@passflow/core 0.14.1 → 0.16.0

package/dist/lib/upgrade/controller.d.ts

@@ -1,27 +1,107 @@
 /**
- * Upgrade orchestration.
+ * Upgrade orchestration — ONE state machine, and it is the single authority for
+ * lifecycle.
  *
  * Turns a parsed RFC 9470 challenge into an elevated session: pick a factor,
  * ask the user, run the prepare round if the factor needs one, assert, then
  * commit through `POST /auth/refresh` with the `upgrade` field.
  *
  * The controller owns no UI. It calls out to a prompt handler, which the React
- * layer (or any consumer) implements — that is what keeps the same logic
- * usable from a headless client.
+ * layer (or any consumer) implements — that is what keeps the same logic usable
+ * from a headless client.
+ *
+ * ## Why a state machine rather than rules
+ *
+ * Three review rounds each found two independently-correct lifecycle fixes
+ * colliding: fold-versus-single-flight, replay-binding-versus-aggregation, and
+ * a prompt outliving the flight whose state had already been cleared. The cause
+ * was not any individual rule — it was that lifecycle was specified as rules
+ * scattered across four sections, so two of them could each be locally right
+ * and jointly impossible. Everything about when state is set, read and cleared
+ * lives here, and nothing else writes these fields.
+ *
+ * ## The states
+ *
+ * | state        | meaning                                                        |
+ * |--------------|----------------------------------------------------------------|
+ * | `idle`       | no flight; every field clear; `inFlight === null`               |
+ * | `collecting` | prompt open, no factor selected yet                             |
+ * | `proving`    | a factor is selected; `prepare`/commit on the wire              |
+ * | `replaying`  | proof accepted; waiters replaying their own bound requests      |
+ * | `settling`   | every waiter has reported; the summary is complete              |
+ * | `done`       | prompt settled and every waiter settled; one step from `idle`   |
+ *
+ * ## The decision that shapes all of it
+ *
+ * **An elevation ends when every waiting request has been retried and settled.**
+ * Proof acceptance does NOT end the flight. The previous implementation cleared
+ * `inFlight` in a `.finally` on proof completion, and that `.finally` was a real
+ * window: a prompt on screen with `inFlight === null`, in which an unrelated
+ * challenged request opened a SECOND modal and a waiter could report into a
+ * controller that had already forgotten its flight. Clearing happens in one
+ * synchronous step, after the prompt has settled, and nowhere else.
+ *
+ * Two costs the design accepts for that: the prompt stays open for one extra
+ * round trip while the replays settle, and a genuinely new challenge arriving in
+ * that window queues behind the flight rather than opening a second prompt.
  */
-import type { UpgradeChallenge } from './challenge';
+import type { AssuranceBar, UpgradeChallenge } from './challenge';
 import { type UpgradeAssertion, type UpgradeFactor, type UpgradeFactorType, type UpgradePrepared } from './factors';
 import type { PlatformAdapter } from '../platform';
-/** What the UI is shown when a upgrade is required. */
+/** What the UI is shown when an upgrade is required. */
 export type UpgradePromptRequest = {
-    /** What the server demanded. */
+    /** What the server demanded — the MERGED requirement, when several challenges joined. */
     challenge: UpgradeChallenge;
     /** Usable factors, already ordered — the suggested one first. */
     factors: readonly UpgradeFactor[];
     /** Failure from the previous attempt, when the user is retrying. */
     previousError?: Error;
+    /**
+     * Called the moment the user picks a factor and BEFORE any answer is
+     * submitted. REQUIRED of every prompt implementation — the SDK's own modal,
+     * the `useUpgrade` hook and a render-prop override alike.
+     *
+     * `selected` is defined off this call and off nothing else. Deriving it from
+     * `prompt` resolving would implement the SUBMISSION boundary instead: the
+     * shipped `UpgradePromptResult` resolves with the code already collected, so
+     * `selected` would stay false for the whole interval in which the user has
+     * picked TOTP and is typing six digits — and a stronger challenge arriving
+     * then would re-rank the list under their fingers, the exact UI jump the
+     * selection boundary exists to prevent.
