@passflow/core 0.14.1 → 0.15.0

package/dist/lib/passflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passflow.d.ts","sourceRoot":"","sources":["../../lib/passflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,WAAW,EAGhB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,cAAc,EAEnB,4BAA4B,EAC5B,KAAK,uCAAuC,EAC5C,KAAK,mCAAmC,EACxC,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,yCAAyC,EAC9C,KAAK,iCAAiC,EACtC,KAAK,qCAAqC,EAC1C,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAI7B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAE7B,MAAM,OAAO,CAAC;AAKf,OAAO,EAAkC,aAAa,EAAqB,gBAAgB,EAAe,MAAM,YAAY,CAAC;AAE7H,OAAO,EAAqB,aAAa,EAAiB,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGnE,qBAAa,QAAQ;IACnB;;;;;;;OAOG;IACH,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAe;IAG9C,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,YAAY,CAAqB;IAGzC,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,sBAAsB,CAAU;IACxC,OAAO,CAAC,eAAe,CAAS;IAGhC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,cAAc,CAAgB;IACtC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,gBAAgB,CAAmB;IAGpC,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAGnC,OAAO,CAAC,qBAAqB,CAAC,CAAgG;IAC9H,OAAO,CAAC,sBAAsB,CAAC,CAAsB;IAGrD,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,OAAO,CAAC,QAAQ,CAAkB;IAClC,IAAI,MAAM,IAAI,MAAM,CAEnB;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;gBAEH,MAAM,EAAE,cAAc;IAqElC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAoB7B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAUrF;YAEY,kBAAkB;IAyBhC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,SAAS,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE;IAOlE;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE;IAKpE;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,IAAI,MAAM,GAAG,SAAS;IAI1C,OAAO,CAAC,iBAAiB;IAmFzB,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,gBAAgB;IAyBxB,OAAO,CAAC,gCAAgC;IAqCxC;;;;;;;;;;;;OAYG;IACH,eAAe;IAIf;;;;;;;;;;OAUG;IACH,oBAAoB;IAIpB;;;;;;;;;;;;;OAaG;IACH,eAAe;IAIf;;;;;;;;;;;OAWG;IACH,gBAAgB;IAKhB;;;;;;;;;;;;;OAaG;IACH,eAAe,IAAI,OAAO;IAW1B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAMpF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAMpF;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAIrG;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,0BAA0B,CAAC,OAAO,EAAE,yCAAyC,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAMzH;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAUnB;;;;;;;;;;;;;;;;OAgBG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAc7B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,GAAG,IAAI;IAInE;;;;;;;;;;;;;;;;OAgBG;IACH,yBAAyB,CAAC,OAAO,EAAE,4BAA4B,GAAG,IAAI;IAItE;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM;IAepB;;;;;;;;;;;;;;;;;OAiBG;IACG,YAAY,IAAI,OAAO,CAAC,6BAA6B,CAAC;IAsB5D;;;;;;;;;;;;;;;;;;;OAmBG;IACH,sBAAsB,CAAC,OAAO,EAAE,qCAAqC,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAIxG;;;;;;;;;;;;;;;;;;OAkBG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAOnG;;;;;;;;;;;;OAYG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAQ5C;;;;;;;;;;;;OAYG;IACG,cAAc,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAQpD;;;;;;;;;;;;OAYG;IACG,yBAAyB,IAAI,OAAO,CAAC,8BAA8B,CAAC;IAQ1E;;;;;;;;;;;;OAYG;IACG,kBAAkB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAS5D;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,eAAe,CAAC,OAAO,EAAE,mCAAmC,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAM3G;;;;;;;;;;;;;;;;;;;OAmBG;IACG,mBAAmB,CAAC,OAAO,EAAE,uCAAuC,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAOnH;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IASnC;;;;;;;;;;;;;;OAcG;IACG,SAAS,CAAC,SAAS,UAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAI/D;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS;IAKlD;;;;;;;;;;;;;OAaG;IACG,eAAe;IAQrB;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQ1F;;;;;;;;;;;;OAYG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQ5E;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,cAAc,CAAC,OAAO,CAAC,EAAE;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IASjB;;;;;OAKG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAY9F;;;;;OAKG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAazF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAYvF;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAQrC;;;;;;;;;;;;OAYG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQvE;;;;;;;;;;;;OAYG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQvE;;;;;;;;;;;;OAYG;IACG,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAS1E;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,CAAC,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM;IAIhH;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,CAAC,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,IAAI;IAI3G;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,IAAI,OAAO,0BAA0B,EAAE,iBAAiB;IAIvE;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAMxC;;;;;;;;;;;;OAYG;IACG,kBAAkB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAQ5D;;;;;;;;;;;;;OAaG;IACG,mBAAmB,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAQ5D;;;;;;;;;;;;;;OAcG;IACG,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAQ5E;;;;;;;;;;;;;;;;OAgBG;IACG,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAkBrE;;;;;;;;;;;;;;;OAeG;IACG,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAkBhF;;;;;;;;;;;;;OAaG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAQvE;;;;;;;;;;;;;;OAcG;IACG,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAQ1F;;;;;;;;;;;;;OAaG;IACH,+BAA+B,IAAI,OAAO;IAI1C;;;;;;;;;OASG;IACH,aAAa,IAAI,CAAC,GAAG,CAAC;IAMtB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,+BAA+B,CACnC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,aAAa,EAAE,yCAAyC,CAAC;IAI3E;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,IAAI,OAAO,aAAa,EAAE,8BAA8B,GAAG,IAAI;IAIlF;;;;;;;;;;;;;OAaG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;;;;;;;;OAUG;IACH,qBAAqB,IAAI,IAAI;CAG9B"}
