@passflow/react 0.9.0 → 0.10.0

package/dist/src/components/ui/upgrade-dialog/types.d.ts

@@ -0,0 +1,188 @@
+/**
+ * Presentational contract for the assurance-upgrade dialog.
+ *
+ * The dialog is a pure projection: it takes a discriminated state and emits
+ * callbacks. Every transition belongs to the controller (architecture §13.2),
+ * so nothing here is a state machine — it is the rendering union.
+ *
+ * `UpgradeFactorType` is declared locally on purpose: P4a must build and run
+ * with no `@passflow/core` runtime import, and the union is the only type the
+ * dialog needs from the protocol. A later phase re-points it at the package.
+ */
+/** Factor types the upgrade protocol understands, named as `upgrade.type` on the wire. */
+export type UpgradeFactorType = 'totp' | 'recovery_codes' | 'passkey' | 'email_otp' | 'sms_otp';
+/** What the UI must collect before the factor can be asserted. */
+export type UpgradeFactorInput = 'code' | 'none';
+/**
+ * An assurance requirement or achievement, carrying both axes (§13.4).
+ * `level` is the parsed bar, `acrValues` the raw winning list, `maxAge` the
+ * freshness constraint when freshness is what was demanded.
+ */
+export type AssuranceBar = {
+    acrValues?: string;
+    level?: number;
+    maxAge?: number;
+};
+/**
+ * What a factor's typed answer actually accepts — the factor's own contract,
+ * not the dialog's guess.
+ *
+ * It exists because the field used to cap input at a TOTP-shaped six
+ * characters for every factor, which silently truncated a recovery code: the
+ * server issues those from `services/totp/recovery.go` at
+ * `DefaultRecoveryCodeLength` (12) and validates a configured length anywhere
+ * in 6..16 (`model/two_factor.go`), from an alphanumeric charset. A six-digit
+ * numeric keypad is wrong for that answer on every axis — length, charset and
+ * autofill — so all three travel together with the factor instead of being
+ * restated at the input.
+ */
+export type UpgradeFactorCodeContract = {
+    /** The longest answer the server can accept for this factor. */
+    maxLength: number;
+    /** A numeric OTP gets the numeric keypad; a recovery code is alphanumeric. */
+    inputMode: 'numeric' | 'text';
+    /** Only a genuine one-time code claims the OTP autofill contract. */
+    autoComplete: 'one-time-code' | 'off';
+    /** Recovery codes are issued upper-case; an OTP must not be re-cased. */
+    autoCapitalize: 'off' | 'characters';
+};
+type UpgradeDialogFactorBase = {
+    type: UpgradeFactorType;
+    /** 'Authenticator app' */
+    label: string;
+    /** 'Enter the code from your authenticator app' */
+    hint?: string;
+};
+/**
+ * A factor as the dialog renders it. The `input` discriminant carries the code
+ * contract rather than leaving it optional: a `'code'` factor with no contract
+ * is unrepresentable, so the truncation defect cannot return by omission.
+ */
+export type UpgradeDialogFactor = (UpgradeDialogFactorBase & {
+    input: 'none';
+}) | (UpgradeDialogFactorBase & {
+    input: 'code';
+    code: UpgradeFactorCodeContract;
+});
+export type UpgradeDialogChallengeState = {
+    kind: 'challenge';
+    /** Already ranked; index 0 is the suggested factor. */
+    factors: readonly UpgradeDialogFactor[];
+    selected: UpgradeFactorType;
+    reason?: string;
+    busy?: boolean;
+    error?: string | null;
+    showAlternatives?: boolean;
+    submitLabel?: string;
+    cancelLabel?: string;
+    alternativesLabel?: string;
+    testId?: string;
+    /**
+     * Reports the user's factor choice. Called the moment a factor is picked and
+     * always before `onSubmit`, which is the late-join boundary of §13.2 (T3).
+     */
+    onSelectFactor: (factor: UpgradeFactorType) => void;
+    onToggleAlternatives: () => void;
+    onSubmit: (code?: string) => void;
+    onCancel: () => void;
+};
+export type UpgradeDialogWorkingState = {
+    kind: 'working';
+    message: string;
+    detail?: string;
+    testId?: string;
+    onCancel?: () => void;
+};
+/**
+ * Every waiter replayed cleanly and no stated bar went unmet (§13.4).
+ *
+ * Success is the happy path, so it is the one state that must never be able to
+ * trap the user: §13.4's story table says the modal "reports success and
+ * closes". `onDismiss` is therefore required, not optional — it is what Escape,