+     *
+     * An override that never calls it leaves the controller in `collecting` for
+     * the whole ceremony, so a late join re-ranks mid-entry: degraded, not silent,
+     * because `onRequirementRaised` still fires and the re-rank is observable.
+     */
+    onFactorSelected: (factor: UpgradeFactorType) => void;
+    /**
+     * The channel by which the controller pushes a raised bar and a re-ranked list
+     * into an OPEN prompt, which updates without resolving. Only ever used before
+     * a factor is selected (branch 2). The one-answer resolution contract is
+     * unchanged.
+     *
+     * A prompt SUBSCRIBES by assigning its own handler to this field on the
+     * request object it was handed, synchronously, before it awaits anything:
+     *
+     * ```ts
+     * const prompt: UpgradePromptHandler = (request) => {
+     *   request.onRequirementRaised = (next) => setView(next);
+     *   return collectAnswer(request);
+     * };
+     * ```
+     *
+     * It is a slot rather than a controller-supplied function because the
+     * direction is controller → prompt: only the prompt knows how to re-render
+     * itself. An override that leaves it unset shows the old bar, and the raised
+     * bar then surfaces as a re-challenged replay reporting `insufficient` —
+     * degraded, never silent.
+     */
+    onRequirementRaised?: (next: {
+        challenge: UpgradeChallenge;
+        factors: readonly UpgradeFactor[];
+    }) => void;
 };
-/** The user's answer to a upgrade prompt. */
+/** The user's answer to an upgrade prompt. */
 export type UpgradePromptResult = {
     type: 'submit';
     factor: UpgradeFactorType;
@@ -33,28 +113,185 @@ export type UpgradePromptResult = {
 export type UpgradePromptHandler = (request: UpgradePromptRequest) => Promise<UpgradePromptResult>;
 /** Transport seam — the controller never touches axios directly, so it stays testable. */
 export type UpgradeTransport = {
-    /** `POST /auth/upgrade/begin`. Only called for factors whose `requiresPrepare` is true. */
-    prepare(method: UpgradeFactorType): Promise<UpgradePrepared>;
+    /**
+     * `POST /auth/upgrade/start`. Only called for factors whose `requiresPrepare`
+     * is true.
+     *
+     * Resolves `undefined` when no prepare round was needed after all — a one-shot
+     * factor, or a server that answers `prepare_not_required` because its view of
+     * the factor differs from ours. Both are recoveries: the factor then asserts
+     * with no `prepared`, which is already the TOTP path.
+     */
+    prepare(method: UpgradeFactorType): Promise<UpgradePrepared | undefined>;
     /** `POST /auth/refresh` carrying `upgrade`. Resolves once elevated tokens are stored. */
     commit(factor: UpgradeFactorType, assertion: UpgradeAssertion): Promise<void>;
 };
+/** The six states. The controller is always in exactly one. */
+export type UpgradeFlightState = 'idle' | 'collecting' | 'proving' | 'replaying' | 'settling' | 'done';
+/**
+ * Who is waiting on this elevation.
+ *
+ * A `request` waiter owns a replay bound to its own URL and method. An
+ * `imperative` waiter has nothing to replay, but when its caller STATED a bar
+ * it still has a locally checkable requirement — which is why `requested`
+ * exists, and why an AAL3 imperative call joining an AAL2 flight can no longer
+ * be reported as `elevated`.
+ */
+export type Waiter = {
+    kind: 'request';
+    url: string;
+    method: string;
+} | {
+    kind: 'imperative';
+    requested?: AssuranceBar;
+};
+/** A waiter's terminal classification. `pending` until it reports. */
+export type WaiterOutcome = 'pending' | 'replayed' | 'insufficient' | 'failed';
+/** What a waiter reports once its own replay has settled. */
+export type WaiterReport = {
+    outcome: 'replayed' | 'insufficient' | 'failed';
+    obtained?: AssuranceBar;
+    required?: AssuranceBar;
+};
+/**
+ * A registered waiter.
