@passflow/react 0.9.1 → 0.10.0

package/dist/src/components/provider/index.d.ts

@@ -1,3 +1,4 @@
 export { PassflowProvider, OIDCExchangeContext } from './passflow-provider';
-export type { OIDCExchangeContextValue } from './passflow-provider';
+export type { OIDCExchangeContextValue, PassflowUpgradeOptions } from './passflow-provider';
+export { UpgradeProvider, type UpgradeProviderProps } from './upgrade-provider';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/components/provider/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/components/provider/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,YAAY,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/components/provider/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,YAAY,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/src/components/provider/passflow-provider.d.ts

@@ -1,10 +1,39 @@
+import { UpgradeProviderProps } from './upgrade-provider';
 import { NavigateFunction, RouterType } from '../../context';
 import { PassflowConfig } from '@passflow/core';
 import { default as React, FC, ReactNode } from 'react';
+/**
+ * The assurance-upgrade options a consumer may set on `PassflowProvider`.
+ *
+ * `children`, `enabled` and `backend` are owned by `PassflowProvider` itself:
+ * `backend` is a top-level prop (§13.5 — "where your API is" is the headline
+ * act, not a nested detail) and `enabled` is derived from `upgrade`/`backend`
+ * below, so there is exactly one source for each.
+ */
+export type PassflowUpgradeOptions = Omit<UpgradeProviderProps, 'children' | 'enabled' | 'backend'>;
 type PassflowProviderProps = PassflowConfig & {
     children: ReactNode;
     navigate?: NavigateFunction;
     router?: RouterType;
+    /**
+     * Where the customer's own API is — domain 2 of §13.5's two-domain
+     * interception model. Nothing outside this and Passflow's own API is ever
+     * observed, and there is no allow-all opt-in. `string | string[]`, an origin
+     * or a same-origin path prefix (`'/api'`).
+     */
+    backend?: string | string[];
+    /**
+     * Automatic assurance upgrade (step-up). `undefined` ⇒ **off**, so no
+     * existing consumer changes behaviour on upgrade. `true` ⇒ on with
+     * defaults; an object ⇒ on with those options; `false` ⇒ off even when
+     * `backend` is declared.
+     *
+     * Declaring `backend` also turns it on: naming where your API is has no
+     * other meaning, and §13.5's acceptance configuration is `backend` plus one
+     * attached client. The global `window.fetch` patch is a separate, explicit
+     * act (`upgrade={{ interceptFetch: true }}`) and stays off by default.
+     */
+    upgrade?: boolean | PassflowUpgradeOptions;
 };
 /**
  * Read `parent_challenge_id` from the current URL's query string.
@@ -71,17 +100,22 @@ type ParentChallengeMeta = {
  *   - 200 { redirect_url } → the interceptor's fetch wrapper follows
  *     the redirect (sole owner of redirect_url navigation; this hook
  *     must never navigate on OK responses — see the res.ok branch).
- *   - 403 { error: "upgrade_required", ... } → SDK falls through to
- *     `setUpgradeRequired(true)` so the consumer renders the
- *     upgrade-required placeholder + login form. Code path is
- *     UNREACHABLE today (server's EvaluatePolicy is a no-op
- *     scaffold); activates when Subtask E lands.
+ *   - 403 { error: "upgrade_required", ... } → falls through to the
+ *     login form. Factor elevation on an existing session is
+ *     `UpgradeProvider`'s flow, not this probe's.
  *   - 401 → clear stale tokens, fall through to login form.
  *
  * On any decision-point that ends with "render login form," the
  * SDK consumer's existing PassflowFlow render path picks up
  * naturally.
  */
+/**
+ * `'upgrade_required'` is vestigial and kept deliberately (§8.4): it is
+ * unreachable today — the 403 branch below sets `'fallback_to_login'` — and
+ * removing a member from an exported union would be a type-level breaking
+ * change for anyone reading `OIDCExchangeContextValue`. Assurance elevation is
+ * now `UpgradeProvider`'s job, not a placeholder's.
+ */
 type ExchangeState = 'idle' | 'exchanging' | 'upgrade_required' | 'fallback_to_login';
 /**
  * Context surface exposed to children so the SDK's own components

