@nuxtjp/local-runtime 0.1.4 → 0.1.6

package/README.ja.md

@@ -6,10 +6,10 @@
 
 ## 導入と使い方
 
-`0.1.1`はnpmで公開済みです。Node `^22.19.0`または`^24.11.0`、Nuxt `^4.5.1`、Vue `^3.5.40`を使用してください。
+公開版は `npm view @nuxtjp/local-runtime version` で確認してください。Nuxt `^4.6.2`、Vue `^3.5.40`、Node.js 22.19以降または24.11以降を使用します。
 
 ```sh
-npm install @nuxtjp/local-runtime@0.1.4
+npm install @nuxtjp/local-runtime
 ```
 
 ```ts
@@ -60,7 +60,7 @@ pnpm test
 pnpm build
 ```
 
-検証入力はNuxt/kit/schema `4.5.1`、Vue `3.5.43`、Vitest `4.1.11`に固定しています。互換性のある依存修正でadvisoryを減らしましたが、残るadvisoryと未検証環境はリリース前に評価してください。Nodeとhostの最低条件はNuxtに合わせて引き上げています。
+検証用の依存と固定版はpackage.json・pnpm-lock.yamlを正本とします。独立consumer CIで実配布物と共通セキュリティ処理を検証し、他の環境の受入れとは区別します。
 module/client API、loopback endpointの規則、明示接続の動作、ライセンス条件は維持しています。
 ローカルTGZの試験は配布物の動作確認であり、registryの配布確認とは別です。操作・配備・公開には、それぞれの権限と設定が必要です。
 
@@ -69,3 +69,6 @@ module/client API、loopback endpointの規則、明示接続の動作、ライ
 [使い方](https://github.com/nuxtjp/nuxt-local-runtime/blob/main/docs/getting-started.md) · [Schema](schemas) · [実装](https://github.com/nuxtjp/nuxt-local-runtime/tree/main/src) · [テスト](https://github.com/nuxtjp/nuxt-local-runtime/tree/main/test) · [貢献方法](https://github.com/nuxtjp/nuxt-local-runtime/blob/main/CONTRIBUTING.md) · [セキュリティ報告](https://github.com/nuxtjp/nuxt-local-runtime/blob/main/SECURITY.md)
 
 コードは[Apache-2.0](LICENSE)です。[NOTICE](NOTICE)と[以前の許諾](LICENSE-PREVIOUS)を保持してください。
+
+Dependency updates: [repository policy](docs/dependency-updates.md).
+Registry releases: [version tags and GitHub OIDC](docs/registry-release.md).

package/README.md

@@ -6,10 +6,10 @@ Connect a browser interface to one explicitly configured local Rust runtime, aft
 
 ## Install and use
 
-Install the package version `0.1.4` after it is available on npm. Use Node `^22.19.0` or `^24.11.0`, Nuxt `^4.5.1` and Vue `^3.5.40`.
+Install the published version identified by `npm view @nuxtjp/local-runtime version`. Use Nuxt `^4.6.2`, Vue `^3.5.40`, and Node.js 22.19+ or 24.11+.
 
 ```sh
-npm install @nuxtjp/local-runtime@0.1.4
+npm install @nuxtjp/local-runtime
 ```
 
 ```ts
@@ -60,7 +60,7 @@ pnpm test
 pnpm build
 ```
 
-The verification inputs pin Nuxt/kit/schema to `4.5.2`, Vue to `3.5.43` and Vitest to `4.1.11`. Compatible dependency fixes remove advisories; assess remaining advisories and untested environments before a release. Node and host compatibility floors were raised to match Nuxt.
+The exact verification dependencies are declared in package.json and pnpm-lock.yaml. Consumer CI exercises the reviewed archive and shared security tool; other environments require their own acceptance.
 The module/client API, loopback endpoint rules, explicit connection behavior and license terms are retained.
 A local TGZ test proves archive behavior, not registry availability. Operations, deployment and publication require their own permissions and settings.
 
@@ -73,3 +73,8 @@ Code: [Apache-2.0](LICENSE). Retain [NOTICE](NOTICE) and the prior grants in [LI
 ## Consumer dependency security
 
 See [dependency security backports](security/README.md) before installing this package in a Nuxt application. pnpm consumers must explicitly apply the included backports and verify their locked dependency tree; ordinary npm installation does not apply them.
+
+[OSS responsibility and source completion](docs/oss-source-contract.md) defines the supported package boundary and required acceptance. It does not declare unexecuted source, distribution or production checks complete.
+
+Dependency updates: [repository policy](docs/dependency-updates.md).
+Registry releases: [version tags and GitHub OIDC](docs/registry-release.md).

