@lenne.tech/nuxt-extensions 1.22.0 → 1.24.0

package/CLAUDE.md

@@ -13,7 +13,7 @@ src/
 │   ├── lib/               # Library exports (auth-client, auth-state, ai)
 │   ├── middleware/        # Route middleware (system setup)
 │   ├── plugins/           # Nuxt plugins (auth interceptor, error translation, config check)
-│   ├── server/            # server-side tsconfig scope (no runtime routes; auth talks to the backend directly)
+│   ├── server/            # Nitro code: the opt-in security.txt route (auth talks to the backend directly, no proxy)
 │   ├── testing/           # Playwright test helpers
 │   ├── types/             # TypeScript type definitions
 │   └── utils/             # Auto-imported utility functions
@@ -41,6 +41,7 @@ src/
 | `useLtAiChat()` | Multi-turn chat: streaming, budget summary, confirmation gate, `stop()`/`clear()`, optional `maxMessages` cap, auto-stop on unmount |
 | `useLtAiConnections()` | User-facing list of available connections + `select()` |
 | `useLtAiSettings()` | The user's own AI settings: MCP confirmation switch (`GET/PUT /ai/settings`, `enforced` → show disabled) |
+| `useLtAiStatus()` | Whether the API's AI module is on (`GET /ai/status`, public; 404 = off): `enabled`, `mcp`, shared `useState`, one request per app start, fails closed |
 | `useLtAiUsage()` | Full token/prompt usage breakdown (`GET /ai/usage`) |
 | `useLtAiPrompts()` | User-facing CRUD for re-usable prompt snippets ("Vorlagen", `scope: 'user'` / `'tenant'`) |
 | `useLtAiPlaceholders()` | Loads the backend's `{{placeholder}}` registry for editor sidebars |
@@ -95,6 +96,10 @@ export default defineNuxtConfig({
       enabled: true,                 // keep text typed before hydration instead of losing it
       maxRestoreMs: 1500,            // how long to keep repairing deferred subtrees
     },
+    securityTxt: {
+      enabled: false,                // opt-in: /.well-known/security.txt (RFC 9116)
+      contact: 'mailto:security@lenne.tech',
+    },
   },
 });
 ```
@@ -403,6 +408,35 @@ fields at `app:beforeMount` and restores them at `app:mounted`, dispatching a sy
   takes over.
 - Opt out with `ltExtensions.preHydrationInput.enabled: false`.
 
+## security.txt (RFC 9116)
+
+`ltExtensions.securityTxt.enabled: true` serves `/.well-known/security.txt`. Contact defaults to
+`mailto:security@lenne.tech`. Builder: `runtime/server/lib/security-txt.ts` (pure, tested in
+`test/security-txt.test.ts`). Route: `runtime/server/routes/security-txt.ts`.
+
+- **Do not replace it with a static file in `public/`.** `Expires` is computed per request so it
+  never runs out between deployments. A static file expires silently, and scanners drop it.
+- **Do not register it with a method.** `addServerHandler` without `method` answers HEAD too;
+  scanners probe with HEAD.
+- **Values live in the server-only runtime config** (`runtimeConfig.ltExtensions.securityTxt`), so
+  `NUXT_LT_EXTENSIONS_SECURITY_TXT_*` overrides them per stage. `enabled` is build-time only.
+- **`Canonical` from the request host only via the `hosts` allowlist.** The host is a request
+  header; anything not listed must never reach the file.
+- **No list defaults in `defaultOptions`.** `defineNuxtModule` merges them with `defu`, which
+  concatenates arrays: a default `['de', 'en']` turned a project's `['en']` into `en, de, en`. Set
+  list defaults where the option is read. `test/security-txt.test.ts` runs the real merge.
+- **A contact that is not a `mailto:`, `https://` or `tel:` URI counts as blank**, so a bare address
+  ends in a 404 rather than a file scanners reject. If a project reports a 404 with the option on,
+  check the contact first.
+- For a customer project, ask whether reports go to lenne.Tech or the customer before enabling it.
+- **No `tsconfig.json` under `src/runtime`.** Vendoring copies that tree one level deeper, so a
+  relative `extends` points at nothing, and `oxlint --type-aware` then stops every vendored project's
+  `check` with `Invalid tsconfig`. Nitro code is typechecked through the root `tsconfig.server.json`.
+  No gate here runs in vendor mode, so `test/vendored-core.test.ts` holds this.
+- **The `nuxt/schema` blocks in `runtime/types/module.ts` augment `PublicRuntimeConfig` and nothing
+  else.** Vendoring turns them into project source, where they cause TS2310, and the cli removes a
+  block only while it holds that one interface. Type server-only config where it is read.
+
 ## Development Rules
 
 1. **ALWAYS read source code** in `dist/runtime/` to understand available composables and components
@@ -412,7 +446,7 @@ fields at `app:beforeMount` and restores them at `app:mounted`, dispatching a sy
    Handling" below).
 3. **Check existing composables** before creating new ones — this module may already provide what you need
 4. **Peer dependencies** (`better-auth`, `@better-auth/passkey`, `tus-js-client`) must be installed in the consuming project.
-   `better-auth` and `@better-auth/passkey` are pinned to **`>=1.7.12 <1.8.0`** — deliberately not a caret.
+   `better-auth` and `@better-auth/passkey` are pinned to **`>=1.7.16 <1.8.0`** — deliberately not a caret.
    **They move in lock-step with `@lenne.tech/nest-server`.** better-auth is one protocol with two ends;
    this module is the client end, nest-server the server end, and both declare the *same* narrow range.
    Raising it means raising it in **both** framework repos and pinning the new version in **both** starters,

package/README.md

@@ -29,8 +29,8 @@ Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.t
 |---|---|---|
 | Node | `>= 22` | |
 | Nuxt | `^4.0.0` | |
-| `better-auth` | `>=1.7.12 <1.8.0` | **required peer** — pin it, see below |
-| `@better-auth/passkey` | `>=1.7.12 <1.8.0` | optional peer, passkey/WebAuthn only |
+| `better-auth` | `>=1.7.16 <1.8.0` | **required peer** — pin it, see below |
+| `@better-auth/passkey` | `>=1.7.16 <1.8.0` | optional peer, passkey/WebAuthn only |
 | `tus-js-client` | `>=4.0.0` | optional peer, resumable uploads only |
 | `@lenne.tech/nest-server` | `>= 11.37.0` | **only if you use the backend** — see the lock-step rule |
 
@@ -38,7 +38,7 @@ Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.t
 better-auth is one protocol with two ends. This module is the client end and
 `@lenne.tech/nest-server` is the server end, and they must resolve the **same**
 better-auth minor. better-auth breaks in *minor* releases — 1.7 removed subpath
-exports and changed the 2FA response shape — so a caret (`^1.7.12`) would re-open the
+exports and changed the 2FA response shape — so a caret (`^1.7.16`) would re-open the
 hole at 1.8. If the api and the app drift apart, 2FA activation fails at runtime with a
 generic client error while **both** projects' checks stay green: each is internally
 consistent, and only the assembled workspace has both halves.
