@passflow/core 0.19.0 → 0.20.1

package/dist/lib/upgrade/facade.d.ts

@@ -1,188 +0,0 @@
-/**
- * The Facade: one object that assembles the controller, the transport and the
- * adapters, and the only construction surface a consumer touches.
- *
- * `UpgradeController`, the transport, `upgradeFetch` and the fetch registry stay
- * internal. Tests reach their types by importing this directory's modules
- * directly, not through the package entry, because a type on `lib/index.ts` is
- * a supported name whether or not anything public produces a value of it.
- * `UpgradeFacadeDeps` is declared here and exported for that in-tree use only.
- * `UpgradeSessionPin`, declared in `./session`, is the exception: it IS on the
- * entry, because `AuthService.readSessionPin()` is public and returns one.
- *
- * **Five members, and the rule is written down because `structural.md` names
- * Facade-as-God-Object as this family's characteristic failure: adding a sixth
- * requires deleting one.** `createClient` is deliberately NOT a member — it is
- * `axios.create(config)` followed by `attachAuth`, so it lives on the `Passflow`
- * instance where the constructor belongs, and it is not a fourth code path.
- *
- * ## The two gates
- *
- * Passflow's own API (domain 1) is derived from `PassflowConfig.url` and handled
- * with zero configuration. The customer's backend (domain 2) is touched only
- * when `backend` is declared AND an adapter is attached: declaring without
- * attaching observes nothing, attaching without declaring matches nothing
- * beyond domain 1. That double gate is why the elevated-credential replay
- * surface is unreachable in the default configuration — there is no default
- * interception surface at all.
- *
- * ## The session-change reset
- *
- * A challenge is server-bound to the session's `sid`, and an abandoned flight
- * must never elevate a NEW session. `UpgradeController.inFlight` is private with
- * no reset, so on `SignIn` / `SignOut` the controller is DISCARDED and a fresh
- * one constructed. A waiter whose elevation was running across that boundary is
- * settled with `UpgradeSessionChangedError` — never replayed — which §13.3's
- * table maps to the original response on fetch and a tagged rejection on axios.
- *
- * SSR-safe: no global is read at module scope, and nothing is installed until
- * `enable()` is called with `interceptFetch`.
- */
-import type { PlatformAdapter } from '../platform';
-import { type AxiosReissue, type ResponseInterceptorHost } from './axios-adapter';
-import type { AssuranceBar, UpgradeChallenge, UpgradeDiagnosticSink } from './challenge';
-import { type UpgradeElevation, type UpgradeFlightSummary, type UpgradePromptHandler, type Waiter } from './controller';
-import type { UpgradeFactor } from './factors';
-import type { FetchLike, ReplayPolicy } from './replay';
-import type { UpgradeSessionPin } from './session';
-import { type UpgradeTransportDeps } from './transport';
-/** Domain 1, as resolved once from `PassflowConfig.url`. `null` = unresolved. */
-export type PassflowUpgradeDomain = {
-    origin: string;
-    pathPrefix?: string;
-} | null;
-/**
- * What the facade needs from its host, as narrow function-shaped dependencies.
- *
- * Everything HTTP arrives pre-wired, which is what keeps this module free of
- * endpoints and of any opinion about delivery mode.
- */
-export type UpgradeFacadeDeps = UpgradeTransportDeps & {
-    /** The platform adapter, for the WebAuthn ceremony. */
-    platform: PlatformAdapter;
-    /** Domain 1. Resolved by the host from `url`; the facade never derives it. */
-    passflowDomain: PassflowUpgradeDomain;
-    /** Construction-time factor override, from `PassflowConfig.upgrade`. */
-    factors?: readonly UpgradeFactor[];
-    /** The bar the elevation reached, read from the freshly stored access token. */
-    readObtainedBar?: () => AssuranceBar | undefined;
-    /** §5.5's credential swap. Snapshotted before the elevation, read again after. */
-    authorizationSwap?: () => {
-        from: string;
-        to: string;
-    } | undefined;
-    /**
-     * Installs (or clears, on `undefined`) the handler the SDK's OWN axios clients
-     * consult inside their existing error interceptor — §4.4's internal seam,
-     * which an ordinary customer-registered interceptor is structurally too late
-     * to be.
-     *
-     * It receives a FACTORY rather than a handler because each of the SDK's
-     * clients must replay through its own instance: a handler built around one
-     * client's `request` would re-issue another client's request on the wrong
-     * instance.
-     */
-    attachInternalSeam?: (factory: ((reissue: AxiosReissue) => (error: unknown) => Promise<unknown>) | undefined) => void;
-    /** Subscribes to session changes (`SignIn` / `SignOut`). Returns unsubscribe. */
-    onSessionChange?: (listener: () => void) => () => void;
-    /**
-     * The session and user identity the host can currently read, or `undefined`
-     * when this delivery mode exposes none.
-     *
-     * Read ONCE per flight, when the flight starts, and handed to `commitRefresh`
-     * so the token-applying path can refuse to write user A's tokens into user
-     * B's session (§13.4 revision 6 / H2).
-     */
-    readSessionPin?: () => UpgradeSessionPin | undefined;
-};
-/**
- * Everything `enable()` accepts: the prompt, the interception scope and the
- * interception policy.
- *
- * `requireChallengeChannel`, `backend` and `shouldIntercept` are interception
- * policy and deliberately NOT on `PassflowConfig` — they are per-installation,
- * not client-wide.
- */
-export type UpgradeEnableOptions = {
-    /** REQUIRED. The js-sdk ships no UI. */
-    prompt: UpgradePromptHandler;
-    /**
-     * Where the customer's own API is: an origin, an origin with a path prefix, or
-     * a same-origin path prefix (`'/api'`). Nothing outside this and domain 1 is
-     * ever observed, and there is no allow-all opt-in — a developer who wants
-     * every origin lists every origin, which is a sentence they can read in a diff.
-     */
-    backend?: string | string[];
-    /**
-     * Patches `globalThis.fetch` through the registry, at the upgrade priority.
-     * **Off by default**, and a different decision from enabling the UI: one prop
-     * for both would bundle "show me the 2FA prompt" with "patch the global", and
-     * only the second has the blast radius. It widens which call sites are
-     * observed, never the scope.
-     */
-    interceptFetch?: boolean;
-    /** Requires the standards channel. The body is then never read. */
-    requireChallengeChannel?: 'header';
-    /** NARROWING ONLY: `false` excludes an admitted URL; `true` cannot widen. */
-    shouldIntercept?: (url: string) => boolean;
-    replay?: ReplayPolicy;
-    /** The fetch surface's only option. Default `'resolve-original'`. */
-    onCancel?: 'resolve-original' | 'reject';
-    onUpgradeDiagnostic?: UpgradeDiagnosticSink;
-    factors?: readonly UpgradeFactor[];
-    maxAttempts?: number;
-    /** One terminal state per flight, after every waiter has reported. */
-    onFlightSettled?: (summary: UpgradeFlightSummary) => void;
-    /** Forwarded verbatim to the prepare round for passkey upgrades. */
-    relyingPartyId?: string;
-};
-/** What the imperative seam resolves with (§13.4). */
-export type UpgradeResult = {
-    status: 'elevated';
-    acr?: string;
-};
-/**
- * What the imperative seam accepts: a bar the CALLER states.
- *
- * Stating one is what makes `UpgradeInsufficientError` reachable on this
- * surface; an options-less call states no bar, has no protected operation to
- * replay, and resolves `{ status: 'elevated' }` (§13.3's `n/a` cell).
- */
-export type UpgradeOptions = {
-    acrValues?: string;
-    maxAge?: number;
-};
-export type UpgradeFacade = {
-    /**
-     * Drives an elevation directly — §13.4's imperative seam.
-     *
-     * The facade is CALLABLE, which is why this signature is here rather than on
-     * a method: the documented surface is `passflow.upgrade(options?)`, and the
-     * same object also carries `enable`, `withAuth` and the rest. Resolves on
-     * proof completion; rejects `UpgradeCancelledError`,
-     * `UpgradeUnsatisfiableError`, `UpgradeUnavailableError`,
-     * `UpgradeSessionChangedError`, `UpgradeTransportError` — and, when the
-     * caller stated a bar the proof did not reach, `UpgradeInsufficientError`.
-     */
-    (options?: UpgradeOptions): Promise<UpgradeResult>;
-    /**
-     * Installs the prompt handler and the selected interceptors. Returns an
-     * idempotent teardown. Calling `enable()` twice replaces the previous
-     * installation and tears the first one down.
-     */
-    enable(options: UpgradeEnableOptions): () => void;
-    /** True when a prompt handler is installed AND the delivery mode can commit. */
-    readonly enabled: boolean;
-    /**
-     * Drives an elevation directly — headless clients, a "verify now" button,
-     * tests. Single-flight with the interceptors: concurrent callers share one
-     * prompt, because they share one controller.
-     */
-    elevate(challenge: UpgradeChallenge, waiter?: Waiter): Promise<UpgradeElevation>;
-    /** Wraps a fetch and returns the wrapper. Touches no global. */
-    withAuth(next?: FetchLike): FetchLike;
-    /** Attaches to an axios instance the developer owns, MUTATING it. Returns `detach()`. */
-    attachAuth(instance: ResponseInterceptorHost): () => void;
-};
-export declare const createUpgradeFacade: (deps: UpgradeFacadeDeps) => UpgradeFacade;
-//# sourceMappingURL=facade.d.ts.map

