@nuxtjp/local-runtime 0.1.3 → 0.1.5

package/README.ja.md

@@ -9,7 +9,7 @@
 `0.1.1`はnpmで公開済みです。Node `^22.19.0`または`^24.11.0`、Nuxt `^4.5.1`、Vue `^3.5.40`を使用してください。
 
 ```sh
-npm install @nuxtjp/local-runtime@0.1.0
+npm install @nuxtjp/local-runtime
 ```
 
 ```ts
@@ -69,3 +69,6 @@ module/client API、loopback endpointの規則、明示接続の動作、ライ
 [使い方](https://github.com/nuxtjp/nuxt-local-runtime/blob/main/docs/getting-started.md) · [Schema](schemas) · [実装](https://github.com/nuxtjp/nuxt-local-runtime/tree/main/src) · [テスト](https://github.com/nuxtjp/nuxt-local-runtime/tree/main/test) · [貢献方法](https://github.com/nuxtjp/nuxt-local-runtime/blob/main/CONTRIBUTING.md) · [セキュリティ報告](https://github.com/nuxtjp/nuxt-local-runtime/blob/main/SECURITY.md)
 
 コードは[Apache-2.0](LICENSE)です。[NOTICE](NOTICE)と[以前の許諾](LICENSE-PREVIOUS)を保持してください。
+
+Dependency updates: [repository policy](docs/dependency-updates.md).
+Registry releases: [version tags and GitHub OIDC](docs/registry-release.md).

package/README.md

@@ -6,10 +6,10 @@ Connect a browser interface to one explicitly configured local Rust runtime, aft
 
 ## Install and use
 
-Version `0.1.1` is published on npm. Use Node `^22.19.0` or `^24.11.0`, Nuxt `^4.5.1` and Vue `^3.5.40`.
+Install the package version `0.1.4` after it is available on npm. Use Node `^22.19.0` or `^24.11.0`, Nuxt `^4.5.1` and Vue `^3.5.40`.
 
 ```sh
-npm install @nuxtjp/local-runtime@0.1.0
+npm install @nuxtjp/local-runtime
 ```
 
 ```ts
@@ -73,3 +73,8 @@ Code: [Apache-2.0](LICENSE). Retain [NOTICE](NOTICE) and the prior grants in [LI
 ## Consumer dependency security
 
 See [dependency security backports](security/README.md) before installing this package in a Nuxt application. pnpm consumers must explicitly apply the included backports and verify their locked dependency tree; ordinary npm installation does not apply them.
+
+[OSS responsibility and source completion](docs/oss-source-contract.md) defines the supported package boundary and required acceptance. It does not declare unexecuted source, distribution or production checks complete.
+
+Dependency updates: [repository policy](docs/dependency-updates.md).
+Registry releases: [version tags and GitHub OIDC](docs/registry-release.md).

package/dist/module.json

@@ -4,9 +4,9 @@
   "compatibility": {
     "nuxt": "^4.5.1"
   },
-  "version": "0.1.3",
+  "version": "0.1.5",
   "builder": {
-    "@nuxt/module-builder": "1.0.2",
+    "@nuxt/module-builder": "1.0.3",
     "unbuild": "unknown"
   }
 }

package/dist/runtime/app/composables/useLocalRuntime.d.ts

@@ -1,4 +1,3 @@
-import type { ViewEnvelope } from '../../shared/types.js';
 export declare function useLocalRuntime(): {
     state: Readonly<import("vue").Ref<{
         readonly phase: import("../../client/index.js").ConnectionPhase;
@@ -87,6 +86,6 @@ export declare function useLocalRuntime(): {
     }>>;
     connected: import("vue").ComputedRef<boolean>;
     connect: (capabilities?: string[]) => Promise<void>;
-    view: (capabilityId: string, viewId: string) => Promise<ViewEnvelope>;
+    view: (capabilityId: string, viewId: string) => Promise<import("../../client/index.js").ViewEnvelope>;
     disconnect: () => Promise<void>;
 };