package/dist/src/components/provider/passflow-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passflow-provider.d.ts","sourceRoot":"","sources":["../../../../src/components/provider/passflow-provider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gBAAgB,EAGrB,KAAK,UAAU,EAIhB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,SAAS,EAAiE,MAAM,OAAO,CAAC;AACtH,OAAO,oBAAoB,CAAC;AAE5B,KAAK,qBAAqB,GAAG,cAAc,GAAG;IAC5C,QAAQ,EAAE,SAAS,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAsBF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,QAAO,MAAM,GAAG,SAQxD,CAAC;AAiCF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,QAAO,OAA+B,CAAC;AAiJ3E;;;GAGG;AACH,KAAK,mBAAmB,GAAG;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IAKvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,KAAK,aAAa,GAAG,MAAM,GAAG,YAAY,GAAG,kBAAkB,GAAG,mBAAmB,CAAC;AA+NtF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;CAC9B,CAAC;AAEF,eAAO,MAAM,mBAAmB,yCAE9B,CAAC;AAEH,eAAO,MAAM,gBAAgB,EAAE,EAAE,CAAC,qBAAqB,CAsItD,CAAC"}
+{"version":3,"file":"passflow-provider.d.ts","sourceRoot":"","sources":["../../../../src/components/provider/passflow-provider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAEL,KAAK,gBAAgB,EAGrB,KAAK,UAAU,EAIhB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAiC,KAAK,cAAc,EAA2B,MAAM,gBAAgB,CAAC;AAC7G,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,SAAS,EAAiE,MAAM,OAAO,CAAC;AACtH,OAAO,oBAAoB,CAAC;AAE5B;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC,CAAC;AAEpG,KAAK,qBAAqB,GAAG,cAAc,GAAG;IAC5C,QAAQ,EAAE,SAAS,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;CAC5C,CAAC;AAsBF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,QAAO,MAAM,GAAG,SAQxD,CAAC;AAiCF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,QAAO,OAA+B,CAAC;AAqK3E;;;GAGG;AACH,KAAK,mBAAmB,GAAG;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IAKvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH;;;;;;GAMG;AACH,KAAK,aAAa,GAAG,MAAM,GAAG,YAAY,GAAG,kBAAkB,GAAG,mBAAmB,CAAC;AAwMtF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;CAC9B,CAAC;AAEF,eAAO,MAAM,mBAAmB,yCAE9B,CAAC;AAEH,eAAO,MAAM,gBAAgB,EAAE,EAAE,CAAC,qBAAqB,CA+ItD,CAAC"}

package/dist/src/components/provider/upgrade-provider.d.ts

@@ -0,0 +1,49 @@
+import { UpgradeDialogLabels, UpgradeDialogProps } from '../ui/upgrade-dialog';
+import { ReplayPolicy, UpgradeDiagnosticSink, UpgradeFactor } from '@passflow/core';
+import { FC, ReactElement, ReactNode } from 'react';
+export type UpgradeProviderProps = {
+    children?: ReactNode;
+    /** Default `true`. `false` installs nothing and leaves the hook inert. */
+    enabled?: boolean;
+    /**
+     * Where the customer's own API is — domain 2 (§13.5). Nothing outside this
+     * and Passflow's own API is ever observed, and there is no allow-all opt-in.
+     */
+    backend?: string | string[];
+    /**
+     * Patches `globalThis.fetch` through the core's registry. **Off by default**,
+     * and a different decision from enabling the UI: one prop for both would
+     * bundle "show me the verification prompt" with "patch the global", and only
+     * the second has the blast radius.
+     */
+    interceptFetch?: boolean;
+    /** Requires the RFC 9470 channel. The body is then never read for a challenge. */
+    requireChallengeChannel?: 'header';
+    /** NARROWING ONLY: `false` excludes an admitted URL; `true` cannot widen. */
+    shouldIntercept?: (url: string) => boolean;
+    replay?: ReplayPolicy;
+    /** The fetch surface's only cancellation option. Default `'resolve-original'`. */
+    onCancel?: 'resolve-original' | 'reject';
+    onUpgradeDiagnostic?: UpgradeDiagnosticSink;
+    factors?: readonly UpgradeFactor[];
+    maxAttempts?: number;
+    relyingPartyId?: string;
+    /** Per-factor wording for the dialog. */
+    labels?: UpgradeDialogLabels;
+    title?: string;
+    /**
+     * FR5's render-prop override. It receives the **exact** props the built-in
+     * dialog would render — a typed, constrained override with no `className` or
+     * `style` leak.
+     *
+     * It carries the same obligations as the built-in dialog, the selection
+     * signal included: the `challenge` state's `onSelectFactor` must be called
+     * when the user picks a factor, because that is the only thing that reports
+     * §13.2's selection boundary to the controller. An override that never calls
+     * it leaves the controller `collecting` for the whole ceremony, so a late
+     * join re-ranks mid-entry — degraded, not silent.
+     */
+    renderDialog?: (props: UpgradeDialogProps) => ReactElement | null;
+};
+export declare const UpgradeProvider: FC<UpgradeProviderProps>;
+//# sourceMappingURL=upgrade-provider.d.ts.map

