@lenne.tech/nuxt-extensions 1.18.1 → 1.18.2

package/dist/module.d.mts

@@ -3,7 +3,7 @@ import { LtExtensionsModuleOptions } from '../dist/runtime/types/index.js';
 export * from '../dist/runtime/types/index.js';
 
 declare const name = "@lenne.tech/nuxt-extensions";
-declare const version = "1.18.1";
+declare const version = "1.18.2";
 declare const configKey = "ltExtensions";
 declare const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 declare const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "configKey": "ltExtensions",
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.18.1",
+  "version": "1.18.2",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -2,7 +2,7 @@ import { defineNuxtModule, createResolver, tryResolveModule, addImports, addComp
 import { pathToFileURL } from 'node:url';
 
 const name = "@lenne.tech/nuxt-extensions";
-const version = "1.18.1";
+const version = "1.18.2";
 const configKey = "ltExtensions";
 const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";

package/dist/runtime/composables/auth/use-lt-auth.js

@@ -2,6 +2,7 @@ import { useNuxtApp, useCookie, useState, useRequestHeaders, ref, computed, watc
 import { ltArrayBufferToBase64Url, ltBase64UrlToUint8Array } from "../../utils/crypto.js";
 import { clearLtAuthCookies, getLtApiBase, getLtAuthCookieNames, resolveLtAuthState } from "../../lib/auth-state.js";
 import { useLtAuthClient } from "../use-lt-auth-client.js";
+const VALIDATE_SESSION_TIMEOUT_MS = 1e4;
 function useTranslation() {
   const nuxtApp = useNuxtApp();
   const i18n = nuxtApp.$i18n;
@@ -155,15 +156,24 @@ export function useLtAuth() {
     return merged;
   }
   async function validateSession() {
+    if (import.meta.server) {
+      return !!resolvedAuthState.value?.user;
+    }
     try {
       const session = authClient.useSession();
       if (session.value.isPending) {
         await new Promise((resolve) => {
-          const unwatch = watch(
+          let unwatch;
+          const timer = setTimeout(() => {
+            unwatch?.();
+            resolve(false);
+          }, VALIDATE_SESSION_TIMEOUT_MS);
+          unwatch = watch(
             () => session.value.isPending,
             (isPending) => {
               if (!isPending) {
-                unwatch();
+                clearTimeout(timer);
+                unwatch?.();
                 resolve(true);
               }
             },
@@ -177,14 +187,14 @@ export function useLtAuth() {
         });
         return true;
       }
-      if (authState.value?.user) {
+      if (resolvedAuthState.value?.user) {
         switchToJwtMode().catch(() => {
         });
         return true;
       }
       return false;
     } catch {
-      return !!authState.value?.user;
+      return !!resolvedAuthState.value?.user;
     }
   }
   async function fetchFeatures() {

package/dist/runtime/composables/use-lt-auth-client.d.ts

@@ -33,6 +33,13 @@ export declare function resetLtAuthClient(): void;
  * This ensures Docker containers can be reconfigured without rebuilding.
  * Trailing slashes are automatically stripped.
  *
+ * During SSR the server-only `runtimeConfig.apiUrl` (`NUXT_API_URL`) comes first,
+ * the same chain as `resolveLtApiBaseUrl()`. The client is built on the server
+ * whenever `useLtAuth()` runs in setup, and a consumer's `getSession()` from a
+ * middleware or `useAsyncData` goes through it. The public URL may be a name only
+ * the browser resolves (on Windows `*.localhost` resolves in Chromium, not in
+ * Node), so the server must not depend on it when an internal address is set.
+ *
  * ## Proxy mode (`NUXT_PUBLIC_API_PROXY=true`)
  * When enabled, `baseURL` is set to `""` (same-origin) and `basePath` is
  * prefixed with `/api` (e.g., `/api/iam`). The Vite dev proxy forwards

