@8wave/ai-elements 0.114.0-beta.25 → 0.114.0-beta.28

package/dist-vue/locales.js

@@ -471,6 +471,18 @@ var e = {
 		untitled: "Untitled file",
 		exclude: "Remove file"
 	},
+	twoFactor: {
+		challengeBackup: "Enter one of the backup codes you saved.",
+		challengeEmailSent: "We sent a 6-digit code to your email. It expires in 5 minutes.",
+		challengeApp: "Enter the 6-digit code from your authenticator app.",
+		challengeTitle: "Two-step verification",
+		backupCode: "Backup code",
+		code: "6-digit code",
+		verify: "Verify",
+		useBackupCode: "Use a backup code",
+		useApp: "Use the authenticator app",
+		sendAgain: "Send a new code"
+	},
 	auth: {
 		signInTitle: "Sign in to your account",
 		signUpTitle: "Create your account",
@@ -1049,6 +1061,18 @@ var e = {
 		untitled: "File senza nome",
 		exclude: "Rimuovi file"
 	},
+	twoFactor: {
+		challengeBackup: "Scrivi uno dei codici di recupero che hai salvato.",
+		challengeEmailSent: "Ti abbiamo inviato un codice a 6 cifre via email. Scade fra 5 minuti.",
+		challengeApp: "Scrivi il codice a 6 cifre della tua app di autenticazione.",
+		challengeTitle: "Verifica in due passaggi",
+		backupCode: "Codice di recupero",
+		code: "Codice a 6 cifre",
+		verify: "Verifica",
+		useBackupCode: "Usa un codice di recupero",
+		useApp: "Usa l'app di autenticazione",
+		sendAgain: "Invia un nuovo codice"
+	},
 	auth: {
 		signInTitle: "Accedi al tuo account",
 		signUpTitle: "Crea il tuo account",

package/dist-vue/packages/auth/src/additional-fields.d.ts

@@ -0,0 +1,48 @@
+/** The columns the config adds to better-auth's session. */
+export declare const sessionAdditionalFields: {
+    activeOrganizationId: {
+        type: "string";
+    };
+    impersonatedBy: {
+        type: "string";
+    };
+    organizationRole: {
+        type: "string";
+    };
+    hardExpiresAt: {
+        type: "date";
+        required: false;
+        input: false;
+    };
+    signedInWithPasskey: {
+        type: "boolean";
+        required: false;
+        input: false;
+        defaultValue: false;
+    };
+};
+/** The columns the config adds to better-auth's user. */
+export declare const userAdditionalFields: {
+    media: {
+        type: "json";
+        required: false;
+    };
+    phoneNumber: {
+        type: "string";
+        required: false;
+    };
+};
+/**
+ * What `inferAdditionalFields` reads of the server options, for a client that
+ * must not load the config itself. The widget's type declarations are built
+ * from its imports, and the inferred type of the config, with the two-step
+ * verification and passkey plugins, is too long to serialize (TS7056).
+ */
+export type AdditionalFieldsOptions = {
+    session: {
+        additionalFields: typeof sessionAdditionalFields;
+    };
+    user: {
+        additionalFields: typeof userAdditionalFields;
+    };
+};

package/dist-vue/packages/auth/src/passkey-policy-client-plugin.d.ts

@@ -0,0 +1,31 @@
+import { BetterFetch } from 'better-auth/client';
+/**
+ * Client counterpart of the server `passkeyPolicy()` plugin, see
+ * docs/specs/two-factor-authentication.md, D10.
+ */
+export declare function passkeyPolicyClient(): {
+    id: "passkey-policy";
+    getActions: ($fetch: BetterFetch) => {
+        passkeyPolicy: {
+            /** Lets the session add a passkey for the next five minutes. */
+            confirmPassword: (data: {
+                password: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: {
+                    status: boolean;
+                };
+                error: null;
+            }>;
+        };
+    };
+    pathMethods: {
+        '/passkey-policy/confirm-password': "POST";
+    };
+};

