@lenne.tech/nuxt-extensions 1.11.1 → 1.12.0

package/CLAUDE.md

@@ -76,6 +76,10 @@ export default defineNuxtConfig({
       enabled: true,
       basePath: '/ai',               // Must match the nest-server AI controller
     },
+    preHydrationInput: {
+      enabled: true,                 // keep text typed before hydration instead of losing it
+      maxRestoreMs: 1500,            // how long to keep repairing deferred subtrees
+    },
   },
 });
 ```
@@ -171,6 +175,35 @@ export default defineNuxtRouteMiddleware((to) => {
 });
 ```
 
+## Pre-Hydration Input Preservation
+
+**The defect:** until Vue hydrates a server-rendered `<input>`, it carries no framework
+listener. Text typed in that window goes into the DOM node, the `input` event reaches nothing,
+and `v-model`'s mounted hook then overwrites it. The entry is **erased, not delayed**. It is
+load-dependent, so it hides in development.
+
+**Vue already fixes most of it.** Since 3.5.41 (vuejs/core#14411) Vue adopts the typed value
+into the model on hydration — but only for `type="text"` and `textarea`. `email`, `password`,
+`tel`, `url`, `search` and `number` are still erased. Upstream tracking: vuejs/core#15210.
+
+**What this module adds:** `runtime/plugins/pre-hydration-input.client.ts` snapshots edited
+fields at `app:beforeMount` and restores them at `app:mounted`, dispatching a synthetic
+`input` event so `v-model` adopts the value.
+
+**What this means when you debug a consuming project:**
+
+- **Do not add a `readonly`-until-mounted guard to inputs.** It was tried and removed: it makes
+  the field look usable while silently refusing, suppresses browser autofill (`readonly` is the
+  documented technique for exactly that), makes screen readers announce "read only" with no
+  announcement when it flips back, and stops mobile browsers raising the on-screen keyboard.
+- A field is treated as edited when `value !== defaultValue`, so server-pre-filled values are
+  never restored over a legitimate change made during hydration.
+- Each field is restored at most once; a later programmatic clear is not undone.
+- This is a **stopgap**. When Vue widens its gate, delete the plugin —
+  `test/pre-hydration-input.test.ts` pins the current behaviour and will fail on the types Vue
+  takes over.
+- Opt out with `ltExtensions.preHydrationInput.enabled: false`.
+
 ## Development Rules
 
 1. **ALWAYS read source code** in `dist/runtime/` to understand available composables and components

package/README.md

@@ -41,6 +41,7 @@ npm install tus-js-client
 - **Transition Components** - Ready-to-use Vue transition wrappers
 - **i18n Support** - English and German translations (works without i18n too)
 - **Auto-imports** - All composables and components are auto-imported
+- **Pre-hydration input preservation** - text typed before hydration is kept, not erased
 
 ## Environment Variables
 
@@ -156,6 +157,70 @@ export default defineNuxtConfig({
 });
 ```
 
+## Pre-Hydration Input Preservation
+
+Text typed before a page has hydrated is kept instead of being silently thrown away.
+
+### The problem
+
+Until Vue hydrates a server-rendered `<input>`, the element carries **no framework listener**.
+Text typed in that window is written to the DOM node, the `input` event reaches nothing, and
+`v-model`'s mounted hook then writes the model value back over it. The entry is **erased, not
+delayed** — no error, no toast, nothing persisted.
+
+It is load-dependent, so it hides in development and shows up on a cold cache, a slow device
+or a throttled CPU — most often on the login screen, where people type on sight.
+
+### What Vue already does, and where it stops
+
+Vue fixed this in **3.5.41** ([vuejs/core#14411](https://github.com/vuejs/core/pull/14411)):
+on hydration it compares the field's live value against what the server rendered and, when
+they differ, adopts the typed value into the model instead of overwriting the node.
+
+That adoption is gated on `type="text"` and `textarea`. **Every other type still loses the
+entry** — and those are exactly the fields a sign-in form uses:
+
+| Input type | Typed before hydration |
+|------------|------------------------|
+| `text`, `textarea` | kept by Vue itself |
+| `email`, `password`, `tel`, `url`, `search`, `number` | **erased** |
+
+Widening the gate is tracked upstream as
+[vuejs/core#15210](https://github.com/vuejs/core/issues/15210) — open, labelled
+`p2-edge-case`, no milestone.
+
+### What this module adds
+
+A small client plugin that closes the remaining gap. Just before hydration it reads what is
+in each field; just after, it writes back anything that was overwritten and dispatches a
+synthetic `input` event so `v-model` adopts it.
