@nuxtjp/localized-site 0.1.0 → 0.1.2

package/README.ja.md

@@ -0,0 +1,66 @@
+# @nuxtjp/localized-site
+
+[English](README.md)
+
+日本語・英語の紹介サイトを、1つの検証済み設定から構成します。`/`、`/docs`、`/docs/getting-started`、`/docs/security`と各英語ページを生成し、言語切替とSEOを適用します。
+
+## 導入と設定
+
+`0.1.0`はnpmで公開済みです。Node.js 22.19以降または24.11以降、Nuxt 4.5.1以降の4系、Vue `^3.5.40`を使用してください。
+
+```sh
+pnpm add --save-exact @nuxtjp/localized-site@0.1.0 nuxt@4.5.1 vue@3.5.43
+```
+
+```ts
+export default defineNuxtConfig({
+  modules: [['@nuxtjp/localized-site', { contentRoot: '.' }]]
+})
+```
+
+`contentRoot`を明示します。[汎用設定サンプル](examples/content/site.config.json)を、そのディレクトリに`site.config.json`として置き、サイト固有の内容に置き換えてください。
+`siteId`、`serviceId`、`origin`、`audienceScope`、完全なja/enコンテンツ、ちょうど3つのfeatures、導入・セキュリティ文書、privacy/contact説明、`externalActions: false`が必須です。
+
+```sh
+pnpm exec nuxtjp-localized-site validate --content-root .
+pnpm exec nuxt build
+```
+
+## 動作と制約
+
+privacy/contactは説明文として表示し、未設定のリンクや操作を生成しません。
+メンテナンス表示は、ブラウザから同一originの`/maintenance.json`を読みます。取得・形式・期限の検証に失敗した場合は表示せず、サイト本文と言語切替は利用できます。
+配布物だけを試す場合は、registry版の代わりに承認された正確なTGZを導入してください。この手順はサイトの公開やregistry設定を行いません。
+
+## 型付きメッセージ
+
+```ts
+const messages = defineLocalizedMessages({
+  ja: { save: '保存', cancel: 'キャンセル' },
+  en: { save: 'Save', cancel: 'Cancel' }
+})
+const { t } = useLocalizedMessages(messages)
+t('save')
+```
+
+英語のキーは日本語と一致させます。空のメッセージは`fallbackLocale`、次に`defaultLocale`へfallbackします。
+
+## 開発
+
+```sh
+pnpm install --frozen-lockfile
+pnpm test
+pnpm typecheck
+pnpm build
+pnpm validate:example
+pnpm pack
+```
+
+`prepack`はテスト、型検査、build、サンプル検証を実行します。リリース前に、実際のarchiveを別hostで確認してください。
+
+## 文書とライセンス
+
+[使い方](https://github.com/nuxtjp/nuxt-localized-site/blob/main/docs/getting-started.md) · [Schema](schemas/localized-site-v1.schema.json) · [テスト](https://github.com/nuxtjp/nuxt-localized-site/tree/main/test) · [セキュリティ報告](https://github.com/nuxtjp/nuxt-localized-site/blob/main/SECURITY.md)
+
+コードは[Apache-2.0](LICENSE)です。[LICENSE-PREVIOUS](LICENSE-PREVIOUS)に以前の許諾、[NOTICE](NOTICE)に帰属表示を保持します。
+[LICENSE-ASSETS](LICENSE-ASSETS)は対象となるブランド・コンテンツ素材の別条件を保持します。コードのライセンスを変更せず、第三者やサイト所有者のコンテンツの権利を追加で許諾するものでもありません。

package/README.md

@@ -1,12 +1,12 @@
 # @nuxtjp/localized-site
 
-## 日本語
+[日本語](README.ja.md)
 
-日本語・英語の紹介サイトを1つの検証済み設定から構成します。
-`/`、`/docs`、`/docs/getting-started`、`/docs/security`と各英語ページを生成し、言語切替とSEOを適用します。
+Generate a Japanese/English introduction site from one validated configuration. The module supplies `/`, `/docs`, `/docs/getting-started`, `/docs/security` and their English counterparts, locale links and SEO metadata.
 
