@lenne.tech/nuxt-extensions 1.23.0 → 1.24.0

package/CLAUDE.md

@@ -13,7 +13,7 @@ src/
 │   ├── lib/               # Library exports (auth-client, auth-state, ai)
 │   ├── middleware/        # Route middleware (system setup)
 │   ├── plugins/           # Nuxt plugins (auth interceptor, error translation, config check)
-│   ├── server/            # server-side tsconfig scope (no runtime routes; auth talks to the backend directly)
+│   ├── server/            # Nitro code: the opt-in security.txt route (auth talks to the backend directly, no proxy)
 │   ├── testing/           # Playwright test helpers
 │   ├── types/             # TypeScript type definitions
 │   └── utils/             # Auto-imported utility functions
@@ -96,6 +96,10 @@ export default defineNuxtConfig({
       enabled: true,                 // keep text typed before hydration instead of losing it
       maxRestoreMs: 1500,            // how long to keep repairing deferred subtrees
     },
+    securityTxt: {
+      enabled: false,                // opt-in: /.well-known/security.txt (RFC 9116)
+      contact: 'mailto:security@lenne.tech',
+    },
   },
 });
 ```
@@ -404,6 +408,35 @@ fields at `app:beforeMount` and restores them at `app:mounted`, dispatching a sy
   takes over.
 - Opt out with `ltExtensions.preHydrationInput.enabled: false`.
 
+## security.txt (RFC 9116)
+
+`ltExtensions.securityTxt.enabled: true` serves `/.well-known/security.txt`. Contact defaults to
+`mailto:security@lenne.tech`. Builder: `runtime/server/lib/security-txt.ts` (pure, tested in
+`test/security-txt.test.ts`). Route: `runtime/server/routes/security-txt.ts`.
+
+- **Do not replace it with a static file in `public/`.** `Expires` is computed per request so it
+  never runs out between deployments. A static file expires silently, and scanners drop it.
+- **Do not register it with a method.** `addServerHandler` without `method` answers HEAD too;
+  scanners probe with HEAD.
+- **Values live in the server-only runtime config** (`runtimeConfig.ltExtensions.securityTxt`), so
+  `NUXT_LT_EXTENSIONS_SECURITY_TXT_*` overrides them per stage. `enabled` is build-time only.
+- **`Canonical` from the request host only via the `hosts` allowlist.** The host is a request
+  header; anything not listed must never reach the file.
+- **No list defaults in `defaultOptions`.** `defineNuxtModule` merges them with `defu`, which
+  concatenates arrays: a default `['de', 'en']` turned a project's `['en']` into `en, de, en`. Set
+  list defaults where the option is read. `test/security-txt.test.ts` runs the real merge.
+- **A contact that is not a `mailto:`, `https://` or `tel:` URI counts as blank**, so a bare address
+  ends in a 404 rather than a file scanners reject. If a project reports a 404 with the option on,
+  check the contact first.
+- For a customer project, ask whether reports go to lenne.Tech or the customer before enabling it.
+- **No `tsconfig.json` under `src/runtime`.** Vendoring copies that tree one level deeper, so a
+  relative `extends` points at nothing, and `oxlint --type-aware` then stops every vendored project's
+  `check` with `Invalid tsconfig`. Nitro code is typechecked through the root `tsconfig.server.json`.
+  No gate here runs in vendor mode, so `test/vendored-core.test.ts` holds this.
+- **The `nuxt/schema` blocks in `runtime/types/module.ts` augment `PublicRuntimeConfig` and nothing
+  else.** Vendoring turns them into project source, where they cause TS2310, and the cli removes a
+  block only while it holds that one interface. Type server-only config where it is read.
+
 ## Development Rules
 
 1. **ALWAYS read source code** in `dist/runtime/` to understand available composables and components

package/README.md

@@ -97,6 +97,7 @@ overrides:
 - **Offline Sync** - Read and write offline, reconcile with the nest-server sync module (opt-in)
 - **Transition Components** - Ready-to-use Vue transition wrappers
 - **i18n Support** - English and German translations (works without i18n too)
+- **security.txt** - Opt-in RFC 9116 file that never expires between deployments
 - **Auto-imports** - All composables and components are auto-imported
 - **Pre-hydration input preservation** - text typed before hydration is kept, not erased
 - **Form label repair** - restores `<label for>` associations that hydration breaks
@@ -213,6 +214,12 @@ export default defineNuxtConfig({
       basePath: '/ai',              // Must match the nest-server AI controller
     },
 
+    // security.txt at /.well-known/security.txt (see "security.txt" below)
+    securityTxt: {
+      enabled: false,               // Opt-in
+      contact: 'mailto:security@lenne.tech',
+    },
+
     // Offline sync (opt-in, see "Offline Sync" below)
     sync: {
       enabled: false,               // Enable useLtOfflineSync() and the sign-out cleanup
@@ -378,6 +385,61 @@ export default defineNuxtConfig({
 });
 ```
 
