@lenne.tech/nuxt-extensions 1.18.3 → 1.18.5

package/CLAUDE.md

@@ -347,7 +347,7 @@ fields at `app:beforeMount` and restores them at `app:mounted`, dispatching a sy
    Handling" below).
 3. **Check existing composables** before creating new ones — this module may already provide what you need
 4. **Peer dependencies** (`better-auth`, `@better-auth/passkey`, `tus-js-client`) must be installed in the consuming project.
-   `better-auth` and `@better-auth/passkey` are pinned to **`>=1.7.1 <1.8.0`** — deliberately not a caret.
+   `better-auth` and `@better-auth/passkey` are pinned to **`>=1.7.7 <1.8.0`** — deliberately not a caret.
    **They move in lock-step with `@lenne.tech/nest-server`.** better-auth is one protocol with two ends;
    this module is the client end, nest-server the server end, and both declare the *same* narrow range.
    Raising it means raising it in **both** framework repos and pinning the new version in **both** starters,

package/README.md

@@ -29,8 +29,8 @@ Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.t
 |---|---|---|
 | Node | `>= 22` | |
 | Nuxt | `^4.0.0` | |
-| `better-auth` | `>=1.7.1 <1.8.0` | **required peer** — pin it, see below |
-| `@better-auth/passkey` | `>=1.7.1 <1.8.0` | optional peer, passkey/WebAuthn only |
+| `better-auth` | `>=1.7.7 <1.8.0` | **required peer** — pin it, see below |
+| `@better-auth/passkey` | `>=1.7.7 <1.8.0` | optional peer, passkey/WebAuthn only |
 | `tus-js-client` | `>=4.0.0` | optional peer, resumable uploads only |
 | `@lenne.tech/nest-server` | `>= 11.37.0` | **only if you use the backend** — see the lock-step rule |
 
@@ -38,7 +38,7 @@ Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.t
 better-auth is one protocol with two ends. This module is the client end and
 `@lenne.tech/nest-server` is the server end, and they must resolve the **same**
 better-auth minor. better-auth breaks in *minor* releases — 1.7 removed subpath
-exports and changed the 2FA response shape — so a caret (`^1.7.1`) would re-open the
+exports and changed the 2FA response shape — so a caret (`^1.7.7`) would re-open the
 hole at 1.8. If the api and the app drift apart, 2FA activation fails at runtime with a
 generic client error while **both** projects' checks stay green: each is internally
 consistent, and only the assembled workspace has both halves.
@@ -46,12 +46,17 @@ consistent, and only the assembled workspace has both halves.
 Raising better-auth therefore means raising it in `@lenne.tech/nest-server` **and**
 `@lenne.tech/nuxt-extensions` in one step.
 
+**Why the floor is 1.7.7:** better-auth below 1.7.7 is affected by
+[GHSA-965c-763c-88jm](https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm)
+(critical): the OAuth state can be used as a magic link to sign in as another user. The flaw
+is in the server end, so your API must run 1.7.7 too, and the pin below keeps both halves on it.
+
 ## Installation
 
 ```bash
-npm install @lenne.tech/nuxt-extensions better-auth@1.7.1
+npm install @lenne.tech/nuxt-extensions better-auth@1.7.7
 # Optional: For passkey support
-npm install @better-auth/passkey@1.7.1
+npm install @better-auth/passkey@1.7.7
 # Optional: For TUS file uploads
 npm install tus-js-client
 ```
@@ -61,8 +66,8 @@ In a fullstack monorepo, pin it workspace-wide so the api and the app cannot dri
 ```yaml
 # pnpm-workspace.yaml
 overrides:
-  better-auth: 1.7.1
-  '@better-auth/passkey': 1.7.1
+  better-auth: 1.7.7
+  '@better-auth/passkey': 1.7.7
 ```
 