-公開準備中です。以下のregistry導入は`@nuxtjp/localized-site@0.1.0`の公開確認後に使います。
-Node.js 22.19以降または24.11以降、Nuxt 4.5.1以降の4系、Vue `^3.5.40`を使用してください。
+## Install and configure
+
+Version `0.1.0` is published on npm. Use Node.js 22.19+ or 24.11+, Nuxt 4.5.1+ in major 4, and Vue `^3.5.40`.
 
 ```sh
 pnpm add --save-exact @nuxtjp/localized-site@0.1.0 nuxt@4.5.1 vue@3.5.43
@@ -18,29 +18,18 @@ export default defineNuxtConfig({
 })
 ```
 
-[`site.config.json`の汎用サンプル](examples/content/site.config.json)を指定したcontent rootに置き、サイト固有の内容に置き換えます。
-`siteId`、`serviceId`、`origin`、`audienceScope`、ja/enのコンテンツ、3つのfeatures、導入・セキュリティ文書、privacy/contact説明、`externalActions: false`が必須です。
+Set `contentRoot` explicitly. Copy the [generic configuration](examples/content/site.config.json) there as `site.config.json`, and replace it with the site's own content.
+The configuration requires `siteId`, `serviceId`, `origin`, `audienceScope`, complete ja/en content, exactly three features, getting-started and security documents, privacy/contact notices, and `externalActions: false`.
 
 ```sh
 pnpm exec nuxtjp-localized-site validate --content-root .
 pnpm exec nuxt build
 ```
 
-privacy/contactは説明文として表示し、未設定のリンクや操作を生成しません。
-メンテナンス表示はブラウザから同一originの`/maintenance.json`を読みます。取得・形式・期限の検証に失敗した場合は表示せず、本文と言語切替は利用できます。
-配布物だけを試す際は、registry版の代わりに承認されたTGZをインストールしてください。サイトの公開やregistry設定はこの手順に含みません。
-
-## English
-
-Generate a Japanese/English introduction site from one validated configuration.
-The module supplies landing, overview, getting-started and security pages, locale links and SEO metadata.
-
-Publication is pending. After verifying registry availability, use the installation command above with Node.js 22.19+ or 24.11+, Nuxt 4.5.1+ in major 4, and Vue `^3.5.40`.
-Set `contentRoot` explicitly, copy the generic example to that directory as `site.config.json`, replace its content, validate it, then build the host application.
-The configuration requires site/service identifiers, origin, audience scope, complete ja/en content, exactly three features, documents and privacy/contact notices, and `externalActions: false`.
+## Behavior and limits
 
-Privacy/contact notices are text; the module creates no unset links or actions.
-In the browser, the optional maintenance notice reads same-origin `/maintenance.json`. Failed retrieval, invalid data or expired data hides the notice while the site remains usable.
+Privacy/contact notices are text. The module creates no unset links or actions.
+In the browser, the optional maintenance notice reads same-origin `/maintenance.json`. Failed retrieval, invalid data or expired data hides that notice; the site and locale switching remain usable.
 For archive testing, install the exact reviewed TGZ instead of the registry version. These commands do not publish a website or configure registry access.
 
 ## Typed messages
@@ -56,7 +45,7 @@ t('save')
 
 English keys must match Japanese keys. Empty messages fall back to `fallbackLocale`, then `defaultLocale`.
 
-## Development / 開発
+## Development
 
 ```sh
 pnpm install --frozen-lockfile
@@ -67,8 +56,15 @@ pnpm validate:example
 pnpm pack
 ```
 
-`prepack` runs the tests, typecheck, build and example validation. Verify the actual archive in a separate host before release.
-See [usage](docs/getting-started.md), [schema](schemas/localized-site-v1.schema.json), [tests](test), and [security reporting](SECURITY.md).
+`prepack` runs tests, typecheck, build and example validation. Verify the actual archive in a separate host before a release.
+
+## Documentation and license
+
+[Usage guide](https://github.com/nuxtjp/nuxt-localized-site/blob/main/docs/getting-started.md) · [Schema](schemas/localized-site-v1.schema.json) · [Tests](https://github.com/nuxtjp/nuxt-localized-site/tree/main/test) · [Security reporting](https://github.com/nuxtjp/nuxt-localized-site/blob/main/SECURITY.md)
+
+Code: [Apache-2.0](LICENSE). [LICENSE-PREVIOUS](LICENSE-PREVIOUS) retains prior grants, and [NOTICE](NOTICE) preserves attribution.
+[LICENSE-ASSETS](LICENSE-ASSETS) retains separate terms for covered brand/content assets. It does not change the code license or grant rights to third-party or site-owned content.
+
+## Consumer dependency security
 
-Code: [Apache-2.0](LICENSE). Retained prior grants: [LICENSE-PREVIOUS](LICENSE-PREVIOUS). [NOTICE](NOTICE) preserves attribution.
-[LICENSE-ASSETS](LICENSE-ASSETS) retains separate terms for covered brand/content assets; it does not change the code license or grant rights to third-party/site-owned content.
+See [dependency security backports](security/README.md) before installing this package in a Nuxt application. pnpm consumers must explicitly apply the included backports and verify their locked dependency tree; ordinary npm installation does not apply them.

package/bin/nuxtjp-localized-site.mjs

@@ -1,7 +1,15 @@
 #!/usr/bin/env node
 import { runValidatorCli } from '../validator/content/cli.js'
 