package/dist/runtime/app/composables/useLocalRuntime.js

@@ -1,51 +1,10 @@
-import { computed, readonly, ref } from "vue";
 import { useRuntimeConfig } from "#imports";
 import { LocalRuntimeClient } from "../../client/client.js";
+import { createLocalRuntimeConnection } from "../connection.js";
 export function useLocalRuntime() {
   const config = useRuntimeConfig();
-  const state = ref({
-    phase: "idle",
-    manifest: null,
-    error: null
-  });
-  let client = null;
-  async function connect(capabilities = []) {
-    state.value = { phase: "connecting", manifest: null, error: null };
-    try {
-      const endpoint = config.public.nuxtJpLocalRuntime.endpoint;
-      client = new LocalRuntimeClient({
-        endpoint,
-        origin: window.location.origin
-      });
-      const manifest = await client.manifest();
-      await client.connect(capabilities);
-      state.value = { phase: "connected", manifest, error: null };
-    } catch (error) {
-      client = null;
-      state.value = {
-        phase: error instanceof DOMException && error.name === "NotAllowedError" ? "denied" : "unavailable",
-        manifest: null,
-        error: error instanceof Error ? error.message : "\u63A5\u7D9A\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F"
-      };
-    }
-  }
-  async function view(capabilityId, viewId) {
-    if (!client) throw new Error("local runtime is not connected");
-    return client.view(capabilityId, viewId);
-  }
-  async function disconnect() {
-    try {
-      await client?.disconnect();
-    } finally {
-      client = null;
-      state.value = { phase: "idle", manifest: null, error: null };
-    }
-  }
-  return {
-    state: readonly(state),
-    connected: computed(() => state.value.phase === "connected"),
-    connect,
-    view,
-    disconnect
-  };
+  return createLocalRuntimeConnection(() => new LocalRuntimeClient({
+    endpoint: config.public.nuxtJpLocalRuntime.endpoint,
+    origin: window.location.origin
+  }));
 }

package/dist/runtime/app/connection.d.ts

@@ -0,0 +1,94 @@
+import type { LocalRuntimeClient } from '../client/client.js';
+import type { ViewEnvelope } from '../shared/types.js';
+/** Own each connection attempt separately; only the latest operation publishes state. */
+export declare function createLocalRuntimeConnection(createClient: () => LocalRuntimeClient): {
+    state: Readonly<import("vue").Ref<{
+        readonly phase: import("../client/index.js").ConnectionPhase;
+        readonly manifest: {
+            readonly schema: "nuxtjp://local-runtime/manifest/v1";
+            readonly runtime_id: string;
+            readonly protocol_version: "1";
+            readonly mode: "local-simulation" | "local-production";
+            readonly external_actions: false;
+            readonly engine: {
+                readonly kind: "rust-v8";
+                readonly status: "disabled" | "simulated" | "ready";
+                readonly isolation: "in-process-simulation" | "process";
+                readonly arbitrary_network: false;
+                readonly arbitrary_filesystem: false;
+            };
+            readonly security: {
+                readonly default_band: "sealed";
+                readonly external_egress: "deny";
+                readonly allowed_origins: readonly string[];
+                readonly limits: {
+                    readonly max_request_bytes: number;
+                    readonly max_response_bytes: number;
+                    readonly max_messages_per_minute: number;
+                    readonly max_bytes_per_minute: number;
+                    readonly session_ttl_seconds: number;
+                };
+            };
+            readonly capabilities: readonly {
+                readonly id: string;
+                readonly service_id: string;
+                readonly description: string;
+                readonly output_band: "session" | "public";
+                readonly payload_schema: {
+                    readonly id: string;
+                    readonly fields: readonly {
+                        readonly name: string;
+                        readonly kind: import("../client/index.js").PayloadValueKind;
+                    }[];
+                };
+            }[];
+        } | null;
+        readonly error: string | null;
+    }, {
+        readonly phase: import("../client/index.js").ConnectionPhase;
+        readonly manifest: {
+            readonly schema: "nuxtjp://local-runtime/manifest/v1";
+            readonly runtime_id: string;
+            readonly protocol_version: "1";
+            readonly mode: "local-simulation" | "local-production";
+            readonly external_actions: false;
+            readonly engine: {
+                readonly kind: "rust-v8";
+                readonly status: "disabled" | "simulated" | "ready";
+                readonly isolation: "in-process-simulation" | "process";
+                readonly arbitrary_network: false;
+                readonly arbitrary_filesystem: false;
+            };
+            readonly security: {
+                readonly default_band: "sealed";
+                readonly external_egress: "deny";
+                readonly allowed_origins: readonly string[];
+                readonly limits: {
+                    readonly max_request_bytes: number;
+                    readonly max_response_bytes: number;
+                    readonly max_messages_per_minute: number;
+                    readonly max_bytes_per_minute: number;
+                    readonly session_ttl_seconds: number;
+                };
+            };
+            readonly capabilities: readonly {
+                readonly id: string;
+                readonly service_id: string;
+                readonly description: string;
+                readonly output_band: "session" | "public";
+                readonly payload_schema: {
+                    readonly id: string;
+                    readonly fields: readonly {
+                        readonly name: string;
+                        readonly kind: import("../client/index.js").PayloadValueKind;
+                    }[];
+                };
+            }[];
+        } | null;
+        readonly error: string | null;
+    }>>;
+    connected: import("vue").ComputedRef<boolean>;
+    connect: (capabilities?: string[]) => Promise<void>;
+    view: (capabilityId: string, viewId: string) => Promise<ViewEnvelope>;
+    disconnect: () => Promise<void>;
+};

