@8wave/ai-elements 0.114.0-beta.8 → 0.115.0-beta.13

package/dist-vue/locales.js

@@ -305,6 +305,7 @@ var e = {
 		toolApprovalBadge: "User confirm",
 		calendarEvent: "Event",
 		comparison: "Comparison",
+		recommended: "Recommended",
 		contactUs: "Contact us",
 		phone: "Phone number",
 		diagram: "Diagram",
@@ -366,6 +367,7 @@ var e = {
 		voiceId: "Cloned voices are not listed: the provider forbids them here.",
 		freshnessScaleExplanationMonths: "A document updated today gets a +{weight} bonus. This bonus halves to +{halfWeight} after {half} days and practically drops to zero (+{zeroWeight}) after {zero} days (approx. {months} months).",
 		freshnessScaleExplanationDays: "A document updated today gets a +{weight} bonus. This bonus halves to +{halfWeight} after {half} days and practically drops to zero (+{zeroWeight}) after {zero} days.",
+		reasoningVisibility: "A reasoning agent is always visible to the members of its organization only.",
 		agentOnOwnEndpoint: "This agent runs on your organization's endpoint.",
 		providerTimeoutMs: "Timeout in milliseconds before falling back to the next provider (min 1000, max 789000). BYOK credentials only.",
 		showExtendedSteps: "Shows reasoning and tool calls as an expandable timeline in the chat.",
@@ -470,6 +472,18 @@ var e = {
 		untitled: "Untitled file",
 		exclude: "Remove file"
 	},
+	twoFactor: {
+		challengeBackup: "Enter one of the backup codes you saved.",
+		challengeEmailSent: "We sent a 6-digit code to your email. It expires in 5 minutes.",
+		challengeApp: "Enter the 6-digit code from your authenticator app.",
+		challengeTitle: "Two-step verification",
+		backupCode: "Backup code",
+		code: "6-digit code",
+		verify: "Verify",
+		useBackupCode: "Use a backup code",
+		useApp: "Use the authenticator app",
+		sendAgain: "Send a new code"
+	},
 	auth: {
 		signInTitle: "Sign in to your account",
 		signUpTitle: "Create your account",
@@ -527,6 +541,7 @@ var e = {
 		showImageGallery: "Loading gallery...",
 		showVideo: "Loading video...",
 		showSuggestedReply: "Suggest a reply...",
+		disconnectOAuthConnection: "Disconnecting...",
 		webSearch: "Searching the web...",
 		tool: "Running a tool...",
 		reasoning: "Reasoning...",
@@ -567,6 +582,14 @@ var e = {
 		feelsLike: "Feels like",
 		dailyForecast: "Daily forecast",
 		airQuality: "Air quality"
+	},
+	turnEvaluation: {
+		cost: "Cost, not charged to the organization: {cost}",
+		title: "Evaluation after the reply",
+		modeHint: "Recorded after the reply, with no effect: nothing reads these probabilities yet.",
+		version: "Questions version {version}",
+		leadFailed: "The evaluation failed or did not answer within {budget} ms: nothing was recorded.",
+		probability: "Probability the evaluation model gives to the question: from 0.5 it leans towards yes"
 	}
 }, t = {
 	agentType: {
@@ -874,6 +897,7 @@ var e = {
