nuxt-convex-module 0.12.2 → 0.13.0

package/dist/devtools-client/index.html

@@ -1 +1 @@
-<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><script type="importmap">{"imports":{"#entry":"/__nuxt-convex-module/_nuxt/COXexnyN.js"}}</script><link rel="stylesheet" href="/__nuxt-convex-module/_nuxt/entry.DsZySRVW.css" crossorigin><link rel="modulepreload" as="script" crossorigin href="/__nuxt-convex-module/_nuxt/COXexnyN.js"><script type="module" src="/__nuxt-convex-module/_nuxt/COXexnyN.js" crossorigin></script><link rel="prefetch" as="script" crossorigin href="/__nuxt-convex-module/_nuxt/BPtiIkWa.js"></head><body><div id="__nuxt"></div><div id="teleports"></div><script>window.__NUXT__={};window.__NUXT__.config={public:{},app:{baseURL:"/__nuxt-convex-module",buildId:"d3335991-c747-41b3-a9e3-6d5c636b70f0",buildAssetsDir:"/_nuxt/",cdnURL:""}}</script><script type="application/json" data-nuxt-data="nuxt-app" data-ssr="false" id="__NUXT_DATA__">[{"prerenderedAt":1,"serverRendered":2},1793365964988,false]</script></body></html>
+<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><script type="importmap">{"imports":{"#entry":"/__nuxt-convex-module/_nuxt/CtC_CmOY.js"}}</script><link rel="stylesheet" href="/__nuxt-convex-module/_nuxt/entry.jOWrhpYd.css" crossorigin><link rel="modulepreload" as="script" crossorigin href="/__nuxt-convex-module/_nuxt/CtC_CmOY.js"><script type="module" src="/__nuxt-convex-module/_nuxt/CtC_CmOY.js" crossorigin></script><link rel="prefetch" as="script" crossorigin href="/__nuxt-convex-module/_nuxt/C-J9qZjr.js"></head><body><div id="__nuxt"></div><div id="teleports"></div><script>window.__NUXT__={};window.__NUXT__.config={public:{},app:{baseURL:"/__nuxt-convex-module",buildId:"ad777e0e-9095-4e0e-9b9b-8010fe4e34c6",buildAssetsDir:"/_nuxt/",cdnURL:""}}</script><script type="application/json" data-nuxt-data="nuxt-app" data-ssr="false" id="__NUXT_DATA__">[{"prerenderedAt":1,"serverRendered":2},1794085598149,false]</script></body></html>

package/dist/module.d.mts

@@ -133,6 +133,7 @@ declare module '@nuxt/schema' {
             siteUrl: string;
             crossDomainCallbackRoute: string;
             loginPath: string;
+            authRoute: string;
         };
     }
 }

package/dist/module.json

@@ -5,7 +5,7 @@
   "compatibility": {
     "nuxt": ">=4.6.0"
   },
-  "version": "0.12.2",
+  "version": "0.13.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "unknown"