package/dist/module.json

@@ -4,9 +4,9 @@
   "compatibility": {
     "nuxt": "^4.5.1"
   },
-  "version": "0.1.4",
+  "version": "0.1.6",
   "builder": {
-    "@nuxt/module-builder": "1.0.2",
+    "@nuxt/module-builder": "1.0.3",
     "unbuild": "unknown"
   }
 }

package/dist/runtime/app/composables/useLocalRuntime.d.ts

@@ -1,4 +1,3 @@
-import type { ViewEnvelope } from '../../shared/types.js';
 export declare function useLocalRuntime(): {
     state: Readonly<import("vue").Ref<{
         readonly phase: import("../../client/index.js").ConnectionPhase;
@@ -87,6 +86,6 @@ export declare function useLocalRuntime(): {
     }>>;
     connected: import("vue").ComputedRef<boolean>;
     connect: (capabilities?: string[]) => Promise<void>;
-    view: (capabilityId: string, viewId: string) => Promise<ViewEnvelope>;
+    view: (capabilityId: string, viewId: string) => Promise<import("../../client/index.js").ViewEnvelope>;
     disconnect: () => Promise<void>;
 };

package/dist/runtime/app/composables/useLocalRuntime.js

@@ -1,51 +1,10 @@
-import { computed, readonly, ref } from "vue";
 import { useRuntimeConfig } from "#imports";
 import { LocalRuntimeClient } from "../../client/client.js";
+import { createLocalRuntimeConnection } from "../connection.js";
 export function useLocalRuntime() {
   const config = useRuntimeConfig();
-  const state = ref({
-    phase: "idle",
-    manifest: null,
-    error: null
-  });
-  let client = null;
-  async function connect(capabilities = []) {
-    state.value = { phase: "connecting", manifest: null, error: null };
-    try {
-      const endpoint = config.public.nuxtJpLocalRuntime.endpoint;
-      client = new LocalRuntimeClient({
-        endpoint,
-        origin: window.location.origin
-      });
-      const manifest = await client.manifest();
-      await client.connect(capabilities);
-      state.value = { phase: "connected", manifest, error: null };
-    } catch (error) {
-      client = null;
-      state.value = {
-        phase: error instanceof DOMException && error.name === "NotAllowedError" ? "denied" : "unavailable",
-        manifest: null,
-        error: error instanceof Error ? error.message : "\u63A5\u7D9A\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F"
-      };
-    }
-  }
-  async function view(capabilityId, viewId) {
-    if (!client) throw new Error("local runtime is not connected");
-    return client.view(capabilityId, viewId);
-  }
-  async function disconnect() {
-    try {
-      await client?.disconnect();
-    } finally {
-      client = null;
-      state.value = { phase: "idle", manifest: null, error: null };
-    }
-  }
-  return {
-    state: readonly(state),
-    connected: computed(() => state.value.phase === "connected"),
-    connect,
-    view,
-    disconnect
-  };
+  return createLocalRuntimeConnection(() => new LocalRuntimeClient({
+    endpoint: config.public.nuxtJpLocalRuntime.endpoint,
+    origin: window.location.origin
+  }));
 }

package/dist/runtime/app/connection.d.ts

@@ -0,0 +1,94 @@
+import type { LocalRuntimeClient } from '../client/client.js';
+import type { ViewEnvelope } from '../shared/types.js';
+/** Own each connection attempt separately; only the latest operation publishes state. */
+export declare function createLocalRuntimeConnection(createClient: () => LocalRuntimeClient): {
+    state: Readonly<import("vue").Ref<{
+        readonly phase: import("../client/index.js").ConnectionPhase;
+        readonly manifest: {
+            readonly schema: "nuxtjp://local-runtime/manifest/v1";
+            readonly runtime_id: string;
+            readonly protocol_version: "1";
+            readonly mode: "local-simulation" | "local-production";
+            readonly external_actions: false;
+            readonly engine: {
+                readonly kind: "rust-v8";
+                readonly status: "disabled" | "simulated" | "ready";
+                readonly isolation: "in-process-simulation" | "process";
+                readonly arbitrary_network: false;
+                readonly arbitrary_filesystem: false;
+            };
+            readonly security: {
+                readonly default_band: "sealed";
+                readonly external_egress: "deny";
+                readonly allowed_origins: readonly string[];
+                readonly limits: {
+                    readonly max_request_bytes: number;
+                    readonly max_response_bytes: number;
+                    readonly max_messages_per_minute: number;
+                    readonly max_bytes_per_minute: number;
+                    readonly session_ttl_seconds: number;
+                };
+            };
+            readonly capabilities: readonly {
+                readonly id: string;
+                readonly service_id: string;
+                readonly description: string;
+                readonly output_band: "session" | "public";
+                readonly payload_schema: {
+                    readonly id: string;
+                    readonly fields: readonly {
+                        readonly name: string;
+                        readonly kind: import("../client/index.js").PayloadValueKind;
+                    }[];
+                };
+            }[];
+        } | null;
+        readonly error: string | null;
+    }, {
+        readonly phase: import("../client/index.js").ConnectionPhase;
+        readonly manifest: {
+            readonly schema: "nuxtjp://local-runtime/manifest/v1";
+            readonly runtime_id: string;
+            readonly protocol_version: "1";
+            readonly mode: "local-simulation" | "local-production";
+            readonly external_actions: false;
+            readonly engine: {
+                readonly kind: "rust-v8";
+                readonly status: "disabled" | "simulated" | "ready";
+                readonly isolation: "in-process-simulation" | "process";
+                readonly arbitrary_network: false;
+                readonly arbitrary_filesystem: false;
+            };
+            readonly security: {
+                readonly default_band: "sealed";
+                readonly external_egress: "deny";
+                readonly allowed_origins: readonly string[];
+                readonly limits: {
+                    readonly max_request_bytes: number;
+                    readonly max_response_bytes: number;
+                    readonly max_messages_per_minute: number;
+                    readonly max_bytes_per_minute: number;
+                    readonly session_ttl_seconds: number;
+                };
+            };
+            readonly capabilities: readonly {
+                readonly id: string;
+                readonly service_id: string;
+                readonly description: string;
+                readonly output_band: "session" | "public";
+                readonly payload_schema: {
+                    readonly id: string;
+                    readonly fields: readonly {
+                        readonly name: string;
+                        readonly kind: import("../client/index.js").PayloadValueKind;
+                    }[];
+                };
+            }[];
+        } | null;
+        readonly error: string | null;
+    }>>;
+    connected: import("vue").ComputedRef<boolean>;
+    connect: (capabilities?: string[]) => Promise<void>;
+    view: (capabilityId: string, viewId: string) => Promise<ViewEnvelope>;
+    disconnect: () => Promise<void>;
+};

