@lenne.tech/nuxt-extensions 1.8.4 → 1.10.0

package/CLAUDE.md

@@ -13,7 +13,7 @@ src/
 │   ├── lib/               # Library exports (auth-client, auth-state, ai)
 │   ├── middleware/        # Route middleware (system setup)
 │   ├── plugins/           # Nuxt plugins (auth interceptor, error translation, config check)
-│   ├── server/            # Nitro server routes (auth proxy)
+│   ├── server/            # server-side tsconfig scope (no runtime routes; auth talks to the backend directly)
 │   ├── testing/           # Playwright test helpers
 │   ├── types/             # TypeScript type definitions
 │   └── utils/             # Auto-imported utility functions
@@ -85,17 +85,17 @@ The API base URL is resolved at runtime from `NUXT_PUBLIC_API_URL` (client + SSR
 ## Authentication (Better Auth)
 
 - SSR-safe session management via `useLtAuth()`
-- Auth proxy server route at `/api/auth/**` (proxies to backend)
-- Middleware `auth` for protected routes
+- Auth requests go **directly** to the backend Better-Auth endpoints (`basePath: '/iam'`) via `ltAuthFetch` (Cookie/JWT dual-mode) — the module ships **no** local Nitro `/api/auth/**` proxy
+- Protected-route gating is the consumer's own middleware (see "Custom Auth Middleware Pattern" below); the module only registers the optional `lt-system-setup` middleware
 - Passkey (WebAuthn) support via `@better-auth/passkey` peer dependency
 - 2FA (TOTP) support built-in
 
 ### Auth Flow
 
 1. Frontend calls `useLtAuth().signIn()` / `.signUp()`
-2. Request goes through Nitro proxy at `/api/auth/**`
-3. Proxy forwards to backend Better Auth endpoints
-4. Session cookie set via `httpOnly` cookie (SSR-safe)
+2. The Better-Auth client sends the request straight to the backend Better-Auth endpoints (`basePath: '/iam'`), with the base URL resolved by `buildLtApiUrl` (`NUXT_PUBLIC_API_URL` / SSR `NUXT_API_URL`)
+3. The backend sets the session as an `httpOnly` cookie (`iam.session_token`); `lt-auth-state` is the non-httpOnly client-side cache used by middleware
+4. Subsequent authenticated requests use `ltAuthFetch` (Cookie mode by default, JWT fallback)
 
 ## AI Assistant Flow
 
@@ -137,9 +137,21 @@ The `useLtAuth()` composable manages the `lt-auth-state` cookie for authenticati
 On session re-validation (`validateSession()` at app init / hard reload, and the passkey get-session fallback), `useLtAuth()` **merges** the Better-Auth session user onto the cached user of the SAME identity via the private `mergeSessionUser()`, instead of overwriting it. Consequences you must know:
 
 - **nest-server-only fields persist across reloads.** Better-Auth's get-session returns only Better-Auth-owned fields (id/email/name + registered additionalFields). Fields it does not own (e.g. custom preferences like `leadTableColumns`) previously vanished on every reload; they now survive. If you built a workaround that re-fetched such fields after each reload, you can retire it.
-- **Authorization fields are fail-closed.** `role`, `banned`, `banExpires`, `banReason`, `emailVerified`, `twoFactorEnabled` always reflect the session — any of these the session omits is dropped from the merge (never kept stale), so a backend downgrade is reflected client-side. If your project adds its OWN authorization-relevant user field, either register it as a Better-Auth additionalField (so get-session returns it) or add it to the `AUTHZ_KEYS` list in `use-lt-auth.ts` — otherwise it could persist stale in the client cache.
+- **Authorization fields are fail-closed.** `role`, `roles`, `banned`, `banExpires`, `banReason`, `emailVerified`, `twoFactorEnabled` always reflect the session — any of these the session omits is dropped from the merge (never kept stale), so a backend downgrade is reflected client-side. If your project adds its OWN authorization-relevant user field, either register it as a Better-Auth additionalField (so get-session returns it) or add it to the `AUTHZ_KEYS` list in `use-lt-auth.ts` — otherwise it could persist stale in the client cache.
 - **Keep the cached user lean.** `lt-auth-state` is a non-httpOnly cookie sent on every same-site request and capped at ~4 KB by browsers. Because the merge keeps preference fields across reloads, large blobs on the user object can push the cookie over the limit — the browser then silently rejects the write and the next reload reads as a logout. `setUser` emits a dev-mode warning above ~3.5 KB; move large preference data off the user object and fetch it from an authenticated API.
 