+{"version":3,"file":"passflow.d.ts","sourceRoot":"","sources":["../../lib/passflow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,EAEL,KAAK,WAAW,EAGhB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,cAAc,EAEnB,4BAA4B,EAC5B,KAAK,uCAAuC,EAC5C,KAAK,mCAAmC,EACxC,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,yCAAyC,EAC9C,KAAK,iCAAiC,EACtC,KAAK,qCAAqC,EAC1C,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAI7B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAK7B,MAAM,OAAO,CAAC;AAOf,OAAO,EAAkC,aAAa,EAAqB,gBAAgB,EAAe,MAAM,YAAY,CAAC;AAE7H,OAAO,EAAqB,aAAa,EAAiB,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AAChD,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAInB,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGnE,qBAAa,QAAQ;IACnB;;;;;;;OAOG;IACH,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAe;IAG9C,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,UAAU,CAAa;IAG/B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,sBAAsB,CAAU;IACxC,OAAO,CAAC,eAAe,CAAS;IAGhC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,cAAc,CAAgB;IACtC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,gBAAgB,CAAmB;IAGpC,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAEnC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAEhC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;IAGrD,OAAO,CAAC,qBAAqB,CAAC,CAAgG;IAC9H,OAAO,CAAC,sBAAsB,CAAC,CAAsB;IAGrD,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,OAAO,CAAC,QAAQ,CAAkB;IAClC,IAAI,MAAM,IAAI,MAAM,CAEnB;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;gBAEH,MAAM,EAAE,cAAc;IA0GlC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAoB7B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS;IAIrC;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,IAAI;IAIzD;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,aAAa;IAIxD;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAoBxB,kGAAkG;IAClG,OAAO,CAAC,YAAY;IAapB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAazB;;;;;;;OAOG;IACH,OAAO,CAAC,wBAAwB;IAShC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAUrF;YAEY,kBAAkB;IAyBhC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,SAAS,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE;IAOlE;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE;IAKpE;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,IAAI,MAAM,GAAG,SAAS;IAI1C,OAAO,CAAC,iBAAiB;IAmFzB,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,gBAAgB;IAyBxB,OAAO,CAAC,gCAAgC;IAqCxC;;;;;;;;;;;;OAYG;IACH,eAAe;IAIf;;;;;;;;;;OAUG;IACH,oBAAoB;IAIpB;;;;;;;;;;;;;OAaG;IACH,eAAe;IAIf;;;;;;;;;;;OAWG;IACH,gBAAgB;IAKhB;;;;;;;;;;;;;OAaG;IACH,eAAe,IAAI,OAAO;IAW1B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAMpF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAMpF;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAIrG;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,0BAA0B,CAAC,OAAO,EAAE,yCAAyC,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAMzH;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAUnB;;;;;;;;;;;;;;;;OAgBG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAc7B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,GAAG,IAAI;IAInE;;;;;;;;;;;;;;;;OAgBG;IACH,yBAAyB,CAAC,OAAO,EAAE,4BAA4B,GAAG,IAAI;IAItE;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM;IAepB;;;;;;;;;;;;;;;;;OAiBG;IACG,YAAY,IAAI,OAAO,CAAC,6BAA6B,CAAC;IAsB5D;;;;;;;;;;;;;;;;;;;OAmBG;IACH,sBAAsB,CAAC,OAAO,EAAE,qCAAqC,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAIxG;;;;;;;;;;;;;;;;;;OAkBG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAOnG;;;;;;;;;;;;OAYG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAQ5C;;;;;;;;;;;;OAYG;IACG,cAAc,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAQpD;;;;;;;;;;;;OAYG;IACG,yBAAyB,IAAI,OAAO,CAAC,8BAA8B,CAAC;IAQ1E;;;;;;;;;;;;OAYG;IACG,kBAAkB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAS5D;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,eAAe,CAAC,OAAO,EAAE,mCAAmC,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAM3G;;;;;;;;;;;;;;;;;;;OAmBG;IACG,mBAAmB,CAAC,OAAO,EAAE,uCAAuC,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAOnH;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IASnC;;;;;;;;;;;;;;OAcG;IACG,SAAS,CAAC,SAAS,UAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAI/D;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS;IAKlD;;;;;;;;;;;;;OAaG;IACG,eAAe;IAQrB;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQ1F;;;;;;;;;;;;OAYG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQ5E;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,cAAc,CAAC,OAAO,CAAC,EAAE;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IASjB;;;;;OAKG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAY9F;;;;;OAKG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAazF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAYvF;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAQrC;;;;;;;;;;;;OAYG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQvE;;;;;;;;;;;;OAYG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQvE;;;;;;;;;;;;OAYG;IACG,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAS1E;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,CAAC,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM;IAIhH;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,CAAC,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,IAAI;IAI3G;