package/dist/runtime/app/connection.js

@@ -0,0 +1,57 @@
+import { computed, readonly, ref } from "vue";
+export function createLocalRuntimeConnection(createClient) {
+  const state = ref({ phase: "idle", manifest: null, error: null });
+  let generation = 0;
+  let client = null;
+  let pending = null;
+  async function connect(capabilities = []) {
+    const operation = ++generation;
+    const previous = pending || client;
+    client = null;
+    pending = null;
+    state.value = { phase: "connecting", manifest: null, error: null };
+    let attempt = null;
+    try {
+      attempt = createClient();
+      pending = attempt;
+      await previous?.disconnect();
+      if (operation !== generation) return;
+      const manifest = await attempt.manifest();
+      await attempt.connect(capabilities);
+      if (operation !== generation) {
+        await attempt.disconnect();
+        return;
+      }
+      client = attempt;
+      pending = null;
+      state.value = { phase: "connected", manifest, error: null };
+    } catch (error) {
+      if (operation !== generation) return;
+      try {
+        await attempt?.disconnect();
+      } catch {
+      }
+      if (operation !== generation) return;
+      pending = null;
+      client = null;
+      state.value = {
+        phase: error instanceof DOMException && error.name === "NotAllowedError" ? "denied" : "unavailable",
+        manifest: null,
+        error: error instanceof Error ? error.message : "\u63A5\u7D9A\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F"
+      };
+    }
+  }
+  async function view(capabilityId, viewId) {
+    if (!client || state.value.phase !== "connected") throw new Error("local runtime is not connected");
+    return client.view(capabilityId, viewId);
+  }
+  async function disconnect() {
+    ++generation;
+    const previous = pending || client;
+    pending = null;
+    client = null;
+    state.value = { phase: "idle", manifest: null, error: null };
+    await previous?.disconnect();
+  }
+  return { state: readonly(state), connected: computed(() => state.value.phase === "connected"), connect, view, disconnect };
+}

package/dist/runtime/client/client.d.ts

@@ -12,6 +12,7 @@ export declare class LocalRuntimeClient {
     private readonly fetcher;
     private readonly maximumResponseBytes;
     private readonly timeoutMilliseconds;
+    private operation;
     private grant;
     private runtimeManifest;
     constructor(options: LocalRuntimeClientOptions);
@@ -19,4 +20,5 @@ export declare class LocalRuntimeClient {
     connect(capabilities: string[]): Promise<SessionGrant>;
     view(capabilityId: string, viewId: string): Promise<ViewEnvelope>;
     disconnect(): Promise<void>;
+    private revoke;
 }

package/dist/runtime/client/client.js

@@ -12,6 +12,7 @@ export class LocalRuntimeClient {
   fetcher;
   maximumResponseBytes;
   timeoutMilliseconds;
+  operation = 0;
   grant = null;
   runtimeManifest = null;
   constructor(options) {
@@ -28,6 +29,7 @@ export class LocalRuntimeClient {
     }
   }
   async manifest() {
+    const operation = this.operation;
     const value = await localJson(
       this.fetcher,
       runtimeUrl(this.endpoint, "/v1/manifest"),
@@ -38,6 +40,7 @@ export class LocalRuntimeClient {
     if (!isLocalRuntimeManifest(value) || !value.security.allowed_origins.includes(this.origin)) {
       throw new Error("invalid runtime manifest");
     }
+    if (operation !== this.operation) throw new Error("local runtime operation was superseded");
     this.runtimeManifest = value;
     return value;
   }
@@ -52,6 +55,12 @@ export class LocalRuntimeClient {
     if (capabilities.some((capability) => !available.has(capability))) {
       throw new Error("requested capability is not declared");
     }
+    const runtimeManifest = this.runtimeManifest;
+    const operation = ++this.operation;
+    const previous = this.grant;
+    this.grant = null;
+    if (previous) await this.revoke(previous.token);
+    if (operation !== this.operation) throw new Error("local runtime operation was superseded");
     const request = {
       schema: "nuxtjp://local-runtime/session-request/v1",
       origin: this.origin,
@@ -69,10 +78,18 @@ export class LocalRuntimeClient {
     const expected = [...new Set(capabilities)].sort();
     const observed = isSessionGrant(value) ? [...value.granted_capabilities].sort() : [];
     const now = Math.floor(Date.now() / 1e3);
-    const limits = this.runtimeManifest.security.limits;
+    const limits = runtimeManifest.security.limits;
     if (!isSessionGrant(value) || value.audience !== this.origin || value.expires_at_unix_seconds <= now || value.expires_at_unix_seconds > now + limits.session_ttl_seconds + 5 || JSON.stringify(observed) !== JSON.stringify(expected) || value.budget.max_messages > limits.max_messages_per_minute || value.budget.max_bytes > limits.max_bytes_per_minute) {
       throw new Error("invalid runtime session grant");
     }
+    if (operation !== this.operation) {
+      try {
+        await this.revoke(value.token);
+      } catch {
+        throw new Error("superseded runtime session cleanup failed");
+      }
+      throw new Error("local runtime operation was superseded");
+    }
     this.grant = value;
     return value;
   }
@@ -83,6 +100,9 @@ export class LocalRuntimeClient {
     if (!this.grant.granted_capabilities.includes(capabilityId)) {
       throw new Error("capability was not granted");
     }
+    const operation = this.operation;
+    const grant = this.grant;
+    const runtimeManifest = this.runtimeManifest;
     const request = {
       schema: "nuxtjp://local-runtime/view-request/v1",
       capability_id: capabilityId,
@@ -92,20 +112,26 @@ export class LocalRuntimeClient {
     const value = await localJson(
       this.fetcher,
       runtimeUrl(this.endpoint, "/v1/view"),
-      localRequest("POST", { body: request, token: this.grant.token }),
+      localRequest("POST", { body: request, token: grant.token }),
       this.maximumResponseBytes,
       this.timeoutMilliseconds
     );
-    const capability = this.runtimeManifest.capabilities.find((item) => item.id === capabilityId);
+    if (operation !== this.operation || this.grant !== grant) {
+      throw new Error("local runtime operation was superseded");
+    }
+    const capability = runtimeManifest.capabilities.find((item) => item.id === capabilityId);
     if (!capability || !isViewEnvelope(value, capability.payload_schema) || value.capability_id !== capabilityId || value.view_id !== viewId) {
       throw new Error("invalid runtime view");
     }
     return value;
   }
   async disconnect() {
+    ++this.operation;
     const token = this.grant?.token;
     this.grant = null;
-    if (!token) return;
+    if (token) await this.revoke(token);
+  }
+  async revoke(token) {
     await localJson(
       this.fetcher,
       runtimeUrl(this.endpoint, "/v1/session"),

