@passflow/core 0.14.0 → 0.15.0

package/dist/lib/upgrade/facade.d.ts

@@ -0,0 +1,183 @@
+/**
+ * The Facade: one object that assembles the controller, the transport and the
+ * adapters, and the only construction surface a consumer touches.
+ *
+ * `UpgradeController`, the transport, `upgradeFetch` and the fetch registry stay
+ * internal. They are exported as types for testing, not as things to build.
+ *
+ * **Five members, and the rule is written down because `structural.md` names
+ * Facade-as-God-Object as this family's characteristic failure: adding a sixth
+ * requires deleting one.** `createClient` is deliberately NOT a member — it is
+ * `axios.create(config)` followed by `attachAuth`, so it lives on the `Passflow`
+ * instance where the constructor belongs, and it is not a fourth code path.
+ *
+ * ## The two gates
+ *
+ * Passflow's own API (domain 1) is derived from `PassflowConfig.url` and handled
+ * with zero configuration. The customer's backend (domain 2) is touched only
+ * when `backend` is declared AND an adapter is attached: declaring without
+ * attaching observes nothing, attaching without declaring matches nothing
+ * beyond domain 1. That double gate is why the elevated-credential replay
+ * surface is unreachable in the default configuration — there is no default
+ * interception surface at all.
+ *
+ * ## The session-change reset
+ *
+ * A challenge is server-bound to the session's `sid`, and an abandoned flight
+ * must never elevate a NEW session. `UpgradeController.inFlight` is private with
+ * no reset, so on `SignIn` / `SignOut` the controller is DISCARDED and a fresh
+ * one constructed. A waiter whose elevation was running across that boundary is
+ * settled with `UpgradeSessionChangedError` — never replayed — which §13.3's
+ * table maps to the original response on fetch and a tagged rejection on axios.
+ *
+ * SSR-safe: no global is read at module scope, and nothing is installed until
+ * `enable()` is called with `interceptFetch`.
+ */
+import type { PlatformAdapter } from '../platform';
+import { type AxiosReissue, type ResponseInterceptorHost } from './axios-adapter';
+import type { AssuranceBar, UpgradeChallenge, UpgradeDiagnosticSink } from './challenge';
+import { type UpgradeElevation, type UpgradeFlightSummary, type UpgradePromptHandler, type Waiter } from './controller';
+import type { UpgradeFactor } from './factors';
+import type { FetchLike, ReplayPolicy } from './replay';
+import type { UpgradeSessionPin } from './session';
+import { type UpgradeTransportDeps } from './transport';
+/** Domain 1, as resolved once from `PassflowConfig.url`. `null` = unresolved. */
+export type PassflowUpgradeDomain = {
+    origin: string;
+    pathPrefix?: string;
+} | null;
+/**
+ * What the facade needs from its host, as narrow function-shaped dependencies.
+ *
+ * Everything HTTP arrives pre-wired, which is what keeps this module free of
+ * endpoints and of any opinion about delivery mode.
+ */
+export type UpgradeFacadeDeps = UpgradeTransportDeps & {
+    /** The platform adapter, for the WebAuthn ceremony. */
+    platform: PlatformAdapter;
+    /** Domain 1. Resolved by the host from `url`; the facade never derives it. */
+    passflowDomain: PassflowUpgradeDomain;
+    /** Construction-time factor override, from `PassflowConfig.upgrade`. */
+    factors?: readonly UpgradeFactor[];
+    /** The bar the elevation reached, read from the freshly stored access token. */
+    readObtainedBar?: () => AssuranceBar | undefined;
+    /** §5.5's credential swap. Snapshotted before the elevation, read again after. */
+    authorizationSwap?: () => {
+        from: string;
+        to: string;
+    } | undefined;
+    /**
+     * Installs (or clears, on `undefined`) the handler the SDK's OWN axios clients
+     * consult inside their existing error interceptor — §4.4's internal seam,
+     * which an ordinary customer-registered interceptor is structurally too late
+     * to be.
+     *
+     * It receives a FACTORY rather than a handler because each of the SDK's
+     * clients must replay through its own instance: a handler built around one
+     * client's `request` would re-issue another client's request on the wrong
+     * instance.
+     */
+    attachInternalSeam?: (factory: ((reissue: AxiosReissue) => (error: unknown) => Promise<unknown>) | undefined) => void;
+    /** Subscribes to session changes (`SignIn` / `SignOut`). Returns unsubscribe. */
+    onSessionChange?: (listener: () => void) => () => void;
+    /**
+     * The session and user identity the host can currently read, or `undefined`