+### Admin Detection (`role` vs `roles`):
+`useLtAuth().isAdmin` accepts BOTH user shapes, so one frontend works against either backend:
+
+- **`@lenne.tech/nest-server`** registers `roles` as a *core* Better-Auth additionalField (`type: 'string[]'`, `defaultValue: []`). Its users carry `roles: ['admin']` and no singular `role`.
+- **Better-Auth's admin plugin** uses the singular `role: 'admin'`.
+
+`isAdmin` is `true` when `role === 'admin'` **or** `roles` contains `'admin'` (a union — either shape granting admin is sufficient). A malformed non-array `roles` (the `lt-auth-state` cookie is client-writable) degrades to `false` — it never throws and never fail-opens via `String.prototype.includes` substring matching. Matching is case-sensitive (`'admin'`, not `'Admin'`), identical to nest-server's own `hasRole(RoleEnum.ADMIN)`.
+
+- `roles` is in `AUTHZ_KEYS`, so a backend-side admin revocation closes the admin UI on the next session re-validation instead of being masked by a stale cached array.
+- The `auth.enableAdmin` module option toggles the Better-Auth **admin client plugin** (user-management calls like `admin.listUsers()`). It does NOT control `isAdmin` — role detection works regardless of that flag.
+- **`isAdmin` is a UX gate, not an authorization boundary.** It reads the non-httpOnly `lt-auth-state` cache, which a user can edit. Render admin UI behind it; enforce admin rights server-side (`@Restricted(RoleEnum.ADMIN)`).
+
 ### Custom Auth Middleware Pattern:
 ```typescript
 // CORRECT — read-only check, no cookie mutation

package/README.md

@@ -166,6 +166,7 @@ export default defineNuxtConfig({
 const {
   user,
   isAuthenticated,
+  isAdmin,
   isLoading,
   signIn,
   signOut,
@@ -199,6 +200,42 @@ async function handlePasskeyLogin() {
 </template>
 ```
 
+#### Admin detection (`role` vs `roles`)
+
+`isAdmin` accepts **both** user shapes, so the same frontend works against either backend:
+
+| Backend | User shape | `isAdmin` is `true` when |
+|---------|------------|-------------------------|
+| `@lenne.tech/nest-server` | `roles: ['admin']` — core Better-Auth additionalField (`type: 'string[]'`), no singular `role` | `roles` contains `'admin'` |
+| Better-Auth admin plugin | `role: 'admin'` — single role | `role === 'admin'` |
+
+```vue
+<script setup>
+const { isAdmin } = useLtAuth();
+</script>
+
+<template>
+  <NuxtLink v-if="isAdmin" to="/admin">Admin</NuxtLink>
+</template>
+```
+
+> **`isAdmin` is a UX gate, not an authorization boundary.** It reads the client-side `lt-auth-state` cookie cache, which is not httpOnly and therefore user-writable. Use it to decide what to *render*; always enforce admin rights server-side (`@Restricted(RoleEnum.ADMIN)` in nest-server).
+>
+> The `auth.enableAdmin` option toggles the Better-Auth **admin client plugin** (user-management calls such as `admin.listUsers()`). It does **not** control `isAdmin` — role detection works regardless of that flag.
+
+For roles other than admin, use `hasRole(role)` / `hasAnyRole(...roles)`. They apply the exact same both-shapes union and `Array.isArray` guard as `isAdmin` (which is itself just `hasRole('admin')`), so you never need the unguarded `user.value?.roles?.includes(...)`:
+
+```vue
+<script setup>
+const { hasRole, hasAnyRole } = useLtAuth();
+</script>
+
+<template>
+  <button v-if="hasRole('editor')">Edit</button>
+  <NuxtLink v-if="hasAnyRole('admin', 'editor')" to="/manage">Manage</NuxtLink>
+</template>
+```
+
 ### Custom Better Auth Plugins
 