 ## Features

package/dist/module.d.mts

@@ -3,7 +3,7 @@ import { LtExtensionsModuleOptions } from '../dist/runtime/types/index.js';
 export * from '../dist/runtime/types/index.js';
 
 declare const name = "@lenne.tech/nuxt-extensions";
-declare const version = "1.18.3";
+declare const version = "1.18.5";
 declare const configKey = "ltExtensions";
 declare const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 declare const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "configKey": "ltExtensions",
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.18.3",
+  "version": "1.18.5",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -2,7 +2,7 @@ import { defineNuxtModule, createResolver, tryResolveModule, addImports, addComp
 import { pathToFileURL } from 'node:url';
 
 const name = "@lenne.tech/nuxt-extensions";
-const version = "1.18.3";
+const version = "1.18.5";
 const configKey = "ltExtensions";
 const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";
@@ -82,6 +82,13 @@ const module$1 = defineNuxtModule({
       nuxt.options.nitro ??= {};
       nuxt.options.nitro.alias = { ...nuxt.options.nitro.alias, "@better-auth/passkey/client": passkeyStub };
     }
+    const uiToastAvailable = !!await tryResolveModule("@nuxt/ui/composables/useToast", [new URL(import.meta.url), pathToFileURL(`${nuxt.options.rootDir}/`)]);
+    if (!uiToastAvailable) {
+      const uiToastStub = resolve("./runtime/lib/ui-toast-stub");
+      nuxt.options.alias["@nuxt/ui/composables/useToast"] = uiToastStub;
+      nuxt.options.nitro ??= {};
+      nuxt.options.nitro.alias = { ...nuxt.options.nitro.alias, "@nuxt/ui/composables/useToast": uiToastStub };
+    }
     const enablePasskey = (resolvedOptions.auth?.enablePasskey ?? true) && passkeyAvailable;
     if ((resolvedOptions.auth?.enablePasskey ?? true) && !passkeyAvailable) {
       console.warn(

package/dist/runtime/components/transition/LtTransitionFade.d.vue.ts

@@ -26,8 +26,8 @@ type __VLS_Slots = {} & {
     default?: (props: typeof __VLS_7) => any;
 };
 declare const __VLS_base: import("@vue/runtime-core").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("@vue/runtime-core").ComponentOptionsMixin, import("@vue/runtime-core").ComponentOptionsMixin, {}, string, import("@vue/runtime-core").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {
-    leaveDuration: `${number}` | number;
-    startDuration: `${number}` | number;
+    leaveDuration: number | `${number}`;
+    startDuration: number | `${number}`;
 }, {}, {}, {}, string, import("@vue/runtime-core").ComponentProvideOptions, false, {}, any>;
 declare const __VLS_export: __VLS_WithSlots<typeof __VLS_base, __VLS_Slots>;
 declare const _default: typeof __VLS_export;

package/dist/runtime/components/transition/LtTransitionFade.vue.d.ts

@@ -26,8 +26,8 @@ type __VLS_Slots = {} & {
     default?: (props: typeof __VLS_7) => any;
 };
 declare const __VLS_base: import("@vue/runtime-core").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("@vue/runtime-core").ComponentOptionsMixin, import("@vue/runtime-core").ComponentOptionsMixin, {}, string, import("@vue/runtime-core").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {
-    leaveDuration: `${number}` | number;
-    startDuration: `${number}` | number;
+    leaveDuration: number | `${number}`;
+    startDuration: number | `${number}`;
 }, {}, {}, {}, string, import("@vue/runtime-core").ComponentProvideOptions, false, {}, any>;
 declare const __VLS_export: __VLS_WithSlots<typeof __VLS_base, __VLS_Slots>;
 declare const _default: typeof __VLS_export;