package/dist/module.mjs

@@ -95,7 +95,7 @@ function integrationWarnings(flags, isInstalled) {
   }
   if (flags.polar && !isInstalled("@polar-sh/checkout")) {
     warnings.push(
-      "`@convex-dev/polar` is installed but its peer `@polar-sh/checkout` is not \u2014 `<CheckoutLink>` imports it and the build fails the moment the component is used. Run `npm install @polar-sh/checkout@~0.4.0`."
+      "`@convex-dev/polar` is installed but its peer `@polar-sh/checkout` is not \u2014 `<CheckoutLink>` imports it and the build fails the moment the component is used. Run `npm install @polar-sh/checkout@~0.6.0`."
     );
   }
   return warnings;
@@ -383,7 +383,7 @@ const module$1 = defineNuxtModule({
   // with no extra entry on the consumer's side. The Convex-aware CSP is applied
   // at runtime (see `registerSecurity`), so module order is irrelevant. Nothing
   // is declared otherwise: kit fails the build resolving an absent package.
-  moduleDependencies: (nuxt) => resolveSecurityState(nuxt, readSecurityOption(nuxt)).enabled ? { "nuxt-security": {} } : {},
+  moduleDependencies: (nuxt) => resolveSecurityState(nuxt, readSecurityOption(nuxt)).enabled ? { "nuxt-security": nuxt.options.dev ? { defaults: DEV_SECURITY_DEFAULTS } : {} } : {},
   async setup(options, nuxt) {
     const resolver = createResolver(import.meta.url);
     nuxt.options.build.transpile.push(resolver.resolve("./runtime"));
@@ -402,6 +402,7 @@ const module$1 = defineNuxtModule({
     for (const message of diagnostics.errors) logger.error(message);
     for (const message of diagnostics.warnings) logger.warn(message);
     nuxt.options.runtimeConfig.public.convex.loginPath = diagnostics.loginPath;
+    nuxt.options.runtimeConfig.public.convex.authRoute = diagnostics.authRoute;
     registerAuthClientAlias(resolver, nuxt, options);
     registerConvexAliases(nuxt);
     registerConvexTypeFallback(nuxt);
@@ -485,6 +486,13 @@ function registerIntegrations(resolver, nuxt, options, autoImports, authRoute) {
   }
   return flags;
 }
+const DEV_SECURITY_DEFAULTS = {
+  rateLimiter: false,
+  headers: {
+    contentSecurityPolicy: { "upgrade-insecure-requests": false },
+    strictTransportSecurity: false
+  }
+};
 function readSecurityOption(nuxt) {
   const opts = nuxt.options;
   return opts.convex?.security;

package/dist/runtime/better-auth/nuxt/server.js

@@ -44,6 +44,8 @@ const handler = async (request, siteUrl) => {
   headers.delete("connection");
   headers.set("accept-encoding", "application/json");
   headers.set("host", new URL(siteUrl).host);
+  headers.delete("x-forwarded-host");
+  headers.delete("x-forwarded-proto");
   headers.set("x-better-auth-forwarded-host", requestUrl.host);
   headers.set("x-better-auth-forwarded-proto", requestUrl.protocol.replace(/:$/, ""));
   const init = {
@@ -82,10 +84,12 @@ const getArgsAndOptions = (args, token) => {
   return [args[0], { token }];
 };
 export function convexAuth(event, opts) {
+  const config = getConvexRuntimeConfig(event);
   const siteUrl = parseConvexSiteUrl(
-    opts?.convexSiteUrl ?? getConvexRuntimeConfig().siteUrl ?? process.env.NUXT_PUBLIC_CONVEX_SITE_URL
+    opts?.convexSiteUrl || config.siteUrl || process.env.NUXT_PUBLIC_CONVEX_SITE_URL
   );
-  const cacheKey = `__nuxtConvexToken:${siteUrl}|${opts?.basePath ?? ""}`;
+  const basePath = opts?.basePath ?? config.authRoute;
+  const cacheKey = `__nuxtConvexToken:${siteUrl}|${basePath ?? ""}`;
   const tokenCache = event.context;
   const cachedGetToken = ({ forceRefresh } = {}) => {
     const cached = tokenCache[cacheKey];
@@ -94,7 +98,7 @@ export function convexAuth(event, opts) {
     mutableHeaders.delete("content-length");
     mutableHeaders.delete("transfer-encoding");
     mutableHeaders.set("accept-encoding", "identity");
-    const promise = getToken(siteUrl, mutableHeaders, { ...opts, forceRefresh });
+    const promise = getToken(siteUrl, mutableHeaders, { ...opts, basePath, forceRefresh });
     tokenCache[cacheKey] = promise;
     return promise;
   };

package/dist/runtime/better-auth/vue/client.d.ts

@@ -1,6 +1,6 @@
 import { convexClient } from '@convex-dev/better-auth/client/plugins';
-import { createAuthClient } from 'better-auth/vue';
-export declare const authClient: ReturnType<typeof createAuthClient<{
+import { type VueAuthClient } from 'better-auth/vue';
+export declare const authClient: VueAuthClient<{
     plugins: ReturnType<typeof convexClient>[];
-}>>;
+}>;
 export type AuthClient = typeof authClient;

