@lenne.tech/nuxt-extensions 1.21.0 → 1.23.0

package/CLAUDE.md

@@ -40,6 +40,8 @@ src/
 | `useLtAi()` | One-shot `prompt()` + streaming `promptStream()` (POST `/ai/prompt` / `/ai/stream`) |
 | `useLtAiChat()` | Multi-turn chat: streaming, budget summary, confirmation gate, `stop()`/`clear()`, optional `maxMessages` cap, auto-stop on unmount |
 | `useLtAiConnections()` | User-facing list of available connections + `select()` |
+| `useLtAiSettings()` | The user's own AI settings: MCP confirmation switch (`GET/PUT /ai/settings`, `enforced` → show disabled) |
+| `useLtAiStatus()` | Whether the API's AI module is on (`GET /ai/status`, public; 404 = off): `enabled`, `mcp`, shared `useState`, one request per app start, fails closed |
 | `useLtAiUsage()` | Full token/prompt usage breakdown (`GET /ai/usage`) |
 | `useLtAiPrompts()` | User-facing CRUD for re-usable prompt snippets ("Vorlagen", `scope: 'user'` / `'tenant'`) |
 | `useLtAiPlaceholders()` | Loads the backend's `{{placeholder}}` registry for editor sidebars |
@@ -411,7 +413,7 @@ fields at `app:beforeMount` and restores them at `app:mounted`, dispatching a sy
    Handling" below).
 3. **Check existing composables** before creating new ones — this module may already provide what you need
 4. **Peer dependencies** (`better-auth`, `@better-auth/passkey`, `tus-js-client`) must be installed in the consuming project.
-   `better-auth` and `@better-auth/passkey` are pinned to **`>=1.7.12 <1.8.0`** — deliberately not a caret.
+   `better-auth` and `@better-auth/passkey` are pinned to **`>=1.7.16 <1.8.0`** — deliberately not a caret.
    **They move in lock-step with `@lenne.tech/nest-server`.** better-auth is one protocol with two ends;
    this module is the client end, nest-server the server end, and both declare the *same* narrow range.
    Raising it means raising it in **both** framework repos and pinning the new version in **both** starters,

package/README.md

@@ -29,8 +29,8 @@ Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.t
 |---|---|---|
 | Node | `>= 22` | |
 | Nuxt | `^4.0.0` | |
-| `better-auth` | `>=1.7.12 <1.8.0` | **required peer** — pin it, see below |
-| `@better-auth/passkey` | `>=1.7.12 <1.8.0` | optional peer, passkey/WebAuthn only |
+| `better-auth` | `>=1.7.16 <1.8.0` | **required peer** — pin it, see below |
+| `@better-auth/passkey` | `>=1.7.16 <1.8.0` | optional peer, passkey/WebAuthn only |
 | `tus-js-client` | `>=4.0.0` | optional peer, resumable uploads only |
 | `@lenne.tech/nest-server` | `>= 11.37.0` | **only if you use the backend** — see the lock-step rule |
 
@@ -38,7 +38,7 @@ Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.t
 better-auth is one protocol with two ends. This module is the client end and
 `@lenne.tech/nest-server` is the server end, and they must resolve the **same**
 better-auth minor. better-auth breaks in *minor* releases — 1.7 removed subpath
-exports and changed the 2FA response shape — so a caret (`^1.7.12`) would re-open the
+exports and changed the 2FA response shape — so a caret (`^1.7.16`) would re-open the
 hole at 1.8. If the api and the app drift apart, 2FA activation fails at runtime with a
 generic client error while **both** projects' checks stay green: each is internally
 consistent, and only the assembled workspace has both halves.
@@ -46,21 +46,35 @@ consistent, and only the assembled workspace has both halves.
 Raising better-auth therefore means raising it in `@lenne.tech/nest-server` **and**
 `@lenne.tech/nuxt-extensions` in one step.
 