package/dist/runtime/composables/use-lt-auth-client.js

@@ -9,12 +9,13 @@ export function useLtAuthClient() {
     const runtimeConfig = useRuntimeConfig();
     const config = runtimeConfig.public?.ltExtensions?.auth || {};
     const publicApiUrl = String(runtimeConfig.public?.apiUrl || "");
+    const serverApiUrl = import.meta.server ? String(runtimeConfig.apiUrl || "") : "";
     const useProxy = isLocalDevApiProxy();
     let basePath = config.basePath || "/iam";
     if (useProxy && basePath && !basePath.startsWith("/api")) {
       basePath = `/api${basePath}`;
     }
-    const authBaseURL = (publicApiUrl || config.baseURL || "").replace(/\/+$/, "");
+    const authBaseURL = (serverApiUrl || publicApiUrl || config.baseURL || "").replace(/\/+$/, "");
     return getOrCreateLtAuthClient({
       baseURL: useProxy ? "" : authBaseURL,
       basePath,

package/dist/runtime/lib/auth-client.d.ts

@@ -79,6 +79,13 @@ export declare function resetLtAuthClientSingleton(): void;
  * Get or create the auth client singleton.
  * This is the main entry point for accessing the auth client.
  * If plugins were registered after initial creation, the client is recreated.
+ *
+ * WARNING — on the server this singleton is shared by EVERY concurrent render in
+ * the Node process, not scoped to one request. It is safe today only because
+ * nothing user-specific hangs on it. Never attach request-scoped data to it —
+ * forwarded cookies, an Authorization header, a per-user fetch option: one
+ * user's session would be rendered into another user's response. Forwarding the
+ * browser's cookies during SSR needs a client created per request, not this one.
  */
 export declare function getOrCreateLtAuthClient(config?: LtAuthClientConfig): LtAuthClient;
 /**

package/dist/runtime/testing/playwright-helpers.js

@@ -7,9 +7,22 @@ export async function waitForHydration(page, options = {}) {
   });
 }
 export async function gotoAndWaitForHydration(page, url, options = {}) {
-  await page.goto(url);
+  await gotoWithAbortRetry(page, url);
   await waitForHydration(page, options);
 }
+async function gotoWithAbortRetry(page, url, maxAttempts = 3) {
+  for (let attempt = 1; ; attempt++) {
+    try {
+      await page.goto(url);
+      return;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (attempt >= maxAttempts || !message.includes("net::ERR_ABORTED")) {
+        throw error;
+      }
+    }
+  }
+}
 export async function waitForURLAndHydration(page, url, options = {}) {
   const { timeout = 3e4, hydrationTimeout } = options;
   await page.waitForURL(url, { timeout });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.18.1",
+  "version": "1.18.2",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",
@@ -61,7 +61,7 @@
     "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxt prepare playground",
     "build": "nuxt-module-build build",
     "lint": "oxlint src/ scripts/",
-    "lint:fix": "oxlint --fix --fix-suggestions src/ scripts/",
+    "lint:fix": "oxlint --fix src/ scripts/",
     "format": "oxfmt --write src/",
     "format:check": "oxfmt --check src/",
     "version:sync": "node scripts/sync-module-version.mjs",
@@ -102,17 +102,18 @@
     "@better-auth/passkey": "1.7.1",
     "@nuxt/module-builder": "1.0.3",
     "@nuxt/schema": "4.5.2",
-    "@nuxt/ui": "4.11.0",
-    "@playwright/test": "1.62.1",
-    "@types/node": "26.2.0",
+    "@nuxt/ui": "4.11.2",
+    "@playwright/test": "1.63.0",
+    "@types/node": "26.6.3",
     "@vitest/coverage-v8": "4.1.11",
-    "@vue/server-renderer": "3.5.41",
+    "@vue/server-renderer": "3.5.43",
     "better-auth": "1.7.1",
-    "happy-dom": "20.11.6",
+    "cross-spawn": "7.0.6",
+    "happy-dom": "20.14.5",
     "nuxt": "4.5.2",
-    "oxfmt": "0.64.0",
-    "oxlint": "1.79.0",
-    "reka-ui": "2.10.3",
+    "oxfmt": "0.70.0",
+    "oxlint": "1.85.0",
+    "reka-ui": "2.10.4",
     "tus-js-client": "4.3.1",
     "typescript": "5.9.3",
     "vitest": "4.1.11",