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,IAAI,OAAO,0BAA0B,EAAE,iBAAiB;IAIvE;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAMxC;;;;;;;;;;;;OAYG;IACG,kBAAkB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAQ5D;;;;;;;;;;;;;OAaG;IACG,mBAAmB,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAQ5D;;;;;;;;;;;;;;OAcG;IACG,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAQ5E;;;;;;;;;;;;;;;;OAgBG;IACG,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAkBrE;;;;;;;;;;;;;;;OAeG;IACG,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAkBhF;;;;;;;;;;;;;OAaG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAQvE;;;;;;;;;;;;;;OAcG;IACG,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAQ1F;;;;;;;;;;;;;OAaG;IACH,+BAA+B,IAAI,OAAO;IAI1C;;;;;;;;;OASG;IACH,aAAa,IAAI,CAAC,GAAG,CAAC;IAMtB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,+BAA+B,CACnC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,aAAa,EAAE,yCAAyC,CAAC;IAI3E;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,IAAI,OAAO,aAAa,EAAE,8BAA8B,GAAG,IAAI;IAIlF;;;;;;;;;;;;;OAaG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;;;;;;;;OAUG;IACH,qBAAqB,IAAI,IAAI;CAG9B"}

package/dist/lib/services/auth-service.d.ts

@@ -1,9 +1,10 @@
-import { AuthAPI, PassflowAuthorizationResponse, PassflowFederatedAuthExtendedPayload, PassflowFederatedAuthPayload, PassflowPasskeyAuthenticateStartPayload, PassflowPasskeyRegisterStartPayload, PassflowPasswordlessResponse, PassflowPasswordlessSignInCompletePayload, PassflowPasswordlessSignInPayload, PassflowSendPasswordResetEmailPayload, PassflowSignInPayload, PassflowSignUpPayload, PassflowSuccessResponse, PassflowValidationResponse, TokenExchangeConfig } from '../api';
+import { AuthAPI, PassflowAuthorizationResponse, PassflowFederatedAuthExtendedPayload, PassflowFederatedAuthPayload, PassflowPasskeyAuthenticateStartPayload, PassflowPasskeyRegisterStartPayload, PassflowPasswordlessResponse, PassflowPasswordlessSignInCompletePayload, PassflowPasswordlessSignInPayload, PassflowSendPasswordResetEmailPayload, PassflowSignInPayload, PassflowSignUpPayload, PassflowSuccessResponse, PassflowValidationResponse, TokenExchangeConfig, type UpgradeRefreshField } from '../api';
 import { DeviceService } from '../device';
 import { type PlatformAdapter } from '../platform';
 import { StorageManager } from '../storage';
 import { PassflowStore } from '../store';
 import { ParsedTokens, Tokens } from '../types';
+import { type UpgradeSessionPin } from '../upgrade/session';
 import { TokenCacheService } from './token-cache-service';
 /**
  * Service for handling authentication related functionality
@@ -54,7 +55,55 @@ export declare class AuthService {
     passwordlessSignIn(payload: PassflowPasswordlessSignInPayload): Promise<PassflowPasswordlessResponse>;
     passwordlessSignInComplete(payload: PassflowPasswordlessSignInCompletePayload): Promise<PassflowValidationResponse>;
     logOut(): Promise<void>;
-    refreshToken(): Promise<PassflowAuthorizationResponse>;
+    /**
+     * The session and user identity this client currently holds, or `undefined`
+     * when none is readable.
+     *
+     * Read from the stored access token's claims, which is the same source every
+     * other client-side session fact comes from. In a delivery mode that keeps
+     * the access token out of reach — a cookie-mode or BFF session — there is
+     * nothing to read and the answer is `undefined`.
+     */
+    readSessionPin(): UpgradeSessionPin | undefined;
+    /**
+     * Refuses to APPLY tokens that belong to a different principal (§13.4
+     * revision 6 / H2).
+     *
+     * Called immediately before the rotated tokens are written, which is the only
+     * place the check cannot be bypassed: the epoch guard around `prepare` and
+     * `commit` runs before the server call, and token application happens after
+     * it returns, so a logout and re-login in between let user A's flight write
+     * over user B's session.
+     *
+     * It throws `UpgradeSessionChangedError`, so the elevation terminates as
+     * §13.3's `session changed mid-flight` on every surface — the outcome class
+     * itself, not a transport failure that happens to carry the kind: this is the
+     * only entry point into token application, so a caller holding the promise
+     * directly (`AuthService.refreshToken`) must see the same `code` a waiter
+     * behind the controller does. It does NOT invalidate
+     * anything: `setSessionInvalid()` runs off a positive allow-list elsewhere,
+     * and the live user is never logged out as a side effect of someone else's
+     * abandoned flight. Fail-closed on token application, fail-open on session
+     * state — two different axes.
+     */
+    private assertSessionPin;
+    /**
+     * Refreshes the session, optionally committing an assurance upgrade.
+     *
+     * This is the ONLY token-storing path for all four delivery modes, which is
+     * why the upgrade commit goes through here rather than posting to
+     * `/auth/refresh` directly: it saves the rotated tokens, updates the cache and
+     * emits `Refresh`. Bypassing it would elevate the session on the server and
+     * leave the client holding stale tokens — everything looks fine until the next
+     * request 401s.
+     *
+     * An upgrade commit changes the error handling in one specific way: a 4xx is
+     * NOT treated as a dead session. The server answers a wrong code with a 401,
+     * and tearing the session down there is the logout-at-step-up defect. The
+     * upgrade transport classifies those failures and invalidates the session
+     * itself when the 401 turns out to be a genuine expiry.