package/package.json

@@ -1,10 +1,9 @@
 {
   "name": "@nuxtjp/local-runtime",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Fail-closed Nuxt client for a loopback local runtime",
   "type": "module",
   "license": "Apache-2.0",
-  "packageManager": "pnpm@10.29.3",
   "engines": {
     "node": "^22.19.0 || ^24.11.0",
     "pnpm": ">=10 <11"
@@ -41,31 +40,24 @@
     },
     "./schema": "./schemas/local-runtime-v1.schema.json"
   },
-  "scripts": {
-    "build": "nuxt-module-build build && nuxt build playground",
-    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
-    "test": "vitest run && pnpm run test:dependency-security && pnpm run test:consumer-security",
-    "prepack": "pnpm run test && pnpm run typecheck && pnpm run build",
-    "test:dependency-security": "node --test scripts/dependency-security.check.cjs",
-    "test:consumer-security": "node --test scripts/consumer-security.check.mjs"
-  },
   "peerDependencies": {
-    "nuxt": "^4.5.1",
+    "nuxt": "^4.6.2",
     "vue": "^3.5.40"
   },
   "dependencies": {
-    "@nuxt/kit": "4.5.2",
-    "@nuxt/schema": "4.5.1"
+    "@nuxt/kit": "4.6.2",
+    "@nuxt/schema": "4.6.2",
+    "@nuxtjp/dependency-security": "0.1.2"
   },
   "devDependencies": {
-    "@nuxt/module-builder": "1.0.2",
+    "@nuxt/module-builder": "1.0.3",
     "@types/node": "24.12.0",
     "ajv": "8.20.0",
-    "nuxt": "4.5.2",
+    "nuxt": "4.6.2",
     "typescript": "5.9.3",
-    "vitest": "4.1.11",
-    "vue": "3.5.43",
-    "vue-tsc": "3.2.8"
+    "vitest": "5.0.5",
+    "vue": "3.5.44",
+    "vue-tsc": "3.3.13"
   },
   "repository": {
     "type": "git",
@@ -80,17 +72,19 @@
     "registry": "https://registry.npmjs.org",
     "provenance": true
   },
-  "pnpm": {
-    "overrides": {
-      "@nuxt/devtools>simple-git": "4.0.2",
-      "simple-git": "4.0.2",
-      "@simple-git/argv-parser": "2.0.1",
-      "esbuild": "0.28.2"
-    },
-    "patchedDependencies": {
-      "braces@3.0.3": "patches/braces@3.0.3.patch",
-      "node-forge@1.4.0": "patches/node-forge@1.4.0.patch",
-      "simple-git@4.0.2": "security/patches/simple-git@4.0.2.patch"
-    }
+  "keywords": [
+    "nuxt",
+    "rust",
+    "local-first",
+    "ipc",
+    "developer-tools"
+  ],
+  "scripts": {
+    "build": "pnpm run build:security && nuxt-module-build build && nuxt build playground",
+    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
+    "test": "vitest run && pnpm run test:dependency-security && pnpm run test:consumer-security",
+    "test:dependency-security": "node security/dependency-security.check.cjs",
+    "test:consumer-security": "node --test scripts/consumer-security.check.mts",
+    "build:security": "tsc -p tsconfig.security.json"
   }
-}
+}

package/security/README.md

@@ -1,23 +1,13 @@
-# Dependency security backports
+# Dependency security maintenance
 