package/dist/lib/upgrade/facade.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"facade.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,uBAAuB,EAAgD,MAAM,iBAAiB,CAAC;AAChI,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAEzB,KAAK,MAAM,EACZ,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,KAAK,oBAAoB,EAA0B,MAAM,aAAa,CAAC;AAEhF,iFAAiF;AACjF,MAAM,MAAM,qBAAqB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,GAAG;IACrD,uDAAuD;IACvD,QAAQ,EAAE,eAAe,CAAC;IAC1B,8EAA8E;IAC9E,cAAc,EAAE,qBAAqB,CAAC;IACtC,wEAAwE;IACxE,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,YAAY,GAAG,SAAS,CAAC;IACjD,kFAAkF;IAClF,iBAAiB,CAAC,EAAE,MAAM;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACnE;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,KAAK,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,KAAK,IAAI,CAAC;IACtH,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAC;IACvD;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,iBAAiB,GAAG,SAAS,CAAC;CACtD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,wCAAwC;IACxC,MAAM,EAAE,oBAAoB,CAAC;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mEAAmE;IACnE,uBAAuB,CAAC,EAAE,QAAQ,CAAC;IACnC,6EAA6E;IAC7E,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,QAAQ,CAAC;IACzC,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC1D,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,sDAAsD;AACtD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;;;;;;;OAUG;IACH,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACnD;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAC;IAClD,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjF,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IACtC,yFAAyF;IACzF,UAAU,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,IAAI,CAAC;CAC3D,CAAC;AAwBF,eAAO,MAAM,mBAAmB,GAAI,MAAM,iBAAiB,KAAG,aA6R7D,CAAC"}