+## security.txt (RFC 9116)
+
+A `security.txt` tells security researchers where to report a vulnerability. The module can serve
+one at `/.well-known/security.txt`. It is **off by default**: only turn it on where somebody
+actually reads the contact address. A published address that nobody answers is worse than none.
+
+```ts
+export default defineNuxtConfig({
+  ltExtensions: {
+    securityTxt: {
+      enabled: true,
+      // All optional:
+      contact: 'mailto:security@lenne.tech',   // default; string or array, mailto:/https:/tel:
+      hosts: ['example.com', 'www.example.com'], // hostnames served without a redirect
+      preferredLanguages: ['de', 'en'],          // default
+      validDays: 180,                            // default; clamped to 365
+      policy: '/security-policy',                // a path is resolved against the site URL
+    },
+  },
+});
+```
+
+Response for `https://example.com`:
+
+```text
+Contact: mailto:security@lenne.tech
+Expires: 2027-04-26T00:00:00.000Z
+Preferred-Languages: de, en
+Canonical: https://example.com/.well-known/security.txt
+```
+
+**For a customer project, decide where reports go.** The default sends them to lenne.Tech. If the
+customer wants reports themselves, set their address.
+
+How it behaves:
+
+- **`Expires` never runs out.** The file is built per request: "now + `validDays`", cut to
+  midnight UTC. A file written once at deploy time would expire on its own, and scanners such as
+  the BSI's drop an expired file without telling anyone.
+- **`Canonical`** names `runtimeConfig.public.siteUrl` (`NUXT_PUBLIC_SITE_URL`; the module declares
+  the key while the option is on). If the site answers under more than one hostname without a redirect (apex
+  and `www`), list them in `hosts`. A request for one of them adds a second `Canonical` line,
+  because RFC 9116 expects the URL a file was fetched from to be listed. The host comes from a
+  request header, so only hosts on that list ever reach the file.
+- **GET and HEAD** both answer `200` with `text/plain; charset=utf-8` and `cache-control: no-store`.
+- **Overridable per stage at runtime**, without a rebuild:
+  `NUXT_LT_EXTENSIONS_SECURITY_TXT_CONTACT`, `…_HOSTS` (`"example.com,www.example.com"`),
+  `…_PREFERRED_LANGUAGES`, `…_VALID_DAYS`, `…_POLICY`. Only `enabled` is fixed at build time.
+- **A contact must be a URI.** `mailto:`, `https://` or `tel:`; a bare `security@example.com` counts
+  as no contact. Without a usable contact, including a blanked one, the route answers `404`, because
+  a file without `Contact` is invalid.
+- **Never prerendered.** The route is excluded from prerendering, so `Expires` is not frozen at
+  build time. A fully static site (`nuxt generate`) has no server to answer it at all. The module
+  warns about that at build time.
+
 ## Usage
 
 ### Authentication

package/dist/module.d.mts

@@ -3,7 +3,7 @@ import { LtExtensionsModuleOptions } from '../dist/runtime/types/index.js';
 export * from '../dist/runtime/types/index.js';
 
 declare const name = "@lenne.tech/nuxt-extensions";
-declare const version = "1.23.0";
+declare const version = "1.24.0";
 declare const configKey = "ltExtensions";
 declare const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 declare const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "configKey": "ltExtensions",
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.23.0",
+  "version": "1.24.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,8 +1,9 @@
-import { defineNuxtModule, createResolver, tryResolveModule, addImports, addComponent, addPlugin, addRouteMiddleware } from '@nuxt/kit';
+import { defineNuxtModule, createResolver, tryResolveModule, addImports, addComponent, addPlugin, addRouteMiddleware, addServerHandler } from '@nuxt/kit';
 import { pathToFileURL } from 'node:url';
+import { SECURITY_TXT_DEFAULT_VALID_DAYS, SECURITY_TXT_DEFAULT_LANGUAGES, SECURITY_TXT_DEFAULT_CONTACT, SECURITY_TXT_PATH } from '../dist/runtime/server/lib/security-txt.js';
 
