@passflow/react 0.9.1 → 0.11.0

package/CHANGELOG.md

@@ -2,6 +2,43 @@
 
 All notable changes to `@passflow/react` are documented in this file.
 
+## [0.11.0] - 2026-10-28
+
+### Changed
+
+- Requires `@passflow/core` 0.17.0 or later, up from 0.15.0. Nothing in this package's own code changed for it — `useUpgrade`, `UpgradeProvider` and `UpgradeDialog` behave exactly as in 0.10.0, and the one core symbol the provider imports as a value, `requiredAcrLevel`, is unaffected.
+
+### Removed
+
+- Twenty-eight names are no longer re-exported. `src/index.ts` carries `export * from '@passflow/core'`, so this package republishes core's entry surface; core withdrew these across 0.16.0 and 0.17.0, and they therefore leave this package's surface too. The published entry goes from 184 exported names to 156.
+
+  Sixteen upgrade assembly functions, none of which a consumer was meant to call — the step-up flow is driven through `passflow.upgrade` and this package's `useUpgrade`:
+  `attachUpgradeAuth`, `barOf`, `coreOutcomeToError`, `createUpgradeClient`, `createUpgradeFacade`, `handleChallenge`, `mergeChallenges`, `parseAcrToken`, `parseMaxAge`, `planReplay`, `readAcrValues`, `readUpgradeChallenge`, `settleAxiosOutcome`, `settleFetchOutcome`, `tagUpgradeOutcome`, `upgradeFetch`.
+
+  Twelve types that only those functions produced, so no public API could hand a consumer a value of any of them:
+  `ChallengeContext`, `ChallengeInput`, `ChallengeReadOptions`, `ChallengeReading`, `CoreOutcome`, `InterceptionScope`, `MaxAgeReading`, `ReplayHints`, `ReplayPlan`, `Settlement`, `UpgradeFacadeDeps`, `UpgradeInterceptorOptions`.
+
+  `ChallengeChannel` and `UpgradeSessionPin` were part of that second group until review found each is still exposed by a public signature — `UpgradeChallenge.channels` and `AuthService.readSessionPin()` — so both remain exported. Everything the step-up UI needs is unchanged: `classifyUpgradeError`, `requiredAcrLevel`, the `isUpgrade*` predicates, the error classes, `UpgradeChallenge`, `UpgradeFacade` and the factor types.
+
+## [0.10.0] - 2026-10-28
+
+### Added
+
+- `UpgradeDialog`, the UI for an assurance upgrade (step-up authentication). A request answered with an RFC 9470 challenge elevates the session and replays itself; this is what the user sees while that happens. It is a library component with a catalogued Storybook story per supported state, including the terminal ones: attempts exhausted, a session changed under the user, a retryable transport failure versus a final one, and an elevation that succeeded only to be challenged again.
+- `useUpgrade` and `UpgradeProvider`. The provider wires the dialog to a configured `Passflow` instance and requires `@passflow/core` 0.15.0 or later; the hook reads the context and installs nothing, so a host rendering its own prompt can use it alone. A cancelled prompt resolves `null` rather than throwing.
+- `Spinner`, with its own story.
+- A `description` prop on the `option` button variant, exposed as an accessible description rather than folded into the name.
+
+### Fixed
+
+- The `option` button folded its hint into the accessible name, which read `"Authenticator appEnter the code from your app"`. The name is now pinned to the label through `aria-labelledby`, with the hint exposed through a merged `aria-describedby`.
+- Eight Storybook accessibility audits were scoped to `#storybook-root`, which Radix's `Dialog.Portal` leaves empty and marks `aria-hidden`. They had been passing vacuously, auditing nothing at all. They now scope to `[role="dialog"]` and fail on an empty render.
+- `pnpm test` no longer fails with `browserType.launch: Executable doesn't exist` after a `@playwright/test` bump. The script installs its browser first, which costs under a second when one is already present.
+
+### Removed
+
+- `upgrade-required-placeholder.tsx`, the internal stand-in the real dialog replaces. It was never exported from the package entry.
+
 ## [0.9.1] - 2026-10-26
 
 ### Fixed