@lenne.tech/nuxt-extensions 1.19.0 → 1.20.0

package/CLAUDE.md

@@ -347,7 +347,7 @@ fields at `app:beforeMount` and restores them at `app:mounted`, dispatching a sy
    Handling" below).
 3. **Check existing composables** before creating new ones — this module may already provide what you need
 4. **Peer dependencies** (`better-auth`, `@better-auth/passkey`, `tus-js-client`) must be installed in the consuming project.
-   `better-auth` and `@better-auth/passkey` are pinned to **`>=1.7.7 <1.8.0`** — deliberately not a caret.
+   `better-auth` and `@better-auth/passkey` are pinned to **`>=1.7.12 <1.8.0`** — deliberately not a caret.
    **They move in lock-step with `@lenne.tech/nest-server`.** better-auth is one protocol with two ends;
    this module is the client end, nest-server the server end, and both declare the *same* narrow range.
    Raising it means raising it in **both** framework repos and pinning the new version in **both** starters,

package/README.md

@@ -29,8 +29,8 @@ Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.t
 |---|---|---|
 | Node | `>= 22` | |
 | Nuxt | `^4.0.0` | |
-| `better-auth` | `>=1.7.7 <1.8.0` | **required peer** — pin it, see below |
-| `@better-auth/passkey` | `>=1.7.7 <1.8.0` | optional peer, passkey/WebAuthn only |
+| `better-auth` | `>=1.7.12 <1.8.0` | **required peer** — pin it, see below |
+| `@better-auth/passkey` | `>=1.7.12 <1.8.0` | optional peer, passkey/WebAuthn only |
 | `tus-js-client` | `>=4.0.0` | optional peer, resumable uploads only |
 | `@lenne.tech/nest-server` | `>= 11.37.0` | **only if you use the backend** — see the lock-step rule |
 
@@ -38,7 +38,7 @@ Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.t
 better-auth is one protocol with two ends. This module is the client end and
 `@lenne.tech/nest-server` is the server end, and they must resolve the **same**
 better-auth minor. better-auth breaks in *minor* releases — 1.7 removed subpath
-exports and changed the 2FA response shape — so a caret (`^1.7.7`) would re-open the
+exports and changed the 2FA response shape — so a caret (`^1.7.12`) would re-open the
 hole at 1.8. If the api and the app drift apart, 2FA activation fails at runtime with a
 generic client error while **both** projects' checks stay green: each is internally
 consistent, and only the assembled workspace has both halves.
@@ -46,17 +46,21 @@ consistent, and only the assembled workspace has both halves.
 Raising better-auth therefore means raising it in `@lenne.tech/nest-server` **and**
 `@lenne.tech/nuxt-extensions` in one step.
 
-**Why the floor is 1.7.7:** better-auth below 1.7.7 is affected by
+**Why the floor is 1.7.12:** better-auth before 1.7.12 verifies JWTs with the algorithm named
+in the token's own header instead of the algorithm of the stored key
+([#11925](https://github.com/better-auth/better-auth/pull/11925)). Below 1.7.7 it is also
+affected by
 [GHSA-965c-763c-88jm](https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm)
-(critical): the OAuth state can be used as a magic link to sign in as another user. The flaw
-is in the server end, so your API must run 1.7.7 too, and the pin below keeps both halves on it.
+(critical): the OAuth state can be used as a magic link to sign in as another user. Both flaws
+are in the server end, so your API must run 1.7.12 too (`@lenne.tech/nest-server` 12.0.0
+declares the same range), and the pin below keeps both halves on it.
 
 ## Installation
 
 ```bash
-npm install @lenne.tech/nuxt-extensions better-auth@1.7.7
+npm install @lenne.tech/nuxt-extensions better-auth@1.7.12
 # Optional: For passkey support
-npm install @better-auth/passkey@1.7.7
+npm install @better-auth/passkey@1.7.12
 # Optional: For TUS file uploads
 npm install tus-js-client
 ```
@@ -66,8 +70,8 @@ In a fullstack monorepo, pin it workspace-wide so the api and the app cannot dri
 ```yaml
 # pnpm-workspace.yaml
 overrides:
-  better-auth: 1.7.7
-  '@better-auth/passkey': 1.7.7
+  better-auth: 1.7.12
+  '@better-auth/passkey': 1.7.12
 ```
 
 ## Features
@@ -583,6 +587,20 @@ absolute URL is used as it is. If your project routes uploads through its own sa
 instead, set `ltExtensions.tus.resolveAgainstApi: false` and the relative endpoint stays on the app
 origin.
 