+
+A field counts as edited when its value differs from `defaultValue` — the same test Vue uses,
+so values the server pre-filled are never mistaken for user input. A browser autofill that
+lands before hydration is recovered the same way.
+
+Fields stay ordinary editable fields throughout. Nothing is made `readonly`, so autofill,
+screen-reader semantics and the mobile on-screen keyboard are untouched, and the user never
+faces a field that looks usable and silently refuses.
+
+**This is a stopgap.** When Vue covers the remaining types, delete it —
+`test/pre-hydration-input.test.ts` pins the current gate and will fail on the types Vue takes
+over, which is the signal.
+
+### Opting out
+
+```ts
+export default defineNuxtConfig({
+  ltExtensions: {
+    preHydrationInput: {
+      enabled: false,
+      // or keep it on and only change how long deferred subtrees are waited for:
+      // maxRestoreMs: 3000,
+    },
+  },
+});
+```
+
 ## Usage
 
 ### Authentication

package/dist/module.d.mts

@@ -3,7 +3,7 @@ import { LtExtensionsModuleOptions } from '../dist/runtime/types/index.js';
 export * from '../dist/runtime/types/index.js';
 
 declare const name = "@lenne.tech/nuxt-extensions";
-declare const version = "1.11.1";
+declare const version = "1.12.0";
 declare const configKey = "ltExtensions";
 declare const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 declare const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";

package/dist/module.json

@@ -1,9 +1,9 @@
 {
   "configKey": "ltExtensions",
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.11.1",
+  "version": "1.12.0",
   "builder": {
-    "@nuxt/module-builder": "1.0.2",
+    "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"
   }
 }

package/dist/module.mjs

@@ -1,7 +1,7 @@
 import { defineNuxtModule, createResolver, tryResolveModule, addImports, addComponent, addPlugin, addRouteMiddleware } from '@nuxt/kit';
 
 const name = "@lenne.tech/nuxt-extensions";
-const version = "1.11.1";
+const version = "1.12.0";
 const configKey = "ltExtensions";
 const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";
@@ -39,6 +39,9 @@ const defaultOptions = {
   i18n: {
     autoMerge: true
   },
+  preHydrationInput: {
+    enabled: true
+  },
   tus: {
     defaultChunkSize: 5 * 1024 * 1024,
     // 5MB
@@ -64,6 +67,7 @@ const module$1 = defineNuxtModule({
       },
       errorTranslation: { ...defaultOptions.errorTranslation, ...options.errorTranslation },
       i18n: { ...defaultOptions.i18n, ...options.i18n },
+      preHydrationInput: { ...defaultOptions.preHydrationInput, ...options.preHydrationInput },
       tus: { ...defaultOptions.tus, ...options.tus }
     };
     const passkeyAvailable = !!await tryResolveModule("@better-auth/passkey/client", new URL(import.meta.url));
@@ -120,6 +124,10 @@ const module$1 = defineNuxtModule({
         enabled: resolvedOptions.errorTranslation?.enabled ?? true,
         defaultLocale: resolvedOptions.errorTranslation?.defaultLocale || "de"
       },
+      preHydrationInput: {
+        enabled: resolvedOptions.preHydrationInput?.enabled ?? true,
+        maxRestoreMs: resolvedOptions.preHydrationInput?.maxRestoreMs ?? 1500
+      },
       tus: {
         defaultChunkSize: resolvedOptions.tus?.defaultChunkSize || 5 * 1024 * 1024,
         defaultEndpoint: resolvedOptions.tus?.defaultEndpoint || "/files/upload"
@@ -208,6 +216,9 @@ const module$1 = defineNuxtModule({
         });
       });
     }
+    if (resolvedOptions.preHydrationInput.enabled !== false) {
+      addPlugin(resolve("./runtime/plugins/pre-hydration-input.client"));
+    }
     nuxt.options.build.transpile.push(resolve("./runtime"));
     nuxt.options.build.transpile.push("tus-js-client");
     console.log(`[${name}] Module loaded with config:`, {

package/dist/runtime/composables/auth/use-lt-auth.js

@@ -110,7 +110,7 @@ export function useLtAuth() {
     if (!isJwtMode.value || !jwtToken.value) return false;
     return switchToJwtMode();
   }
-  const PATHS_REQUIRING_COOKIES = ["/passkey/", "/two-factor/", "/2fa/"];
+  const PATHS_REQUIRING_COOKIES = ["/passkey/", "/two-factor/", "/2fa/", "/get-session"];
   function urlRequiresCookies(url) {
     return PATHS_REQUIRING_COOKIES.some((path) => url.includes(path));
   }

package/dist/runtime/lib/auth-client.d.ts

@@ -284,7 +284,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
     requestPasswordReset: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<{
         email: string;
         redirectTo?: string | undefined;
-    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth").Prettify<{
+    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: import("better-auth").Prettify<{
         email: string;
         redirectTo?: string | undefined;
     } & {
@@ -488,8 +488,9 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             scopes?: string[] | undefined;
             requestSignUp?: boolean | undefined;
             loginHint?: string | undefined;
+            additionalParams?: Record<string, string> | undefined;
             additionalData?: Record<string, any> | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth").Prettify<{
+        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: import("better-auth").Prettify<Omit<{
             provider: (string & {}) | "linear" | "huggingface" | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat";
             callbackURL?: string | undefined;
             newUserCallbackURL?: string | undefined;
@@ -512,9 +513,13 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             scopes?: string[] | undefined;
             requestSignUp?: boolean | undefined;