+ * an overlay click, the Done control and the auto-close timer all call.
+ * `autoCloseMs` is the timer's dwell; `0` disables it and leaves the explicit
+ * control as the only path out.
+ */
+export type UpgradeDialogSuccessState = {
+    kind: 'success';
+    message: string;
+    detail?: string;
+    dismissLabel?: string;
+    /** Milliseconds before the dialog closes itself. Omitted: the component's default. */
+    autoCloseMs?: number;
+    testId?: string;
+    onDismiss: () => void;
+};
+/**
+ * Elevated, and still not enough: the replay was re-challenged (§13.3, §13.4).
+ * This state must never read as success — it is the honest
+ * "elevated to AAL2; this action requires AAL3" message.
+ */
+export type UpgradeDialogInsufficientState = {
+    kind: 'insufficient';
+    message: string;
+    obtained: AssuranceBar;
+    required: AssuranceBar;
+    detail?: string;
+    dismissLabel?: string;
+    testId?: string;
+    onDismiss: () => void;
+};
+/** The offered factor list is empty — `no usable factor` of §13.3's table. */
+export type UpgradeDialogUnsatisfiableState = {
+    kind: 'unsatisfiable';
+    message: string;
+    /** The diagnostic line: what was demanded, and why nothing could answer it. */
+    detail?: string;
+    required?: AssuranceBar;
+    dismissLabel?: string;
+    testId?: string;
+    onDismiss: () => void;
+};
+/** 501 / BFF — the deployment cannot elevate at all. */
+export type UpgradeDialogUnavailableState = {
+    kind: 'unavailable';
+    message: string;
+    detail?: string;
+    dismissLabel?: string;
+    testId?: string;
+    onDismiss: () => void;
+};
+/** The attempt budget ran out. */
+export type UpgradeDialogExhaustedState = {
+    kind: 'exhausted';
+    message: string;
+    detail?: string;
+    dismissLabel?: string;
+    testId?: string;
+    onDismiss: () => void;
+};
+/** A transport failure — FR1's non-retryable 400, or a retryable network fault. */
+export type UpgradeDialogTransportState = {
+    kind: 'transport';
+    message: string;
+    detail?: string;
+    retryable?: boolean;
+    retryLabel?: string;
+    dismissLabel?: string;
+    testId?: string;
+    onRetry?: () => void;
+    onDismiss: () => void;
+};
+/** The user dismissed the dialog, or a passkey ceremony was cancelled. */
+export type UpgradeDialogCancelledState = {
+    kind: 'cancelled';
+    message: string;
+    detail?: string;
+    dismissLabel?: string;
+    testId?: string;
+    onDismiss: () => void;
+};
+export type UpgradeDialogState = UpgradeDialogChallengeState | UpgradeDialogWorkingState | UpgradeDialogSuccessState | UpgradeDialogInsufficientState | UpgradeDialogUnsatisfiableState | UpgradeDialogUnavailableState | UpgradeDialogExhaustedState | UpgradeDialogTransportState | UpgradeDialogCancelledState;
+export type UpgradeDialogProps = {
+    open: boolean;
+    title?: string;
+    state: UpgradeDialogState;
+};
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/src/components/ui/upgrade-dialog/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/components/ui/upgrade-dialog/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,gBAAgB,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAEhG,kEAAkE;AAClE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;AAEjD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC;IAC9B,qEAAqE;IACrE,YAAY,EAAE,eAAe,GAAG,KAAK,CAAC;IACtC,yEAAyE;IACzE,cAAc,EAAE,KAAK,GAAG,YAAY,CAAC;CACtC,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAC;IACxB,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC3B,CAAC,uBAAuB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC7C,CAAC,uBAAuB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,yBAAyB,CAAA;CAAE,CAAC,CAAC;AAEnF,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,WAAW,CAAC;IAClB,uDAAuD;IACvD,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,cAAc,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACpD,oBAAoB,EAAE,MAAM,IAAI,CAAC;IACjC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,wDAAwD;AACxD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,kCAAkC;AAClC,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,mFAAmF;AACnF,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B,2BAA2B,GAC3B,yBAAyB,GACzB,yBAAyB,GACzB,8BAA8B,GAC9B,+BAA+B,GAC/B,6BAA6B,GAC7B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,CAAC;AAEhC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;CAC3B,CAAC"}