package/dist/lib/upgrade/factors.d.ts

@@ -1,97 +0,0 @@
-/**
- * Upgrade factor abstraction.
- *
- * A factor knows two things: whether proving it needs a server round-trip
- * first, and how to turn whatever the user did into the `upgrade.assertion`
- * blob `POST /auth/refresh` expects.
- *
- * `requiresPrepare` is declared statically rather than discovered by trying.
- * The server actively REJECTS a prepare call for one-shot factors
- * (`ErrorUpgradePrepareNotRequired`), so "call /begin and see what happens"
- * costs a guaranteed round-trip and a 400 on every TOTP upgrade.
- */
-import type { AuthenticationResponseJSON, PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/types';
-import type { PlatformAdapter } from '../platform';
-/** Factor types the upgrade protocol understands, named as `upgrade.type` on the wire. */
-export type UpgradeFactorType = 'totp' | 'recovery_codes' | 'passkey' | 'email_otp' | 'sms_otp';
-/** The prepare round's result — `POST /auth/upgrade/begin`, normalised to camelCase. */
-export type UpgradePrepared = {
-    challengeId: string;
-    method: string;
-    /** RFC 3339. The server gives a challenge five minutes; treat it as a hard deadline. */
-    expiresAt: string;
-    /** WebAuthn assertion options, present only for a passkey upgrade. */
-    webauthn?: PublicKeyCredentialRequestOptionsJSON;
-    /** Masked delivery target (`j***@x.com`), present only for email / SMS OTP. */
-    codeSentTo?: string;
-};
-/**
- * The `upgrade.assertion` payload. Deliberately an open record: the server
- * types this field as `json.RawMessage` so new factors can extend the shape
- * without a wire-format change.
- */
-export type UpgradeAssertion = {
-    challenge_id?: string;
-    code?: string;
-    credential?: AuthenticationResponseJSON;
-};
-/** What a factor needs from the UI before it can be asserted. */
-export type UpgradeFactorInput = 
-/** A user-typed value: an OTP or a recovery code. */
-'code'
-/** Nothing typed — the ceremony itself collects the proof (a passkey prompt). */
- | 'none';
-export type UpgradeAssertContext = {
-    /** The value the user typed, for factors whose `input` is `'code'`. */
-    code?: string;
-    /** The prepare round's result, for factors where `requiresPrepare` is true. */
-    prepared?: UpgradePrepared;
-    /** Platform seam for the WebAuthn ceremony — keeps non-web adapters working. */
-    platform: PlatformAdapter;
-};
-export type UpgradeFactor = {
-    type: UpgradeFactorType;
-    /** Whether `POST /auth/upgrade/begin` must run before the user can produce proof. */
-    requiresPrepare: boolean;
-    /** What the UI must collect before `assert` can run. */
-    input: UpgradeFactorInput;
-    /** Turns the user's response into the assertion blob sent as `upgrade.assertion`. */
-    assert(ctx: UpgradeAssertContext): Promise<UpgradeAssertion>;
-};
-/** Thrown when a factor cannot produce proof — a cancelled prompt, or missing prerequisites. */
-export declare class UpgradeFactorError extends Error {
-    readonly factor: UpgradeFactorType;
-    /** True when the user dismissed the ceremony rather than failing it. */
-    readonly cancelled: boolean;
-    constructor(factor: UpgradeFactorType, message: string, cancelled?: boolean);
-}
-/**
- * TOTP — the canonical one-shot factor. The code is derived from a shared
- * secret and the clock, so nothing needs to be fetched first.
- */
-export declare const totpFactor: UpgradeFactor;
-/**
- * Recovery codes — also one-shot. Verified against the user's stored code set,
- * so like TOTP there is no challenge to issue.
- */
-export declare const recoveryCodesFactor: UpgradeFactor;
-/**
- * Passkey — the challenge-response factor. The prepare round supplies the
- * server nonce and, critically, an `allowCredentials` list scoped to the
- * signed-in user; the ceremony signs it and the assertion goes back with the
- * challenge id that binds it to this session.
- */
-export declare const passkeyFactor: UpgradeFactor;
-/**
- * The factors this SDK can actually complete.
- *
- * `email_otp` and `sms_otp` are intentionally ABSENT. The server routes them
- * (`upgradePrepareMethod` accepts both) but has no OTP transport, so no user can
- * enrol them and `upgradeMethodRegistered` refuses the prepare round. Adding
- * them later is one entry here plus a factor whose assert returns
- * `{ challenge_id, code }` — no change to anything that consumes this registry.
- */
-export declare const DEFAULT_UPGRADE_FACTORS: readonly UpgradeFactor[];
-/** Indexes a factor list by type for lookup during a challenge. */
-export declare const factorRegistry: (factors?: readonly UpgradeFactor[]) => Map<UpgradeFactorType, UpgradeFactor>;
-//# sourceMappingURL=factors.d.ts.map