+     */
+    refreshToken(upgrade?: UpgradeRefreshField, pin?: UpgradeSessionPin): Promise<PassflowAuthorizationResponse>;
     sendPasswordResetEmail(payload: PassflowSendPasswordResetEmailPayload): Promise<PassflowSuccessResponse>;
     resetPassword(newPassword: string, scopes?: string[]): Promise<PassflowAuthorizationResponse>;
     passkeyRegister(payload: PassflowPasskeyRegisterStartPayload): Promise<PassflowAuthorizationResponse>;

package/dist/lib/services/auth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../../lib/services/auth-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,OAAO,EACP,6BAA6B,EAE7B,oCAAoC,EACpC,4BAA4B,EAC5B,uCAAuC,EACvC,mCAAmC,EACnC,4BAA4B,EAC5B,yCAAyC,EACzC,iCAAiC,EACjC,qCAAqC,EACrC,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,mBAAmB,EAEpB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,eAAe,EAAoB,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAA+B,aAAa,EAAE,MAAM,UAAU,CAAC;AAGtE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;GAEG;AACH,qBAAa,WAAW;IAKpB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,aAAa;IACrB,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,iBAAiB;IACzB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,sBAAsB;IAC9B,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,KAAK,CAAC;IAEd,OAAO,CAAC,QAAQ;IAlBlB,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,mBAAmB,CAAC,CAAsB;gBAGxC,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,aAAa,EAC7B,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,MAAM,EAAE,EAChB,sBAAsB,EAAE,OAAO,EAC/B,GAAG,EAAE,MAAM,EACX,gBAAgB,EAAE;QACxB,aAAa,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,YAAY,CAAC,EAAE,YAAY,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9G,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;KACtC,EACO,KAAK,CAAC,EAAE,MAAM,YAAA,EACtB,mBAAmB,CAAC,EAAE,mBAAmB,EACjC,QAAQ,GAAE,eAA4B;IAchD;;OAEG;YACW,iBAAiB;IAO/B;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAsDxC;;;;OAIG;YACW,mBAAmB;IA6BjC;;OAEG;YACW,kBAAkB;IAwB1B,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAqF9E,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAgD9E,kBAAkB,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,4BAA4B,CAAC;IA6CrG,0BAA0B,CAAC,OAAO,EAAE,yCAAyC,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAyBnH,MAAM;IA4CN,YAAY,IAAI,OAAO,CAAC,6BAA6B,CAAC;IAqJtD,sBAAsB,CAAC,OAAO,EAAE,qCAAqC,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAcxG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC;IA0B7F,eAAe,CAAC,OAAO,EAAE,mCAAmC,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAuCrG,mBAAmB,CAAC,OAAO,EAAE,uCAAuC,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAwCnH,sBAAsB,CAAC,OAAO,EAAE,oCAAoC,GAAG,MAAM;IAsBvE,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC;IAwClF,yBAAyB,CAAC,OAAO,EAAE,4BAA4B,GAAG,IAAI;IAStE,eAAe,CAAC,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM;IA0BhH,YAAY,CAAC,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,IAAI;IAa3G;;;OAGG;IACH,eAAe,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO;IAgCpD;;OAEG;IACG,kBAAkB,CAAC,SAAS,UAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IA0BxE;;;;OAIG;IACG,SAAS,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA0CjE"}
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../../lib/services/auth-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,OAAO,EACP,6BAA6B,EAE7B,oCAAoC,EACpC,4BAA4B,EAC5B,uCAAuC,EACvC,mCAAmC,EACnC,4BAA4B,EAC5B,yCAAyC,EACzC,iCAAiC,EACjC,qCAAqC,EACrC,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,mBAAmB,EAEzB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,eAAe,EAAoB,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAA+B,aAAa,EAAE,MAAM,UAAU,CAAC;AAGtE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEhD,OAAO,EAAE,KAAK,iBAAiB,EAAqC,MAAM,oBAAoB,CAAC;AAE/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;GAEG;AACH,qBAAa,WAAW;IAKpB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,aAAa;IACrB,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,iBAAiB;IACzB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,sBAAsB;IAC9B,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,KAAK,CAAC;IAEd,OAAO,CAAC,QAAQ;IAlBlB,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,mBAAmB,CAAC,CAAsB;gBAGxC,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,aAAa,EAC7B,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,MAAM,EAAE,EAChB,sBAAsB,EAAE,OAAO,EAC/B,GAAG,EAAE,MAAM,EACX,gBAAgB,EAAE;QACxB,aAAa,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,YAAY,CAAC,EAAE,YAAY,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9G,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;KACtC,EACO,KAAK,CAAC,EAAE,MAAM,YAAA,EACtB,mBAAmB,CAAC,EAAE,mBAAmB,EACjC,QAAQ,GAAE,eAA4B;IAchD;;OAEG;YACW,iBAAiB;IAO/B;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAsDxC;;;;OAIG;YACW,mBAAmB;IA6BjC;;OAEG;YACW,kBAAkB;IAwB1B,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAqF9E,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAgD9E,kBAAkB,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,4BAA4B,CAAC;IA6CrG,0BAA0B,CAAC,OAAO,EAAE,yCAAyC,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAyBnH,MAAM;IA4CZ;;;;;;;;OAQG;IACH,cAAc,IAAI,iBAAiB,GAAG,SAAS;IAY/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;;;;;;;;;;;;;;OAeG;IACG,YAAY,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,6BAA6B,CAAC;IA8L5G,sBAAsB,CAAC,OAAO,EAAE,qCAAqC,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAcxG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC;IA0B7F,eAAe,CAAC,OAAO,EAAE,mCAAmC,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAuCrG,mBAAmB,CAAC,OAAO,EAAE,uCAAuC,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAwCnH,sBAAsB,CAAC,OAAO,EAAE,oCAAoC,GAAG,MAAM;IAsBvE,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC;IAwClF,yBAAyB,CAAC,OAAO,EAAE,4BAA4B,GAAG,IAAI;IAStE,eAAe,CAAC,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM;IA0BhH,YAAY,CAAC,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,IAAI;IAa3G;;;OAGG;IACH,eAAe,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO;IAgCpD;;OAEG;IACG,kBAAkB,CAAC,SAAS,UAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IA0BxE;;;;OAIG;IACG,SAAS,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA0CjE"}

package/dist/lib/upgrade/acr.d.ts

@@ -0,0 +1,85 @@
+/**
+ * The one implementation of "what level does this `acr_values` string demand".
