1.5.2: update deps, fix security vulnerabilities, fix TS2742 build errors, and add CLAUDE.md

Author: kaihaase

.claude/agent-memory/lt-dev-npm-package-maintainer/MEMORY.md

@@ -0,0 +1,4 @@
+# Agent Memory Index
+
+- [Project: nuxt-extensions structure](project_nuxt_extensions.md) — Module-only project with single runtime dep @nuxt/kit; all others are devDeps or peerDeps
+- [Feedback: Pre-existing TS2742 build errors](feedback_ts2742_build_error.md) — TS2742 errors in middleware/plugin mkdist .d.ts generation pre-existed; fix by explicit type annotations

.claude/agent-memory/lt-dev-npm-package-maintainer/feedback_ts2742_build_error.md

@@ -0,0 +1,15 @@
+---
+name: TS2742 build errors in middleware and plugins
+description: Pre-existing TS2742 mkdist type generation errors in middleware/setup.ts and plugins/error-translation.client.ts
+type: feedback
+---
+
+TS2742 "inferred type of 'default' cannot be named without a reference to nuxt/app" errors existed in the build BEFORE any maintenance changes. They are pre-existing bugs.
+
+**Why:** `defineNuxtPlugin` and `defineNuxtRouteMiddleware` return types reference `nuxt/app` internals via pnpm's `.pnpm/` path which TypeScript cannot make portable in .d.ts files.
+
+**How to apply:**
+- For `defineNuxtPlugin`: Add `import type { NuxtApp } from "#app"` and type the nuxtApp parameter as `NuxtApp`
+- For `defineNuxtRouteMiddleware`: Cast the export as `ReturnType<typeof defineNuxtRouteMiddleware>` — e.g., `export default defineNuxtRouteMiddleware(fn) as ReturnType<typeof defineNuxtRouteMiddleware>`
+
+The middleware approach (type cast) works when the plugin approach (typing the argument) does not fully resolve the issue for middleware. Both should be applied together when fixing the build.

.claude/agent-memory/lt-dev-npm-package-maintainer/project_nuxt_extensions.md

@@ -0,0 +1,15 @@
+---
+name: nuxt-extensions project structure
+description: Key dependency and build facts about @lenne.tech/nuxt-extensions module
+type: project
+---
+
+@lenne.tech/nuxt-extensions has only ONE runtime dependency: `@nuxt/kit` (used in src/module.ts). Everything else is devDependencies or peerDependencies.
+
+**Why:** This is a Nuxt module library. Consumers install it as a peer dep; runtime deps must be minimal to avoid bloating consumer installs.
+
+**How to apply:** When doing dependency maintenance, only @nuxt/kit belongs in `dependencies`. All build tools, test frameworks, and peer implementations (better-auth, @better-auth/passkey, tus-js-client, @playwright/test) go in devDependencies.
+
+The `packageManager` field uses pnpm and is tracked in package.json — update it alongside pnpm version bumps.
+
+Build command: `npm run prepack` (runs `nuxt-module-build build`). Tests: `pnpm test` (vitest). No test scripts configured via npm, use pnpm test directly.

CLAUDE.md

@@ -0,0 +1,75 @@
+# @lenne.tech/nuxt-extensions
+
+Reusable Nuxt 4 module providing composables, components, utilities, and Better Auth integration for lenne.tech projects.
+
+## Architecture
+
+```
+src/
+├── module.ts              # Nuxt module entry point (auto-imports, plugin registration)
+├── runtime/
+│   ├── composables/       # Auto-imported composables
+│   ├── components/        # Auto-imported components
+│   ├── lib/               # Library exports (auth-client, helpers)
+│   ├── middleware/         # Route middleware (auth)
+│   ├── plugins/           # Nuxt plugins (auth initialization)
+│   ├── server/            # Nitro server routes (auth proxy)
+│   ├── testing/           # Playwright test helpers
+│   ├── types/             # TypeScript type definitions
+│   └── utils/             # Auto-imported utility functions
+```
+
+## Key Composables
+
+| Composable | Purpose |
+|-----------|---------|
+| `useBetterAuth()` | Authentication state, login, logout, session management |
+| `useAuthClient()` | Raw Better Auth client access |
+| `useTusUpload()` | TUS resumable file uploads |
+
+## Module Configuration
+
+Configure in `nuxt.config.ts`:
+
+```typescript
+export default defineNuxtConfig({
+  modules: ['@lenne.tech/nuxt-extensions'],
+  lennetech: {
+    // API base URL for auth proxy
+    apiUrl: 'http://localhost:3000',
+    // Enable/disable features
+    betterAuth: true,
+    tusUpload: true,
+  }
+})
+```
+
+## Authentication (Better Auth)
+
+- SSR-safe session management via `useBetterAuth()`
+- Auth proxy server route at `/api/auth/**` (proxies to backend)
+- Middleware `auth` for protected routes
+- Passkey (WebAuthn) support via `@better-auth/passkey` peer dependency
+- 2FA (TOTP) support built-in
+
+### Auth Flow
+
+1. Frontend calls `useBetterAuth().signIn()` / `.signUp()`
+2. Request goes through Nitro proxy at `/api/auth/**`
+3. Proxy forwards to backend Better Auth endpoints
+4. Session cookie set via `httpOnly` cookie (SSR-safe)
+
+## Testing Helpers
+
+Import from `@lenne.tech/nuxt-extensions/testing`:
+
+```typescript
+import { createTestUser, loginTestUser } from '@lenne.tech/nuxt-extensions/testing';
+```
+
+## Development Rules
+
+1. **ALWAYS read source code** in `dist/runtime/` to understand available composables and components
+2. **Use `useBetterAuth()`** for authentication — never implement auth manually
+3. **Check existing composables** before creating new ones — this module may already provide what you need
+4. **Peer dependencies** (`better-auth`, `@better-auth/passkey`, `tus-js-client`) must be installed in the consuming project