+ *
+ * `report()` is the declared inbound edge: classification happens in the
+ * adapter, after `elevate()` resolved, and this is the channel by which it
+ * reaches the controller. Because `waiters` is cleared in the final transition
+ * rather than on proof completion, the entries are still alive when the summary
+ * reads them.
+ */
+export type WaiterEntry = Waiter & {
+    outcome: WaiterOutcome;
+    obtained?: AssuranceBar;
+    required?: AssuranceBar;
+    /** Called exactly once. Idempotent: later calls are ignored. */
+    report(result: WaiterReport): void;
+};
+/** The proof's own outcome, which is NOT any operation's outcome. */
+export type UpgradeProof = {
+    status: 'proven';
+    obtained: AssuranceBar;
+} | {
+    status: 'failed';
+    reason: Error;
+};
+/** What a successful `elevate()` hands back to its caller. */
+export type UpgradeElevation = {
+    /** This caller's own registered waiter. `report()` is its edge back. */
+    waiter: WaiterEntry;
+    /** The bar the proof reached, as far as the client can know it. */
+    obtained: AssuranceBar;
+};
+/** One row of the per-flight outcome summary. */
+export type UpgradeWaiterSummary = {
+    url?: string;
+    method?: string;
+    outcome: WaiterOutcome;
+    obtained?: AssuranceBar;
+    required?: AssuranceBar;
+};
+/**
+ * The per-flight outcome summary: a pure function of `waiters` plus `proof`.
+ *
+ * `terminal` is what the prompt may report. The modal must NOT say "success"
+ * while any waiter is re-challenged — for AAL3 endpoints with TOTP-only users
+ * that is the NORMAL path, not an edge case, and a design cannot both claim the
+ * server is the authority and delete the path by which its second refusal
+ * reaches the user.
+ */
+export type UpgradeFlightSummary = {
+    proof: UpgradeProof;
+    waiters: UpgradeWaiterSummary[];
+    terminal: 'success' | 'insufficient' | 'failed';
+    /** The bars of the STRONGEST unmet waiter, so the message is honest. */
+    insufficient?: {
+        obtained: AssuranceBar;
+        required: AssuranceBar;
+    };
+    /** The proof failure, when the flight never produced a proof. */
+    error?: Error;
+};
 export type UpgradeControllerOptions = {
     transport: UpgradeTransport;
     prompt: UpgradePromptHandler;
     platform: PlatformAdapter;
     /** Defaults to the factors this SDK can complete. */
     factors?: readonly UpgradeFactor[];
-    /** How many times the user may answer wrongly before the elevation gives up. Server allows four. */
+    /** How many times the user may answer wrongly before the elevation gives up. */
     maxAttempts?: number;
+    /**
+     * The bar the elevation actually reached, when the host can read it — from the
+     * `acr` claim of the freshly stored access token, for instance.
+     *
+     * Without it the controller reports the bar the ceremony was RANKED for, which
+     * is the honest client-side approximation: the server scores `acr` from the
+     * base session plus the verified factor and is the only authority, and a
+     * replay that is re-challenged corrects the approximation immediately.
+     */
+    readObtainedBar?: () => AssuranceBar | undefined;
+    /**
+     * Called once per flight, in the settling transition, after every waiter has
+     * reported. This is how the open prompt is given its terminal state, and how
+     * the React layer gets exactly one terminal state per flight.
+     */
+    onFlightSettled?: (summary: UpgradeFlightSummary) => void;
+    /**
+     * Liveness guard: how long to wait for waiters to report before settling the
+     * flight anyway. A waiter that never calls `report()` is an adapter bug, and
+     * without a bound it would hold `inFlight` open forever — so every later
+     * elevation would join a dead flight, which is a worse failure than settling
+     * early. Defaults to 30s.