-**Why the floor is 1.7.12:** better-auth before 1.7.12 verifies JWTs with the algorithm named
-in the token's own header instead of the algorithm of the stored key
-([#11925](https://github.com/better-auth/better-auth/pull/11925)). Below 1.7.7 it is also
-affected by
-[GHSA-965c-763c-88jm](https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm)
-(critical): the OAuth state can be used as a magic link to sign in as another user. Both flaws
-are in the server end, so your API must run 1.7.12 too (`@lenne.tech/nest-server` 12.0.0
-declares the same range), and the pin below keeps both halves on it.
+**Why the floor is 1.7.16:** better-auth 1.7.16 closes twelve advisories published on
+2026-11-03. Among those that reach a typical lt project: a social sign-in can treat an unverified
+provider email as verified
+([GHSA-9hm7-xhfp-cx58](https://github.com/better-auth/better-auth/security/advisories/GHSA-9hm7-xhfp-cx58)),
+revoked sessions can stay valid with secondary storage or the cookie cache
+([GHSA-fvxx-76fc-893x](https://github.com/better-auth/better-auth/security/advisories/GHSA-fvxx-76fc-893x)),
+email-change links stay valid after the address changes hands
+([GHSA-hwq2-v29r-p69r](https://github.com/better-auth/better-auth/security/advisories/GHSA-hwq2-v29r-p69r)),
+and passkey verification does not enforce origin or user verification
+([GHSA-gv75-j3v8-3crm](https://github.com/better-auth/better-auth/security/advisories/GHSA-gv75-j3v8-3crm)).
+It also pins better-call 1.4.5, which closes
+[GHSA-23w8-wx9r-vm57](https://github.com/better-auth/better-call/security/advisories/GHSA-23w8-wx9r-vm57)
+(high, shared router context). That one is a second layer only: better-auth's own handler builds a
+fresh router per request, so the flaw is not reachable through it. Older flaws stay behind the
+floor too: before
+1.7.12 better-auth verifies JWTs with the algorithm named in the token's own header
+([#11925](https://github.com/better-auth/better-auth/pull/11925)), and below 1.7.7 the OAuth
+state can be used as a magic link to sign in as another user
+([GHSA-965c-763c-88jm](https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm),
+critical). All of these are in the server end, so your API must run 1.7.16 too
+(`@lenne.tech/nest-server` 12.3.1 declares the same range), and the pin below keeps both halves
+on it.
 
 ## Installation
 
 ```bash
-npm install @lenne.tech/nuxt-extensions better-auth@1.7.12
+npm install @lenne.tech/nuxt-extensions better-auth@1.7.16
 # Optional: For passkey support
-npm install @better-auth/passkey@1.7.12
+npm install @better-auth/passkey@1.7.16
 # Optional: For TUS file uploads
 npm install tus-js-client
 ```
@@ -70,8 +84,9 @@ In a fullstack monorepo, pin it workspace-wide so the api and the app cannot dri
 ```yaml
 # pnpm-workspace.yaml
 overrides:
-  better-auth: 1.7.12
-  '@better-auth/passkey': 1.7.12
+  better-auth: 1.7.16
+  '@better-auth/passkey': 1.7.16
+  '@better-auth/core': 1.7.16 # the api of nest-server-starter projects depends on it directly
 ```
 
 ## Features
@@ -709,6 +724,77 @@ await load();
 is private to the owner; `scope: 'tenant'` is shared across the owner's tenant. The list
 returned by `load()` is already server-filtered to what the user is allowed to see.
 