package/dist-vue/packages/auth/src/passkey-policy-plugin.d.ts

@@ -0,0 +1,22 @@
+import { BetterAuthPlugin } from 'better-auth';
+/** Whether a session created on this route is opened with a passkey. */
+export declare function isPasskeySessionPath(path: string | undefined): boolean;
+/**
+ * Refuses a passkey that did not check who holds it (a PIN, a fingerprint, a
+ * face). With that check a passkey is two factors on its own, which is what
+ * lets it stand in for the password and the code; without it, it is a key
+ * anyone holding the device can use. better-auth leaves the check off.
+ */
+export declare function requirePasskeyUserVerification(userVerified: boolean | undefined): void;
+/**
+ * The confirmation that guards adding a passkey, the announcements of D7 for
+ * passkeys and the rate limit of the confirmation.
+ *
+ * A passkey signs in without the password and without the code, so adding
+ * one is as strong as setting the password: the session alone is not enough,
+ * since a stolen one would leave a way in that outlives it (there is no
+ * freshness window, see `freshAge` in packages/auth/src/index.ts). The
+ * password is asked again, or, for an account without one, a sign-in in the
+ * last ten minutes.
+ */
+export declare function passkeyPolicy(): BetterAuthPlugin;

package/dist-vue/packages/auth/src/two-factor-policy-client-plugin.d.ts

@@ -0,0 +1,60 @@
+import { BetterFetch } from 'better-auth/client';
+/** What `GET /two-factor-policy/status` answers. */
+export interface TwoFactorStatus {
+    enabled: boolean;
+    /** `totp` for an authenticator app, `otp` for the code sent by email. */
+    method: 'totp' | 'otp' | null;
+    /** The second factor protects a password: without one it is not offered. */
+    hasPassword: boolean;
+    /** An organization of the user requires it and it is not set up yet. */
+    required: boolean;
+    /** The user's organizations that require it. */
+    requiredBy: {
+        id: string;
+        name: string;
+    }[];
+    /** Backup codes left, with an authenticator app; null otherwise. */
+    backupCodesRemaining: number | null;
+    /** Passkeys of the user: a session opened with one meets the policy. */
+    passkeys: number;
+}
+/**
+ * Client counterpart of the server `twoFactorPolicy()` plugin, see
+ * docs/specs/two-factor-authentication.md.
+ */
+export declare function twoFactorPolicyClient(): {
+    id: "two-factor-policy";
+    getActions: ($fetch: BetterFetch) => {
+        twoFactorPolicy: {
+            status: () => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: TwoFactorStatus;
+                error: null;
+            }>;
+            reset: (data: {
+                userId: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: {
+                    status: boolean;
+                };
+                error: null;
+            }>;
+        };
+    };
+    pathMethods: {
+        '/two-factor-policy/reset': "POST";
+    };
+};