package/dist/runtime/app/connection.js

@@ -0,0 +1,57 @@
+import { computed, readonly, ref } from "vue";
+export function createLocalRuntimeConnection(createClient) {
+  const state = ref({ phase: "idle", manifest: null, error: null });
+  let generation = 0;
+  let client = null;
+  let pending = null;
+  async function connect(capabilities = []) {
+    const operation = ++generation;
+    const previous = pending || client;
+    client = null;
+    pending = null;
+    state.value = { phase: "connecting", manifest: null, error: null };
+    let attempt = null;
+    try {
+      attempt = createClient();
+      pending = attempt;
+      await previous?.disconnect();
+      if (operation !== generation) return;
+      const manifest = await attempt.manifest();
+      await attempt.connect(capabilities);
+      if (operation !== generation) {
+        await attempt.disconnect();
+        return;
+      }
+      client = attempt;
+      pending = null;
+      state.value = { phase: "connected", manifest, error: null };
+    } catch (error) {
+      if (operation !== generation) return;
+      try {
+        await attempt?.disconnect();
+      } catch {
+      }
+      if (operation !== generation) return;
+      pending = null;
+      client = null;
+      state.value = {
+        phase: error instanceof DOMException && error.name === "NotAllowedError" ? "denied" : "unavailable",
+        manifest: null,
+        error: error instanceof Error ? error.message : "\u63A5\u7D9A\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F"
+      };
+    }
+  }
+  async function view(capabilityId, viewId) {
+    if (!client || state.value.phase !== "connected") throw new Error("local runtime is not connected");
+    return client.view(capabilityId, viewId);
+  }
+  async function disconnect() {
+    ++generation;
+    const previous = pending || client;
+    pending = null;
+    client = null;
+    state.value = { phase: "idle", manifest: null, error: null };
+    await previous?.disconnect();
+  }
+  return { state: readonly(state), connected: computed(() => state.value.phase === "connected"), connect, view, disconnect };
+}

package/dist/runtime/client/client.d.ts

@@ -12,6 +12,7 @@ export declare class LocalRuntimeClient {
     private readonly fetcher;
     private readonly maximumResponseBytes;
     private readonly timeoutMilliseconds;
+    private operation;
     private grant;
     private runtimeManifest;
     constructor(options: LocalRuntimeClientOptions);
@@ -19,4 +20,5 @@ export declare class LocalRuntimeClient {
     connect(capabilities: string[]): Promise<SessionGrant>;
     view(capabilityId: string, viewId: string): Promise<ViewEnvelope>;
     disconnect(): Promise<void>;
+    private revoke;
 }