+### AI status
+
+`useLtAiStatus()` says whether the API's AI module is on, so AI pages and navigation entries can
+be shown only then. It reads the public `GET /ai/status` of nest-server: 200 `{ mcp }` while the
+module is on, 404 while it is off.
+
+```typescript
+// middleware/ai.ts
+export default defineNuxtRouteMiddleware(async () => {
+  const status = useLtAiStatus();
+  await status.load();
+  if (!status.enabled.value) {
+    return navigateTo('/app');
+  }
+});
+```
+
+- One request per app start. The state is shared (`useState`) and travels from SSR to the
+  client, and callers that load at the same time share one request. `load({ force: true })` asks
+  again.
+- Sent without credentials; the endpoint is public.
+- Fails closed. A 404 means "AI is off" and sets no `error`. A network error, a timeout (5 s),
+  any other status or a malformed body leaves `enabled` false and sets `error`.
+- `GET /ai/status` exists from nest-server 12.3.1. An older API answers 404 as well, so AI reads
+  as off there. Gate on this only once your API runs 12.3.1 or later.
+- `mcp` says whether the API serves MCP. Show the MCP confirmation switch below only then.
+
+### MCP confirmation switch
+
+Over MCP (Claude Desktop, Claude Code and other clients), nest-server 12.3.0 or later asks the
+user before a destructive tool runs, and before a mutating one if the server is configured that
+way. Each user may switch the question off for themselves, like a "bypass permissions" mode.
+`useLtAiSettings()` reads and changes that switch (`GET/PUT /ai/settings`):
+
+```vue
+<script setup lang="ts">
+const { enforced, load, settings, update } = useLtAiSettings();
+await load();
+
+async function toggle(value: boolean) {
+  try {
+    await update({ mcpConfirmation: value });
+  } catch {
+    // `error` holds the message; `settings` keeps the previous value, so the switch snaps back
+  }
+}
+</script>
+
+<template>
+  <USwitch
+    v-if="settings"
+    :model-value="settings.mcpConfirmation"
+    :disabled="enforced"
+    label="Ask before destructive AI actions over MCP"
+    @update:model-value="toggle"
+  />
+</template>
+```
+
+- Mount the switch only once `settings` is loaded (`v-if`). reka-ui's `Switch` decides at mount
+  whether it is controlled: mounted with `undefined`, for example while `onMounted(load)` is still
+  running, it keeps its own state, and a refused change then stays flipped although `settings`
+  kept the old value.
+- `settings` is always the value as it takes effect, never just the stored choice. `update()`
+  adopts the server's answer instead of the input.
+- `enforced` is true when the server fixed the value (`ai.mcp.confirmation.enforced`). Show the
+  switch disabled. A change is refused with 403 `#LTNS_0609`, which `update()` throws.
+- Switching it off lets an MCP client run destructive tools in this user's name without asking.
+  Say so next to the switch. The tool's own `authorize()` check and the admin's `deny` / `ask`
+  rules still apply, and other users and the in-app chat are not affected.
+
 ### Lower-level + supporting composables
 
 | Composable | Purpose |
@@ -716,6 +802,8 @@ returned by `load()` is already server-filtered to what the user is allowed to s
 | `useLtAi()` | One-shot `prompt(input)` and streaming `promptStream(input, handlers)` (POST `/ai/stream`) |
 | `useLtAiChat()` | Multi-turn chat state, streaming, budget, confirmation, `stop()`/`clear()`, optional `maxMessages` cap, auto-stop on component unmount |
 | `useLtAiConnections()` | User self-service: available connections + `select()` (`selected`/`locked`) |
+| `useLtAiSettings()` | The user's own AI settings: the MCP confirmation switch + `update()` (`enforced`) |
+| `useLtAiStatus()` | Whether the API's AI module is on (`enabled`, `mcp`), shared state, one request per app start |
 | `useLtAiUsage()` | Full token/prompt usage breakdown (`GET /ai/usage`) |
 | `useLtAiPrompts()` | User-facing CRUD for re-usable prompt snippets ("Vorlagen", `scope: 'user'` / `'tenant'`) |
 | `useLtAiPlaceholders()` | Loads `{{placeholder}}` registry from the backend so slot / prompt editors render a dynamic helper sidebar |
@@ -829,6 +917,8 @@ The package works **with or without** `@nuxtjs/i18n`:
 | `useLtAi()` | One-shot `prompt()` + streaming `promptStream()` for the nest-server AI module |
 | `useLtAiChat()` | Multi-turn chat state, streaming, budget summary, confirmation gate, `maxMessages` cap |
 | `useLtAiConnections()` | User self-service connection list + `select()` |
+| `useLtAiSettings()` | The user's own AI settings (MCP confirmation switch, nest-server >= 12.3.0) |
+| `useLtAiStatus()` | Whether the API's AI module is on and serves MCP (public `GET /ai/status`) |
 | `useLtAiUsage()` | Token/prompt usage breakdown per user / tenant |
 | `useLtAiPrompts()` | User-facing prompt snippet CRUD (`'user'` / `'tenant'` scope) |
 | `useLtAiPlaceholders()` | Loads the backend's `{{placeholder}}` registry |