 		toolApprovalBadge: "Conferma utente",
 		calendarEvent: "Evento",
 		comparison: "Confronto",
+		recommended: "Consigliato",
 		contactUs: "Contattaci",
 		phone: "Telefono",
 		diagram: "Diagramma",
@@ -935,6 +959,7 @@ var e = {
 		voiceId: "Le voci clonate non sono in elenco: il fornitore non le ammette qui.",
 		freshnessScaleExplanationMonths: "Un documento modificato oggi ottiene un bonus di +{weight}. Il bonus si dimezza a +{halfWeight} dopo {half} giorni e si azzera praticamente (+{zeroWeight}) dopo {zero} giorni (circa {months} mesi).",
 		freshnessScaleExplanationDays: "Un documento modificato oggi ottiene un bonus di +{weight}. Il bonus si dimezza a +{halfWeight} dopo {half} giorni e si azzera praticamente (+{zeroWeight}) dopo {zero} giorni.",
+		reasoningVisibility: "Un agente reasoning è sempre visibile solo ai membri dell'organizzazione.",
 		agentOnOwnEndpoint: "Questo agente gira sull’endpoint della tua organizzazione.",
 		providerTimeoutMs: "Timeout in millisecondi prima di passare al provider successivo (min 1000, max 789000). Solo credenziali BYOK.",
 		showExtendedSteps: "Visualizza la timeline con il ragionamento e gli strumenti nella chat.",
@@ -1039,6 +1064,18 @@ var e = {
 		untitled: "File senza nome",
 		exclude: "Rimuovi file"
 	},
+	twoFactor: {
+		challengeBackup: "Scrivi uno dei codici di recupero che hai salvato.",
+		challengeEmailSent: "Ti abbiamo inviato un codice a 6 cifre via email. Scade fra 5 minuti.",
+		challengeApp: "Scrivi il codice a 6 cifre della tua app di autenticazione.",
+		challengeTitle: "Verifica in due passaggi",
+		backupCode: "Codice di recupero",
+		code: "Codice a 6 cifre",
+		verify: "Verifica",
+		useBackupCode: "Usa un codice di recupero",
+		useApp: "Usa l'app di autenticazione",
+		sendAgain: "Invia un nuovo codice"
+	},
 	auth: {
 		signInTitle: "Accedi al tuo account",
 		signUpTitle: "Crea il tuo account",
@@ -1096,6 +1133,7 @@ var e = {
 		showImageGallery: "Caricamento galleria...",
 		showVideo: "Caricamento video...",
 		showSuggestedReply: "Suggerisco una risposta...",
+		disconnectOAuthConnection: "Disconnessione in corso...",
 		webSearch: "Ricerca sul web...",
 		tool: "Esecuzione di un tool...",
 		reasoning: "Ragionamento...",
@@ -1136,6 +1174,14 @@ var e = {
 		feelsLike: "Percepita",
 		dailyForecast: "Previsioni giornaliere",
 		airQuality: "Qualità dell'aria"
+	},
+	turnEvaluation: {
+		cost: "Costo, non addebitato all'organizzazione: {cost}",
+		title: "Valutazione a fine turno",
+		modeHint: "Registrata dopo la risposta, senza effetti: per ora nessuno legge queste probabilità.",
+		version: "Versione delle domande: {version}",
+		leadFailed: "La valutazione non è riuscita o non ha risposto entro {budget} ms: non è stato registrato niente.",
+		probability: "Probabilità che il modello di valutazione dà alla domanda: da 0,5 in su propende per il sì"
 	}
 };
 //#endregion