package/dist/lib/upgrade/factors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"factors.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/factors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,0BAA0B,EAAE,qCAAqC,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,gBAAgB,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAEhG,wFAAwF;AACxF,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,qCAAqC,CAAC;IACjD,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,0BAA0B,CAAC;CACzC,CAAC;AAEF,iEAAiE;AACjE,MAAM,MAAM,kBAAkB;AAC5B,qDAAqD;AACnD,MAAM;AACR,iFAAiF;GAC/E,MAAM,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,iBAAiB,CAAC;IACxB,qFAAqF;IACrF,eAAe,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,qFAAqF;IACrF,MAAM,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC9D,CAAC;AAEF,gGAAgG;AAChG,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,UAAQ;CAM1E;AAWD;;;GAGG;AACH,eAAO,MAAM,UAAU,EAAE,aAKxB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAKjC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,aAgC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,aAAa,EAI1D,CAAC;AAEH,mEAAmE;AACnE,eAAO,MAAM,cAAc,GACzB,UAAS,SAAS,aAAa,EAA4B,KAC1D,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAA6C,CAAC"}

package/dist/lib/upgrade/fetch-adapter.d.ts

@@ -1,30 +0,0 @@
-/**
- * The FETCH adapter over `handleChallenge`. One of four, and the thinnest.
- *
- * **NO LOGIC IN AN ADAPTER.** Everything here is translation: a `Response`
- * becomes a `ChallengeContext` on the way in, and a `CoreOutcome` becomes a
- * `Response` (or a throw) on the way out, through `settleFetchOutcome`. It
- * parses no challenge, compares no bar, decides no scope, counts no retry and
- * chooses no error class. If something in this file ever looks like a decision,
- * it belongs in `core.ts` instead — a row that passes here and fails on the
- * axios surface is a leak out of the core, not a difference between transports.
- *
- * The one genuinely transport-shaped obligation it carries is the body: a
- * replay needs the request body while it is still unread, so `planReplay` runs
- * BEFORE the first call and the core is told whether a replay is even possible
- * before any prompt opens. The caller's own response is never consumed — every
- * body read is taken from `clone()`, so `bodyUsed === false` holds on the object
- * the caller receives.
- *
- * SSR-safe: no global is read at module scope. `withAuth()`'s default `next` is
- * resolved inside the call, not here.
- */
-import { type UpgradeInterceptorOptionsSource } from './core';
-import { type FetchLike } from './replay';
-/**
- * Wraps a `fetch`, returning a new function. Installs nothing and touches no
- * global — this is the SSR- and React-Native-safe entry point, and the one the
- * global patch itself is built from.
- */
-export declare const upgradeFetch: (next: FetchLike, source: UpgradeInterceptorOptionsSource) => FetchLike;
-//# sourceMappingURL=fetch-adapter.d.ts.map

package/dist/lib/upgrade/fetch-adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fetch-adapter.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/fetch-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAGL,KAAK,+BAA+B,EAIrC,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,KAAK,SAAS,EAAiD,MAAM,UAAU,CAAC;AA2HzF;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,SAAS,EAAE,QAAQ,+BAA+B,KAAG,SA2CvF,CAAC"}