package/dist/runtime/better-auth/vue/cross-domain.d.ts

@@ -1,3 +1,29 @@
+import { authClient } from '#convex/auth-client';
+/**
+ * An {@link AuthClient} that also includes the `crossDomainClient()` plugin.
+ *
+ * The aliased client's type only reflects the plugins the app installed (the
+ * bundled default omits `crossDomainClient()`), so this describes the
+ * cross-domain additions itself.
+ *
+ * @public
+ */
+export type AuthClientWithCrossDomain = typeof authClient & {
+    updateSession: () => void;
+    crossDomain?: {
+        oneTimeToken: {
+            verify: (args: {
+                token: string;
+            }) => Promise<{
+                data?: {
+                    session?: {
+                        token: string;
+                    } | null;
+                } | null;
+            }>;
+        };
+    };
+};
 /**
  * Options for {@link consumeCrossDomainOneTimeToken}.
  *

package/dist/runtime/better-auth/vue/index.d.ts

@@ -7,7 +7,7 @@
 export { useBetterAuth, type UseBetterAuthReturn, type BetterAuthSession, type BetterAuthUser } from './use-better-auth.js';
 export { authClient, type AuthClient } from '#convex/auth-client';
 export { usePreloadedAuthQuery } from './hydration.js';
-export { consumeCrossDomainOneTimeToken, type ConsumeCrossDomainOneTimeTokenOptions } from './cross-domain.js';
+export { consumeCrossDomainOneTimeToken, type AuthClientWithCrossDomain, type ConsumeCrossDomainOneTimeTokenOptions } from './cross-domain.js';
 export { resolveAuthRedirect } from './redirect.js';
 export { AuthBoundary } from './auth-boundary.js';
 export { convexClient, crossDomainClient } from '@convex-dev/better-auth/client/plugins';

package/dist/runtime/better-auth/vue/plugin.server.js

@@ -1,9 +1,10 @@
 import { computed } from "vue";
 import { defineNuxtPlugin, useRuntimeConfig, useState, useRequestEvent, useResponseHeader } from "#app";
 import { ConvexVueClient, ConvexClientKey } from "../../vue/client.js";
-import { CONVEX_INITIAL_TOKEN_KEY } from "../../nuxt/config.js";
+import { CONVEX_INITIAL_TOKEN_KEY, closeAfterRender } from "../../nuxt/config.js";
 import { convexAuth } from "../nuxt/server.js";
 import { ConvexAuthStateKey } from "../../vue/auth/index.js";
+import { BetterAuthTokenStoreKey, createBetterAuthTokenStore, seedInitialToken } from "./token-store.js";
 export async function prefetchAuthToken(event, initialToken, cacheControl) {
   try {
     const token = await convexAuth(event).getToken();
@@ -19,10 +20,13 @@ export default defineNuxtPlugin({
   name: "nuxt-convex-module:better-auth:server",
   async setup(nuxtApp) {
     const initialToken = useState(CONVEX_INITIAL_TOKEN_KEY, () => null);
+    const tokenStore = createBetterAuthTokenStore();
+    nuxtApp.vueApp.provide(BetterAuthTokenStoreKey, tokenStore);
     const url = useRuntimeConfig().public.convex.url;
     const ssrClient = url ? new ConvexVueClient(url) : void 0;
     if (ssrClient) {
       nuxtApp.vueApp.provide(ConvexClientKey, ssrClient);
+      closeAfterRender(nuxtApp, ssrClient);
     }
     const ssrAuthState = {
       isLoading: computed(() => true),
@@ -33,6 +37,7 @@ export default defineNuxtPlugin({
     const event = useRequestEvent();
     if (event && !import.meta.prerender) {
       await prefetchAuthToken(event, initialToken, useResponseHeader("Cache-Control"));
+      seedInitialToken(tokenStore, initialToken.value);
     }
   }
 });

package/dist/runtime/better-auth/vue/token-store.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/runtime/better-auth/vue/token-store.js