 const name = "@lenne.tech/nuxt-extensions";
-const version = "1.23.0";
+const version = "1.24.0";
 const configKey = "ltExtensions";
 const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";
@@ -46,6 +47,12 @@ const defaultOptions = {
   preHydrationInput: {
     enabled: true
   },
+  // Only the switch. `defineNuxtModule` merges these defaults with `defu`, which concatenates arrays,
+  // so a list here would be appended to the project's own. The other defaults are set where the
+  // option is read, in the `securityTxt` block of `setup`.
+  securityTxt: {
+    enabled: false
+  },
   // Opt-in: an app without offline sync gets no auto-import and no sign-out cleanup
   sync: {
     basePath: "/sync",
@@ -79,6 +86,7 @@ const module$1 = defineNuxtModule({
       formLabelAssociation: { ...defaultOptions.formLabelAssociation, ...options.formLabelAssociation },
       i18n: { ...defaultOptions.i18n, ...options.i18n },
       preHydrationInput: { ...defaultOptions.preHydrationInput, ...options.preHydrationInput },
+      securityTxt: { ...defaultOptions.securityTxt, ...options.securityTxt },
       sync: { ...defaultOptions.sync, ...options.sync },
       tus: { ...defaultOptions.tus, ...options.tus }
     };
@@ -256,6 +264,33 @@ const module$1 = defineNuxtModule({
     if (resolvedOptions.formLabelAssociation.enabled !== false) {
       addPlugin(resolve("./runtime/plugins/form-label-association.client"));
     }
+    if (resolvedOptions.securityTxt.enabled === true) {
+      const securityTxt = resolvedOptions.securityTxt;
+      rc.public.siteUrl ??= "";
+      nuxt.options.runtimeConfig.ltExtensions = {
+        ...nuxt.options.runtimeConfig.ltExtensions,
+        securityTxt: {
+          contact: securityTxt.contact ?? SECURITY_TXT_DEFAULT_CONTACT,
+          hosts: securityTxt.hosts ?? [],
+          policy: securityTxt.policy ?? "",
+          preferredLanguages: securityTxt.preferredLanguages ?? SECURITY_TXT_DEFAULT_LANGUAGES,
+          validDays: securityTxt.validDays ?? SECURITY_TXT_DEFAULT_VALID_DAYS
+        }
+      };
+      addServerHandler({ handler: resolve("./runtime/server/routes/security-txt"), route: SECURITY_TXT_PATH });
+      nuxt.options.routeRules = {
+        ...nuxt.options.routeRules,
+        [SECURITY_TXT_PATH]: { ...nuxt.options.routeRules?.[SECURITY_TXT_PATH], prerender: false }
+      };
+      nuxt.options.nitro ??= {};
+      nuxt.options.nitro.prerender ??= {};
+      nuxt.options.nitro.prerender.ignore = [...nuxt.options.nitro.prerender.ignore ?? [], SECURITY_TXT_PATH];
+      if (nuxt.options._generate || nuxt.options.nitro.static) {
+        console.warn(
+          `[${name}] securityTxt is enabled, but this is a static build (nuxt generate): there is no server to answer ${SECURITY_TXT_PATH}, so the file will be missing. Serve it with a server build, or place a static file yourself and keep its Expires current.`
+        );
+      }
+    }
     nuxt.options.build.transpile.push(resolve("./runtime"));
     nuxt.options.build.transpile.push("tus-js-client");
     if (await tryResolveModule("tus-js-client", [pathToFileURL(`${nuxt.options.rootDir}/`)])) {