+     * when this delivery mode exposes none.
+     *
+     * Read ONCE per flight, when the flight starts, and handed to `commitRefresh`
+     * so the token-applying path can refuse to write user A's tokens into user
+     * B's session (§13.4 revision 6 / H2).
+     */
+    readSessionPin?: () => UpgradeSessionPin | undefined;
+};
+/**
+ * Everything `enable()` accepts: the prompt, the interception scope and the
+ * interception policy.
+ *
+ * `requireChallengeChannel`, `backend` and `shouldIntercept` are interception
+ * policy and deliberately NOT on `PassflowConfig` — they are per-installation,
+ * not client-wide.
+ */
+export type UpgradeEnableOptions = {
+    /** REQUIRED. The js-sdk ships no UI. */
+    prompt: UpgradePromptHandler;
+    /**
+     * Where the customer's own API is: an origin, an origin with a path prefix, or
+     * a same-origin path prefix (`'/api'`). Nothing outside this and domain 1 is
+     * ever observed, and there is no allow-all opt-in — a developer who wants
+     * every origin lists every origin, which is a sentence they can read in a diff.
+     */
+    backend?: string | string[];
+    /**
+     * Patches `globalThis.fetch` through the registry, at the upgrade priority.
+     * **Off by default**, and a different decision from enabling the UI: one prop
+     * for both would bundle "show me the 2FA prompt" with "patch the global", and
+     * only the second has the blast radius. It widens which call sites are
+     * observed, never the scope.
+     */
+    interceptFetch?: boolean;
+    /** Requires the standards channel. The body is then never read. */
+    requireChallengeChannel?: 'header';
+    /** NARROWING ONLY: `false` excludes an admitted URL; `true` cannot widen. */
+    shouldIntercept?: (url: string) => boolean;
+    replay?: ReplayPolicy;
+    /** The fetch surface's only option. Default `'resolve-original'`. */
+    onCancel?: 'resolve-original' | 'reject';
+    onUpgradeDiagnostic?: UpgradeDiagnosticSink;
+    factors?: readonly UpgradeFactor[];
+    maxAttempts?: number;
+    /** One terminal state per flight, after every waiter has reported. */
+    onFlightSettled?: (summary: UpgradeFlightSummary) => void;
+    /** Forwarded verbatim to the prepare round for passkey upgrades. */
+    relyingPartyId?: string;
+};
+/** What the imperative seam resolves with (§13.4). */
+export type UpgradeResult = {
+    status: 'elevated';
+    acr?: string;
+};
+/**
+ * What the imperative seam accepts: a bar the CALLER states.
+ *
+ * Stating one is what makes `UpgradeInsufficientError` reachable on this
+ * surface; an options-less call states no bar, has no protected operation to
+ * replay, and resolves `{ status: 'elevated' }` (§13.3's `n/a` cell).
+ */
+export type UpgradeOptions = {
+    acrValues?: string;
+    maxAge?: number;
+};
+export type UpgradeFacade = {
+    /**
+     * Drives an elevation directly — §13.4's imperative seam.
+     *
+     * The facade is CALLABLE, which is why this signature is here rather than on
+     * a method: the documented surface is `passflow.upgrade(options?)`, and the
+     * same object also carries `enable`, `withAuth` and the rest. Resolves on
+     * proof completion; rejects `UpgradeCancelledError`,
+     * `UpgradeUnsatisfiableError`, `UpgradeUnavailableError`,
+     * `UpgradeSessionChangedError`, `UpgradeTransportError` — and, when the
+     * caller stated a bar the proof did not reach, `UpgradeInsufficientError`.
+     */
+    (options?: UpgradeOptions): Promise<UpgradeResult>;
+    /**
+     * Installs the prompt handler and the selected interceptors. Returns an
+     * idempotent teardown. Calling `enable()` twice replaces the previous
+     * installation and tears the first one down.
+     */
+    enable(options: UpgradeEnableOptions): () => void;
+    /** True when a prompt handler is installed AND the delivery mode can commit. */
+    readonly enabled: boolean;
+    /**
+     * Drives an elevation directly — headless clients, a "verify now" button,
+     * tests. Single-flight with the interceptors: concurrent callers share one
+     * prompt, because they share one controller.
+     */
+    elevate(challenge: UpgradeChallenge, waiter?: Waiter): Promise<UpgradeElevation>;
+    /** Wraps a fetch and returns the wrapper. Touches no global. */
+    withAuth(next?: FetchLike): FetchLike;
+    /** Attaches to an axios instance the developer owns, MUTATING it. Returns `detach()`. */
+    attachAuth(instance: ResponseInterceptorHost): () => void;
+};
+export declare const createUpgradeFacade: (deps: UpgradeFacadeDeps) => UpgradeFacade;
+//# sourceMappingURL=facade.d.ts.map