+**Changing it per stage.** The `tus` options are part of the public runtime config, so a deployed
+stage can override them through the environment, without a rebuild:
+
+```bash
+# Send this stage's uploads to another host (absolute URLs are used as they are)
+NUXT_PUBLIC_LT_EXTENSIONS_TUS_DEFAULT_ENDPOINT=https://uploads.example.com/tus
+# Keep a relative endpoint on the app origin (own same-origin proxy)
+NUXT_PUBLIC_LT_EXTENSIONS_TUS_RESOLVE_AGAINST_API=false
+```
+
+Keep the relative default where you can: `NUXT_PUBLIC_API_URL` already differs per stage, so `'/tus'`
+follows it. Uploads are sent with credentials, so a host other than the API has to receive the
+session cookie, or every upload answers 401.
+
 **Which id to keep.** After a successful upload, `item.fileId` is the id of the stored file, read
 from the `X-File-Id` response header (nest-server 11.42.13+). Use it for file links and references.
 `item.url` is the TUS upload resource; its last segment is the upload id, not the file id. `fileId`

package/dist/module.d.mts

@@ -3,7 +3,7 @@ import { LtExtensionsModuleOptions } from '../dist/runtime/types/index.js';
 export * from '../dist/runtime/types/index.js';
 
 declare const name = "@lenne.tech/nuxt-extensions";
-declare const version = "1.19.0";
+declare const version = "1.20.0";
 declare const configKey = "ltExtensions";
 declare const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 declare const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "configKey": "ltExtensions",
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -2,7 +2,7 @@ import { defineNuxtModule, createResolver, tryResolveModule, addImports, addComp
 import { pathToFileURL } from 'node:url';
 
 const name = "@lenne.tech/nuxt-extensions";
-const version = "1.19.0";
+const version = "1.20.0";
 const configKey = "ltExtensions";
 const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";

package/dist/runtime/composables/auth/use-lt-auth.js

@@ -3,6 +3,7 @@ import { ltArrayBufferToBase64Url, ltBase64UrlToUint8Array } from "../../utils/c
 import { clearLtAuthCookies, getLtApiBase, getLtAuthCookieNames, resolveLtAuthState } from "../../lib/auth-state.js";
 import { useLtAuthClient } from "../use-lt-auth-client.js";
 const VALIDATE_SESSION_TIMEOUT_MS = 1e4;
+let staleJwtRefresh = null;
 function useTranslation() {
   const nuxtApp = useNuxtApp();
   const i18n = nuxtApp.$i18n;
@@ -139,8 +140,35 @@ export function useLtAuth() {
         });
       }
     }
+    if (response.status === 401 && isJwtMode.value && isAuthenticated.value && !needsCookies) {
+      const freshToken = await refreshStaleJwt();
+      if (freshToken) {
+        headers.set("Authorization", `Bearer ${freshToken}`);
+        return fetch(url, {
+          ...options,
+          headers,
+          credentials: "omit"
+        });
+      }
+    }
     return response;
   }
+  async function refreshStaleJwt() {
+    const mint = async () => await switchToJwtMode() ? jwtToken.value : null;
+    if (!import.meta.client) {
+      return mint();
+    }
+    if (!staleJwtRefresh) {
+      staleJwtRefresh = mint().finally(() => {
+        staleJwtRefresh = null;
+      });
+    }
+    const token = await staleJwtRefresh;
+    if (token && jwtToken.value !== token) {
+      jwtToken.value = token;
+    }
+    return token;
+  }
   const AUTHZ_KEYS = ["banExpires", "banReason", "banned", "emailVerified", "role", "roles", "twoFactorEnabled"];
   function mergeSessionUser(sessionUser) {
     const cached = resolvedAuthState.value?.user;
@@ -465,7 +493,7 @@ export function useLtAuth() {
   }
   if (import.meta.client && !featuresFetched.value) {
     featuresFetched.value = true;
-    fetchFeatures();
+    void fetchFeatures();
   }
   return {
     // Auth state

package/dist/runtime/composables/auth/use-system-setup.js

@@ -1,10 +1,21 @@
 import { computed, useState } from "#imports";
 import { ltSha256 } from "../../utils/crypto.js";
-import { buildLtApiUrl } from "../../lib/auth-state.js";
+import { buildLtApiUrl, resolveLtApiBaseUrl, warnMissingLtApiUrl } from "../../lib/auth-state.js";
+function isApiUrlMissing() {
+  try {
+    return resolveLtApiBaseUrl().missing;
+  } catch {
+    return true;
+  }
+}
 export function useSystemSetup() {
   const needsSetupState = useState("lt-needs-setup", () => null);
   const needsSetup = computed(() => needsSetupState.value);
   async function checkSetupStatus() {
+    if (import.meta.server && isApiUrlMissing()) {
+      warnMissingLtApiUrl("server");
+      return false;
+    }
     try {
       const url = buildLtApiUrl("/system-setup/status");
       const data = await $fetch(url);