@@ -0,0 +1,38 @@
+import { ref } from "vue";
+export function createBetterAuthTokenStore() {
+  return {
+    cachedToken: ref(null),
+    cachedTokenVersion: null,
+    pendingToken: null,
+    pendingTokenVersion: null,
+    initialTokenUsed: false,
+    initialTokenSessionId: void 0
+  };
+}
+export const BetterAuthTokenStoreKey = Symbol("BetterAuthTokenStore");
+export const PENDING_AUTH_VERSION = "__pending__";
+export function readTokenClaims(token) {
+  try {
+    const payload = token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
+    return JSON.parse(atob(payload)) ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+const getTokenSessionId = (token) => {
+  const sessionId = readTokenClaims(token)?.sessionId;
+  return typeof sessionId === "string" ? sessionId : void 0;
+};
+export function seedInitialToken(store, initialToken) {
+  if (store.initialTokenUsed || !initialToken) return;
+  store.cachedToken.value = initialToken;
+  store.cachedTokenVersion = PENDING_AUTH_VERSION;
+  store.initialTokenSessionId = getTokenSessionId(initialToken);
+  store.initialTokenUsed = true;
+}
+export function clearToken(store) {
+  store.cachedToken.value = null;
+  store.cachedTokenVersion = null;
+  store.pendingToken = null;
+  store.pendingTokenVersion = null;
+}

package/dist/runtime/better-auth/vue/use-better-auth.d.ts

@@ -13,9 +13,9 @@ export type BetterAuthUser = {
 } & Record<string, unknown>;
 /** What `useBetterAuth()` returns. */
 export interface UseBetterAuthReturn {
-    /** `true` until the session is known and no prefetched token covers the gap. */
+    /** `true` until the session is known and no prefetched token covers the gap, or while a token from another user is replaced. */
     isLoading: ComputedRef<boolean>;
-    /** `true` when Better Auth reports a session, or a token is cached while it reloads. */
+    /** `true` when Better Auth reports a session, or the prefetched token covers the session loading. */
     isAuthenticated: ComputedRef<boolean>;
     /** Convex's token fetcher: the Better Auth JWT for the current session, or `null`. */
     fetchAccessToken: AuthTokenFetcher;
@@ -25,8 +25,8 @@ export interface UseBetterAuthReturn {
     session: BetterAuthSession;
     /** The current user, or `null` when signed out / still loading. */
     user: ComputedRef<BetterAuthUser | null>;
-    /** The session id (or user id); changes when the signed-in identity changes. */
-    authVersion: ComputedRef<string | null>;
+    /** The session id (or user id), `null` when signed out, `undefined` until the session settles. */
+    authVersion: ComputedRef<string | null | undefined>;
 }
 /**
  * The Better Auth service for the Vue/Nuxt runtime.