package/dist/runtime/components/transition/LtTransitionFadeScale.d.vue.ts

@@ -29,8 +29,8 @@ type __VLS_Slots = {} & {
     default?: (props: typeof __VLS_7) => any;
 };
 declare const __VLS_base: import("@vue/runtime-core").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("@vue/runtime-core").ComponentOptionsMixin, import("@vue/runtime-core").ComponentOptionsMixin, {}, string, import("@vue/runtime-core").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {
-    leaveDuration: `${number}` | number;
-    startDuration: `${number}` | number;
+    leaveDuration: number | `${number}`;
+    startDuration: number | `${number}`;
 }, {}, {}, {}, string, import("@vue/runtime-core").ComponentProvideOptions, false, {}, any>;
 declare const __VLS_export: __VLS_WithSlots<typeof __VLS_base, __VLS_Slots>;
 declare const _default: typeof __VLS_export;

package/dist/runtime/components/transition/LtTransitionFadeScale.vue.d.ts

@@ -29,8 +29,8 @@ type __VLS_Slots = {} & {
     default?: (props: typeof __VLS_7) => any;
 };
 declare const __VLS_base: import("@vue/runtime-core").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("@vue/runtime-core").ComponentOptionsMixin, import("@vue/runtime-core").ComponentOptionsMixin, {}, string, import("@vue/runtime-core").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {
-    leaveDuration: `${number}` | number;
-    startDuration: `${number}` | number;
+    leaveDuration: number | `${number}`;
+    startDuration: number | `${number}`;
 }, {}, {}, {}, string, import("@vue/runtime-core").ComponentProvideOptions, false, {}, any>;
 declare const __VLS_export: __VLS_WithSlots<typeof __VLS_base, __VLS_Slots>;
 declare const _default: typeof __VLS_export;

package/dist/runtime/composables/use-lt-error-translation.js

@@ -1,5 +1,6 @@
 import { computed, ref, useState, useNuxtApp, useRuntimeConfig } from "#imports";
 import { buildLtApiUrl } from "../lib/auth-state.js";
+import { ltAddToast } from "../lib/toast.js";
 const ERROR_CODE_REGEX = /^#([A-Z_]+_\d+):\s*(.+)$/;
 export function useLtErrorTranslation() {
   const nuxtApp = useNuxtApp();
@@ -101,21 +102,14 @@ export function useLtErrorTranslation() {
       return;
     }
     const parsed = parseError(errorOrMessage);
-    try {
-      nuxtApp.runWithContext(() => {
-        const toastComposable = nuxtApp.useToast || globalThis.useToast;
-        if (typeof toastComposable === "function") {
-          const toast = toastComposable();
-          toast.add({
-            color: "error",
-            title: title || t("lt.error.title", "Fehler"),
-            description: parsed.translatedMessage
-          });
-        } else {
-          console.error("[LtErrorTranslation]", parsed.translatedMessage);
-        }
-      });
-    } catch {
+    const shown = nuxtApp.runWithContext(
+      () => ltAddToast({
+        color: "error",
+        description: parsed.translatedMessage,
+        title: title || t("lt.error.title", "Fehler")
+      })
+    );
+    if (!shown) {
       console.error("[LtErrorTranslation]", parsed.translatedMessage);
     }
   }

package/dist/runtime/composables/use-lt-share.js

@@ -1,4 +1,5 @@
 import { useNuxtApp, useRoute } from "#imports";
+import { ltAddToast } from "../lib/toast.js";
 export function useLtShare() {
   const route = useRoute();
   const nuxtApp = useNuxtApp();
@@ -26,19 +27,14 @@ export function useLtShare() {
     } else {
       try {
         await navigator.clipboard.writeText(url ?? window.location.origin);
-        const useToast = nuxtApp.$useToast || globalThis.useToast;
-        if (typeof useToast === "function") {
-          try {
-            const toast = useToast();
-            toast.add({
-              color: "success",
-              description: t("lt.share.copiedDescription", "Der Link wurde in die Zwischenablage kopiert."),
-              title: t("lt.share.copied", "Link kopiert")
-            });
-          } catch {
-            console.debug("Link copied to clipboard");
-          }
-        } else {
+        const shown = nuxtApp.runWithContext(
+          () => ltAddToast({
+            color: "success",
+            description: t("lt.share.copiedDescription", "Der Link wurde in die Zwischenablage kopiert."),
+            title: t("lt.share.copied", "Link kopiert")
+          })
+        );
+        if (!shown) {
           console.debug("Link copied to clipboard");
         }
       } catch (error) {