package/dist/runtime/server/lib/security-txt.d.ts

@@ -0,0 +1,83 @@
+/**
+ * security.txt according to RFC 9116, built per request.
+ *
+ * Ported from the lenne.Tech website (DEV-3602), where it has been live since 2026-10-13.
+ * Pure functions only, so the route stays a thin adapter and everything that decides the
+ * file's content is unit-testable without a Nitro context.
+ */
+export declare const SECURITY_TXT_PATH = "/.well-known/security.txt";
+export declare const SECURITY_TXT_DEFAULT_CONTACT = "mailto:security@lenne.tech";
+export declare const SECURITY_TXT_DEFAULT_LANGUAGES: string[];
+export declare const SECURITY_TXT_DEFAULT_VALID_DAYS = 180;
+export interface SecurityTxtOptions {
+    /** Contact URIs (`mailto:`, `https:` or `tel:`), in order of preference. */
+    contacts: string[];
+    /** Point in time the file is built for; `Expires` is derived from it. */
+    now: Date;
+    /** Origins the file is served from; each becomes one `Canonical` line. */
+    origins: string[];
+    /** URI of the vulnerability disclosure policy, or a path resolved against the first origin. */
+    policy?: string;
+    /** Language tags in order of preference. */
+    preferredLanguages?: string[];
+    /** Days between `now` and `Expires`. */
+    validDays?: number;
+}
+/**
+ * Normalises the configured contact(s). Accepts a string or an array, because a runtime override
+ * via `NUXT_LT_EXTENSIONS_SECURITY_TXT_CONTACT` arrives as a plain string.
+ *
+ * Whatever is not a usable URI is dropped. `security@example.com` is the obvious typo, and scanners
+ * treat the file it would produce as invalid; with no contact left, the route answers 404 instead.
+ */
+export declare function normalizeSecurityTxtContacts(contact: unknown): string[];
+/**
+ * Normalises a list option (languages, hosts). A runtime override via an environment variable
+ * arrives as a string, so `"de, en"` is accepted as well as `['de', 'en']`.
+ */
+export declare function normalizeSecurityTxtList(value: unknown): string[];
+/**
+ * Clamps `validDays` into the window RFC 9116 recommends. A non-finite or non-positive value
+ * falls back to the default instead of producing an `Expires` in the past.
+ */
+export declare function normalizeSecurityTxtValidDays(validDays: unknown): number;
+/**
+ * Turns a configured site URL into an origin (`https://example.com`), dropping path, query and
+ * trailing slash. Anything that is not an absolute http(s) URL yields `undefined`.
+ */
+export declare function toSecurityTxtOrigin(url: string | undefined): string | undefined;
+/**
+ * Turns the requested host into an origin, but only if it is one the site is known to be served
+ * from. The host comes from a request header, so anything else must not end up in the file.
+ */
+export declare function allowedRequestOrigin(host: string | undefined, allowedHosts: string[]): string | undefined;
+/**
+ * Builds a security.txt according to RFC 9116.
+ *
+ * `Expires` is relative to `now`, so a file built per request never goes stale, no matter how
+ * long ago the last deployment was. It is cut to midnight UTC, which makes the file valid for up
+ * to a day less than `validDays` and keeps it byte-identical for a whole day.
+ */
+export declare function buildSecurityTxt(options: SecurityTxtOptions): string;
+/** The server-only runtime config the module writes to `runtimeConfig.ltExtensions.securityTxt`. */
+export interface SecurityTxtRuntimeConfig {
+    contact?: string | string[];
+    hosts?: string | string[];
+    policy?: string;
+    preferredLanguages?: string | string[];
+    validDays?: number | string;
+}
+/**
+ * Turns the runtime config and the request into the file's content, or `undefined` when no
+ * usable contact is left (the route then answers 404).
+ *
+ * `Canonical` names the configured site URL and, in addition, the requested host if it is one of
+ * the configured `hosts`. A site served under several hostnames without a redirect needs the
+ * second line: RFC 9116 expects the URI a file was fetched from among its Canonical lines.
+ */
+export declare function resolveSecurityTxt(input: {
+    config: SecurityTxtRuntimeConfig | undefined;
+    now: Date;
+    requestHost: string | undefined;
+    siteUrl: string | undefined;
+}): string | undefined;