-Two upstream dependencies have no fixed release: braces 3.0.3 (GHSA-vfj7-8cjw-p6xm) and node-forge 1.4.0 (GHSA-86w9-cpqp-85rv). The root configuration also requires simple-git 4.0.2, @simple-git/argv-parser 2.0.1 and esbuild 0.28.2 from the public registry to address their upstream advisories. Exact versions are maintained in `dependency-versions.json`. The included patches bound brace AST recursion and reject malformed RSA DigestAlgorithm parameters. Regression tests cover ordinary behavior and the malicious input shapes.
-
-The package is distributed through npm. A consumer must use pnpm 10 and explicitly configure the reviewed backports at its project root. Dependency packages cannot impose root-level npm overrides or pnpm patches on a consuming application. Installing this module alone does not apply the patches.
+`@nuxtjp/dependency-security` owns the reviewed policy, patches, installed dependency resolver and regression checks. This module depends on that peer-free package; its `security/apply.mjs` and `security/dependency-security.check.cjs` paths are generated compatibility entry points and contain no independent policy.
 
 ```sh
-node node_modules/@nuxtjp/local-runtime/security/apply.mjs --project-root . --apply
+pnpm exec nuxtjp-security-config --project-root . --apply
 pnpm install --no-frozen-lockfile
 pnpm install --frozen-lockfile
+pnpm exec nuxtjp-security-check --project-root .
+pnpm audit --json
 ```
 
-Commit the generated `.nuxtjp-security/*.patch`, `package.json`, and lockfile in your application. The command does not run installs, access the network, or replace an existing conflicting patch. It preserves unrelated pnpm settings. Each root application must apply the patches, including CI checkouts.
-
-Run `node node_modules/@nuxtjp/local-runtime/security/dependency-security.check.cjs` after installing the locked project to verify that the actual resolved dependencies reject the affected inputs. These are backports, not upstream fixed versions. Version-only advisory tools still report the two vulnerable upstream versions; retain their findings and link the lockfile/patch hashes and regression results. Reapply and reverify when dependency versions change. npm-only consumers require a separately reviewed override distribution; they are not certified by this pnpm procedure.
-
-The RSA test creates an ephemeral key in memory and never reads a user key. Patches contain code only and do not include credentials, customer content, or private endpoints.
-
-Run `pnpm audit --json` on the installed application and retain the report. Only the two backported braces/node-forge advisories may remain; any other advisory, including simple-git, its argument parser, or esbuild, blocks validation. Run the dependency regression command on each install to reject missing or older active versions.
-
-The code patch inputs retain third-party notices in `LICENSE-braces` (MIT) and `LICENSE-node-forge`. The original dependencies remain registry packages; the shipped files configure and test the consumer rather than silently replacing its package manager.
-
-The simple-git 4.0.2 compatibility patch restores only the legacy ESM default factory used by Nuxt devtools. It aliases the existing, fixed `simpleGit` factory and does not change argument validation, executable selection, or Git execution. The named factory remains identical. `LICENSE-simple-git` retains its upstream MIT notice. A fresh consumer build and type check with devtools enabled are mandatory release checks.
+Installation does not apply patches. Select the application explicitly and commit its generated patches, manifest and lockfile. Configuration rejects conflicts; only the shared policy's tested backport advisories may remain visible. An application build and type check with devtools enabled are required separately. Existing LICENSE-braces, LICENSE-node-forge and LICENSE-simple-git attribution is retained. Root `patches/` files are this repository's own build inputs, not another distributed security implementation.

package/security/apply.mjs

@@ -1,19 +1,18 @@
 #!/usr/bin/env node
-/** Apply reviewed Nuxt dependency backports to an explicitly selected pnpm project. */
-import { fileURLToPath } from 'node:url'
-import { dirname } from 'node:path'
-import { applySecurityPatches } from './project.mjs'
-
-const args = process.argv.slice(2)
+// Compatibility CLI: the shared tool owns policy, patches and validation.
+import { applySecurityPatches } from '@nuxtjp/dependency-security';
+const args = process.argv.slice(2);
 if (args.length !== 3 || args[0] !== '--project-root' || args[2] !== '--apply') {
-  console.error('Usage: node apply.mjs --project-root PROJECT --apply')
-  process.exitCode = 2
-} else {
-  try {
-    applySecurityPatches(args[1], dirname(fileURLToPath(import.meta.url)))
-    console.log('Reviewed backports configured. Run pnpm install --no-frozen-lockfile to refresh the lockfile.')
-  } catch (error) {
-    console.error(error.message)
-    process.exitCode = 1
-  }
+    console.error('Usage: node apply.mjs --project-root PROJECT --apply');
+    process.exitCode = 2;
+}
+else {
+    try {
+        applySecurityPatches(args[1]);
+        console.log('Reviewed backports configured. Run pnpm install --no-frozen-lockfile to refresh the lockfile.');
+    }
+    catch {
+        console.error('Selected project configuration could not be applied; review manifest and patch conflicts.');
+        process.exitCode = 1;
+    }
 }