+ *
+ * `challenge.ts` and `select.ts` both import it, so there is exactly one answer
+ * in this package (§13.2.1b). It is consistent with the Go model *where the Go
+ * model parses a single value* (`Level("2") === 2`) and deliberately diverges
+ * where Go parses a list as a scalar: `token_acr.go`'s `Level()` is
+ * `strconv.Atoi` over the whole string, so `Level("2 3")` is 0 — the weakest
+ * possible reading of the stronger demand, which inverts channel precedence in
+ * exactly the third-party interop case the precedence rule exists for.
+ *
+ * ## The lexical contract
+ *
+ * `acr_values` is a space-delimited list of values the server will accept (OIDC
+ * Core §3.1.2.1, RFC 9470 §3), and satisfying ANY listed value suffices. So the
+ * bar to clear is the list's MINIMUM participating level — the weakest value
+ * that satisfies the server, which is by definition what it is demanding.
+ *
+ * A token PARTICIPATES iff the whole token is decimal digits (`/^[0-9]+$/`).
+ * `"02"` participates as 2, matching `strconv.Atoi`. Everything else does not:
+ * `"2gold"`, `"gold"`, `"2.0"`, `"-1"`, `"+2"`, `"1e2"`, `"urn:example:gold"`,
+ * the empty token. Two deliberate narrowings:
+ *
+ *   - **Whole-token only.** `Number.parseInt("2gold", 10)` reads 2, which would
+ *     contradict the rule that opaque values do not participate — and would let
+ *     a hostile or buggy channel smuggle a bar out of a value nobody meant as a
+ *     level.
+ *   - **Negatives excluded**, even though `strconv.Atoi` accepts them. A
+ *     negative assurance level has no meaning in the Passflow scale or in OIDC,
+ *     and admitting one would hand an attacker a bar below every real level.
+ *
+ * Every non-negative integer is in domain. Passflow's scale is 0..3, but a
+ * third-party server may legally demand 4; the SDK never refuses a demand
+ * client-side (§13.4) — it ranks factors for the highest bar it knows and lets
+ * the server's verdict on the replay decide.
+ *
+ * ## "unknown" is not zero, and zero is not absent
+ *
+ * An opaque issuer-defined value (`urn:…`, `"gold"`) is legal OIDC and is NOT a
+ * level at all: scoring it 0 would make it the weakest possible requirement, so
+ * the other channel would always win and the anti-downgrade rule would itself
+ * produce a downgrade. A literal `"0"`, by contrast, IS a participating level
+ * that happens to demand nothing — OIDC defines `acr` 0 as authentication not
+ * meeting even ISO/IEC 29115 level 1, so a server listing it is stating it
+ * accepts unelevated authentication. Same net contribution (no constraint),
+ * different diagnostics.
+ */
+/** What an `acr_values` list demands, plus what it discarded getting there. */
+export type AcrReading = {
+    /**
+     * The bar this list demands: the minimum participating level, when that is a
+     * real constraint. `undefined` means this list contributes no `acr`
+     * constraint — it was absent, every token was non-participating, or the
+     * minimum participating level was `0`.
+     */
+    level?: number;
+    /** The raw list, verbatim, when one was present at all. */
+    raw?: string;
+    /** True when a list was present but no token participated (`"urn:example:gold"`). */
+    unorderable: boolean;
+    /** True when the minimum participating level was `0` — a demand of nothing. */
+    zero: boolean;
+};
+/**
+ * Parses one `acr_values` token. Returns `undefined` for every value that does
+ * not participate, which is the only distinction the comparator needs.
+ */
+export declare const parseAcrToken: (token: string) => number | undefined;
+/**
+ * Reduces an `acr_values` list to the bar it demands.
+ *
+ * The reducer is `min` over participating tokens; the cross-channel comparator
+ * (`challenge.ts`) then takes the `max` over per-channel minima, which is the
+ * monotonic lattice join and therefore can never resolve below a correctly
+ * parsed channel.
+ */
+export declare const readAcrValues: (raw: string | undefined | null) => AcrReading;
+/**
+ * The level an `acr_values` list demands, or `undefined` for no constraint.
+ *
+ * The convenience form `select.ts` wants: it ranks factors and has no use for
+ * the diagnostics.
+ */
+export declare const requiredAcrLevel: (raw: string | undefined | null) => number | undefined;
+//# sourceMappingURL=acr.d.ts.map

package/dist/lib/upgrade/acr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acr.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/acr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAKH,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,WAAW,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,IAAI,EAAE,OAAO,CAAC;CACf,CAAC;AAKF;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,MAAM,GAAG,SACmB,CAAC;AAE3E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,UA8B9D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,MAAM,GAAG,SAAqC,CAAC"}

package/dist/lib/upgrade/axios-adapter.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The AXIOS adapter over `handleChallenge`. Two of the four surfaces use it.
+ *
+ * **NO LOGIC IN AN ADAPTER.** It builds a `ChallengeContext` from an
+ * `AxiosError` and settles through `settleAxiosOutcome`; it parses no
+ * challenge, compares no bar, decides no scope, counts no retry and chooses no
+ * error class. The replay-once guard in particular is NOT here: the replay goes
+ * back through `request(config)` and re-enters this very interceptor, so the
+ * guard has to be surface-independent, and it is — the core reads and writes
+ * `markers.replayed`, and this file only says where that marker lives (on the
+ * request config, where axios hands it back unchanged).
+ *
+ * ## Why the parameter is structurally typed
+ *
+ * `ResponseInterceptorHost` is declared by us and satisfied by any axios
+ * instance. We never name axios' own types in the signature, so a customer on a
+ * different axios major — or on a fetch-based client that mimics the
+ * interceptor API — attaches without a type error, and this package's axios
+ * version is not a constraint on theirs.
