@8wave/ai-elements 0.114.0-beta.7 → 0.114.0-beta.8

package/dist-vue/index.js

@@ -679,7 +679,7 @@ var ca = oa, la = { class: "flex items-center gap-4 mb-4" }, ua = { class: "font
 	}
 });
 //#endregion
-//#region virtual:intlify-i18n-3
+//#region virtual:intlify-i18n-2
 function ga(e) {
 	let t = e;
 	t.__i18n = t.__i18n || [], t.__i18n.push({
@@ -16306,7 +16306,7 @@ var uC = /*#__PURE__*/ sC(cC, [["render", lC]]), dC = {
 	}
 });
 //#endregion
-//#region virtual:intlify-i18n-2
+//#region virtual:intlify-i18n-3
 function bC(e) {
 	let t = e;
 	t.__i18n = t.__i18n || [], t.__i18n.push({

package/dist-vue/packages/auth/src/social-redirect-plugin.d.ts

@@ -1,22 +1,28 @@
 import { BetterAuthPlugin } from 'better-auth';
 /**
- * Backs the widget social-login OAuth popup flow end to end.
+ * Whether `value` is exactly one of the trusted origins: a bare origin, listed
+ * as it is. better-auth matches its trusted origins as patterns, so an agent
+ * whose trusted origins hold `*` would let any page through; the CORS plugin
+ * (apps/backend/src/plugins/fastifyCors.ts) compares them exactly, and a widget
+ * whose host it refuses cannot run anyway.
+ */
+export declare function isListedOrigin(value: string, trusted: string[]): boolean;
+/**
+ * Backs the social sign-in that runs in a browser window on the backend origin.
  *
  * `socialRedirect` initiates the flow through a top-level GET navigation instead
  * of the default `POST /sign-in/social` XHR call. Better-auth's social sign-in
  * sets a signed `state` cookie that the OAuth callback verifies (CSRF
- * protection). When the flow is started from an XHR on a different origin (e.g.
- * the embeddable widget, or any cross-site context), that `Set-Cookie` is a
- * third-party cookie and modern browsers drop it, so the callback fails with
- * `state_mismatch`. By navigating the browser (popup or full page) directly to
+ * protection). When the flow is started from an XHR on a different origin, that
+ * `Set-Cookie` is a third-party cookie and modern browsers drop it, so the
+ * callback fails with `state_mismatch`. By navigating the browser directly to
  * this endpoint on the backend origin, the `state` cookie is set first-party and
- * survives, both in development and in production on customer domains. It mirrors
- * the redirect branch of core `signInSocial`, reusing `generateState` so the
- * stored state stays compatible with the standard OAuth callback.
+ * survives. It mirrors the redirect branch of core `signInSocial`, reusing
+ * `generateState` so the stored state stays compatible with the standard OAuth
+ * callback. The frontend uses it; the widget's popup uses `oauthPopup`, whose
+ * callback hands back the token of the session it just created, and only to the
+ * origin that started it.
  *
- * `widgetOAuthCallback` is the landing page the popup ends on after the OAuth
- * callback completes (it's the `callbackURL` passed to `socialRedirect`). It runs
- * on the backend origin so it can read the first-party session cookie and post the
- * Bearer token back to the widget opener.
+ * The before hook narrows the origin `oauthPopup` accepts to the listed ones.
  */
 export declare function socialRedirect(): BetterAuthPlugin;

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@8wave/ai-elements",
     "private": false,
-    "version": "0.114.0-beta.7",
+    "version": "0.114.0-beta.8",
     "type": "module",
     "scripts": {
         "dev": "vite --port 8082 --open --host",