@nuxtjp/localized-site 0.1.1 → 0.1.2

package/README.md

@@ -64,3 +64,7 @@ pnpm pack
 
 Code: [Apache-2.0](LICENSE). [LICENSE-PREVIOUS](LICENSE-PREVIOUS) retains prior grants, and [NOTICE](NOTICE) preserves attribution.
 [LICENSE-ASSETS](LICENSE-ASSETS) retains separate terms for covered brand/content assets. It does not change the code license or grant rights to third-party or site-owned content.
+
+## Consumer dependency security
+
+See [dependency security backports](security/README.md) before installing this package in a Nuxt application. pnpm consumers must explicitly apply the included backports and verify their locked dependency tree; ordinary npm installation does not apply them.

package/bin/nuxtjp-localized-site.mjs

@@ -1,7 +1,15 @@
 #!/usr/bin/env node
 import { runValidatorCli } from '../validator/content/cli.js'
 
-process.exitCode = await runValidatorCli(process.argv.slice(2), {
+if (process.argv[2] === 'site') {
+  try {
+    const { runOrganizationCli } = await import('../organization/cli.mjs')
+    process.exitCode = await runOrganizationCli(process.argv.slice(3))
+  } catch (error) {
+    console.error(error.message)
+    process.exitCode = 1
+  }
+} else process.exitCode = await runValidatorCli(process.argv.slice(2), {
   out: value => process.stdout.write(`${value}\n`),
   error: value => process.stderr.write(`${value}\n`)
 })

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": "^4.5.1"
   },
-  "version": "0.1.1",
+  "version": "0.1.2",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/organization/app.vue

@@ -0,0 +1,5 @@
+<template>
+  <NuxtLayout>
+    <NuxtPage />
+  </NuxtLayout>
+</template>

package/organization/cli.mjs

@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { join, dirname } from 'node:path'
+import { organizationSites, siteDirectory, checkSitePublication } from './index.mjs'
+import { loadSiteConfig } from '../validator/content/index.js'
+import { localizedHead, siteRoutes } from '../dist/runtime/core/index.js'
+
+export async function runOrganizationCli(args, root = process.cwd()) {
+  const [command, key, ...extra] = args
+  if (extra.length || !['list', 'check', 'dev', 'build', 'typecheck', 'preview'].includes(command)) {
+    throw new Error('usage: nuxtjp-localized-site site <list|check|dev|build|typecheck|preview> [SITE_ID]')
+  }
+  const keys = organizationSites(root)
+  if (key !== undefined) siteDirectory(root, key)
+  if (command === 'list') { console.log(JSON.stringify(keys)); return 0 }
+  const selected = key === undefined ? keys : [key]
+  const all = keys.map(id => loadSiteConfig(siteDirectory(root, id)))
+  for (const field of ['siteId', 'origin']) {
+    assert.equal(new Set(all.map(config => config[field])).size, all.length, `Duplicate ${field}`)
+  }
+  for (const id of selected) {
+    const config = loadSiteConfig(siteDirectory(root, id))
+    const routes = siteRoutes(config)
+    assert.equal(config.externalActions, false)
+    assert.equal(config.defaultLocale, config.audienceScope === 'japan' ? 'ja' : 'en')
+    assert.equal(new Set(routes).size, routes.length)
+    assert.equal(routes.length, 8)
+    for (const route of routes) {
+      const head = localizedHead(route, config)
+      assert.ok(head.link.some(link => link.rel === 'canonical' && new URL(link.href).origin === new URL(config.origin).origin))
+    }
+    checkSitePublication(root, id)
+    if (command === 'check') console.log(JSON.stringify({ site: id, siteId: config.siteId, routes: routes.length }))
+  }
+  if (command === 'check') return 0
+  if (key === undefined) throw new Error('SITE_ID is required for Nuxt commands')
+  // Resolve the installed consumer CLI without a shell or a package-manager download.
+  const require = createRequire(join(root, 'package.json'))
+  const manifestPath = require.resolve('nuxt/package.json')
+  const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+  const bin = typeof manifest.bin === 'string' ? manifest.bin : manifest.bin.nuxt
+  if (!bin) throw new Error('Installed Nuxt CLI not found')
+  const run = (file, args) => new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [file, ...args], {
+      cwd: root, stdio: 'inherit', env: { ...process.env, SITE_ID: key, NUXT_TELEMETRY_DISABLED: '1' }
+    })
+    child.on('error', reject)
+    child.on('exit', (code, signal) => resolve(signal ? 1 : code ?? 1))
+  })
+  if (command === 'typecheck') {
+    const prepared = await run(join(dirname(manifestPath), bin), ['prepare'])
+    if (prepared !== 0) return prepared
+    return await run(require.resolve('vue-tsc/bin/vue-tsc.js'), ['--noEmit', '--project', join(root, '.nuxt', key, 'tsconfig.json')])
+  }
+  return await run(join(dirname(manifestPath), bin), [command === 'build' ? 'generate' : command])
+}

