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+
+import { collectTeleports, renderTeleports } from '../src/teleports.ts';
+
+const anchors = '<!--teleport start anchor--><!--teleport anchor-->';
+
+async function renderTeleport(to: string, disabled: boolean) {
+  const context: { teleports?: Record<string, string> } = {};
+  const app = createSSRApp({
+    render: () => h('main', [h(Teleport, { to, disabled }, h('span', 'action'))]),
+  });
+  const html = await renderToString(app, context);
+  assert.ok(context.teleports);
+  return { html, teleports: context.teleports };
+}
+
+function assertUnsupportedTarget(target: string, fragment = '') {
+  assert.throws(
+    () => renderTeleports({ [target]: fragment }),
+    error => {
+      assert.ok(error instanceof Error);
+      assert.ok(error.message.includes(JSON.stringify(target)));
+      assert.match(error.message, /simple #id/);
+      assert.match(error.message, /dedicated.*container/i);
+      return true;
+    },
+  );
+}
+
+test('empty Teleport maps produce no containers', () => {
+  assert.equal(renderTeleports(undefined), '');
+  assert.equal(renderTeleports(null), '');
+  assert.equal(renderTeleports({}), '');
+});
+
+test('simple ID targets retain empty fragments, anchors, and entry order', () => {
+  const teleports = {
+    '#modal-root': '<p>first &amp; second</p>',
+    '#v-0': anchors,
+    '#v-0-0': '',
+    '#_overlay2': '<span>last</span>',
+  };
+  assert.equal(
+    renderTeleports(teleports),
+    '<div id="modal-root"><p>first &amp; second</p></div>' +
+      `<div id="v-0">${anchors}</div>` +
+      '<div id="v-0-0"></div><div id="_overlay2"><span>last</span></div>',
+  );
+});
+
+test('unsupported selectors and unsafe IDs fail even with empty fragments', () => {
+  const targets = [
+    'body',
+    'head',
+    'html',
+    '.modal',
+    '[data-modal]',
+    '',
+    '#',
+    '#1modal',
+    '#modal .child',
+    '#modal>span',
+    '#modal,#other',
+    '#modal.active',
+    '#modal:focus',
+    '#modal[open]',
+    '#modal\\:child',
+    '#modal" data-other="value',
+    "#modal'",
+    '#modal><span>',
+    '#modal&amp;',
+    ' #modal',
+    '#modal ',
+    '#modal\n',
+    '#modal\r\n',
+    `#modal${String.fromCharCode(0x2028)}`,
+  ];
+  for (const target of targets) assertUnsupportedTarget(target);
+  assertUnsupportedTarget('body', anchors);
+});
+
+test('collectTeleports inserts supported fragments and propagates unsupported targets', () => {
+  const html = '<body>\n  <!--app-teleports-->\n</body>';
+  assert.equal(
+    collectTeleports(html, { '#modal-root': anchors }),
+    `<body><div id="modal-root">${anchors}</div>\n</body>`,
+  );
+  assert.throws(() => collectTeleports(html, { body: anchors }), /simple #id/);
+});
+
+test('real SSR enabled and disabled Teleports preserve their complete target fragments', async () => {
+  for (const disabled of [false, true]) {
+    const { html, teleports } = await renderTeleport('#modal-root', disabled);
+    assert.equal(
+      teleports['#modal-root'],
+      `<!--teleport start anchor-->${disabled ? '' : '<span>action</span>'}<!--teleport anchor-->`,
+    );
+    assert.equal(html.includes('<span>action</span>'), disabled);
+    assert.equal(
+      renderTeleports(teleports),
+      `<div id="modal-root">${teleports['#modal-root']}</div>`,
+    );
+  }
+});
+
+test('real SSR disabled body Teleport is rejected instead of becoming an unrelated ID', async () => {
+  const { html, teleports } = await renderTeleport('body', true);
+  assert.ok(html.includes('<span>action</span>'));
+  assert.equal(teleports.body, anchors);
+  assert.throws(() => renderTeleports(teleports), /Unsupported SSR Teleport target "body"/);
+});

package/zova/packages-zova/zova/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova",
-  "version": "5.1.178",
+  "version": "5.1.179",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A vue3 framework with ioc",
   "keywords": [
@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "zova-core": "^5.1.95",
-    "zova-suite-a-zova": "^5.1.177"
+    "zova-suite-a-zova": "^5.1.178"
   },
   "devDependencies": {
     "clean-package": "^2.2.0",