@nuxtjp/localized-site 0.1.1 → 0.1.3

package/README.md

@@ -64,3 +64,7 @@ pnpm pack
 
 Code: [Apache-2.0](LICENSE). [LICENSE-PREVIOUS](LICENSE-PREVIOUS) retains prior grants, and [NOTICE](NOTICE) preserves attribution.
 [LICENSE-ASSETS](LICENSE-ASSETS) retains separate terms for covered brand/content assets. It does not change the code license or grant rights to third-party or site-owned content.
+
+## Consumer dependency security
+
+See [dependency security backports](security/README.md) before installing this package in a Nuxt application. pnpm consumers must explicitly apply the included backports and verify their locked dependency tree; ordinary npm installation does not apply them.

package/bin/nuxtjp-localized-site.mjs

@@ -1,7 +1,15 @@
 #!/usr/bin/env node
 import { runValidatorCli } from '../validator/content/cli.js'
 
-process.exitCode = await runValidatorCli(process.argv.slice(2), {
+if (process.argv[2] === 'site') {
+  try {
+    const { runOrganizationCli } = await import('../organization/cli.mjs')
+    process.exitCode = await runOrganizationCli(process.argv.slice(3))
+  } catch (error) {
+    console.error(error.message)
+    process.exitCode = 1
+  }
+} else process.exitCode = await runValidatorCli(process.argv.slice(2), {
   out: value => process.stdout.write(`${value}\n`),
   error: value => process.stderr.write(`${value}\n`)
 })

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": "^4.5.1"
   },
-  "version": "0.1.1",
+  "version": "0.1.3",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/organization/app.vue

@@ -0,0 +1,5 @@
+<template>
+  <NuxtLayout>
+    <NuxtPage />
+  </NuxtLayout>
+</template>

package/organization/cli.mjs

@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { join, dirname } from 'node:path'
+import { organizationSites, siteDirectory, checkSitePublication } from './index.mjs'
+import { loadSiteConfig } from '../validator/content/index.js'
+import { localizedHead, siteRoutes } from '../dist/runtime/core/index.js'
+
+export async function runOrganizationCli(args, root = process.cwd()) {
+  const [command, key, ...extra] = args
+  if (extra.length || !['list', 'check', 'dev', 'build', 'typecheck', 'preview'].includes(command)) {
+    throw new Error('usage: nuxtjp-localized-site site <list|check|dev|build|typecheck|preview> [SITE_ID]')
+  }
+  const keys = organizationSites(root)
+  if (key !== undefined) siteDirectory(root, key)
+  if (command === 'list') { console.log(JSON.stringify(keys)); return 0 }
+  const selected = key === undefined ? keys : [key]
+  const all = keys.map(id => loadSiteConfig(siteDirectory(root, id)))
+  for (const field of ['siteId', 'origin']) {
+    assert.equal(new Set(all.map(config => config[field])).size, all.length, `Duplicate ${field}`)
+  }
+  for (const id of selected) {
+    const config = loadSiteConfig(siteDirectory(root, id))
+    const routes = siteRoutes(config)
+    assert.equal(config.externalActions, false)
+    assert.equal(config.defaultLocale, config.audienceScope === 'japan' ? 'ja' : 'en')
+    assert.equal(new Set(routes).size, routes.length)
+    assert.equal(routes.length, 8)
+    for (const route of routes) {
+      const head = localizedHead(route, config)
+      assert.ok(head.link.some(link => link.rel === 'canonical' && new URL(link.href).origin === new URL(config.origin).origin))
+    }
+    checkSitePublication(root, id)
+    if (command === 'check') console.log(JSON.stringify({ site: id, siteId: config.siteId, routes: routes.length }))
+  }
+  if (command === 'check') return 0
+  if (key === undefined) throw new Error('SITE_ID is required for Nuxt commands')
+  // Resolve the installed consumer CLI without a shell or a package-manager download.
+  const require = createRequire(join(root, 'package.json'))
+  const manifestPath = require.resolve('nuxt/package.json')
+  const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+  const bin = typeof manifest.bin === 'string' ? manifest.bin : manifest.bin.nuxt
+  if (!bin) throw new Error('Installed Nuxt CLI not found')
+  const run = (file, args) => new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [file, ...args], {
+      cwd: root, stdio: 'inherit', env: { ...process.env, SITE_ID: key, NUXT_TELEMETRY_DISABLED: '1' }
+    })
+    child.on('error', reject)
+    child.on('exit', (code, signal) => resolve(signal ? 1 : code ?? 1))
+  })
+  if (command === 'typecheck') {
+    const prepared = await run(join(dirname(manifestPath), bin), ['prepare'])
+    if (prepared !== 0) return prepared
+    return await run(require.resolve('vue-tsc/bin/vue-tsc.js'), ['--noEmit', '--project', join(root, '.nuxt', key, 'tsconfig.json')])
+  }
+  return await run(join(dirname(manifestPath), bin), [command === 'build' ? 'generate' : command])
+}

