convex-auth v2.0.4

What’s changed

• Remove module-scope JWT private-key/JWKS caching so rotated keys take effect immediately and warm processes cannot sign with stale material.
• Add the missing convex/auth.config.ts native Convex auth provider wiring in the OAuth demo.
• Share the pending 2FA challenge token through ConvexAuthProvider context so the sign-in page and reusable verification form stay in sync.
• Improve toError in convex-auth-client.ts to preserve string/object messages.
• Increase JWT iat future-clock skew leeway.
• Update mintOAuthState for the new getJwtPrivateKey return shape and include the key id in the header.
• Clean up demo lint warnings and harden forgot/reset/verify-email response handling.

Verification

• pnpm run check, typecheck, build, test (1275 tests), lint, lint:convex, scan:secrets all pass locally.
• convex-auth check and convex-auth preflight pass for examples/oauth.
• Browser (Safari MCP): 2FA TOTP sign-in, backup codes, sessions, API keys, service principals + verify-as-session, webhooks, audit, and preflight UI all verified.