package/dist/runtime/server/lib/security-txt.js

@@ -0,0 +1,87 @@
+export const SECURITY_TXT_PATH = "/.well-known/security.txt";
+export const SECURITY_TXT_DEFAULT_CONTACT = "mailto:security@lenne.tech";
+export const SECURITY_TXT_DEFAULT_LANGUAGES = ["de", "en"];
+export const SECURITY_TXT_DEFAULT_VALID_DAYS = 180;
+const SECURITY_TXT_MAX_VALID_DAYS = 365;
+const DAY_MS = 24 * 60 * 60 * 1e3;
+const CONTACT_URI = /^(?:mailto:|tel:|https:\/\/)\S/i;
+function isSingleToken(value) {
+  return typeof value === "string" && value.length > 0 && !/\s/.test(value);
+}
+export function normalizeSecurityTxtContacts(contact) {
+  const values = Array.isArray(contact) ? contact : [contact];
+  return values.map((value) => typeof value === "string" ? value.trim() : value).filter(isSingleToken).filter((value) => CONTACT_URI.test(value));
+}
+export function normalizeSecurityTxtList(value) {
+  const values = typeof value === "string" ? value.split(",") : Array.isArray(value) ? value : [];
+  return values.map((entry) => typeof entry === "string" ? entry.trim() : entry).filter(isSingleToken);
+}
+export function normalizeSecurityTxtValidDays(validDays) {
+  const days = Number(validDays);
+  if (!Number.isFinite(days) || days < 1) {
+    return SECURITY_TXT_DEFAULT_VALID_DAYS;
+  }
+  return Math.min(Math.floor(days), SECURITY_TXT_MAX_VALID_DAYS);
+}
+export function toSecurityTxtOrigin(url) {
+  if (!url) {
+    return void 0;
+  }
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.origin : void 0;
+  } catch {
+    return void 0;
+  }
+}
+export function allowedRequestOrigin(host, allowedHosts) {
+  const name = host?.trim().toLowerCase();
+  const allowed = allowedHosts.map((entry) => entry.trim().toLowerCase());
+  return name && allowed.includes(name) ? `https://${name}` : void 0;
+}
+function resolveAgainstOrigin(value, origin) {
+  if (!isSingleToken(value)) {
+    return void 0;
+  }
+  if (!value.startsWith("/")) {
+    return value;
+  }
+  return origin ? `${origin}${value}` : void 0;
+}
+export function buildSecurityTxt(options) {
+  const { contacts, now, origins, policy, preferredLanguages = [] } = options;
+  const validDays = normalizeSecurityTxtValidDays(options.validDays ?? SECURITY_TXT_DEFAULT_VALID_DAYS);
+  const expires = new Date(Math.floor((now.getTime() + validDays * DAY_MS) / DAY_MS) * DAY_MS);
+  const canonicals = [...new Set(origins.map((origin) => origin.replace(/\/+$/, "")).filter(Boolean))];
+  const languages = preferredLanguages.map((language) => language.trim()).filter(isSingleToken);
+  const lines = [...contacts.filter(isSingleToken).map((contact) => `Contact: ${contact}`), `Expires: ${expires.toISOString()}`];
+  const policyUri = resolveAgainstOrigin(policy, canonicals[0]);
+  if (policyUri) {
+    lines.push(`Policy: ${policyUri}`);
+  }
+  if (languages.length) {
+    lines.push(`Preferred-Languages: ${languages.join(", ")}`);
+  }
+  for (const origin of canonicals) {
+    lines.push(`Canonical: ${origin}${SECURITY_TXT_PATH}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+export function resolveSecurityTxt(input) {
+  const config = input.config ?? {};
+  const contacts = normalizeSecurityTxtContacts(config.contact);
+  if (!contacts.length) {
+    return void 0;
+  }
+  const siteOrigin = toSecurityTxtOrigin(input.siteUrl);
+  const requestOrigin = allowedRequestOrigin(input.requestHost, normalizeSecurityTxtList(config.hosts));
+  return buildSecurityTxt({
+    contacts,
+    now: input.now,
+    origins: [siteOrigin, requestOrigin].filter((origin) => !!origin),
+    policy: config.policy,
+    preferredLanguages: normalizeSecurityTxtList(config.preferredLanguages),
+    validDays: normalizeSecurityTxtValidDays(config.validDays)
+  });
+}

package/dist/runtime/server/routes/security-txt.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Serves `/.well-known/security.txt` (RFC 9116). Registered by the module only when
+ * `ltExtensions.securityTxt.enabled` is set.
+ *
+ * Registered without a method on purpose: scanners probe with HEAD as well as GET, and a
+ * GET-only handler would answer HEAD with the 404 catch-all.
+ */
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/security-txt.js