+ *
+ * ## Why it is the error interceptor
+ *
+ * axios' own contract, expressed in `validateStatus`, is that a non-2xx
+ * response rejects, so a 401/403 arrives as an `AxiosError`. Resolving a
+ * declined step-up would invert that contract: every caller's post-`await`
+ * success path would run after the user clicked "Not now".
+ */
+import { type AbortView, type UpgradeInterceptorOptionsSource } from './core';
+/**
+ * The only thing we require of a client: that it lets us add and remove a
+ * response interceptor. Duck-typed deliberately — see the module comment.
+ */
+export type ResponseInterceptorHost = {
+    interceptors: {
+        response: {
+            use(onFulfilled?: (value: any) => any, onRejected?: (error: any) => any): number;
+            eject(id: number): void;
+        };
+    };
+};
+/** Re-issues a request from a config. Supplied by whoever owns the client. */
+export type AxiosReissue = (config: AxiosConfigLike) => Promise<unknown>;
+/** The subset of `AxiosRequestConfig` this adapter reads. */
+export type AxiosConfigLike = {
+    url?: string;
+    baseURL?: string;
+    method?: string;
+    data?: unknown;
+    headers?: unknown;
+    /**
+     * The caller's own signal, forwarded to the core untouched. Typed as the
+     * core's `AbortView` so an `AbortSignal`'s listener pair types through: that
+     * pair is what lets the core settle this caller at abort time while a proof
+     * is still pending (REQ-C12). A plain `{ aborted }` object is still accepted,
+     * and then the core reads the flag after the elevation as it always did.
+     */
+    signal?: AbortView;
+};
+/**
+ * The rejection handler itself: an `AxiosError` in, a replayed response or a
+ * tagged rejection out.
+ *
+ * Shared by `attachUpgradeAuth` (the customer's own instance) and by the SDK's
+ * internal seam, so both surfaces settle from the same table.
+ */
+export declare const createAxiosUpgradeHandler: (source: UpgradeInterceptorOptionsSource, reissue: AxiosReissue) => (error: unknown) => Promise<unknown>;
+/**
+ * Attaches step-up handling to a client the developer already owns, MUTATING
+ * it, and returns a disposer that ejects exactly the interceptor it added.
+ *
+ * It returns the disposer rather than the instance on purpose: it mutates, and
+ * returning the instance would invite `const api = attachAuth(axios.create())`
+ * and read as if it had built something. The disposer is also what a React
+ * effect needs.
+ *
+ * `reissue` defaults to the host's own `request`, duck-typed, so the replay
+ * goes back through the customer's interceptors, `baseURL` and adapter rather
+ * than through some instance of ours.
+ */
+export declare const attachUpgradeAuth: (host: ResponseInterceptorHost, source: UpgradeInterceptorOptionsSource, reissue?: AxiosReissue) => (() => void);
+//# sourceMappingURL=axios-adapter.d.ts.map

package/dist/lib/upgrade/axios-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"axios-adapter.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/axios-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,KAAK,SAAS,EAGd,KAAK,+BAA+B,EAIrC,MAAM,QAAQ,CAAC;AAMhB;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE;QACZ,QAAQ,EAAE;YAER,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,GAAG,MAAM,CAAC;YACjF,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;SACzB,CAAC;KACH,CAAC;CACH,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEzE,6DAA6D;AAC7D,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC;CACpB,CAAC;AAsMF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GACnC,QAAQ,+BAA+B,EAAE,SAAS,YAAY,MACxD,OAAO,OAAO,KAAG,OAAO,CAAC,OAAO,CActC,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,uBAAuB,EAC7B,QAAQ,+BAA+B,EACvC,UAAU,YAAY,KACrB,CAAC,MAAM,IAAI,CAiBb,CAAC"}

package/dist/lib/upgrade/challenge.d.ts

@@ -28,13 +28,70 @@ export declare const UPGRADE_REQUIRED = "upgrade_required";
  * valid — it means "re-prove a factor" without further qualification.
  */
 export type UpgradeChallenge = {
-    /** Required authentication context class (`acr`), e.g. `'2'`. */
+    /**
+     * Required authentication context class (`acr`), e.g. `'2'`.
+     *
+     * After a two-channel merge this is the raw list of the channel that SET THE
+     * BAR, with the header preferred on a numeric tie. A channel that contributed
+     * no level never supplies it — showing `"2gold"` as the bar would
+     * misrepresent what the server demanded.
+     */
     acrValues?: string;
+    /**
+     * The parsed bar: `max` over each channel's `min` participating level
+     * (§13.2.1a). `undefined` means unknown or unconstrained on this axis.
+     *
+     * Optional, and absent from the single-channel parsers' output, so
+     * `parseChallengeHeader` / `parseChallengeBody` keep the exact shape they
+     * ship with. `readUpgradeChallenge` always sets it when a level was parsed.
+     */
+    requiredLevel?: number;
     /** Maximum permitted age of the authentication event, in seconds. */
     maxAge?: number;
     /** The status that carried the challenge: 401 (protected resource) or 403 (session exchange). */
     status: number;
+    /**
+     * Every channel that PARSED AS A CHALLENGE in any field — not only the
+     * channels that won a comparison. An opaque header contributes no constraint
+     * yet must still be counted, because only something that saw and discarded it
+     * can report it. `length === 2` means "both channels carried a challenge".
+     *
+     * Set by `readUpgradeChallenge`; absent from the single-channel parsers.
+     */
+    channels?: ChallengeChannel[];
 };
+/** Which wire channel a challenge was read from. */
+export type ChallengeChannel = 'header' | 'body';
+/**
+ * `max_age` has three outcomes, not two, so it gets a three-valued return.
+ *
+ * - **absent** — the field was not sent. Silent; it contributes nothing and
+ *   there is nothing to report.