package/dist/lib/upgrade/facade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facade.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,uBAAuB,EAAgD,MAAM,iBAAiB,CAAC;AAChI,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAEzB,KAAK,MAAM,EACZ,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,KAAK,oBAAoB,EAA0B,MAAM,aAAa,CAAC;AAEhF,iFAAiF;AACjF,MAAM,MAAM,qBAAqB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,GAAG;IACrD,uDAAuD;IACvD,QAAQ,EAAE,eAAe,CAAC;IAC1B,8EAA8E;IAC9E,cAAc,EAAE,qBAAqB,CAAC;IACtC,wEAAwE;IACxE,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,YAAY,GAAG,SAAS,CAAC;IACjD,kFAAkF;IAClF,iBAAiB,CAAC,EAAE,MAAM;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACnE;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,KAAK,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,KAAK,IAAI,CAAC;IACtH,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAC;IACvD;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,iBAAiB,GAAG,SAAS,CAAC;CACtD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,wCAAwC;IACxC,MAAM,EAAE,oBAAoB,CAAC;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mEAAmE;IACnE,uBAAuB,CAAC,EAAE,QAAQ,CAAC;IACnC,6EAA6E;IAC7E,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,QAAQ,CAAC;IACzC,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC1D,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,sDAAsD;AACtD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;;;;;;;OAUG;IACH,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACnD;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAC;IAClD,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjF,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IACtC,yFAAyF;IACzF,UAAU,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,IAAI,CAAC;CAC3D,CAAC;AAwBF,eAAO,MAAM,mBAAmB,GAAI,MAAM,iBAAiB,KAAG,aA6R7D,CAAC"}

package/dist/lib/upgrade/fetch-adapter.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The FETCH adapter over `handleChallenge`. One of four, and the thinnest.
+ *
+ * **NO LOGIC IN AN ADAPTER.** Everything here is translation: a `Response`
+ * becomes a `ChallengeContext` on the way in, and a `CoreOutcome` becomes a
+ * `Response` (or a throw) on the way out, through `settleFetchOutcome`. It
+ * parses no challenge, compares no bar, decides no scope, counts no retry and
+ * chooses no error class. If something in this file ever looks like a decision,
+ * it belongs in `core.ts` instead — a row that passes here and fails on the
+ * axios surface is a leak out of the core, not a difference between transports.
+ *
+ * The one genuinely transport-shaped obligation it carries is the body: a
+ * replay needs the request body while it is still unread, so `planReplay` runs
+ * BEFORE the first call and the core is told whether a replay is even possible
+ * before any prompt opens. The caller's own response is never consumed — every
+ * body read is taken from `clone()`, so `bodyUsed === false` holds on the object
+ * the caller receives.
+ *
+ * SSR-safe: no global is read at module scope. `withAuth()`'s default `next` is
+ * resolved inside the call, not here.
+ */
+import { type UpgradeInterceptorOptionsSource } from './core';
+import { type FetchLike } from './replay';
+/**
+ * Wraps a `fetch`, returning a new function. Installs nothing and touches no
+ * global — this is the SSR- and React-Native-safe entry point, and the one the
+ * global patch itself is built from.
+ */
+export declare const upgradeFetch: (next: FetchLike, source: UpgradeInterceptorOptionsSource) => FetchLike;
+//# sourceMappingURL=fetch-adapter.d.ts.map

package/dist/lib/upgrade/fetch-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-adapter.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/fetch-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAGL,KAAK,+BAA+B,EAIrC,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,KAAK,SAAS,EAAiD,MAAM,UAAU,CAAC;AA2HzF;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,SAAS,EAAE,QAAQ,+BAA+B,KAAG,SA2CvF,CAAC"}