package/dist-vue/packages/ability/src/index.d.ts

@@ -1,6 +1,5 @@
-import { MongoAbility, InferSubjects, ForcedSubject, Ability as PureAbility } from '@casl/ability';
+import { MongoAbility, InferSubjects, ForcedSubject } from '@casl/ability';
 import { Action, Capability, Subject, Session } from './types';
-import { MongoQueryTopLevelOperators } from '@ucast/mongo2js';
 import { Statements, RoleInput, Role, ExactRoleStatements } from 'better-auth/plugins';
 export declare const OrganizationRoles: {
     readonly admin: "admin";
@@ -13,23 +12,20 @@ export declare const UserRoles: {
     readonly user: "user";
 };
 export type AbilitySubject = InferSubjects<'all' | Subject, true> | ForcedSubject<InferSubjects<'all' | Subject, true>>;
-type Ability = MongoAbility<[Action, AbilitySubject]>;
-export declare const ability: PureAbility<[Action, AbilitySubject], {
-    [x: string]: any;
-    [x: number]: any;
-    [x: symbol]: any;
-} & MongoQueryTopLevelOperators<Record<PropertyKey, any>>>;
+export type AppAbility = MongoAbility<[Action, AbilitySubject]>;
 export declare const isValidOrganizationRole: (role?: string | null) => role is keyof typeof OrganizationRoles;
 export declare const isValidUserRole: (role?: string | null) => role is keyof typeof UserRoles;
 export declare const getOrganizationRoleCapabilities: (currentSession?: Session | null) => Capability[];
 export declare const getUserRoleCapabilities: (currentSession?: Session | null) => Capability[];
 /**
- * Builds a standalone ability instance for a session, without touching the
- * shared singleton. Use for per-call checks outside the HTTP request flow
- * (e.g. MCP tool handlers).
+ * Builds the ability of one caller: the session's roles, or the guest rules
+ * when there is no session. Every call returns a new instance and this package
+ * keeps none: a server judges many callers at once, so an instance shared
+ * between them is judged by whoever wrote it last. The backend builds one per
+ * request (`request.ability`), the Platform MCP one per tool call, and the
+ * frontend keeps its own for the single user of the tab.
  */
-export declare const buildAbilityForSession: (currentSession?: Session | null) => Ability;
-export declare const updateAbilityFromSession: (currentSession?: Session | null) => void;
+export declare const buildAbilityForSession: (currentSession?: Session | null) => AppAbility;
 export type PermissionMap = Partial<Record<Action, Subject>>;
 /**
  * Evaluates a route-style permission map ({ action: Subject }) against an
@@ -39,7 +35,7 @@ export type PermissionMap = Partial<Record<Action, Subject>>;
  * Single source of truth for both the HTTP preHandler and the Platform MCP
  * tool handlers.
  */
-export declare const findDeniedPermission: (abilityInstance: Pick<Ability, "can">, permissions: PermissionMap, payload?: unknown) => {
+export declare const findDeniedPermission: (abilityInstance: Pick<AppAbility, "can">, permissions: PermissionMap, payload?: unknown) => {
     action: Action;
     subject: Subject;
 } | null;

package/dist-vue/packages/auth/src/active-membership.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The role `userId` holds in `organizationId` now, or `null` when they are
+ * not a member. A role is cached, an absence is not: a membership created
+ * after a refusal is seen on the next request, so the paths that add members
+ * have nothing to invalidate.
+ */
+export declare function currentMemberRole(userId: string, organizationId: string): Promise<string | null>;
+type OrganizationSession = {
+    userId: string;
+    activeOrganizationId?: string | null;
+    organizationRole?: string | null;
+};
+/**
+ * The session as a request may trust it: its active organization only while
+ * the user is still a member of it, and the role they hold there now.
+ *
+ * The two fields are written when the organization is activated and nothing
+ * rewrites them when the membership changes. Every service reads the tenant
+ * from the first and every permission from the second, so a member removed
+ * from an organization kept reading and writing it for the life of their
+ * session (90 days, renewed daily), and a demoted admin kept the admin rules.
+ * A session whose organization was unset kept the role it had there, which
+ * still opened the audience gates.
+ */
+export declare function withCurrentMembership<T extends OrganizationSession>(session: T): Promise<T>;
+/**
+ * Brings the stored sessions of `userId` in line with their membership of
+ * `organizationId`, after a write to it: a new role replaces the old one, a
+ * membership that is gone takes the active organization with it. Call it
+ * after every role change and every removal. The request check does not
+ * depend on it, it reads the membership itself, but the client does: it
+ * reads its organization and role from the session. The role is read from
+ * the database, not the cache, which a request may still be refilling.
+ */
+export declare function syncSessionsWithMembership(userId: string, organizationId: string): Promise<void>;
+export {};