package/dist/src/components/provider/upgrade-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-provider.d.ts","sourceRoot":"","sources":["../../../../src/components/provider/upgrade-provider.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAwB,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAYpH,OAAO,EAIL,KAAK,YAAY,EAEjB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,YAAY,EAAE,KAAK,SAAS,EAAqD,MAAM,OAAO,CAAC;AAEtH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kFAAkF;IAClF,uBAAuB,CAAC,EAAE,QAAQ,CAAC;IACnC,6EAA6E;IAC7E,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,kBAAkB,GAAG,QAAQ,CAAC;IACzC,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yCAAyC;IACzC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,YAAY,GAAG,IAAI,CAAC;CACnE,CAAC;AAkHF,eAAO,MAAM,eAAe,EAAE,EAAE,CAAC,oBAAoB,CAqWpD,CAAC"}

package/dist/src/components/ui/button/index.d.ts

@@ -7,12 +7,23 @@ type RippleProps = {
 export declare const Ripple: FC<RippleProps>;
 type TButton = PropsWithChildren & ButtonHTMLAttributes<HTMLButtonElement> & {
     size: 'small' | 'medium' | 'big';
-    variant: 'primary' | 'secondary' | 'outlined' | 'warning' | 'clean' | 'provider' | 'dark';
+    variant: 'primary' | 'secondary' | 'outlined' | 'warning' | 'clean' | 'provider' | 'dark' | 'option';
     type: 'button' | 'submit' | 'reset';
     withIcon?: boolean;
     asIcon?: boolean;
     className?: string;
     withRipple?: boolean;
+    /**
+     * The `option` variant's second line — the hint under the label. Rendered
+     * only by that variant, which owns the two-line geometry.
+     */
+    description?: string;
+    /**
+     * Toggle state for the `option` variant: mirrored to `aria-pressed` and
+     * styled by the variant itself, so no call site has to describe what
+     * "selected" looks like.
+     */
+    pressed?: boolean;
 };
 export declare const Button: FC<TButton>;
 export {};

package/dist/src/components/ui/button/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/ui/button/index.tsx"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,EAAE,EAGP,KAAK,iBAAiB,EAGvB,MAAM,OAAO,CAAC;AACf,OAAO,oBAAoB,CAAC;AAE5B,KAAK,WAAW,GAAG;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CASlC,CAAC;AAEF,KAAK,OAAO,GAAG,iBAAiB,GAC9B,oBAAoB,CAAC,iBAAiB,CAAC,GAAG;IACxC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjC,OAAO,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IAC1F,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACpC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEJ,eAAO,MAAM,MAAM,EAAE,EAAE,CAAC,OAAO,CA8D9B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/ui/button/index.tsx"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,EAAE,EAGP,KAAK,iBAAiB,EAIvB,MAAM,OAAO,CAAC;AACf,OAAO,oBAAoB,CAAC;AAE5B,KAAK,WAAW,GAAG;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,EAAE,CAAC,WAAW,CASlC,CAAC;AAEF,KAAK,OAAO,GAAG,iBAAiB,GAC9B,oBAAoB,CAAC,iBAAiB,CAAC,GAAG;IACxC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjC,OAAO,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACrG,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACpC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEJ,eAAO,MAAM,MAAM,EAAE,EAAE,CAAC,OAAO,CA+F9B,CAAC"}

package/dist/src/components/ui/index.d.ts

@@ -4,8 +4,10 @@ export { Button } from './button';
 export * from './fields';
 export * from './providers-box';
 export { Link } from './link';
+export { Spinner, type SpinnerProps, type SpinnerSize } from './spinner';
 export { Switch } from './switch';
 export * from './popover';
 export * from './dialog';
 export * from './login-screen';
+export { UpgradeDialog, UpgradeChallengeView, UpgradeFactorList, UpgradeStatus, type UpgradeStatusState, DEFAULT_FACTOR_LABELS, dialogOutcomeFromError, describeAssuranceBar, readAssuranceBar, UPGRADE_FACTOR_CODE_CONTRACTS, toDialogFactors, toDialogState, upgradeDialogDismissHandler, type ToDialogStateInput, type UpgradeChallengeSnapshot, type UpgradeDialogErrorKind, type UpgradeDialogHandlers, type UpgradeDialogLabels, type UpgradeDialogOutcome, type UpgradeDialogUiState, type UpgradeFactorSnapshot, type UpgradePromptSnapshot, type UpgradeDialogCancelledState, type UpgradeDialogChallengeState, type UpgradeDialogExhaustedState, type UpgradeDialogFactor, type UpgradeDialogInsufficientState, type UpgradeDialogProps, type UpgradeDialogState, type UpgradeDialogSuccessState, type UpgradeDialogTransportState, type UpgradeDialogUnavailableState, type UpgradeDialogUnsatisfiableState, type UpgradeDialogWorkingState, type UpgradeFactorCodeContract, } from './upgrade-dialog';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/components/ui/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/components/ui/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/components/ui/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAM/B,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,aAAa,EACb,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,6BAA6B,EAC7B,eAAe,EACf,aAAa,EACb,2BAA2B,EAC3B,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,KAAK,+BAA+B,EACpC,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC"}

