create-vexcms 0.0.19 → 0.0.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-vexcms",
-  "version": "0.0.19",
+  "version": "0.0.20",
   "type": "module",
   "bin": {
     "create-vexcms": "./dist/index.js"

package/templates/base-nextjs/convex/vex/collections.ts

@@ -178,6 +178,9 @@ export const updateDocument = mutation({
     const match = requireCollection(collectionSlug)
     const { user, roles } = await requireUser(ctx)
 
+    // Fetch existing document for permission check (dynamic callbacks may need current data)
+    const existingDoc = await ctx.db.get(documentId as any)
+
     const fieldNames = Object.keys(fields as Record<string, unknown>)
     checkPermission({
       access,
@@ -186,7 +189,7 @@ export const updateDocument = mutation({
       resource: collectionSlug,
       action: "update",
       fields: fieldNames,
-      data: fields as Record<string, unknown>,
+      data: (existingDoc as Record<string, unknown>) ?? (fields as Record<string, unknown>),
     })
 
     return await Collections.updateDocument<DataModel>({
@@ -242,12 +245,16 @@ export const deleteDocument = mutation({
     const match = requireCollection(collectionSlug)
     const { user, roles } = await requireUser(ctx)
 
+    // Fetch the document so dynamic permission callbacks can access its data
+    const doc = await ctx.db.get(documentId as any)
+
     checkPermission({
       access,
       user,
       userRoles: roles,
       resource: collectionSlug,
       action: "delete",
+      data: (doc as Record<string, unknown>) ?? {},
     })
 
     await Collections.deleteDocument<DataModel>({
@@ -269,13 +276,18 @@ export const bulkDeleteDocuments = mutation({
   handler: async (ctx, { collectionSlug, documentIds }) => {
     const { user, roles } = await requireUser(ctx)
 
-    checkPermission({
-      access,
-      user,
-      userRoles: roles,
-      resource: collectionSlug,
-      action: "delete",
-    })
+    // Check permission for each document individually (dynamic callbacks need doc data)
+    for (const docId of documentIds) {
+      const doc = await ctx.db.get(docId as any)
+      checkPermission({
+        access,
+        user,
+        userRoles: roles,
+        resource: collectionSlug,
+        action: "delete",
+        data: (doc as Record<string, unknown>) ?? {},
+      })
+    }
 
     return await Collections.bulkDeleteDocuments<DataModel>({
       args: { documentIds },

package/templates/base-nextjs/package.json

@@ -22,12 +22,12 @@
     "@t3-oss/env-nextjs": "^0.13.10",
     "@tanstack/react-form": "^1.27.7",
     "@tanstack/react-query": "^5.90.17",
-    "@vexcms/admin-next": "~0.0.19",
-    "@vexcms/better-auth": "~0.0.19",
-    "@vexcms/core": "~0.0.19",
-    "@vexcms/richtext": "~0.0.19",
-    "@vexcms/ui": "~0.0.19",
-    "@vexcms/file-storage-convex": "~0.0.19",
+    "@vexcms/admin-next": "~0.0.20",
+    "@vexcms/better-auth": "~0.0.20",
+    "@vexcms/core": "~0.0.20",
+    "@vexcms/richtext": "~0.0.20",
+    "@vexcms/ui": "~0.0.20",
+    "@vexcms/file-storage-convex": "~0.0.20",
     "better-auth": ">=1.4.9 <1.5.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -54,7 +54,7 @@
     "@types/node": "^20",
     "@types/react": "^19",
     "@types/react-dom": "^19",
-    "@vexcms/cli": "~0.0.19",
+    "@vexcms/cli": "~0.0.20",
     "babel-plugin-react-compiler": "^1.0.0",
     "eslint": "^9",
     "eslint-config-next": "15.5.9",

package/templates/base-nextjs/src/auth/serverUtils.ts

@@ -4,7 +4,10 @@ import { cookies } from "next/headers"
 
 export async function getSessionToken() {
   const cookieStore = await cookies()
-  const sessionToken = cookieStore.get("better-auth.session_token")?.value.split(".")[0]
+  // In production (HTTPS), Better Auth prefixes cookies with __Secure-
+  const sessionToken =
+    cookieStore.get("__Secure-better-auth.session_token")?.value.split(".")[0] ??
+    cookieStore.get("better-auth.session_token")?.value.split(".")[0]
   if (!sessionToken) {
     console.error("Error getting session token")
     return null

package/templates/base-nextjs/src/proxy.ts

@@ -7,7 +7,9 @@ export async function proxy(request: NextRequest) {
   }
 
   const cookieStore = await cookies()
-  const sessionToken = cookieStore.get("better-auth.session_token")
+  const sessionToken =
+    cookieStore.get("__Secure-better-auth.session_token") ??
+    cookieStore.get("better-auth.session_token")
 
   if (!sessionToken) {
     return NextResponse.redirect(new URL("/auth/sign-in", request.url))

package/templates/marketing-site/src/components/motion-primitives/animated-group.tsx

@@ -115,8 +115,8 @@ function AnimatedGroup({
   const containerVariants = variants?.container ?? selectedVariants.container
   const itemVariants = variants?.item ?? selectedVariants.item
 
-  const MotionComponent = motion(as)
-  const MotionChild = motion(asChild)
+  const MotionComponent = motion.create(as)
+  const MotionChild = motion.create(asChild)
 
   return (
     <MotionComponent