package/organization/index.d.mts

@@ -0,0 +1,12 @@
+export function organizationSites(root: string): string[];
+export function siteDirectory(root: string, key: string): string;
+export function organizationSite(configUrl: string, key?: string): {
+  srcDir: string;
+  devtools: { enabled: boolean };
+  buildDir: string;
+  dir: { public: string };
+  modules: [string, { contentRoot: string }][];
+  nitro: { output: { dir: string }; prerender: { failOnError: boolean } };
+};
+export function checkPublicCatalog(policy: unknown, catalog: unknown): { scope: string; entries: number };
+export function checkSitePublication(root: string, key: string): { scope: string; entries: number } | null;

package/organization/index.mjs

@@ -0,0 +1,77 @@
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import assert from 'node:assert/strict'
+
+const keyPattern = /^[a-z0-9]+(?:-[a-z0-9]+)*$/
+
+function directory(path) {
+  if (!existsSync(path) || lstatSync(path).isSymbolicLink() || !lstatSync(path).isDirectory()) {
+    throw new Error('Expected a real organization site directory')
+  }
+  return realpathSync(path)
+}
+
+export function organizationSites(root) {
+  const sites = directory(join(directory(root), 'sites'))
+  const keys = readdirSync(sites).sort()
+  if (!keys.length) throw new Error('No organization sites configured')
+  for (const key of keys) siteDirectory(root, key)
+  return keys
+}
+
+export function siteDirectory(root, key) {
+  if (typeof key !== 'string' || !keyPattern.test(key)) throw new Error('Invalid SITE_ID')
+  const sites = directory(join(directory(root), 'sites'))
+  const path = directory(join(sites, key))
+  if (dirname(path) !== sites) throw new Error('Site must remain within sites/')
+  const config = join(path, 'site.config.json')
+  if (!existsSync(config) || lstatSync(config).isSymbolicLink() || !lstatSync(config).isFile()) {
+    throw new Error('Site configuration must be a regular file')
+  }
+  for (const name of ['package.json', 'nuxt.config.ts', 'app.vue', 'layouts', 'pages', 'components']) {
+    if (existsSync(join(path, name))) throw new Error('Site-specific Nuxt applications/layouts are not permitted')
+  }
+  return path
+}
+
+export function organizationSite(configUrl, key = process.env.SITE_ID) {
+  const root = dirname(fileURLToPath(configUrl))
+  const contentRoot = siteDirectory(root, key)
+  return {
+    srcDir: dirname(fileURLToPath(import.meta.url)),
+    devtools: { enabled: false },
+    buildDir: join(root, '.nuxt', key),
+    dir: { public: join(contentRoot, 'public') },
+    modules: [['@nuxtjp/localized-site', { contentRoot }]],
+    nitro: {
+      output: { dir: join(root, '.output', key) },
+      prerender: { failOnError: true }
+    }
+  }
+}
+
+export function checkPublicCatalog(policy, catalog) {
+  assert.equal(policy.scope, 'public')
+  assert.ok(Array.isArray(policy.repository_ids) && policy.repository_ids.length > 0)
+  assert.equal(new Set(policy.repository_ids).size, policy.repository_ids.length)
+  assert.ok(Array.isArray(catalog.entries))
+  assert.deepEqual(catalog.entries.map(entry => entry.repository_id).sort(), [...policy.repository_ids].sort(),
+    'Catalog visibility gate failed: entries must match the reviewed public allowlist exactly')
+  return { scope: 'public', entries: catalog.entries.length }
+}
+
+export function checkSitePublication(root, key) {
+  const path = siteDirectory(root, key)
+  const policy = join(path, 'public-package-policy.json')
+  const catalog = join(path, 'public/catalog/v2/index.json')
+  if (existsSync(policy) || existsSync(catalog)) {
+    for (const file of [policy, catalog]) {
+      if (!existsSync(file) || lstatSync(file).isSymbolicLink() || !lstatSync(file).isFile()) {
+        throw new Error('Public catalog and reviewed policy must both exist as regular files')
+      }
+    }
+    return checkPublicCatalog(JSON.parse(readFileSync(policy, 'utf8')), JSON.parse(readFileSync(catalog, 'utf8')))
+  }
+  return null
+}

