@8wave/ai-elements 0.114.0-beta.30 → 0.114.0-beta.43

package/dist-vue/packages/auth/src/add-member-to-organization.d.ts

@@ -1,5 +1,11 @@
 /**
  * Adds a user as member of an organization if not already present.
- * Shared by external-auth and organization-auto-join flows.
+ * Shared by external-auth and organization-auto-join flows. Only auto-join
+ * passes `respectMemberLimit`: the widget's external login must never fail
+ * because the organization is full. An automatic join does not take a seat
+ * an open invitation holds either, and a skipped one is not retried at the
+ * next sign-in: the person joins through an invitation once a seat is free.
  */
-export declare function addMemberToOrganizationIfNotExists(userId: string, organizationId: string, role?: string): Promise<boolean>;
+export declare function addMemberToOrganizationIfNotExists(userId: string, organizationId: string, role?: string, { respectMemberLimit }?: {
+    respectMemberLimit?: boolean;
+}): Promise<boolean>;

package/dist-vue/packages/auth/src/organization-member-limit.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Whether an organization already holds as many members as the limit the
+ * system panel set on it. An organization with no limit is never full.
+ * With `countPendingInvitations` an open invitation holds a seat until it is
+ * accepted or expires, so a new one cannot be sent for a seat another
+ * invitation already promised. The count runs outside the write that
+ * follows, like better-auth's own check: two joins racing for the last seat
+ * can both pass.
+ */
+export declare function isOrganizationFull(organizationId: string, { countPendingInvitations, }?: {
+    countPendingInvitations?: boolean;
+}): Promise<boolean>;

package/dist-vue/packages/auth/src/two-factor-admin-plugin.d.ts

@@ -0,0 +1,2 @@
+import { BetterAuthPlugin } from 'better-auth';
+export declare function twoFactorAdmin(): BetterAuthPlugin;

package/dist-vue/packages/auth/src/two-factor-policy-client-plugin.d.ts

@@ -1,4 +1,44 @@
+import { SignInSecurityState } from '../../models/src';
 import { BetterFetch } from 'better-auth/client';
+/**
+ * What `GET /two-factor-policy/user-security` answers to a system
+ * administrator, see docs/specs/two-factor-system-assistance.md (D3). Dates
+ * arrive as ISO strings.
+ */
+export interface UserSignInSecurity {
+    state: SignInSecurityState;
+    factor: {
+        enabled: boolean;
+        method: 'totp' | 'otp' | null;
+        backupCodesRemaining: number | null;
+        /** Wrong codes in a row since the last right one. */
+        failedAttempts: number;
+        /** Set only while the pause after too many wrong codes lasts. */
+        lockedUntil: string | null;
+    };
+    passkeys: {
+        id: string;
+        name: string | null;
+        /** `multiDevice` when synced across the user's devices. */
+        deviceType: string;
+        backedUp: boolean;
+        createdAt: string | null;
+    }[];
+    trustedDevices: {
+        count: number;
+        lastExpiresAt: string | null;
+    };
+    hasPassword: boolean;
+    requiredBy: {
+        id: string;
+        name: string;
+    }[];
+    /** The latest changes, from the notices the user received. */
+    changes: {
+        action: string;
+        createdAt: string;
+    }[];
+}
 /** What `GET /two-factor-policy/status` answers. */
 export interface TwoFactorStatus {
     enabled: boolean;
@@ -19,8 +59,9 @@ export interface TwoFactorStatus {
     passkeys: number;
 }
 /**
- * Client counterpart of the server `twoFactorPolicy()` plugin, see
- * docs/specs/two-factor-authentication.md.
+ * Client counterpart of the server `twoFactorPolicy()` and `twoFactorAdmin()`
+ * plugins, see docs/specs/two-factor-authentication.md and
+ * docs/specs/two-factor-system-assistance.md.
  */
 export declare function twoFactorPolicyClient(): {
     id: "two-factor-policy";
@@ -52,9 +93,71 @@ export declare function twoFactorPolicyClient(): {
                 };
                 error: null;
             }>;
+            userSecurity: (query: {
+                userId: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: UserSignInSecurity;
+                error: null;
+            }>;
+            unlock: (data: {
+                userId: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: {
+                    status: boolean;
+                };
+                error: null;
+            }>;
+            removePasskey: (data: {
+                userId: string;
+                passkeyId: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: {
+                    status: boolean;
+                };
+                error: null;
+            }>;
+            forgetTrustedDevices: (data: {
+                userId: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: {
+                    status: boolean;
+                };
+                error: null;
+            }>;
         };
     };
     pathMethods: {
         '/two-factor-policy/reset': "POST";
+        '/two-factor-policy/unlock': "POST";
+        '/two-factor-policy/remove-passkey': "POST";
+        '/two-factor-policy/forget-trusted-devices': "POST";
     };
 };