+     */
+    replaySettleTimeoutMs?: number;
 };
-/** Raised when the user dismissed the upgrade rather than failing it. */
+/**
+ * Raised when the user dismissed the upgrade rather than failing it.
+ *
+ * `cause` is carried for one case only: a prompt implementation that threw or
+ * rejected is treated as a failed COLLECTION and settles on the cancellation
+ * contract, because there is no answer and no proof — but the thrown error is
+ * the only evidence of an integration bug, so it travels rather than being
+ * swallowed.
+ */
 export declare class UpgradeCancelledError extends Error {
-    constructor();
+    readonly code: "upgrade_cancelled";
+    /** Declared here rather than inherited: `Error.cause` is ES2022, this build targets ES2021 libs. */
+    readonly cause?: unknown;
+    constructor(cause?: unknown);
 }
 /** Raised when no registered factor can satisfy the challenge. */
 export declare class UpgradeUnsatisfiableError extends Error {
+    readonly code: "upgrade_unsatisfiable";
     constructor(message?: string);
 }
+/** The bar a challenge demands, in the shape the errors and the hook share. */
+export declare const barOf: (challenge: UpgradeChallenge) => AssuranceBar;
+/**
+ * Does `obtained` reach `required`?
+ *
+ * Only the `acr` axis is decidable client-side. A completed proof always
+ * satisfies a freshness demand, since it just happened, and a requirement with
+ * no level constrains nothing on this axis — so both of those are `true`.
+ *
+ * **An UNKNOWN obtained level does not meet a bar.** This is the one place in
+ * the feature where fail-open is wrong, and §13.4 revision 6 draws the line
+ * explicitly: fail-open governs *recovery* — availability, not logging the user
+ * out, not blocking the app — never the *granting of access*. Answering "meets"
+ * for a level we could not read is granting access on no evidence.
+ *
+ * It is NOT pre-judging satisfiability, and the difference is what §13.2 line
+ * 1599 and §13.4 line 2213 protect: nothing is refused outright, no elevation
+ * is declined, no factor is filtered. The SDK merely declines to ASSERT that a
+ * bar was reached; the server's replay re-challenge decides, and that surfaces
+ * as §13.3's `insufficient` with both bars attached. The only waiters this can
+ * settle locally are imperative ones that STATED a bar, which have no replay to
+ * ask the server about.
+ */
+export declare const barMeets: (obtained: AssuranceBar, required: AssuranceBar) => boolean;
+/** Field-wise merge of two requirements: `acr` tightens up, freshness tightens down. */
+export declare const mergeChallenges: (current: UpgradeChallenge, incoming: UpgradeChallenge) => UpgradeChallenge;
 export declare class UpgradeController {
     private readonly transport;
     private readonly prompt;
@@ -62,33 +299,137 @@ export declare class UpgradeController {
     private readonly registry;
     private readonly available;
     private readonly maxAttempts;
+    private readonly readObtainedBar?;
+    private readonly onFlightSettled?;
+    private readonly settleTimeoutMs;
+    /** The current state. Public for diagnostics and tests; nothing outside writes it. */
+    private state;
     /**
      * The elevation currently running.
      *
-     * Upgrade is single-flight on purpose. A screen that fires several protected
-     * requests at once gets several challenges, and every one of them must land
-     * on ONE prompt — otherwise the user sees a stack of modals and every
-     * additional elevation burns a challenge for nothing.
+     * Single-flight is the STATE SET, not a flag: `elevate` returns the existing
+     * flight in every state but `idle`, and starts one only from `idle`. A screen
+     * that fires several protected requests at once gets several challenges, and
+     * every one of them must land on ONE prompt — otherwise the user sees a stack
+     * of modals and every extra elevation burns a challenge for nothing.