@@ -46,21 +46,35 @@ consistent, and only the assembled workspace has both halves.
 Raising better-auth therefore means raising it in `@lenne.tech/nest-server` **and**
 `@lenne.tech/nuxt-extensions` in one step.
 
-**Why the floor is 1.7.12:** better-auth before 1.7.12 verifies JWTs with the algorithm named
-in the token's own header instead of the algorithm of the stored key
-([#11925](https://github.com/better-auth/better-auth/pull/11925)). Below 1.7.7 it is also
-affected by
-[GHSA-965c-763c-88jm](https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm)
-(critical): the OAuth state can be used as a magic link to sign in as another user. Both flaws
-are in the server end, so your API must run 1.7.12 too (`@lenne.tech/nest-server` 12.0.0
-declares the same range), and the pin below keeps both halves on it.
+**Why the floor is 1.7.16:** better-auth 1.7.16 closes twelve advisories published on
+2026-11-03. Among those that reach a typical lt project: a social sign-in can treat an unverified
+provider email as verified
+([GHSA-9hm7-xhfp-cx58](https://github.com/better-auth/better-auth/security/advisories/GHSA-9hm7-xhfp-cx58)),
+revoked sessions can stay valid with secondary storage or the cookie cache
+([GHSA-fvxx-76fc-893x](https://github.com/better-auth/better-auth/security/advisories/GHSA-fvxx-76fc-893x)),
+email-change links stay valid after the address changes hands
+([GHSA-hwq2-v29r-p69r](https://github.com/better-auth/better-auth/security/advisories/GHSA-hwq2-v29r-p69r)),
+and passkey verification does not enforce origin or user verification
+([GHSA-gv75-j3v8-3crm](https://github.com/better-auth/better-auth/security/advisories/GHSA-gv75-j3v8-3crm)).
+It also pins better-call 1.4.5, which closes
+[GHSA-23w8-wx9r-vm57](https://github.com/better-auth/better-call/security/advisories/GHSA-23w8-wx9r-vm57)
+(high, shared router context). That one is a second layer only: better-auth's own handler builds a
+fresh router per request, so the flaw is not reachable through it. Older flaws stay behind the
+floor too: before
+1.7.12 better-auth verifies JWTs with the algorithm named in the token's own header
+([#11925](https://github.com/better-auth/better-auth/pull/11925)), and below 1.7.7 the OAuth
+state can be used as a magic link to sign in as another user
+([GHSA-965c-763c-88jm](https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm),
+critical). All of these are in the server end, so your API must run 1.7.16 too
+(`@lenne.tech/nest-server` 12.3.1 declares the same range), and the pin below keeps both halves
+on it.
 
 ## Installation
 
 ```bash
-npm install @lenne.tech/nuxt-extensions better-auth@1.7.12
+npm install @lenne.tech/nuxt-extensions better-auth@1.7.16
 # Optional: For passkey support
-npm install @better-auth/passkey@1.7.12
+npm install @better-auth/passkey@1.7.16
 # Optional: For TUS file uploads
 npm install tus-js-client
 ```
@@ -70,8 +84,9 @@ In a fullstack monorepo, pin it workspace-wide so the api and the app cannot dri
 ```yaml
 # pnpm-workspace.yaml
 overrides:
-  better-auth: 1.7.12
-  '@better-auth/passkey': 1.7.12
+  better-auth: 1.7.16
+  '@better-auth/passkey': 1.7.16
+  '@better-auth/core': 1.7.16 # the api of nest-server-starter projects depends on it directly
 ```
 
 ## Features
@@ -82,6 +97,7 @@ overrides:
 - **Offline Sync** - Read and write offline, reconcile with the nest-server sync module (opt-in)
 - **Transition Components** - Ready-to-use Vue transition wrappers
 - **i18n Support** - English and German translations (works without i18n too)
+- **security.txt** - Opt-in RFC 9116 file that never expires between deployments
 - **Auto-imports** - All composables and components are auto-imported
 - **Pre-hydration input preservation** - text typed before hydration is kept, not erased
 - **Form label repair** - restores `<label for>` associations that hydration breaks
@@ -198,6 +214,12 @@ export default defineNuxtConfig({
       basePath: '/ai',              // Must match the nest-server AI controller
     },
 
+    // security.txt at /.well-known/security.txt (see "security.txt" below)
+    securityTxt: {
+      enabled: false,               // Opt-in
+      contact: 'mailto:security@lenne.tech',
+    },
+
     // Offline sync (opt-in, see "Offline Sync" below)
     sync: {
       enabled: false,               // Enable useLtOfflineSync() and the sign-out cleanup
@@ -363,6 +385,61 @@ export default defineNuxtConfig({
 });
 ```
 
+## security.txt (RFC 9116)
+
+A `security.txt` tells security researchers where to report a vulnerability. The module can serve
+one at `/.well-known/security.txt`. It is **off by default**: only turn it on where somebody
+actually reads the contact address. A published address that nobody answers is worse than none.
+
+```ts
+export default defineNuxtConfig({
+  ltExtensions: {
+    securityTxt: {
+      enabled: true,
+      // All optional:
+      contact: 'mailto:security@lenne.tech',   // default; string or array, mailto:/https:/tel:
+      hosts: ['example.com', 'www.example.com'], // hostnames served without a redirect
+      preferredLanguages: ['de', 'en'],          // default
+      validDays: 180,                            // default; clamped to 365
+      policy: '/security-policy',                // a path is resolved against the site URL
+    },
+  },
+});
+```
+
+Response for `https://example.com`:
+
+```text
+Contact: mailto:security@lenne.tech
+Expires: 2027-04-26T00:00:00.000Z
+Preferred-Languages: de, en
+Canonical: https://example.com/.well-known/security.txt
+```
+
+**For a customer project, decide where reports go.** The default sends them to lenne.Tech. If the
+customer wants reports themselves, set their address.
+
+How it behaves:
+
+- **`Expires` never runs out.** The file is built per request: "now + `validDays`", cut to
+  midnight UTC. A file written once at deploy time would expire on its own, and scanners such as
+  the BSI's drop an expired file without telling anyone.