package/security/dependency-security.check.cjs

@@ -1,70 +1,9 @@
-const assert = require('node:assert/strict');
-const { test } = require('node:test');
-const { createRequire } = require('node:module');
-const { generateKeyPairSync, sign, privateEncrypt, constants } = require('node:crypto');
-const path = require('node:path');
-const fs = require('node:fs');
-function dependency(name, version) {
-  const { installedDependencies } = require('./resolved-dependency.cjs');
-  const matches = installedDependencies(process.cwd(), name, version);
-  assert.equal(matches.length, 1, 'Expected one active locked dependency implementation');
-  return createRequire(matches[0])(name);
-}
-const braces = dependency('braces', '3.0.3');
-const forge = dependency('node-forge', '1.4.0');
-test('brace compilation, expansion and stringification retain ordinary behavior', () => {
-  assert.equal(braces.compile('src/{a,b}.vue'), 'src/(a|b).vue');
-  assert.deepEqual(braces.expand('src/{a,b}.vue'), ['src/a.vue', 'src/b.vue']);
-  assert.equal(braces.stringify(braces.parse('src/{a,b}.vue')), 'src/{a,b}.vue');
-  assert.equal(braces.compile('src/\\{a,b\\}.vue'), 'src/{a,b}.vue');
-});
-test('deep brace, parenthesis and caller AST inputs reject before stack exhaustion', () => {
-  for (const pattern of ['{'.repeat(6000) + 'a,b' + '}'.repeat(6000), '('.repeat(6000) + 'x' + ')'.repeat(6000), '{'.repeat(6000) + 'x']) {
-    for (const fn of [braces.compile, braces.expand, braces.stringify, braces.parse]) assert.throws(() => fn(pattern), SyntaxError);
-  }
-  let ast = { type: 'text', value: 'x' };
-  for (let i = 0; i < 6000; i++) ast = { type: 'root', nodes: [ast] };
-  for (const fn of [braces.compile, braces.expand, braces.stringify]) assert.throws(() => fn(ast), SyntaxError);
-  const cyclic = { type: 'root', nodes: [] }; cyclic.nodes.push(cyclic);
-  assert.throws(() => braces.compile(cyclic), SyntaxError);
-});
-test('RSA verifier accepts standard signatures and rejects extra or malformed DigestAlgorithm elements', () => {
-  const keys = generateKeyPairSync('rsa', { modulusLength: 2048 });
-  const publicKey = forge.pki.publicKeyFromPem(keys.publicKey.export({ type: 'spki', format: 'pem' }));
-  const data = Buffer.from('never-issued security regression fixture');
-  const md = forge.md.sha256.create(); md.update(data.toString('binary'));
-  const digest = md.digest().getBytes();
-  assert.equal(publicKey.verify(digest, sign('sha256', data, keys.privateKey).toString('binary')), true);
-  const a = forge.asn1;
-  const oid = () => a.create(a.Class.UNIVERSAL, a.Type.OID, false, a.oidToDer(forge.oids.sha256).getBytes());
-  const nil = value => a.create(a.Class.UNIVERSAL, a.Type.NULL, false, value);
-  for (const parameters of [[oid(), nil(''), oid()], [oid(), a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, [oid()])], [oid(), nil('x')]]) {
-    const info = a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, [a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, parameters), a.create(a.Class.UNIVERSAL, a.Type.OCTETSTRING, false, digest)]);
-    const encoded = Buffer.from(a.toDer(info).getBytes(), 'binary');
-    const signature = privateEncrypt({ key: keys.privateKey, padding: constants.RSA_PKCS1_PADDING }, encoded).toString('binary');
-    let accepted = false;
-    try { accepted = publicKey.verify(digest, signature); } catch { /* Rejection is the expected result for a malformed signature. */ }
-    assert.equal(accepted, false, 'Malformed algorithm must not verify');
-  }
-});
-
-test('active dependency graph uses every required upstream security version', () => {
-  const policy = JSON.parse(fs.readFileSync(path.join(__dirname, 'dependency-versions.json'), 'utf8'));
-  const { installedDependencies } = require('./resolved-dependency.cjs');
-  for (const [name, version] of Object.entries(policy.overrides)) {
-    const matches = installedDependencies(process.cwd(), name);
-    assert.ok(matches.length > 0, 'Required dependency is absent: ' + name);
-    for (const manifest of matches) assert.equal(JSON.parse(fs.readFileSync(manifest, 'utf8')).version, version, name);
-  }
-});
-
-// Preserve the ESM entry point expected by current Nuxt devtools without downgrading Git protections.
-test('fixed simple-git retains named and legacy ESM factory exports', async () => {
-  const { pathToFileURL } = require('node:url');
-  const { installedDependencies } = require('./resolved-dependency.cjs');
-  for (const manifest of installedDependencies(process.cwd(), 'simple-git', '4.0.2')) {
-    const module = await import(pathToFileURL(path.join(path.dirname(manifest), 'dist/index.mjs')).href);
-    assert.equal(typeof module.simpleGit, 'function');
-    assert.equal(module.default, module.simpleGit);
-  }
-});
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+// Compatibility entry point; regressions execute only after explicit invocation.
+void import('@nuxtjp/dependency-security').then(({ verifyProject }) => {
+    const result = verifyProject(process.cwd());
+    process.stdout.write(result.stdout);
+    process.stderr.write(result.stderr);
+    process.exitCode = result.exitCode;
+}).catch(() => { console.error('Selected dependency graph cannot be verified'); process.exitCode = 2; });