      */
     private inFlight;
+    /** The merged requirement. Written at registration and at every join. */
+    private requirement;
+    /** Non-null from the moment the prompt reports a selection, and from nowhere else. */
+    private selected;
+    /** The requirement in force when the factor was selected — what the ceremony was ranked for. */
+    private rankedRequirement;
+    private registrations;
+    private proof;
+    /** Factors the SERVER refused for this user, dropped for the duration of this flight only. */
+    private pruned;
+    /** The request handed to the open prompt. Its `onRequirementRaised` slot is branch 2's channel. */
+    private openPrompt;
+    /** Set while `awaitReports` is waiting; called by the reporting path. See H7. */
+    private reportsSettled?;
     constructor(options: UpgradeControllerOptions);
+    /** The current lifecycle state. Read-only. */
+    get currentState(): UpgradeFlightState;
+    /** True while a flight is open — from the first challenge until the last waiter settled. */
+    get active(): boolean;
     /**
      * Elevates the session so the challenged request can be retried.
      *
-     * Concurrent callers share one elevation: the first starts it, the rest await
-     * the same promise and all resolve together. Callers retry their own request
-     * once this resolves; it rejects if the user cancelled or ran out of attempts.
+     * Every call registers a waiter, including the imperative one. Concurrent
+     * callers share one elevation and one prompt; the returned promise settles for
+     * THIS caller when the proof settles, and carries that caller's own waiter
+     * entry so it can report its replay's outcome back.
+     *
+     * It resolves when the server accepted a factor and recorded the elevation. It
+     * rejects for cancelled, exhausted, unsatisfiable, unavailable, session-changed
+     * and non-retryable transport failure — and, for a waiter whose own demanded
+     * bar the proof did not reach, with `UpgradeInsufficientError`.
+     */
+    elevate(challenge: UpgradeChallenge, waiter?: Waiter): Promise<UpgradeElevation>;
+    /** Registers a waiter and the bar it arrived demanding. */
+    private register;
+    /**
+     * Folds a joining challenge into the running flight.
+     *
+     * The boundary is factor SELECTION. Before it, nothing is on the wire and
+     * there is no race, so a strictly stronger challenge folds in place: the
+     * requirement rises, the list is re-ranked for the higher bar, and the open
+     * prompt is told. After it, a ceremony is running — a `prepare` round trip, a
+     * TOTP commit, a WebAuthn ceremony holding the platform authenticator — and
+     * neither interrupting it nor starting a second concurrent flight is
+     * acceptable, so it completes at the bar it was ranked for and each waiter's
+     * own replay decides its own fate.
+     */
+    private join;
+    /** The factors to offer right now: ranked for the merged bar, minus what the server refused. */
+    private offeredFactors;
+    /** The waiter's inbound edge. Idempotent — a second call is ignored. */
+    private receiveReport;
+    /** Resolves `awaitReports`' promise when the last outstanding report lands. */
+    private notifyReportsSettled;
+    /**
+     * The flight, start to finish.
+     *
+     * Nothing here clears state: clearing is one synchronous step at the very end,
+     * after the prompt has settled, so nothing can observe a half-cleared
+     * controller and no waiter can report into a flight the controller has
+     * forgotten.
+     */
+    private runFlight;
+    /**
+     * Settles one waiter against the proof.
+     *
+     * An imperative waiter has no operation to replay, so it is classified here
+     * and nowhere else: with no stated bar it simply succeeded, and with a stated
+     * bar the proof is checked against it — which is what stops an AAL3 imperative
+     * call that joined an AAL2 flight from resolving as though it had been
+     * elevated to AAL3.
+     *
+     * A REQUEST waiter is never pre-judged here, and §13 is explicit about it
+     * twice: "a demand above 3 is never refused client-side — the SDK does not
+     * pre-judge satisfiability (§13.4) — it ranks factors for the highest bar it
+     * knows and lets the server's replay re-challenge decide, surfacing as
+     * §13.3's `insufficient`", and "never refuse outright on the default path".