package/dist-vue/packages/auth/src/two-factor-policy-plugin.d.ts

@@ -1,5 +1,6 @@
 import { BetterAuthPlugin } from 'better-auth';
 import { createAuthMiddleware } from 'better-auth/api';
+import { symmetricDecrypt } from 'better-auth/crypto';
 import { TwoFactorChange } from 'email';
 /**
  * Carries the challenge for a client that cannot hold the cookie: the widget,
@@ -9,6 +10,14 @@ import { TwoFactorChange } from 'email';
 export declare const TWO_FACTOR_TOKEN_HEADER = "x-two-factor-token";
 /** Time the code sent by email stays valid, in minutes. */
 export declare const TWO_FACTOR_OTP_PERIOD_MINUTES = 5;
+export type TwoFactorRow = {
+    id: string;
+    userId: string;
+    backupCodes: string;
+    verified?: boolean | null;
+    failedVerificationCount?: number | null;
+    lockedUntil?: Date | string | null;
+};
 type ChangedUser = {
     id: string;
     email: string;
@@ -21,6 +30,37 @@ export type MiddlewareContext = Parameters<Parameters<typeof createAuthMiddlewar
  * written.
  */
 export declare function announceTwoFactorChange(user: ChangedUser, change: TwoFactorChange): Promise<void>;
+/**
+ * The verification rows that remember a device on which the user chose to
+ * skip the code: the `twoFactor` plugin names them `trust-device-<id>` and
+ * stores the user id as their value.
+ */
+export declare function trustedDeviceWhere(userId: string): ({
+    field: string;
+    value: string;
+    operator?: undefined;
+} | {
+    field: string;
+    operator: "starts_with";
+    value: string;
+})[];
+/**
+ * Forgets every device on which the user chose to skip the code. They are
+ * verification rows holding the user id: left in place, one would skip the
+ * code once the factor is on again, on a device that may be the lost one.
+ * The plugin itself forgets only the device the factor is turned off from.
+ */
+export declare function forgetTrustedDevices(adapter: MiddlewareContext['context']['adapter'], userId: string): Promise<number>;
+/**
+ * How many recovery codes the user has left, or null when it cannot be told.
+ * better-auth keeps them encrypted with its secret, so only the count leaves
+ * this function, never a code.
+ */
+export declare function countBackupCodes(ctx: {
+    context: {
+        secretConfig: Parameters<typeof symmetricDecrypt>[0]['key'];
+    };
+}, row: Pick<TwoFactorRow, 'backupCodes'>): Promise<number | null>;
 type PolicyOrganization = {
     requireTwoFactor?: boolean | null;
     deleted?: boolean | null;
@@ -54,8 +94,9 @@ export declare function isTwoFactorSetupRequiredForSession(input: {
     organizations: readonly PolicyOrganization[] | (() => Promise<readonly PolicyOrganization[]>);
 }): Promise<boolean>;
 /**
- * The status endpoint, the administrator reset, the widget bridge and the
- * announcements of docs/specs/two-factor-authentication.md.
+ * The status endpoint, the widget bridge and the announcements of
+ * docs/specs/two-factor-authentication.md. The administrator's endpoints are
+ * in two-factor-admin-plugin.ts.
  *
  * The endpoints live under `/two-factor-policy/` and not `/two-factor/` on
  * purpose: the `twoFactor` plugin rate limits its prefix to three requests