package/organization/workspace.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { organizationSites } from './index.mjs'
+
+const [command, input] = process.argv.slice(2)
+if (!['module', 'verify'].includes(command) || !input || process.argv.length !== 4) {
+  throw new Error('usage: workspace.mjs <module|verify> WORKSPACE_ROOT')
+}
+const root = resolve(input)
+const moduleRoot = join(root, 'organizations/nuxtjp/nuxt-localized-site')
+if (command === 'module') console.log(moduleRoot)
+else {
+  for (const organization of readdirSync(join(root, 'organizations'), { withFileTypes: true })) {
+    if (!organization.isDirectory() || organization.isSymbolicLink()) continue
+    const owner = join(root, 'organizations', organization.name)
+    for (const entry of readdirSync(owner, { withFileTypes: true })) {
+      if (!entry.isDirectory() || entry.isSymbolicLink()) continue
+      const repository = join(owner, entry.name)
+      if (!existsSync(join(repository, 'sites')) || !existsSync(join(repository, 'package.json'))) continue
+      const manifest = JSON.parse(readFileSync(join(repository, 'package.json'), 'utf8'))
+      if (!manifest.dependencies?.['@nuxtjp/localized-site']) continue
+      const commands = [['test'], ...organizationSites(repository).flatMap(key => [['site', 'typecheck', key], ['site', 'build', key]])]
+      for (const args of commands) {
+        const result = spawnSync('pnpm', args, { cwd: repository, stdio: 'inherit' })
+        if (result.status !== 0) process.exit(result.status ?? 1)
+      }
+    }
+  }
+}

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@nuxtjp/localized-site",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Contract-first Japanese and English public-site module for Nuxt",
   "type": "module",
   "license": "Apache-2.0",
+  "packageManager": "pnpm@10.29.3",
   "engines": {
     "node": "^22.19.0 || ^24.11.0",
     "pnpm": ">=10 <11"
@@ -19,7 +20,10 @@
     "NOTICE",
     "LICENSE-ASSETS",
     "LICENSE-PREVIOUS",
-    "README.ja.md"
+    "README.ja.md",
+    "organization",
+    "security",
+    "ASSET-SCOPE.md"
   ],
   "bin": {
     "nuxtjp-localized-site": "./bin/nuxtjp-localized-site.mjs"
@@ -39,20 +43,36 @@
       "types": "./validator/content/index.d.ts",
       "import": "./validator/content/index.js"
     },
-    "./schema": "./schemas/localized-site-v1.schema.json"
+    "./schema": "./schemas/localized-site-v1.schema.json",
+    "./organization": {
+      "types": "./organization/index.d.mts",
+      "import": "./organization/index.mjs"
+    }
+  },
+  "scripts": {
+    "build:module": "nuxt-module-build build",
+    "build:validator": "tsc -p tsconfig.validator.json",
+    "build": "pnpm run build:validator && pnpm run build:module && nuxt build playground",
+    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
+    "test": "vitest run && pnpm run test:organization && pnpm run test:dependency-security && pnpm run test:consumer-security",
+    "validate:example": "node ./bin/nuxtjp-localized-site.mjs validate --content-root ./examples/content",
+    "prepack": "pnpm test && pnpm typecheck && pnpm build && pnpm validate:example",
+    "test:organization": "pnpm run build:validator && pnpm run build:module && node --test test/organization-check.mjs",
+    "test:dependency-security": "node --test scripts/dependency-security.check.cjs",
+    "test:consumer-security": "node --test scripts/consumer-security.check.mjs"
   },
   "peerDependencies": {
     "nuxt": "^4.5.1",
     "vue": "^3.5.40"
   },
   "dependencies": {
-    "@nuxt/kit": "4.5.1",
+    "@nuxt/kit": "4.5.2",
     "@nuxt/schema": "4.5.1"
   },
   "devDependencies": {
     "@nuxt/module-builder": "1.0.2",
     "@types/node": "24.12.0",
-    "nuxt": "4.5.1",
+    "nuxt": "4.5.2",
     "typescript": "5.9.3",
     "vitest": "4.1.11",
     "vue": "3.5.43",
@@ -67,12 +87,16 @@
     "access": "public",
     "provenance": true
   },
-  "scripts": {
-    "build:module": "nuxt-module-build build",
-    "build:validator": "tsc -p tsconfig.validator.json",
-    "build": "pnpm run build:validator && pnpm run build:module && nuxt build playground",
-    "typecheck": "vue-tsc --noEmit --project tsconfig.json",
-    "test": "vitest run",
-    "validate:example": "node ./bin/nuxtjp-localized-site.mjs validate --content-root ./examples/content"
+  "pnpm": {
+    "overrides": {
+      "@nuxt/devtools>simple-git": "4.0.2",
+      "simple-git": "4.0.2",
+      "@simple-git/argv-parser": "2.0.1",
+      "esbuild": "0.28.2"
+    },
+    "patchedDependencies": {
+      "braces@3.0.3": "patches/braces@3.0.3.patch",
+      "node-forge@1.4.0": "patches/node-forge@1.4.0.patch"
+    }
   }
-}
+}