package/dist/src/components/ui/spinner/index.d.ts

@@ -0,0 +1,23 @@
+import { FC } from 'react';
+export type SpinnerSize = 'small' | 'medium';
+export type SpinnerProps = {
+    /** `small` sits inline beside a line of text; `medium` stands alone. */
+    size?: SpinnerSize;
+    /**
+     * The accessible name. Omit it when a sibling already announces the busy
+     * state — the ring is then decorative and hidden from assistive technology,
+     * which is what a status region with its own live text wants.
+     */
+    label?: string;
+};
+/**
+ * The indeterminate activity ring.
+ *
+ * It exists as a primitive so its diameter and stroke live in one place rather
+ * than in each consuming component's stylesheet. The upgrade dialog uses it;
+ * the login screen still draws its own identical ring in
+ * `login-screen.css` and should be migrated onto this when that file is next
+ * touched.
+ */
+export declare const Spinner: FC<SpinnerProps>;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/components/ui/spinner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/ui/spinner/index.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,eAAe,CAAC;AAEvB,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE7C,MAAM,MAAM,YAAY,GAAG;IACzB,wEAAwE;IACxE,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,EAAE,EAAE,CAAC,YAAY,CAOpC,CAAC"}

package/dist/src/components/ui/upgrade-dialog/challenge.d.ts

@@ -0,0 +1,12 @@
+import { FC } from 'react';
+import { UpgradeDialogChallengeState } from './types';
+/**
+ * The collecting view: the suggested factor, its input affordance, the
+ * alternatives toggle, and the two terminal controls.
+ *
+ * Selection is reported through `onSelectFactor` before `onSubmit` ever fires —
+ * architecture §13.2's late-join boundary is factor selection, not submission,
+ * so the controller must learn of the choice while the user is still typing.
+ */
+export declare const UpgradeChallengeView: FC<UpgradeDialogChallengeState>;
+//# sourceMappingURL=challenge.d.ts.map

package/dist/src/components/ui/upgrade-dialog/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../../../../src/components/ui/upgrade-dialog/challenge.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,EAAoC,MAAM,OAAO,CAAC;AAKlE,OAAO,KAAK,EAAE,2BAA2B,EAAqB,MAAM,SAAS,CAAC;AAK9E;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,EAAE,CAAC,2BAA2B,CAoHhE,CAAC"}

package/dist/src/components/ui/upgrade-dialog/factor-list.d.ts

@@ -0,0 +1,20 @@
+import { FC } from 'react';
+import { UpgradeDialogFactor, UpgradeFactorType } from './types';
+type UpgradeFactorListProps = {
+    factors: readonly UpgradeDialogFactor[];
+    selected: UpgradeFactorType;
+    disabled?: boolean;
+    label?: string;
+    onSelect: (factor: UpgradeFactorType) => void;
+};
+/**
+ * The "use another way" alternatives. Selecting one reports the user's choice;
+ * it never navigates.
+ *
+ * Each row is `Button variant='option'`: the two-line geometry and the pressed
+ * look belong to that variant in the button library, not to this list. The list
+ * contributes layout only.
+ */
+export declare const UpgradeFactorList: FC<UpgradeFactorListProps>;
+export {};
+//# sourceMappingURL=factor-list.d.ts.map

package/dist/src/components/ui/upgrade-dialog/factor-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factor-list.d.ts","sourceRoot":"","sources":["../../../../../src/components/ui/upgrade-dialog/factor-list.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAEhC,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEtE,KAAK,sBAAsB,GAAG;IAC5B,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAC/C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,EAAE,CAAC,sBAAsB,CAyBxD,CAAC"}

package/dist/src/components/ui/upgrade-dialog/index.d.ts

@@ -0,0 +1,8 @@
+export { UpgradeDialog } from './upgrade-dialog';
+export { UpgradeChallengeView } from './challenge';
+export { UpgradeFactorList } from './factor-list';
+export { UPGRADE_SUCCESS_AUTO_CLOSE_MS, UpgradeStatus, type UpgradeStatusState } from './status';
+export { DEFAULT_FACTOR_LABELS, dialogOutcomeFromError, describeAssuranceBar, readAssuranceBar, UPGRADE_FACTOR_CODE_CONTRACTS, toDialogFactors, toDialogState, upgradeDialogDismissHandler, } from './state-mapping';
+export type { ToDialogStateInput, UpgradeChallengeSnapshot, UpgradeDialogErrorKind, UpgradeDialogHandlers, UpgradeDialogLabels, UpgradeDialogOutcome, UpgradeDialogUiState, UpgradeFactorSnapshot, UpgradePromptSnapshot, } from './state-mapping';
+export type { AssuranceBar, UpgradeDialogCancelledState, UpgradeDialogChallengeState, UpgradeDialogExhaustedState, UpgradeDialogFactor, UpgradeDialogInsufficientState, UpgradeDialogProps, UpgradeDialogState, UpgradeDialogSuccessState, UpgradeDialogTransportState, UpgradeDialogUnavailableState, UpgradeDialogUnsatisfiableState, UpgradeDialogWorkingState, UpgradeFactorCodeContract, UpgradeFactorInput, UpgradeFactorType, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/components/ui/upgrade-dialog/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/ui/upgrade-dialog/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,6BAA6B,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACjG,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,6BAA6B,EAC7B,eAAe,EACf,aAAa,EACb,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,YAAY,EACZ,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,mBAAmB,EACnB,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,EAC7B,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,SAAS,CAAC"}