package/dist/runtime/client/client.js

@@ -12,6 +12,7 @@ export class LocalRuntimeClient {
   fetcher;
   maximumResponseBytes;
   timeoutMilliseconds;
+  operation = 0;
   grant = null;
   runtimeManifest = null;
   constructor(options) {
@@ -28,6 +29,7 @@ export class LocalRuntimeClient {
     }
   }
   async manifest() {
+    const operation = this.operation;
     const value = await localJson(
       this.fetcher,
       runtimeUrl(this.endpoint, "/v1/manifest"),
@@ -38,6 +40,7 @@ export class LocalRuntimeClient {
     if (!isLocalRuntimeManifest(value) || !value.security.allowed_origins.includes(this.origin)) {
       throw new Error("invalid runtime manifest");
     }
+    if (operation !== this.operation) throw new Error("local runtime operation was superseded");
     this.runtimeManifest = value;
     return value;
   }
@@ -52,6 +55,12 @@ export class LocalRuntimeClient {
     if (capabilities.some((capability) => !available.has(capability))) {
       throw new Error("requested capability is not declared");
     }
+    const runtimeManifest = this.runtimeManifest;
+    const operation = ++this.operation;
+    const previous = this.grant;
+    this.grant = null;
+    if (previous) await this.revoke(previous.token);
+    if (operation !== this.operation) throw new Error("local runtime operation was superseded");
     const request = {
       schema: "nuxtjp://local-runtime/session-request/v1",
       origin: this.origin,
@@ -69,10 +78,18 @@ export class LocalRuntimeClient {
     const expected = [...new Set(capabilities)].sort();
     const observed = isSessionGrant(value) ? [...value.granted_capabilities].sort() : [];
     const now = Math.floor(Date.now() / 1e3);
-    const limits = this.runtimeManifest.security.limits;
+    const limits = runtimeManifest.security.limits;
     if (!isSessionGrant(value) || value.audience !== this.origin || value.expires_at_unix_seconds <= now || value.expires_at_unix_seconds > now + limits.session_ttl_seconds + 5 || JSON.stringify(observed) !== JSON.stringify(expected) || value.budget.max_messages > limits.max_messages_per_minute || value.budget.max_bytes > limits.max_bytes_per_minute) {
       throw new Error("invalid runtime session grant");
     }
+    if (operation !== this.operation) {
+      try {
+        await this.revoke(value.token);
+      } catch {
+        throw new Error("superseded runtime session cleanup failed");
+      }
+      throw new Error("local runtime operation was superseded");
+    }
     this.grant = value;
     return value;
   }
@@ -83,6 +100,9 @@ export class LocalRuntimeClient {
     if (!this.grant.granted_capabilities.includes(capabilityId)) {
       throw new Error("capability was not granted");
     }
+    const operation = this.operation;
+    const grant = this.grant;
+    const runtimeManifest = this.runtimeManifest;
     const request = {
       schema: "nuxtjp://local-runtime/view-request/v1",
       capability_id: capabilityId,
@@ -92,20 +112,26 @@ export class LocalRuntimeClient {
     const value = await localJson(
       this.fetcher,
       runtimeUrl(this.endpoint, "/v1/view"),
-      localRequest("POST", { body: request, token: this.grant.token }),
+      localRequest("POST", { body: request, token: grant.token }),
       this.maximumResponseBytes,
       this.timeoutMilliseconds
     );
-    const capability = this.runtimeManifest.capabilities.find((item) => item.id === capabilityId);
+    if (operation !== this.operation || this.grant !== grant) {
+      throw new Error("local runtime operation was superseded");
+    }
+    const capability = runtimeManifest.capabilities.find((item) => item.id === capabilityId);
     if (!capability || !isViewEnvelope(value, capability.payload_schema) || value.capability_id !== capabilityId || value.view_id !== viewId) {
       throw new Error("invalid runtime view");
     }
     return value;
   }
   async disconnect() {
+    ++this.operation;
     const token = this.grant?.token;
     this.grant = null;
-    if (!token) return;
+    if (token) await this.revoke(token);
+  }
+  async revoke(token) {
     await localJson(
       this.fetcher,
       runtimeUrl(this.endpoint, "/v1/session"),