package/organization/index.d.mts

@@ -0,0 +1,12 @@
+export function organizationSites(root: string): string[];
+export function siteDirectory(root: string, key: string): string;
+export function organizationSite(configUrl: string, key?: string): {
+  srcDir: string;
+  devtools: { enabled: boolean };
+  buildDir: string;
+  dir: { public: string };
+  modules: [string, { contentRoot: string }][];
+  nitro: { output: { dir: string }; prerender: { failOnError: boolean } };
+};
+export function checkPublicCatalog(policy: unknown, catalog: unknown): { scope: string; entries: number };
+export function checkSitePublication(root: string, key: string): { scope: string; entries: number } | null;

package/organization/index.mjs

@@ -0,0 +1,77 @@
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import assert from 'node:assert/strict'
+
+const keyPattern = /^[a-z0-9]+(?:-[a-z0-9]+)*$/
+
+function directory(path) {
+  if (!existsSync(path) || lstatSync(path).isSymbolicLink() || !lstatSync(path).isDirectory()) {
+    throw new Error('Expected a real organization site directory')
+  }
+  return realpathSync(path)
+}
+
+export function organizationSites(root) {
+  const sites = directory(join(directory(root), 'sites'))
+  const keys = readdirSync(sites).sort()
+  if (!keys.length) throw new Error('No organization sites configured')
+  for (const key of keys) siteDirectory(root, key)
+  return keys
+}
+
+export function siteDirectory(root, key) {
+  if (typeof key !== 'string' || !keyPattern.test(key)) throw new Error('Invalid SITE_ID')
+  const sites = directory(join(directory(root), 'sites'))
+  const path = directory(join(sites, key))
+  if (dirname(path) !== sites) throw new Error('Site must remain within sites/')
+  const config = join(path, 'site.config.json')
+  if (!existsSync(config) || lstatSync(config).isSymbolicLink() || !lstatSync(config).isFile()) {
+    throw new Error('Site configuration must be a regular file')
+  }
+  for (const name of ['package.json', 'nuxt.config.ts', 'app.vue', 'layouts', 'pages', 'components']) {
+    if (existsSync(join(path, name))) throw new Error('Site-specific Nuxt applications/layouts are not permitted')
+  }
+  return path
+}
+
+export function organizationSite(configUrl, key = process.env.SITE_ID) {
+  const root = dirname(fileURLToPath(configUrl))
+  const contentRoot = siteDirectory(root, key)
+  return {
+    srcDir: dirname(fileURLToPath(import.meta.url)),
+    devtools: { enabled: false },
+    buildDir: join(root, '.nuxt', key),
+    dir: { public: join(contentRoot, 'public') },
+    modules: [['@nuxtjp/localized-site', { contentRoot }]],
+    nitro: {
+      output: { dir: join(root, '.output', key) },
+      prerender: { failOnError: true }
+    }
+  }
+}
+
+export function checkPublicCatalog(policy, catalog) {
+  assert.equal(policy.scope, 'public')
+  assert.ok(Array.isArray(policy.repository_ids) && policy.repository_ids.length > 0)
+  assert.equal(new Set(policy.repository_ids).size, policy.repository_ids.length)
+  assert.ok(Array.isArray(catalog.entries))
+  assert.deepEqual(catalog.entries.map(entry => entry.repository_id).sort(), [...policy.repository_ids].sort(),
+    'Catalog visibility gate failed: entries must match the reviewed public allowlist exactly')
+  return { scope: 'public', entries: catalog.entries.length }
+}
+
+export function checkSitePublication(root, key) {
+  const path = siteDirectory(root, key)
+  const policy = join(path, 'public-package-policy.json')
+  const catalog = join(path, 'public/catalog/v2/index.json')
+  if (existsSync(policy) || existsSync(catalog)) {
+    for (const file of [policy, catalog]) {
+      if (!existsSync(file) || lstatSync(file).isSymbolicLink() || !lstatSync(file).isFile()) {
+        throw new Error('Public catalog and reviewed policy must both exist as regular files')
+      }
+    }
+    return checkPublicCatalog(JSON.parse(readFileSync(policy, 'utf8')), JSON.parse(readFileSync(catalog, 'utf8')))
+  }
+  return null
+}