+ * - **invalid** — `<= 0`, or non-numeric. It contributes nothing AND raises
+ *   `'zero-constraint-ignored'`, because a literal `0` cannot be both "absent"
+ *   and "invalid" while the parser is required to tell them apart.
+ * - **valid** — a positive number of seconds.
+ *
+ * Treating `0` as invalid is a deliberate narrowing of RFC 9470 §3, which
+ * permits `max_age=0` as a maximally strict freshness demand. Two reasons: this
+ * parser already accepted only values `> 0` before §13, so preserving zero
+ * would be a behaviour change on a shipped parser rather than a gap in it; and
+ * under "smaller positive wins" a literal `0` from a buggy serializer or a
+ * hostile body would force re-proof on EVERY request — an unauthenticated
+ * denial-of-service against the user's own session. Recorded as a known
+ * deviation so a later reader does not "fix" it.
+ */
+export type MaxAgeReading = {
+    kind: 'absent';
+} | {
+    kind: 'invalid';
+    raw: unknown;
+} | {
+    kind: 'valid';
+    value: number;
+};
+/** Reads `max_age` into its three outcomes. See `MaxAgeReading`. */
+export declare const parseMaxAge: (raw: unknown) => MaxAgeReading;
 /**
  * Reads a upgrade challenge out of a `WWW-Authenticate` header, or returns
  * `undefined` when the header is absent or describes some other failure.
@@ -50,9 +107,107 @@ export declare const parseChallengeHeader: (header: string | undefined | null, s
  * even though it also sets the standard header.
  */
 export declare const parseChallengeBody: (body: unknown, status: number) => UpgradeChallenge | undefined;
+/** The bar a challenge demanded, or an elevation reached, on both axes. */
+export type AssuranceBar = {
+    /** The raw winning `acr_values` list, for display and diagnostics. */
+    acrValues?: string;
+    /** The parsed bar. `undefined` = unknown, or not constrained on this axis. */
+    level?: number;
+    /** The freshness constraint, when that is what was demanded. */
+    maxAge?: number;
+};
+/** The reasons the SDK can decline to act on a challenge, or act on a suspect one. */
+export type UpgradeDiagnosticReason = 'no-channel' | 'header-required-but-absent' | 'channels-disagree' | 'channels-unorderable' | 'zero-constraint-ignored' | 'challenge-out-of-scope' | 'elevated-insufficient' | 'replay-unsupported';
+/**
+ * One diagnostic record.
+ *
+ * A diagnostic is the only observable signal of the response-rewriting and the
+ * misconfiguration this design warns about, so it routes through a callback
+ * whose DEFAULT sink is `console.warn` — never `debug`, which is invisible in
+ * every default configuration. A deployment where step-up silently never fires
+ * must be distinguishable from one where it was never required.
+ */
+export type UpgradeDiagnostic = {
+    status: number;
+    /**
+     * The request's URL. The parser does not know it — it is handed a status, a
+     * header reader and a body — so it emits `''` and the core, which owns the
+     * request context, fills it in before forwarding to the sink.
+     */
+    url: string;
+    reason: UpgradeDiagnosticReason;
+    detail?: {
+        obtained?: AssuranceBar;
+        required?: AssuranceBar;
+        /** Raw channel inputs, including values discarded as unorderable. */
+        header?: string;
+        body?: string;
+        /** Which field was discarded, for `'zero-constraint-ignored'`. */
+        field?: 'acr_values' | 'max_age';
+        /** Which operation, for per-waiter reasons. */
+        method?: string;
+        /** A human-readable sentence naming the fix. The default sink prints it. */
+        message?: string;
+    };
+};
+/** Where diagnostics go. `console.warn` is the default sink, not the only one. */
+export type UpgradeDiagnosticSink = (diagnostic: UpgradeDiagnostic) => void;
+/** What `readUpgradeChallenge` is given. The CALLER decides whether reading the body is in scope. */
+export type ChallengeInput = {
+    status: number;
+    getHeader: (name: string) => string | undefined | null;
+    /** Pre-read. Omit it — do not pass `undefined` lazily — when the body must not be read. */
+    body?: unknown;
+};
+export type ChallengeReadOptions = {
+    /**
+     * `'header'` takes the challenge from the header ONLY: the body is not read
+     * for challenge purposes at all, and a 401/403 with no parseable header is a
+     * non-challenge. For an integrator whose compliance rule names RFC 9470, or
+     * who does not consider a third-party server's body authoritative. Two
+     * intended consequences: a strictly stronger body is ignored, and since no
+     * body is resolved the disagreement diagnostic never fires.
+     *
+     * There is deliberately no `'body'` value. Excluding a third-party API's
+     * standard header is what `shouldIntercept` is for, and a `'body'` setting
+     * would mandate a non-standard channel, which §13.1a forbids.
+     */
+    requireChallengeChannel?: 'header';
+};
+/**
+ * What a parse found, and what it had to discard finding it.
+ *
+ * A pure parser returning its findings beats a sink parameter: it is
+ * side-effect-free and directly testable against a fixture corpus, and
+ * `'channels-disagree'`, `'zero-constraint-ignored'` and
+ * `'channels-unorderable'` are knowable ONLY inside the parse — the shipped
+ * parser discarded them before returning, which is why they could not be
+ * surfaced at all.
+ */
+export type ChallengeReading = {
+    challenge?: UpgradeChallenge;
+    /** `[]` when there is nothing to report. Never `undefined`. */
+    diagnostics: UpgradeDiagnostic[];
+};
+/**
+ * Reads a step-up challenge from both channels at once, merging them field-wise
+ * and reporting everything it discarded.