package/dist-vue/packages/auth/src/add-member-to-organization.d.ts

@@ -1,5 +1,15 @@
 /**
  * Adds a user as member of an organization if not already present.
- * Shared by external-auth and organization-auto-join flows.
+ * Shared by external-auth and organization-auto-join flows. Only auto-join
+ * passes `respectMemberLimit`: the widget's external login must never fail
+ * because the organization is full. An automatic join does not take a seat
+ * an open invitation holds either, and a skipped one is not retried at the
+ * next sign-in: the person joins through an invitation once a seat is free.
+ *
+ * The role has no default: it used to be `member`, and the external login,
+ * which did not pass one, made every visitor of the widget a member with the
+ * frontoffice of the organization, whatever its configuration said.
  */
-export declare function addMemberToOrganizationIfNotExists(userId: string, organizationId: string, role?: string): Promise<boolean>;
+export declare function addMemberToOrganizationIfNotExists(userId: string, organizationId: string, role: string, { respectMemberLimit }?: {
+    respectMemberLimit?: boolean;
+}): Promise<boolean>;

package/dist-vue/packages/auth/src/additional-fields.d.ts

@@ -0,0 +1,48 @@
+/** The columns the config adds to better-auth's session. */
+export declare const sessionAdditionalFields: {
+    activeOrganizationId: {
+        type: "string";
+    };
+    impersonatedBy: {
+        type: "string";
+    };
+    organizationRole: {
+        type: "string";
+    };
+    hardExpiresAt: {
+        type: "date";
+        required: false;
+        input: false;
+    };
+    signedInWithPasskey: {
+        type: "boolean";
+        required: false;
+        input: false;
+        defaultValue: false;
+    };
+};
+/** The columns the config adds to better-auth's user. */
+export declare const userAdditionalFields: {
+    media: {
+        type: "json";
+        required: false;
+    };
+    phoneNumber: {
+        type: "string";
+        required: false;
+    };
+};
+/**
+ * What `inferAdditionalFields` reads of the server options, for a client that
+ * must not load the config itself. The widget's type declarations are built
+ * from its imports, and the inferred type of the config, with the two-step
+ * verification and passkey plugins, is too long to serialize (TS7056).
+ */
+export type AdditionalFieldsOptions = {
+    session: {
+        additionalFields: typeof sessionAdditionalFields;
+    };
+    user: {
+        additionalFields: typeof userAdditionalFields;
+    };
+};

package/dist-vue/packages/auth/src/organization-member-limit.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Whether an organization already holds as many members as the limit the
+ * system panel set on it. An organization with no limit is never full.
+ * With `countPendingInvitations` an open invitation holds a seat until it is
+ * accepted or expires, so a new one cannot be sent for a seat another
+ * invitation already promised. The count runs outside the write that
+ * follows, like better-auth's own check: two joins racing for the last seat
+ * can both pass.
+ */
+export declare function isOrganizationFull(organizationId: string, { countPendingInvitations, }?: {
+    countPendingInvitations?: boolean;
+}): Promise<boolean>;

package/dist-vue/packages/auth/src/passkey-policy-client-plugin.d.ts

@@ -0,0 +1,31 @@
+import { BetterFetch } from 'better-auth/client';
+/**
+ * Client counterpart of the server `passkeyPolicy()` plugin, see
+ * docs/specs/released/two-factor-authentication.md, D10.
+ */
+export declare function passkeyPolicyClient(): {
+    id: "passkey-policy";
+    getActions: ($fetch: BetterFetch) => {
+        passkeyPolicy: {
+            /** Lets the session add a passkey for the next five minutes. */
+            confirmPassword: (data: {
+                password: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: {
+                    status: boolean;
+                };
+                error: null;
+            }>;
+        };
+    };
+    pathMethods: {
+        '/passkey-policy/confirm-password': "POST";
+    };
+};