package/dist/src/components/ui/upgrade-dialog/state-mapping.d.ts

@@ -0,0 +1,119 @@
+import { AssuranceBar, UpgradeDialogFactor, UpgradeDialogState, UpgradeFactorCodeContract, UpgradeFactorInput, UpgradeFactorType } from './types';
+export type UpgradeChallengeSnapshot = {
+    requiredLevel?: number;
+    acrValues?: string;
+    maxAge?: number;
+};
+export type UpgradeFactorSnapshot = {
+    type: UpgradeFactorType;
+    input: UpgradeFactorInput;
+};
+export type UpgradePromptSnapshot = {
+    challenge: UpgradeChallengeSnapshot;
+    /** Already ranked by `selectFactors`; index 0 is the suggested factor. */
+    factors: readonly UpgradeFactorSnapshot[];
+    previousError?: unknown;
+};
+export type UpgradeDialogLabels = Partial<Record<UpgradeFactorType, {
+    label: string;
+    hint?: string;
+}>>;
+/** How the flight ended, as the controller's outcome summary reports it (§13.4). */
+export type UpgradeDialogOutcome = {
+    kind: 'elevated';
+} | {
+    kind: 'insufficient';
+    obtained: AssuranceBar;
+    required: AssuranceBar;
+} | {
+    kind: 'cancelled';
+} | {
+    kind: 'failed';
+    error: unknown;
+};
+export type UpgradeDialogUiState = {
+    selected?: UpgradeFactorType | null;
+    busy?: boolean;
+    showAlternatives?: boolean;
+};
+export type UpgradeDialogHandlers = {
+    onSelectFactor: (factor: UpgradeFactorType) => void;
+    onToggleAlternatives: () => void;
+    onSubmit: (code?: string) => void;
+    onCancel: () => void;
+    onDismiss: () => void;
+    onRetry?: () => void;
+};
+export type ToDialogStateInput = {
+    prompt: UpgradePromptSnapshot | null;
+    outcome?: UpgradeDialogOutcome;
+    ui?: UpgradeDialogUiState;
+    labels?: UpgradeDialogLabels;
+    handlers: UpgradeDialogHandlers;
+    testId?: string;
+};
+/**
+ * How an elevation failure reads to the user. `rejected` is the retryable
+ * wrong-answer case, which keeps the dialog open on the challenge.
+ */
+export type UpgradeDialogErrorKind = 'rejected' | 'cancelled' | 'exhausted' | 'unsatisfiable' | 'unavailable' | 'transport' | 'insufficient' | 'session-changed';
+export declare const DEFAULT_FACTOR_LABELS: Record<UpgradeFactorType, {
+    label: string;
+    hint?: string;
+}>;
+/**
+ * Per-factor code contracts, keyed by the factor type, which is the only thing
+ * about a factor the protocol guarantees.
+ *
+ * `recovery_codes` is the reason this table exists. The server generates them
+ * at `DefaultRecoveryCodeLength` (12) from a 32-character alphanumeric charset
+ * and accepts a configured length anywhere in 6..16, so the cap is the server's
+ * MAXIMUM — capping at the default would reject a valid code on a deployment
+ * that raised it, and capping at six (the old single hardcoded number) rejected
+ * every code on every deployment. A shorter configured code simply types
+ * shorter; a cap can only ever do harm by being too small.
+ *
+ * `null` means the factor collects nothing typed: its proof comes from the
+ * ceremony, so there is no field and no contract to state.
+ */
+export declare const UPGRADE_FACTOR_CODE_CONTRACTS: Readonly<{
+    totp: UpgradeFactorCodeContract;
+    email_otp: UpgradeFactorCodeContract;
+    sms_otp: UpgradeFactorCodeContract;
+    recovery_codes: UpgradeFactorCodeContract;
+    passkey: null;
+}>;
+/** Index 0 stays index 0: `selectFactors` already ranked the list, and ranking is not filtering. */
+export declare const toDialogFactors: (factors: readonly UpgradeFactorSnapshot[], labels?: UpgradeDialogLabels) => UpgradeDialogFactor[];
+/**
+ * How a failure reads to the user, as the dialog's own vocabulary.
+ *
+ * Named `dialogOutcomeFromError`, not `classifyUpgradeError`: that name belongs
+ * to `@passflow/core`, and holding it here shadowed core's symbol in the
+ * package's own star exports, which made the real classifier unreachable to
+ * consumers. This function decides nothing about what the error IS — core's
+ * classifier does — only which panel that kind is shown on.
+ *
+ * The dedicated error classes are matched before the kind table because they
+ * are not transport failures at all: they carry no `kind`, and core's
+ * classifier has nothing to say about them.
+ */
+export declare const dialogOutcomeFromError: (error: unknown) => UpgradeDialogErrorKind;
+export declare const readAssuranceBar: (value: unknown) => AssuranceBar | undefined;
+/** Human wording for a bar, on whichever axis it constrains. */
+export declare const describeAssuranceBar: (bar?: AssuranceBar) => string;
+/**
+ * The single projection. A terminal `outcome` always wins over an open prompt;
+ * an empty offered factor list is the `no usable factor` outcome; a `busy`
+ * ceremony with no code to type is `working`; everything else is the challenge.
+ */
+export declare const toDialogState: (input: ToDialogStateInput) => UpgradeDialogState;
+/**
+ * What Escape and an overlay click mean in each state. Cancellation must reach
+ * the controller or the caller's promise hangs (§8.1), so this is never a bare
+ * close; `success` has nothing to cancel, so it closes instead of cancelling —
+ * returning `undefined` there made Escape and the overlay inert on the one
+ * state every user reaches.
+ */
+export declare const upgradeDialogDismissHandler: (state: UpgradeDialogState) => (() => void) | undefined;
+//# sourceMappingURL=state-mapping.d.ts.map

