Changelog

Improved

• Refreshed the public site with Inter + DM Sans, olive theme tokens, a quieter Linear-style layout, dashboard wireframe hero, testimonials, and a three-bar Acme mark.
• Page titles: Document titles now use `{page} – {appName}` (en dash), and every SaaS page sets a title so browser tabs never fall back to the product name alone.
• UI polish: Rounded alerts and form controls, wider mail templates, smoother FAQ accordion, blog covers with tag filters, and olive touch accents across the SaaS app.

Fixed

• Nuxt apps share one Vue version and guard Nitro tracing so Vercel builds stay stable when dependency links go stale.

Fixed

• Invitation Accept uses the primary button, revoke/rename/password flows refresh the right caches, and admin access no longer depends on Permix setup timing.

New

• Introduced typed `@repo/permissions` with Permix for admin, organization, and payment gates across oRPC and the SaaS UI.
• Admin user bans: Added admin controls to ban users with an internal reason, optional expiration, active ban details, and unban actions.
• Agent skills: Added curated agent skills for common workflows like features, auth, payments, database changes, tests, and more.

Fixed

• Login, signup, OTP, verify, and onboarding redirects now stay on safe SaaS paths, and protected SaaS pages are marked noindex.

Fixed

• Restored strict SEO rendering, kept favicon metadata typed, and aligned SaaS H3 types.

Fixed

• Organization billing, payment redirects, and AI message handling now have stricter authorization and validation.

Improved

• API contracts: oRPC procedures now define explicit output schemas next to their handlers.

Improved

• Refreshed the Nuxt SaaS shell with Plus Jakarta Sans, zinc and slate theme tokens, cleaner navigation, organization and user menus, auth screens, settings rows, and rounded organization logos.
• Favicons: SaaS, marketing, and docs now share the same rocket favicon.
• Two-factor auth: Database schemas now track failed two-factor verification attempts and lockout timing.

Fixed

• Avatar cropping: The avatar crop dialog now keeps Cropper.js contained inside the modal with a visible default crop selection.

Improved

• Resend is now the default mail provider, and the Plunk provider plus PLUNK_API_KEY example have been removed.

Removed

• Removed the Dependabot configuration. Dependency updates are now handled manually or through AI-agent automation while pnpm's one-day minimum release age remains in place.

Fixed

• i18n config: Adjusted the SaaS app locale mapping for @nuxtjs/i18n 10.4.0 type compatibility.

Fixed

• Removed the role permissions info box from the members settings page. Role descriptions now appear only in the select dropdown, capped to one line, so the trigger shows the role label alone and stays compact.
• Vercel builds: Added .npmrc with shamefully-hoist and a public hoist pattern so pnpm resolves dependencies correctly when deploying to Vercel.

Fixed

• When requireOrganization is enabled, organization resolution now runs once in the app layout instead of the authenticated index page setup, avoiding a race where the login form could stay mounted while the URL already pointed at the organization route. Login and signup also redirect already-authenticated visitors immediately.
• Organization invitations: Not-yet-onboarded users who accept an invitation are sent directly to onboarding with the invited organization as redirectTo, instead of briefly flashing the login form while the app layout bounced through /login on the way to /onboarding.

Improved

• Vite dev server: Pre-bundles @vue/devtools-core and @vue/devtools-kit in optimizeDeps so the SaaS app dev server starts reliably when Vue DevTools dependencies are present.

Fixed

• Login, signup, and account security connected-account provider UI now consistently respect authConfig.enableSocialLogin. When social login is disabled, provider sign-in buttons and provider linking controls are hidden.
• Favicon: Added a default favicon asset and registered it in the Nuxt app head for the marketing and SaaS apps so new projects include a browser tab icon by default.
• Marketing favicon: The marketing app now references /favicon.svg with the correct image/svg+xml MIME type instead of a non-existent /icon.png path.

Fixed

• Social sign-in for accounts with two-factor authentication enabled now routes its OAuth callback through the verify page (matching the magic-link flow) instead of the final post-login destination. Better Auth completes the OAuth callback without an active session when 2FA is required, so the previous direct redirect bounced users back to login and the OTP form never appeared.
• Organization invitations: Accepting or declining an organization invitation no longer throws a Nuxt composable context error after async organization resolution. Post-accept and post-decline redirects are wrapped in nuxtApp.runWithContext so navigateTo keeps the Nuxt instance context across await boundaries.