package/security/LICENSE-braces

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014-present, Jon Schlinkert.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/security/LICENSE-node-forge

@@ -0,0 +1,331 @@
+You may use the Forge project under the terms of either the BSD License or the
+GNU General Public License (GPL) Version 2.
+
+The BSD License is recommended for most projects. It is simple and easy to
+understand and it places almost no restrictions on what you can do with the
+Forge project.
+
+If the GPL suits your project better you are also free to use Forge under
+that license.
+
+You don't have to do anything special to choose one license or the other and
+you don't have to notify anyone which license you are using. You are free to
+use this project in commercial projects as long as the copyright header is
+left intact.
+
+If you are a commercial entity and use this set of libraries in your
+commercial software then reasonable payment to Digital Bazaar, if you can
+afford it, is not required but is expected and would be appreciated. If this
+library saves you time, then it's saving you money. The cost of developing
+the Forge software was on the order of several hundred hours and tens of
+thousands of dollars. We are attempting to strike a balance between helping
+the development community while not being taken advantage of by lucrative
+commercial entities for our efforts.
+
+-------------------------------------------------------------------------------
+New BSD License (3-clause)
+Copyright (c) 2010, Digital Bazaar, Inc.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of Digital Bazaar, Inc. nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL DIGITAL BAZAAR BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+-------------------------------------------------------------------------------
+        GNU GENERAL PUBLIC LICENSE
+           Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+          Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+        GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+          NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+