+- **`Canonical`** names `runtimeConfig.public.siteUrl` (`NUXT_PUBLIC_SITE_URL`; the module declares
+  the key while the option is on). If the site answers under more than one hostname without a redirect (apex
+  and `www`), list them in `hosts`. A request for one of them adds a second `Canonical` line,
+  because RFC 9116 expects the URL a file was fetched from to be listed. The host comes from a
+  request header, so only hosts on that list ever reach the file.
+- **GET and HEAD** both answer `200` with `text/plain; charset=utf-8` and `cache-control: no-store`.
+- **Overridable per stage at runtime**, without a rebuild:
+  `NUXT_LT_EXTENSIONS_SECURITY_TXT_CONTACT`, `…_HOSTS` (`"example.com,www.example.com"`),
+  `…_PREFERRED_LANGUAGES`, `…_VALID_DAYS`, `…_POLICY`. Only `enabled` is fixed at build time.
+- **A contact must be a URI.** `mailto:`, `https://` or `tel:`; a bare `security@example.com` counts
+  as no contact. Without a usable contact, including a blanked one, the route answers `404`, because
+  a file without `Contact` is invalid.
+- **Never prerendered.** The route is excluded from prerendering, so `Expires` is not frozen at
+  build time. A fully static site (`nuxt generate`) has no server to answer it at all. The module
+  warns about that at build time.
+
 ## Usage
 
 ### Authentication
@@ -709,6 +786,33 @@ await load();
 is private to the owner; `scope: 'tenant'` is shared across the owner's tenant. The list
 returned by `load()` is already server-filtered to what the user is allowed to see.
 
+### AI status
+
+`useLtAiStatus()` says whether the API's AI module is on, so AI pages and navigation entries can
+be shown only then. It reads the public `GET /ai/status` of nest-server: 200 `{ mcp }` while the
+module is on, 404 while it is off.
+
+```typescript
+// middleware/ai.ts
+export default defineNuxtRouteMiddleware(async () => {
+  const status = useLtAiStatus();
+  await status.load();
+  if (!status.enabled.value) {
+    return navigateTo('/app');
+  }
+});
+```
+
+- One request per app start. The state is shared (`useState`) and travels from SSR to the
+  client, and callers that load at the same time share one request. `load({ force: true })` asks
+  again.
+- Sent without credentials; the endpoint is public.
+- Fails closed. A 404 means "AI is off" and sets no `error`. A network error, a timeout (5 s),
+  any other status or a malformed body leaves `enabled` false and sets `error`.
+- `GET /ai/status` exists from nest-server 12.3.1. An older API answers 404 as well, so AI reads
+  as off there. Gate on this only once your API runs 12.3.1 or later.
+- `mcp` says whether the API serves MCP. Show the MCP confirmation switch below only then.
+
 ### MCP confirmation switch
 
 Over MCP (Claude Desktop, Claude Code and other clients), nest-server 12.3.0 or later asks the
@@ -732,14 +836,19 @@ async function toggle(value: boolean) {
 
 <template>
   <USwitch
-    :model-value="settings?.mcpConfirmation"
-    :disabled="enforced || !settings"
+    v-if="settings"
+    :model-value="settings.mcpConfirmation"
+    :disabled="enforced"
     label="Ask before destructive AI actions over MCP"
     @update:model-value="toggle"
   />
 </template>
 ```
 
+- Mount the switch only once `settings` is loaded (`v-if`). reka-ui's `Switch` decides at mount
+  whether it is controlled: mounted with `undefined`, for example while `onMounted(load)` is still
+  running, it keeps its own state, and a refused change then stays flipped although `settings`
+  kept the old value.
 - `settings` is always the value as it takes effect, never just the stored choice. `update()`
   adopts the server's answer instead of the input.
 - `enforced` is true when the server fixed the value (`ai.mcp.confirmation.enforced`). Show the
@@ -756,6 +865,7 @@ async function toggle(value: boolean) {
 | `useLtAiChat()` | Multi-turn chat state, streaming, budget, confirmation, `stop()`/`clear()`, optional `maxMessages` cap, auto-stop on component unmount |
 | `useLtAiConnections()` | User self-service: available connections + `select()` (`selected`/`locked`) |
 | `useLtAiSettings()` | The user's own AI settings: the MCP confirmation switch + `update()` (`enforced`) |
+| `useLtAiStatus()` | Whether the API's AI module is on (`enabled`, `mcp`), shared state, one request per app start |
 | `useLtAiUsage()` | Full token/prompt usage breakdown (`GET /ai/usage`) |
 | `useLtAiPrompts()` | User-facing CRUD for re-usable prompt snippets ("Vorlagen", `scope: 'user'` / `'tenant'`) |
 | `useLtAiPlaceholders()` | Loads `{{placeholder}}` registry from the backend so slot / prompt editors render a dynamic helper sidebar |
@@ -870,6 +980,7 @@ The package works **with or without** `@nuxtjs/i18n`:
 | `useLtAiChat()` | Multi-turn chat state, streaming, budget summary, confirmation gate, `maxMessages` cap |
 | `useLtAiConnections()` | User self-service connection list + `select()` |
 | `useLtAiSettings()` | The user's own AI settings (MCP confirmation switch, nest-server >= 12.3.0) |
+| `useLtAiStatus()` | Whether the API's AI module is on and serves MCP (public `GET /ai/status`) |
 | `useLtAiUsage()` | Token/prompt usage breakdown per user / tenant |
 | `useLtAiPrompts()` | User-facing prompt snippet CRUD (`'user'` / `'tenant'` scope) |
 | `useLtAiPlaceholders()` | Loads the backend's `{{placeholder}}` registry |

package/dist/module.d.mts

@@ -3,7 +3,7 @@ import { LtExtensionsModuleOptions } from '../dist/runtime/types/index.js';
 export * from '../dist/runtime/types/index.js';
 
 declare const name = "@lenne.tech/nuxt-extensions";
-declare const version = "1.22.0";
+declare const version = "1.24.0";
 declare const configKey = "ltExtensions";
 declare const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 declare const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "configKey": "ltExtensions",
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.22.0",
+  "version": "1.24.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,8 +1,9 @@
-import { defineNuxtModule, createResolver, tryResolveModule, addImports, addComponent, addPlugin, addRouteMiddleware } from '@nuxt/kit';
+import { defineNuxtModule, createResolver, tryResolveModule, addImports, addComponent, addPlugin, addRouteMiddleware, addServerHandler } from '@nuxt/kit';
 import { pathToFileURL } from 'node:url';
+import { SECURITY_TXT_DEFAULT_VALID_DAYS, SECURITY_TXT_DEFAULT_LANGUAGES, SECURITY_TXT_DEFAULT_CONTACT, SECURITY_TXT_PATH } from '../dist/runtime/server/lib/security-txt.js';
 
 const name = "@lenne.tech/nuxt-extensions";
-const version = "1.22.0";
+const version = "1.24.0";
 const configKey = "ltExtensions";
 const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";
@@ -46,6 +47,12 @@ const defaultOptions = {
   preHydrationInput: {
     enabled: true
   },
+  // Only the switch. `defineNuxtModule` merges these defaults with `defu`, which concatenates arrays,
+  // so a list here would be appended to the project's own. The other defaults are set where the
+  // option is read, in the `securityTxt` block of `setup`.