 You can extend the auth client with additional [Better Auth plugins](https://www.better-auth.com/docs/plugins):

package/dist/module.d.mts

@@ -3,7 +3,7 @@ import { LtExtensionsModuleOptions } from '../dist/runtime/types/index.js';
 export * from '../dist/runtime/types/index.js';
 
 declare const name = "@lenne.tech/nuxt-extensions";
-declare const version = "1.5.2";
+declare const version = "1.10.0";
 declare const configKey = "ltExtensions";
 declare const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 declare const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "configKey": "ltExtensions",
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.5.2",
+  "version": "1.10.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,7 +1,7 @@
-import { defineNuxtModule, createResolver, addImports, addComponent, addPlugin, addRouteMiddleware } from '@nuxt/kit';
+import { defineNuxtModule, createResolver, tryResolveModule, addImports, addComponent, addPlugin, addRouteMiddleware } from '@nuxt/kit';
 
 const name = "@lenne.tech/nuxt-extensions";
-const version = "1.5.2";
+const version = "1.10.0";
 const configKey = "ltExtensions";
 const DEFAULT_LT_AUTH_STATE_COOKIE = "lt-auth-state";
 const DEFAULT_LT_JWT_TOKEN_COOKIE = "lt-jwt-token";
@@ -66,6 +66,19 @@ const module$1 = defineNuxtModule({
       i18n: { ...defaultOptions.i18n, ...options.i18n },
       tus: { ...defaultOptions.tus, ...options.tus }
     };
+    const passkeyAvailable = !!await tryResolveModule("@better-auth/passkey/client", new URL(import.meta.url));
+    if (!passkeyAvailable) {
+      const passkeyStub = resolve("./runtime/lib/passkey-stub");
+      nuxt.options.alias["@better-auth/passkey/client"] = passkeyStub;
+      nuxt.options.nitro ??= {};
+      nuxt.options.nitro.alias = { ...nuxt.options.nitro.alias, "@better-auth/passkey/client": passkeyStub };
+    }
+    const enablePasskey = (resolvedOptions.auth?.enablePasskey ?? true) && passkeyAvailable;
+    if ((resolvedOptions.auth?.enablePasskey ?? true) && !passkeyAvailable) {
+      console.warn(
+        `[${name}] Passkey support disabled: the optional peer dependency "@better-auth/passkey" is not installed. Install it to use passkeys, or set \`ltExtensions.auth.enablePasskey = false\` to silence this warning.`
+      );
+    }
     const rc = nuxt.options.runtimeConfig;
     if (!rc.apiUrl) {
       rc.apiUrl = "";
@@ -90,7 +103,7 @@ const module$1 = defineNuxtModule({
         },
         enabled: resolvedOptions.auth?.enabled ?? true,
         enableAdmin: resolvedOptions.auth?.enableAdmin ?? true,
-        enablePasskey: resolvedOptions.auth?.enablePasskey ?? true,
+        enablePasskey,
         enableTwoFactor: resolvedOptions.auth?.enableTwoFactor ?? true,
         interceptor: {
           enabled: resolvedOptions.auth?.interceptor?.enabled ?? true,

package/dist/runtime/composables/auth/use-lt-auth.js

@@ -46,7 +46,17 @@ export function useLtAuth() {
   const isJwtMode = computed(() => authMode.value === "jwt");
   const user = computed(() => resolvedAuthState.value?.user ?? null);
   const isAuthenticated = computed(() => !!user.value);
-  const isAdmin = computed(() => user.value?.role === "admin");
+  function hasRole(role) {
+    const current = user.value;
+    if (!current) {
+      return false;
+    }
+    return current.role === role || Array.isArray(current.roles) && current.roles.includes(role);
+  }
+  function hasAnyRole(...roles) {
+    return roles.some((role) => hasRole(role));
+  }
+  const isAdmin = computed(() => hasRole("admin"));
   const is2FAEnabled = computed(() => user.value?.twoFactorEnabled ?? false);
   const features = useState("lt-auth-features", () => ({}));
   const featuresFetched = useState("lt-auth-features-fetched", () => false);
@@ -129,7 +139,7 @@ export function useLtAuth() {
     }
     return response;
   }
-  const AUTHZ_KEYS = ["banExpires", "banReason", "banned", "emailVerified", "role", "twoFactorEnabled"];
+  const AUTHZ_KEYS = ["banExpires", "banReason", "banned", "emailVerified", "role", "roles", "twoFactorEnabled"];
   function mergeSessionUser(sessionUser) {
     const cached = resolvedAuthState.value?.user;
     if (!cached?.id || !sessionUser?.id || cached.id !== sessionUser.id) {
@@ -457,6 +467,8 @@ export function useLtAuth() {
     isLoading: computed(() => isLoading.value),
     user,
     // User properties
+    hasAnyRole,
+    hasRole,
     is2FAEnabled,
     isAdmin,
     // Feature detection