-process.exitCode = await runValidatorCli(process.argv.slice(2), {
+if (process.argv[2] === 'site') {
+  try {
+    const { runOrganizationCli } = await import('../organization/cli.mjs')
+    process.exitCode = await runOrganizationCli(process.argv.slice(3))
+  } catch (error) {
+    console.error(error.message)
+    process.exitCode = 1
+  }
+} else process.exitCode = await runValidatorCli(process.argv.slice(2), {
   out: value => process.stdout.write(`${value}\n`),
   error: value => process.stderr.write(`${value}\n`)
 })

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": "^4.5.1"
   },
-  "version": "0.1.0",
+  "version": "0.1.2",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/organization/app.vue

@@ -0,0 +1,5 @@
+<template>
+  <NuxtLayout>
+    <NuxtPage />
+  </NuxtLayout>
+</template>

package/organization/cli.mjs

@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { join, dirname } from 'node:path'
+import { organizationSites, siteDirectory, checkSitePublication } from './index.mjs'
+import { loadSiteConfig } from '../validator/content/index.js'
+import { localizedHead, siteRoutes } from '../dist/runtime/core/index.js'
+
+export async function runOrganizationCli(args, root = process.cwd()) {
+  const [command, key, ...extra] = args
+  if (extra.length || !['list', 'check', 'dev', 'build', 'typecheck', 'preview'].includes(command)) {
+    throw new Error('usage: nuxtjp-localized-site site <list|check|dev|build|typecheck|preview> [SITE_ID]')
+  }
+  const keys = organizationSites(root)
+  if (key !== undefined) siteDirectory(root, key)
+  if (command === 'list') { console.log(JSON.stringify(keys)); return 0 }
+  const selected = key === undefined ? keys : [key]
+  const all = keys.map(id => loadSiteConfig(siteDirectory(root, id)))
+  for (const field of ['siteId', 'origin']) {
+    assert.equal(new Set(all.map(config => config[field])).size, all.length, `Duplicate ${field}`)
+  }
+  for (const id of selected) {
+    const config = loadSiteConfig(siteDirectory(root, id))
+    const routes = siteRoutes(config)
+    assert.equal(config.externalActions, false)
+    assert.equal(config.defaultLocale, config.audienceScope === 'japan' ? 'ja' : 'en')
+    assert.equal(new Set(routes).size, routes.length)
+    assert.equal(routes.length, 8)
+    for (const route of routes) {
+      const head = localizedHead(route, config)
+      assert.ok(head.link.some(link => link.rel === 'canonical' && new URL(link.href).origin === new URL(config.origin).origin))
+    }
+    checkSitePublication(root, id)
+    if (command === 'check') console.log(JSON.stringify({ site: id, siteId: config.siteId, routes: routes.length }))
+  }
+  if (command === 'check') return 0
+  if (key === undefined) throw new Error('SITE_ID is required for Nuxt commands')
+  // Resolve the installed consumer CLI without a shell or a package-manager download.
+  const require = createRequire(join(root, 'package.json'))
+  const manifestPath = require.resolve('nuxt/package.json')
+  const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+  const bin = typeof manifest.bin === 'string' ? manifest.bin : manifest.bin.nuxt
+  if (!bin) throw new Error('Installed Nuxt CLI not found')
+  const run = (file, args) => new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [file, ...args], {
+      cwd: root, stdio: 'inherit', env: { ...process.env, SITE_ID: key, NUXT_TELEMETRY_DISABLED: '1' }
+    })
+    child.on('error', reject)
+    child.on('exit', (code, signal) => resolve(signal ? 1 : code ?? 1))
+  })
+  if (command === 'typecheck') {
+    const prepared = await run(join(dirname(manifestPath), bin), ['prepare'])
+    if (prepared !== 0) return prepared
+    return await run(require.resolve('vue-tsc/bin/vue-tsc.js'), ['--noEmit', '--project', join(root, '.nuxt', key, 'tsconfig.json')])
+  }
+  return await run(join(dirname(manifestPath), bin), [command === 'build' ? 'generate' : command])
+}

package/organization/index.d.mts

@@ -0,0 +1,12 @@
+export function organizationSites(root: string): string[];
+export function siteDirectory(root: string, key: string): string;
+export function organizationSite(configUrl: string, key?: string): {
+  srcDir: string;
+  devtools: { enabled: boolean };
+  buildDir: string;
+  dir: { public: string };
+  modules: [string, { contentRoot: string }][];
+  nitro: { output: { dir: string }; prerender: { failOnError: boolean } };
+};
+export function checkPublicCatalog(policy: unknown, catalog: unknown): { scope: string; entries: number };
+export function checkSitePublication(root: string, key: string): { scope: string; entries: number } | null;

