Better Convex v1.0.0-beta.4

• Revoke every earlier session after password reset with atomic generation
  invalidation, including accounts with more than the bounded bulk-delete limit.
• Require a current persisted session before approving destructive MCP starter
  operations, instead of trusting a still-valid session JWT alone.
• Bind development initialization to one inspected Convex authority and reject
  production or changed deployment credentials before provisioning.

Better Convex v1.0.0-beta.3

• Add an opt-in workforce assurance baseline for business applications with
  verified email, bounded sessions, TOTP, recovery codes, enrollment and
  revocation controls, and replay-safe security operations.
• Add typed Better Auth email hooks for verification, password reset, and
  invitations while keeping delivery in application-owned Convex actions.
• Preserve request-bound authentication continuity across browser, Nuxt, and
  Convex boundaries without exposing credentials to client state or logs.
• Centralize workforce adapter policy so transport handlers remain thin and
  security rules have one source of truth.

Better Convex v1.0.0-beta.2

• Prevent the OAuth client deletion operator from exposing a raw
  application-owned profile resolver failure.
• Recreate missing Better Auth user projections from the current update,
  reject ambiguous duplicate rows with a fixed internal error, and leave
  duplicate repair to application-owned migrations.

Better Convex v1.0.0-beta.1

• Support stable latest releases and independent mcp-v* releases without
  changing the trusted publishing workflow identity or rebuilding artifacts.
• Align @lupinum/better-convex-nuxt, @lupinum/better-convex-vue, and
  @lupinum/better-convex-mcp on the first 1.0 beta contract.
• Replace the old auth export paths and separate executables with the focused
  better-auth/* entries and one better-convex command.
• Move the Vue MCP App integration to @lupinum/better-convex-mcp/vue so the
  Vue runtime remains identity-safe and provider-neutral.
• Standardize public reactive progress on pending and adopt bounded Nuxt,
  Convex, Vue, and Node compatibility ranges backed by exact tested versions.
• Add deferred and lazy query lifecycles, dynamic keyed multi-query state, and
  resumable pagination with generation-safe reset and overlap handling.
• Add one reviewed createBetterConvexAuth factory and an idempotent,
  confirmation-gated development initializer that never prints generated secrets.
• Harden cookie forwarding, auth failure classification, serialized error revival,
  OAuth/MCP routing, and request-scoped sanitized MCP tool failure hooks.
• Focus DevTools on query gates, operation timelines, auth/proxy state, and
  sanitized agent boundary diagnostics without polling or editing controls.

Better Convex mcp-v1.0.0-beta.1

• Release @lupinum/better-convex-mcp on its independent 1.0 beta line while
  preserving the coupled Vue/Nuxt version and release history.
• Consolidate MCP server operation on the better-convex command with
  provider-neutral request handling, OAuth resource verification, live access
  checks, and sanitized tool-failure hooks.
• Provide the experimental Vue MCP App boundary from the MCP-owned /vue
  entrypoint so the Vue runtime remains provider-neutral.

Better Convex v0.8.0-beta.40

• Move all publishable packages to the @lupinum npm scope. This is a hard
  cutover: use @lupinum/better-convex-nuxt, @lupinum/better-convex-vue, and
  @lupinum/better-convex-mcp.
• Hard-cut Better Convex to one Vue-owned client lifecycle, one integrated
  Better Auth client, identity-partitioned SSR/query state, and direct callable
  mutation/action contracts without compatibility shims.
• Make authentication opt-in, keep no-auth installs free of Better Auth, and
  expose an opaque token-free attachment for embedded Vue consumers.
• Ship provider-neutral MCP request handling on the official server, exact
  OAuth resource verification, provider-owned live access checks, and the
  experimental Vue MCP App client boundary.
• Replace repeated release rehearsals with one clean hosted source
  certification followed by immutable artifact checks, protected staging, and
  exact npm byte comparison.
• Refresh every maintained candidate lock against the final package bytes, make
  the local candidate registry compatible with the 24-hour dependency policy,
  and replace the demo's vulnerable fontless esbuild version.