package/dist/runtime/lib/auth-client.d.ts

@@ -229,11 +229,6 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         priority?: RequestPriority | undefined;
         cache?: RequestCache | undefined;
         credentials?: RequestCredentials;
-        headers?: (HeadersInit & (HeadersInit | {
-            accept: "application/json" | "text/plain" | "application/octet-stream";
-            "content-type": "application/json" | "text/plain" | "application/x-www-form-urlencoded" | "multipart/form-data" | "application/octet-stream";
-            authorization: "Bearer" | "Basic";
-        })) | undefined;
         integrity?: string | undefined;
         keepalive?: boolean | undefined;
         method: string;
@@ -263,6 +258,12 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
             prefix: string | (() => string | undefined) | undefined;
             value: string | (() => string | undefined) | undefined;
         }) | undefined;
+        headers?: {} | {
+            [x: string]: string | undefined;
+            accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
+            "content-type"?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "application/octet-stream" | "multipart/form-data") | undefined;
+            authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
+        } | undefined;
         body?: any;
         query?: any;
         params?: any;
@@ -703,9 +704,14 @@ export declare function createLtAuthClient(config?: LtAuthClientConfig): {
         code?: string | undefined;
         message?: string | undefined;
     }, FetchOptions["throw"] extends true ? true : false>>;
-    updateSession: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<Partial<{}>> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<Partial<{}> & {
-        fetchOptions?: FetchOptions | undefined;
-    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
+    updateSession: <FetchOptions extends import("better-auth").ClientFetchOption<Partial<Partial<{}>> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth").Prettify<import("better-auth/client").InferSessionUpdateCtx<{
+        basePath: string;
+        baseURL: any;
+        fetchOptions: {
+            customFetchImpl: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+        };
+        plugins: any[];
+    }, FetchOptions>> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/client").BetterFetchResponse<{
         session: {
             id: string;
             createdAt: Date;

package/dist/runtime/lib/passkey-stub.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Build-time stand-in for the OPTIONAL `@better-auth/passkey` peer dependency.
+ *
+ * `auth-client.ts` imports `passkeyClient` as a static top-level import, so a
+ * bundler has to resolve the specifier even in projects that never enable
+ * passkeys. Without a resolvable module the build dies on an unresolved
+ * optional peer, which contradicts `peerDependenciesMeta.optional: true`.
+ *
+ * The module aliases `@better-auth/passkey/client` onto this file when the real
+ * package is absent, and forces `auth.enablePasskey` to `false` in that case —
+ * so the factory below is normally never called. It stays a no-op (rather than
+ * throwing) to keep the direct `createLtAuthClient()` entry point working, whose
+ * own `enablePasskey` default is `true`.
+ */
+/**
+ * No-op replacement for the real `passkeyClient()` Better-Auth client plugin.
+ *
+ * Returns a plugin with a deliberately distinct `id`: claiming `'passkey'` would
+ * make Better-Auth expose passkey actions that cannot work without the package.
+ */
+export declare function passkeyClient(): {
+    id: "lt-passkey-unavailable";
+};

package/dist/runtime/lib/passkey-stub.js

@@ -0,0 +1,10 @@
+let warned = false;
+export function passkeyClient() {
+  if (!warned) {
+    warned = true;
+    console.warn(
+      '[@lenne.tech/nuxt-extensions] Passkey support is unavailable: the optional peer dependency "@better-auth/passkey" is not installed. Install it to use passkeys, or pass `enablePasskey: false` to createLtAuthClient() to silence this warning.'
+    );
+  }
+  return { id: "lt-passkey-unavailable" };
+}