package/organization/index.mjs

@@ -0,0 +1,77 @@
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import assert from 'node:assert/strict'
+
+const keyPattern = /^[a-z0-9]+(?:-[a-z0-9]+)*$/
+
+function directory(path) {
+  if (!existsSync(path) || lstatSync(path).isSymbolicLink() || !lstatSync(path).isDirectory()) {
+    throw new Error('Expected a real organization site directory')
+  }
+  return realpathSync(path)
+}
+
+export function organizationSites(root) {
+  const sites = directory(join(directory(root), 'sites'))
+  const keys = readdirSync(sites).sort()
+  if (!keys.length) throw new Error('No organization sites configured')
+  for (const key of keys) siteDirectory(root, key)
+  return keys
+}
+
+export function siteDirectory(root, key) {
+  if (typeof key !== 'string' || !keyPattern.test(key)) throw new Error('Invalid SITE_ID')
+  const sites = directory(join(directory(root), 'sites'))
+  const path = directory(join(sites, key))
+  if (dirname(path) !== sites) throw new Error('Site must remain within sites/')
+  const config = join(path, 'site.config.json')
+  if (!existsSync(config) || lstatSync(config).isSymbolicLink() || !lstatSync(config).isFile()) {
+    throw new Error('Site configuration must be a regular file')
+  }
+  for (const name of ['package.json', 'nuxt.config.ts', 'app.vue', 'layouts', 'pages', 'components']) {
+    if (existsSync(join(path, name))) throw new Error('Site-specific Nuxt applications/layouts are not permitted')
+  }
+  return path
+}
+
+export function organizationSite(configUrl, key = process.env.SITE_ID) {
+  const root = dirname(fileURLToPath(configUrl))
+  const contentRoot = siteDirectory(root, key)
+  return {
+    srcDir: dirname(fileURLToPath(import.meta.url)),
+    devtools: { enabled: false },
+    buildDir: join(root, '.nuxt', key),
+    dir: { public: join(contentRoot, 'public') },
+    modules: [['@nuxtjp/localized-site', { contentRoot }]],
+    nitro: {
+      output: { dir: join(root, '.output', key) },
+      prerender: { failOnError: true }
+    }
+  }
+}
+
+export function checkPublicCatalog(policy, catalog) {
+  assert.equal(policy.scope, 'public')
+  assert.ok(Array.isArray(policy.repository_ids) && policy.repository_ids.length > 0)
+  assert.equal(new Set(policy.repository_ids).size, policy.repository_ids.length)
+  assert.ok(Array.isArray(catalog.entries))
+  assert.deepEqual(catalog.entries.map(entry => entry.repository_id).sort(), [...policy.repository_ids].sort(),
+    'Catalog visibility gate failed: entries must match the reviewed public allowlist exactly')
+  return { scope: 'public', entries: catalog.entries.length }
+}
+
+export function checkSitePublication(root, key) {
+  const path = siteDirectory(root, key)
+  const policy = join(path, 'public-package-policy.json')
+  const catalog = join(path, 'public/catalog/v2/index.json')
+  if (existsSync(policy) || existsSync(catalog)) {
+    for (const file of [policy, catalog]) {
+      if (!existsSync(file) || lstatSync(file).isSymbolicLink() || !lstatSync(file).isFile()) {
+        throw new Error('Public catalog and reviewed policy must both exist as regular files')
+      }
+    }
+    return checkPublicCatalog(JSON.parse(readFileSync(policy, 'utf8')), JSON.parse(readFileSync(catalog, 'utf8')))
+  }
+  return null
+}

package/organization/workspace.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { organizationSites } from './index.mjs'
+
+const [command, input] = process.argv.slice(2)
+if (!['module', 'verify'].includes(command) || !input || process.argv.length !== 4) {
+  throw new Error('usage: workspace.mjs <module|verify> WORKSPACE_ROOT')
+}
+const root = resolve(input)
+const moduleRoot = join(root, 'organizations/nuxtjp/nuxt-localized-site')
+if (command === 'module') console.log(moduleRoot)
+else {
+  for (const organization of readdirSync(join(root, 'organizations'), { withFileTypes: true })) {
+    if (!organization.isDirectory() || organization.isSymbolicLink()) continue
+    const owner = join(root, 'organizations', organization.name)
+    for (const entry of readdirSync(owner, { withFileTypes: true })) {
+      if (!entry.isDirectory() || entry.isSymbolicLink()) continue
+      const repository = join(owner, entry.name)
+      if (!existsSync(join(repository, 'sites')) || !existsSync(join(repository, 'package.json'))) continue
+      const manifest = JSON.parse(readFileSync(join(repository, 'package.json'), 'utf8'))
+      if (!manifest.dependencies?.['@nuxtjp/localized-site']) continue
+      const commands = [['test'], ...organizationSites(repository).flatMap(key => [['site', 'typecheck', key], ['site', 'build', key]])]
+      for (const args of commands) {
+        const result = spawnSync('pnpm', args, { cwd: repository, stdio: 'inherit' })
+        if (result.status !== 0) process.exit(result.status ?? 1)
+      }
+    }
+  }
+}