package/dist/src/components/ui/upgrade-dialog/state-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-mapping.d.ts","sourceRoot":"","sources":["../../../../../src/components/ui/upgrade-dialog/state-mapping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,SAAS,CAAC;AAEjB,MAAM,MAAM,wBAAwB,GAAG;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,kBAAkB,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,EAAE,wBAAwB,CAAC;IACpC,0EAA0E;IAC1E,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC1C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC;AAEvG,oFAAoF;AACpF,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GACxE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEvC,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,cAAc,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACpD,oBAAoB,EAAE,MAAM,IAAI,CAAC;IACjC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,EAAE,CAAC,EAAE,oBAAoB,CAAC;IAC1B,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAC9B,UAAU,GACV,WAAW,GACX,WAAW,GACX,eAAe,GACf,aAAa,GACb,WAAW,GACX,cAAc,GACd,iBAAiB,CAAC;AAEtB,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,iBAAiB,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAM7F,CAAC;AAYF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,6BAA6B,EAAE,QAAQ,CAAC;IACnD,IAAI,EAAE,yBAAyB,CAAC;IAChC,SAAS,EAAE,yBAAyB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;IACnC,cAAc,EAAE,yBAAyB,CAAC;IAC1C,OAAO,EAAE,IAAI,CAAC;CACf,CAWC,CAAC;AAUH,oGAAoG;AACpG,eAAO,MAAM,eAAe,GAC1B,SAAS,SAAS,qBAAqB,EAAE,EACzC,SAAS,mBAAmB,KAC3B,mBAAmB,EAYlB,CAAC;AA2EL;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,sBAiBvD,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,OAAO,OAAO,KAAG,YAAY,GAAG,SAQhE,CAAC;AAEF,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,GAAI,MAAM,YAAY,KAAG,MAOzD,CAAC;AAkFF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,kBAAkB,KAAG,kBAgGzD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GAAI,OAAO,kBAAkB,KAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAStF,CAAC"}

package/dist/src/components/ui/upgrade-dialog/status.d.ts

@@ -0,0 +1,27 @@
+import { FC } from 'react';
+import { UpgradeDialogState } from './types';
+/** Every state that is not the collecting challenge. */
+export type UpgradeStatusState = Exclude<UpgradeDialogState, {
+    kind: 'challenge';
+}>;
+/**
+ * How long `success` stays on screen before it closes itself (§13.4: "reports
+ * success and closes"). Long enough to be read, short enough that the app is
+ * never held behind a modal the user cannot see a reason for.
+ */
+export declare const UPGRADE_SUCCESS_AUTO_CLOSE_MS = 1800;
+/**
+ * The non-collecting views: `working`, `success` and the six terminal outcomes
+ * of §13.3's settlement table.
+ *
+ * `insufficient` is deliberately rendered in the problem tone with both bars
+ * shown: the elevation succeeded and the action still did not, and the dialog
+ * must not report success when the replay was re-challenged (§13.4).
+ *
+ * `success` owns its own exit: a Done control and an auto-close timer, both
+ * calling the state's `onDismiss`. The affordance lives here rather than in the
+ * provider because a modal that cannot be closed is a property of this
+ * component, and the Storybook story for the state has to show the way out.
+ */
+export declare const UpgradeStatus: FC<UpgradeStatusState>;
+//# sourceMappingURL=status.d.ts.map