package/dist/lib/upgrade/index.d.ts

@@ -1,20 +0,0 @@
-export { INSUFFICIENT_USER_AUTHENTICATION, UPGRADE_REQUIRED, parseChallengeBody, parseChallengeHeader, parseUpgradeChallenge, type UpgradeChallenge, } from './challenge';
-export { DEFAULT_UPGRADE_FACTORS, factorRegistry, passkeyFactor, recoveryCodesFactor, UpgradeFactorError, totpFactor, type UpgradeAssertion, type UpgradeAssertContext, type UpgradeFactor, type UpgradeFactorInput, type UpgradeFactorType, type UpgradePrepared, } from './factors';
-export { UpgradeCancelledError, UpgradeController, UpgradeUnsatisfiableError, type UpgradeControllerOptions, type UpgradePromptHandler, type UpgradePromptRequest, type UpgradePromptResult, type UpgradeTransport, } from './controller';
-export { RECOVERABLE_COMMIT_ERROR_IDS, SESSION_INVALIDATING_COMMIT_ERROR_IDS, UpgradeErrorIds, UpgradeTransportError, classifyUpgradeError, invalidatesSessionOnCommit, isRecoverableCommitFailure, isRetryableUpgradeKind, isUpgradeTransportError, type UpgradeEndpoint, type UpgradeErrorKind, type UpgradeTransportErrorInit, } from './errors';
-export { UPGRADE_REPLAYED_MARKER, UPGRADE_TRANSACTION_MARKER, hasUpgradeReplayedMarker, hasUpgradeTransactionMarker, markUpgradeReplayed, markUpgradeTransaction, type UpgradeRequestMarkers, } from './markers';
-export { selectFactors } from './select';
-export { RELATIVE_BASE, captureHeaders, createRequestSnapshot, headersToObject, normaliseUrl, snapshotHeader, swapAuthorization, type NormalisedUrl, type RequestSnapshot, type RequestSnapshotInit, type SnapshotHeader, } from './snapshot';
-export { readSessionPin, sessionPinMatches, type UpgradeSessionClaims, type UpgradeSessionPin, } from './session';
-export { createUpgradeTransport, toPrepared, type UpgradeTransportDeps } from './transport';
-export { parseAcrToken, readAcrValues, requiredAcrLevel, type AcrReading } from './acr';
-export { parseMaxAge, readUpgradeChallenge, type AssuranceBar, type ChallengeChannel, type ChallengeInput, type ChallengeReadOptions, type ChallengeReading, type MaxAgeReading, type UpgradeDiagnostic, type UpgradeDiagnosticReason, type UpgradeDiagnosticSink, } from './challenge';
-export { barMeets, barOf, mergeChallenges, type UpgradeElevation, type UpgradeFlightState, type UpgradeFlightSummary, type UpgradeProof, type UpgradeWaiterSummary, type Waiter, type WaiterEntry, type WaiterOutcome, type WaiterReport, } from './controller';
-export { UpgradeInsufficientError, UpgradeSessionChangedError, UpgradeUnavailableError, } from './errors';
-export { coreOutcomeToError, handleChallenge, isInterceptionScope, isUpgradeCancelled, isUpgradeExhausted, isUpgradeInsufficient, isUpgradeSessionChanged, isUpgradeTransportFailure, isUpgradeUnavailable, isUpgradeUnsatisfiable, settleAxiosOutcome, settleFetchOutcome, tagUpgradeOutcome, type ChallengeContext, type CoreOutcome, type InterceptionScope, type Settlement, type UpgradeInterceptorOptions, } from './core';
-export { methodOf, planReplay, policyPermits, urlOf, type BodyKind, type FetchLike, type ReplayHints, type ReplayPlan, type ReplayPolicy, type UpgradeReplayInfo, } from './replay';
-export { attachUpgradeAuth, createAxiosUpgradeHandler, type AxiosConfigLike, type AxiosReissue, type ResponseInterceptorHost, } from './axios-adapter';
-export { upgradeFetch } from './fetch-adapter';
-export { createUpgradeClient, type CreateClientConfig } from './client';
-export { createUpgradeFacade, type PassflowUpgradeDomain, type UpgradeEnableOptions, type UpgradeFacade, type UpgradeFacadeDeps, type UpgradeOptions, type UpgradeResult, } from './facade';
-//# sourceMappingURL=index.d.ts.map

package/dist/lib/upgrade/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,eAAe,GACrB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,4BAA4B,EAC5B,qCAAqC,EACrC,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,GAC/B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,2BAA2B,EAC3B,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE5F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC;AAExF,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,QAAQ,EACR,KAAK,EACL,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,yBAAyB,GAC/B,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,aAAa,EACb,KAAK,EACL,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,uBAAuB,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAExE,OAAO,EACL,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC"}