package/security/project.mjs

@@ -1,76 +1,2 @@
-/** Configure caller-owned pnpm backports without executing installs or changing unrelated settings. */
-import { existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSync, unlinkSync, realpathSync } from 'node:fs'
-import { join, resolve } from 'node:path'
-import { randomUUID } from 'node:crypto'
-
-const patches = ['braces@3.0.3', 'node-forge@1.4.0', 'simple-git@4.0.2']
-function regular(path) {
-  const stat = lstatSync(path)
-  if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 1024 * 1024) {
-    throw new Error('Expected a bounded regular project or patch file')
-  }
-  return readFileSync(path)
-}
-function object(value) {
-  return value !== null && typeof value === 'object' && !Array.isArray(value)
-}
-
-/** Reject conflicting patches and links before mutating a project. No network access occurs. */
-export function applySecurityPatches(project, source) {
-  const root = realpathSync(resolve(project))
-  const manifest = join(root, 'package.json')
-  const original = regular(manifest)
-  const data = JSON.parse(original)
-  if (!object(data) || (data.pnpm !== undefined && !object(data.pnpm))) {
-    throw new Error('Expected a package manifest with object-valued pnpm settings')
-  }
-  const pnpm = data.pnpm ?? {}
-  const existing = pnpm.patchedDependencies ?? {}
-  if (!object(existing)) throw new Error('Expected object-valued patchedDependencies')
-  const pinned = JSON.parse(regular(join(source, 'dependency-versions.json')))
-  if (pinned.schemaVersion !== 1 || !object(pinned.overrides)) throw new Error('Invalid dependency version policy')
-  const overrides = pnpm.overrides ?? {}
-  if (!object(overrides)) throw new Error('Expected object-valued dependency overrides')
-  for (const [name, version] of Object.entries(pinned.overrides)) {
-    if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(name) || !/^\d+\.\d+\.\d+$/.test(version)) {
-      throw new Error('Exact registry package versions required')
-    }
-    for (const [selector, target] of Object.entries(overrides)) {
-      const dependency = selector.split('>').at(-1)
-      if ((dependency === name || dependency.startsWith(name + '@')) && target !== version) {
-        throw new Error('A dependency override conflicts; review it before applying')
-      }
-    }
-  }
-  const dir = join(root, '.nuxtjp-security')
-  if (existsSync(dir) && (lstatSync(dir).isSymbolicLink() || !lstatSync(dir).isDirectory())) {
-    throw new Error('Security patch directory must be a real directory')
-  }
-  const inputs = patches.map(name => {
-    const relative = `.nuxtjp-security/${name}.patch`
-    if (existing[name] !== undefined && existing[name] !== relative) {
-      throw new Error('An existing dependency patch conflicts; review it before applying')
-    }
-    const bytes = regular(join(source, 'patches', `${name}.patch`))
-    const target = join(root, relative)
-    if (existsSync(target) && !regular(target).equals(bytes)) {
-      throw new Error('An existing patch differs; no files were overwritten')
-    }
-    return { name, relative, bytes, target }
-  })
-  if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed during preparation')
-  mkdirSync(dir, { recursive: true })
-  for (const patch of inputs) {
-    if (!existsSync(patch.target)) writeFileSync(patch.target, patch.bytes, { flag: 'wx' })
-    existing[patch.name] = patch.relative
-  }
-  data.pnpm = { ...pnpm, patchedDependencies: existing, overrides: { ...overrides, ...pinned.overrides } }
-  const temporary = join(root, `.nuxtjp-manifest-${randomUUID()}.tmp`)
-  try {
-    writeFileSync(temporary, JSON.stringify(data, null, 2) + '\n', { flag: 'wx' })
-    if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed; retry after review')
-    renameSync(temporary, manifest)
-  } finally {
-    if (existsSync(temporary)) unlinkSync(temporary)
-  }
-}
+// Generated compatibility outputs delegate to the single versioned security owner.
+export { applySecurityPatches } from "@nuxtjp/dependency-security";

package/security/resolved-dependency.cjs

@@ -1,40 +1,4 @@
-/** Resolve a dependency through the installed application graph, ignoring unused store entries. */
-const fs = require('node:fs');
-const path = require('node:path');
-const { createRequire } = require('node:module');
-
-function installedDependencies(root, target, version) {
-  root = fs.realpathSync(root);
-  const pending = [path.join(root, 'package.json')];
-  const seen = new Set();
-  const found = new Set();
-  while (pending.length) {
-    if (seen.size > 5000) throw new Error('Installed dependency graph exceeds verification budget');
-    const file = pending.pop();
-    if (seen.has(file)) continue;
-    seen.add(file);
-    const data = JSON.parse(fs.readFileSync(file, 'utf8'));
-    if (data.name === target) {
-      if (version !== undefined && data.version !== version) throw new Error('Dependency version changed; review its security patch');
-      found.add(file);
-    }
-    const request = createRequire(file);
-    const names = Object.keys({ ...data.dependencies, ...data.optionalDependencies, ...data.peerDependencies,
-      ...(file === path.join(root, 'package.json') ? data.devDependencies : {}) });
-    for (const name of names) {
-      for (const location of request.resolve.paths(name) ?? []) {
-        const candidate = path.join(location, name, 'package.json');
-        if (!fs.existsSync(candidate)) continue;
-        const real = fs.realpathSync(candidate);
-        if (!real.startsWith(path.join(root, 'node_modules') + path.sep)) {
-          throw new Error('Dependency resolves outside the selected project; select the workspace root');
-        }
-        pending.push(real);
-        break;
-      }
-    }
-  }
-  if (found.size === 0) throw new Error('Dependency not present in the installed application graph');
-  return [...found].sort();
-}
-module.exports = { installedDependencies };
+"use strict";
+// The shared maintenance tool owns active dependency resolution.
+const resolver = require("@nuxtjp/dependency-security/installed-dependencies");
+module.exports = resolver;

