@nuxtjp/local-runtime 0.1.4 → 0.1.5

package/README.ja.md

@@ -9,7 +9,7 @@
 `0.1.1`はnpmで公開済みです。Node `^22.19.0`または`^24.11.0`、Nuxt `^4.5.1`、Vue `^3.5.40`を使用してください。
 
 ```sh
-npm install @nuxtjp/local-runtime@0.1.4
+npm install @nuxtjp/local-runtime
 ```
 
 ```ts
@@ -69,3 +69,6 @@ module/client API、loopback endpointの規則、明示接続の動作、ライ
 [使い方](https://github.com/nuxtjp/nuxt-local-runtime/blob/main/docs/getting-started.md) · [Schema](schemas) · [実装](https://github.com/nuxtjp/nuxt-local-runtime/tree/main/src) · [テスト](https://github.com/nuxtjp/nuxt-local-runtime/tree/main/test) · [貢献方法](https://github.com/nuxtjp/nuxt-local-runtime/blob/main/CONTRIBUTING.md) · [セキュリティ報告](https://github.com/nuxtjp/nuxt-local-runtime/blob/main/SECURITY.md)
 
 コードは[Apache-2.0](LICENSE)です。[NOTICE](NOTICE)と[以前の許諾](LICENSE-PREVIOUS)を保持してください。
+
+Dependency updates: [repository policy](docs/dependency-updates.md).
+Registry releases: [version tags and GitHub OIDC](docs/registry-release.md).

package/README.md

@@ -9,7 +9,7 @@ Connect a browser interface to one explicitly configured local Rust runtime, aft
 Install the package version `0.1.4` after it is available on npm. Use Node `^22.19.0` or `^24.11.0`, Nuxt `^4.5.1` and Vue `^3.5.40`.
 
 ```sh
-npm install @nuxtjp/local-runtime@0.1.4
+npm install @nuxtjp/local-runtime
 ```
 
 ```ts
@@ -73,3 +73,8 @@ Code: [Apache-2.0](LICENSE). Retain [NOTICE](NOTICE) and the prior grants in [LI
 ## Consumer dependency security
 
 See [dependency security backports](security/README.md) before installing this package in a Nuxt application. pnpm consumers must explicitly apply the included backports and verify their locked dependency tree; ordinary npm installation does not apply them.
+
+[OSS responsibility and source completion](docs/oss-source-contract.md) defines the supported package boundary and required acceptance. It does not declare unexecuted source, distribution or production checks complete.
+
+Dependency updates: [repository policy](docs/dependency-updates.md).
+Registry releases: [version tags and GitHub OIDC](docs/registry-release.md).

package/dist/module.json

@@ -4,9 +4,9 @@
   "compatibility": {
     "nuxt": "^4.5.1"
   },
-  "version": "0.1.4",
+  "version": "0.1.5",
   "builder": {
-    "@nuxt/module-builder": "1.0.2",
+    "@nuxt/module-builder": "1.0.3",
     "unbuild": "unknown"
   }
 }

package/dist/runtime/app/composables/useLocalRuntime.d.ts

@@ -1,4 +1,3 @@
-import type { ViewEnvelope } from '../../shared/types.js';
 export declare function useLocalRuntime(): {
     state: Readonly<import("vue").Ref<{
         readonly phase: import("../../client/index.js").ConnectionPhase;
@@ -87,6 +86,6 @@ export declare function useLocalRuntime(): {
     }>>;
     connected: import("vue").ComputedRef<boolean>;
     connect: (capabilities?: string[]) => Promise<void>;
-    view: (capabilityId: string, viewId: string) => Promise<ViewEnvelope>;
+    view: (capabilityId: string, viewId: string) => Promise<import("../../client/index.js").ViewEnvelope>;
     disconnect: () => Promise<void>;
 };