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@nuxtjp/localized-site",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Contract-first Japanese and English public-site module for Nuxt",
   "type": "module",
   "license": "Apache-2.0",
+  "packageManager": "pnpm@10.29.3",
   "engines": {
     "node": "^22.19.0 || ^24.11.0",
     "pnpm": ">=10 <11"
@@ -18,7 +19,11 @@
     "README.md",
     "NOTICE",
     "LICENSE-ASSETS",
-    "LICENSE-PREVIOUS"
+    "LICENSE-PREVIOUS",
+    "README.ja.md",
+    "organization",
+    "security",
+    "ASSET-SCOPE.md"
   ],
   "bin": {
     "nuxtjp-localized-site": "./bin/nuxtjp-localized-site.mjs"
@@ -38,20 +43,36 @@
       "types": "./validator/content/index.d.ts",
       "import": "./validator/content/index.js"
     },
-    "./schema": "./schemas/localized-site-v1.schema.json"
+    "./schema": "./schemas/localized-site-v1.schema.json",
+    "./organization": {
+      "types": "./organization/index.d.mts",
+      "import": "./organization/index.mjs"
+    }
+  },
+  "scripts": {
+    "build:module": "nuxt-module-build build",
+    "build:validator": "tsc -p tsconfig.validator.json",
+    "build": "pnpm run build:validator && pnpm run build:module && nuxt build playground",
+    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
+    "test": "vitest run && pnpm run test:organization && pnpm run test:dependency-security && pnpm run test:consumer-security",
+    "validate:example": "node ./bin/nuxtjp-localized-site.mjs validate --content-root ./examples/content",
+    "prepack": "pnpm test && pnpm typecheck && pnpm build && pnpm validate:example",
+    "test:organization": "pnpm run build:validator && pnpm run build:module && node --test test/organization-check.mjs",
+    "test:dependency-security": "node --test scripts/dependency-security.check.cjs",
+    "test:consumer-security": "node --test scripts/consumer-security.check.mjs"
   },
   "peerDependencies": {
     "nuxt": "^4.5.1",
     "vue": "^3.5.40"
   },
   "dependencies": {
-    "@nuxt/kit": "4.5.1",
+    "@nuxt/kit": "4.5.2",
     "@nuxt/schema": "4.5.1"
   },
   "devDependencies": {
     "@nuxt/module-builder": "1.0.2",
     "@types/node": "24.12.0",
-    "nuxt": "4.5.1",
+    "nuxt": "4.5.2",
     "typescript": "5.9.3",
     "vitest": "4.1.11",
     "vue": "3.5.43",
@@ -66,12 +87,13 @@
     "access": "public",
     "provenance": true
   },
-  "scripts": {
-    "build:module": "nuxt-module-build build",
-    "build:validator": "tsc -p tsconfig.validator.json",
-    "build": "pnpm run build:validator && pnpm run build:module && nuxt build playground",
-    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
-    "test": "vitest run",
-    "validate:example": "node ./bin/nuxtjp-localized-site.mjs validate --content-root ./examples/content"
+  "pnpm": {
+    "overrides": {
+      "@nuxt/devtools>simple-git": "4.0.2"
+    },
+    "patchedDependencies": {
+      "braces@3.0.3": "patches/braces@3.0.3.patch",
+      "node-forge@1.4.0": "patches/node-forge@1.4.0.patch"
+    }
   }
-}
+}

package/security/README.md

@@ -0,0 +1,17 @@
+# Dependency security backports
+
+Two upstream dependencies have no fixed release: braces 3.0.3 (GHSA-vfj7-8cjw-p6xm) and node-forge 1.4.0 (GHSA-86w9-cpqp-85rv). The included patches bound brace AST recursion and reject malformed RSA DigestAlgorithm parameters. Regression tests cover ordinary behavior and the malicious input shapes.
+
+The package is distributed through npm. A consumer must use pnpm 10 and explicitly configure the reviewed backports at its project root. Dependency packages cannot impose root-level npm overrides or pnpm patches on a consuming application. Installing this module alone does not apply the patches.
+
+```sh
+node node_modules/@nuxtjp/localized-site/security/apply.mjs --project-root . --apply
+pnpm install --no-frozen-lockfile
+pnpm install --frozen-lockfile
+```
+
+Commit the generated `.nuxtjp-security/*.patch`, `package.json`, and lockfile in your application. The command does not run installs, access the network, or replace an existing conflicting patch. It preserves unrelated pnpm settings. Each root application must apply the patches, including CI checkouts.
+
+Run `node node_modules/@nuxtjp/localized-site/security/dependency-security.check.cjs` after installing the locked project to verify that the actual resolved dependencies reject the affected inputs. These are backports, not upstream fixed versions. Version-only advisory tools still report the two vulnerable upstream versions; retain their findings and link the lockfile/patch hashes and regression results. Reapply and reverify when dependency versions change. npm-only consumers require a separately reviewed override distribution; they are not certified by this pnpm procedure.
+
+The RSA test creates an ephemeral key in memory and never reads a user key. Patches contain code only and do not include credentials, customer content, or private endpoints.