+  securityTxt: {
+    enabled: false
+  },
   // Opt-in: an app without offline sync gets no auto-import and no sign-out cleanup
   sync: {
     basePath: "/sync",
@@ -79,6 +86,7 @@ const module$1 = defineNuxtModule({
       formLabelAssociation: { ...defaultOptions.formLabelAssociation, ...options.formLabelAssociation },
       i18n: { ...defaultOptions.i18n, ...options.i18n },
       preHydrationInput: { ...defaultOptions.preHydrationInput, ...options.preHydrationInput },
+      securityTxt: { ...defaultOptions.securityTxt, ...options.securityTxt },
       sync: { ...defaultOptions.sync, ...options.sync },
       tus: { ...defaultOptions.tus, ...options.tus }
     };
@@ -205,6 +213,7 @@ const module$1 = defineNuxtModule({
         { name: "useLtAiChat", from: resolve("./runtime/composables/use-lt-ai-chat") },
         { name: "useLtAiConnections", from: resolve("./runtime/composables/use-lt-ai-connections") },
         { name: "useLtAiSettings", from: resolve("./runtime/composables/use-lt-ai-settings") },
+        { name: "useLtAiStatus", from: resolve("./runtime/composables/use-lt-ai-status") },
         { name: "useLtAiUsage", from: resolve("./runtime/composables/use-lt-ai-usage") },
         { name: "useLtAiPrompts", from: resolve("./runtime/composables/use-lt-ai-prompts") },
         { name: "useLtAiPlaceholders", from: resolve("./runtime/composables/use-lt-ai-placeholders") },
@@ -255,6 +264,33 @@ const module$1 = defineNuxtModule({
     if (resolvedOptions.formLabelAssociation.enabled !== false) {
       addPlugin(resolve("./runtime/plugins/form-label-association.client"));
     }
+    if (resolvedOptions.securityTxt.enabled === true) {
+      const securityTxt = resolvedOptions.securityTxt;
+      rc.public.siteUrl ??= "";
+      nuxt.options.runtimeConfig.ltExtensions = {
+        ...nuxt.options.runtimeConfig.ltExtensions,
+        securityTxt: {
+          contact: securityTxt.contact ?? SECURITY_TXT_DEFAULT_CONTACT,
+          hosts: securityTxt.hosts ?? [],
+          policy: securityTxt.policy ?? "",
+          preferredLanguages: securityTxt.preferredLanguages ?? SECURITY_TXT_DEFAULT_LANGUAGES,
+          validDays: securityTxt.validDays ?? SECURITY_TXT_DEFAULT_VALID_DAYS
+        }
+      };
+      addServerHandler({ handler: resolve("./runtime/server/routes/security-txt"), route: SECURITY_TXT_PATH });
+      nuxt.options.routeRules = {
+        ...nuxt.options.routeRules,
+        [SECURITY_TXT_PATH]: { ...nuxt.options.routeRules?.[SECURITY_TXT_PATH], prerender: false }
+      };
+      nuxt.options.nitro ??= {};
+      nuxt.options.nitro.prerender ??= {};
+      nuxt.options.nitro.prerender.ignore = [...nuxt.options.nitro.prerender.ignore ?? [], SECURITY_TXT_PATH];
+      if (nuxt.options._generate || nuxt.options.nitro.static) {
+        console.warn(
+          `[${name}] securityTxt is enabled, but this is a static build (nuxt generate): there is no server to answer ${SECURITY_TXT_PATH}, so the file will be missing. Serve it with a server build, or place a static file yourself and keep its Expires current.`
+        );
+      }
+    }
     nuxt.options.build.transpile.push(resolve("./runtime"));
     nuxt.options.build.transpile.push("tus-js-client");
     if (await tryResolveModule("tus-js-client", [pathToFileURL(`${nuxt.options.rootDir}/`)])) {

package/dist/runtime/composables/index.d.ts

@@ -9,6 +9,7 @@ export { useLtAi } from './use-lt-ai.js';
 export { useLtAiChat } from './use-lt-ai-chat.js';
 export { useLtAiConnections } from './use-lt-ai-connections.js';
 export { useLtAiSettings } from './use-lt-ai-settings.js';
+export { useLtAiStatus } from './use-lt-ai-status.js';
 export { useLtAiUsage } from './use-lt-ai-usage.js';
 export { useLtAiAdmin } from './use-lt-ai-admin.js';
 export { useLtAiPrompts } from './use-lt-ai-prompts.js';

package/dist/runtime/composables/index.js

@@ -9,6 +9,7 @@ export { useLtAi } from "./use-lt-ai.js";
 export { useLtAiChat } from "./use-lt-ai-chat.js";
 export { useLtAiConnections } from "./use-lt-ai-connections.js";
 export { useLtAiSettings } from "./use-lt-ai-settings.js";
+export { useLtAiStatus } from "./use-lt-ai-status.js";
 export { useLtAiUsage } from "./use-lt-ai-usage.js";
 export { useLtAiAdmin } from "./use-lt-ai-admin.js";
 export { useLtAiPrompts } from "./use-lt-ai-prompts.js";

package/dist/runtime/composables/use-lt-ai-status.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Whether the API's AI module is on, and whether it serves MCP. Backed by the
+ * public `GET /ai/status` of nest-server: 200 `{ mcp }` while the module is on,
+ * 404 while it is off (the route does not exist then).
+ *
+ * The state is shared app-wide (`useState`) and travels from SSR to the client,
+ * so layout, route middleware and pages together cause one request per app
+ * start. It is sent without credentials: the endpoint is public, and the
+ * auth-aware fetch would start its 401 handling for nothing.
+ *
+ * Fails closed: anything but a well-formed 200 leaves `enabled` false. A 404 is
+ * an answer ("AI is off") and sets no `error`; a network error, a timeout, any
+ * other status or a malformed body sets `error`.