package/dist/module.d.mts

@@ -3,7 +3,7 @@ import { LtExtensionsModuleOptions } from '../dist/runtime/types/index.js';
 export * from '../dist/runtime/types/index.js';
 
 declare const name = "@lenne.tech/nuxt-extensions";
-declare const version = "1.21.0";
+declare const version = "1.23.0";
 declare const configKey = "ltExtensions";
 declare const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 declare const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "configKey": "ltExtensions",
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.21.0",
+  "version": "1.23.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -2,7 +2,7 @@ import { defineNuxtModule, createResolver, tryResolveModule, addImports, addComp
 import { pathToFileURL } from 'node:url';
 
 const name = "@lenne.tech/nuxt-extensions";
-const version = "1.21.0";
+const version = "1.23.0";
 const configKey = "ltExtensions";
 const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";
@@ -204,6 +204,8 @@ const module$1 = defineNuxtModule({
         { name: "useLtAi", from: resolve("./runtime/composables/use-lt-ai") },
         { name: "useLtAiChat", from: resolve("./runtime/composables/use-lt-ai-chat") },
         { name: "useLtAiConnections", from: resolve("./runtime/composables/use-lt-ai-connections") },
+        { name: "useLtAiSettings", from: resolve("./runtime/composables/use-lt-ai-settings") },
+        { name: "useLtAiStatus", from: resolve("./runtime/composables/use-lt-ai-status") },
         { name: "useLtAiUsage", from: resolve("./runtime/composables/use-lt-ai-usage") },
         { name: "useLtAiPrompts", from: resolve("./runtime/composables/use-lt-ai-prompts") },
         { name: "useLtAiPlaceholders", from: resolve("./runtime/composables/use-lt-ai-placeholders") },

package/dist/runtime/composables/index.d.ts

@@ -8,6 +8,8 @@ export { useLtErrorTranslation } from './use-lt-error-translation.js';
 export { useLtAi } from './use-lt-ai.js';
 export { useLtAiChat } from './use-lt-ai-chat.js';
 export { useLtAiConnections } from './use-lt-ai-connections.js';
+export { useLtAiSettings } from './use-lt-ai-settings.js';
+export { useLtAiStatus } from './use-lt-ai-status.js';
 export { useLtAiUsage } from './use-lt-ai-usage.js';
 export { useLtAiAdmin } from './use-lt-ai-admin.js';
 export { useLtAiPrompts } from './use-lt-ai-prompts.js';

package/dist/runtime/composables/index.js

@@ -8,6 +8,8 @@ export { useLtErrorTranslation } from "./use-lt-error-translation.js";
 export { useLtAi } from "./use-lt-ai.js";
 export { useLtAiChat } from "./use-lt-ai-chat.js";
 export { useLtAiConnections } from "./use-lt-ai-connections.js";
+export { useLtAiSettings } from "./use-lt-ai-settings.js";
+export { useLtAiStatus } from "./use-lt-ai-status.js";
 export { useLtAiUsage } from "./use-lt-ai-usage.js";
 export { useLtAiAdmin } from "./use-lt-ai-admin.js";
 export { useLtAiPrompts } from "./use-lt-ai-prompts.js";