package/dist/runtime/app/composables/useLocalRuntime.js

@@ -1,51 +1,10 @@
-import { computed, readonly, ref } from "vue";
 import { useRuntimeConfig } from "#imports";
 import { LocalRuntimeClient } from "../../client/client.js";
+import { createLocalRuntimeConnection } from "../connection.js";
 export function useLocalRuntime() {
   const config = useRuntimeConfig();
-  const state = ref({
-    phase: "idle",
-    manifest: null,
-    error: null
-  });
-  let client = null;
-  async function connect(capabilities = []) {
-    state.value = { phase: "connecting", manifest: null, error: null };
-    try {
-      const endpoint = config.public.nuxtJpLocalRuntime.endpoint;
-      client = new LocalRuntimeClient({
-        endpoint,
-        origin: window.location.origin
-      });
-      const manifest = await client.manifest();
-      await client.connect(capabilities);
-      state.value = { phase: "connected", manifest, error: null };
-    } catch (error) {
-      client = null;
-      state.value = {
-        phase: error instanceof DOMException && error.name === "NotAllowedError" ? "denied" : "unavailable",
-        manifest: null,
-        error: error instanceof Error ? error.message : "\u63A5\u7D9A\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F"
-      };
-    }
-  }
-  async function view(capabilityId, viewId) {
-    if (!client) throw new Error("local runtime is not connected");
-    return client.view(capabilityId, viewId);
-  }
-  async function disconnect() {
-    try {
-      await client?.disconnect();
-    } finally {
-      client = null;
-      state.value = { phase: "idle", manifest: null, error: null };
-    }
-  }
-  return {
-    state: readonly(state),
-    connected: computed(() => state.value.phase === "connected"),
-    connect,
-    view,
-    disconnect
-  };
+  return createLocalRuntimeConnection(() => new LocalRuntimeClient({
+    endpoint: config.public.nuxtJpLocalRuntime.endpoint,
+    origin: window.location.origin
+  }));
 }

package/dist/runtime/app/connection.d.ts

@@ -0,0 +1,94 @@
+import type { LocalRuntimeClient } from '../client/client.js';
+import type { ViewEnvelope } from '../shared/types.js';
+/** Own each connection attempt separately; only the latest operation publishes state. */
+export declare function createLocalRuntimeConnection(createClient: () => LocalRuntimeClient): {
+    state: Readonly<import("vue").Ref<{
+        readonly phase: import("../client/index.js").ConnectionPhase;
+        readonly manifest: {
+            readonly schema: "nuxtjp://local-runtime/manifest/v1";
+            readonly runtime_id: string;
+            readonly protocol_version: "1";
+            readonly mode: "local-simulation" | "local-production";
+            readonly external_actions: false;
+            readonly engine: {
+                readonly kind: "rust-v8";
+                readonly status: "disabled" | "simulated" | "ready";
+                readonly isolation: "in-process-simulation" | "process";
+                readonly arbitrary_network: false;
+                readonly arbitrary_filesystem: false;
+            };
+            readonly security: {
+                readonly default_band: "sealed";
+                readonly external_egress: "deny";
+                readonly allowed_origins: readonly string[];
+                readonly limits: {
+                    readonly max_request_bytes: number;
+                    readonly max_response_bytes: number;
+                    readonly max_messages_per_minute: number;
+                    readonly max_bytes_per_minute: number;
+                    readonly session_ttl_seconds: number;
+                };
+            };
+            readonly capabilities: readonly {
+                readonly id: string;
+                readonly service_id: string;
+                readonly description: string;
+                readonly output_band: "session" | "public";
+                readonly payload_schema: {
+                    readonly id: string;
+                    readonly fields: readonly {
+                        readonly name: string;
+                        readonly kind: import("../client/index.js").PayloadValueKind;
+                    }[];
+                };
+            }[];
+        } | null;
+        readonly error: string | null;
+    }, {
+        readonly phase: import("../client/index.js").ConnectionPhase;
+        readonly manifest: {
+            readonly schema: "nuxtjp://local-runtime/manifest/v1";
+            readonly runtime_id: string;
+            readonly protocol_version: "1";
+            readonly mode: "local-simulation" | "local-production";
+            readonly external_actions: false;
+            readonly engine: {
+                readonly kind: "rust-v8";
+                readonly status: "disabled" | "simulated" | "ready";
+                readonly isolation: "in-process-simulation" | "process";
+                readonly arbitrary_network: false;
+                readonly arbitrary_filesystem: false;
+            };
+            readonly security: {
+                readonly default_band: "sealed";
+                readonly external_egress: "deny";
+                readonly allowed_origins: readonly string[];
+                readonly limits: {
+                    readonly max_request_bytes: number;
+                    readonly max_response_bytes: number;
+                    readonly max_messages_per_minute: number;
+                    readonly max_bytes_per_minute: number;
+                    readonly session_ttl_seconds: number;
+                };
+            };
+            readonly capabilities: readonly {
+                readonly id: string;
+                readonly service_id: string;
+                readonly description: string;
+                readonly output_band: "session" | "public";
+                readonly payload_schema: {
+                    readonly id: string;
+                    readonly fields: readonly {
+                        readonly name: string;
+                        readonly kind: import("../client/index.js").PayloadValueKind;
+                    }[];
+                };
+            }[];
+        } | null;
+        readonly error: string | null;
+    }>>;
+    connected: import("vue").ComputedRef<boolean>;
+    connect: (capabilities?: string[]) => Promise<void>;
+    view: (capabilityId: string, viewId: string) => Promise<ViewEnvelope>;
+    disconnect: () => Promise<void>;
+};