package/package.json

@@ -1,10 +1,9 @@
 {
   "name": "@nuxtjp/local-runtime",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Fail-closed Nuxt client for a loopback local runtime",
   "type": "module",
   "license": "Apache-2.0",
-  "packageManager": "pnpm@10.29.3",
   "engines": {
     "node": "^22.19.0 || ^24.11.0",
     "pnpm": ">=10 <11"
@@ -41,31 +40,23 @@
     },
     "./schema": "./schemas/local-runtime-v1.schema.json"
   },
-  "scripts": {
-    "build": "nuxt-module-build build && nuxt build playground",
-    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
-    "test": "vitest run && pnpm run test:dependency-security && pnpm run test:consumer-security",
-    "prepack": "pnpm run test && pnpm run typecheck && pnpm run build",
-    "test:dependency-security": "node --test scripts/dependency-security.check.cjs",
-    "test:consumer-security": "node --test scripts/consumer-security.check.mjs"
-  },
   "peerDependencies": {
     "nuxt": "^4.5.1",
     "vue": "^3.5.40"
   },
   "dependencies": {
-    "@nuxt/kit": "4.5.2",
-    "@nuxt/schema": "4.5.1"
+    "@nuxt/kit": "4.6.1",
+    "@nuxt/schema": "4.6.1"
   },
   "devDependencies": {
-    "@nuxt/module-builder": "1.0.2",
+    "@nuxt/module-builder": "1.0.3",
     "@types/node": "24.12.0",
     "ajv": "8.20.0",
-    "nuxt": "4.5.2",
+    "nuxt": "4.6.1",
     "typescript": "5.9.3",
-    "vitest": "4.1.11",
+    "vitest": "5.0.3",
     "vue": "3.5.43",
-    "vue-tsc": "3.2.8"
+    "vue-tsc": "3.3.13"
   },
   "repository": {
     "type": "git",
@@ -80,16 +71,11 @@
     "registry": "https://registry.npmjs.org",
     "provenance": true
   },
-  "pnpm": {
-    "overrides": {
-      "@nuxt/devtools>simple-git": "4.0.2",
-      "simple-git": "4.0.2",
-      "@simple-git/argv-parser": "2.0.1",
-      "esbuild": "0.28.2"
-    },
-    "patchedDependencies": {
-      "braces@3.0.3": "patches/braces@3.0.3.patch",
-      "node-forge@1.4.0": "patches/node-forge@1.4.0.patch"
-    }
+  "scripts": {
+    "build": "nuxt-module-build build && nuxt build playground",
+    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
+    "test": "vitest run && pnpm run test:dependency-security && pnpm run test:consumer-security",
+    "test:dependency-security": "node --test scripts/dependency-security.check.cjs",
+    "test:consumer-security": "node --test scripts/consumer-security.check.mjs"
   }
-}
+}

package/security/LICENSE-simple-git

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2025 Steve King
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/security/README.md

@@ -19,3 +19,5 @@ The RSA test creates an ephemeral key in memory and never reads a user key. Patc
 Run `pnpm audit --json` on the installed application and retain the report. Only the two backported braces/node-forge advisories may remain; any other advisory, including simple-git, its argument parser, or esbuild, blocks validation. Run the dependency regression command on each install to reject missing or older active versions.
 
 The code patch inputs retain third-party notices in `LICENSE-braces` (MIT) and `LICENSE-node-forge`. The original dependencies remain registry packages; the shipped files configure and test the consumer rather than silently replacing its package manager.
+
+The simple-git 4.0.2 compatibility patch restores only the legacy ESM default factory used by Nuxt devtools. It aliases the existing, fixed `simpleGit` factory and does not change argument validation, executable selection, or Git execution. The named factory remains identical. `LICENSE-simple-git` retains its upstream MIT notice. A fresh consumer build and type check with devtools enabled are mandatory release checks.

package/security/dependency-security.check.cjs

@@ -57,3 +57,14 @@ test('active dependency graph uses every required upstream security version', ()
     for (const manifest of matches) assert.equal(JSON.parse(fs.readFileSync(manifest, 'utf8')).version, version, name);
   }
 });
+
+// Preserve the ESM entry point expected by current Nuxt devtools without downgrading Git protections.
+test('fixed simple-git retains named and legacy ESM factory exports', async () => {
+  const { pathToFileURL } = require('node:url');
+  const { installedDependencies } = require('./resolved-dependency.cjs');
+  for (const manifest of installedDependencies(process.cwd(), 'simple-git', '4.0.2')) {
+    const module = await import(pathToFileURL(path.join(path.dirname(manifest), 'dist/index.mjs')).href);
+    assert.equal(typeof module.simpleGit, 'function');
+    assert.equal(module.default, module.simpleGit);
+  }
+});

package/security/patches/simple-git@4.0.2.patch

@@ -0,0 +1,11 @@
+--- a/dist/index.mjs
++++ b/dist/index.mjs
+@@ -2890,6 +2890,7 @@
+   xe as TaskConfigurationError,
+   Sn as grepQueryBuilder,
+   ko as pathspec,
+-  wo as simpleGit
++  wo as simpleGit,
++  wo as default
+ };
+ //# sourceMappingURL=index.mjs.map

package/security/project.mjs

@@ -3,7 +3,7 @@ import { existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSy
 import { join, resolve } from 'node:path'
 import { randomUUID } from 'node:crypto'
 
-const patches = ['braces@3.0.3', 'node-forge@1.4.0']
+const patches = ['braces@3.0.3', 'node-forge@1.4.0', 'simple-git@4.0.2']
 function regular(path) {
   const stat = lstatSync(path)
   if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 1024 * 1024) {