package/dist/src/components/ui/upgrade-dialog/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../../../src/components/ui/upgrade-dialog/status.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,EAAa,MAAM,OAAO,CAAC;AAK3C,OAAO,KAAK,EAAgB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAEhE,wDAAwD;AACxD,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,EAAE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC;AAepF;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,OAAO,CAAC;AASlD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,EAAE,EAAE,CAAC,kBAAkB,CA4DhD,CAAC"}

package/dist/src/components/ui/upgrade-dialog/types.d.ts

@@ -0,0 +1,188 @@
+/**
+ * Presentational contract for the assurance-upgrade dialog.
+ *
+ * The dialog is a pure projection: it takes a discriminated state and emits
+ * callbacks. Every transition belongs to the controller (architecture §13.2),
+ * so nothing here is a state machine — it is the rendering union.
+ *
+ * `UpgradeFactorType` is declared locally on purpose: P4a must build and run
+ * with no `@passflow/core` runtime import, and the union is the only type the
+ * dialog needs from the protocol. A later phase re-points it at the package.
+ */
+/** Factor types the upgrade protocol understands, named as `upgrade.type` on the wire. */
+export type UpgradeFactorType = 'totp' | 'recovery_codes' | 'passkey' | 'email_otp' | 'sms_otp';
+/** What the UI must collect before the factor can be asserted. */
+export type UpgradeFactorInput = 'code' | 'none';
+/**
+ * An assurance requirement or achievement, carrying both axes (§13.4).
+ * `level` is the parsed bar, `acrValues` the raw winning list, `maxAge` the
+ * freshness constraint when freshness is what was demanded.
+ */
+export type AssuranceBar = {
+    acrValues?: string;
+    level?: number;
+    maxAge?: number;
+};
+/**
+ * What a factor's typed answer actually accepts — the factor's own contract,
+ * not the dialog's guess.
+ *
+ * It exists because the field used to cap input at a TOTP-shaped six
+ * characters for every factor, which silently truncated a recovery code: the
+ * server issues those from `services/totp/recovery.go` at
+ * `DefaultRecoveryCodeLength` (12) and validates a configured length anywhere
+ * in 6..16 (`model/two_factor.go`), from an alphanumeric charset. A six-digit
+ * numeric keypad is wrong for that answer on every axis — length, charset and
+ * autofill — so all three travel together with the factor instead of being
+ * restated at the input.
+ */
+export type UpgradeFactorCodeContract = {
+    /** The longest answer the server can accept for this factor. */
+    maxLength: number;
+    /** A numeric OTP gets the numeric keypad; a recovery code is alphanumeric. */
+    inputMode: 'numeric' | 'text';
+    /** Only a genuine one-time code claims the OTP autofill contract. */
+    autoComplete: 'one-time-code' | 'off';
+    /** Recovery codes are issued upper-case; an OTP must not be re-cased. */
+    autoCapitalize: 'off' | 'characters';
+};
+type UpgradeDialogFactorBase = {
+    type: UpgradeFactorType;
+    /** 'Authenticator app' */
+    label: string;
+    /** 'Enter the code from your authenticator app' */
+    hint?: string;
+};
+/**
+ * A factor as the dialog renders it. The `input` discriminant carries the code
+ * contract rather than leaving it optional: a `'code'` factor with no contract
+ * is unrepresentable, so the truncation defect cannot return by omission.
+ */
+export type UpgradeDialogFactor = (UpgradeDialogFactorBase & {
+    input: 'none';
+}) | (UpgradeDialogFactorBase & {
+    input: 'code';
+    code: UpgradeFactorCodeContract;
+});
+export type UpgradeDialogChallengeState = {
+    kind: 'challenge';
+    /** Already ranked; index 0 is the suggested factor. */
+    factors: readonly UpgradeDialogFactor[];
+    selected: UpgradeFactorType;
+    reason?: string;
+    busy?: boolean;
+    error?: string | null;
+    showAlternatives?: boolean;
+    submitLabel?: string;
+    cancelLabel?: string;
+    alternativesLabel?: string;
+    testId?: string;
+    /**
+     * Reports the user's factor choice. Called the moment a factor is picked and
+     * always before `onSubmit`, which is the late-join boundary of §13.2 (T3).
+     */
+    onSelectFactor: (factor: UpgradeFactorType) => void;
+    onToggleAlternatives: () => void;
+    onSubmit: (code?: string) => void;
+    onCancel: () => void;
+};
+export type UpgradeDialogWorkingState = {
+    kind: 'working';
+    message: string;
+    detail?: string;
+    testId?: string;
+    onCancel?: () => void;
+};
+/**
+ * Every waiter replayed cleanly and no stated bar went unmet (§13.4).