package/security/README.md

@@ -0,0 +1,21 @@
+# Dependency security backports
+
+Two upstream dependencies have no fixed release: braces 3.0.3 (GHSA-vfj7-8cjw-p6xm) and node-forge 1.4.0 (GHSA-86w9-cpqp-85rv). The root configuration also requires simple-git 4.0.2, @simple-git/argv-parser 2.0.1 and esbuild 0.28.2 from the public registry to address their upstream advisories. Exact versions are maintained in `dependency-versions.json`. The included patches bound brace AST recursion and reject malformed RSA DigestAlgorithm parameters. Regression tests cover ordinary behavior and the malicious input shapes.
+
+The package is distributed through npm. A consumer must use pnpm 10 and explicitly configure the reviewed backports at its project root. Dependency packages cannot impose root-level npm overrides or pnpm patches on a consuming application. Installing this module alone does not apply the patches.
+
+```sh
+node node_modules/@nuxtjp/localized-site/security/apply.mjs --project-root . --apply
+pnpm install --no-frozen-lockfile
+pnpm install --frozen-lockfile
+```
+
+Commit the generated `.nuxtjp-security/*.patch`, `package.json`, and lockfile in your application. The command does not run installs, access the network, or replace an existing conflicting patch. It preserves unrelated pnpm settings. Each root application must apply the patches, including CI checkouts.
+
+Run `node node_modules/@nuxtjp/localized-site/security/dependency-security.check.cjs` after installing the locked project to verify that the actual resolved dependencies reject the affected inputs. These are backports, not upstream fixed versions. Version-only advisory tools still report the two vulnerable upstream versions; retain their findings and link the lockfile/patch hashes and regression results. Reapply and reverify when dependency versions change. npm-only consumers require a separately reviewed override distribution; they are not certified by this pnpm procedure.
+
+The RSA test creates an ephemeral key in memory and never reads a user key. Patches contain code only and do not include credentials, customer content, or private endpoints.
+
+Run `pnpm audit --json` on the installed application and retain the report. Only the two backported braces/node-forge advisories may remain; any other advisory, including simple-git, its argument parser, or esbuild, blocks validation. Run the dependency regression command on each install to reject missing or older active versions.
+
+The code patch inputs retain third-party notices in `LICENSE-braces` (MIT) and `LICENSE-node-forge`. The original dependencies remain registry packages; the shipped files configure and test the consumer rather than silently replacing its package manager.

package/security/apply.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/** Apply reviewed Nuxt dependency backports to an explicitly selected pnpm project. */
+import { fileURLToPath } from 'node:url'
+import { dirname } from 'node:path'
+import { applySecurityPatches } from './project.mjs'
+
+const args = process.argv.slice(2)
+if (args.length !== 3 || args[0] !== '--project-root' || args[2] !== '--apply') {
+  console.error('Usage: node apply.mjs --project-root PROJECT --apply')
+  process.exitCode = 2
+} else {
+  try {
+    applySecurityPatches(args[1], dirname(fileURLToPath(import.meta.url)))
+    console.log('Reviewed backports configured. Run pnpm install --no-frozen-lockfile to refresh the lockfile.')
+  } catch (error) {
+    console.error(error.message)
+    process.exitCode = 1
+  }
+}