package/dist-vue/packages/models/src/schema/Lead.d.ts

@@ -9,7 +9,7 @@ export declare const LeadSchema: z.ZodObject<{
     phone: z.ZodNullable<z.ZodString>;
     agentId: z.ZodString;
     organizationId: z.ZodString;
-    chatId: z.ZodString;
+    chatId: z.ZodNullable<z.ZodString>;
     metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     createdAt: z.ZodCoercedDate<unknown>;
     createdBy: z.ZodString;

package/dist-vue/packages/models/src/schema/Member.d.ts

@@ -122,6 +122,13 @@ export declare const MemberSchema: z.ZodObject<{
         twoFactorEnabled: z.ZodOptional<z.ZodBoolean>;
         hasPassword: z.ZodOptional<z.ZodBoolean>;
         hasPasskey: z.ZodOptional<z.ZodBoolean>;
+        signInSecurity: z.ZodOptional<z.ZodEnum<{
+            required: "required";
+            none: "none";
+            totp: "totp";
+            otp: "otp";
+            passkey: "passkey";
+        }>>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type Member = z.infer<typeof MemberSchema>;

package/dist-vue/packages/models/src/schema/Notification.d.ts

@@ -17,6 +17,31 @@ export declare const NotificationType: {
     readonly Generic: "generic";
 };
 export type NotificationType = (typeof NotificationType)[keyof typeof NotificationType];
+/**
+ * Group key of the admins' notification about a flagged conversation: one row
+ * per chat and admin, bumped by every later analysis of that chat.
+ */
+export declare const chatAnalysisNotificationGroupKey: (chatId: string) => string;
+/**
+ * Title of the admins' notification about a flagged conversation. It tells a
+ * block from a warning on a stored row better than `type` does: a group bump
+ * rewrites the title, the body and the metadata, never the type, so a chat
+ * warned first and blocked later keeps `type = chat_warning`.
+ */
+export declare const chatAnalysisNotificationTitle: (blocked: boolean) => string;
+/**
+ * Body of the admins' notification about a flagged conversation
+ * (`chat_warning` or `chat_blocked`). The writer quotes the chat's title; the
+ * GDPR erasure (`eraseConversationRows`) rebuilds the body without it, from the
+ * same sentences, so the notification and its link to the chat survive with
+ * nothing the user wrote. Migration `erase_chat_residuals` holds a SQL copy
+ * of these sentences for the rows erased before it.
+ */
+export declare function chatAnalysisNotificationBody({ blocked, riskScore, chatTitle, }: {
+    blocked: boolean;
+    riskScore?: number;
+    chatTitle?: string;
+}): string;
 export declare const NotificationSchema: z.ZodObject<{
     id: z.ZodString;
     organizationId: z.ZodNullable<z.ZodString>;