             loginHint?: string | undefined;
+            additionalParams?: Record<string, string> | undefined;
             additionalData?: Record<string, any> | undefined;
         } & {
             fetchOptions?: FetchOptions | undefined;
+        }, "provider"> & {
+            provider: string | (string & {});
+            fetchOptions?: FetchOptions | undefined;
         }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
             redirect: boolean;
             url: string;
@@ -546,11 +551,20 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             message?: string | undefined;
         }, FetchOptions["throw"] extends true ? true : false>>;
     };
-    signOut: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<{
-        query?: Record<string, any> | undefined;
+    signOut: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<{
+        callbackURL?: string | undefined;
+        disableRedirect?: boolean | undefined;
+        state?: string | undefined;
+    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0?: import("better-auth").Prettify<{
+        callbackURL?: string | undefined;
+        disableRedirect?: boolean | undefined;
+        state?: string | undefined;
+    } & {
         fetchOptions?: FetchOptions | undefined;
     }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
         success: boolean;
+        url: string | undefined;
+        redirect: boolean | undefined;
     }, {
         code?: string | undefined;
         message?: string | undefined;
@@ -664,7 +678,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
     verifyEmail: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<{
         token: string;
         callbackURL?: string | undefined;
-    }> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth").Prettify<{
+    }> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: import("better-auth").Prettify<{
         query: {
             token: string;
             callbackURL?: string | undefined;
@@ -679,7 +693,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
     sendVerificationEmail: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<{
         email: string;
         callbackURL?: string | undefined;
-    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth").Prettify<{
+    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: import("better-auth").Prettify<{
         email: string;
         callbackURL?: string | undefined;
     } & {
@@ -693,7 +707,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
     changeEmail: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<{
         newEmail: string;
         callbackURL?: string | undefined;
-    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth").Prettify<{
+    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: import("better-auth").Prettify<{
         newEmail: string;
         callbackURL?: string | undefined;
     } & {
@@ -704,7 +718,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         code?: string | undefined;
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
-    updateSession: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<Partial<{}>> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<import("better-auth/client").InferSessionUpdateCtx<{
+    updateSession: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<Partial<{}>> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0?: import("better-auth").Prettify<import("better-auth/client").InferSessionUpdateCtx<{
         basePath: string;
         baseURL: any;
         fetchOptions: {
@@ -729,7 +743,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
     updateUser: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<Partial<{}> & {
         name?: string | undefined;
         image?: string | undefined | null;
-    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<import("better-auth/client").InferUserUpdateCtx<{
+    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0?: import("better-auth").Prettify<import("better-auth/client").InferUserUpdateCtx<{
         basePath: string;
         baseURL: any;
         fetchOptions: {
@@ -746,7 +760,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         callbackURL?: string | undefined;
         password?: string | undefined;
         token?: string | undefined;
-    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<{
+    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0?: import("better-auth").Prettify<{
         callbackURL?: string | undefined;
         password?: string | undefined;
         token?: string | undefined;
@@ -762,7 +776,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         callback: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<{
             token: string;
             callbackURL?: string | undefined;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth").Prettify<{
+        }> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: import("better-auth").Prettify<{
             query: {
                 token: string;
                 callbackURL?: string | undefined;
@@ -776,7 +790,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             message?: string | undefined;
         }, FetchOptions["throw"] extends true ? true : false>>;
     };
-    listSessions: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<{
+    listSessions: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0?: import("better-auth").Prettify<{
         query?: Record<string, any> | undefined;
         fetchOptions?: FetchOptions | undefined;
     }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<import("better-auth").Prettify<{
@@ -794,7 +808,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