package/dist/runtime/composables/use-lt-ai-settings.d.ts

@@ -0,0 +1,12 @@
+/**
+ * User self-service for the current user's own AI settings, today whether MCP
+ * asks before a destructive or mutating tool runs (a "bypass permissions"
+ * switch). Backed by `GET /ai/settings` and `PUT /ai/settings`
+ * (nest-server >= 12.3.0).
+ *
+ * The answer is always the setting as it takes effect. When the server fixes
+ * it (`ai.mcp.confirmation.enforced`), `enforced` is true, the switch should be
+ * shown disabled, and `update()` is refused with 403 (`#LTNS_0609`).
+ */
+import type { UseLtAiSettingsReturn } from '../types/ai.js';
+export declare function useLtAiSettings(): UseLtAiSettingsReturn;

package/dist/runtime/composables/use-lt-ai-settings.js

@@ -0,0 +1,32 @@
+import { computed, readonly, ref } from "#imports";
+import { ltAiRequest } from "../lib/ai.js";
+export function useLtAiSettings() {
+  const settings = ref(null);
+  const loading = ref(false);
+  const error = ref(null);
+  const enforced = computed(() => settings.value?.mcpConfirmationEnforced === true);
+  async function load() {
+    loading.value = true;
+    error.value = null;
+    try {
+      settings.value = await ltAiRequest("GET", "/settings");
+    } catch (err) {
+      error.value = err.message;
+    } finally {
+      loading.value = false;
+    }
+  }
+  async function update(input) {
+    loading.value = true;
+    error.value = null;
+    try {
+      settings.value = await ltAiRequest("PUT", "/settings", input);
+    } catch (err) {
+      error.value = err.message;
+      throw err;
+    } finally {
+      loading.value = false;
+    }
+  }
+  return { enforced, error: readonly(error), load, loading: readonly(loading), settings: readonly(settings), update };
+}

package/dist/runtime/composables/use-lt-ai-status.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Whether the API's AI module is on, and whether it serves MCP. Backed by the
+ * public `GET /ai/status` of nest-server: 200 `{ mcp }` while the module is on,
+ * 404 while it is off (the route does not exist then).
+ *
+ * The state is shared app-wide (`useState`) and travels from SSR to the client,
+ * so layout, route middleware and pages together cause one request per app
+ * start. It is sent without credentials: the endpoint is public, and the
+ * auth-aware fetch would start its 401 handling for nothing.
+ *
+ * Fails closed: anything but a well-formed 200 leaves `enabled` false. A 404 is
+ * an answer ("AI is off") and sets no `error`; a network error, a timeout, any
+ * other status or a malformed body sets `error`.
+ */
+import type { UseLtAiStatusReturn } from '../types/ai.js';
+export declare function useLtAiStatus(): UseLtAiStatusReturn;