Note

This first npm version was created from the exact CI-certified artifact before npm trusted publishing could be configured. npm does not provide GitHub OIDC provenance for this bootstrap publication. The protected workflow verified the registry bytes. Later versions use trusted publishing with provenance.
Bootstrap packages: @lupinum/better-convex-vue,@lupinum/better-convex-nuxt,@lupinum/better-convex-mcp

v0.6.1

🔒 Dependency and CI hardening

• Updated the exact supported Convex version to 1.42.1 across the package,
  fixtures, demo, and maintained starters.
• Updated the release toolchain, including ESLint 10, Playwright 1.61,
  @nuxt/eslint-config 1.16, @vitejs/plugin-vue 6.0.8, convex-test 0.0.54,
  lint-staged 17, oxfmt 0.59, and the latest compatible stable supporting
  packages.
• Updated pinned GitHub Actions for checkout, Node setup, pnpm setup, and
  TruffleHog; the TruffleHog binary input now matches the pinned action, and
  checkout credentials are not persisted into subsequent job steps.
• Kept TypeScript on the latest compatible 5.9 release because TypeScript 7 is
  outside the current Nuxt, ESLint, and Convex peer ranges.

✅ Reliability

• Adapted error construction and local assignments to the stricter ESLint 10
  rules without changing public behavior.
• Made the small Convex backend test corpus run serially, avoiding CPU-contention
  timeouts while preserving the existing per-test failure bound.
• Regenerated and frozen-validated the exact candidate resolution in the demo
  and all five maintained starters.

better-convex-nuxt v0.6.0

v0.6.0

compare changes

This is the vNext hard cutover. It replaces the pre-0.6 auth, query-argument,
error, and server-call surfaces outright — there is no compatibility shim and
no deprecation period. Upgrading requires reading the sections below; most
consumers will need source changes.

🔒 Security hardening

• Fixed authentication to one same-origin /api/auth proxy, GET/POST only,
  with one validated upstream request, no server-side redirect following, and
  no caller-controlled forwarding headers.
• Preserved request bytes and one deadline through complete response
  consumption, including bounded request/response bodies and deterministic
  stream cancellation.
• Made Better Auth's public reactive session the canonical client identity
  source across built-in, raw, and plugin operations, MFA settlement, expiry,
  cross-tab logout, and account switching.
• Serialized complete sign-in, sign-up, and sign-out operations so stale work
  cannot publish a superseded identity.
• Removed cross-origin CORS/trusted-origin configuration, custom proxy routes,
  the cross-request JWT cache, and its public clear helper.
• Hardened maintained demo and starter Convex functions with server-side
  authorization, tenant ownership checks, bounded reads/writes, pagination,
  body limits, and invariant tests.
• Narrowed supported Nuxt versions to ^4.4.0; Better Auth, its Convex adapter,
  and Convex use exact tested peer versions.

✅ Release assurance

• Added deterministic isolated E2E execution, real Nitro proxy probes, seeded
  proxy property tests, browser identity lifecycle coverage, and a two-tab
  session/account-switch matrix.
• Added a machine-checked OWASP ASVS 5.0.0 Level 2 responsibility/evidence
  ledger covering all 253 applicable Level 1/2 controls.
• Added production dependency auditing, CycloneDX SBOM generation, secret
  scanning, CodeQL, pinned CI actions, Dependabot, and exact-tarball release
  gates across the demo and all five maintained starters.
• Release preparation now builds and packs once, verifies that exact immutable
  tarball, records its manifest and SHA-256, and leaves npm publication and Git
  tagging as explicit operator actions.

💥 Breaking changes

Auth installation, config, and runtime topology

• Removed auth.enabled as a separate boolean. Authentication now installs by
  default (or via an options object); pass auth: false as the sole
  off-switch. defaults.auth no longer exists.
• Removed auth.cache.enabled and auth.unauthorized.enabled/auth.unauthorized.
  The auth cache option is now a plain false | options value with no nested
  enabled flag, and unauthorized-route recovery no longer exists in module
  options, runtime config, or source.
• Removed auth: 'auto'. Query auth modes are exactly required | optional | none,
  with identical meaning on client and server. The default mode is optional.

Query modes and cross-identity isolation

• optional/required queries now wait for initial auth settlement before
  running, and are partitioned by the caller's stable identity key plus an
  identityGeneration counter — no query, paginated page, optimistic update,
  mutation/action result, upload, callback, or seeded-profile state can leak
  across a sign-in/sign-out/user-switch boundary.
• none queries always use a dedicated, permanently anonymous transport and
  never observe a Convex identity, even when the app is otherwise signed in.
• Same-user token rotation (refresh) no longer forces query reacquisition.
• Every identity-key change (anonymous↔user, user↔user) retires and closes the
  previous primary ConvexClient and replaces it; the public useConvex()
  handle and the dedicated anonymous client stay stable across the swap.