package/dist/runtime/app/connection.js

@@ -0,0 +1,57 @@
+import { computed, readonly, ref } from "vue";
+export function createLocalRuntimeConnection(createClient) {
+  const state = ref({ phase: "idle", manifest: null, error: null });
+  let generation = 0;
+  let client = null;
+  let pending = null;
+  async function connect(capabilities = []) {
+    const operation = ++generation;
+    const previous = pending || client;
+    client = null;
+    pending = null;
+    state.value = { phase: "connecting", manifest: null, error: null };
+    let attempt = null;
+    try {
+      attempt = createClient();
+      pending = attempt;
+      await previous?.disconnect();
+      if (operation !== generation) return;
+      const manifest = await attempt.manifest();
+      await attempt.connect(capabilities);
+      if (operation !== generation) {
+        await attempt.disconnect();
+        return;
+      }
+      client = attempt;
+      pending = null;
+      state.value = { phase: "connected", manifest, error: null };
+    } catch (error) {
+      if (operation !== generation) return;
+      try {
+        await attempt?.disconnect();
+      } catch {
+      }
+      if (operation !== generation) return;
+      pending = null;
+      client = null;
+      state.value = {
+        phase: error instanceof DOMException && error.name === "NotAllowedError" ? "denied" : "unavailable",
+        manifest: null,
+        error: error instanceof Error ? error.message : "\u63A5\u7D9A\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F"
+      };
+    }
+  }
+  async function view(capabilityId, viewId) {
+    if (!client || state.value.phase !== "connected") throw new Error("local runtime is not connected");
+    return client.view(capabilityId, viewId);
+  }
+  async function disconnect() {
+    ++generation;
+    const previous = pending || client;
+    pending = null;
+    client = null;
+    state.value = { phase: "idle", manifest: null, error: null };
+    await previous?.disconnect();
+  }
+  return { state: readonly(state), connected: computed(() => state.value.phase === "connected"), connect, view, disconnect };
+}

package/dist/runtime/client/client.d.ts

@@ -12,6 +12,7 @@ export declare class LocalRuntimeClient {
     private readonly fetcher;
     private readonly maximumResponseBytes;
     private readonly timeoutMilliseconds;
+    private operation;
     private grant;
     private runtimeManifest;
     constructor(options: LocalRuntimeClientOptions);
@@ -19,4 +20,5 @@ export declare class LocalRuntimeClient {
     connect(capabilities: string[]): Promise<SessionGrant>;
     view(capabilityId: string, viewId: string): Promise<ViewEnvelope>;
     disconnect(): Promise<void>;
+    private revoke;
 }

package/dist/runtime/client/client.js

@@ -12,6 +12,7 @@ export class LocalRuntimeClient {
   fetcher;
   maximumResponseBytes;
   timeoutMilliseconds;
+  operation = 0;
   grant = null;
   runtimeManifest = null;
   constructor(options) {
@@ -28,6 +29,7 @@ export class LocalRuntimeClient {
     }
   }
   async manifest() {
+    const operation = this.operation;
     const value = await localJson(
       this.fetcher,
       runtimeUrl(this.endpoint, "/v1/manifest"),
@@ -38,6 +40,7 @@ export class LocalRuntimeClient {
     if (!isLocalRuntimeManifest(value) || !value.security.allowed_origins.includes(this.origin)) {
       throw new Error("invalid runtime manifest");
     }
+    if (operation !== this.operation) throw new Error("local runtime operation was superseded");
     this.runtimeManifest = value;
     return value;
   }
@@ -52,6 +55,12 @@ export class LocalRuntimeClient {
     if (capabilities.some((capability) => !available.has(capability))) {
       throw new Error("requested capability is not declared");
     }
+    const runtimeManifest = this.runtimeManifest;
+    const operation = ++this.operation;
+    const previous = this.grant;
+    this.grant = null;
+    if (previous) await this.revoke(previous.token);
+    if (operation !== this.operation) throw new Error("local runtime operation was superseded");
     const request = {
       schema: "nuxtjp://local-runtime/session-request/v1",
       origin: this.origin,
@@ -69,10 +78,18 @@ export class LocalRuntimeClient {
     const expected = [...new Set(capabilities)].sort();
     const observed = isSessionGrant(value) ? [...value.granted_capabilities].sort() : [];
     const now = Math.floor(Date.now() / 1e3);
-    const limits = this.runtimeManifest.security.limits;
+    const limits = runtimeManifest.security.limits;
     if (!isSessionGrant(value) || value.audience !== this.origin || value.expires_at_unix_seconds <= now || value.expires_at_unix_seconds > now + limits.session_ttl_seconds + 5 || JSON.stringify(observed) !== JSON.stringify(expected) || value.budget.max_messages > limits.max_messages_per_minute || value.budget.max_bytes > limits.max_bytes_per_minute) {
       throw new Error("invalid runtime session grant");
     }
+    if (operation !== this.operation) {
+      try {
+        await this.revoke(value.token);
+      } catch {
+        throw new Error("superseded runtime session cleanup failed");
+      }
+      throw new Error("local runtime operation was superseded");
+    }
     this.grant = value;
     return value;
   }
@@ -83,6 +100,9 @@ export class LocalRuntimeClient {
     if (!this.grant.granted_capabilities.includes(capabilityId)) {
       throw new Error("capability was not granted");
     }
+    const operation = this.operation;
+    const grant = this.grant;
+    const runtimeManifest = this.runtimeManifest;
     const request = {
       schema: "nuxtjp://local-runtime/view-request/v1",
       capability_id: capabilityId,
@@ -92,20 +112,26 @@ export class LocalRuntimeClient {
     const value = await localJson(
       this.fetcher,
       runtimeUrl(this.endpoint, "/v1/view"),
-      localRequest("POST", { body: request, token: this.grant.token }),
+      localRequest("POST", { body: request, token: grant.token }),
       this.maximumResponseBytes,
       this.timeoutMilliseconds
     );
-    const capability = this.runtimeManifest.capabilities.find((item) => item.id === capabilityId);
+    if (operation !== this.operation || this.grant !== grant) {
+      throw new Error("local runtime operation was superseded");
+    }
+    const capability = runtimeManifest.capabilities.find((item) => item.id === capabilityId);
     if (!capability || !isViewEnvelope(value, capability.payload_schema) || value.capability_id !== capabilityId || value.view_id !== viewId) {
       throw new Error("invalid runtime view");
     }
     return value;
   }
   async disconnect() {
+    ++this.operation;
     const token = this.grant?.token;
     this.grant = null;
-    if (!token) return;
+    if (token) await this.revoke(token);
+  }
+  async revoke(token) {
     await localJson(
       this.fetcher,
       runtimeUrl(this.endpoint, "/v1/session"),