package/dist/runtime/composables/use-lt-tus-upload.js

@@ -173,7 +173,7 @@ export function useLtTusUpload(defaultOptions = {}) {
     const tusUpload = tusUploads.value.get(id);
     if (item && tusUpload && item.status !== "uploading") {
       updateItem(id, { startedAt: /* @__PURE__ */ new Date(), status: "uploading" });
-      tusUpload.findPreviousUploads().then((previousUploads) => {
+      void tusUpload.findPreviousUploads().then((previousUploads) => {
         const previousUpload = previousUploads[0];
         if (previousUpload) {
           tusUpload.resumeFromPreviousUpload(previousUpload);
@@ -191,7 +191,7 @@ export function useLtTusUpload(defaultOptions = {}) {
   function pauseUpload(id) {
     const tusUpload = tusUploads.value.get(id);
     if (tusUpload) {
-      tusUpload.abort();
+      void tusUpload.abort();
       updateItem(id, { status: "paused" });
     }
   }
@@ -207,7 +207,7 @@ export function useLtTusUpload(defaultOptions = {}) {
   function cancelUpload(id) {
     const tusUpload = tusUploads.value.get(id);
     if (tusUpload) {
-      tusUpload.abort();
+      void tusUpload.abort();
     }
     tusUploads.value.delete(id);
     const newMap = new Map(uploadItems.value);

package/dist/runtime/lib/auth-client.js

@@ -59,7 +59,7 @@ export function createLtAuthClient(config = {}) {
     plugins.push(
       twoFactorClient({
         onTwoFactorRedirect() {
-          navigateTo(twoFactorRedirectPath);
+          void navigateTo(twoFactorRedirectPath);
         }
       })
     );

package/dist/runtime/lib/auth-state.js

@@ -78,7 +78,7 @@ export function isLocalDevApiProxy() {
 }
 const MISSING_API_URL_WARNING = {
   client: "[LtExtensions] No API URL configured. Set NUXT_PUBLIC_API_URL. API paths stay relative and resolve against the app origin, so auth and setup calls 404 unless the app is served behind a same-origin reverse proxy.",
-  server: "[LtExtensions] No API URL configured for SSR. Set NUXT_API_URL or NUXT_PUBLIC_API_URL. API paths stay relative, so server-side requests never reach the backend: $fetch resolves them against Nitro (404) and global fetch rejects them as an invalid URL."
+  server: "[LtExtensions] No API URL configured for SSR. Set NUXT_API_URL or NUXT_PUBLIC_API_URL. API paths stay relative, so server-side requests never reach the backend: $fetch sends them to this Nitro server itself and global fetch rejects them as an invalid URL."
 };
 function stripTrailingSlashes(url) {
   return url.replace(/\/+$/, "");

package/dist/runtime/plugins/auth-interceptor.client.js

@@ -117,6 +117,8 @@ export default defineNuxtPlugin((nuxtApp) => {
       const currentPath = router?.currentRoute?.value?.fullPath;
       const redirectQuery = currentPath && currentPath !== loginPath ? `?redirect=${encodeURIComponent(currentPath)}` : "";
       window.location.href = loginPath + redirectQuery;
+    } catch (error) {
+      console.error("[LtAuth Interceptor] Handling a 401 failed:", error);
     } finally {
       if (loggingOut) {
         setTimeout(() => {
@@ -139,7 +141,7 @@ export default defineNuxtPlugin((nuxtApp) => {
             options.onResponseError(context);
           }
           if (context.response?.status === 401) {
-            handleUnauthorized(url);
+            void handleUnauthorized(url);
           }
         }
       });
@@ -149,7 +151,7 @@ export default defineNuxtPlugin((nuxtApp) => {
       const response = await originalNativeFetch(input, init);
       if (response.status === 401) {
         const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-        handleUnauthorized(url);
+        void handleUnauthorized(url);
       }
       return response;
     };