package/dist/lib/upgrade/index.d.ts

@@ -1,5 +1,20 @@
 export { INSUFFICIENT_USER_AUTHENTICATION, UPGRADE_REQUIRED, parseChallengeBody, parseChallengeHeader, parseUpgradeChallenge, type UpgradeChallenge, } from './challenge';
 export { DEFAULT_UPGRADE_FACTORS, factorRegistry, passkeyFactor, recoveryCodesFactor, UpgradeFactorError, totpFactor, type UpgradeAssertion, type UpgradeAssertContext, type UpgradeFactor, type UpgradeFactorInput, type UpgradeFactorType, type UpgradePrepared, } from './factors';
 export { UpgradeCancelledError, UpgradeController, UpgradeUnsatisfiableError, type UpgradeControllerOptions, type UpgradePromptHandler, type UpgradePromptRequest, type UpgradePromptResult, type UpgradeTransport, } from './controller';
+export { RECOVERABLE_COMMIT_ERROR_IDS, SESSION_INVALIDATING_COMMIT_ERROR_IDS, UpgradeErrorIds, UpgradeTransportError, classifyUpgradeError, invalidatesSessionOnCommit, isRecoverableCommitFailure, isRetryableUpgradeKind, isUpgradeTransportError, type UpgradeEndpoint, type UpgradeErrorKind, type UpgradeTransportErrorInit, } from './errors';
+export { UPGRADE_REPLAYED_MARKER, UPGRADE_TRANSACTION_MARKER, hasUpgradeReplayedMarker, hasUpgradeTransactionMarker, markUpgradeReplayed, markUpgradeTransaction, type UpgradeRequestMarkers, } from './markers';
 export { selectFactors } from './select';
+export { RELATIVE_BASE, captureHeaders, createRequestSnapshot, headersToObject, normaliseUrl, snapshotHeader, swapAuthorization, type NormalisedUrl, type RequestSnapshot, type RequestSnapshotInit, type SnapshotHeader, } from './snapshot';
+export { readSessionPin, sessionPinMatches, type UpgradeSessionClaims, type UpgradeSessionPin, } from './session';
+export { createUpgradeTransport, toPrepared, type UpgradeTransportDeps } from './transport';
+export { parseAcrToken, readAcrValues, requiredAcrLevel, type AcrReading } from './acr';
+export { parseMaxAge, readUpgradeChallenge, type AssuranceBar, type ChallengeChannel, type ChallengeInput, type ChallengeReadOptions, type ChallengeReading, type MaxAgeReading, type UpgradeDiagnostic, type UpgradeDiagnosticReason, type UpgradeDiagnosticSink, } from './challenge';
+export { barMeets, barOf, mergeChallenges, type UpgradeElevation, type UpgradeFlightState, type UpgradeFlightSummary, type UpgradeProof, type UpgradeWaiterSummary, type Waiter, type WaiterEntry, type WaiterOutcome, type WaiterReport, } from './controller';
+export { UpgradeInsufficientError, UpgradeSessionChangedError, UpgradeUnavailableError, } from './errors';
+export { coreOutcomeToError, handleChallenge, isInterceptionScope, isUpgradeCancelled, isUpgradeExhausted, isUpgradeInsufficient, isUpgradeSessionChanged, isUpgradeTransportFailure, isUpgradeUnavailable, isUpgradeUnsatisfiable, settleAxiosOutcome, settleFetchOutcome, tagUpgradeOutcome, type ChallengeContext, type CoreOutcome, type InterceptionScope, type Settlement, type UpgradeInterceptorOptions, } from './core';
+export { methodOf, planReplay, policyPermits, urlOf, type BodyKind, type FetchLike, type ReplayHints, type ReplayPlan, type ReplayPolicy, type UpgradeReplayInfo, } from './replay';
+export { attachUpgradeAuth, createAxiosUpgradeHandler, type AxiosConfigLike, type AxiosReissue, type ResponseInterceptorHost, } from './axios-adapter';
+export { upgradeFetch } from './fetch-adapter';
+export { createUpgradeClient, type CreateClientConfig } from './client';
+export { createUpgradeFacade, type PassflowUpgradeDomain, type UpgradeEnableOptions, type UpgradeFacade, type UpgradeFacadeDeps, type UpgradeOptions, type UpgradeResult, } from './facade';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/upgrade/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,eAAe,GACrB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,eAAe,GACrB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,4BAA4B,EAC5B,qCAAqC,EACrC,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,GAC/B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,2BAA2B,EAC3B,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE5F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC;AAExF,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,QAAQ,EACR,KAAK,EACL,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,yBAAyB,GAC/B,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,aAAa,EACb,KAAK,EACL,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,uBAAuB,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAExE,OAAO,EACL,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC"}