package/dist/runtime/better-auth/vue/use-better-auth.js

@@ -1,67 +1,110 @@
-import { computed, ref } from "vue";
+import { computed, effectScope, hasInjectionContext, inject, shallowRef, triggerRef, watch } from "vue";
 import { authClient } from "#convex/auth-client";
-const cachedToken = ref(null);
-let cachedTokenVersion = null;
-let pendingToken = null;
-let pendingTokenVersion = null;
-let initialTokenUsed = false;
-const PENDING_AUTH_VERSION = "__pending__";
-const useClientSession = () => authClient.useSession();
-export function useBetterAuth(initialToken) {
-  if (!initialTokenUsed && initialToken) {
-    cachedToken.value = initialToken;
-    cachedTokenVersion = PENDING_AUTH_VERSION;
-    initialTokenUsed = true;
+import { BetterAuthTokenStoreKey, clearToken, createBetterAuthTokenStore, PENDING_AUTH_VERSION, readTokenClaims, seedInitialToken } from "./token-store.js";
+const browserStore = createBetterAuthTokenStore();
+function useTokenStore() {
+  if (!import.meta.server) return browserStore;
+  return (hasInjectionContext() ? inject(BetterAuthTokenStoreKey, null) : null) ?? createBetterAuthTokenStore();
+}
+const serverSession = () => shallowRef({
+  data: null,
+  error: null,
+  isPending: true,
+  isRefetching: false,
+  refetch: async () => {
   }
+});
+let browserSession;
+let browserSessionScope;
+const useClientSession = () => {
+  if (import.meta.server) return serverSession();
+  browserSessionScope ??= effectScope(true);
+  return browserSession ??= browserSessionScope.run(() => {
+    const session = authClient.useSession();
+    watch(session, ({ data, isPending }) => {
+      if (!data && !isPending) clearToken(browserStore);
+    }, { flush: "sync" });
+    return session;
+  });
+};
+export function useBetterAuth(initialToken) {
+  const store = useTokenStore();
+  seedInitialToken(store, initialToken);
+  const { cachedToken } = store;
   const session = useClientSession();
   const client = authClient;
   const authVersion = computed(() => {
     const data = session.value.data;
-    return data?.session?.id ?? data?.user?.id ?? null;
+    const id = data?.session?.id ?? data?.user?.id ?? null;
+    return id === null && session.value.isPending ? void 0 : id;
   });
-  const currentAuthVersion = () => authVersion.value ?? (session.value.isPending ? PENDING_AUTH_VERSION : null);
+  const currentAuthVersion = () => authVersion.value === void 0 ? PENDING_AUTH_VERSION : authVersion.value;
+  const holdsAnotherSessionsToken = computed(() => {
+    const data = session.value.data;
+    if (!data || !cachedToken.value || store.cachedTokenVersion !== PENDING_AUTH_VERSION) return false;
+    if (store.initialTokenSessionId && data.session?.id) return store.initialTokenSessionId !== data.session.id;
+    const subject = readTokenClaims(cachedToken.value)?.sub;
+    return !!data.user?.id && subject !== void 0 && subject !== data.user.id;
+  });
+  const isServerTokenActive = () => session.value.isPending && cachedToken.value !== null && store.cachedTokenVersion === PENDING_AUTH_VERSION;
   const fetchAccessToken = async ({
     forceRefreshToken = false
   } = {}) => {
     const version = currentAuthVersion();
     if (version === null) {
-      cachedToken.value = null;
-      cachedTokenVersion = null;
-      pendingToken = null;
-      pendingTokenVersion = null;
+      clearToken(store);
       return null;
     }
-    if (cachedToken.value && !forceRefreshToken && cachedTokenVersion === version) {
-      return cachedToken.value;
+    if (store.cachedTokenVersion === PENDING_AUTH_VERSION && store.initialTokenSessionId === version) {
+      store.cachedTokenVersion = version;
     }
-    if (!forceRefreshToken && pendingToken && pendingTokenVersion === version) {
-      return pendingToken;
+    if (!forceRefreshToken) {
+      if (store.pendingToken && store.pendingTokenVersion === version) {
+        return store.pendingToken;
+      }
+      if (cachedToken.value && store.cachedTokenVersion === version) {
+        return cachedToken.value;
+      }
     }
-    pendingTokenVersion = version;
-    pendingToken = client.convex.token({ fetchOptions: { throw: false } }).then(({ data }) => {
+    const afterFailure = () => {
+      if (cachedToken.value && !holdsAnotherSessionsToken.value && (store.cachedTokenVersion === version || store.cachedTokenVersion === PENDING_AUTH_VERSION)) {
+        return cachedToken.value;
+      }
+      if (isLatest()) {
+        cachedToken.value = null;
+        store.cachedTokenVersion = version;
+      }
+      return null;
+    };
+    store.pendingTokenVersion = version;
+    const isLatest = () => store.pendingToken === pending;
+    const pending = store.pendingToken = client.convex.token({ fetchOptions: { throw: false } }).then(({ data, error }) => {
+      if (error && error.status !== 401) {
+        return afterFailure();
+      }
       const token = data?.token || null;
-      cachedToken.value = token;
-      cachedTokenVersion = version;
+      if (isLatest()) {
+        store.cachedTokenVersion = version;
+        cachedToken.value = token;
+        triggerRef(cachedToken);
+      }
       return token;
-    }).catch(() => {
-      cachedToken.value = null;
-      cachedTokenVersion = version;
-      return null;
-    }).finally(() => {
-      pendingToken = null;
-      pendingTokenVersion = null;
+    }).catch(afterFailure).finally(() => {
+      if (isLatest()) {
+        store.pendingToken = null;
+        store.pendingTokenVersion = null;
+      }
     });
-    return pendingToken;
+    return pending;
   };
   return {
-    isLoading: computed(() => session.value.isPending && !cachedToken.value),
+    isLoading: computed(() => session.value.isPending && !isServerTokenActive() || holdsAnotherSessionsToken.value),
     // PARITY: D-03
-    // Diverges from upstream's `Boolean(session?.session) || cachedToken !== null`:
-    // a settled signed-out session must read unauthenticated immediately (Vue has
-    // no re-render to run upstream's cache-clearing effect first), and Better Auth
-    // session data without a nested `session` still counts as signed in.
+    // Diverges from upstream's `Boolean(session?.session) || isSsrTokenActive`:
+    // Better Auth session data without a nested `session` still counts as
+    // signed in.
     isAuthenticated: computed(
-      () => !!session.value.data || session.value.isPending && cachedToken.value !== null
+      () => !!session.value.data || isServerTokenActive()
     ),
     fetchAccessToken,
     // PARITY: A-06 — Vue-only service extensions.
@@ -75,9 +118,9 @@ export function useBetterAuth(initialToken) {
   };
 }
 export function __resetUseBetterAuthForTests() {
-  cachedToken.value = null;
-  cachedTokenVersion = null;
-  pendingToken = null;
-  pendingTokenVersion = null;
-  initialTokenUsed = false;
+  Object.assign(browserStore, createBetterAuthTokenStore(), { cachedToken: browserStore.cachedToken });
+  browserStore.cachedToken.value = null;
+  browserSessionScope?.stop();
+  browserSessionScope = void 0;
+  browserSession = void 0;
 }