package/organization/workspace.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { organizationSites } from './index.mjs'
+
+const [command, input] = process.argv.slice(2)
+if (!['module', 'verify'].includes(command) || !input || process.argv.length !== 4) {
+  throw new Error('usage: workspace.mjs <module|verify> WORKSPACE_ROOT')
+}
+const root = resolve(input)
+const moduleRoot = join(root, 'organizations/nuxtjp/nuxt-localized-site')
+if (command === 'module') console.log(moduleRoot)
+else {
+  for (const organization of readdirSync(join(root, 'organizations'), { withFileTypes: true })) {
+    if (!organization.isDirectory() || organization.isSymbolicLink()) continue
+    const owner = join(root, 'organizations', organization.name)
+    for (const entry of readdirSync(owner, { withFileTypes: true })) {
+      if (!entry.isDirectory() || entry.isSymbolicLink()) continue
+      const repository = join(owner, entry.name)
+      if (!existsSync(join(repository, 'sites')) || !existsSync(join(repository, 'package.json'))) continue
+      const manifest = JSON.parse(readFileSync(join(repository, 'package.json'), 'utf8'))
+      if (!manifest.dependencies?.['@nuxtjp/localized-site']) continue
+      const commands = [['test'], ...organizationSites(repository).flatMap(key => [['site', 'typecheck', key], ['site', 'build', key]])]
+      for (const args of commands) {
+        const result = spawnSync('pnpm', args, { cwd: repository, stdio: 'inherit' })
+        if (result.status !== 0) process.exit(result.status ?? 1)
+      }
+    }
+  }
+}

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@nuxtjp/localized-site",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Contract-first Japanese and English public-site module for Nuxt",
   "type": "module",
   "license": "Apache-2.0",
+  "packageManager": "pnpm@10.29.3",
   "engines": {
     "node": "^22.19.0 || ^24.11.0",
     "pnpm": ">=10 <11"
@@ -19,7 +20,10 @@
     "NOTICE",
     "LICENSE-ASSETS",
     "LICENSE-PREVIOUS",
-    "README.ja.md"
+    "README.ja.md",
+    "organization",
+    "security",
+    "ASSET-SCOPE.md"
   ],
   "bin": {
     "nuxtjp-localized-site": "./bin/nuxtjp-localized-site.mjs"
@@ -39,20 +43,36 @@
       "types": "./validator/content/index.d.ts",
       "import": "./validator/content/index.js"
     },
-    "./schema": "./schemas/localized-site-v1.schema.json"
+    "./schema": "./schemas/localized-site-v1.schema.json",
+    "./organization": {
+      "types": "./organization/index.d.mts",
+      "import": "./organization/index.mjs"
+    }
+  },
+  "scripts": {
+    "build:module": "nuxt-module-build build",
+    "build:validator": "tsc -p tsconfig.validator.json",
+    "build": "pnpm run build:validator && pnpm run build:module && nuxt build playground",
+    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
+    "test": "vitest run && pnpm run test:organization && pnpm run test:dependency-security && pnpm run test:consumer-security",
+    "validate:example": "node ./bin/nuxtjp-localized-site.mjs validate --content-root ./examples/content",
+    "prepack": "pnpm test && pnpm typecheck && pnpm build && pnpm validate:example",
+    "test:organization": "pnpm run build:validator && pnpm run build:module && node --test test/organization-check.mjs",
+    "test:dependency-security": "node --test scripts/dependency-security.check.cjs",
+    "test:consumer-security": "node --test scripts/consumer-security.check.mjs"
   },
   "peerDependencies": {
     "nuxt": "^4.5.1",
     "vue": "^3.5.40"
   },
   "dependencies": {
-    "@nuxt/kit": "4.5.1",
+    "@nuxt/kit": "4.5.2",
     "@nuxt/schema": "4.5.1"
   },
   "devDependencies": {
     "@nuxt/module-builder": "1.0.2",
     "@types/node": "24.12.0",
-    "nuxt": "4.5.1",
+    "nuxt": "4.5.2",
     "typescript": "5.9.3",
     "vitest": "4.1.11",
     "vue": "3.5.43",
@@ -67,12 +87,13 @@
     "access": "public",
     "provenance": true
   },
-  "scripts": {
-    "build:module": "nuxt-module-build build",
-    "build:validator": "tsc -p tsconfig.validator.json",
-    "build": "pnpm run build:validator && pnpm run build:module && nuxt build playground",
-    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
-    "test": "vitest run",
-    "validate:example": "node ./bin/nuxtjp-localized-site.mjs validate --content-root ./examples/content"
+  "pnpm": {
+    "overrides": {
+      "@nuxt/devtools>simple-git": "4.0.2"
+    },
+    "patchedDependencies": {
+      "braces@3.0.3": "patches/braces@3.0.3.patch",
+      "node-forge@1.4.0": "patches/node-forge@1.4.0.patch"
+    }
   }
-}
+}