package/dist-vue/packages/auth/src/passkey-policy-plugin.d.ts

@@ -0,0 +1,22 @@
+import { BetterAuthPlugin } from 'better-auth';
+/** Whether a session created on this route is opened with a passkey. */
+export declare function isPasskeySessionPath(path: string | undefined): boolean;
+/**
+ * Refuses a passkey that did not check who holds it (a PIN, a fingerprint, a
+ * face). With that check a passkey is two factors on its own, which is what
+ * lets it stand in for the password and the code; without it, it is a key
+ * anyone holding the device can use. better-auth leaves the check off.
+ */
+export declare function requirePasskeyUserVerification(userVerified: boolean | undefined): void;
+/**
+ * The confirmation that guards adding a passkey, the announcements of D7 for
+ * passkeys and the rate limit of the confirmation.
+ *
+ * A passkey signs in without the password and without the code, so adding
+ * one is as strong as setting the password: the session alone is not enough,
+ * since a stolen one would leave a way in that outlives it (there is no
+ * freshness window, see `freshAge` in packages/auth/src/index.ts). The
+ * password is asked again, or, for an account without one, a sign-in in the
+ * last ten minutes.
+ */
+export declare function passkeyPolicy(): BetterAuthPlugin;

package/dist-vue/packages/auth/src/two-factor-admin-plugin.d.ts

@@ -0,0 +1,2 @@
+import { BetterAuthPlugin } from 'better-auth';
+export declare function twoFactorAdmin(): BetterAuthPlugin;

package/dist-vue/packages/auth/src/two-factor-policy-client-plugin.d.ts

@@ -0,0 +1,163 @@
+import { SignInSecurityState } from '../../models/src';
+import { BetterFetch } from 'better-auth/client';
+/**
+ * What `GET /two-factor-policy/user-security` answers to a system
+ * administrator, see docs/specs/released/two-factor-system-assistance.md (D3). Dates
+ * arrive as ISO strings.
+ */
+export interface UserSignInSecurity {
+    state: SignInSecurityState;
+    factor: {
+        enabled: boolean;
+        method: 'totp' | 'otp' | null;
+        backupCodesRemaining: number | null;
+        /** Wrong codes in a row since the last right one. */
+        failedAttempts: number;
+        /** Set only while the pause after too many wrong codes lasts. */
+        lockedUntil: string | null;
+    };
+    passkeys: {
+        id: string;
+        name: string | null;
+        /** `multiDevice` when synced across the user's devices. */
+        deviceType: string;
+        backedUp: boolean;
+        createdAt: string | null;
+    }[];
+    trustedDevices: {
+        count: number;
+        lastExpiresAt: string | null;
+    };
+    hasPassword: boolean;
+    requiredBy: {
+        id: string;
+        name: string;
+    }[];
+    /** The latest changes, from the notices the user received. */
+    changes: {
+        action: string;
+        createdAt: string;
+    }[];
+}
+/** What `GET /two-factor-policy/status` answers. */
+export interface TwoFactorStatus {
+    enabled: boolean;
+    /** `totp` for an authenticator app, `otp` for the code sent by email. */
+    method: 'totp' | 'otp' | null;
+    /** The second factor protects a password: without one it is not offered. */
+    hasPassword: boolean;
+    /** An organization of the user requires it and it is not set up yet. */
+    required: boolean;
+    /** The user's organizations that require it. */
+    requiredBy: {
+        id: string;
+        name: string;
+    }[];
+    /** Backup codes left, with an authenticator app; null otherwise. */
+    backupCodesRemaining: number | null;
+    /** Passkeys of the user: a session opened with one meets the policy. */
+    passkeys: number;
+}
+/**
+ * Client counterpart of the server `twoFactorPolicy()` and `twoFactorAdmin()`
+ * plugins, see docs/specs/released/two-factor-authentication.md and
+ * docs/specs/released/two-factor-system-assistance.md.
+ */
+export declare function twoFactorPolicyClient(): {
+    id: "two-factor-policy";
+    getActions: ($fetch: BetterFetch) => {
+        twoFactorPolicy: {
+            status: () => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: TwoFactorStatus;
+                error: null;
+            }>;
+            reset: (data: {
+                userId: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: {
+                    status: boolean;
+                };
+                error: null;
+            }>;
+            userSecurity: (query: {
+                userId: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: UserSignInSecurity;
+                error: null;
+            }>;
+            unlock: (data: {
+                userId: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: {
+                    status: boolean;
+                };
+                error: null;
+            }>;
+            removePasskey: (data: {
+                userId: string;
+                passkeyId: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: {
+                    status: boolean;
+                };
+                error: null;
+            }>;
+            forgetTrustedDevices: (data: {
+                userId: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: {
+                    status: boolean;
+                };
+                error: null;
+            }>;
+        };
+    };
+    pathMethods: {
+        '/two-factor-policy/reset': "POST";
+        '/two-factor-policy/unlock': "POST";
+        '/two-factor-policy/remove-passkey': "POST";
+        '/two-factor-policy/forget-trusted-devices': "POST";
+    };
+};