package/security/apply.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/** Apply reviewed Nuxt dependency backports to an explicitly selected pnpm project. */
+import { fileURLToPath } from 'node:url'
+import { dirname } from 'node:path'
+import { applySecurityPatches } from './project.mjs'
+
+const args = process.argv.slice(2)
+if (args.length !== 3 || args[0] !== '--project-root' || args[2] !== '--apply') {
+  console.error('Usage: node apply.mjs --project-root PROJECT --apply')
+  process.exitCode = 2
+} else {
+  try {
+    applySecurityPatches(args[1], dirname(fileURLToPath(import.meta.url)))
+    console.log('Reviewed backports configured. Run pnpm install --no-frozen-lockfile to refresh the lockfile.')
+  } catch (error) {
+    console.error(error.message)
+    process.exitCode = 1
+  }
+}

package/security/dependency-security.check.cjs

@@ -0,0 +1,51 @@
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+const { createRequire } = require('node:module');
+const { generateKeyPairSync, sign, privateEncrypt, constants } = require('node:crypto');
+const path = require('node:path');
+const fs = require('node:fs');
+function dependency(name, version) {
+  const explicit = process.env['SECURITY_TEST_' + name.toUpperCase().replace('-', '_')];
+  if (explicit) return require(path.resolve(explicit));
+  const { installedDependencies } = require('./resolved-dependency.cjs');
+  const matches = installedDependencies(process.cwd(), name, version);
+  assert.equal(matches.length, 1, 'Expected one active locked dependency implementation');
+  return createRequire(matches[0])(name);
+}
+const braces = dependency('braces', '3.0.3');
+const forge = dependency('node-forge', '1.4.0');
+test('brace compilation, expansion and stringification retain ordinary behavior', () => {
+  assert.equal(braces.compile('src/{a,b}.vue'), 'src/(a|b).vue');
+  assert.deepEqual(braces.expand('src/{a,b}.vue'), ['src/a.vue', 'src/b.vue']);
+  assert.equal(braces.stringify(braces.parse('src/{a,b}.vue')), 'src/{a,b}.vue');
+  assert.equal(braces.compile('src/\\{a,b\\}.vue'), 'src/{a,b}.vue');
+});
+test('deep brace, parenthesis and caller AST inputs reject before stack exhaustion', () => {
+  for (const pattern of ['{'.repeat(6000) + 'a,b' + '}'.repeat(6000), '('.repeat(6000) + 'x' + ')'.repeat(6000), '{'.repeat(6000) + 'x']) {
+    for (const fn of [braces.compile, braces.expand, braces.stringify, braces.parse]) assert.throws(() => fn(pattern), SyntaxError);
+  }
+  let ast = { type: 'text', value: 'x' };
+  for (let i = 0; i < 6000; i++) ast = { type: 'root', nodes: [ast] };
+  for (const fn of [braces.compile, braces.expand, braces.stringify]) assert.throws(() => fn(ast), SyntaxError);
+  const cyclic = { type: 'root', nodes: [] }; cyclic.nodes.push(cyclic);
+  assert.throws(() => braces.compile(cyclic), SyntaxError);
+});
+test('RSA verifier accepts standard signatures and rejects extra or malformed DigestAlgorithm elements', () => {
+  const keys = generateKeyPairSync('rsa', { modulusLength: 2048 });
+  const publicKey = forge.pki.publicKeyFromPem(keys.publicKey.export({ type: 'spki', format: 'pem' }));
+  const data = Buffer.from('never-issued security regression fixture');
+  const md = forge.md.sha256.create(); md.update(data.toString('binary'));
+  const digest = md.digest().getBytes();
+  assert.equal(publicKey.verify(digest, sign('sha256', data, keys.privateKey).toString('binary')), true);
+  const a = forge.asn1;
+  const oid = () => a.create(a.Class.UNIVERSAL, a.Type.OID, false, a.oidToDer(forge.oids.sha256).getBytes());
+  const nil = value => a.create(a.Class.UNIVERSAL, a.Type.NULL, false, value);
+  for (const parameters of [[oid(), nil(''), oid()], [oid(), a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, [oid()])], [oid(), nil('x')]]) {
+    const info = a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, [a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, parameters), a.create(a.Class.UNIVERSAL, a.Type.OCTETSTRING, false, digest)]);
+    const encoded = Buffer.from(a.toDer(info).getBytes(), 'binary');
+    const signature = privateEncrypt({ key: keys.privateKey, padding: constants.RSA_PKCS1_PADDING }, encoded).toString('binary');
+    let accepted = false;
+    try { accepted = publicKey.verify(digest, signature); } catch { /* Rejection is the expected result for a malformed signature. */ }
+    assert.equal(accepted, false, 'Malformed algorithm must not verify');
+  }
+});