package/security/README.md

@@ -0,0 +1,17 @@
+# Dependency security backports
+
+Two upstream dependencies have no fixed release: braces 3.0.3 (GHSA-vfj7-8cjw-p6xm) and node-forge 1.4.0 (GHSA-86w9-cpqp-85rv). The included patches bound brace AST recursion and reject malformed RSA DigestAlgorithm parameters. Regression tests cover ordinary behavior and the malicious input shapes.
+
+The package is distributed through npm. A consumer must use pnpm 10 and explicitly configure the reviewed backports at its project root. Dependency packages cannot impose root-level npm overrides or pnpm patches on a consuming application. Installing this module alone does not apply the patches.
+
+```sh
+node node_modules/@nuxtjp/localized-site/security/apply.mjs --project-root . --apply
+pnpm install --no-frozen-lockfile
+pnpm install --frozen-lockfile
+```
+
+Commit the generated `.nuxtjp-security/*.patch`, `package.json`, and lockfile in your application. The command does not run installs, access the network, or replace an existing conflicting patch. It preserves unrelated pnpm settings. Each root application must apply the patches, including CI checkouts.
+
+Run `node node_modules/@nuxtjp/localized-site/security/dependency-security.check.cjs` after installing the locked project to verify that the actual resolved dependencies reject the affected inputs. These are backports, not upstream fixed versions. Version-only advisory tools still report the two vulnerable upstream versions; retain their findings and link the lockfile/patch hashes and regression results. Reapply and reverify when dependency versions change. npm-only consumers require a separately reviewed override distribution; they are not certified by this pnpm procedure.
+
+The RSA test creates an ephemeral key in memory and never reads a user key. Patches contain code only and do not include credentials, customer content, or private endpoints.

package/security/apply.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/** Apply reviewed Nuxt dependency backports to an explicitly selected pnpm project. */
+import { fileURLToPath } from 'node:url'
+import { dirname } from 'node:path'
+import { applySecurityPatches } from './project.mjs'
+
+const args = process.argv.slice(2)
+if (args.length !== 3 || args[0] !== '--project-root' || args[2] !== '--apply') {
+  console.error('Usage: node apply.mjs --project-root PROJECT --apply')
+  process.exitCode = 2
+} else {
+  try {
+    applySecurityPatches(args[1], dirname(fileURLToPath(import.meta.url)))
+    console.log('Reviewed backports configured. Run pnpm install --no-frozen-lockfile to refresh the lockfile.')
+  } catch (error) {
+    console.error(error.message)
+    process.exitCode = 1
+  }
+}