package/dist-vue/packages/auth/src/two-factor-policy-plugin.d.ts

@@ -0,0 +1,106 @@
+import { BetterAuthPlugin } from 'better-auth';
+import { createAuthMiddleware } from 'better-auth/api';
+import { symmetricDecrypt } from 'better-auth/crypto';
+import { TwoFactorChange } from 'email';
+/**
+ * Carries the challenge for a client that cannot hold the cookie: the widget,
+ * cross-origin and on bearer tokens (D4). The value is the signed cookie as
+ * the sign-in set it.
+ */
+export declare const TWO_FACTOR_TOKEN_HEADER = "x-two-factor-token";
+/** Time the code sent by email stays valid, in minutes. */
+export declare const TWO_FACTOR_OTP_PERIOD_MINUTES = 5;
+export type TwoFactorRow = {
+    id: string;
+    userId: string;
+    backupCodes: string;
+    verified?: boolean | null;
+    failedVerificationCount?: number | null;
+    lockedUntil?: Date | string | null;
+};
+type ChangedUser = {
+    id: string;
+    email: string;
+    name: string;
+};
+export type MiddlewareContext = Parameters<Parameters<typeof createAuthMiddleware>[0]>[0];
+/**
+ * Tells the user that their second factor or their passkeys changed (D7, D10),
+ * by email and in the notification panel. Never throws: the change is already
+ * written.
+ */
+export declare function announceTwoFactorChange(user: ChangedUser, change: TwoFactorChange): Promise<void>;
+/**
+ * The verification rows that remember a device on which the user chose to
+ * skip the code: the `twoFactor` plugin names them `trust-device-<id>` and
+ * stores the user id as their value.
+ */
+export declare function trustedDeviceWhere(userId: string): ({
+    field: string;
+    value: string;
+    operator?: undefined;
+} | {
+    field: string;
+    operator: "starts_with";
+    value: string;
+})[];
+/**
+ * Forgets every device on which the user chose to skip the code. They are
+ * verification rows holding the user id: left in place, one would skip the
+ * code once the factor is on again, on a device that may be the lost one.
+ * The plugin itself forgets only the device the factor is turned off from.
+ */
+export declare function forgetTrustedDevices(adapter: MiddlewareContext['context']['adapter'], userId: string): Promise<number>;
+/**
+ * How many recovery codes the user has left, or null when it cannot be told.
+ * better-auth keeps them encrypted with its secret, so only the count leaves
+ * this function, never a code.
+ */
+export declare function countBackupCodes(ctx: {
+    context: {
+        secretConfig: Parameters<typeof symmetricDecrypt>[0]['key'];
+    };
+}, row: Pick<TwoFactorRow, 'backupCodes'>): Promise<number | null>;
+type PolicyOrganization = {
+    requireTwoFactor?: boolean | null;
+    deleted?: boolean | null;
+};
+/**
+ * Whether the request has to stop for the organization policy (D6): the
+ * session of a member of an organization that requires a second factor, who
+ * signs in with a password and has none. `organizations` is what the caller
+ * already listed for the request, so the common case costs no query, or a
+ * loader that runs only once the cheap exemptions are past; the password
+ * check is cached, since most users have no second factor. Impersonation and
+ * anonymous sessions are exempt, and so is a deleted organization, which the
+ * status endpoint does not list either: counted here alone, it would bounce
+ * the user between the setup page and the app.
+ *
+ * A session opened with a passkey meets the policy (D10), and so does a user
+ * with a passkey where no session tells how they signed in: a Platform MCP
+ * token, whose authorization ran in a session the policy let through.
+ */
+export declare function isTwoFactorSetupRequiredForSession(input: {
+    user: {
+        id: string;
+        twoFactorEnabled?: boolean | null;
+        isAnonymous?: boolean | null;
+        hasPasskey?: boolean;
+    };
+    session: {
+        impersonatedBy?: string | null;
+        signedInWithPasskey?: boolean | null;
+    };
+    organizations: readonly PolicyOrganization[] | (() => Promise<readonly PolicyOrganization[]>);
+}): Promise<boolean>;
+/**
+ * The status endpoint, the widget bridge and the announcements of
+ * docs/specs/released/two-factor-authentication.md. The administrator's endpoints are
+ * in two-factor-admin-plugin.ts.
+ *
+ * The endpoints live under `/two-factor-policy/` and not `/two-factor/` on
+ * purpose: the `twoFactor` plugin rate limits its prefix to three requests
+ * every ten seconds, which a profile page reading the status would hit.
+ */
+export declare function twoFactorPolicy(): BetterAuthPlugin;
+export {};