package/security/patches/braces@3.0.3.patch

@@ -0,0 +1,92 @@
+diff --git a/lib/depth-guard.js b/lib/depth-guard.js
+new file mode 100644
+--- /dev/null
++++ b/lib/depth-guard.js
+@@ -0,0 +1,19 @@
++'use strict';
++
++// Wonderland security backport: bound recursive walkers, including caller ASTs.
++module.exports = ast => {
++  const pending = [[ast, 0]];
++  const seen = new Set();
++  let count = 0;
++  while (pending.length) {
++    const [node, depth] = pending.pop();
++    if (depth > 64 || ++count > 100000 || seen.has(node)) {
++      throw new SyntaxError('Brace pattern exceeds safe AST bounds');
++    }
++    if (!node || typeof node !== 'object') continue;
++    seen.add(node);
++    if (Array.isArray(node.nodes)) {
++      for (const child of node.nodes) pending.push([child, depth + 1]);
++    }
++  }
++};
+diff --git a/lib/parse.js b/lib/parse.js
+--- a/lib/parse.js
++++ b/lib/parse.js
+@@ -144,6 +144,7 @@
+ 
+     if (value === CHAR_LEFT_PARENTHESES) {
+       block = push({ type: 'paren', nodes: [] });
++      if (stack.length >= 64) throw new SyntaxError('Brace pattern exceeds safe nesting depth');
+       stack.push(block);
+       push({ type: 'text', value });
+       continue;
+@@ -210,6 +211,7 @@
+       };
+ 
+       block = push(brace);
++      if (stack.length >= 64) throw new SyntaxError('Brace pattern exceeds safe nesting depth');
+       stack.push(block);
+       push({ type: 'open', value });
+       continue;
+diff --git a/lib/compile.js b/lib/compile.js
+--- a/lib/compile.js
++++ b/lib/compile.js
+@@ -1,9 +1,12 @@
+ 'use strict';
++
++const assertDepth = require('./depth-guard');
+ 
+ const fill = require('fill-range');
+ const utils = require('./utils');
+ 
+ const compile = (ast, options = {}) => {
++  assertDepth(ast);
+   const walk = (node, parent = {}) => {
+     const invalidBlock = utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+diff --git a/lib/expand.js b/lib/expand.js
+--- a/lib/expand.js
++++ b/lib/expand.js
+@@ -1,4 +1,6 @@
+ 'use strict';
++
++const assertDepth = require('./depth-guard');
+ 
+ const fill = require('fill-range');
+ const stringify = require('./stringify');
+@@ -31,6 +33,7 @@
+ };
+ 
+ const expand = (ast, options = {}) => {
++  assertDepth(ast);
+   const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit;
+ 
+   const walk = (node, parent = {}) => {
+diff --git a/lib/stringify.js b/lib/stringify.js
+--- a/lib/stringify.js
++++ b/lib/stringify.js
+@@ -1,8 +1,11 @@
+ 'use strict';
++
++const assertDepth = require('./depth-guard');
+ 
+ const utils = require('./utils');
+ 
+ module.exports = (ast, options = {}) => {
++  assertDepth(ast);
+   const stringify = (node, parent = {}) => {
+     const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;

package/security/patches/node-forge@1.4.0.patch

@@ -0,0 +1,20 @@
+diff --git a/lib/rsa.js b/lib/rsa.js
+--- a/lib/rsa.js
++++ b/lib/rsa.js
+@@ -1172,7 +1172,15 @@
+           var capture = {};
+           var errors = [];
+           if(!asn1.validate(obj, digestInfoValidator, capture, errors) ||
+-            obj.value.length !== 2) {
++            obj.value.length !== 2 ||
++            // Wonderland security backport: AlgorithmIdentifier has one OID
++            // and, optionally, exactly one empty primitive NULL parameter.
++            obj.value[0].value.length < 1 || obj.value[0].value.length > 2 ||
++            (obj.value[0].value.length === 2 &&
++              (obj.value[0].value[1].tagClass !== asn1.Class.UNIVERSAL ||
++               obj.value[0].value[1].type !== asn1.Type.NULL ||
++               obj.value[0].value[1].constructed !== false ||
++               obj.value[0].value[1].value !== ''))) {
+             var error = new Error(
+               'ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 ' +
+               'DigestInfo value.');