package/dist/lib/upgrade/markers.d.ts

@@ -1,64 +0,0 @@
-/**
- * Per-request markers for the upgrade transaction.
- *
- * Two 401s look identical on the wire and mean opposite things. A protected
- * resource's 401 says "this session is not strong enough"; the elevation's own
- * `POST /auth/refresh` 401 says "that TOTP code was wrong, try again". Neither
- * carries RFC 9470 vocabulary on the commit path — `refreshErrorStatus` maps the
- * four recoverable upgrade errors to a bare 401 with no `WWW-Authenticate` and no
- * `upgrade_required` body — so the response alone cannot tell them apart from an
- * expired session.
- *
- * The evidence that CAN tell them apart is the request: we know we issued it.
- * Both rounds of the elevation (`POST /auth/upgrade/start` and the committing
- * `POST /auth/refresh`) carry a marker on their axios config, set at the call
- * site immediately before dispatch. The response interceptor reads it off
- * `error.config`, which axios hands back unchanged, and suppresses
- * `setSessionInvalid()` for that one request only. An unrelated background 401
- * arriving while a prompt is open is unmarked and invalidates exactly as before.
- *
- * A second marker records that a request has already been replayed after an
- * elevation, so an adapter that re-issues through the same interceptor cannot
- * elevate twice for one challenge.
- *
- * ## Why these are enumerable, against the design's "non-enumerable"
- *
- * The design asks for non-enumerable properties, reasoning that they must never
- * reach the wire. Non-enumerable does not survive the trip: `AxiosClient.send`
- * spreads the caller's config into a fresh object (`{ method, url, ...options }`)
- * and axios' own `mergeConfig` iterates `Object.keys`, so both drop a
- * non-enumerable property before the request is dispatched — verified against
- * `axios@1.13` with a stub adapter. An enumerable key reaches both the adapter
- * and `error.config`.
- *
- * The property the design actually wanted is preserved regardless: axios
- * serializes only `data` (and `params`/`headers`), never unknown config keys, so
- * a marker is never transmitted. The same mechanism already carries
- * `_retryCount` through the rate-limit retry path.
- */
-/** Config key marking a request as one of the upgrade transaction's two rounds. */
-export declare const UPGRADE_TRANSACTION_MARKER = "__passflowUpgradeTransaction";
-/** Config key marking a request as the single post-elevation replay (FR3). */
-export declare const UPGRADE_REPLAYED_MARKER = "__passflowUpgradeReplayed";
-/** The markers as they appear on a request config. Both are absent unless set. */
-export type UpgradeRequestMarkers = {
-    /** Set by the upgrade transport on `prepare` and `commit`. */
-    __passflowUpgradeTransaction?: true;
-    /** Set by the replaying adapter before it re-issues the original request. */
-    __passflowUpgradeReplayed?: true;
-};
-/**
- * Returns a copy of `config` marked as part of the upgrade transaction.
- *
- * Copies rather than mutates: the caller may be reusing a config object, and a
- * marker that outlives its request would suppress invalidation for an unrelated
- * 401 — the exact over-broad behaviour the per-request rule replaces.
- */
-export declare const markUpgradeTransaction: <T extends object>(config?: T) => T & UpgradeRequestMarkers;
-/** Reports whether a request config carries the upgrade-transaction marker. */
-export declare const hasUpgradeTransactionMarker: (config: unknown) => boolean;
-/** Returns a copy of `config` marked as the one permitted post-elevation replay. */
-export declare const markUpgradeReplayed: <T extends object>(config: T) => T & UpgradeRequestMarkers;
-/** Reports whether a request config has already been replayed after an elevation. */
-export declare const hasUpgradeReplayedMarker: (config: unknown) => boolean;
-//# sourceMappingURL=markers.d.ts.map

package/dist/lib/upgrade/markers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"markers.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/markers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,mFAAmF;AACnF,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE,kFAAkF;AAClF,MAAM,MAAM,qBAAqB,GAAG;IAClC,8DAA8D;IAC9D,4BAA4B,CAAC,EAAE,IAAI,CAAC;IACpC,6EAA6E;IAC7E,yBAAyB,CAAC,EAAE,IAAI,CAAC;CAClC,CAAC;AAKF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAAI,CAAC,SAAS,MAAM,EAAE,SAAS,CAAC,KAAG,CAAC,GAAG,qBAGxE,CAAC;AAEH,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B,GAAI,QAAQ,OAAO,KAAG,OAAyD,CAAC;AAExH,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,GAAI,CAAC,SAAS,MAAM,EAAE,QAAQ,CAAC,KAAG,CAAC,GAAG,qBAGpE,CAAC;AAEH,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,GAAI,QAAQ,OAAO,KAAG,OAAsD,CAAC"}