package/dist/runtime/types/auth.d.ts

@@ -12,7 +12,22 @@ export interface LtUser {
     id: string;
     image?: string;
     name?: string;
+    /** Single-role shape (Better-Auth admin plugin). See also {@link LtUser.roles}. */
     role?: string;
+    /**
+     * Multi-role shape, and the canonical home for this fact: `@lenne.tech/nest-server`
+     * registers `roles` as a core Better-Auth additionalField (`type: 'string[]'`,
+     * `defaultValue: []`), so its users carry `roles: ['admin']` and usually NO
+     * singular `role`.
+     *
+     * NOT a source of authorization truth: this lives in the non-httpOnly
+     * `lt-auth-state` cookie and is therefore client-writable. It is kept
+     * fail-closed on session merge (see `AUTHZ_KEYS` in `use-lt-auth.ts`) so a
+     * backend downgrade is never masked by a stale value — that is a *staleness*
+     * guarantee, not a security guarantee. `isAdmin` reads it for UI gating;
+     * authorization is enforced server-side (`@Restricted(RoleEnum.ADMIN)`).
+     */
+    roles?: string[];
     twoFactorEnabled?: boolean;
 }
 /**
@@ -94,7 +109,50 @@ export interface UseLtAuthReturn {
     isLoading: ComputedRef<boolean>;
     jwtToken: Ref<string | null>;
     user: ComputedRef<LtUser | null>;
+    /**
+     * Returns `true` when the current user has ANY of the given roles (union).
+     * Same shape-tolerance and UX-gate-only caveats as {@link UseLtAuthReturn.hasRole}.
+     *
+     * @example
+     * // <NuxtLink v-if="hasAnyRole('admin', 'editor')" to="/manage">Manage</NuxtLink>
+     */
+    hasAnyRole: (...roles: string[]) => boolean;
+    /**
+     * Returns `true` when the current user has `role` in EITHER supported shape:
+     * `role === role` (Better-Auth admin plugin) or `roles` containing it
+     * (`@lenne.tech/nest-server`; see {@link LtUser.roles}). A malformed non-array
+     * `roles` degrades to `false` — never throws, never fail-opens via
+     * `String.prototype.includes` substring matching. Reads `user` live, so call it
+     * from a template or `computed` for reactivity.
+     *
+     * Prefer this over the raw `user.value?.roles?.includes(x)`, which is unguarded
+     * against the string-`roles` substring-confusion this method closes.
+     *
+     * UX gate only — the `lt-auth-state` cache is client-writable; enforce rights
+     * server-side.
+     *
+     * @example
+     * // <button v-if="hasRole('editor')">Edit</button>
+     * @see {@link LtUser.role}
+     * @see {@link LtUser.roles}
+     */
+    hasRole: (role: string) => boolean;
     is2FAEnabled: ComputedRef<boolean>;
+    /**
+     * `true` when the current user is an admin in EITHER supported shape:
+     * `role === 'admin'` (Better-Auth admin plugin) or `roles` containing `'admin'`
+     * (`@lenne.tech/nest-server`; see {@link LtUser.roles}). Equivalent to
+     * `hasRole('admin')`. A malformed non-array `roles` degrades to `false` (never
+     * throws, never fail-opens). Independent of the `enableAdmin` module option,
+     * which only toggles the Better-Auth admin *client plugin*.
+     *
+     * UX gate only: the `lt-auth-state` cache it reads is client-writable, so treat
+     * this as "what to render", never as the gate itself. Enforce admin rights
+     * server-side.
+     *
+     * @see {@link UseLtAuthReturn.hasRole}
+     * @see {@link LtUser.roles}
+     */
     isAdmin: ComputedRef<boolean>;
     features: ComputedRef<Record<string, boolean | number | string[]>>;
     fetchFeatures: () => Promise<Record<string, boolean | number | string[]>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.8.4",
+  "version": "1.10.0",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",
@@ -12,7 +12,6 @@
   },
   "author": "lenne.Tech <info@lenne.tech> (https://lenne.tech)",
   "license": "MIT",
-  "packageManager": "pnpm@10.33.0",
   "type": "module",
   "sideEffects": false,
   "exports": {
@@ -52,9 +51,9 @@
     "prepack": "node scripts/sync-module-version.mjs && nuxt-module-build build",