+ */
+import type { UseLtAiStatusReturn } from '../types/ai.js';
+export declare function useLtAiStatus(): UseLtAiStatusReturn;

package/dist/runtime/composables/use-lt-ai-status.js

@@ -0,0 +1,57 @@
+import { computed, useNuxtApp, useState } from "#imports";
+import { buildLtAiUrl } from "../lib/ai.js";
+const LT_AI_STATUS_KEY = "lt-ai-status";
+const LT_AI_STATUS_TIMEOUT_MS = 5e3;
+const inflight = /* @__PURE__ */ new WeakMap();
+async function fetchLtAiStatus() {
+  const failed = (error) => ({ enabled: false, error, loaded: true, mcp: false });
+  let response;
+  try {
+    response = await fetch(buildLtAiUrl("/status"), {
+      credentials: "omit",
+      headers: { Accept: "application/json" },
+      signal: AbortSignal.timeout(LT_AI_STATUS_TIMEOUT_MS)
+    });
+  } catch (err) {
+    return failed(err?.name === "TimeoutError" ? "AI status request timed out" : "AI status request failed");
+  }
+  if (response.status === 404) {
+    return { enabled: false, error: null, loaded: true, mcp: false };
+  }
+  if (!response.ok) {
+    return failed(`HTTP ${response.status}`);
+  }
+  try {
+    const body = await response.json();
+    if (typeof body?.mcp === "boolean") {
+      return { enabled: true, error: null, loaded: true, mcp: body.mcp };
+    }
+  } catch {
+  }
+  return failed("Unexpected AI status response");
+}
+export function useLtAiStatus() {
+  const state = useState(LT_AI_STATUS_KEY, () => ({ enabled: false, error: null, loaded: false, mcp: false }));
+  const nuxtApp = useNuxtApp();
+  function load(options) {
+    if (state.value.loaded && !options?.force) {
+      return Promise.resolve();
+    }
+    const running = inflight.get(nuxtApp);
+    if (running) {
+      return running;
+    }
+    const request = fetchLtAiStatus().then((status) => {
+      state.value = status;
+    }).finally(() => inflight.delete(nuxtApp));
+    inflight.set(nuxtApp, request);
+    return request;
+  }
+  return {
+    enabled: computed(() => state.value.enabled),
+    error: computed(() => state.value.error),
+    load,
+    loaded: computed(() => state.value.loaded),
+    mcp: computed(() => state.value.mcp)
+  };
+}

package/dist/runtime/lib/auth-client.d.ts

@@ -323,7 +323,31 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         headers?: {} | {
             [x: string]: string | undefined;
             accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
-            "content-type"?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "application/octet-stream" | "multipart/form-data") | undefined;
+            "content-type"
+            /**
+             * Register additional Better Auth plugins before auth client initialization.
+             *
+             * Call this in a Nuxt plugin (client-side) or in app.vue setup before
+             * the auth client is used.
+             *
+             * If the auth client was already created, it will be automatically recreated
+             * with the new plugins on next access.
+             *
+             * @example
+             * ```typescript
+             * // plugins/auth-plugins.client.ts
+             * import { registerLtAuthPlugins } from '@lenne.tech/nuxt-extensions/lib';
+             * import { organizationClient, magicLinkClient } from 'better-auth/client/plugins';
+             *
+             * export default defineNuxtPlugin(() => {
+             *   registerLtAuthPlugins([
+             *     organizationClient(),
+             *     magicLinkClient(),
+             *   ]);
+             * });
+             * ```
+             */
+            ?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "application/octet-stream" | "multipart/form-data") | undefined;
             authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
         } | undefined;
         body?: any;

package/dist/runtime/lib/passkey-stub.d.ts

@@ -59,6 +59,10 @@ export declare const PASSKEY_ERROR_CODES: Readonly<{
         code: string;
         message: string;
     };
+    ORIGIN_NOT_CONFIGURED: {
+        code: string;
+        message: string;
+    };
     PASSKEY_NOT_FOUND: {
         code: string;
         message: string;

package/dist/runtime/lib/passkey-stub.js

@@ -18,6 +18,10 @@ export const PASSKEY_ERROR_CODES = Object.freeze({
   CHALLENGE_NOT_FOUND: { code: "CHALLENGE_NOT_FOUND", message: "Challenge not found" },
   FAILED_TO_UPDATE_PASSKEY: { code: "FAILED_TO_UPDATE_PASSKEY", message: "Failed to update passkey" },
   FAILED_TO_VERIFY_REGISTRATION: { code: "FAILED_TO_VERIFY_REGISTRATION", message: "Failed to verify registration" },
+  ORIGIN_NOT_CONFIGURED: {
+    code: "ORIGIN_NOT_CONFIGURED",
+    message: "Passkey origin is not configured. Set the `origin` option of the passkey plugin or configure `baseURL`."
+  },
   PASSKEY_NOT_FOUND: { code: "PASSKEY_NOT_FOUND", message: "Passkey not found" },
   PREVIOUSLY_REGISTERED: { code: "PREVIOUSLY_REGISTERED", message: "Previously registered" },
   REGISTRATION_CANCELLED: { code: "REGISTRATION_CANCELLED", message: "Registration cancelled" },

package/dist/runtime/server/lib/security-txt.d.ts

@@ -0,0 +1,83 @@
+/**
+ * security.txt according to RFC 9116, built per request.
+ *
+ * Ported from the lenne.Tech website (DEV-3602), where it has been live since 2026-10-13.
+ * Pure functions only, so the route stays a thin adapter and everything that decides the
+ * file's content is unit-testable without a Nitro context.
+ */
+export declare const SECURITY_TXT_PATH = "/.well-known/security.txt";
+export declare const SECURITY_TXT_DEFAULT_CONTACT = "mailto:security@lenne.tech";
+export declare const SECURITY_TXT_DEFAULT_LANGUAGES: string[];
+export declare const SECURITY_TXT_DEFAULT_VALID_DAYS = 180;
+export interface SecurityTxtOptions {
+    /** Contact URIs (`mailto:`, `https:` or `tel:`), in order of preference. */
+    contacts: string[];
+    /** Point in time the file is built for; `Expires` is derived from it. */
+    now: Date;
+    /** Origins the file is served from; each becomes one `Canonical` line. */
+    origins: string[];
+    /** URI of the vulnerability disclosure policy, or a path resolved against the first origin. */
+    policy?: string;
+    /** Language tags in order of preference. */
+    preferredLanguages?: string[];
+    /** Days between `now` and `Expires`. */
+    validDays?: number;
+}
+/**
+ * Normalises the configured contact(s). Accepts a string or an array, because a runtime override
+ * via `NUXT_LT_EXTENSIONS_SECURITY_TXT_CONTACT` arrives as a plain string.