package/dist/lib/upgrade/markers.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Per-request markers for the upgrade transaction.
+ *
+ * Two 401s look identical on the wire and mean opposite things. A protected
+ * resource's 401 says "this session is not strong enough"; the elevation's own
+ * `POST /auth/refresh` 401 says "that TOTP code was wrong, try again". Neither
+ * carries RFC 9470 vocabulary on the commit path — `refreshErrorStatus` maps the
+ * four recoverable upgrade errors to a bare 401 with no `WWW-Authenticate` and no
+ * `upgrade_required` body — so the response alone cannot tell them apart from an
+ * expired session.
+ *
+ * The evidence that CAN tell them apart is the request: we know we issued it.
+ * Both rounds of the elevation (`POST /auth/upgrade/start` and the committing
+ * `POST /auth/refresh`) carry a marker on their axios config, set at the call
+ * site immediately before dispatch. The response interceptor reads it off
+ * `error.config`, which axios hands back unchanged, and suppresses
+ * `setSessionInvalid()` for that one request only. An unrelated background 401
+ * arriving while a prompt is open is unmarked and invalidates exactly as before.
+ *
+ * A second marker records that a request has already been replayed after an
+ * elevation, so an adapter that re-issues through the same interceptor cannot
+ * elevate twice for one challenge.
+ *
+ * ## Why these are enumerable, against the design's "non-enumerable"
+ *
+ * The design asks for non-enumerable properties, reasoning that they must never
+ * reach the wire. Non-enumerable does not survive the trip: `AxiosClient.send`
+ * spreads the caller's config into a fresh object (`{ method, url, ...options }`)
+ * and axios' own `mergeConfig` iterates `Object.keys`, so both drop a
+ * non-enumerable property before the request is dispatched — verified against
+ * `axios@1.13` with a stub adapter. An enumerable key reaches both the adapter
+ * and `error.config`.
+ *
+ * The property the design actually wanted is preserved regardless: axios
+ * serializes only `data` (and `params`/`headers`), never unknown config keys, so
+ * a marker is never transmitted. The same mechanism already carries
+ * `_retryCount` through the rate-limit retry path.
+ */
+/** Config key marking a request as one of the upgrade transaction's two rounds. */
+export declare const UPGRADE_TRANSACTION_MARKER = "__passflowUpgradeTransaction";
+/** Config key marking a request as the single post-elevation replay (FR3). */
+export declare const UPGRADE_REPLAYED_MARKER = "__passflowUpgradeReplayed";
+/** The markers as they appear on a request config. Both are absent unless set. */
+export type UpgradeRequestMarkers = {
+    /** Set by the upgrade transport on `prepare` and `commit`. */
+    __passflowUpgradeTransaction?: true;
+    /** Set by the replaying adapter before it re-issues the original request. */
+    __passflowUpgradeReplayed?: true;
+};
+/**
+ * Returns a copy of `config` marked as part of the upgrade transaction.
+ *
+ * Copies rather than mutates: the caller may be reusing a config object, and a
+ * marker that outlives its request would suppress invalidation for an unrelated
+ * 401 — the exact over-broad behaviour the per-request rule replaces.
+ */
+export declare const markUpgradeTransaction: <T extends object>(config?: T) => T & UpgradeRequestMarkers;
+/** Reports whether a request config carries the upgrade-transaction marker. */
+export declare const hasUpgradeTransactionMarker: (config: unknown) => boolean;
+/** Returns a copy of `config` marked as the one permitted post-elevation replay. */
+export declare const markUpgradeReplayed: <T extends object>(config: T) => T & UpgradeRequestMarkers;
+/** Reports whether a request config has already been replayed after an elevation. */
+export declare const hasUpgradeReplayedMarker: (config: unknown) => boolean;
+//# sourceMappingURL=markers.d.ts.map