package/dist-vue/packages/models/src/schema/Organization.d.ts

@@ -222,6 +222,16 @@ export declare const OrganizationRetentionPolicySchema: z.ZodObject<{
     anonymousRetentionDays: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
 }, z.core.$strip>;
 export type OrganizationRetentionPolicy = z.infer<typeof OrganizationRetentionPolicySchema>;
+/**
+ * Per-organization limits an operator sets from the system panel, persisted
+ * inside the `organization.metadata` text column. `members` counts every
+ * member, the ones the widget's external login brings in included; absent or
+ * `null` means no limit.
+ */
+export declare const OrganizationLimitsSchema: z.ZodObject<{
+    members: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>;
+export type OrganizationLimits = z.infer<typeof OrganizationLimitsSchema>;
 /**
  * Product features an operator can switch on or off per organization from the
  * system panel. A feature is listed here when a contract can plausibly exclude
@@ -358,6 +368,9 @@ export declare const OrganizationMetadataSchema: z.ZodObject<{
         utilityModel: z.ZodOptional<z.ZodString>;
         disabledGatewayModels: z.ZodCatch<z.ZodOptional<z.ZodArray<z.ZodString>>>;
     }, z.core.$strip>>>;
+    limits: z.ZodCatch<z.ZodOptional<z.ZodObject<{
+        members: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strip>>>;
 }, z.core.$loose>;
 export type OrganizationMetadata = z.infer<typeof OrganizationMetadataSchema>;
 /**
@@ -382,6 +395,12 @@ export declare function parseOrganizationMetadata(metadata: string | Record<stri
  * malformed metadata resolves to the platform defaults instead of failing.
  */
 export declare function resolveOrganizationFeatures(metadata: string | Record<string, unknown> | null | undefined): OrganizationFeatures;
+/**
+ * The most members an organization may hold, from its raw `metadata` value,
+ * or `null` when it sets no limit. A malformed value reads as no limit, so a
+ * bad write can never lock an organization out of adding people.
+ */
+export declare function resolveOrganizationMemberLimit(metadata: string | Record<string, unknown> | null | undefined): number | null;
 export declare const OrganizationPublicSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodString;