package/security/dependency-security.check.cjs

@@ -0,0 +1,59 @@
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+const { createRequire } = require('node:module');
+const { generateKeyPairSync, sign, privateEncrypt, constants } = require('node:crypto');
+const path = require('node:path');
+const fs = require('node:fs');
+function dependency(name, version) {
+  const { installedDependencies } = require('./resolved-dependency.cjs');
+  const matches = installedDependencies(process.cwd(), name, version);
+  assert.equal(matches.length, 1, 'Expected one active locked dependency implementation');
+  return createRequire(matches[0])(name);
+}
+const braces = dependency('braces', '3.0.3');
+const forge = dependency('node-forge', '1.4.0');
+test('brace compilation, expansion and stringification retain ordinary behavior', () => {
+  assert.equal(braces.compile('src/{a,b}.vue'), 'src/(a|b).vue');
+  assert.deepEqual(braces.expand('src/{a,b}.vue'), ['src/a.vue', 'src/b.vue']);
+  assert.equal(braces.stringify(braces.parse('src/{a,b}.vue')), 'src/{a,b}.vue');
+  assert.equal(braces.compile('src/\\{a,b\\}.vue'), 'src/{a,b}.vue');
+});
+test('deep brace, parenthesis and caller AST inputs reject before stack exhaustion', () => {
+  for (const pattern of ['{'.repeat(6000) + 'a,b' + '}'.repeat(6000), '('.repeat(6000) + 'x' + ')'.repeat(6000), '{'.repeat(6000) + 'x']) {
+    for (const fn of [braces.compile, braces.expand, braces.stringify, braces.parse]) assert.throws(() => fn(pattern), SyntaxError);
+  }
+  let ast = { type: 'text', value: 'x' };
+  for (let i = 0; i < 6000; i++) ast = { type: 'root', nodes: [ast] };
+  for (const fn of [braces.compile, braces.expand, braces.stringify]) assert.throws(() => fn(ast), SyntaxError);
+  const cyclic = { type: 'root', nodes: [] }; cyclic.nodes.push(cyclic);
+  assert.throws(() => braces.compile(cyclic), SyntaxError);
+});
+test('RSA verifier accepts standard signatures and rejects extra or malformed DigestAlgorithm elements', () => {
+  const keys = generateKeyPairSync('rsa', { modulusLength: 2048 });
+  const publicKey = forge.pki.publicKeyFromPem(keys.publicKey.export({ type: 'spki', format: 'pem' }));
+  const data = Buffer.from('never-issued security regression fixture');
+  const md = forge.md.sha256.create(); md.update(data.toString('binary'));
+  const digest = md.digest().getBytes();
+  assert.equal(publicKey.verify(digest, sign('sha256', data, keys.privateKey).toString('binary')), true);
+  const a = forge.asn1;
+  const oid = () => a.create(a.Class.UNIVERSAL, a.Type.OID, false, a.oidToDer(forge.oids.sha256).getBytes());
+  const nil = value => a.create(a.Class.UNIVERSAL, a.Type.NULL, false, value);
+  for (const parameters of [[oid(), nil(''), oid()], [oid(), a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, [oid()])], [oid(), nil('x')]]) {
+    const info = a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, [a.create(a.Class.UNIVERSAL, a.Type.SEQUENCE, true, parameters), a.create(a.Class.UNIVERSAL, a.Type.OCTETSTRING, false, digest)]);
+    const encoded = Buffer.from(a.toDer(info).getBytes(), 'binary');
+    const signature = privateEncrypt({ key: keys.privateKey, padding: constants.RSA_PKCS1_PADDING }, encoded).toString('binary');
+    let accepted = false;
+    try { accepted = publicKey.verify(digest, signature); } catch { /* Rejection is the expected result for a malformed signature. */ }
+    assert.equal(accepted, false, 'Malformed algorithm must not verify');
+  }
+});
+
+test('active dependency graph uses every required upstream security version', () => {
+  const policy = JSON.parse(fs.readFileSync(path.join(__dirname, 'dependency-versions.json'), 'utf8'));
+  const { installedDependencies } = require('./resolved-dependency.cjs');
+  for (const [name, version] of Object.entries(policy.overrides)) {
+    const matches = installedDependencies(process.cwd(), name);
+    assert.ok(matches.length > 0, 'Required dependency is absent: ' + name);
+    for (const manifest of matches) assert.equal(JSON.parse(fs.readFileSync(manifest, 'utf8')).version, version, name);
+  }
+});

package/security/dependency-versions.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "overrides": {
+    "simple-git": "4.0.2",
+    "@simple-git/argv-parser": "2.0.1",
+    "esbuild": "0.28.2"
+  },
+  "backportedAdvisories": [
+    "GHSA-vfj7-8cjw-p6xm",
+    "GHSA-86w9-cpqp-85rv"
+  ]
+}