package/security/project.mjs

@@ -0,0 +1,61 @@
+/** Configure caller-owned pnpm backports without executing installs or changing unrelated settings. */
+import { existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSync, unlinkSync, realpathSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { randomUUID } from 'node:crypto'
+
+const patches = ['braces@3.0.3', 'node-forge@1.4.0']
+function regular(path) {
+  const stat = lstatSync(path)
+  if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 1024 * 1024) {
+    throw new Error('Expected a bounded regular project or patch file')
+  }
+  return readFileSync(path)
+}
+function object(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+/** Reject conflicting patches and links before mutating a project. No network access occurs. */
+export function applySecurityPatches(project, source) {
+  const root = realpathSync(resolve(project))
+  const manifest = join(root, 'package.json')
+  const original = regular(manifest)
+  const data = JSON.parse(original)
+  if (!object(data) || (data.pnpm !== undefined && !object(data.pnpm))) {
+    throw new Error('Expected a package manifest with object-valued pnpm settings')
+  }
+  const pnpm = data.pnpm ?? {}
+  const existing = pnpm.patchedDependencies ?? {}
+  if (!object(existing)) throw new Error('Expected object-valued patchedDependencies')
+  const dir = join(root, '.nuxtjp-security')
+  if (existsSync(dir) && (lstatSync(dir).isSymbolicLink() || !lstatSync(dir).isDirectory())) {
+    throw new Error('Security patch directory must be a real directory')
+  }
+  const inputs = patches.map(name => {
+    const relative = `.nuxtjp-security/${name}.patch`
+    if (existing[name] !== undefined && existing[name] !== relative) {
+      throw new Error('An existing dependency patch conflicts; review it before applying')
+    }
+    const bytes = regular(join(source, 'patches', `${name}.patch`))
+    const target = join(root, relative)
+    if (existsSync(target) && !regular(target).equals(bytes)) {
+      throw new Error('An existing patch differs; no files were overwritten')
+    }
+    return { name, relative, bytes, target }
+  })
+  if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed during preparation')
+  mkdirSync(dir, { recursive: true })
+  for (const patch of inputs) {
+    if (!existsSync(patch.target)) writeFileSync(patch.target, patch.bytes, { flag: 'wx' })
+    existing[patch.name] = patch.relative
+  }
+  data.pnpm = { ...pnpm, patchedDependencies: existing }
+  const temporary = join(root, `.nuxtjp-manifest-${randomUUID()}.tmp`)
+  try {
+    writeFileSync(temporary, JSON.stringify(data, null, 2) + '\n', { flag: 'wx' })
+    if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed; retry after review')
+    renameSync(temporary, manifest)
+  } finally {
+    if (existsSync(temporary)) unlinkSync(temporary)
+  }
+}

package/security/resolved-dependency.cjs

@@ -0,0 +1,40 @@
+/** Resolve a dependency through the installed application graph, ignoring unused store entries. */
+const fs = require('node:fs');
+const path = require('node:path');
+const { createRequire } = require('node:module');
+
+function installedDependencies(root, target, version) {
+  root = fs.realpathSync(root);
+  const pending = [path.join(root, 'package.json')];
+  const seen = new Set();
+  const found = new Set();
+  while (pending.length) {
+    if (seen.size > 5000) throw new Error('Installed dependency graph exceeds verification budget');
+    const file = pending.pop();
+    if (seen.has(file)) continue;
+    seen.add(file);
+    const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (data.name === target) {
+      if (data.version !== version) throw new Error('Dependency version changed; review its security patch');
+      found.add(file);
+    }
+    const request = createRequire(file);
+    const names = Object.keys({ ...data.dependencies, ...data.optionalDependencies, ...data.peerDependencies,
+      ...(file === path.join(root, 'package.json') ? data.devDependencies : {}) });
+    for (const name of names) {
+      for (const location of request.resolve.paths(name) ?? []) {
+        const candidate = path.join(location, name, 'package.json');
+        if (!fs.existsSync(candidate)) continue;
+        const real = fs.realpathSync(candidate);
+        if (!real.startsWith(path.join(root, 'node_modules') + path.sep)) {
+          throw new Error('Dependency resolves outside the selected project; select the workspace root');
+        }
+        pending.push(real);
+        break;
+      }
+    }
+  }
+  if (found.size === 0) throw new Error('Dependency not present in the installed application graph');
+  return [...found].sort();
+}
+module.exports = { installedDependencies };