     }, FetchOptions["throw"] extends true ? true : false>>;
     revokeSession: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<{
         token: string;
-    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth").Prettify<{
+    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: import("better-auth").Prettify<{
         token: string;
     } & {
         fetchOptions?: FetchOptions | undefined;
@@ -804,7 +818,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         code?: string | undefined;
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
-    revokeSessions: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<{
+    revokeSessions: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0?: import("better-auth").Prettify<{
         query?: Record<string, any> | undefined;
         fetchOptions?: FetchOptions | undefined;
     }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
@@ -813,7 +827,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         code?: string | undefined;
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
-    revokeOtherSessions: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<{
+    revokeOtherSessions: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0?: import("better-auth").Prettify<{
         query?: Record<string, any> | undefined;
         fetchOptions?: FetchOptions | undefined;
     }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
@@ -830,14 +844,15 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             nonce?: string | undefined;
             accessToken?: string | undefined;
             refreshToken?: string | undefined;
-            scopes?: string[] | undefined;
         } | undefined;
         requestSignUp?: boolean | undefined;
         scopes?: string[] | undefined;
         errorCallbackURL?: string | undefined;
         disableRedirect?: boolean | undefined;
+        loginHint?: string | undefined;
+        additionalParams?: Record<string, string> | undefined;
         additionalData?: Record<string, any> | undefined;
-    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth").Prettify<{
+    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: import("better-auth").Prettify<{
         provider: unknown;
         callbackURL?: string | undefined;
         idToken?: {
@@ -845,12 +860,13 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             nonce?: string | undefined;
             accessToken?: string | undefined;
             refreshToken?: string | undefined;
-            scopes?: string[] | undefined;
         } | undefined;
         requestSignUp?: boolean | undefined;
         scopes?: string[] | undefined;
         errorCallbackURL?: string | undefined;
         disableRedirect?: boolean | undefined;
+        loginHint?: string | undefined;
+        additionalParams?: Record<string, string> | undefined;
         additionalData?: Record<string, any> | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
@@ -861,7 +877,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         code?: string | undefined;
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
-    listAccounts: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<{
+    listAccounts: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0?: import("better-auth").Prettify<{
         query?: Record<string, any> | undefined;
         fetchOptions?: FetchOptions | undefined;
     }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
@@ -871,17 +887,16 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         updatedAt: Date;
         userId: string;
         providerId: string;
+        issuer: string;
         accountId: string;
     }[], {
         code?: string | undefined;
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
     unlinkAccount: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<{
-        providerId: string;
-        accountId?: string | undefined;
-    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth").Prettify<{
-        providerId: string;
-        accountId?: string | undefined;
+        accountId: string;
+    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: import("better-auth").Prettify<{
+        accountId: string;
     } & {
         fetchOptions?: FetchOptions | undefined;
     }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
@@ -891,12 +906,18 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
     refreshToken: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<{
-        providerId: string;
-        accountId?: string | undefined;
+        accountId: string;
         userId?: string | undefined;
-    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth").Prettify<{
-        providerId: string;
-        accountId?: string | undefined;
+    } | {
+        useAccountCookie: true;
+        userId?: string | undefined;
+    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: import("better-auth").Prettify<{
+        accountId: string;
+        userId?: string | undefined;
+    } & {
+        fetchOptions?: FetchOptions | undefined;
+    }> | import("better-auth").Prettify<{
+        useAccountCookie: true;
         userId?: string | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
@@ -914,12 +935,18 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
     getAccessToken: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<{
-        providerId: string;
-        accountId?: string | undefined;
+        accountId: string;
         userId?: string | undefined;
-    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth").Prettify<{
-        providerId: string;
-        accountId?: string | undefined;