package/dist/runtime/composables/use-lt-ai-status.js

@@ -0,0 +1,57 @@
+import { computed, useNuxtApp, useState } from "#imports";
+import { buildLtAiUrl } from "../lib/ai.js";
+const LT_AI_STATUS_KEY = "lt-ai-status";
+const LT_AI_STATUS_TIMEOUT_MS = 5e3;
+const inflight = /* @__PURE__ */ new WeakMap();
+async function fetchLtAiStatus() {
+  const failed = (error) => ({ enabled: false, error, loaded: true, mcp: false });
+  let response;
+  try {
+    response = await fetch(buildLtAiUrl("/status"), {
+      credentials: "omit",
+      headers: { Accept: "application/json" },
+      signal: AbortSignal.timeout(LT_AI_STATUS_TIMEOUT_MS)
+    });
+  } catch (err) {
+    return failed(err?.name === "TimeoutError" ? "AI status request timed out" : "AI status request failed");
+  }
+  if (response.status === 404) {
+    return { enabled: false, error: null, loaded: true, mcp: false };
+  }
+  if (!response.ok) {
+    return failed(`HTTP ${response.status}`);
+  }
+  try {
+    const body = await response.json();
+    if (typeof body?.mcp === "boolean") {
+      return { enabled: true, error: null, loaded: true, mcp: body.mcp };
+    }
+  } catch {
+  }
+  return failed("Unexpected AI status response");
+}
+export function useLtAiStatus() {
+  const state = useState(LT_AI_STATUS_KEY, () => ({ enabled: false, error: null, loaded: false, mcp: false }));
+  const nuxtApp = useNuxtApp();
+  function load(options) {
+    if (state.value.loaded && !options?.force) {
+      return Promise.resolve();
+    }
+    const running = inflight.get(nuxtApp);
+    if (running) {
+      return running;
+    }
+    const request = fetchLtAiStatus().then((status) => {
+      state.value = status;
+    }).finally(() => inflight.delete(nuxtApp));
+    inflight.set(nuxtApp, request);
+    return request;
+  }
+  return {
+    enabled: computed(() => state.value.enabled),
+    error: computed(() => state.value.error),
+    load,
+    loaded: computed(() => state.value.loaded),
+    mcp: computed(() => state.value.mcp)
+  };
+}

package/dist/runtime/lib/auth-client.d.ts

@@ -323,7 +323,31 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         headers?: {} | {
             [x: string]: string | undefined;
             accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
-            "content-type"?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "application/octet-stream" | "multipart/form-data") | undefined;
+            "content-type"
+            /**
+             * Register additional Better Auth plugins before auth client initialization.
+             *
+             * Call this in a Nuxt plugin (client-side) or in app.vue setup before
+             * the auth client is used.
+             *
+             * If the auth client was already created, it will be automatically recreated
+             * with the new plugins on next access.
+             *
+             * @example
+             * ```typescript
+             * // plugins/auth-plugins.client.ts
+             * import { registerLtAuthPlugins } from '@lenne.tech/nuxt-extensions/lib';
+             * import { organizationClient, magicLinkClient } from 'better-auth/client/plugins';
+             *
+             * export default defineNuxtPlugin(() => {
+             *   registerLtAuthPlugins([
+             *     organizationClient(),
+             *     magicLinkClient(),
+             *   ]);
+             * });
+             * ```
+             */
+            ?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "application/octet-stream" | "multipart/form-data") | undefined;
             authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
         } | undefined;
         body?: any;

package/dist/runtime/lib/passkey-stub.d.ts

@@ -59,6 +59,10 @@ export declare const PASSKEY_ERROR_CODES: Readonly<{
         code: string;
         message: string;
     };
+    ORIGIN_NOT_CONFIGURED: {
+        code: string;
+        message: string;
+    };
     PASSKEY_NOT_FOUND: {
         code: string;
         message: string;

package/dist/runtime/lib/passkey-stub.js

@@ -18,6 +18,10 @@ export const PASSKEY_ERROR_CODES = Object.freeze({
   CHALLENGE_NOT_FOUND: { code: "CHALLENGE_NOT_FOUND", message: "Challenge not found" },
   FAILED_TO_UPDATE_PASSKEY: { code: "FAILED_TO_UPDATE_PASSKEY", message: "Failed to update passkey" },
   FAILED_TO_VERIFY_REGISTRATION: { code: "FAILED_TO_VERIFY_REGISTRATION", message: "Failed to verify registration" },
+  ORIGIN_NOT_CONFIGURED: {
+    code: "ORIGIN_NOT_CONFIGURED",
+    message: "Passkey origin is not configured. Set the `origin` option of the passkey plugin or configure `baseURL`."
+  },
   PASSKEY_NOT_FOUND: { code: "PASSKEY_NOT_FOUND", message: "Passkey not found" },
   PREVIOUSLY_REGISTERED: { code: "PREVIOUSLY_REGISTERED", message: "Previously registered" },
   REGISTRATION_CANCELLED: { code: "REGISTRATION_CANCELLED", message: "Registration cancelled" },