@@ -0,0 +1,19 @@
+import { createError, defineEventHandler, getRequestHost, setResponseHeader, useRuntimeConfig } from "#imports";
+import { resolveSecurityTxt } from "../lib/security-txt.js";
+export default defineEventHandler((event) => {
+  const config = useRuntimeConfig(event);
+  const siteUrl = config.public?.siteUrl;
+  const ltExtensions = config.ltExtensions;
+  const body = resolveSecurityTxt({
+    config: ltExtensions?.securityTxt,
+    now: /* @__PURE__ */ new Date(),
+    requestHost: getRequestHost(event, { xForwardedHost: true }),
+    siteUrl: typeof siteUrl === "string" ? siteUrl : void 0
+  });
+  if (!body) {
+    throw createError({ statusCode: 404, statusMessage: "Not Found" });
+  }
+  setResponseHeader(event, "content-type", "text/plain; charset=utf-8");
+  setResponseHeader(event, "cache-control", "no-store");
+  return body;
+});

package/dist/runtime/types/index.d.ts

@@ -1,6 +1,6 @@
 export type { LtAuthClientConfig, LtAuthMode, LtAuthResponse, LtAuthState, LtPasskeyAuthResult, LtPasskeyRegisterResult, LtUser, LtUserInput, UseLtAuthReturn } from './auth.js';
 export type { LtFileInfo, LtUploadItem, LtUploadOptions, LtUploadProgress, LtUploadStatus, UseLtFileReturn, UseLtTusUploadReturn } from './upload.js';
-export type { LtAiModuleOptions, LtAuthCookieNamesOptions, LtAuthModuleOptions, LtErrorTranslationModuleOptions, LtExtensionsModuleOptions, LtExtensionsPublicRuntimeConfig, LtFormLabelAssociationOptions, LtI18nModuleOptions, LtPreHydrationInputOptions, LtSystemSetupModuleOptions, LtTusModuleOptions, } from './module.js';
+export type { LtAiModuleOptions, LtAuthCookieNamesOptions, LtAuthModuleOptions, LtErrorTranslationModuleOptions, LtExtensionsModuleOptions, LtExtensionsPublicRuntimeConfig, LtFormLabelAssociationOptions, LtI18nModuleOptions, LtPreHydrationInputOptions, LtSecurityTxtOptions, LtSystemSetupModuleOptions, LtTusModuleOptions, } from './module.js';
 export type { LtErrorTranslationResponse, LtParsedError, UseLtErrorTranslationReturn } from './error.js';
 export type { LtSyncConflict, LtSyncConflictResolution, LtSyncIdFormat, LtSyncItemStatus, LtSyncModuleOptions, LtSyncPushResult, LtSyncRecord, LtSyncResult, UseLtOfflineSyncOptions, UseLtOfflineSyncReturn, } from './sync.js';
 export type { LtAiAction, LtAiAvailableConnection, LtAiBudgetLimit, LtAiBudgetSummary, LtAiConnection, LtAiConnectionInput, LtAiConnectionPreference, LtAiEffectiveSlot, LtAiInteraction, LtAiMessage, LtAiMode, LtAiPlaceholder, LtAiPrompt, LtAiPromptHint, LtAiPromptHintInput, LtAiPromptInput, LtAiPromptRunInput, LtAiResponse, LtAiSettings, LtAiSettingsInput, LtAiSlot, LtAiStatus, LtAiSlotInput, LtAiStreamEvent, LtAiStreamHandlers, LtAiUsage, LtAiUsageInfo, LtAiUsageScope, UseLtAiAdminReturn, UseLtAiChatOptions, UseLtAiChatReturn, UseLtAiConnectionsReturn, UseLtAiPlaceholdersReturn, UseLtAiPromptsReturn, UseLtAiReturn, UseLtAiSettingsReturn, UseLtAiStatusReturn, UseLtAiUsageReturn, } from './ai.js';