package/dist/runtime/nuxt/composables/use-async-paginated-query.d.ts

@@ -32,7 +32,7 @@ export interface AsyncPaginatedQueryData<Item> {
     status: ComputedRef<PaginationStatus>;
     /** `true` while no page — server or live — is available yet, or more rows are loading. */
     isLoading: ComputedRef<boolean>;
-    /** The SSR fetch error or the live subscription's, `null` when none. Never thrown. */
+    /** The live subscription's error, or the SSR fetch error until the live query has a page; `null` when none. Never thrown. */
     error: ComputedRef<Error | null>;
     /**
      * Fetch `numItems` more rows. Takes effect once the live subscription has

package/dist/runtime/nuxt/composables/use-async-paginated-query.js

@@ -70,9 +70,11 @@ export function useAsyncPaginatedQuery(query, args, options) {
     return "LoadingFirstPage";
   });
   const isLoading = computed(() => status.value === "LoadingFirstPage" || status.value === "LoadingMore");
-  const error = computed(
-    () => liveState.value?.error ?? clientError.value ?? asyncData.error.value ?? null
-  );
+  const error = computed(() => {
+    const liveError = liveState.value?.error ?? clientError.value;
+    if (liveError) return liveError;
+    return liveHasPage.value ? null : asyncData.error.value ?? null;
+  });
   const loadMore = (numItems) => {
     live?.loadMore(numItems);
   };

package/dist/runtime/nuxt/composables/use-async-query.d.ts

@@ -66,7 +66,10 @@ export interface AsyncQueryReturn<T> extends PromiseLike<AsyncQueryData<T>> {
      * nothing has loaded (or while skipped).
      */
     data: ComputedRef<T | undefined>;
-    /** The initial-fetch or live-subscription error, `null` when none. */
+    /**
+     * The initial-fetch or live-subscription error, `null` when none. A failed
+     * initial fetch stops counting once the live subscription has a value.
+     */
     error: ComputedRef<Error | null>;
     /**
      * Initial-fetch status. Live pushes don't churn it: once data exists it

package/dist/runtime/nuxt/composables/use-async-query.js

@@ -75,9 +75,12 @@ export function useAsyncQuery(query, args, options = {}) {
   const data = computed(
     () => liveValue.value !== void 0 ? liveValue.value : payloadValue.value
   );
-  const error = computed(
-    () => liveError.value ?? asyncData.error.value ?? null
-  );
+  const error = computed(() => {
+    if (liveError.value) {
+      return liveError.value;
+    }
+    return liveValue.value !== void 0 ? null : asyncData.error.value ?? null;
+  });
   const status = computed(() => {
     if (liveError.value) {
       return "error";