+ *
+ * Whatever is not a usable URI is dropped. `security@example.com` is the obvious typo, and scanners
+ * treat the file it would produce as invalid; with no contact left, the route answers 404 instead.
+ */
+export declare function normalizeSecurityTxtContacts(contact: unknown): string[];
+/**
+ * Normalises a list option (languages, hosts). A runtime override via an environment variable
+ * arrives as a string, so `"de, en"` is accepted as well as `['de', 'en']`.
+ */
+export declare function normalizeSecurityTxtList(value: unknown): string[];
+/**
+ * Clamps `validDays` into the window RFC 9116 recommends. A non-finite or non-positive value
+ * falls back to the default instead of producing an `Expires` in the past.
+ */
+export declare function normalizeSecurityTxtValidDays(validDays: unknown): number;
+/**
+ * Turns a configured site URL into an origin (`https://example.com`), dropping path, query and
+ * trailing slash. Anything that is not an absolute http(s) URL yields `undefined`.
+ */
+export declare function toSecurityTxtOrigin(url: string | undefined): string | undefined;
+/**
+ * Turns the requested host into an origin, but only if it is one the site is known to be served
+ * from. The host comes from a request header, so anything else must not end up in the file.
+ */
+export declare function allowedRequestOrigin(host: string | undefined, allowedHosts: string[]): string | undefined;
+/**
+ * Builds a security.txt according to RFC 9116.
+ *
+ * `Expires` is relative to `now`, so a file built per request never goes stale, no matter how
+ * long ago the last deployment was. It is cut to midnight UTC, which makes the file valid for up
+ * to a day less than `validDays` and keeps it byte-identical for a whole day.
+ */
+export declare function buildSecurityTxt(options: SecurityTxtOptions): string;
+/** The server-only runtime config the module writes to `runtimeConfig.ltExtensions.securityTxt`. */
+export interface SecurityTxtRuntimeConfig {
+    contact?: string | string[];
+    hosts?: string | string[];
+    policy?: string;
+    preferredLanguages?: string | string[];
+    validDays?: number | string;
+}
+/**
+ * Turns the runtime config and the request into the file's content, or `undefined` when no
+ * usable contact is left (the route then answers 404).
+ *
+ * `Canonical` names the configured site URL and, in addition, the requested host if it is one of
+ * the configured `hosts`. A site served under several hostnames without a redirect needs the
+ * second line: RFC 9116 expects the URI a file was fetched from among its Canonical lines.
+ */
+export declare function resolveSecurityTxt(input: {
+    config: SecurityTxtRuntimeConfig | undefined;
+    now: Date;
+    requestHost: string | undefined;
+    siteUrl: string | undefined;
+}): string | undefined;

package/dist/runtime/server/lib/security-txt.js

@@ -0,0 +1,87 @@
+export const SECURITY_TXT_PATH = "/.well-known/security.txt";
+export const SECURITY_TXT_DEFAULT_CONTACT = "mailto:security@lenne.tech";
+export const SECURITY_TXT_DEFAULT_LANGUAGES = ["de", "en"];
+export const SECURITY_TXT_DEFAULT_VALID_DAYS = 180;
+const SECURITY_TXT_MAX_VALID_DAYS = 365;
+const DAY_MS = 24 * 60 * 60 * 1e3;
+const CONTACT_URI = /^(?:mailto:|tel:|https:\/\/)\S/i;
+function isSingleToken(value) {
+  return typeof value === "string" && value.length > 0 && !/\s/.test(value);
+}
+export function normalizeSecurityTxtContacts(contact) {
+  const values = Array.isArray(contact) ? contact : [contact];
+  return values.map((value) => typeof value === "string" ? value.trim() : value).filter(isSingleToken).filter((value) => CONTACT_URI.test(value));
+}
+export function normalizeSecurityTxtList(value) {
+  const values = typeof value === "string" ? value.split(",") : Array.isArray(value) ? value : [];
+  return values.map((entry) => typeof entry === "string" ? entry.trim() : entry).filter(isSingleToken);
+}
+export function normalizeSecurityTxtValidDays(validDays) {
+  const days = Number(validDays);
+  if (!Number.isFinite(days) || days < 1) {
+    return SECURITY_TXT_DEFAULT_VALID_DAYS;
+  }
+  return Math.min(Math.floor(days), SECURITY_TXT_MAX_VALID_DAYS);
+}
+export function toSecurityTxtOrigin(url) {
+  if (!url) {
+    return void 0;
+  }
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.origin : void 0;
+  } catch {
+    return void 0;
+  }
+}
+export function allowedRequestOrigin(host, allowedHosts) {
+  const name = host?.trim().toLowerCase();
+  const allowed = allowedHosts.map((entry) => entry.trim().toLowerCase());
+  return name && allowed.includes(name) ? `https://${name}` : void 0;
+}
+function resolveAgainstOrigin(value, origin) {
+  if (!isSingleToken(value)) {
+    return void 0;
+  }
+  if (!value.startsWith("/")) {
+    return value;
+  }
+  return origin ? `${origin}${value}` : void 0;
+}
+export function buildSecurityTxt(options) {
+  const { contacts, now, origins, policy, preferredLanguages = [] } = options;
+  const validDays = normalizeSecurityTxtValidDays(options.validDays ?? SECURITY_TXT_DEFAULT_VALID_DAYS);
+  const expires = new Date(Math.floor((now.getTime() + validDays * DAY_MS) / DAY_MS) * DAY_MS);
+  const canonicals = [...new Set(origins.map((origin) => origin.replace(/\/+$/, "")).filter(Boolean))];
+  const languages = preferredLanguages.map((language) => language.trim()).filter(isSingleToken);
+  const lines = [...contacts.filter(isSingleToken).map((contact) => `Contact: ${contact}`), `Expires: ${expires.toISOString()}`];
+  const policyUri = resolveAgainstOrigin(policy, canonicals[0]);
+  if (policyUri) {
+    lines.push(`Policy: ${policyUri}`);
+  }
+  if (languages.length) {
+    lines.push(`Preferred-Languages: ${languages.join(", ")}`);
+  }
+  for (const origin of canonicals) {
+    lines.push(`Canonical: ${origin}${SECURITY_TXT_PATH}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+export function resolveSecurityTxt(input) {
+  const config = input.config ?? {};
+  const contacts = normalizeSecurityTxtContacts(config.contact);
+  if (!contacts.length) {
+    return void 0;
+  }
+  const siteOrigin = toSecurityTxtOrigin(input.siteUrl);
+  const requestOrigin = allowedRequestOrigin(input.requestHost, normalizeSecurityTxtList(config.hosts));
+  return buildSecurityTxt({
+    contacts,
+    now: input.now,
+    origins: [siteOrigin, requestOrigin].filter((origin) => !!origin),
+    policy: config.policy,
+    preferredLanguages: normalizeSecurityTxtList(config.preferredLanguages),
+    validDays: normalizeSecurityTxtValidDays(config.validDays)
+  });
+}

package/dist/runtime/server/routes/security-txt.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Serves `/.well-known/security.txt` (RFC 9116). Registered by the module only when
+ * `ltExtensions.securityTxt.enabled` is set.