+ *
+ * The additive sibling of `parseUpgradeChallenge`, which keeps its shipped
+ * three-parameter signature and delegates here. It keeps the `getHeader`
+ * callback form — the reason the function works from both the fetch surface and
+ * the axios surface, where `AxiosError.response` hands back a plain object
+ * rather than a DOM `Headers`.
+ */
+export declare const readUpgradeChallenge: (input: ChallengeInput, options?: ChallengeReadOptions) => ChallengeReading;
 /**
- * Resolves a upgrade challenge from a response, checking the standard header
- * first and falling back to the session-exchange body.
+ * Resolves a upgrade challenge from a response, from either channel.
+ *
+ * The SHIPPED export: same name, same three parameters, same return, published
+ * in `@passflow/core@0.14.1`. It is now a thin delegate over
+ * `readUpgradeChallenge`, so there is one merge rule rather than two parsers
+ * that can drift — but it discards the diagnostics, which is why a caller that
+ * needs them (the core) calls the sibling directly.
  *
  * Returns `undefined` for every response that is not a upgrade challenge —
  * including ordinary `401`s, which callers must keep treating as "session

package/dist/lib/upgrade/challenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,mFAAmF;AACnF,eAAO,MAAM,gCAAgC,qCAAqC,CAAC;AAEnF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AA0CF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,GAAG,SAAS,GAAG,IAAI,EAAE,QAAQ,MAAM,KAAG,gBAAgB,GAAG,SAe3G,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,OAAO,EAAE,QAAQ,MAAM,KAAG,gBAAgB,GAAG,SAerF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAChC,QAAQ,MAAM,EACd,WAAW,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EACtD,OAAO,OAAO,KACb,gBAAgB,GAAG,SAKrB,CAAC"}
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,mFAAmF;AACnF,eAAO,MAAM,gCAAgC,qCAAqC,CAAC;AAEnF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAC/B,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAoCjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtH,oEAAoE;AACpE,eAAO,MAAM,WAAW,GAAI,KAAK,OAAO,KAAG,aAM1C,CAAC;AAQF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,GAAG,SAAS,GAAG,IAAI,EAAE,QAAQ,MAAM,KAAG,gBAAgB,GAAG,SAe3G,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,OAAO,EAAE,QAAQ,MAAM,KAAG,gBAAgB,GAAG,SAerF,CAAC;AA4BF,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG;IACzB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,sFAAsF;AACtF,MAAM,MAAM,uBAAuB,GAC/B,YAAY,GACZ,4BAA4B,GAC5B,mBAAmB,GACnB,sBAAsB,GACtB,yBAAyB,GACzB,wBAAwB,GACxB,uBAAuB,GACvB,oBAAoB,CAAC;AAEzB;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,uBAAuB,CAAC;IAChC,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,YAAY,CAAC;QACxB,QAAQ,CAAC,EAAE,YAAY,CAAC;QACxB,qEAAqE;QACrE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,kEAAkE;QAClE,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;QACjC,+CAA+C;QAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,4EAA4E;QAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH,CAAC;AAEF,kFAAkF;AAClF,MAAM,MAAM,qBAAqB,GAAG,CAAC,UAAU,EAAE,iBAAiB,KAAK,IAAI,CAAC;AAE5E,qGAAqG;AACrG,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IACvD,2FAA2F;IAC3F,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;;;;;;;;;OAWG;IACH,uBAAuB,CAAC,EAAE,QAAQ,CAAC;CACpC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,+DAA+D;IAC/D,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC,CAAC;AAqBF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAAI,OAAO,cAAc,EAAE,UAAU,oBAAoB,KAAG,gBAsG5F,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,GAChC,QAAQ,MAAM,EACd,WAAW,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EACtD,OAAO,OAAO,KACb,gBAAgB,GAAG,SAAwE,CAAC"}

package/dist/lib/upgrade/client.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `createClient` — the greenfield surface, for a developer with no HTTP client
+ * of their own.
+ *
+ * It is **not a fourth code path**: it is `axios.create(config)` followed by the
+ * axios adapter, which is why it cannot drift from `attachAuth`. The attach is
+ * passed in rather than imported so this module holds no scope, no controller
+ * and no options — only the constructor.
+ *
+ * It also costs no new dependency: `axios` is already a hard dependency of this
+ * package. This is the one place axios' own types are deliberately back on the
+ * public surface — `attachAuth`'s structural `ResponseInterceptorHost` exists to
+ * avoid exactly that, and the asymmetry is the point: a developer asking us to
+ * BUILD their client has accepted axios, while one handing us their own must not
+ * be pinned to our major.
+ */
+import { type AxiosInstance, type CreateAxiosDefaults } from 'axios';
+import type { ResponseInterceptorHost } from './axios-adapter';
+/**
+ * axios' own create options plus nothing of ours, so `baseURL`, `headers`,
+ * `timeout`, `adapter` and interceptor ordering all stay the customer's.
+ *
+ * A `baseURL` is NOT read as a declared backend: that would be the derived
+ * interception model through a side door. An un-declared `baseURL` gets a
+ * `'challenge-out-of-scope'` diagnostic naming `backend` as the fix.
+ */
+export type CreateClientConfig = CreateAxiosDefaults;
+export declare const createUpgradeClient: (config: CreateClientConfig | undefined, attachAuth: (host: ResponseInterceptorHost) => () => void) => AxiosInstance;
+//# sourceMappingURL=client.d.ts.map

package/dist/lib/upgrade/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAc,EAAE,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAE5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAErD,eAAO,MAAM,mBAAmB,GAC9B,QAAQ,kBAAkB,GAAG,SAAS,EACtC,YAAY,CAAC,IAAI,EAAE,uBAAuB,KAAK,MAAM,IAAI,KACxD,aAIF,CAAC"}