package/dist/runtime/nuxt/config.d.ts

@@ -8,11 +8,17 @@ export declare const CONVEX_INITIAL_TOKEN_KEY = "convex:initialToken";
 /**
  * The module's runtime config, tolerating a missing Nuxt context (a plain
  * server import outside a request) by returning an empty object.
+ *
+ * Given a server route's event, it reads that request's config: an
+ * environment variable set after the server started (by a Nitro plugin, say)
+ * reaches it, where the config read without one was fixed at startup.
  */
-export declare function getConvexRuntimeConfig(): {
+export declare function getConvexRuntimeConfig(event?: unknown): {
     url: string | undefined;
     siteUrl: string | undefined;
+    authRoute: string | undefined;
 } | {
     url?: undefined;
     siteUrl?: undefined;
+    authRoute?: undefined;
 };

package/dist/runtime/nuxt/config.js

@@ -1,11 +1,17 @@
 import { useRuntimeConfig } from "#imports";
 export const CONVEX_INITIAL_TOKEN_KEY = "convex:initialToken";
-export function getConvexRuntimeConfig() {
+export function closeAfterRender(nuxtApp, client) {
+  const close = () => void client.close();
+  nuxtApp.hook("app:rendered", close);
+  nuxtApp.hook("app:error", close);
+}
+export function getConvexRuntimeConfig(event) {
   try {
-    const config = useRuntimeConfig();
+    const config = useRuntimeConfig(event);
     return {
       url: config.public?.convex?.url,
-      siteUrl: config.public?.convex?.siteUrl
+      siteUrl: config.public?.convex?.siteUrl,
+      authRoute: config.public?.convex?.authRoute
     };
   } catch {
     return {};

package/dist/runtime/nuxt/csp.d.ts

@@ -37,7 +37,8 @@ export declare function convexResourceSrc(url?: string, siteUrl?: string): strin
  *
  * For each directive we keep any value the user already set and *append* the
  * Convex origins, so consumers extend (add their own third parties) rather than
- * fight the defaults, and the Convex origins are always present. A user who sets
+ * fight the defaults, and the Convex origins are always present. That covers a
+ * directive the user left to `default-src`, whose places carry over. A user who sets
  * `contentSecurityPolicy: false` (CSP disabled) is left untouched, as is a rule
  * set with nothing to add (no Convex URL).
  */

package/dist/runtime/nuxt/csp.js

@@ -39,8 +39,14 @@ export function applyConvexSecurityDefaults(rules, connectSrc, resourceSrc) {
   tightenDirective(csp, "media-src", ["'self'"], resourceSrc);
 }
 function tightenDirective(csp, name, baseline, additions) {
-  if (additions.length === 0) return;
-  const current = csp[name];
-  const existing = Array.isArray(current) ? current : typeof current === "string" ? current.split(/\s+/).filter(Boolean) : baseline;
+  if (additions.length === 0 || csp[name] === false) return;
+  const existing = sourcesOf(csp[name]) ?? [...baseline, ...inheritedSources(csp)];
   csp[name] = uniq([...existing, ...additions]);
 }
+function sourcesOf(value) {
+  if (Array.isArray(value)) return value;
+  return typeof value === "string" ? value.split(/\s+/).filter(Boolean) : void 0;
+}
+function inheritedSources(csp) {
+  return (sourcesOf(csp["default-src"]) ?? []).filter((source) => source === "'self'" || !source.startsWith("'"));
+}

package/dist/runtime/vue/auth/index.d.ts

@@ -66,7 +66,8 @@ export interface ConvexAuthProviderOptions {
          * Alternative re-authentication trigger for providers that hand out a
          * stable fetcher function: when this value changes, auth state transitions
          * back to loading, `clearAuth` runs, and `fetchAccessToken` is called
-         * again against the new auth context.
+         * again against the new auth context. `undefined` means the provider does
+         * not know the context yet, so the first value it learns is no change.
          */
         authVersion?: MaybeRefOrGetter<unknown>;
     };