package/security/dependency-security.check.cjs

@@ -0,0 +1,51 @@
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+const { createRequire } = require('node:module');
+const { generateKeyPairSync, sign, privateEncrypt, constants } = require('node:crypto');
+const path = require('node:path');
+const fs = require('node:fs');
+function dependency(name, version) {
+  const explicit = process.env['SECURITY_TEST_' + name.toUpperCase().replace('-', '_')];
+  if (explicit) return require(path.resolve(explicit));
+  const { installedDependencies } = require('./resolved-dependency.cjs');
+  const matches = installedDependencies(process.cwd(), name, version);
+  assert.equal(matches.length, 1, 'Expected one active locked dependency implementation');
+  return createRequire(matches[0])(name);
+}
+const braces = dependency('braces', '3.0.3');
+const forge = dependency('node-forge', '1.4.0');
+test('brace compilation, expansion and stringification retain ordinary behavior', () => {
+  assert.equal(braces.compile('src/{a,b}.vue'), 'src/(a|b).vue');
+  assert.deepEqual(braces.expand('src/{a,b}.vue'), ['src/a.vue', 'src/b.vue']);
+  assert.equal(braces.stringify(braces.parse('src/{a,b}.vue')), 'src/{a,b}.vue');
+  assert.equal(braces.compile('src/\\{a,b\\}.vue'), 'src/{a,b}.vue');
+});
+test('deep brace, parenthesis and caller AST inputs reject before stack exhaustion', () => {
+  for (const pattern of ['{'.repeat(6000) + 'a,b' + '}'.repeat(6000), '('.repeat(6000) + 'x' + ')'.repeat(6000), '{'.repeat(6000) + 'x']) {
+    for (const fn of [braces.compile, braces.expand, braces.stringify, braces.parse]) assert.throws(() => fn(pattern), SyntaxError);
+  }
+  let ast = { type: 'text', value: 'x' };
+  for (let i = 0; i < 6000; i++) ast = { type: 'root', nodes: [ast] };
+  for (const fn of [braces.compile, braces.expand, braces.stringify]) assert.throws(() => fn(ast), SyntaxError);
+  const cyclic = { type: 'root', nodes: [] }; cyclic.nodes.push(cyclic);
+  assert.throws(() => braces.compile(cyclic), SyntaxError);
+});
+test('RSA verifier accepts standard signatures and rejects extra or malformed DigestAlgorithm elements', () => {
+  const keys = generateKeyPairSync('rsa', { modulusLength: 2048 });
+  const publicKey = forge.pki.publicKeyFromPem(keys.publicKey.export({ type: 'spki', format: 'pem' }));
+  const data = Buffer.from('never-issued security regression fixture');
+  const md = forge.md.sha256.create(); md.update(data.toString('binary'));
+  const digest = md.digest().getBytes();
+  assert.equal(publicKey.verify(digest, sign('sha256', data, keys.privateKey).toString('binary')), true);
+  const a = forge.asn1;
+  const oid = () => a.create(a.Class.UNIVERSAL, a.Type.OID, false, a.oidToDer(forge.oids.sha256).getBytes());
+  const nil = value => a.create(a.Class.UNIVERSAL, a.Type.NULL, false, value);
+  for (const parameters of [[oid(), nil(''), oid()], [oid(), a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, [oid()])], [oid(), nil('x')]]) {
+    const info = a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, [a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, parameters), a.create(a.Class.UNIVERSAL, a.Type.OCTETSTRING, false, digest)]);
+    const encoded = Buffer.from(a.toDer(info).getBytes(), 'binary');
+    const signature = privateEncrypt({ key: keys.privateKey, padding: constants.RSA_PKCS1_PADDING }, encoded).toString('binary');
+    let accepted = false;
+    try { accepted = publicKey.verify(digest, signature); } catch { /* Rejection is the expected result for a malformed signature. */ }
+    assert.equal(accepted, false, 'Malformed algorithm must not verify');
+  }
+});