package/package.json

@@ -1,10 +1,9 @@
 {
   "name": "@nuxtjp/local-runtime",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Fail-closed Nuxt client for a loopback local runtime",
   "type": "module",
   "license": "Apache-2.0",
-  "packageManager": "pnpm@10.29.3",
   "engines": {
     "node": "^22.19.0 || ^24.11.0",
     "pnpm": ">=10 <11"
@@ -41,31 +40,23 @@
     },
     "./schema": "./schemas/local-runtime-v1.schema.json"
   },
-  "scripts": {
-    "build": "nuxt-module-build build && nuxt build playground",
-    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
-    "test": "vitest run && pnpm run test:dependency-security && pnpm run test:consumer-security",
-    "prepack": "pnpm run test && pnpm run typecheck && pnpm run build",
-    "test:dependency-security": "node --test scripts/dependency-security.check.cjs",
-    "test:consumer-security": "node --test scripts/consumer-security.check.mjs"
-  },
   "peerDependencies": {
     "nuxt": "^4.5.1",
     "vue": "^3.5.40"
   },
   "dependencies": {
-    "@nuxt/kit": "4.5.2",
-    "@nuxt/schema": "4.5.1"
+    "@nuxt/kit": "4.6.1",
+    "@nuxt/schema": "4.6.1"
   },
   "devDependencies": {
-    "@nuxt/module-builder": "1.0.2",
+    "@nuxt/module-builder": "1.0.3",
     "@types/node": "24.12.0",
     "ajv": "8.20.0",
-    "nuxt": "4.5.2",
+    "nuxt": "4.6.1",
     "typescript": "5.9.3",
-    "vitest": "4.1.11",
+    "vitest": "5.0.3",
     "vue": "3.5.43",
-    "vue-tsc": "3.2.8"
+    "vue-tsc": "3.3.13"
   },
   "repository": {
     "type": "git",
@@ -80,17 +71,11 @@
     "registry": "https://registry.npmjs.org",
     "provenance": true
   },
-  "pnpm": {
-    "overrides": {
-      "@nuxt/devtools>simple-git": "4.0.2",
-      "simple-git": "4.0.2",
-      "@simple-git/argv-parser": "2.0.1",
-      "esbuild": "0.28.2"
-    },
-    "patchedDependencies": {
-      "braces@3.0.3": "patches/braces@3.0.3.patch",
-      "node-forge@1.4.0": "patches/node-forge@1.4.0.patch",
-      "simple-git@4.0.2": "security/patches/simple-git@4.0.2.patch"
-    }
+  "scripts": {
+    "build": "nuxt-module-build build && nuxt build playground",
+    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
+    "test": "vitest run && pnpm run test:dependency-security && pnpm run test:consumer-security",
+    "test:dependency-security": "node --test scripts/dependency-security.check.cjs",
+    "test:consumer-security": "node --test scripts/consumer-security.check.mjs"
   }
-}
+}