package/security/patches/braces@3.0.3.patch

@@ -0,0 +1,92 @@
+diff --git a/lib/depth-guard.js b/lib/depth-guard.js
+new file mode 100644
+--- /dev/null
++++ b/lib/depth-guard.js
+@@ -0,0 +1,19 @@
++'use strict';
++
++// Wonderland security backport: bound recursive walkers, including caller ASTs.
++module.exports = ast => {
++  const pending = [[ast, 0]];
++  const seen = new Set();
++  let count = 0;
++  while (pending.length) {
++    const [node, depth] = pending.pop();
++    if (depth > 64 || ++count > 100000 || seen.has(node)) {
++      throw new SyntaxError('Brace pattern exceeds safe AST bounds');
++    }
++    if (!node || typeof node !== 'object') continue;
++    seen.add(node);
++    if (Array.isArray(node.nodes)) {
++      for (const child of node.nodes) pending.push([child, depth + 1]);
++    }
++  }
++};
+diff --git a/lib/parse.js b/lib/parse.js
+--- a/lib/parse.js
++++ b/lib/parse.js
+@@ -144,6 +144,7 @@
+ 
+     if (value === CHAR_LEFT_PARENTHESES) {
+       block = push({ type: 'paren', nodes: [] });
++      if (stack.length >= 64) throw new SyntaxError('Brace pattern exceeds safe nesting depth');
+       stack.push(block);
+       push({ type: 'text', value });
+       continue;
+@@ -210,6 +211,7 @@
+       };
+ 
+       block = push(brace);
++      if (stack.length >= 64) throw new SyntaxError('Brace pattern exceeds safe nesting depth');
+       stack.push(block);
+       push({ type: 'open', value });
+       continue;
+diff --git a/lib/compile.js b/lib/compile.js
+--- a/lib/compile.js
++++ b/lib/compile.js
+@@ -1,9 +1,12 @@
+ 'use strict';
++
++const assertDepth = require('./depth-guard');
+ 
+ const fill = require('fill-range');
+ const utils = require('./utils');
+ 
+ const compile = (ast, options = {}) => {
++  assertDepth(ast);
+   const walk = (node, parent = {}) => {
+     const invalidBlock = utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+diff --git a/lib/expand.js b/lib/expand.js
+--- a/lib/expand.js
++++ b/lib/expand.js
+@@ -1,4 +1,6 @@
+ 'use strict';
++
++const assertDepth = require('./depth-guard');
+ 
+ const fill = require('fill-range');
+ const stringify = require('./stringify');
+@@ -31,6 +33,7 @@
+ };
+ 
+ const expand = (ast, options = {}) => {
++  assertDepth(ast);
+   const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit;
+ 
+   const walk = (node, parent = {}) => {
+diff --git a/lib/stringify.js b/lib/stringify.js
+--- a/lib/stringify.js
++++ b/lib/stringify.js
+@@ -1,8 +1,11 @@
+ 'use strict';
++
++const assertDepth = require('./depth-guard');
+ 
+ const utils = require('./utils');
+ 
+ module.exports = (ast, options = {}) => {
++  assertDepth(ast);
+   const stringify = (node, parent = {}) => {
+     const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;

package/security/patches/node-forge@1.4.0.patch

@@ -0,0 +1,20 @@
+diff --git a/lib/rsa.js b/lib/rsa.js
+--- a/lib/rsa.js
++++ b/lib/rsa.js
+@@ -1172,7 +1172,15 @@
+           var capture = {};
+           var errors = [];
+           if(!asn1.validate(obj, digestInfoValidator, capture, errors) ||
+-            obj.value.length !== 2) {
++            obj.value.length !== 2 ||
++            // Wonderland security backport: AlgorithmIdentifier has one OID
++            // and, optionally, exactly one empty primitive NULL parameter.
++            obj.value[0].value.length < 1 || obj.value[0].value.length > 2 ||
++            (obj.value[0].value.length === 2 &&
++              (obj.value[0].value[1].tagClass !== asn1.Class.UNIVERSAL ||
++               obj.value[0].value[1].type !== asn1.Type.NULL ||
++               obj.value[0].value[1].constructed !== false ||
++               obj.value[0].value[1].value !== ''))) {
+             var error = new Error(
+               'ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 ' +
+               'DigestInfo value.');