package/dist/lib/upgrade/markers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markers.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/markers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,mFAAmF;AACnF,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE,kFAAkF;AAClF,MAAM,MAAM,qBAAqB,GAAG;IAClC,8DAA8D;IAC9D,4BAA4B,CAAC,EAAE,IAAI,CAAC;IACpC,6EAA6E;IAC7E,yBAAyB,CAAC,EAAE,IAAI,CAAC;CAClC,CAAC;AAKF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAAI,CAAC,SAAS,MAAM,EAAE,SAAS,CAAC,KAAG,CAAC,GAAG,qBAGxE,CAAC;AAEH,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B,GAAI,QAAQ,OAAO,KAAG,OAAyD,CAAC;AAExH,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,GAAI,CAAC,SAAS,MAAM,EAAE,QAAQ,CAAC,KAAG,CAAC,GAAG,qBAGpE,CAAC;AAEH,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,GAAI,QAAQ,OAAO,KAAG,OAAsD,CAAC"}

package/dist/lib/upgrade/replay.d.ts

@@ -0,0 +1,132 @@
+/**
+ * The replay planner.
+ *
+ * Pure, no I/O, and it runs BEFORE the first call — a `Request` body must be
+ * cloned while it is still unread, so by the time a 401 has come back it is too
+ * late to decide whether a replay is possible. Planning first is also what lets
+ * the core fail BEFORE opening a prompt: prompting the user, elevating their
+ * session and only then discovering we cannot honour it is the worst possible
+ * ordering, because it spends a server challenge and a user interaction for
+ * nothing.
+ *
+ * ## Why replaying a challenged request is safe at all
+ *
+ * An RFC 9470 challenge is emitted by the authorization middleware —
+ * `RequireAuthLevel` / `RequireFreshAuth` — BEFORE the handler runs, so the
+ * request had no effect. That is categorically different from a 429 or a 502,
+ * where the request may have partially executed, which is why
+ * `AxiosClient.handleRateLimitError` correctly refuses to retry non-idempotent
+ * requests and why this correctly does the opposite.
+ *
+ * The guarantee depends on the CUSTOMER's middleware placement, though, so
+ * there is an escape hatch rather than an assumption: a backend that emits an
+ * `insufficient_user_authentication` challenge after a side effect is violating
+ * RFC 9470, and such a backend sets `'idempotent-only'`. Stating the
+ * precondition is the design; silently assuming it would not be.
+ *
+ * ## Per-waiter binding
+ *
+ * A plan is bound to the request that carried the challenge: its own URL, its
+ * own method and its own pre-captured body. No waiter's challenge, outcome or
+ * response ever changes what another waiter replays, or where — requirement
+ * AGGREGATION across waiters sharing a session is permitted and happens in the
+ * controller; replay SUBSTITUTION is prohibited, and that prohibition is this
+ * module's whole job.
+ */
+import { type RequestSnapshot } from './snapshot';
+/** Our own `fetch` shape. Declared here rather than imported so no DOM lib is required. */
+export type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+/** How a body can be re-sent, which is the only thing that decides replayability. */
+export type BodyKind = 
+/** No body at all. Re-issue the same input. */
+'none'
+/** A value the caller still holds and `fetch` re-reads: string, Blob, buffer, FormData, params. */
+ | 'reusable'
+/** A `Request` with a body, cloned before the first send. */
+ | 'request-clone'
+/** Consumed by the first send and unrecoverable: a `ReadableStream`, or a failed clone. */
+ | 'one-shot';
+/** What the policy predicate is told about a request. */
+export type UpgradeReplayInfo = {
+    url: string;
+    method: string;
+    bodyKind: BodyKind;
+};
+/**
+ * Replay policy.
+ *
+ * The object form is §13.5's: size and streaming limits. The three string and
+ * function forms are §5.1's escape hatch, kept because `'idempotent-only'`
+ * expresses a constraint the object form cannot — a backend whose challenge may
+ * arrive after a side effect.
+ */
+export type ReplayPolicy = {
+    /** Refuse to buffer a `Request` body larger than this many bytes, when the size is known. */
+    maxBodyBytes?: number;
+    /** A stream is never replayable; the field exists so the intent is written down. */
+    allowStreamingBody?: false;
+} | 'always' | 'idempotent-only' | ((info: UpgradeReplayInfo) => boolean);
+/** Hints the core passes at replay time. The planner applies them; it decides nothing. */
+export type ReplayHints = {
+    /**
+     * The §5.5 credential swap, already resolved by the core.
+     *
+     * Applied if and only if the outgoing `Authorization` header value EXACTLY
+     * equals `from`: equality with the token we hold in storage is what proves the
+     * header was ours. Any other value is forwarded untouched, because rewriting a
+     * header we do not own would be a security bug.
+     *
+     * Without this the replay re-sends the stale `Authorization` header, every
+     * elevation ends in a surfaced second 401, and the feature silently never
+     * works. Cookie mode needs none of it: the browser attaches the current —
+     * now elevated — cookie by itself.
+     */
+    authorizationSwap?: {
+        from: string;
+        to: string;
+    };
+};
+export type ReplayPlan = {
+    /** False when the body cannot be re-sent, or the policy refused. */
+    replayable: boolean;
+    bodyKind: BodyKind;
+    /** Why it is not replayable, for the `'replay-unsupported'` diagnostic. */
+    reason?: string;
+    /** What to pass to `next()` on the FIRST call. */
+    forwardInput: RequestInfo | URL;
+    forwardInit?: RequestInit;
+    /**
+     * The normalised, immutable snapshot of this request — §13.4 revision 6.
+     *
+     * EXPOSED rather than hidden as a plan-time url, so the scope check, the
+     * challenge context, the diagnostics and the replay all read the same object
+     * and the request that is *authorized* cannot differ from the one that is
+     * *sent*.
+     */
+    snapshot: RequestSnapshot;
+    /** Re-issues the original request, once. Rejects if `!replayable`. */
+    replay: (next: FetchLike, hints?: ReplayHints) => Promise<Response>;
+};
+/** The URL of whatever shape the caller passed, without touching the network. */
+export declare const urlOf: (input: RequestInfo | URL) => string;
+/** The method of whatever shape the caller passed. `init` wins, as `fetch` itself has it. */
+export declare const methodOf: (input: RequestInfo | URL, init?: RequestInit) => string;
+/**
+ * Applies the policy. The planner asks; it never decides what the policy means.
+ *
+ * Exported because the axios adapter needs the same answer about an
+ * `AxiosRequestConfig`, which has no `Request` and no `BodyInit` to plan over.
+ * Two readings of `'idempotent-only'` — one here and one there — is exactly the
+ * per-surface drift the single core forbids, so there is one reading and both
+ * surfaces call it.
+ */
+export declare const policyPermits: (policy: ReplayPolicy | undefined, info: UpgradeReplayInfo, bodyBytes?: number) => boolean;
+/**
+ * Decides whether a request can be replayed, and produces the thunk that does it.
+ *
+ * Call it BEFORE the first send. The returned `forwardInput` / `forwardInit` are
+ * what the first send must use: for a `Request` with a body they are the
+ * original, with the spare clone held for the replay.
+ */
+export declare const planReplay: (input: RequestInfo | URL, init?: RequestInit, policy?: ReplayPolicy) => ReplayPlan;
+//# sourceMappingURL=replay.d.ts.map