package/security/dependency-versions.json

@@ -1,12 +0,0 @@
-{
-  "schemaVersion": 1,
-  "overrides": {
-    "simple-git": "4.0.2",
-    "@simple-git/argv-parser": "2.0.1",
-    "esbuild": "0.28.2"
-  },
-  "backportedAdvisories": [
-    "GHSA-vfj7-8cjw-p6xm",
-    "GHSA-86w9-cpqp-85rv"
-  ]
-}

package/security/patches/braces@3.0.3.patch

@@ -1,92 +0,0 @@
-diff --git a/lib/depth-guard.js b/lib/depth-guard.js
-new file mode 100644
---- /dev/null
-+++ b/lib/depth-guard.js
-@@ -0,0 +1,19 @@
-+'use strict';
-+
-+// Wonderland security backport: bound recursive walkers, including caller ASTs.
-+module.exports = ast => {
-+  const pending = [[ast, 0]];
-+  const seen = new Set();
-+  let count = 0;
-+  while (pending.length) {
-+    const [node, depth] = pending.pop();
-+    if (depth > 64 || ++count > 100000 || seen.has(node)) {
-+      throw new SyntaxError('Brace pattern exceeds safe AST bounds');
-+    }
-+    if (!node || typeof node !== 'object') continue;
-+    seen.add(node);
-+    if (Array.isArray(node.nodes)) {
-+      for (const child of node.nodes) pending.push([child, depth + 1]);
-+    }
-+  }
-+};
-diff --git a/lib/parse.js b/lib/parse.js
---- a/lib/parse.js
-+++ b/lib/parse.js
-@@ -144,6 +144,7 @@
- 
-     if (value === CHAR_LEFT_PARENTHESES) {
-       block = push({ type: 'paren', nodes: [] });
-+      if (stack.length >= 64) throw new SyntaxError('Brace pattern exceeds safe nesting depth');
-       stack.push(block);
-       push({ type: 'text', value });
-       continue;
-@@ -210,6 +211,7 @@
-       };
- 
-       block = push(brace);
-+      if (stack.length >= 64) throw new SyntaxError('Brace pattern exceeds safe nesting depth');
-       stack.push(block);
-       push({ type: 'open', value });
-       continue;
-diff --git a/lib/compile.js b/lib/compile.js
---- a/lib/compile.js
-+++ b/lib/compile.js
-@@ -1,9 +1,12 @@
- 'use strict';
-+
-+const assertDepth = require('./depth-guard');
- 
- const fill = require('fill-range');
- const utils = require('./utils');
- 
- const compile = (ast, options = {}) => {
-+  assertDepth(ast);
-   const walk = (node, parent = {}) => {
-     const invalidBlock = utils.isInvalidBrace(parent);
-     const invalidNode = node.invalid === true && options.escapeInvalid === true;
-diff --git a/lib/expand.js b/lib/expand.js
---- a/lib/expand.js
-+++ b/lib/expand.js
-@@ -1,4 +1,6 @@
- 'use strict';
-+
-+const assertDepth = require('./depth-guard');
- 
- const fill = require('fill-range');
- const stringify = require('./stringify');
-@@ -31,6 +33,7 @@
- };
- 
- const expand = (ast, options = {}) => {
-+  assertDepth(ast);
-   const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit;
- 
-   const walk = (node, parent = {}) => {
-diff --git a/lib/stringify.js b/lib/stringify.js
---- a/lib/stringify.js
-+++ b/lib/stringify.js
-@@ -1,8 +1,11 @@
- 'use strict';
-+
-+const assertDepth = require('./depth-guard');
- 
- const utils = require('./utils');
- 
- module.exports = (ast, options = {}) => {
-+  assertDepth(ast);
-   const stringify = (node, parent = {}) => {
-     const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
-     const invalidNode = node.invalid === true && options.escapeInvalid === true;

package/security/patches/node-forge@1.4.0.patch

@@ -1,20 +0,0 @@
-diff --git a/lib/rsa.js b/lib/rsa.js
---- a/lib/rsa.js
-+++ b/lib/rsa.js
-@@ -1172,7 +1172,15 @@
-           var capture = {};
-           var errors = [];
-           if(!asn1.validate(obj, digestInfoValidator, capture, errors) ||
--            obj.value.length !== 2) {
-+            obj.value.length !== 2 ||
-+            // Wonderland security backport: AlgorithmIdentifier has one OID
-+            // and, optionally, exactly one empty primitive NULL parameter.
-+            obj.value[0].value.length < 1 || obj.value[0].value.length > 2 ||
-+            (obj.value[0].value.length === 2 &&
-+              (obj.value[0].value[1].tagClass !== asn1.Class.UNIVERSAL ||
-+               obj.value[0].value[1].type !== asn1.Type.NULL ||
-+               obj.value[0].value[1].constructed !== false ||
-+               obj.value[0].value[1].value !== ''))) {
-             var error = new Error(
-               'ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 ' +
-               'DigestInfo value.');

package/security/patches/simple-git@4.0.2.patch

@@ -1,11 +0,0 @@
---- a/dist/index.mjs
-+++ b/dist/index.mjs
-@@ -2890,6 +2890,7 @@
-   xe as TaskConfigurationError,
-   Sn as grepQueryBuilder,
-   ko as pathspec,
--  wo as simpleGit
-+  wo as simpleGit,
-+  wo as default
- };
- //# sourceMappingURL=index.mjs.map