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nuxt-extensions",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "Reusable Nuxt 4 composables, components, and Better-Auth integration for lenne.tech projects",
   "repository": {
     "type": "git",
@@ -12,7 +12,7 @@
   },
   "author": "lenne.Tech <info@lenne.tech> (https://lenne.tech)",
   "license": "MIT",
-  "packageManager": "pnpm@10.32.1",
+  "packageManager": "pnpm@10.33.0",
   "type": "module",
   "exports": {
     ".": {
@@ -43,7 +43,8 @@
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "CLAUDE.md"
   ],
   "scripts": {
     "prepare": "git config core.hooksPath .githooks",
@@ -93,36 +94,46 @@
     }
   },
   "devDependencies": {
-    "@better-auth/passkey": "1.5.5",
-    "@nuxt/devtools": "3.2.3",
+    "@better-auth/passkey": "1.5.6",
+    "@nuxt/devtools": "3.2.4",
     "@nuxt/module-builder": "1.0.2",
     "@nuxt/schema": "4.4.2",
-    "@playwright/test": "1.58.2",
-    "@types/node": "25.5.0",
-    "@vitest/coverage-v8": "4.1.0",
-    "better-auth": "1.5.5",
-    "happy-dom": "20.8.4",
+    "@playwright/test": "1.59.1",
+    "@types/node": "25.5.2",
+    "@vitest/coverage-v8": "4.1.2",
+    "better-auth": "1.5.6",
+    "happy-dom": "20.8.9",
     "nuxt": "4.4.2",
-    "oxfmt": "0.40.0",
-    "oxlint": "1.55.0",
+    "oxfmt": "0.43.0",
+    "oxlint": "1.58.0",
     "tus-js-client": "4.3.1",
     "typescript": "5.9.3",
-    "vitest": "4.1.0",
-    "vue-tsc": "3.2.5"
+    "vitest": "4.1.2",
+    "vue-tsc": "3.2.6"
   },
   "pnpm": {
     "onlyBuiltDependencies": [
       "@parcel/watcher",
       "esbuild"
     ],
     "overrides": {
-      "minimatch@>=5.0.0 <5.1.8": "5.1.8",
-      "minimatch@>=9.0.0 <9.0.7": "9.0.7",
-      "minimatch@>=10.0.0 <10.2.3": "10.2.3",
+      "brace-expansion@<2.0.3": ">=2.0.3",
+      "brace-expansion@>=4.0.0 <5.0.5": ">=5.0.5",
+      "defu@<=6.1.4": ">=6.1.5",
+      "h3@<1.15.9": ">=1.15.9",
+      "lodash@<=4.17.23": ">=4.18.0",
+      "minimatch@>=5.0.0 <5.1.9": "5.1.9",
+      "minimatch@>=9.0.0 <9.0.9": "9.0.9",
+      "minimatch@>=10.0.0 <10.2.5": "10.2.5",
+      "node-forge@<1.4.0": ">=1.4.0",
+      "picomatch@<2.3.2": ">=2.3.2",
+      "picomatch@>=4.0.0 <4.0.4": ">=4.0.4",
       "rollup@>=4.0.0 <4.59.0": ">=4.59.0",
-      "serialize-javascript@<=7.0.2": ">=7.0.3",
+      "serialize-javascript@<7.0.5": ">=7.0.5",
+      "srvx@<0.11.13": ">=0.11.13",
       "svgo@=4.0.0": ">=4.0.1",
-      "tar@<7.5.11": "7.5.11"
+      "tar@<7.5.11": "7.5.11",
+      "yaml@>=2.0.0 <2.8.3": ">=2.8.3"
     }
   },
   "keywords": [