+    } | {
+        useAccountCookie: true;
+        userId?: string | undefined;
+    }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: import("better-auth").Prettify<{
+        accountId: string;
+        userId?: string | undefined;
+    } & {
+        fetchOptions?: FetchOptions | undefined;
+    }> | import("better-auth").Prettify<{
+        useAccountCookie: true;
         userId?: string | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
@@ -933,19 +960,29 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
     accountInfo: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<{
-        accountId?: string | undefined;
-        providerId?: string | undefined;
+        accountId: string;
         userId?: string | undefined;
-    }> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<{
-        query?: {
-            accountId?: string | undefined;
-            providerId?: string | undefined;
+    } | {
+        useAccountCookie: true;
+        userId?: string | undefined;
+    }> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: import("better-auth").Prettify<{
+        query: {
+            accountId: string;
             userId?: string | undefined;
-        } | undefined;
+        } | {
+            useAccountCookie: true;
+            userId?: string | undefined;
+        };
         fetchOptions?: FetchOptions | undefined;
-    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
+        account: {
+            id: string;
+            providerId: string;
+            issuer: string;
+            accountId: string;
+        };
         user: import("better-auth").OAuth2UserInfo;
-        data: Record<string, any>;
+        data: object;
     }, {
         code?: string | undefined;
         message?: string | undefined;
@@ -953,7 +990,7 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
     getSession: <FetchOptions extends import("better-auth").ClientFetchOption<never, Partial<{
         disableCookieCache?: unknown;
         disableRefresh?: unknown;
-    }> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<{
+    }> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0?: import("better-auth").Prettify<{
         query?: {
             disableCookieCache?: unknown;
             disableRefresh?: unknown;
@@ -983,6 +1020,27 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         code?: string | undefined;
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
+    hydrateSession: (session: {
+        user: import("better-auth").StripEmptyObjects<{
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+        }>;
+        session: import("better-auth").StripEmptyObjects<{
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+        }>;
+    } | null) => void;
     $ERROR_CODES: {
         USER_NOT_FOUND: {
             readonly code: "USER_NOT_FOUND";

package/dist/runtime/lib/auth-client.js

@@ -39,7 +39,8 @@ export function getOrCreateLtAuthClient(config) {
 }
 export function createLtAuthClient(config = {}) {
   const useProxy = isLocalDevApiProxy();
-  const defaultBaseURL = useProxy ? "" : import.meta.env?.VITE_API_URL || process.env.API_URL || "";
+  const envApiUrl = typeof import.meta.env?.VITE_API_URL === "string" ? import.meta.env.VITE_API_URL : void 0;
+  const defaultBaseURL = useProxy ? "" : envApiUrl || process.env.API_URL || "";
   const defaultBasePath = useProxy ? "/api/iam" : "/iam";
   const {
     baseURL = defaultBaseURL,

package/dist/runtime/plugins/auth-interceptor.client.js

@@ -29,7 +29,17 @@ export default (nuxtApp) => {
       "/forgot-password",
       "/reset-password",
       "/verify-email",
-      "/session",
+      // Better Auth's session routes, spelled out. A generic '/session' entry
+      // used to stand here and never matched anything: the routes are
+      // `get-session`, `list-sessions`, `revoke-session`, … — in every one of
+      // them the character before `session` is `-`, not `/`, so `url.includes`
+      // returned false. `/get-session` matters most: it is the URL the session
+      // probe below calls, and exempting it is what keeps a 401 from the probe
+      // out of this handler.
+      "/get-session",
+      "/list-sessions",
+      "/revoke-session",
+      "/revoke-other-sessions",
       "/token",
       // Passkey endpoints - handled by authFetch with JWT fallback
       "/passkey/",
@@ -43,19 +53,38 @@ export default (nuxtApp) => {
     ];
     return authEndpoints.some((endpoint) => url.includes(endpoint));
   }
+  const ALIVE_VERDICT_TTL_MS = 1e3;
+  let aliveVerdictValidUntil = 0;
   async function isSessionStillAlive() {
     try {
-      const { fetchWithAuth } = getAuth();
+      const { fetchWithAuth, isJwtMode, switchToJwtMode } = getAuth();
       const response = await fetchWithAuth(`${getLtApiBase()}/get-session`, { method: "GET" });
-      if (!response.ok) {
+      if (response.status === 401 || response.status === 403) {
         return false;
       }
+      if (!response.ok) {
+        return null;
+      }
       const data = await response.json().catch(() => null);
-      return Boolean(data && (data.user || data.session));
+      const alive = Boolean(data && (data.user || data.session));
+      if (alive && isJwtMode.value) {
+        await switchToJwtMode().catch(() => false);
+      }
+      return alive;
     } catch {
       return null;
     }
   }
+  async function probeSessionAlive() {
+    if (Date.now() < aliveVerdictValidUntil) {
+      return true;
+    }
+    const verdict = await isSessionStillAlive();
+    if (verdict === true) {
+      aliveVerdictValidUntil = Date.now() + ALIVE_VERDICT_TTL_MS;
+    }
+    return verdict;
+  }