package/dist/runtime/types/ai.d.ts

@@ -126,6 +126,28 @@ export interface LtAiAvailableConnection {
     name?: string;
     selected?: boolean;
 }
+/** The current user's AI settings as they take effect (`GET/PUT /ai/settings`, nest-server >= 12.3.0). */
+export interface LtAiSettings {
+    /** Whether MCP asks this user before a destructive tool (and a mutating one, if configured) runs. */
+    mcpConfirmation: boolean;
+    /** Whether the server fixed `mcpConfirmation`, so the user cannot change it (a change answers 403 `#LTNS_0609`). */
+    mcpConfirmationEnforced: boolean;
+}
+/** The user's own choices for `PUT /ai/settings`; a field left out stays unchanged. */
+export interface LtAiSettingsInput {
+    mcpConfirmation?: boolean;
+}
+/** Whether the API's AI module is on (`GET /ai/status`), as `useLtAiStatus()` holds it. */
+export interface LtAiStatus {
+    /** True only after a well-formed 200: the AI module is on. */
+    enabled: boolean;
+    /** Why the status could not be read (network, timeout, other status, malformed body); null for an answer, 404 included. */
+    error: null | string;
+    /** True once an answer or an error is in. */
+    loaded: boolean;
+    /** Whether the API serves MCP; false whenever `enabled` is false. */
+    mcp: boolean;
+}
 /** Usage for a single scope (user or tenant). */
 export interface LtAiUsageScope {
     maxPrompts?: number;
@@ -429,6 +451,26 @@ export interface UseLtAiConnectionsReturn {
     select: (connectionId: string) => Promise<void>;
     selected: ComputedRef<LtAiAvailableConnection | undefined>;
 }
+export interface UseLtAiStatusReturn {
+    enabled: ComputedRef<boolean>;
+    error: ComputedRef<null | string>;
+    /** Reads the status once per app start; `force` asks again. Never throws. */
+    load: (options?: {
+        force?: boolean;
+    }) => Promise<void>;
+    loaded: ComputedRef<boolean>;
+    mcp: ComputedRef<boolean>;
+}
+export interface UseLtAiSettingsReturn {
+    /** True when the server fixed the MCP confirmation: show the switch disabled. */
+    enforced: ComputedRef<boolean>;
+    error: DeepReadonly<Ref<null | string>>;
+    load: () => Promise<void>;
+    loading: DeepReadonly<Ref<boolean>>;
+    settings: DeepReadonly<Ref<LtAiSettings | null>>;
+    /** Stores the user's choice and adopts the answer; throws (and sets `error`) when refused. */
+    update: (input: LtAiSettingsInput) => Promise<void>;
+}
 export interface UseLtAiUsageReturn {
     error: DeepReadonly<Ref<null | string>>;
     loading: DeepReadonly<Ref<boolean>>;