package/dist/src/components/ui/upgrade-dialog/upgrade-dialog.d.ts

@@ -0,0 +1,13 @@
+import { FC } from 'react';
+import { UpgradeDialogProps } from './types';
+/**
+ * The assurance-upgrade modal. A switch over `state.kind`, modelled on
+ * `LoginScreen`: one discriminated union, one view per state, no transitions of
+ * its own.
+ *
+ * Escape and an overlay click route to the state's cancel or dismiss callback,
+ * never to a bare close — cancellation must reach the controller or the
+ * caller's promise never settles (§8.1).
+ */
+export declare const UpgradeDialog: FC<UpgradeDialogProps>;
+//# sourceMappingURL=upgrade-dialog.d.ts.map

package/dist/src/components/ui/upgrade-dialog/upgrade-dialog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-dialog.d.ts","sourceRoot":"","sources":["../../../../../src/components/ui/upgrade-dialog/upgrade-dialog.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAKhC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,sBAAsB,CAAC;AAI9B;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,EAAE,EAAE,CAAC,kBAAkB,CAwBhD,CAAC"}

package/dist/src/context/index.d.ts

@@ -2,4 +2,5 @@ export * from './passflow-context';
 export * from './router-context';
 export * from './navigation-context';
 export * from './auth-context';
+export * from './upgrade-context';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/context/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/context/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/context/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC"}