package/dist-vue/packages/auth/src/two-factor-policy-plugin.d.ts

@@ -0,0 +1,65 @@
+import { BetterAuthPlugin } from 'better-auth';
+import { createAuthMiddleware } from 'better-auth/api';
+import { TwoFactorChange } from 'email';
+/**
+ * Carries the challenge for a client that cannot hold the cookie: the widget,
+ * cross-origin and on bearer tokens (D4). The value is the signed cookie as
+ * the sign-in set it.
+ */
+export declare const TWO_FACTOR_TOKEN_HEADER = "x-two-factor-token";
+/** Time the code sent by email stays valid, in minutes. */
+export declare const TWO_FACTOR_OTP_PERIOD_MINUTES = 5;
+type ChangedUser = {
+    id: string;
+    email: string;
+    name: string;
+};
+export type MiddlewareContext = Parameters<Parameters<typeof createAuthMiddleware>[0]>[0];
+/**
+ * Tells the user that their second factor or their passkeys changed (D7, D10),
+ * by email and in the notification panel. Never throws: the change is already
+ * written.
+ */
+export declare function announceTwoFactorChange(user: ChangedUser, change: TwoFactorChange): Promise<void>;
+type PolicyOrganization = {
+    requireTwoFactor?: boolean | null;
+    deleted?: boolean | null;
+};
+/**
+ * Whether the request has to stop for the organization policy (D6): the
+ * session of a member of an organization that requires a second factor, who
+ * signs in with a password and has none. `organizations` is what the caller
+ * already listed for the request, so the common case costs no query, or a
+ * loader that runs only once the cheap exemptions are past; the password
+ * check is cached, since most users have no second factor. Impersonation and
+ * anonymous sessions are exempt, and so is a deleted organization, which the
+ * status endpoint does not list either: counted here alone, it would bounce
+ * the user between the setup page and the app.
+ *
+ * A session opened with a passkey meets the policy (D10), and so does a user
+ * with a passkey where no session tells how they signed in: a Platform MCP
+ * token, whose authorization ran in a session the policy let through.
+ */
+export declare function isTwoFactorSetupRequiredForSession(input: {
+    user: {
+        id: string;
+        twoFactorEnabled?: boolean | null;
+        isAnonymous?: boolean | null;
+        hasPasskey?: boolean;
+    };
+    session: {
+        impersonatedBy?: string | null;
+        signedInWithPasskey?: boolean | null;
+    };
+    organizations: readonly PolicyOrganization[] | (() => Promise<readonly PolicyOrganization[]>);
+}): Promise<boolean>;
+/**
+ * The status endpoint, the administrator reset, the widget bridge and the
+ * announcements of docs/specs/two-factor-authentication.md.
+ *
+ * The endpoints live under `/two-factor-policy/` and not `/two-factor/` on
+ * purpose: the `twoFactor` plugin rate limits its prefix to three requests
+ * every ten seconds, which a profile page reading the status would hit.
+ */
+export declare function twoFactorPolicy(): BetterAuthPlugin;
+export {};

package/dist-vue/packages/components/src/PkQrCode.d.ts

@@ -0,0 +1,14 @@
+import { DefineComponent, ComponentOptionsMixin, PublicProps, ComponentProvideOptions } from 'vue';
+/**
+ * A QR code drawn as inline SVG, with `qrcode` loaded on first use. The
+ * code stays dark on a white ground whatever the theme: a scanner reads
+ * the contrast, and not every one reads it inverted.
+ */
+type __VLS_Props = {
+    value: string;
+    /** What the code holds, for a screen reader. */
+    label: string;
+};
+declare const __VLS_export: DefineComponent<__VLS_Props, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {}, string, PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+declare const _default: typeof __VLS_export;
+export default _default;

package/dist-vue/packages/components/src/chat/PkChatbotAuth.d.ts

@@ -4,6 +4,12 @@ type __VLS_Props = {
     branding?: AgentBranding;
     authMethods?: AuthMethods;
     loading?: boolean;
+    /**
+     * Set while an email sign-in waits for its second factor: the
+     * methods the account has (`totp`, `otp`). The code step replaces
+     * the forms until it is answered or cancelled.
+     */
+    twoFactorMethods?: string[];
 };
 type __VLS_ModelProps = {
     'errorMessage'?: string | undefined;
@@ -43,6 +49,12 @@ declare const __VLS_export: DefineComponent<__VLS_PublicProps, {}, {}, {}, {}, C
         email: string;
     }) => any;
     social: (provider: "google" | "microsoft") => any;
+    "verify-two-factor": (payload: {
+        kind: "totp" | "otp" | "backup";
+        code: string;
+    }) => any;
+    "send-two-factor-code": () => any;
+    "cancel-two-factor": () => any;
 }, string, PublicProps, Readonly<__VLS_PublicProps> & Readonly<{
     "onUpdate:errorMessage"?: ((message?: string | undefined) => any) | undefined;
     "onUpdate:success"?: ((value?: {
@@ -63,10 +75,17 @@ declare const __VLS_export: DefineComponent<__VLS_PublicProps, {}, {}, {}, {}, C
         email: string;
     }) => any) | undefined;
     onSocial?: ((provider: "google" | "microsoft") => any) | undefined;
+    "onVerify-two-factor"?: ((payload: {
+        kind: "totp" | "otp" | "backup";
+        code: string;
+    }) => any) | undefined;
+    "onSend-two-factor-code"?: (() => any) | undefined;
+    "onCancel-two-factor"?: (() => any) | undefined;
 }>, {
     branding: AgentBranding;
     authMethods: AuthMethods;
     loading: boolean;
+    twoFactorMethods: string[];
 }, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
 declare const _default: typeof __VLS_export;
 export default _default;