   async function handleUnauthorized(requestUrl) {
     if (isHandling401) {
       return;
@@ -66,28 +95,35 @@ export default (nuxtApp) => {
     if (isPublicAuthRoute()) {
       return;
     }
+    const { clearUser, isAuthenticated } = getAuth();
+    if (!isAuthenticated.value) {
+      return;
+    }
     isHandling401 = true;
+    let loggingOut = false;
     try {
-      const { clearUser, isAuthenticated } = getAuth();
-      if (isAuthenticated.value) {
-        const sessionAlive = await isSessionStillAlive();
-        if (sessionAlive !== false) {
-          console.debug(
-            sessionAlive ? `[LtAuth Interceptor] 401 from ${requestUrl ?? "unknown URL"} but session is still valid \u2014 treating it as a permission error, not logging out` : "[LtAuth Interceptor] 401 received but session state could not be verified \u2014 not logging out"
-          );
-          return;
-        }
-        console.debug("[LtAuth Interceptor] Session expired, logging out...");
-        clearUser();
-        const router = nuxtApp.$router;
-        const currentPath = router?.currentRoute?.value?.fullPath;
-        const redirectQuery = currentPath && currentPath !== loginPath ? `?redirect=${encodeURIComponent(currentPath)}` : "";
-        window.location.href = loginPath + redirectQuery;
+      const sessionAlive = await probeSessionAlive();
+      if (sessionAlive !== false) {
+        console.debug(
+          sessionAlive ? `[LtAuth Interceptor] 401 from ${requestUrl ?? "unknown URL"} but session is still valid \u2014 treating it as a permission error, not logging out` : "[LtAuth Interceptor] 401 received but session state could not be verified \u2014 not logging out"
+        );
+        return;
       }
+      console.debug("[LtAuth Interceptor] Session expired, logging out...");
+      loggingOut = true;
+      clearUser();
+      const router = nuxtApp.$router;
+      const currentPath = router?.currentRoute?.value?.fullPath;
+      const redirectQuery = currentPath && currentPath !== loginPath ? `?redirect=${encodeURIComponent(currentPath)}` : "";
+      window.location.href = loginPath + redirectQuery;
     } finally {
-      setTimeout(() => {
+      if (loggingOut) {
+        setTimeout(() => {
+          isHandling401 = false;
+        }, 1e3);
+      } else {
         isHandling401 = false;
-      }, 1e3);
+      }
     }
   }
   const wrapMarker = "__ltAuthFetchWrapped";

package/dist/runtime/plugins/pre-hydration-input.client.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Pre-hydration input preservation — the part Vue does not do yet.
+ *
+ * ## What Vue already handles
+ *
+ * Until Vue hydrates a server-rendered `<input>`, the element carries no framework listener.
+ * What the user types is written to the DOM node, the `input` event reaches no model, and
+ * `v-model`'s mounted hook then writes the model value back over it — the entry is ERASED,
+ * not delayed.
+ *
+ * Vue fixed this in `vModelText` (vuejs/core#14411, shipped in 3.5.41): `created` records
+ * `el.defaultValue`, and `mounted` compares the live value against it. When they differ, the
+ * DOM value is pushed INTO the model instead of the node being overwritten.
+ *
+ * That adoption is gated on `el.type === 'text' || el.type === 'textarea'`. **Every other
+ * input type still falls through to the erasure** — `email`, `password`, `tel`, `url`,
+ * `search`, `number`. Verified against Vue 3.5.41 in `test/pre-hydration-input.test.ts`.
+ *
+ * Widening the gate is tracked upstream as vuejs/core#15210 (open, `p2-edge-case`, no
+ * milestone, PR #15211 pending). **This plugin is a stopgap for exactly that gap and should
+ * be deleted once the upstream fix lands** — the test above will start failing on the types
+ * Vue has taken over, which is the signal to remove it.
+ *
+ * ## Why this matters more than the gate suggests
+ *
+ * The uncovered types are precisely the ones a sign-in form uses. That is also where people
+ * type on sight, and where losing the entry is most expensive: a password silently truncated
+ * to its last few characters produces "invalid credentials", which sends the user down the
+ * wrong diagnostic path entirely.
+ *
+ * ## How it works
+ *
+ * At `app:beforeMount` the client bundle has loaded but hydration has not run, so every
+ * server-rendered field still holds whatever the user typed. A field is treated as edited
+ * when its live value differs from `defaultValue` — the same test Vue itself uses, so the
+ * server's own pre-filled values are never mistaken for user input.
+ *
+ * At `app:mounted` any field whose value was overwritten gets it back, followed by a
+ * synthetic `input` event so the framework's own listener adopts it. Setting `.value` alone
+ * would not do: the model would still hold the old value and the next render would wipe the
+ * node again.
+ *
+ * A browser autofill that landed before hydration is recovered the same way.
+ *
+ * ## Why not make the field `readonly` until mounted
+ *
+ * Declining the keystroke was the first approach tried and it is worse. The user is left with
+ * a field that looks usable and silently refuses, which reads as a broken page. It also costs
+ * real things: `readonly` is the documented technique for SUPPRESSING browser autofill,
+ * screen readers announce "read only" and never announce the silent flip back, and mobile
+ * browsers do not raise the on-screen keyboard for it. Preserving the entry avoids all of
+ * that, because the field is never anything other than a normal, editable field.
+ */
+type EditableField = HTMLInputElement | HTMLTextAreaElement;
+/**
+ * Collect fields the user edited before hydration.