package/security/project.mjs

@@ -0,0 +1,76 @@
+/** Configure caller-owned pnpm backports without executing installs or changing unrelated settings. */
+import { existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSync, unlinkSync, realpathSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { randomUUID } from 'node:crypto'
+
+const patches = ['braces@3.0.3', 'node-forge@1.4.0']
+function regular(path) {
+  const stat = lstatSync(path)
+  if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 1024 * 1024) {
+    throw new Error('Expected a bounded regular project or patch file')
+  }
+  return readFileSync(path)
+}
+function object(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+/** Reject conflicting patches and links before mutating a project. No network access occurs. */
+export function applySecurityPatches(project, source) {
+  const root = realpathSync(resolve(project))
+  const manifest = join(root, 'package.json')
+  const original = regular(manifest)
+  const data = JSON.parse(original)
+  if (!object(data) || (data.pnpm !== undefined && !object(data.pnpm))) {
+    throw new Error('Expected a package manifest with object-valued pnpm settings')
+  }
+  const pnpm = data.pnpm ?? {}
+  const existing = pnpm.patchedDependencies ?? {}
+  if (!object(existing)) throw new Error('Expected object-valued patchedDependencies')
+  const pinned = JSON.parse(regular(join(source, 'dependency-versions.json')))
+  if (pinned.schemaVersion !== 1 || !object(pinned.overrides)) throw new Error('Invalid dependency version policy')
+  const overrides = pnpm.overrides ?? {}
+  if (!object(overrides)) throw new Error('Expected object-valued dependency overrides')
+  for (const [name, version] of Object.entries(pinned.overrides)) {
+    if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(name) || !/^\d+\.\d+\.\d+$/.test(version)) {
+      throw new Error('Exact registry package versions required')
+    }
+    for (const [selector, target] of Object.entries(overrides)) {
+      const dependency = selector.split('>').at(-1)
+      if ((dependency === name || dependency.startsWith(name + '@')) && target !== version) {
+        throw new Error('A dependency override conflicts; review it before applying')
+      }
+    }
+  }
+  const dir = join(root, '.nuxtjp-security')
+  if (existsSync(dir) && (lstatSync(dir).isSymbolicLink() || !lstatSync(dir).isDirectory())) {
+    throw new Error('Security patch directory must be a real directory')
+  }
+  const inputs = patches.map(name => {
+    const relative = `.nuxtjp-security/${name}.patch`
+    if (existing[name] !== undefined && existing[name] !== relative) {
+      throw new Error('An existing dependency patch conflicts; review it before applying')
+    }
+    const bytes = regular(join(source, 'patches', `${name}.patch`))
+    const target = join(root, relative)
+    if (existsSync(target) && !regular(target).equals(bytes)) {
+      throw new Error('An existing patch differs; no files were overwritten')
+    }
+    return { name, relative, bytes, target }
+  })
+  if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed during preparation')
+  mkdirSync(dir, { recursive: true })
+  for (const patch of inputs) {
+    if (!existsSync(patch.target)) writeFileSync(patch.target, patch.bytes, { flag: 'wx' })
+    existing[patch.name] = patch.relative
+  }
+  data.pnpm = { ...pnpm, patchedDependencies: existing, overrides: { ...overrides, ...pinned.overrides } }
+  const temporary = join(root, `.nuxtjp-manifest-${randomUUID()}.tmp`)
+  try {
+    writeFileSync(temporary, JSON.stringify(data, null, 2) + '\n', { flag: 'wx' })
+    if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed; retry after review')
+    renameSync(temporary, manifest)
+  } finally {
+    if (existsSync(temporary)) unlinkSync(temporary)
+  }
+}

package/security/resolved-dependency.cjs

@@ -0,0 +1,40 @@
+/** Resolve a dependency through the installed application graph, ignoring unused store entries. */
+const fs = require('node:fs');
+const path = require('node:path');
+const { createRequire } = require('node:module');
+
+function installedDependencies(root, target, version) {
+  root = fs.realpathSync(root);
+  const pending = [path.join(root, 'package.json')];
+  const seen = new Set();
+  const found = new Set();
+  while (pending.length) {
+    if (seen.size > 5000) throw new Error('Installed dependency graph exceeds verification budget');
+    const file = pending.pop();
+    if (seen.has(file)) continue;
+    seen.add(file);
+    const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (data.name === target) {
+      if (version !== undefined && data.version !== version) throw new Error('Dependency version changed; review its security patch');
+      found.add(file);
+    }
+    const request = createRequire(file);
+    const names = Object.keys({ ...data.dependencies, ...data.optionalDependencies, ...data.peerDependencies,
+      ...(file === path.join(root, 'package.json') ? data.devDependencies : {}) });
+    for (const name of names) {
+      for (const location of request.resolve.paths(name) ?? []) {
+        const candidate = path.join(location, name, 'package.json');
+        if (!fs.existsSync(candidate)) continue;
+        const real = fs.realpathSync(candidate);
+        if (!real.startsWith(path.join(root, 'node_modules') + path.sep)) {
+          throw new Error('Dependency resolves outside the selected project; select the workspace root');
+        }
+        pending.push(real);
+        break;
+      }
+    }
+  }
+  if (found.size === 0) throw new Error('Dependency not present in the installed application graph');
+  return [...found].sort();
+}
+module.exports = { installedDependencies };