package/dist-vue/packages/components/src/index.d.ts

@@ -22,6 +22,7 @@ import { default as PkLoader } from './PkLoader';
 import { default as PkMedia } from './PkMedia';
 import { default as PkOfflineScreen } from './PkOfflineScreen';
 import { default as PkPwaNotices } from './PkPwaNotices';
+import { default as PkQrCode } from './PkQrCode';
 import { default as PkRelativeTime } from './PkRelativeTime';
 import { default as PkSkeleton } from './PkSkeleton';
 import { default as PkSvgViewer } from './PkSvgViewer';
@@ -32,4 +33,4 @@ export * from './chat';
 export * from './input';
 export * from './table';
 export * from './types';
-export { PkBadge, PkEditorAgentType, PkEditorDocumentType, PkEditorNotificationType, PkEditorCode, PkEditorJsonSchema, PkEditorMarkdown, PkEditorMedia, PkEditorPrompt, PkEditorRadioButtons, PkEditorCheckboxButtons, PkEditorRepeater, PkEditorWyswyg, PkCheckboxField, PkFieldset, PkInfobox, PkSchemaField, PkIntegrationProvider, PkLazyImg, PkLightbox, PkLoader, PkMedia, PkOfflineScreen, PkPwaNotices, PkRelativeTime, PkSkeleton, PkSvgViewer, PkUrl, };
+export { PkBadge, PkEditorAgentType, PkEditorDocumentType, PkEditorNotificationType, PkEditorCode, PkEditorJsonSchema, PkEditorMarkdown, PkEditorMedia, PkEditorPrompt, PkEditorRadioButtons, PkEditorCheckboxButtons, PkEditorRepeater, PkEditorWyswyg, PkCheckboxField, PkFieldset, PkInfobox, PkSchemaField, PkIntegrationProvider, PkLazyImg, PkLightbox, PkLoader, PkMedia, PkOfflineScreen, PkPwaNotices, PkQrCode, PkRelativeTime, PkSkeleton, PkSvgViewer, PkUrl, };

package/dist-vue/packages/models/src/schema/Member.d.ts

@@ -119,6 +119,9 @@ export declare const MemberSchema: z.ZodObject<{
             user: "user";
             admin: "admin";
         }>;
+        twoFactorEnabled: z.ZodOptional<z.ZodBoolean>;
+        hasPassword: z.ZodOptional<z.ZodBoolean>;
+        hasPasskey: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type Member = z.infer<typeof MemberSchema>;

package/dist-vue/packages/models/src/schema/Notification.d.ts

@@ -4,6 +4,8 @@ export declare const NotificationType: {
     readonly ApiKeyExpiring: "api_key_expiring";
     readonly Organization: "organization";
     readonly PasswordResetRequested: "password_reset_requested";
+    /** Two-step verification turned on, off, or reset by an administrator. */
+    readonly TwoFactor: "two_factor";
     /** A sync took documents out because the remote no longer has them. */
     readonly DocumentSyncRemoved: "document_sync_removed";
     readonly ChatWarning: "chat_warning";

package/dist-vue/packages/models/src/schema/Organization.d.ts

@@ -106,6 +106,7 @@ export declare const OrganizationSchema: z.ZodObject<{
     deletedAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
     deletedBy: z.ZodNullable<z.ZodString>;
     metadata: z.ZodNullable<z.ZodString>;
+    requireTwoFactor: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type Organization = z.infer<typeof OrganizationSchema>;
 export declare const OrganizationDtoSchema: z.ZodObject<{

package/dist-vue/packages/models/src/schema/User.d.ts

@@ -118,6 +118,7 @@ export declare const UserSchema: z.ZodObject<{
         user: "user";
         admin: "admin";
     }>;
+    twoFactorEnabled: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type User = z.infer<typeof UserSchema>;
 /**