+ *
+ * `value !== defaultValue` is the discriminator, matching Vue's own: `defaultValue` is what
+ * the server rendered, so a difference can only have come from the user (or from an autofill,
+ * which is just as worth keeping). Server-supplied values therefore never enter the snapshot
+ * and can never be restored over a legitimate change made during hydration.
+ */
+export declare function collectEditedFields(root: ParentNode): Map<EditableField, string>;
+/**
+ * Write a preserved value back onto a field and tell the framework about it.
+ *
+ * @returns `true` when a value was actually restored.
+ */
+export declare function restoreField(field: EditableField, value: string): boolean;
+declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
+export default _default;

package/dist/runtime/plugins/pre-hydration-input.client.js

@@ -0,0 +1,57 @@
+import { defineNuxtPlugin, useRuntimeConfig } from "#imports";
+export function collectEditedFields(root) {
+  const edited = /* @__PURE__ */ new Map();
+  for (const node of root.querySelectorAll("input, textarea")) {
+    const field = node;
+    if (field.value !== field.defaultValue) {
+      edited.set(field, field.value);
+    }
+  }
+  return edited;
+}
+export function restoreField(field, value) {
+  if (!field.isConnected || field.value === value) {
+    return false;
+  }
+  field.value = value;
+  field.dispatchEvent(new Event("input", { bubbles: true }));
+  return true;
+}
+export default defineNuxtPlugin({
+  // After the app's own plugins: the restore has to land once hydration has done its writes.
+  enforce: "post",
+  name: "lt-pre-hydration-input",
+  setup(nuxtApp) {
+    const options = useRuntimeConfig().public.ltExtensions?.preHydrationInput;
+    if (options?.enabled === false) {
+      return;
+    }
+    const maxRestoreMs = options?.maxRestoreMs ?? 1500;
+    let edited = /* @__PURE__ */ new Map();
+    nuxtApp.hook("app:beforeMount", () => {
+      edited = collectEditedFields(document);
+    });
+    nuxtApp.hook("app:mounted", () => {
+      if (edited.size === 0) {
+        return;
+      }
+      const sweep = () => {
+        for (const [field, value] of edited) {
+          if (restoreField(field, value)) {
+            edited.delete(field);
+          }
+        }
+      };
+      sweep();
+      if (maxRestoreMs <= 0) {
+        edited = /* @__PURE__ */ new Map();
+        return;
+      }
+      const interval = setInterval(sweep, 250);
+      setTimeout(() => {
+        clearInterval(interval);
+        edited = /* @__PURE__ */ new Map();
+      }, maxRestoreMs);
+    });
+  }
+});

package/dist/runtime/types/index.d.ts

@@ -1,5 +1,5 @@
 export type { LtAuthClientConfig, LtAuthMode, LtAuthResponse, LtAuthState, LtPasskeyAuthResult, LtPasskeyRegisterResult, LtUser, UseLtAuthReturn } from './auth.js';
 export type { LtFileInfo, LtUploadItem, LtUploadOptions, LtUploadProgress, LtUploadStatus, UseLtFileReturn, UseLtTusUploadReturn } from './upload.js';
-export type { LtAiModuleOptions, LtAuthCookieNamesOptions, LtAuthModuleOptions, LtErrorTranslationModuleOptions, LtExtensionsModuleOptions, LtExtensionsPublicRuntimeConfig, LtI18nModuleOptions, LtSystemSetupModuleOptions, LtTusModuleOptions, } from './module.js';
+export type { LtAiModuleOptions, LtAuthCookieNamesOptions, LtAuthModuleOptions, LtErrorTranslationModuleOptions, LtExtensionsModuleOptions, LtExtensionsPublicRuntimeConfig, LtI18nModuleOptions, LtPreHydrationInputOptions, LtSystemSetupModuleOptions, LtTusModuleOptions, } from './module.js';
 export type { LtErrorTranslationResponse, LtParsedError, UseLtErrorTranslationReturn } from './error.js';
 export type { LtAiAction, LtAiAvailableConnection, LtAiBudgetLimit, LtAiBudgetSummary, LtAiConnection, LtAiConnectionInput, LtAiConnectionPreference, LtAiEffectiveSlot, LtAiInteraction, LtAiMessage, LtAiMode, LtAiPlaceholder, LtAiPrompt, LtAiPromptHint, LtAiPromptHintInput, LtAiPromptInput, LtAiPromptRunInput, LtAiResponse, LtAiSlot, LtAiSlotInput, LtAiStreamEvent, LtAiStreamHandlers, LtAiUsage, LtAiUsageInfo, LtAiUsageScope, UseLtAiAdminReturn, UseLtAiChatOptions, UseLtAiChatReturn, UseLtAiConnectionsReturn, UseLtAiPlaceholdersReturn, UseLtAiPromptsReturn, UseLtAiReturn, UseLtAiUsageReturn, } from './ai.js';

package/dist/runtime/types/module.d.ts

@@ -129,9 +129,61 @@ export interface LtExtensionsModuleOptions {
     errorTranslation?: LtErrorTranslationModuleOptions;
     /** i18n configuration */
     i18n?: LtI18nModuleOptions;
+    /** Pre-hydration input preservation configuration */
+    preHydrationInput?: LtPreHydrationInputOptions;
     /** TUS upload module configuration */
     tus?: LtTusModuleOptions;
 }
+/**
+ * Pre-hydration input preservation.