package/dist/src/context/upgrade-context.d.ts

@@ -0,0 +1,85 @@
+import { AssuranceBar, UpgradeChallenge, UpgradeFactor, UpgradeFactorType } from '@passflow/core';
+/** What a protected elevation can fail with, in the hook's vocabulary (§13.3's table). */
+export type UpgradeErrorStatusKind = 'exhausted' | 'unsatisfiable' | 'unavailable' | 'transport';
+/**
+ * The hook's observable state. Exactly one terminal state per flight, taken
+ * from the controller's outcome summary (§13.4).
+ *
+ * `idle` is also where a flight abandoned by a session change lands: nothing
+ * happened, and nothing is reported as though it had.
+ */
+export type UpgradeHookState = {
+    status: 'idle';
+} | {
+    status: 'challenged';
+    challenge: UpgradeChallenge;
+    factors: UpgradeFactorType[];
+} | {
+    status: 'submitting';
+} | {
+    status: 'success';
+} | {
+    status: 'insufficient';
+    obtained: AssuranceBar;
+    required: AssuranceBar;
+} | {
+    status: 'error';
+    kind: UpgradeErrorStatusKind;
+    error: Error;
+};
+/** The states a flight can settle in. `null` alongside these is cancellation. */
+export type UpgradeSettledState = Extract<UpgradeHookState, {
+    status: 'idle' | 'success' | 'insufficient' | 'error';
+}>;
+/** A bar a caller states for itself on the imperative seam (§13.2 T10 / H-6). */
+export type UpgradeElevateOptions = {
+    acrValues?: string;
+    maxAge?: number;
+};
+/** The open prompt, as the dialog and the hook read it. */
+export type UpgradePromptView = {
+    challenge: UpgradeChallenge;
+    /** Already ranked by `selectFactors`; index 0 is the suggested factor. */
+    factors: readonly UpgradeFactor[];
+    /** The previous attempt's failure, when the controller re-prompted. */
+    previousError?: Error;
+};
+export type UpgradeContextValue = {
+    /** True when the provider installed a prompt handler on this `Passflow` instance. */
+    enabled: boolean;
+    state: UpgradeHookState;
+    /** The open prompt, or `null` when no elevation is collecting an answer. */
+    prompt: UpgradePromptView | null;
+    selectedFactor: UpgradeFactorType | null;
+    /**
+     * The factor-selection signal. Reports the user's choice to the controller
+     * through `UpgradePromptRequest.onFactorSelected` the moment it is made and
+     * before any answer is submitted — §13.2's late-join boundary (T3), which is
+     * selection and not submission.
+     */
+    selectFactor: (factor: UpgradeFactorType) => void;
+    /** Answers the open prompt. Resolves the controller's promise exactly once. */
+    submit: (code?: string) => void;
+    /** Declines the open prompt. Exactly once; never leaves the promise pending. */
+    cancel: () => void;
+    /** Acknowledges a terminal state, closing the dialog. Settles nothing. */
+    dismiss: () => void;
+    /**
+     * Drives an elevation directly — a "verify now" button, or a headless
+     * caller. Resolves **`null`** when the user cancelled, and otherwise the
+     * flight's terminal state; it never rejects, because the hook's contract is
+     * a rendered decision rather than a thrown transport outcome.
+     */
+    elevate: (options?: UpgradeElevateOptions) => Promise<UpgradeSettledState | null>;
+};
+export declare const UpgradeContext: import('react').Context<UpgradeContextValue | undefined>;
+/**
+ * What `useUpgrade` reads outside an `UpgradeProvider`: idle, inert, and it
+ * does not throw (§9.5 H8) — a component that merely wants to know whether an
+ * elevation is running is not a bug.
+ *
+ * `elevate` resolves `{ status: 'idle' }` rather than `null`: nothing was
+ * asked and nothing was declined, and `null` means the user declined.
+ */
+export declare const INERT_UPGRADE_CONTEXT: UpgradeContextValue;
+//# sourceMappingURL=upgrade-context.d.ts.map

package/dist/src/context/upgrade-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-context.d.ts","sourceRoot":"","sources":["../../../src/context/upgrade-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGvG,0FAA0F;AAC1F,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,eAAe,GAAG,aAAa,GAAG,WAAW,CAAC;AAEjG;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAA;CAAE,GACnF;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GAC1E;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAEpE,iFAAiF;AACjF,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,GAAG,OAAO,CAAA;CAAE,CAAC,CAAC;AAEvH,iFAAiF;AACjF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,0EAA0E;IAC1E,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAClC,uEAAuE;IACvE,aAAa,CAAC,EAAE,KAAK,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,qFAAqF;IACrF,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,gBAAgB,CAAC;IACxB,4EAA4E;IAC5E,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACjC,cAAc,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACzC;;;;;OAKG;IACH,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAClD,+EAA+E;IAC/E,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,gFAAgF;IAChF,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB;;;;;OAKG;IACH,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,qBAAqB,KAAK,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CACnF,CAAC;AAEF,eAAO,MAAM,cAAc,0DAA4D,CAAC;AAIxF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAE,mBAUnC,CAAC"}

package/dist/src/hooks/index.d.ts

@@ -23,4 +23,5 @@ export { useTwoFactorMethods, type UseTwoFactorMethodsReturn } from './use-two-f
 export { useSessionExpired, type UseSessionExpiredOptions, type UseSessionExpiredResult, type SessionExpiredReason, } from './use-session-expired';
 export { useDeviceVerify, type UseDeviceVerifyProps, type DeviceVerifyStatus, type DeviceVerifyInfo, type DeviceUIMode, } from './use-device-verify';
 export { useConsent, type UseConsentProps, type ConsentStatus, type ConsentInfo, type ConsentError, type ConsentScopeMetadata, } from './use-consent';
+export { useUpgrade, type UseUpgradeResult } from './use-upgrade';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/hooks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AACzG,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjH,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,KAAK,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,KAAK,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,KAAK,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,GAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,UAAU,EACV,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AACzG,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjH,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,KAAK,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,KAAK,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,KAAK,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,GAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,UAAU,EACV,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/src/hooks/use-upgrade.d.ts