package/security/patches/braces@3.0.3.patch

@@ -0,0 +1,92 @@
+diff --git a/lib/depth-guard.js b/lib/depth-guard.js
+new file mode 100644
+--- /dev/null
++++ b/lib/depth-guard.js
+@@ -0,0 +1,19 @@
++'use strict';
++
++// Wonderland security backport: bound recursive walkers, including caller ASTs.
++module.exports = ast => {
++  const pending = [[ast, 0]];
++  const seen = new Set();
++  let count = 0;
++  while (pending.length) {
++    const [node, depth] = pending.pop();
++    if (depth > 64 || ++count > 100000 || seen.has(node)) {
++      throw new SyntaxError('Brace pattern exceeds safe AST bounds');
++    }
++    if (!node || typeof node !== 'object') continue;
++    seen.add(node);
++    if (Array.isArray(node.nodes)) {
++      for (const child of node.nodes) pending.push([child, depth + 1]);
++    }
++  }
++};
+diff --git a/lib/parse.js b/lib/parse.js
+--- a/lib/parse.js
++++ b/lib/parse.js
+@@ -144,6 +144,7 @@
+ 
+     if (value === CHAR_LEFT_PARENTHESES) {
+       block = push({ type: 'paren', nodes: [] });
++      if (stack.length >= 64) throw new SyntaxError('Brace pattern exceeds safe nesting depth');
+       stack.push(block);
+       push({ type: 'text', value });
+       continue;
+@@ -210,6 +211,7 @@
+       };
+ 
+       block = push(brace);
++      if (stack.length >= 64) throw new SyntaxError('Brace pattern exceeds safe nesting depth');
+       stack.push(block);
+       push({ type: 'open', value });
+       continue;
+diff --git a/lib/compile.js b/lib/compile.js
+--- a/lib/compile.js
++++ b/lib/compile.js
+@@ -1,9 +1,12 @@
+ 'use strict';
++
++const assertDepth = require('./depth-guard');
+ 
+ const fill = require('fill-range');
+ const utils = require('./utils');
+ 
+ const compile = (ast, options = {}) => {
++  assertDepth(ast);
+   const walk = (node, parent = {}) => {
+     const invalidBlock = utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+diff --git a/lib/expand.js b/lib/expand.js
+--- a/lib/expand.js
++++ b/lib/expand.js
+@@ -1,4 +1,6 @@
+ 'use strict';
++
++const assertDepth = require('./depth-guard');
+ 
+ const fill = require('fill-range');
+ const stringify = require('./stringify');
+@@ -31,6 +33,7 @@
+ };
+ 
+ const expand = (ast, options = {}) => {
++  assertDepth(ast);
+   const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit;
+ 
+   const walk = (node, parent = {}) => {
+diff --git a/lib/stringify.js b/lib/stringify.js
+--- a/lib/stringify.js
++++ b/lib/stringify.js
+@@ -1,8 +1,11 @@
+ 'use strict';
++
++const assertDepth = require('./depth-guard');
+ 
+ const utils = require('./utils');
+ 
+ module.exports = (ast, options = {}) => {
++  assertDepth(ast);
+   const stringify = (node, parent = {}) => {
+     const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;

package/security/patches/node-forge@1.4.0.patch

@@ -0,0 +1,20 @@
+diff --git a/lib/rsa.js b/lib/rsa.js
+--- a/lib/rsa.js
++++ b/lib/rsa.js
+@@ -1172,7 +1172,15 @@
+           var capture = {};
+           var errors = [];
+           if(!asn1.validate(obj, digestInfoValidator, capture, errors) ||
+-            obj.value.length !== 2) {
++            obj.value.length !== 2 ||
++            // Wonderland security backport: AlgorithmIdentifier has one OID
++            // and, optionally, exactly one empty primitive NULL parameter.
++            obj.value[0].value.length < 1 || obj.value[0].value.length > 2 ||
++            (obj.value[0].value.length === 2 &&
++              (obj.value[0].value[1].tagClass !== asn1.Class.UNIVERSAL ||
++               obj.value[0].value[1].type !== asn1.Type.NULL ||
++               obj.value[0].value[1].constructed !== false ||
++               obj.value[0].value[1].value !== ''))) {
+             var error = new Error(
+               'ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 ' +
+               'DigestInfo value.');