Explicit query arguments; surface removal

• Queries must always be called with an explicit args object or the literal
  string 'skip'. Omitted-argument calls (e.g. useConvexQuery(api.x.y)) are
  no longer accepted.
• Removed getQueryKey and the better-convex-nuxt/composables subpath.
  Public types are imported from the package root.

ConvexCallError

• Introduced ConvexCallError as the one public error type for both throwing
  and safe ({ data, error }-style) call paths. It survives Nitro/SSR
  serialization with its identity and public fields (kind, code, message,
  status, data) intact; cause is never serialized or logged.
• Unstructured upstream response bodies can no longer reach public errors,
  logs, or payloads.

Typed Better Auth client

• Better Auth client plugins are now registered once per Nuxt app through
  defineConvexAuthClient in a project's convex-auth.ts, using the
  framework-free better-convex-nuxt/auth-client entry. Removed
  createBetterConvexAuthClient, resolveBetterConvexAuthBaseURL, and the
  BetterConvexAuthClientOptions/BetterConvexAuthClientPluginList types.

Atomic sign-in/sign-up

• signIn/signUp now synchronize the Convex identity automatically as part
  of the call; there is no manual post-sign-in/sign-up refresh step. refresh()
  remains available only for advanced raw-client or claim-change flows.
• useConvexAuth() is available both when auth is enabled and when it is
  disabled (module option auth: false), reporting status 'disabled' in the
  latter case.

Server caller and credential exchange

• serverConvex is now the only public server call API. Removed
  serverConvexQuery, serverConvexMutation, serverConvexAction, and
  useConvexCall.
• Cookie and bearer credential exchange is bounded, never follows a redirect
  with the credential attached, and never logs secrets.
• Removed the built-in permissions module option (both the true and
  false states) and the createPermissions permissions runtime. Permission
  rules are application/Convex policy, not library machinery. Replace package
  permission helpers with an application-owned UI capability composable backed
  by Convex queries, and continue enforcing authorization inside Convex handlers.

🧹 Cleanup

• Deleted research/ and experiments/ (concluded Phase 0 exploration,
  distilled into src/ARCHITECTURE.md and ADRs where durable; retained only in
  Git history).
• Removed the Phase 0 test/proofs/auth-races, test/proofs/isolation,
  test/proofs/onupdate-rebinding, and test/proofs/ssr-errors prototype
  fixtures; their guarantees are now covered by permanent unit, Nuxt, and e2e
  tests (test/unit/auth-generation-races.test.ts, test/unit/client-owner.test.ts,
  test/nuxt/auth-two-app-isolation.nuxt.test.ts,
  test/e2e/ssr-errors-consumer.e2e.test.ts, and related identity/anonymous-
  transport Nuxt tests).

📖 Documentation

• Rewrote guides and examples onto the final vNext API (explicit query args,
  optional-by-default auth modes, serverConvex, defineConvexAuthClient,
  the replacement-safe useConvex() handle, structured error classification,
  and application-owned UI capabilities).

v0.5.0

compare changes

🩹 Fixes

• Remove unnecessary override for parent workspace in pnpm configuration (7f6b2bb0)

💅 Refactors

• Simplify landing feature syntax in documentation (eef25d41)

❤️ Contributors

• Mat4m0 matthias.amon@me.com

v0.4.0

Highlights

• Published better-convex-nuxt@0.4.0.
• Adds and documents the supported shared query path with defineSharedConvexQuery.
• Cleans up stale query docs that referenced the old useLazyConvexQuery API.
• Keeps low-level query state internals private instead of exposing createConvexQueryState as public API.
• Exports ConvexUser from the module entrypoint so apps can use root module augmentation.
• Hardens starter apps, including MCP approval flow work and 0.4.0 package references.
• Updates the demo to the current callable mutation API (const mutate = useConvexMutation(...)).

Notes

• useConvexMutation is callable directly. The old .execute style is not part of the current public API.
• For middleware/plugins, continue using useConvexCall or server helpers instead of live query composables.

Validation

• Root package was already published to npm as 0.4.0.
• Demo typecheck and build pass against better-convex-nuxt@0.4.0.
• MCP starter lint and tests passed; typecheck and build passed. convex codegen requires a configured CONVEX_DEPLOYMENT and was not runnable in this local checkout.
• Starter generated-artifact guard passes.