package/dist/lib/upgrade/replay.d.ts

@@ -1,132 +0,0 @@
-/**
- * The replay planner.
- *
- * Pure, no I/O, and it runs BEFORE the first call — a `Request` body must be
- * cloned while it is still unread, so by the time a 401 has come back it is too
- * late to decide whether a replay is possible. Planning first is also what lets
- * the core fail BEFORE opening a prompt: prompting the user, elevating their
- * session and only then discovering we cannot honour it is the worst possible
- * ordering, because it spends a server challenge and a user interaction for
- * nothing.
- *
- * ## Why replaying a challenged request is safe at all
- *
- * An RFC 9470 challenge is emitted by the authorization middleware —
- * `RequireAuthLevel` / `RequireFreshAuth` — BEFORE the handler runs, so the
- * request had no effect. That is categorically different from a 429 or a 502,
- * where the request may have partially executed, which is why
- * `AxiosClient.handleRateLimitError` correctly refuses to retry non-idempotent
- * requests and why this correctly does the opposite.
- *
- * The guarantee depends on the CUSTOMER's middleware placement, though, so
- * there is an escape hatch rather than an assumption: a backend that emits an
- * `insufficient_user_authentication` challenge after a side effect is violating
- * RFC 9470, and such a backend sets `'idempotent-only'`. Stating the
- * precondition is the design; silently assuming it would not be.
- *
- * ## Per-waiter binding
- *
- * A plan is bound to the request that carried the challenge: its own URL, its
- * own method and its own pre-captured body. No waiter's challenge, outcome or
- * response ever changes what another waiter replays, or where — requirement
- * AGGREGATION across waiters sharing a session is permitted and happens in the
- * controller; replay SUBSTITUTION is prohibited, and that prohibition is this
- * module's whole job.
- */
-import { type RequestSnapshot } from './snapshot';
-/** Our own `fetch` shape. Declared here rather than imported so no DOM lib is required. */
-export type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
-/** How a body can be re-sent, which is the only thing that decides replayability. */
-export type BodyKind = 
-/** No body at all. Re-issue the same input. */
-'none'
-/** A value the caller still holds and `fetch` re-reads: string, Blob, buffer, FormData, params. */
- | 'reusable'
-/** A `Request` with a body, cloned before the first send. */
- | 'request-clone'
-/** Consumed by the first send and unrecoverable: a `ReadableStream`, or a failed clone. */
- | 'one-shot';
-/** What the policy predicate is told about a request. */
-export type UpgradeReplayInfo = {
-    url: string;
-    method: string;
-    bodyKind: BodyKind;
-};
-/**
- * Replay policy.
- *
- * The object form is §13.5's: size and streaming limits. The three string and
- * function forms are §5.1's escape hatch, kept because `'idempotent-only'`
- * expresses a constraint the object form cannot — a backend whose challenge may
- * arrive after a side effect.
- */
-export type ReplayPolicy = {
-    /** Refuse to buffer a `Request` body larger than this many bytes, when the size is known. */
-    maxBodyBytes?: number;
-    /** A stream is never replayable; the field exists so the intent is written down. */
-    allowStreamingBody?: false;
-} | 'always' | 'idempotent-only' | ((info: UpgradeReplayInfo) => boolean);
-/** Hints the core passes at replay time. The planner applies them; it decides nothing. */
-export type ReplayHints = {
-    /**
-     * The §5.5 credential swap, already resolved by the core.
-     *
-     * Applied if and only if the outgoing `Authorization` header value EXACTLY
-     * equals `from`: equality with the token we hold in storage is what proves the
-     * header was ours. Any other value is forwarded untouched, because rewriting a
-     * header we do not own would be a security bug.
-     *
-     * Without this the replay re-sends the stale `Authorization` header, every
-     * elevation ends in a surfaced second 401, and the feature silently never
-     * works. Cookie mode needs none of it: the browser attaches the current —
-     * now elevated — cookie by itself.
-     */
-    authorizationSwap?: {
-        from: string;
-        to: string;
-    };
-};
-export type ReplayPlan = {
-    /** False when the body cannot be re-sent, or the policy refused. */
-    replayable: boolean;
-    bodyKind: BodyKind;
-    /** Why it is not replayable, for the `'replay-unsupported'` diagnostic. */
-    reason?: string;
-    /** What to pass to `next()` on the FIRST call. */
-    forwardInput: RequestInfo | URL;
-    forwardInit?: RequestInit;
-    /**
-     * The normalised, immutable snapshot of this request — §13.4 revision 6.
-     *
-     * EXPOSED rather than hidden as a plan-time url, so the scope check, the
-     * challenge context, the diagnostics and the replay all read the same object
-     * and the request that is *authorized* cannot differ from the one that is
-     * *sent*.
-     */
-    snapshot: RequestSnapshot;
-    /** Re-issues the original request, once. Rejects if `!replayable`. */
-    replay: (next: FetchLike, hints?: ReplayHints) => Promise<Response>;
-};
-/** The URL of whatever shape the caller passed, without touching the network. */
-export declare const urlOf: (input: RequestInfo | URL) => string;
-/** The method of whatever shape the caller passed. `init` wins, as `fetch` itself has it. */
-export declare const methodOf: (input: RequestInfo | URL, init?: RequestInit) => string;
-/**
- * Applies the policy. The planner asks; it never decides what the policy means.
- *
- * Exported because the axios adapter needs the same answer about an
- * `AxiosRequestConfig`, which has no `Request` and no `BodyInit` to plan over.
- * Two readings of `'idempotent-only'` — one here and one there — is exactly the
- * per-surface drift the single core forbids, so there is one reading and both
- * surfaces call it.
- */
-export declare const policyPermits: (policy: ReplayPolicy | undefined, info: UpgradeReplayInfo, bodyBytes?: number) => boolean;
-/**
- * Decides whether a request can be replayed, and produces the thunk that does it.
- *
- * Call it BEFORE the first send. The returned `forwardInput` / `forwardInit` are
- * what the first send must use: for a `Request` with a body they are the
- * original, with the spare clone held for the replay.
- */
-export declare const planReplay: (input: RequestInfo | URL, init?: RequestInit, policy?: ReplayPolicy) => ReplayPlan;
-//# sourceMappingURL=replay.d.ts.map