package/dist/runtime/types/module.d.ts

@@ -148,6 +148,8 @@ export interface LtExtensionsModuleOptions {
     i18n?: LtI18nModuleOptions;
     /** Pre-hydration input preservation configuration */
     preHydrationInput?: LtPreHydrationInputOptions;
+    /** security.txt (RFC 9116) at `/.well-known/security.txt` */
+    securityTxt?: LtSecurityTxtOptions;
     /** Offline sync with the nest-server sync module (opt-in) */
     sync?: LtSyncModuleOptions;
     /** TUS upload module configuration */
@@ -271,6 +273,67 @@ export interface LtPreHydrationInputOptions {
      */
     maxRestoreMs?: number;
 }
+/**
+ * security.txt according to RFC 9116, served at `/.well-known/security.txt`.
+ *
+ * The file tells security researchers where to report a vulnerability. Off by default: only turn
+ * it on where somebody actually reads the contact address — a published address that nobody
+ * answers is worse than none.
+ *
+ * The file is built per request. `Expires` is always "now + `validDays`", cut to midnight UTC, so
+ * it never runs out between deployments. `Canonical` names `runtimeConfig.public.siteUrl`
+ * (`NUXT_PUBLIC_SITE_URL`, the module declares the key) and, in addition, the requested host if it
+ * is listed in `hosts`.
+ *
+ * Everything except `enabled` can be overridden per stage at runtime, without a rebuild:
+ * `NUXT_LT_EXTENSIONS_SECURITY_TXT_CONTACT`, `…_HOSTS`, `…_POLICY`, `…_PREFERRED_LANGUAGES`,
+ * `…_VALID_DAYS`. Blanking the contact that way makes the route answer 404, because a file without
+ * `Contact` is invalid.
+ *
+ * Not available with `nuxt generate`: a static site has no server to compute the file.
+ *
+ * @example
+ * ```ts
+ * export default defineNuxtConfig({
+ *   ltExtensions: {
+ *     securityTxt: {
+ *       enabled: true,
+ *       contact: 'mailto:security@customer.example',
+ *       hosts: ['customer.example', 'www.customer.example'],
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export interface LtSecurityTxtOptions {
+    /**
+     * Contact URI(s), in order of preference: `mailto:`, `https://` or `tel:`. Anything else, such
+     * as a bare address, counts as no contact, and the route answers 404.
+     * Defaults to `'mailto:security@lenne.tech'`. For a customer project, decide whether reports go
+     * to lenne.Tech or to the customer, and set it explicitly.
+     */
+    contact?: string | string[];
+    /** Serve the file. Defaults to `false`. */
+    enabled?: boolean;
+    /**
+     * Hostnames the site is served from without a redirect (e.g. apex and `www`). A request for one
+     * of them adds a second `Canonical` line for that host. The host comes from a request header,
+     * so nothing outside this list ever reaches the file. Defaults to `[]`.
+     */
+    hosts?: string[];
+    /**
+     * URI of the vulnerability disclosure policy. A path (`/security-policy`) is resolved against the
+     * site URL and left out when no site URL is configured.
+     */
+    policy?: string;
+    /** Language tags reports may be written in, in order of preference. Defaults to `['de', 'en']`. */
+    preferredLanguages?: string[];
+    /**
+     * Days between the request and `Expires`. Defaults to `180`; clamped to `365` because RFC 9116
+     * recommends less than a year, and a value below `1` falls back to the default.
+     */
+    validDays?: number;
+}
 /**
  * Public runtime config added by this module
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.23.0",
+  "version": "1.24.0",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",
@@ -69,7 +69,7 @@
     "test": "vitest run",
     "test:watch": "vitest watch",
     "test:coverage": "vitest run --coverage",
-    "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit",
+    "test:types": "vue-tsc --noEmit && vue-tsc --noEmit -p tsconfig.server.json && cd playground && vue-tsc --noEmit",
     "release": "pnpm format:check && pnpm run dev:prepare && pnpm lint && pnpm run version:check && pnpm test:types && pnpm test && pnpm run check:consumer && pnpm prepack",
     "check:consumer": "node scripts/check-consumer-build.mjs",
     "check:manifest": "node scripts/check-package-manifest.mjs",

package/dist/runtime/server/tsconfig.json

@@ -1,3 +0,0 @@
-{
-  "extends": "../../../.nuxt/tsconfig.server.json"
-}