@@ -0,0 +1,43 @@
+import { UpgradeElevateOptions, UpgradeErrorStatusKind, UpgradeHookState, UpgradeSettledState } from '../context/upgrade-context';
+import { AssuranceBar, UpgradeChallenge, UpgradeFactor, UpgradeFactorType } from '@passflow/core';
+export type UseUpgradeResult = {
+    /** True when an `UpgradeProvider` installed a prompt handler. */
+    enabled: boolean;
+    /** The whole state, as the discriminated union (§13.5's `UpgradeHookState`). */
+    state: UpgradeHookState;
+    /** The discriminant, for the common `status === 'challenged'` read. */
+    status: UpgradeHookState['status'];
+    /** What the server demanded — the MERGED requirement when challenges joined. */
+    challenge: UpgradeChallenge | null;
+    /** Usable factors, already ranked; index 0 is the suggested one. */
+    factors: readonly UpgradeFactor[];
+    /** The ranked factor types, which is what `UpgradeHookState.challenged` carries. */
+    factorTypes: readonly UpgradeFactorType[];
+    selectedFactor: UpgradeFactorType | null;
+    /**
+     * Elevated, and still not enough: the replay was re-challenged (§13.4).
+     * Non-null **only** in the `insufficient` state, and it never coexists with
+     * `status === 'success'` — this must not read as success.
+     */
+    insufficient: {
+        obtained: AssuranceBar;
+        required: AssuranceBar;
+    } | null;
+    /** The terminal failure, in the `error` state only. */
+    error: Error | null;
+    /** Which failure class, in the `error` state only. */
+    errorKind: UpgradeErrorStatusKind | null;
+    /** The previous attempt's failure while the prompt is re-shown (a wrong code). */
+    previousError: Error | null;
+    /** True while a ceremony is on the wire. */
+    busy: boolean;
+    /** The factor-selection signal — §13.2's late-join boundary (T3). */
+    selectFactor: (factor: UpgradeFactorType) => void;
+    submit: (code?: string) => void;
+    cancel: () => void;
+    dismiss: () => void;
+    /** Resolves `null` on cancellation; otherwise the flight's terminal state. */
+    elevate: (options?: UpgradeElevateOptions) => Promise<UpgradeSettledState | null>;
+};
+export declare const useUpgrade: () => UseUpgradeResult;
+//# sourceMappingURL=use-upgrade.d.ts.map

package/dist/src/hooks/use-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-upgrade.d.ts","sourceRoot":"","sources":["../../../src/hooks/use-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EAErB,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGvG,MAAM,MAAM,gBAAgB,GAAG;IAC7B,iEAAiE;IACjE,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,KAAK,EAAE,gBAAgB,CAAC;IACxB,uEAAuE;IACvE,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,gFAAgF;IAChF,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnC,oEAAoE;IACpE,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAClC,oFAAoF;IACpF,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,cAAc,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACzC;;;;OAIG;IACH,YAAY,EAAE;QAAE,QAAQ,EAAE,YAAY,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,GAAG,IAAI,CAAC;IACxE,uDAAuD;IACvD,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,sDAAsD;IACtD,SAAS,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACzC,kFAAkF;IAClF,aAAa,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,4CAA4C;IAC5C,IAAI,EAAE,OAAO,CAAC;IACd,qEAAqE;IACrE,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAClD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,8EAA8E;IAC9E,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,qBAAqB,KAAK,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CACnF,CAAC;AAOF,eAAO,MAAM,UAAU,QAAO,gBA2B7B,CAAC"}