+ *
+ * Until Vue hydrates a server-rendered `<input>`, the element carries no framework listener:
+ * text typed into it reaches no model and is then overwritten by the mounting value — ERASED,
+ * not delayed.
+ *
+ * Vue fixed this in 3.5.41 (vuejs/core#14411), but only for `type="text"` and `textarea`.
+ * Every other type still loses the entry: `email`, `password`, `tel`, `url`, `search`,
+ * `number` — precisely the fields a sign-in form uses, and where people are most likely to
+ * type on sight. Widening it is tracked upstream as vuejs/core#15210.
+ *
+ * This closes that remaining gap: what the user typed is read out of the DOM just before
+ * hydration and written back afterwards, with a synthetic `input` event so `v-model` adopts
+ * it. Fields stay ordinary editable fields throughout — nothing is made `readonly`, so
+ * autofill, screen-reader semantics and the mobile keyboard are untouched. A browser autofill
+ * that lands before hydration is recovered the same way.
+ *
+ * Applies to every `<input>` and `<textarea>` on the page, regardless of which UI library
+ * rendered it. It is a stopgap and is meant to be removed once Vue covers the remaining
+ * types.
+ *
+ * @example
+ * ```ts
+ * export default defineNuxtConfig({
+ *   ltExtensions: {
+ *     preHydrationInput: { enabled: false },
+ *   },
+ * });
+ * ```
+ */
+export interface LtPreHydrationInputOptions {
+    /**
+     * Enable preservation. Defaults to `true`.
+     *
+     * Turn it off only with a reason: the alternative is that a user who types immediately
+     * after a page appears loses the entry silently.
+     */
+    enabled?: boolean;
+    /**
+     * How long after mount to keep restoring, in milliseconds. Defaults to `1500`; `0` restores
+     * once and stops immediately.
+     *
+     * Most fields are repaired in the first pass. The window exists for subtrees whose mount is
+     * deferred — an unresolved `<Suspense>` boundary writes its model value later than
+     * `app:mounted`. When it elapses the snapshot is dropped, so preserved values, passwords
+     * included, are not kept alive for the session.
+     */
+    maxRestoreMs?: number;
+}
 /**
  * Public runtime config added by this module
  */
@@ -167,6 +219,10 @@ export interface LtExtensionsPublicRuntimeConfig {
             enabled: boolean;
             defaultLocale: string;
         };
+        preHydrationInput: {
+            enabled: boolean;
+            maxRestoreMs: number;
+        };
         tus: {
             defaultChunkSize: number;
             defaultEndpoint: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.11.1",
+  "version": "1.12.0",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",
@@ -99,21 +99,22 @@
     }
   },
   "devDependencies": {
-    "@better-auth/passkey": "1.6.23",
-    "@nuxt/module-builder": "1.0.2",
-    "@nuxt/schema": "4.4.8",
-    "@playwright/test": "1.61.1",
-    "@types/node": "26.1.1",
-    "@vitest/coverage-v8": "4.1.10",
-    "better-auth": "1.6.23",
-    "happy-dom": "20.10.6",
-    "nuxt": "4.4.8",
-    "oxfmt": "0.59.0",
-    "oxlint": "1.74.0",
+    "@better-auth/passkey": "1.7.1",
+    "@nuxt/module-builder": "1.0.3",
+    "@nuxt/schema": "4.5.2",
+    "@playwright/test": "1.62.1",
+    "@types/node": "26.2.0",
+    "@vitest/coverage-v8": "4.1.11",
+    "@vue/server-renderer": "3.5.41",
+    "better-auth": "1.7.1",
+    "happy-dom": "20.11.6",
+    "nuxt": "4.5.2",
+    "oxfmt": "0.64.0",
+    "oxlint": "1.79.0",
     "tus-js-client": "4.3.1",
     "typescript": "5.9.3",
-    "vitest": "4.1.10",
-    "vue-tsc": "3.3.7"
+    "vitest": "4.1.11",
+    "vue-tsc": "3.3.11"
   },
   "keywords": [
     "nuxt",