package/dist/lib/upgrade/replay.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,KAAK,eAAe,EAA6D,MAAM,YAAY,CAAC;AAE7G,2FAA2F;AAC3F,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE5F,qFAAqF;AACrF,MAAM,MAAM,QAAQ;AAClB,+CAA+C;AAC7C,MAAM;AACR,mGAAmG;GACjG,UAAU;AACZ,6DAA6D;GAC3D,eAAe;AACjB,2FAA2F;GACzF,UAAU,CAAC;AAEf,yDAAyD;AACzD,MAAM,MAAM,iBAAiB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEpF;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IACE,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,KAAK,CAAC;CAC5B,GACD,QAAQ,GACR,iBAAiB,GACjB,CAAC,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC;AAE3C,0FAA0F;AAC1F,MAAM,MAAM,WAAW,GAAG;IACxB;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,YAAY,EAAE,WAAW,GAAG,GAAG,CAAC;IAChC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,EAAE,eAAe,CAAC;IAC1B,sEAAsE;IACtE,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrE,CAAC;AAYF,iFAAiF;AACjF,eAAO,MAAM,KAAK,GAAI,OAAO,WAAW,GAAG,GAAG,KAAG,MAQhD,CAAC;AAEF,6FAA6F;AAC7F,eAAO,MAAM,QAAQ,GAAI,OAAO,WAAW,GAAG,GAAG,EAAE,OAAO,WAAW,KAAG,MAGvE,CAAC;AAwCF;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,YAAY,GAAG,SAAS,EAAE,MAAM,iBAAiB,EAAE,YAAY,MAAM,KAAG,OAc7G,CAAC;AAoHF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GAAI,OAAO,WAAW,GAAG,GAAG,EAAE,OAAO,WAAW,EAAE,SAAS,YAAY,KAAG,UAyGhG,CAAC"}

package/dist/lib/upgrade/select.d.ts

@@ -1,48 +0,0 @@
-/**
- * Which factor do we put in front of the user, and in what order?
- *
- * The challenge names what the server wants (`acrValues`, `maxAge`); this
- * module decides which of the SDK's registered factors to offer and which one
- * leads. The first entry is the "suggested" method the UI renders immediately
- * — everything after it sits behind "use another way" (PFL-509).
- *
- * ## Rank, never filter
- *
- * It is tempting to drop factors that "cannot reach" the demanded level. The
- * SDK cannot know that. The server computes `acr` from the *combination* of the
- * session's base methods and the verified factor, so a code factor DOES satisfy
- * an AAL3 challenge when the base session already reaches AAL3 — and for a
- * passkey the level depends on what the assertion reports, which is unknowable
- * until the ceremony runs.
- *
- * Getting that wrong is asymmetric. Offering a factor that turns out to be
- * insufficient costs one round-trip and a retry. Hiding one that would have
- * worked tells the user to re-authenticate when they did not have to, and
- * there is no way back from that. So every factor stays on the list; the
- * ordering carries the opinion, and the server stays the authority.
- *
- * ## Enrolment is filtered upstream, not here
- *
- * `available` is what this SDK can complete, not what the user has. The server
- * refuses a prepare round for an unenrolled factor
- * (`ErrorUpgradeMethodNotRegistered`). Narrowing `available` to the user's
- * actual credentials belongs to the caller — see the note at the bottom.
- */
-import type { UpgradeChallenge } from './challenge';
-import type { UpgradeFactor } from './factors';
-/**
- * Orders the factors to offer for a challenge. Index 0 is the suggested
- * method; the rest are the "use another way" alternatives.
- *
- * The suggested slot is not only a UX choice: PFL-510 treats a non-suggested
- * choice as a minor risk signal, so whatever leads here becomes the behavioural
- * baseline deviation is measured against.
- *
- * @param available - Factors this SDK can complete. Narrow to the user's
- *                    enrolled credentials before calling, when known.
- * @param challenge - What the server demanded (`acrValues`, `maxAge`).
- * @returns The factors to offer, most-preferred first. Empty only when
- *          `available` was empty — this never drops a factor of its own accord.
- */
-export declare const selectFactors: (available: readonly UpgradeFactor[], challenge: UpgradeChallenge) => readonly UpgradeFactor[];
-//# sourceMappingURL=select.d.ts.map

package/dist/lib/upgrade/select.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"select.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/select.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAqB,MAAM,WAAW,CAAC;AAiElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,GAAI,WAAW,SAAS,aAAa,EAAE,EAAE,WAAW,gBAAgB,KAAG,SAAS,aAAa,EAKtH,CAAC"}