package/dist-vue/packages/models/src/schema/SignInSecurity.d.ts

@@ -0,0 +1,168 @@
+import { StoragePolicy } from './Media';
+import * as z from 'zod';
+/**
+ * Where a user stands on two-step verification and passkeys, as the system
+ * panel shows it (docs/specs/two-factor-system-assistance.md, D2). One state
+ * per user, decided in this order: the authenticator app, the email code, a
+ * passkey alone, then `required` for a member of an organization that asks
+ * for a second factor who signs in with a password and has none.
+ */
+export declare const SignInSecurityStateSchema: z.ZodEnum<{
+    required: "required";
+    none: "none";
+    totp: "totp";
+    otp: "otp";
+    passkey: "passkey";
+}>;
+export type SignInSecurityState = z.infer<typeof SignInSecurityStateSchema>;
+/** A row of the system users list. */
+export declare const SignInSecurityUserSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    email: z.ZodString;
+    emailVerified: z.ZodBoolean;
+    image: z.ZodNullable<z.ZodString>;
+    media: z.ZodNullable<z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        src: z.ZodObject<{
+            type: z.ZodString;
+            name: z.ZodString;
+            mimeType: z.ZodString;
+            bytesCount: z.ZodNumber;
+            extension: z.ZodString;
+            metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+            tags: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+            storageHandle: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"azure-blob">;
+                blobUri: z.ZodURL;
+                containerName: z.ZodString;
+                pathRelativeToContainer: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                type: z.ZodLiteral<"s3">;
+                bucket: z.ZodString;
+                key: z.ZodString;
+                region: z.ZodString;
+            }, z.core.$strip>], "type">;
+            storagePolicy: z.ZodEnum<typeof StoragePolicy>;
+            signData: z.ZodOptional<z.ZodString>;
+            storedFileName: z.ZodString;
+        }, z.core.$strip>;
+        srcSet: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            type: z.ZodString;
+            name: z.ZodString;
+            mimeType: z.ZodString;
+            bytesCount: z.ZodNumber;
+            extension: z.ZodString;
+            metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+            tags: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+            storageHandle: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"azure-blob">;
+                blobUri: z.ZodURL;
+                containerName: z.ZodString;
+                pathRelativeToContainer: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                type: z.ZodLiteral<"s3">;
+                bucket: z.ZodString;
+                key: z.ZodString;
+                region: z.ZodString;
+            }, z.core.$strip>], "type">;
+            storagePolicy: z.ZodEnum<typeof StoragePolicy>;
+            signData: z.ZodOptional<z.ZodString>;
+            storedFileName: z.ZodString;
+        }, z.core.$strip>>>;
+        rawOptions: z.ZodOptional<z.ZodCustom<{
+            type: import('./Media').MediaType.picture;
+            width: number;
+            height: number;
+            blurhash?: string | undefined;
+        } | {
+            type: import('./Media').MediaType.video;
+            width: number;
+            height: number;
+            duration: number;
+        } | {
+            type: import('./Media').MediaType.audio;
+            duration: number;
+        } | {
+            type: import('./Media').MediaType.office;
+        } | {
+            type: import('./Media').MediaType.archive;
+        } | {
+            type: import('./Media').MediaType.binary;
+        } | {
+            type: import('./Media').MediaType.executable;
+        }, {
+            type: import('./Media').MediaType.picture;
+            width: number;
+            height: number;
+            blurhash?: string | undefined;
+        } | {
+            type: import('./Media').MediaType.video;
+            width: number;
+            height: number;
+            duration: number;
+        } | {
+            type: import('./Media').MediaType.audio;
+            duration: number;
+        } | {
+            type: import('./Media').MediaType.office;
+        } | {
+            type: import('./Media').MediaType.archive;
+        } | {
+            type: import('./Media').MediaType.binary;
+        } | {
+            type: import('./Media').MediaType.executable;
+        }>>;
+    }, z.core.$strip>>>;
+    createdAt: z.ZodCoercedDate<unknown>;
+    updatedAt: z.ZodCoercedDate<unknown>;
+    banned: z.ZodNullable<z.ZodBoolean>;
+    banReason: z.ZodNullable<z.ZodString>;
+    banExpires: z.ZodNullable<z.ZodCoercedDate<unknown>>;
+    isAnonymous: z.ZodNullable<z.ZodBoolean>;
+    role: z.ZodEnum<{
+        user: "user";
+        admin: "admin";
+    }>;
+    twoFactorEnabled: z.ZodOptional<z.ZodBoolean>;
+    signInSecurity: z.ZodEnum<{
+        required: "required";
+        none: "none";
+        totp: "totp";
+        otp: "otp";
+        passkey: "passkey";
+    }>;
+}, z.core.$strip>;
+export type SignInSecurityUser = z.infer<typeof SignInSecurityUserSchema>;
+export declare const SignInSecurityUsersQuerystringSchema: z.ZodObject<{
+    signInSecurity: z.ZodOptional<z.ZodEnum<{
+        required: "required";
+        none: "none";
+        totp: "totp";
+        otp: "otp";
+        passkey: "passkey";
+    }>>;
+    "filter[fullText]": z.ZodOptional<z.ZodString>;
+    sort: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+        name: "name";
+        createdAt: "createdAt";
+        updatedAt: "updatedAt";
+        "-name": "-name";
+        "-createdAt": "-createdAt";
+        "-updatedAt": "-updatedAt";
+        email: "email";
+        "-email": "-email";
+    }>>>;
+    'page[number]': z.ZodDefault<z.ZodPipe<z.ZodUnion<[z.ZodNumber, z.ZodString]>, z.ZodTransform<number, string | number>>>;
+    'page[size]': z.ZodDefault<z.ZodPipe<z.ZodUnion<[z.ZodNumber, z.ZodString]>, z.ZodTransform<number, string | number>>>;
+}, z.core.$strip>;
+export type SignInSecurityUsersQuerystring = z.infer<typeof SignInSecurityUsersQuerystringSchema>;
+/** How many users are in each state. */
+export declare const SignInSecuritySummarySchema: z.ZodRecord<z.ZodEnum<{
+    required: "required";
+    none: "none";
+    totp: "totp";
+    otp: "otp";
+    passkey: "passkey";
+}>, z.ZodNumber>;
+export type SignInSecuritySummary = z.infer<typeof SignInSecuritySummarySchema>;

package/dist-vue/packages/models/src/schema/index.d.ts

@@ -33,6 +33,7 @@ export * from './Integration';
 export * from './Platform';
 export * from './ReasoningChat';
 export * from './RevisedAnswer';
+export * from './SignInSecurity';
 export * from './StreamError';
 export * from './SubAgent';
 export * from './TimingLog';

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@8wave/ai-elements",
     "private": false,
-    "version": "0.114.0-beta.30",
+    "version": "0.114.0-beta.43",
     "type": "module",
     "scripts": {
         "dev": "vite --port 8082 --open --host",