package/dist/runtime/types/index.d.ts

@@ -3,4 +3,4 @@ export type { LtFileInfo, LtUploadItem, LtUploadOptions, LtUploadProgress, LtUpl
 export type { LtAiModuleOptions, LtAuthCookieNamesOptions, LtAuthModuleOptions, LtErrorTranslationModuleOptions, LtExtensionsModuleOptions, LtExtensionsPublicRuntimeConfig, LtFormLabelAssociationOptions, LtI18nModuleOptions, LtPreHydrationInputOptions, LtSystemSetupModuleOptions, LtTusModuleOptions, } from './module.js';
 export type { LtErrorTranslationResponse, LtParsedError, UseLtErrorTranslationReturn } from './error.js';
 export type { LtSyncConflict, LtSyncConflictResolution, LtSyncIdFormat, LtSyncItemStatus, LtSyncModuleOptions, LtSyncPushResult, LtSyncRecord, LtSyncResult, UseLtOfflineSyncOptions, UseLtOfflineSyncReturn, } from './sync.js';
-export type { LtAiAction, LtAiAvailableConnection, LtAiBudgetLimit, LtAiBudgetSummary, LtAiConnection, LtAiConnectionInput, LtAiConnectionPreference, LtAiEffectiveSlot, LtAiInteraction, LtAiMessage, LtAiMode, LtAiPlaceholder, LtAiPrompt, LtAiPromptHint, LtAiPromptHintInput, LtAiPromptInput, LtAiPromptRunInput, LtAiResponse, LtAiSlot, LtAiSlotInput, LtAiStreamEvent, LtAiStreamHandlers, LtAiUsage, LtAiUsageInfo, LtAiUsageScope, UseLtAiAdminReturn, UseLtAiChatOptions, UseLtAiChatReturn, UseLtAiConnectionsReturn, UseLtAiPlaceholdersReturn, UseLtAiPromptsReturn, UseLtAiReturn, UseLtAiUsageReturn, } from './ai.js';
+export type { LtAiAction, LtAiAvailableConnection, LtAiBudgetLimit, LtAiBudgetSummary, LtAiConnection, LtAiConnectionInput, LtAiConnectionPreference, LtAiEffectiveSlot, LtAiInteraction, LtAiMessage, LtAiMode, LtAiPlaceholder, LtAiPrompt, LtAiPromptHint, LtAiPromptHintInput, LtAiPromptInput, LtAiPromptRunInput, LtAiResponse, LtAiSettings, LtAiSettingsInput, LtAiSlot, LtAiStatus, LtAiSlotInput, LtAiStreamEvent, LtAiStreamHandlers, LtAiUsage, LtAiUsageInfo, LtAiUsageScope, UseLtAiAdminReturn, UseLtAiChatOptions, UseLtAiChatReturn, UseLtAiConnectionsReturn, UseLtAiPlaceholdersReturn, UseLtAiPromptsReturn, UseLtAiReturn, UseLtAiSettingsReturn, UseLtAiStatusReturn, UseLtAiUsageReturn, } from './ai.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.21.0",
+  "version": "1.23.0",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",
@@ -79,9 +79,9 @@
     "@nuxt/kit": "^4.0.0"
   },
   "peerDependencies": {
-    "@better-auth/passkey": ">=1.7.12 <1.8.0",
+    "@better-auth/passkey": ">=1.7.16 <1.8.0",
     "@playwright/test": ">=1.0.0",
-    "better-auth": ">=1.7.12 <1.8.0",
+    "better-auth": ">=1.7.16 <1.8.0",
     "nuxt": "^4.0.0",
     "tus-js-client": ">=4.0.0"
   },
@@ -100,26 +100,26 @@
     }
   },
   "devDependencies": {
-    "@better-auth/passkey": "1.7.12",
+    "@better-auth/passkey": "1.7.16",
     "@nuxt/module-builder": "1.0.3",
-    "@nuxt/schema": "4.6.3",
+    "@nuxt/schema": "4.6.4",
     "@nuxt/ui": "4.12.0",
     "@playwright/test": "1.64.1",
     "@types/node": "26.6.6",
-    "@vitest/coverage-v8": "5.0.5",
+    "@vitest/coverage-v8": "5.1.0",
     "@vue/server-renderer": "3.5.44",
-    "better-auth": "1.7.12",
+    "better-auth": "1.7.16",
     "cross-spawn": "7.0.6",
     "fake-indexeddb": "6.2.7",
     "happy-dom": "21.0.4",
-    "nuxt": "4.6.3",
+    "nuxt": "4.6.4",
     "oxfmt": "0.75.0",
     "oxlint": "1.90.0",
     "oxlint-tsgolint": "7.0.2005",
     "reka-ui": "2.11.0",
     "tus-js-client": "4.3.1",
     "typescript": "5.9.3",
-    "vitest": "5.0.5",
+    "vitest": "5.1.0",
     "vue-tsc": "3.3.14"
   },
   "keywords": [