package/dist/lib/upgrade/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,KAAK,eAAe,EAA6D,MAAM,YAAY,CAAC;AAE7G,2FAA2F;AAC3F,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE5F,qFAAqF;AACrF,MAAM,MAAM,QAAQ;AAClB,+CAA+C;AAC7C,MAAM;AACR,mGAAmG;GACjG,UAAU;AACZ,6DAA6D;GAC3D,eAAe;AACjB,2FAA2F;GACzF,UAAU,CAAC;AAEf,yDAAyD;AACzD,MAAM,MAAM,iBAAiB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEpF;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IACE,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,KAAK,CAAC;CAC5B,GACD,QAAQ,GACR,iBAAiB,GACjB,CAAC,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC;AAE3C,0FAA0F;AAC1F,MAAM,MAAM,WAAW,GAAG;IACxB;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,YAAY,EAAE,WAAW,GAAG,GAAG,CAAC;IAChC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,EAAE,eAAe,CAAC;IAC1B,sEAAsE;IACtE,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrE,CAAC;AAYF,iFAAiF;AACjF,eAAO,MAAM,KAAK,GAAI,OAAO,WAAW,GAAG,GAAG,KAAG,MAQhD,CAAC;AAEF,6FAA6F;AAC7F,eAAO,MAAM,QAAQ,GAAI,OAAO,WAAW,GAAG,GAAG,EAAE,OAAO,WAAW,KAAG,MAGvE,CAAC;AAwCF;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,YAAY,GAAG,SAAS,EAAE,MAAM,iBAAiB,EAAE,YAAY,MAAM,KAAG,OAc7G,CAAC;AAoHF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GAAI,OAAO,WAAW,GAAG,GAAG,EAAE,OAAO,WAAW,EAAE,SAAS,YAAY,KAAG,UAyGhG,CAAC"}