+     * The reason is not conformance alone: the client-side comparison is the
+     * fragile half — ACR ordinals, the minimum-of-list rule — so refusing here
+     * can skip a replay the server would have accepted, and it loses the
+     * `elevated-insufficient` diagnostic the replay path raises. So the waiter is
+     * released whatever the bar comparison says; `handleChallenge` replays, reads
+     * the server's answer, and reports `insufficient` if that is what it is.
+     */
+    private release;
+    /**
+     * Waits for every released waiter to report, under the liveness bound.
+     *
+     * Report-driven, not polled. The previous implementation re-armed a
+     * `setTimeout(…, 0)` until the last waiter reported, which burned a timer per
+     * event-loop turn for the whole replay window and made the state machine
+     * untestable under fake timers — `runAllTimers()` never terminates against a
+     * self-re-arming zero-delay timer. `receiveReport` is the one edge on which a
+     * waiter stops being pending, so it resolves this promise directly.
+     *
+     * The deadline stays: a waiter that never reports is an adapter bug, and
+     * settling it as `failed` is better than holding `inFlight` open forever,
+     * which would make every later elevation join a dead flight.
      */
-    elevate(challenge: UpgradeChallenge): Promise<void>;
-    private run;
+    private awaitReports;
+    /** The summary: a pure function of the waiters and the proof. */
+    private summarise;
     /**
-     * Runs one full proof for a single factor.
+     * Collects an answer and proves it, re-prompting on every recoverable failure.
      *
-     * The prepare round is re-run on every attempt rather than cached: a
-     * challenge is single-use and the server consumes it atomically, so a failed
-     * attempt has already spent it. Reusing the id would fail with
+     * The prepare round is re-run on every attempt rather than cached: a challenge
+     * is single-use and the server consumes it atomically, so a failed attempt has
+     * already spent it. Reusing the id would fail with
      * `ErrorUpgradeChallengeInvalid` and look like a bad code to the user.
      */
+    private prove;
+    /** Opens (or re-opens) the prompt and wires the two prompt → controller edges. */
+    private collect;
+    /** Maps a proof failure to a terminal reason, or `undefined` when the user may retry. */
+    private classifyProofFailure;
+    /** Runs one full proof for a single factor. */
     private proveAndCommit;
 }
 //# sourceMappingURL=controller.d.ts.map

package/dist/lib/upgrade/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAElB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAErB,MAAM,WAAW,CAAC;AAGnB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,uDAAuD;AACvD,MAAM,MAAM,oBAAoB,GAAG;IACjC,gCAAgC;IAChC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,iEAAiE;IACjE,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAClC,oEAAoE;IACpE,aAAa,CAAC,EAAE,KAAK,CAAC;CACvB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,mBAAmB,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEpH,8EAA8E;AAC9E,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAEnG,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG;IAC7B,2FAA2F;IAC3F,OAAO,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7D,yFAAyF;IACzF,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/E,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,QAAQ,EAAE,eAAe,CAAC;IAC1B,qDAAqD;IACrD,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC,oGAAoG;IACpG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,yEAAyE;AACzE,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C;AAED,kEAAkE;AAClE,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,SAAkE;CAItF;AASD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAA8B;gBAElC,OAAO,EAAE,wBAAwB;IAS7C;;;;;;OAMG;IACH,OAAO,