+ *
+ * Registered without a method on purpose: scanners probe with HEAD as well as GET, and a
+ * GET-only handler would answer HEAD with the 404 catch-all.
+ */
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/security-txt.js

@@ -0,0 +1,19 @@
+import { createError, defineEventHandler, getRequestHost, setResponseHeader, useRuntimeConfig } from "#imports";
+import { resolveSecurityTxt } from "../lib/security-txt.js";
+export default defineEventHandler((event) => {
+  const config = useRuntimeConfig(event);
+  const siteUrl = config.public?.siteUrl;
+  const ltExtensions = config.ltExtensions;
+  const body = resolveSecurityTxt({
+    config: ltExtensions?.securityTxt,
+    now: /* @__PURE__ */ new Date(),
+    requestHost: getRequestHost(event, { xForwardedHost: true }),
+    siteUrl: typeof siteUrl === "string" ? siteUrl : void 0
+  });
+  if (!body) {
+    throw createError({ statusCode: 404, statusMessage: "Not Found" });
+  }
+  setResponseHeader(event, "content-type", "text/plain; charset=utf-8");
+  setResponseHeader(event, "cache-control", "no-store");
+  return body;
+});

package/dist/runtime/types/ai.d.ts

@@ -137,6 +137,17 @@ export interface LtAiSettings {
 export interface LtAiSettingsInput {
     mcpConfirmation?: boolean;
 }
+/** Whether the API's AI module is on (`GET /ai/status`), as `useLtAiStatus()` holds it. */
+export interface LtAiStatus {
+    /** True only after a well-formed 200: the AI module is on. */
+    enabled: boolean;
+    /** Why the status could not be read (network, timeout, other status, malformed body); null for an answer, 404 included. */
+    error: null | string;
+    /** True once an answer or an error is in. */
+    loaded: boolean;
+    /** Whether the API serves MCP; false whenever `enabled` is false. */
+    mcp: boolean;
+}
 /** Usage for a single scope (user or tenant). */
 export interface LtAiUsageScope {
     maxPrompts?: number;
@@ -440,6 +451,16 @@ export interface UseLtAiConnectionsReturn {
     select: (connectionId: string) => Promise<void>;
     selected: ComputedRef<LtAiAvailableConnection | undefined>;
 }
+export interface UseLtAiStatusReturn {
+    enabled: ComputedRef<boolean>;
+    error: ComputedRef<null | string>;
+    /** Reads the status once per app start; `force` asks again. Never throws. */
+    load: (options?: {
+        force?: boolean;
+    }) => Promise<void>;
+    loaded: ComputedRef<boolean>;
+    mcp: ComputedRef<boolean>;
+}
 export interface UseLtAiSettingsReturn {
     /** True when the server fixed the MCP confirmation: show the switch disabled. */
     enforced: ComputedRef<boolean>;

package/dist/runtime/types/index.d.ts

@@ -1,6 +1,6 @@
 export type { LtAuthClientConfig, LtAuthMode, LtAuthResponse, LtAuthState, LtPasskeyAuthResult, LtPasskeyRegisterResult, LtUser, LtUserInput, UseLtAuthReturn } from './auth.js';
 export type { LtFileInfo, LtUploadItem, LtUploadOptions, LtUploadProgress, LtUploadStatus, UseLtFileReturn, UseLtTusUploadReturn } from './upload.js';
-export type { LtAiModuleOptions, LtAuthCookieNamesOptions, LtAuthModuleOptions, LtErrorTranslationModuleOptions, LtExtensionsModuleOptions, LtExtensionsPublicRuntimeConfig, LtFormLabelAssociationOptions, LtI18nModuleOptions, LtPreHydrationInputOptions, LtSystemSetupModuleOptions, LtTusModuleOptions, } from './module.js';
+export type { LtAiModuleOptions, LtAuthCookieNamesOptions, LtAuthModuleOptions, LtErrorTranslationModuleOptions, LtExtensionsModuleOptions, LtExtensionsPublicRuntimeConfig, LtFormLabelAssociationOptions, LtI18nModuleOptions, LtPreHydrationInputOptions, LtSecurityTxtOptions, LtSystemSetupModuleOptions, LtTusModuleOptions, } from './module.js';
 export type { LtErrorTranslationResponse, LtParsedError, UseLtErrorTranslationReturn } from './error.js';
 export type { LtSyncConflict, LtSyncConflictResolution, LtSyncIdFormat, LtSyncItemStatus, LtSyncModuleOptions, LtSyncPushResult, LtSyncRecord, LtSyncResult, UseLtOfflineSyncOptions, UseLtOfflineSyncReturn, } from './sync.js';
-export type { LtAiAction, LtAiAvailableConnection, LtAiBudgetLimit, LtAiBudgetSummary, LtAiConnection, LtAiConnectionInput, LtAiConnectionPreference, LtAiEffectiveSlot, LtAiInteraction, LtAiMessage, LtAiMode, LtAiPlaceholder, LtAiPrompt, LtAiPromptHint, LtAiPromptHintInput, LtAiPromptInput, LtAiPromptRunInput, LtAiResponse, LtAiSettings, LtAiSettingsInput, LtAiSlot, LtAiSlotInput, LtAiStreamEvent, LtAiStreamHandlers, LtAiUsage, LtAiUsageInfo, LtAiUsageScope, UseLtAiAdminReturn, UseLtAiChatOptions, UseLtAiChatReturn, UseLtAiConnectionsReturn, UseLtAiPlaceholdersReturn, UseLtAiPromptsReturn, UseLtAiReturn, UseLtAiSettingsReturn, UseLtAiUsageReturn, } from './ai.js';
+export type { LtAiAction, LtAiAvailableConnection, LtAiBudgetLimit, LtAiBudgetSummary, LtAiConnection, LtAiConnectionInput, LtAiConnectionPreference, LtAiEffectiveSlot, LtAiInteraction, LtAiMessage, LtAiMode, LtAiPlaceholder, LtAiPrompt, LtAiPromptHint, LtAiPromptHintInput, LtAiPromptInput, LtAiPromptRunInput, LtAiResponse, LtAiSettings, LtAiSettingsInput, LtAiSlot, LtAiStatus, LtAiSlotInput, LtAiStreamEvent, LtAiStreamHandlers, LtAiUsage, LtAiUsageInfo, LtAiUsageScope, UseLtAiAdminReturn, UseLtAiChatOptions, UseLtAiChatReturn, UseLtAiConnectionsReturn, UseLtAiPlaceholdersReturn, UseLtAiPromptsReturn, UseLtAiReturn, UseLtAiSettingsReturn, UseLtAiStatusReturn, UseLtAiUsageReturn, } from './ai.js';

package/dist/runtime/types/module.d.ts

@@ -148,6 +148,8 @@ export interface LtExtensionsModuleOptions {
     i18n?: LtI18nModuleOptions;
     /** Pre-hydration input preservation configuration */
     preHydrationInput?: LtPreHydrationInputOptions;
+    /** security.txt (RFC 9116) at `/.well-known/security.txt` */
+    securityTxt?: LtSecurityTxtOptions;
     /** Offline sync with the nest-server sync module (opt-in) */
     sync?: LtSyncModuleOptions;
     /** TUS upload module configuration */
@@ -271,6 +273,67 @@ export interface LtPreHydrationInputOptions {
      */
     maxRestoreMs?: number;
 }
+/**
+ * security.txt according to RFC 9116, served at `/.well-known/security.txt`.