package/dist-vue/packages/components/src/PkQrCode.d.ts

@@ -0,0 +1,14 @@
+import { DefineComponent, ComponentOptionsMixin, PublicProps, ComponentProvideOptions } from 'vue';
+/**
+ * A QR code drawn as inline SVG, with `qrcode` loaded on first use. The
+ * code stays dark on a white ground whatever the theme: a scanner reads
+ * the contrast, and not every one reads it inverted.
+ */
+type __VLS_Props = {
+    value: string;
+    /** What the code holds, for a screen reader. */
+    label: string;
+};
+declare const __VLS_export: DefineComponent<__VLS_Props, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {}, string, PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+declare const _default: typeof __VLS_export;
+export default _default;

package/dist-vue/packages/components/src/chat/PkChatbotAuth.d.ts

@@ -4,6 +4,12 @@ type __VLS_Props = {
     branding?: AgentBranding;
     authMethods?: AuthMethods;
     loading?: boolean;
+    /**
+     * Set while an email sign-in waits for its second factor: the
+     * methods the account has (`totp`, `otp`). The code step replaces
+     * the forms until it is answered or cancelled.
+     */
+    twoFactorMethods?: string[];
 };
 type __VLS_ModelProps = {
     'errorMessage'?: string | undefined;
@@ -43,6 +49,12 @@ declare const __VLS_export: DefineComponent<__VLS_PublicProps, {}, {}, {}, {}, C
         email: string;
     }) => any;
     social: (provider: "google" | "microsoft") => any;
+    "verify-two-factor": (payload: {
+        kind: "totp" | "otp" | "backup";
+        code: string;
+    }) => any;
+    "send-two-factor-code": () => any;
+    "cancel-two-factor": () => any;
 }, string, PublicProps, Readonly<__VLS_PublicProps> & Readonly<{
     "onUpdate:errorMessage"?: ((message?: string | undefined) => any) | undefined;
     "onUpdate:success"?: ((value?: {
@@ -63,10 +75,17 @@ declare const __VLS_export: DefineComponent<__VLS_PublicProps, {}, {}, {}, {}, C
         email: string;
     }) => any) | undefined;
     onSocial?: ((provider: "google" | "microsoft") => any) | undefined;
+    "onVerify-two-factor"?: ((payload: {
+        kind: "totp" | "otp" | "backup";
+        code: string;
+    }) => any) | undefined;
+    "onSend-two-factor-code"?: (() => any) | undefined;
+    "onCancel-two-factor"?: (() => any) | undefined;
 }>, {
     branding: AgentBranding;
     authMethods: AuthMethods;
     loading: boolean;
+    twoFactorMethods: string[];
 }, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
 declare const _default: typeof __VLS_export;
 export default _default;