package/security/project.mjs

@@ -0,0 +1,61 @@
+/** Configure caller-owned pnpm backports without executing installs or changing unrelated settings. */
+import { existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSync, unlinkSync, realpathSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { randomUUID } from 'node:crypto'
+
+const patches = ['braces@3.0.3', 'node-forge@1.4.0']
+function regular(path) {
+  const stat = lstatSync(path)
+  if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 1024 * 1024) {
+    throw new Error('Expected a bounded regular project or patch file')
+  }
+  return readFileSync(path)
+}
+function object(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+/** Reject conflicting patches and links before mutating a project. No network access occurs. */
+export function applySecurityPatches(project, source) {
+  const root = realpathSync(resolve(project))
+  const manifest = join(root, 'package.json')
+  const original = regular(manifest)
+  const data = JSON.parse(original)
+  if (!object(data) || (data.pnpm !== undefined && !object(data.pnpm))) {
+    throw new Error('Expected a package manifest with object-valued pnpm settings')
+  }
+  const pnpm = data.pnpm ?? {}
+  const existing = pnpm.patchedDependencies ?? {}
+  if (!object(existing)) throw new Error('Expected object-valued patchedDependencies')
+  const dir = join(root, '.nuxtjp-security')
+  if (existsSync(dir) && (lstatSync(dir).isSymbolicLink() || !lstatSync(dir).isDirectory())) {
+    throw new Error('Security patch directory must be a real directory')
+  }
+  const inputs = patches.map(name => {
+    const relative = `.nuxtjp-security/${name}.patch`
+    if (existing[name] !== undefined && existing[name] !== relative) {
+      throw new Error('An existing dependency patch conflicts; review it before applying')
+    }
+    const bytes = regular(join(source, 'patches', `${name}.patch`))
+    const target = join(root, relative)
+    if (existsSync(target) && !regular(target).equals(bytes)) {
+      throw new Error('An existing patch differs; no files were overwritten')
+    }
+    return { name, relative, bytes, target }
+  })
+  if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed during preparation')
+  mkdirSync(dir, { recursive: true })
+  for (const patch of inputs) {
+    if (!existsSync(patch.target)) writeFileSync(patch.target, patch.bytes, { flag: 'wx' })
+    existing[patch.name] = patch.relative
+  }
+  data.pnpm = { ...pnpm, patchedDependencies: existing }
+  const temporary = join(root, `.nuxtjp-manifest-${randomUUID()}.tmp`)
+  try {
+    writeFileSync(temporary, JSON.stringify(data, null, 2) + '\n', { flag: 'wx' })
+    if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed; retry after review')
+    renameSync(temporary, manifest)
+  } finally {
+    if (existsSync(temporary)) unlinkSync(temporary)
+  }
+}

package/security/resolved-dependency.cjs

@@ -0,0 +1,40 @@
+/** Resolve a dependency through the installed application graph, ignoring unused store entries. */
+const fs = require('node:fs');
+const path = require('node:path');
+const { createRequire } = require('node:module');
+
+function installedDependencies(root, target, version) {
+  root = fs.realpathSync(root);
+  const pending = [path.join(root, 'package.json')];
+  const seen = new Set();
+  const found = new Set();
+  while (pending.length) {
+    if (seen.size > 5000) throw new Error('Installed dependency graph exceeds verification budget');
+    const file = pending.pop();
+    if (seen.has(file)) continue;
+    seen.add(file);
+    const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (data.name === target) {
+      if (data.version !== version) throw new Error('Dependency version changed; review its security patch');
+      found.add(file);
+    }
+    const request = createRequire(file);
+    const names = Object.keys({ ...data.dependencies, ...data.optionalDependencies, ...data.peerDependencies,
+      ...(file === path.join(root, 'package.json') ? data.devDependencies : {}) });
+    for (const name of names) {
+      for (const location of request.resolve.paths(name) ?? []) {
+        const candidate = path.join(location, name, 'package.json');
+        if (!fs.existsSync(candidate)) continue;
+        const real = fs.realpathSync(candidate);
+        if (!real.startsWith(path.join(root, 'node_modules') + path.sep)) {
+          throw new Error('Dependency resolves outside the selected project; select the workspace root');
+        }
+        pending.push(real);
+        break;
+      }
+    }
+  }
+  if (found.size === 0) throw new Error('Dependency not present in the installed application graph');
+  return [...found].sort();
+}
+module.exports = { installedDependencies };