package/dist/runtime/testing/playwright-helpers.js

@@ -114,7 +114,7 @@ export async function waitForElement(page, selector, options = {}) {
           resolve();
           return;
         }
-        Promise.all(el.getAnimations().map((a) => a.finished)).then(() => resolve());
+        void Promise.allSettled(el.getAnimations().map((a) => a.finished)).then(() => resolve());
       });
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",
@@ -51,17 +51,17 @@
     "prepack": "node scripts/sync-module-version.mjs && nuxt-module-build build",
     "c": "pnpm run check",
     "check": "node scripts/check.mjs",
-    "check:raw": "pnpm install --frozen-lockfile && pnpm audit && pnpm run check:suppressions && pnpm peers check && pnpm run format:check && pnpm run lint && pnpm run version:check && pnpm run dev:prepare && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
-    "check:fix": "pnpm install && pnpm audit --fix && pnpm run check:suppressions && pnpm peers check && pnpm run format && pnpm run lint:fix && pnpm run version:sync && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
-    "check:naf": "pnpm install && pnpm peers check && pnpm run format && pnpm run lint:fix && pnpm run version:sync && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
+    "check:raw": "pnpm install --frozen-lockfile && pnpm audit && pnpm run check:suppressions && pnpm peers check && pnpm run format:check && pnpm run dev:prepare && pnpm run lint && pnpm run version:check && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
+    "check:fix": "pnpm install && pnpm audit --fix && pnpm run check:suppressions && pnpm peers check && pnpm run format && pnpm run dev:prepare && pnpm run lint:fix && pnpm run version:sync && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
+    "check:naf": "pnpm install && pnpm peers check && pnpm run format && pnpm run dev:prepare && pnpm run lint:fix && pnpm run version:sync && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
     "cf": "pnpm run check:fix",
     "cnaf": "pnpm run check:naf",
     "dev": "pnpm dev:prepare && nuxt dev playground",
     "dev:build": "nuxt build playground",
     "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxt prepare playground",
     "build": "nuxt-module-build build",
-    "lint": "oxlint src/ scripts/",
-    "lint:fix": "oxlint --fix src/ scripts/",
+    "lint": "oxlint --type-aware src/ scripts/",
+    "lint:fix": "oxlint --type-aware --fix src/ scripts/",
     "format": "oxfmt --write src/",
     "format:check": "oxfmt --check src/",
     "version:sync": "node scripts/sync-module-version.mjs",
@@ -70,7 +70,7 @@
     "test:watch": "vitest watch",
     "test:coverage": "vitest run --coverage",
     "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit",
-    "release": "pnpm format:check && pnpm lint && pnpm run version:check && pnpm test:types && pnpm test && pnpm run check:consumer && pnpm prepack",
+    "release": "pnpm format:check && pnpm run dev:prepare && pnpm lint && pnpm run version:check && pnpm test:types && pnpm test && pnpm run check:consumer && pnpm prepack",
     "check:consumer": "node scripts/check-consumer-build.mjs",
     "check:manifest": "node scripts/check-package-manifest.mjs",
     "check:suppressions": "node scripts/check-suppressions.mjs"
@@ -79,9 +79,9 @@
     "@nuxt/kit": "^4.0.0"
   },
   "peerDependencies": {
-    "@better-auth/passkey": ">=1.7.7 <1.8.0",
+    "@better-auth/passkey": ">=1.7.12 <1.8.0",
     "@playwright/test": ">=1.0.0",
-    "better-auth": ">=1.7.7 <1.8.0",
+    "better-auth": ">=1.7.12 <1.8.0",
     "nuxt": "^4.0.0",
     "tus-js-client": ">=4.0.0"
   },
@@ -100,24 +100,25 @@
     }
   },
   "devDependencies": {
-    "@better-auth/passkey": "1.7.7",
+    "@better-auth/passkey": "1.7.12",
     "@nuxt/module-builder": "1.0.3",
-    "@nuxt/schema": "4.6.1",
-    "@nuxt/ui": "4.11.3",
-    "@playwright/test": "1.64.0",
+    "@nuxt/schema": "4.6.2",
+    "@nuxt/ui": "4.12.0",
+    "@playwright/test": "1.64.1",
     "@types/node": "26.6.5",
-    "@vitest/coverage-v8": "5.0.3",
-    "@vue/server-renderer": "3.5.43",
-    "better-auth": "1.7.7",
+    "@vitest/coverage-v8": "5.0.5",
+    "@vue/server-renderer": "3.5.44",
+    "better-auth": "1.7.12",
     "cross-spawn": "7.0.6",
-    "happy-dom": "20.14.6",
-    "nuxt": "4.6.1",
-    "oxfmt": "0.72.0",
-    "oxlint": "1.87.0",
-    "reka-ui": "2.10.5",
+    "happy-dom": "21.0.4",
+    "nuxt": "4.6.2",
+    "oxfmt": "0.74.0",
+    "oxlint": "1.89.0",
+    "oxlint-tsgolint": "7.0.2005",
+    "reka-ui": "2.11.0",
     "tus-js-client": "4.3.1",
     "typescript": "5.9.3",
-    "vitest": "5.0.3",
+    "vitest": "5.0.5",
     "vue-tsc": "3.3.13"
   },
   "keywords": [