@8wave/ai-elements 0.119.0-beta.56 → 0.119.0-beta.60

package/dist-vue/packages/auth/src/external-auth-plugin.d.ts

@@ -1,2 +1,24 @@
 import { BetterAuthPlugin } from 'better-auth';
+/**
+ * The identity provider's token a session was opened, or last refreshed,
+ * with: what an MCP server set to `external-token` receives on the turns of
+ * that session.
+ */
+export type ExternalTokenGrant = {
+    token: string;
+    issuer: string;
+    organizationId: string;
+    userId: string;
+    expiresAt: Date | undefined;
+};
+/**
+ * Where a session's token is kept, implemented by the backend (encrypted,
+ * expiring with the token) and injected at startup, as the media service is.
+ * `save` never throws and says whether the token was kept.
+ */
+export type ExternalTokenStore = {
+    save(sessionId: string, grant: ExternalTokenGrant, sessionExpiresAt: Date): Promise<boolean>;
+};
+/** Injects the store the sign-in and the refresh keep a session's token in. */
+export declare function setExternalTokenStore(store: ExternalTokenStore): void;
 export declare function externalAuth(): BetterAuthPlugin;

package/dist-vue/packages/auth/src/external-identity.d.ts

@@ -0,0 +1,64 @@
+import { DBAdapter } from 'better-auth';
+import { database } from 'database';
+/**
+ * Why an external token was refused. Each caller answers in its own shape:
+ * the better-auth endpoint as an API error, the OpenAI-compatible surface in
+ * OpenAI's.
+ */
+export declare class ExternalTokenError extends Error {
+    readonly status: 'BAD_REQUEST' | 'UNAUTHORIZED';
+    constructor(status: 'BAD_REQUEST' | 'UNAUTHORIZED', message: string);
+}
+type ExternalUserRecord = {
+    id: string;
+    name: string;
+    email: string;
+    [key: string]: unknown;
+};
+/**
+ * Who an external token names, after its signature, issuer and audience were
+ * checked against the organization's configuration, and with the user and
+ * the membership it implies already in the database.
+ */
+export type ExternalIdentity = {
+    user: ExternalUserRecord;
+    issuer: string;
+    organizationId: string;
+    sessionExpiresIn: number | null;
+    /** The token's own `exp`, when it carries one. */
+    expiresAt: Date | undefined;
+};
+type ExternalAuthConfig = NonNullable<Awaited<ReturnType<typeof database.query.organizationExternalAuth.findFirst>>>;
+/** A token whose signature, issuer and audience verified, and nothing more. */
+export type VerifiedExternalToken = {
+    issuer: string;
+    /** The `sub` claim. */
+    externalId: string;
+    /** The organization whose configuration verified the token. */
+    organizationId: string;
+    expiresAt: Date | undefined;
+    payload: Record<string, unknown>;
+    config: ExternalAuthConfig;
+};
+/**
+ * Verifies a token issued by an organization's identity provider, without
+ * touching any user: the step a refresh of a session's token needs, which
+ * must change nothing when it refuses.
+ *
+ * @throws {ExternalTokenError} when the token is malformed, its issuer has no
+ * enabled configuration, or its signature, issuer or audience do not verify.
+ */
+export declare function verifyExternalToken(token: string): Promise<VerifiedExternalToken>;
+/** The user a provider's identity (issuer, sub) is linked to, if any. */
+export declare function findExternalIdentityUserId(issuer: string, externalId: string): Promise<string | null>;
+/**
+ * Verifies a token issued by an organization's identity provider and returns
+ * the platform user it names, creating, linking or updating that user and
+ * their membership as needed. Shared by the widget's sign-in, which then opens
+ * a session, and by the OpenAI-compatible surface, which takes the token on
+ * every request instead.
+ *
+ * @throws {ExternalTokenError} as {@link verifyExternalToken}.
+ */
+export declare function resolveExternalIdentity(token: string, adapter: Pick<DBAdapter, 'findOne' | 'create' | 'update'>): Promise<ExternalIdentity>;
+export {};

package/dist-vue/packages/models/src/schema/McpServer.d.ts

@@ -24,8 +24,20 @@ export declare enum McpServerStatus {
 }
 export declare enum McpServerAuthType {
     Headers = "headers",
-    OAuth = "oauth"
+    OAuth = "oauth",
+    /**
+     * Forwards the identity provider's token the caller authenticated with
+     * (the organization's external sign-in) as `Authorization: Bearer`. For an
+     * MCP server of the same organization that trusts that provider.
+     */
+    ExternalToken = "external-token"
 }
+/**
+ * Whether a server's connection carries a credential of the user taking the
+ * turn (their OAuth sign-in, or the token they authenticated with), so it can
+ * neither be loaded without one nor shared between users.
+ */
+export declare const isPerUserAuthType: (authType: string) => boolean;
 export declare const McpServerSchema: z.ZodObject<{
     createdAt: z.ZodCoercedDate<unknown>;
     createdBy: z.ZodString;
@@ -37,6 +49,7 @@ export declare const McpServerSchema: z.ZodObject<{
     authType: z.ZodDefault<z.ZodEnum<{
         headers: "headers";
         oauth: "oauth";
+        "external-token": "external-token";
     }>>;
     oauthClientId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     oauthClientSecret: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -66,6 +79,7 @@ export declare const McpServerCreateSchema: z.ZodObject<{
     authType: z.ZodDefault<z.ZodEnum<{
         headers: "headers";
         oauth: "oauth";
+        "external-token": "external-token";
     }>>;
     oauthClientId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     oauthClientSecret: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -91,6 +105,7 @@ export declare const McpServerUpdateSchema: z.ZodObject<{
     authType: z.ZodDefault<z.ZodEnum<{
         headers: "headers";
         oauth: "oauth";
+        "external-token": "external-token";
     }>>;
     oauthClientId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     oauthClientSecret: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -137,10 +152,11 @@ export declare const McpServerInfoSchema: z.ZodObject<{
         name: z.ZodString;
         description: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
-    info: z.ZodObject<{
+    info: z.ZodOptional<z.ZodObject<{
         name: z.ZodString;
         version: z.ZodString;
-    }, z.core.$strip>;
+    }, z.core.$strip>>;
+    lastKnown: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /**
  * One integration the current user has signed in to with their own account,

package/dist-vue/packages/models/src/schema/Organization.d.ts

@@ -260,6 +260,16 @@ export declare enum OrganizationFeature {
     ApiTools = "apiTools",
     SubAgents = "subAgents",
     Endpoints = "endpoints",
+    /**
+     * The agents as models of the OpenAI-compatible API (`/api/openai/v1`):
+     * the agent page that shows how to connect a client, and the switch that
+     * exposes the agent there. Like the endpoints, the flag gates the page
+     * and the switch into the on state, not the calls: an agent already
+     * exposed keeps answering, and can still be switched off. Off by
+     * default: until this page the switch had no screen, so no organization
+     * relied on turning it on by itself.
+     */
+    OpenAiApi = "openaiApi",
     /**
      * One flag per integration provider and not one for all of them, for
      * the same reason as the channels: a contract names the CRM or the