+ *
+ * The file tells security researchers where to report a vulnerability. Off by default: only turn
+ * it on where somebody actually reads the contact address — a published address that nobody
+ * answers is worse than none.
+ *
+ * The file is built per request. `Expires` is always "now + `validDays`", cut to midnight UTC, so
+ * it never runs out between deployments. `Canonical` names `runtimeConfig.public.siteUrl`
+ * (`NUXT_PUBLIC_SITE_URL`, the module declares the key) and, in addition, the requested host if it
+ * is listed in `hosts`.
+ *
+ * Everything except `enabled` can be overridden per stage at runtime, without a rebuild:
+ * `NUXT_LT_EXTENSIONS_SECURITY_TXT_CONTACT`, `…_HOSTS`, `…_POLICY`, `…_PREFERRED_LANGUAGES`,
+ * `…_VALID_DAYS`. Blanking the contact that way makes the route answer 404, because a file without
+ * `Contact` is invalid.
+ *
+ * Not available with `nuxt generate`: a static site has no server to compute the file.
+ *
+ * @example
+ * ```ts
+ * export default defineNuxtConfig({
+ *   ltExtensions: {
+ *     securityTxt: {
+ *       enabled: true,
+ *       contact: 'mailto:security@customer.example',
+ *       hosts: ['customer.example', 'www.customer.example'],
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export interface LtSecurityTxtOptions {
+    /**
+     * Contact URI(s), in order of preference: `mailto:`, `https://` or `tel:`. Anything else, such
+     * as a bare address, counts as no contact, and the route answers 404.
+     * Defaults to `'mailto:security@lenne.tech'`. For a customer project, decide whether reports go
+     * to lenne.Tech or to the customer, and set it explicitly.
+     */
+    contact?: string | string[];
+    /** Serve the file. Defaults to `false`. */
+    enabled?: boolean;
+    /**
+     * Hostnames the site is served from without a redirect (e.g. apex and `www`). A request for one
+     * of them adds a second `Canonical` line for that host. The host comes from a request header,
+     * so nothing outside this list ever reaches the file. Defaults to `[]`.
+     */
+    hosts?: string[];
+    /**
+     * URI of the vulnerability disclosure policy. A path (`/security-policy`) is resolved against the
+     * site URL and left out when no site URL is configured.
+     */
+    policy?: string;
+    /** Language tags reports may be written in, in order of preference. Defaults to `['de', 'en']`. */
+    preferredLanguages?: string[];
+    /**
+     * Days between the request and `Expires`. Defaults to `180`; clamped to `365` because RFC 9116
+     * recommends less than a year, and a value below `1` falls back to the default.
+     */
+    validDays?: number;
+}
 /**
  * Public runtime config added by this module
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.22.0",
+  "version": "1.24.0",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",
@@ -69,7 +69,7 @@
     "test": "vitest run",
     "test:watch": "vitest watch",
     "test:coverage": "vitest run --coverage",
-    "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit",
+    "test:types": "vue-tsc --noEmit && vue-tsc --noEmit -p tsconfig.server.json && cd playground && vue-tsc --noEmit",
     "release": "pnpm format:check && pnpm run dev:prepare && pnpm lint && pnpm run version:check && pnpm test:types && pnpm test && pnpm run check:consumer && pnpm prepack",
     "check:consumer": "node scripts/check-consumer-build.mjs",
     "check:manifest": "node scripts/check-package-manifest.mjs",
@@ -79,9 +79,9 @@
     "@nuxt/kit": "^4.0.0"
   },
   "peerDependencies": {
-    "@better-auth/passkey": ">=1.7.12 <1.8.0",
+    "@better-auth/passkey": ">=1.7.16 <1.8.0",
     "@playwright/test": ">=1.0.0",
-    "better-auth": ">=1.7.12 <1.8.0",
+    "better-auth": ">=1.7.16 <1.8.0",
     "nuxt": "^4.0.0",
     "tus-js-client": ">=4.0.0"
   },
@@ -100,7 +100,7 @@
     }
   },
   "devDependencies": {
-    "@better-auth/passkey": "1.7.12",
+    "@better-auth/passkey": "1.7.16",
     "@nuxt/module-builder": "1.0.3",
     "@nuxt/schema": "4.6.4",
     "@nuxt/ui": "4.12.0",
@@ -108,7 +108,7 @@
     "@types/node": "26.6.6",
     "@vitest/coverage-v8": "5.1.0",
     "@vue/server-renderer": "3.5.44",
-    "better-auth": "1.7.12",
+    "better-auth": "1.7.16",
     "cross-spawn": "7.0.6",
     "fake-indexeddb": "6.2.7",
     "happy-dom": "21.0.4",

package/dist/runtime/server/tsconfig.json

@@ -1,3 +0,0 @@
-{
-  "extends": "../../../.nuxt/tsconfig.server.json"
-}