package/dist/src/index.d.ts

@@ -1,7 +1,10 @@
 export * from './components/flow';
 export * from './components/form';
 export * from './components/ui';
-export { PassflowProvider } from './components/provider';
+export { PassflowProvider, UpgradeProvider } from './components/provider';
+export type { UpgradeProviderProps, PassflowUpgradeOptions } from './components/provider';
+export { UpgradeContext, INERT_UPGRADE_CONTEXT, type UpgradeContextValue, type UpgradeElevateOptions, type UpgradeErrorStatusKind, type UpgradeHookState, type UpgradePromptView, type UpgradeSettledState, } from './context/upgrade-context';
+export { withAuth, attachAuth } from './utils/upgrade-auth';
 export * from './hooks';
 export * from '@passflow/core';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,oBAAoB,CAAC;AAC5B,OAAO,yBAAyB,CAAC;AAEjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,oBAAoB,CAAC;AAC5B,OAAO,yBAAyB,CAAC;AAEjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC1E,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC5D,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC"}

package/dist/src/utils/index.d.ts

@@ -13,4 +13,5 @@ export { classifyDeviceError, deviceErrorOfType, DeviceApiError } from './classi
 export { authErrorFor, authRedirectErrorMessage, invitationLinkErrorMessage, verificationLinkErrorMessage, verificationRequestErrorMessage, } from './auth-error';
 export { getInvitationAuthChrome, type InvitationAuthIntent } from './invitation-auth-chrome';
 export { TwoFactorLoopPrevention } from './two-factor-loop-prevention';
+export { withAuth, attachAuth, registerUpgradeAuthInstance, releaseUpgradeAuthInstance, upgradeAuthInstance, } from './upgrade-auth';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9E,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9E,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EACL,QAAQ,EACR,UAAU,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC"}

package/dist/src/utils/upgrade-auth.d.ts

@@ -0,0 +1,38 @@
+import { FetchLike, Passflow, ResponseInterceptorHost } from '@passflow/core';
+/**
+ * Publishes the provider's `Passflow` instance to the free functions, and
+ * returns an unregister suitable as a React effect cleanup.
+ *
+ * Last registration wins, and the returned unregister is *deferred*: it clears
+ * the instance on a microtask, and only if nothing has registered in the
+ * meantime. See the module comment — that deferral is what keeps a Strict Mode
+ * mount → unmount → remount from leaving the free functions unbound, and it is
+ * why register and release are symmetric rather than one in render and one in a
+ * cleanup that nothing undoes.
+ */
+export declare const registerUpgradeAuthInstance: (instance: Passflow) => (() => void);
+/**
+ * Clears `instance` if it is still the registered one, and does nothing
+ * otherwise. Idempotent, so an effect cleanup that runs after a newer provider
+ * has already published cannot unbind the live instance.
+ */
+export declare const releaseUpgradeAuthInstance: (instance: Passflow) => void;
+/** The instance the free functions bind to, or `null` outside a provider. */
+export declare const upgradeAuthInstance: () => Passflow | null;
+/**
+ * Wraps a `fetch` and returns the wrapper. Installs nothing and touches no
+ * global — two verbs exist because the semantics genuinely differ: an axios
+ * interceptor mutates, a fetch wrapper returns.
+ */
+export declare const withAuth: (next?: FetchLike) => FetchLike;
+/**
+ * Attaches step-up handling to an axios instance the caller already owns,
+ * **mutating** it, and returns the `detach()` disposer — which is exactly what
+ * a React effect needs.
+ *
+ * The parameter is typed structurally (duck-typed on
+ * `interceptors.response.use`), so this package's axios version is not a
+ * constraint on the caller's.
+ */
+export declare const attachAuth: (instance: ResponseInterceptorHost) => (() => void);
+//# sourceMappingURL=upgrade-auth.d.ts.map

package/dist/src/utils/upgrade-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-auth.d.ts","sourceRoot":"","sources":["../../../src/utils/upgrade-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAWnF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GAAI,UAAU,QAAQ,KAAG,CAAC,MAAM,IAAI,CAY3E,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GAAI,UAAU,QAAQ,KAAG,IAE/D,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,QAAO,QAAQ,GAAG,IAAsB,CAAC;AAWzE;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAI,OAAO,SAAS,KAAG,SAAuD,CAAC;AAEpG;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GAAI,UAAU,uBAAuB,KAAG,CAAC,MAAM,IAAI,CACtB,CAAC"}