package/dist/runtime/lib/auth-client.d.ts

@@ -169,7 +169,14 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                 query?: import("better-auth").SessionQueryParams;
             } | undefined) => Promise<void>;
         }>>;
-        <F extends (...args: any) => any>(useFetch: F): Promise<{
+        (useFetch: (url: string, options: {
+            headers?: HeadersInit;
+            key: string;
+            watch: import("vue").WatchSource<unknown>[];
+        }) => Promise<{
+            data: import("vue").Ref<unknown>;
+            error: import("vue").Ref<unknown>;
+        }>): Promise<{
             data: import("vue").Ref<{
                 user: import("better-auth").StripEmptyObjects<{
                     id: string;
@@ -281,17 +288,17 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
                 onResponse: ((context: import("better-auth/client").ResponseContext) => Promise<Response | void | import("better-auth/client").ResponseContext> | Response | import("better-auth/client").ResponseContext | void) | undefined;
             };
         })[];
-        priority?: RequestPriority | undefined;
         cache?: RequestCache | undefined;
         credentials?: RequestCredentials;
         integrity?: string | undefined;
         keepalive?: boolean | undefined;
         method: string;
         mode?: RequestMode | undefined;
+        priority?: RequestPriority | undefined;
         redirect?: RequestRedirect | undefined;
         referrer?: string | undefined;
         referrerPolicy?: ReferrerPolicy | undefined;
-        signal?: (AbortSignal | null) | undefined;
+        signal?: AbortSignal | null;
         window?: null | undefined;
         onRetry?: ((response: import("better-auth/client").ResponseContext) => Promise<void> | void) | undefined;
         hookOptions?: {

package/dist/runtime/lib/toast.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Toast helper
+ *
+ * Single place where the module talks to Nuxt UI's toaster.
+ *
+ * Composables used to look the composable up on `nuxtApp` / `globalThis`
+ * (`(nuxtApp as any).useToast || (globalThis as any).useToast`). Nuxt UI exposes
+ * `useToast` as an auto-import and puts it on neither, so that lookup was always
+ * `undefined` and every toast silently degraded to a `console.*` line — users
+ * got no visible feedback at all.
+ *
+ * Importing Nuxt UI's `useToast` directly is what actually works. The specifier
+ * resolves to the very same file the auto-import points at, so the toast lands
+ * in the `useState('toasts')` array that `<UApp>` / `<UToaster>` renders.
+ * `module.ts` aliases it onto {@link ui-toast-stub} when `@nuxt/ui` is not
+ * installed, which keeps it an optional peer.
+ */
+/** Semantic toast colors — mirrors Nuxt UI's color tokens. */
+export type LtToastColor = 'error' | 'info' | 'neutral' | 'primary' | 'secondary' | 'success' | 'warning';
+export interface LtToastOptions {
+    color?: LtToastColor;
+    description?: string;
+    title?: string;
+}
+/**
+ * Show a toast, if the app has a toaster.
+ *
+ * Call it inside `nuxtApp.runWithContext()` when you are past an `await` or
+ * outside a component: `useToast()` needs the Nuxt instance for `useState`.
+ *
+ * @param options - Toast color, title and description
+ * @returns `true` when the toast was handed to Nuxt UI, `false` when no toaster
+ *   is available (or it threw) — callers use this to fall back to the console
+ *   instead of swallowing the message.
+ *
+ * @example
+ * ```typescript
+ * if (!ltAddToast({ color: 'error', description: message, title: 'Fehler' })) {
+ *   console.error('[MyComposable]', message);
+ * }
+ * ```
+ */
+export declare function ltAddToast(options: LtToastOptions): boolean;