     "c": "pnpm run check",
     "check": "node scripts/check.mjs",
-    "check:raw": "pnpm audit && pnpm run format:check && pnpm run lint && pnpm run dev:prepare && pnpm test:types && pnpm test && pnpm run build",
-    "check:fix": "pnpm install && pnpm audit --fix && pnpm run format && pnpm run lint:fix && pnpm test:types && pnpm test && pnpm run build",
-    "check:naf": "pnpm install && pnpm run format && pnpm run lint:fix && pnpm test:types && pnpm test && pnpm run build",
+    "check:raw": "pnpm install --frozen-lockfile && pnpm audit && pnpm run format:check && pnpm run lint && pnpm run version:check && pnpm run dev:prepare && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
+    "check:fix": "pnpm install && pnpm audit --fix && pnpm run format && pnpm run lint:fix && pnpm run version:sync && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
+    "check:naf": "pnpm install && pnpm run format && pnpm run lint:fix && pnpm run version:sync && pnpm test:types && pnpm test && pnpm run build && pnpm run check:manifest",
     "cf": "pnpm run check:fix",
     "cnaf": "pnpm run check:naf",
     "dev": "pnpm dev:prepare && nuxt dev playground",
@@ -65,20 +64,24 @@
     "lint:fix": "oxlint --fix --fix-suggestions src/",
     "format": "oxfmt --write src/",
     "format:check": "oxfmt --check src/",
+    "version:sync": "node scripts/sync-module-version.mjs",
+    "version:check": "node scripts/sync-module-version.mjs --check",
     "test": "vitest run",
     "test:watch": "vitest watch",
     "test:coverage": "vitest run --coverage",
     "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit",
-    "release": "pnpm format:check && pnpm lint && pnpm test:types && pnpm test && pnpm prepack"
+    "release": "pnpm format:check && pnpm lint && pnpm run version:check && pnpm test:types && pnpm test && pnpm run check:consumer && pnpm prepack",
+    "check:consumer": "node scripts/check-consumer-build.mjs",
+    "check:manifest": "node scripts/check-package-manifest.mjs"
   },
   "dependencies": {
-    "@nuxt/kit": "4.4.6"
+    "@nuxt/kit": "^4.0.0"
   },
   "peerDependencies": {
     "@better-auth/passkey": ">=1.0.0",
     "@playwright/test": ">=1.0.0",
     "better-auth": ">=1.0.0",
-    "nuxt": ">=3.0.0",
+    "nuxt": "^4.0.0",
     "tus-js-client": ">=4.0.0"
   },
   "peerDependenciesMeta": {
@@ -96,41 +99,21 @@
     }
   },
   "devDependencies": {
-    "@better-auth/passkey": "1.6.13",
-    "@nuxt/devtools": "3.2.4",
+    "@better-auth/passkey": "1.6.23",
     "@nuxt/module-builder": "1.0.2",
-    "@nuxt/schema": "4.4.6",
-    "@playwright/test": "1.60.0",
-    "@types/node": "25.9.1",
-    "@vitest/coverage-v8": "4.1.7",
-    "better-auth": "1.6.13",
-    "happy-dom": "20.9.0",
-    "nuxt": "4.4.6",
-    "oxfmt": "0.52.0",
-    "oxlint": "1.67.0",
+    "@nuxt/schema": "4.4.8",
+    "@playwright/test": "1.61.1",
+    "@types/node": "26.1.1",
+    "@vitest/coverage-v8": "4.1.10",
+    "better-auth": "1.6.23",
+    "happy-dom": "20.10.6",
+    "nuxt": "4.4.8",
+    "oxfmt": "0.59.0",
+    "oxlint": "1.74.0",
     "tus-js-client": "4.3.1",
     "typescript": "5.9.3",
-    "vitest": "4.1.7",
-    "vue-tsc": "3.3.3"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "@parcel/watcher",
-      "esbuild"
-    ],
-    "overrides": {
-      "brace-expansion@>=5.0.0 <5.0.6": "5.0.6",
-      "devalue@>=5.6.3 <=5.8.0": "5.8.1",
-      "kysely@>=0.26.0 <0.28.17": "0.28.17",
-      "ws@>=8.0.0 <8.20.1": "8.21.0",
-      "shell-quote@<1.8.4": "1.8.4",
-      "nuxt@<4.4.7": "4.4.7",
-      "vite@>=7.0.0 <7.3.5": "7.3.5",
-      "tar@<7.5.16": "7.5.16",
-      "launch-editor@<2.14.1": "2.14.1",
-      "esbuild@<0.28.1": "0.28.1",
-      "@babel/core@<7.29.6": "7.29.6"
-    }
+    "vitest": "4.1.10",
+    "vue-tsc": "3.3.7"
   },
   "keywords": [
     "nuxt",
@@ -144,5 +127,9 @@
     "tus-upload",
     "file-upload",
     "lenne-tech"
-  ]
+  ],
+  "engines": {
+    "node": ">= 22",
+    "pnpm": "^11.0.0"
+  }
 }