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;YAUrC,GAAG;IAoCjB;;;;;;;OAOG;YACW,cAAc;CAK7B"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAElB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAErB,MAAM,WAAW,CAAC;AAGnB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,wDAAwD;AACxD,MAAM,MAAM,oBAAoB,GAAG;IACjC,yFAAyF;IACzF,SAAS,EAAE,gBAAgB,CAAC;IAC5B,iEAAiE;IACjE,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAClC,oEAAoE;IACpE,aAAa,CAAC,EAAE,KAAK,CAAC;IACtB;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACtD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;KAAE,KAAK,IAAI,CAAC;CAC1G,CAAC;AAEF,8CAA8C;AAC9C,MAAM,MAAM,mBAAmB,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEpH,8EAA8E;AAC9E,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAEnG,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IACzE,yFAAyF;IACzF,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/E,CAAC;AAEF,+DAA+D;AAC/D,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;AAEvG;;;;;;;;GAQG;AACH,MAAM,MAAM,MAAM,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,SAAS,CAAC,EAAE,YAAY,CAAA;CAAE,CAAC;AAEzH,sEAAsE;AACtE,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC;IAChD,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG;IACjC,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,gEAAgE;IAChE,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,KAAK,CAAA;CAAE,CAAC;AAE9G,8DAA8D;AAC9D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,wEAAwE;IACxE,MAAM,EAAE,WAAW,CAAC;IACpB,mEAAmE;IACnE,QAAQ,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,iDAAiD;AACjD,MAAM,MAAM,oBAAoB,GAAG;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,QAAQ,EAAE,SAAS,GAAG,cAAc,GAAG,QAAQ,CAAC;IAChD,wEAAwE;IACxE,YAAY,CAAC,EAAE;QAAE,QAAQ,EAAE,YAAY,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,CAAC;IAClE,iEAAiE;IACjE,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,QAAQ,EAAE,eAAe,CAAC;IAC1B,qDAAqD;IACrD,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,YAAY,GAAG,SAAS,CAAC;IACjD;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC1D;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;IAC7C,oGAAoG;IACpG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,KAAK,CAAC,EAAE,OAAO;CAO5B;AAED,kEAAkE;AAClE,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;gBAErC,OAAO,SAAkE;CAItF;AAgDD,+EAA+E;AAC/E,eAAO,MAAM,KAAK,GAAI,WAAW,gBAAgB,KAAG,YAIlD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,QAAQ,GAAI,UAAU,YAAY,EAAE,UAAU,YAAY,KAAG,OAQzE,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,GAAI,SAAS,gBAAgB,EAAE,UAAU,gBAAgB,KAAG,gBAiCvF,CAAC;AAYF,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAiC;IAClE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAA0C;IAC3E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,sFAAsF;IACtF,OAAO,CAAC,KAAK,CAA8B;IAE3C;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAA8B;IAE9C,yEAAyE;IACzE,OAAO,CAAC,WAAW,CAAiC;IAEpD,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAkC;IAElD,gGAAgG;IAChG,OAAO,CAAC,iBAAiB,CAAiC;IAE1D,OAAO,CAAC,aAAa,CAAsB;IAE3C,OAAO,CAAC,KAAK,CAA6B;IAE1C,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAgC;IAE9C,mGAAmG;IACnG,OAAO,CAAC,UAAU,CAAqC;IAEvD,iFAAiF;IACjF,OAAO,CAAC,cAAc,CAAC,CAAa;gBAExB,OAAO,EAAE,wBAAwB;IAY7C,8CAA8C;IAC9C,IAAI,YAAY,IAAI,kBAAkB,CAErC;IAED,4FAA4F;IAC5F,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,GAAE,MAA+B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA8BxG,2DAA2D;IAC3D,OAAO,CAAC,QAAQ;IAkBhB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,IAAI;IA4BZ,gGAAgG;IAChG,OAAO,CAAC,cAAc;IAMtB,wEAAwE;IACxE,OAAO,CAAC,aAAa;IAkBrB,+EAA+E;IAC/E,OAAO,CAAC,oBAAoB;IAS5B;;;;;;;OAOG;YACW,SAAS;IA8DvB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,OAAO;IAiBf;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,YAAY;IAwBpB,iEAAiE;IACjE,OAAO,CAAC,SAAS;IAuDjB;;;;;;;OAOG;YACW,KAAK;IA4FnB,kFAAkF;IAClF,OAAO,CAAC,OAAO;IA0Bf,yFAAyF;IACzF,OAAO,CAAC,oBAAoB;IAkC5B,+CAA+C;YACjC,cAAc;CAK7B"}