package/dist/lib/upgrade/select.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"select.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/select.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAqB,MAAM,WAAW,CAAC;AAoElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,GAAI,WAAW,SAAS,aAAa,EAAE,EAAE,WAAW,gBAAgB,KAAG,SAAS,aAAa,EAKtH,CAAC"}
+{"version":3,"file":"select.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/select.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAqB,MAAM,WAAW,CAAC;AAiElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,GAAI,WAAW,SAAS,aAAa,EAAE,EAAE,WAAW,gBAAgB,KAAG,SAAS,aAAa,EAKtH,CAAC"}

package/dist/lib/upgrade/session.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Session and user identity pinning for an upgrade flight (§13.4 revision 6).
+ *
+ * ## The rule
+ *
+ * An upgrade flight is bound to the **session and user identity it began
+ * under**, and that identity is verified **at the moment tokens are applied** —
+ * not only around `prepare` and `commit`. On mismatch the rotated tokens are
+ * discarded, never applied, and the flight settles as `session changed
+ * mid-flight`.
+ *
+ * ## Why the epoch counter was not enough
+ *
+ * The round-1 epoch check wraps the two rounds that talk to the server. It does
+ * not wrap token APPLICATION, which happens inside `AuthService.refreshToken`
+ * after the commit returns. A logout and re-login during an in-flight upgrade
+ * therefore let user A's flight write its rotated tokens over user B's live
+ * session: the request was authorized as A, the storage belongs to B, and
+ * nothing in between compared the two principals.
+ *
+ * An epoch tells you something changed. An identity check tells you **whether
+ * it is still the same principal**, which is the property actually required.
+ * Both run, and they are complementary rather than redundant.
+ *
+ * ## Why this module is pure
+ *
+ * It imports nothing and reads no storage, so the token-applying path can be
+ * given a pin by value and the comparison can be tested with literals. Reading
+ * the identity is the host's job — it is the only code that knows where the
+ * session lives in each delivery mode.
+ */
+/**
+ * The principal an upgrade flight is pinned to.
+ *
+ * `sub` is the user. `sid` is the session when the server issues one; it is
+ * absent in tokens that carry no session claim, and the field is then simply
+ * not part of the comparison — a missing claim cannot be made to prove
+ * anything, and inventing a value would make two different sessions compare
+ * equal or unequal arbitrarily.
+ */
+export type UpgradeSessionPin = {
+    readonly sub: string;
+    readonly sid?: string;
+};
+/** Claims the pin is read from. Deliberately `unknown`-typed: it is a parsed JWT body. */
+export type UpgradeSessionClaims = {
+    sub?: unknown;
+    sid?: unknown;
+} | null | undefined;
+/**
+ * Reads a pin from token claims, or `undefined` when there is no identity to
+ * pin to.
+ *
+ * `sub` is mandatory: without a user there is no principal, and a pin that
+ * compares nothing would report "unchanged" for every change.
+ */
+export declare const readSessionPin: (claims: UpgradeSessionClaims) => UpgradeSessionPin | undefined;
+/**
+ * Is `current` the same principal the flight was pinned to?
+ *
+ * `false` when `current` is absent: a pin exists, so the identity WAS readable
+ * when the flight began, and an identity that has since become unreadable is a
+ * change — the session was torn down. That is fail-closed on token
+ * APPLICATION (nothing is written) and still fail-open on session STATE
+ * (nothing is invalidated, nobody is logged out). §13.4 revision 6 keeps those
+ * two axes separate on purpose.
+ *
+ * When both sides carry a `sid` it must match as well, which is what catches a
+ * logout and re-login as the SAME user.
+ */
+export declare const sessionPinMatches: (pin: UpgradeSessionPin, current: UpgradeSessionPin | undefined) => boolean;
+//# sourceMappingURL=session.d.ts.map

package/dist/lib/upgrade/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,0FAA0F;AAC1F,MAAM,MAAM,oBAAoB,GAAG;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,oBAAoB,KAAG,iBAAiB,GAAG,SAKjF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAAI,KAAK,iBAAiB,EAAE,SAAS,iBAAiB,GAAG,SAAS,KAAG,OAQlG,CAAC"}