Security

• Replaced Better Auth trustedOrigins wildcard with an explicit allowlist from the app URLs so magic-link and callback redirects cannot send users to external origins. Removed the username plugin and user columns that exposed an unauthenticated username availability probe.

Improved

• Trusted origins: Added buildTrustedOrigins and getTrustedOrigins in @repo/utils so Better Auth and the API CORS allowlist share one source of truth instead of a wildcard or a single hard-coded URL.

Fixed

• Post-login navigation: Login, signup, email verification, two-factor, and social sign-in now route through a single org-aware helper so users without an organization land on organization resolution instead of extra redirects. Stale active organizations with no accessible memberships go to organization creation, and the authenticated index redirects with replace without a 404.
• Organization settings: Only organization owners see the delete organization section and confirmation modal in general settings. Admins keep access to the rest of organization settings.
• Translations: Added the missing English organizations.settings.logo.delete string for the organization logo removal control.

Fixed

• Member role updates, removals, and invitation revokes on the settings members page reuse a single toast for loading and success or error states instead of briefly showing a second empty toast.
• Organization settings: Organization members can no longer open organization settings routes directly. Admins and owners keep access through navigation and the existing route guard.

Improved

• Dependabot: Dependabot no longer caps open pull requests or applies a cooldown on npm upgrades. pnpm still enforces a one-day minimum release age at install time.

Fixed

• One-time Stripe Checkout sessions for users or organizations that already have a Stripe customer no longer send customer_creation together with customer, avoiding the parameter conflict error from Stripe.

Improved

• The validate-PRs workflow matches the Next.js and TanStack starters with separate lint (including format check), type-check, unit, and e2e jobs. End-to-end runs cover SaaS and marketing apps, Vitest runs API procedure tests, and CI sets secrets and database fallbacks so auth and client generation succeed on forks and pull requests.
• Database: Drizzle schemas for PostgreSQL, MySQL, and SQLite align with the Prisma schema for indexes, uniques, nullability, and field parity, with timestamp columns using database defaults again. Drizzle member-count queries no longer emit invalid SQL when subscription seats update after an accepted invitation. The package still exports Prisma by default and Better Auth keeps the Prisma adapter.

Fixed

• Organization invitations: Accepting an invitation redirects into the organization instead of reloading the invite page, with session and organization caches refreshed afterward and graceful handling when an invite was already accepted. Logged-in users see invalid, expired, or used invitations immediately on load via Better Auth getInvitation.
• Organization members: Removing a member requires confirmation in a modal, and member or role updates refresh the query cache so the list does not flash empty or force a full reload. The role dropdown no longer disables editing for admins on non-owner members, owners stay read-only, non-admins see a static label, and the invite form stays limited to admins. Role selects follow member, admin, then owner order with a permissions summary and per-role descriptions.
• Login and signup: Adjusted spacing around the organization invitation alert on login and signup forms.
• Two-factor authentication: Password and magic-link sign-ins route users with two-factor enabled through a dedicated OTP step. The OTP form uses Nuxt UI PinInput with one-time-code autofill, auto-submits complete six-digit codes, and adds missing 2FA setup error translations.

Fixed

• Visiting the SaaS app unauthenticated no longer crashes during Nuxt 4 SSR on redirects to login. Auth and admin forms use an SSR-safe route query helper with batched URL write-back instead of useRouteQuery from @vueuse/router, and that dependency was removed.
• Organization invitations: Invitation emails and auth redirects now use a consistent invitationId query param with a dedicated /organization-invitation page after sign-in or sign-up, explicit accept or decline actions, organization previews including logos, clearer separation between invalid invites and post-accept setup failures, stable row ids for revoke and remove actions, and welcome notifications limited to in-app delivery.

Improved

• sendEmail now requires a locale and renders subjects and bodies from mail.json, with auth and notification call sites passing the recipient language from request cookies.
• Mail templates: Dropped unused HTML templates and kept individual HTML files for each active email type so layouts stay easy to override.

Fixed

• Vercel mail delivery: Mail translations are bundled into the server output so transactional email no longer fails when translation JSON modules are missing in serverless bundles.
• Nuxt UI icons: Added @nuxt/icon as an explicit dependency for marketing and SaaS so Nuxt UI resolves icons reliably under pnpm.
• End-to-end tests: Playwright now waits on /login, CI generates the database client before e2e, and login SSR issues that blocked the web server health check were resolved.