+ *
+ * Success is the happy path, so it is the one state that must never be able to
+ * trap the user: §13.4's story table says the modal "reports success and
+ * closes". `onDismiss` is therefore required, not optional — it is what Escape,
+ * an overlay click, the Done control and the auto-close timer all call.
+ * `autoCloseMs` is the timer's dwell; `0` disables it and leaves the explicit
+ * control as the only path out.
+ */
+export type UpgradeDialogSuccessState = {
+    kind: 'success';
+    message: string;
+    detail?: string;
+    dismissLabel?: string;
+    /** Milliseconds before the dialog closes itself. Omitted: the component's default. */
+    autoCloseMs?: number;
+    testId?: string;
+    onDismiss: () => void;
+};
+/**
+ * Elevated, and still not enough: the replay was re-challenged (§13.3, §13.4).
+ * This state must never read as success — it is the honest
+ * "elevated to AAL2; this action requires AAL3" message.
+ */
+export type UpgradeDialogInsufficientState = {
+    kind: 'insufficient';
+    message: string;
+    obtained: AssuranceBar;
+    required: AssuranceBar;
+    detail?: string;
+    dismissLabel?: string;
+    testId?: string;
+    onDismiss: () => void;
+};
+/** The offered factor list is empty — `no usable factor` of §13.3's table. */
+export type UpgradeDialogUnsatisfiableState = {
+    kind: 'unsatisfiable';
+    message: string;
+    /** The diagnostic line: what was demanded, and why nothing could answer it. */
+    detail?: string;
+    required?: AssuranceBar;
+    dismissLabel?: string;
+    testId?: string;
+    onDismiss: () => void;
+};
+/** 501 / BFF — the deployment cannot elevate at all. */
+export type UpgradeDialogUnavailableState = {
+    kind: 'unavailable';
+    message: string;
+    detail?: string;
+    dismissLabel?: string;
+    testId?: string;
+    onDismiss: () => void;
+};
+/** The attempt budget ran out. */
+export type UpgradeDialogExhaustedState = {
+    kind: 'exhausted';
+    message: string;
+    detail?: string;
+    dismissLabel?: string;
+    testId?: string;
+    onDismiss: () => void;
+};
+/** A transport failure — FR1's non-retryable 400, or a retryable network fault. */
+export type UpgradeDialogTransportState = {
+    kind: 'transport';
+    message: string;
+    detail?: string;
+    retryable?: boolean;
+    retryLabel?: string;
+    dismissLabel?: string;
+    testId?: string;
+    onRetry?: () => void;
+    onDismiss: () => void;
+};
+/** The user dismissed the dialog, or a passkey ceremony was cancelled. */
+export type UpgradeDialogCancelledState = {
+    kind: 'cancelled';
+    message: string;
+    detail?: string;
+    dismissLabel?: string;
+    testId?: string;
+    onDismiss: () => void;
+};
+export type UpgradeDialogState = UpgradeDialogChallengeState | UpgradeDialogWorkingState | UpgradeDialogSuccessState | UpgradeDialogInsufficientState | UpgradeDialogUnsatisfiableState | UpgradeDialogUnavailableState | UpgradeDialogExhaustedState | UpgradeDialogTransportState | UpgradeDialogCancelledState;
+export type UpgradeDialogProps = {
+    open: boolean;
+    title?: string;
+    state: UpgradeDialogState;
+};
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/src/components/ui/upgrade-dialog/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/components/ui/upgrade-dialog/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,gBAAgB,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAEhG,kEAAkE;AAClE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;AAEjD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC;IAC9B,qEAAqE;IACrE,YAAY,EAAE,eAAe,GAAG,KAAK,CAAC;IACtC,yEAAyE;IACzE,cAAc,EAAE,KAAK,GAAG,YAAY,CAAC;CACtC,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAC;IACxB,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC3B,CAAC,uBAAuB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC7C,CAAC,uBAAuB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,yBAAyB,CAAA;CAAE,CAAC,CAAC;AAEnF,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,WAAW,CAAC;IAClB,uDAAuD;IACvD,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,cAAc,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACpD,oBAAoB,EAAE,MAAM,IAAI,CAAC;IACjC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,wDAAwD;AACxD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,kCAAkC;AAClC,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,mFAAmF;AACnF,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B,2BAA2B,GAC3B,yBAAyB,GACzB,yBAAyB,GACzB,8BAA8B,GAC9B,+BAA+B,GAC/B,6BAA6B,GAC7B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,CAAC;AAEhC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;CAC3B,CAAC"}