package/dist/runtime/lib/toast.js

@@ -0,0 +1,13 @@
+import { useToast } from "@nuxt/ui/composables/useToast";
+export function ltAddToast(options) {
+  try {
+    const toast = useToast();
+    if (typeof toast?.add !== "function") {
+      return false;
+    }
+    toast.add(options);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/dist/runtime/lib/ui-toast-stub.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Build-time stand-in for Nuxt UI's `@nuxt/ui/composables/useToast`.
+ *
+ * `@nuxt/ui` is an OPTIONAL peer of this module, but `runtime/lib/toast.ts`
+ * imports `useToast` at the top level — so the bundler must resolve the
+ * specifier even in a project that ships a different UI layer. `module.ts`
+ * aliases `@nuxt/ui/composables/useToast` onto this file when the package is
+ * absent; without it the build would fail on an unresolved optional peer
+ * instead of honouring the optionality (same pattern as `passkey-stub.ts`).
+ *
+ * The alias rewrites the specifier for the WHOLE consumer app, so this file
+ * mirrors every name the real module exports. `test/lt-toast.test.ts` pins that
+ * surface against the real package.
+ */
+/** Mirror of Nuxt UI's injection key for the toaster's `max` prop. */
+export declare const toastMaxInjectionKey: unique symbol;
+/**
+ * No-op replacement for Nuxt UI's `useToast()`.
+ *
+ * Returning `undefined` — rather than an object whose `add()` silently swallows
+ * the toast — is what lets {@link ltAddToast} report "no toast was shown", so
+ * callers keep their console fallback.
+ */
+export declare function useToast(): undefined;

package/dist/runtime/lib/ui-toast-stub.js

@@ -0,0 +1,4 @@
+export const toastMaxInjectionKey = Symbol("nuxt-ui.toast-max");
+export function useToast() {
+  return void 0;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.18.3",
+  "version": "1.18.5",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",
@@ -79,9 +79,9 @@
     "@nuxt/kit": "^4.0.0"
   },
   "peerDependencies": {
-    "@better-auth/passkey": ">=1.7.1 <1.8.0",
+    "@better-auth/passkey": ">=1.7.7 <1.8.0",
     "@playwright/test": ">=1.0.0",
-    "better-auth": ">=1.7.1 <1.8.0",
+    "better-auth": ">=1.7.7 <1.8.0",
     "nuxt": "^4.0.0",
     "tus-js-client": ">=4.0.0"
   },
@@ -100,25 +100,25 @@
     }
   },
   "devDependencies": {
-    "@better-auth/passkey": "1.7.1",
+    "@better-auth/passkey": "1.7.7",
     "@nuxt/module-builder": "1.0.3",
-    "@nuxt/schema": "4.5.2",
-    "@nuxt/ui": "4.11.2",
+    "@nuxt/schema": "4.6.0",
+    "@nuxt/ui": "4.11.3",
     "@playwright/test": "1.63.0",
-    "@types/node": "26.6.3",
-    "@vitest/coverage-v8": "4.1.11",
+    "@types/node": "26.6.4",
+    "@vitest/coverage-v8": "5.0.3",
     "@vue/server-renderer": "3.5.43",
-    "better-auth": "1.7.1",
+    "better-auth": "1.7.7",
     "cross-spawn": "7.0.6",
     "happy-dom": "20.14.5",
-    "nuxt": "4.5.2",
-    "oxfmt": "0.70.0",
-    "oxlint": "1.85.0",
-    "reka-ui": "2.10.4",
+    "nuxt": "4.6.0",
+    "oxfmt": "0.72.0",
+    "oxlint": "1.87.0",
+    "reka-ui": "2.10.5",
     "tus-js-client": "4.3.1",
     "typescript": "5.9.3",
-    "vitest": "4.1.11",
-    "vue-tsc": "3.3.11"
+    "vitest": "5.0.3",
+    "vue-tsc": "3.3.12"
   },
   "keywords": [
     "nuxt",