@passflow/core 0.20.0 → 0.21.0

package/dist/lib/upgrade/session.d.ts

@@ -1,72 +0,0 @@
-/**
- * Session and user identity pinning for an upgrade flight (§13.4 revision 6).
- *
- * ## The rule
- *
- * An upgrade flight is bound to the **session and user identity it began
- * under**, and that identity is verified **at the moment tokens are applied** —
- * not only around `prepare` and `commit`. On mismatch the rotated tokens are
- * discarded, never applied, and the flight settles as `session changed
- * mid-flight`.
- *
- * ## Why the epoch counter was not enough
- *
- * The round-1 epoch check wraps the two rounds that talk to the server. It does
- * not wrap token APPLICATION, which happens inside `AuthService.refreshToken`
- * after the commit returns. A logout and re-login during an in-flight upgrade
- * therefore let user A's flight write its rotated tokens over user B's live
- * session: the request was authorized as A, the storage belongs to B, and
- * nothing in between compared the two principals.
- *
- * An epoch tells you something changed. An identity check tells you **whether
- * it is still the same principal**, which is the property actually required.
- * Both run, and they are complementary rather than redundant.
- *
- * ## Why this module is pure
- *
- * It imports nothing and reads no storage, so the token-applying path can be
- * given a pin by value and the comparison can be tested with literals. Reading
- * the identity is the host's job — it is the only code that knows where the
- * session lives in each delivery mode.
- */
-/**
- * The principal an upgrade flight is pinned to.
- *
- * `sub` is the user. `sid` is the session when the server issues one; it is
- * absent in tokens that carry no session claim, and the field is then simply
- * not part of the comparison — a missing claim cannot be made to prove
- * anything, and inventing a value would make two different sessions compare
- * equal or unequal arbitrarily.
- */
-export type UpgradeSessionPin = {
-    readonly sub: string;
-    readonly sid?: string;
-};
-/** Claims the pin is read from. Deliberately `unknown`-typed: it is a parsed JWT body. */
-export type UpgradeSessionClaims = {
-    sub?: unknown;
-    sid?: unknown;
-} | null | undefined;
-/**
- * Reads a pin from token claims, or `undefined` when there is no identity to
- * pin to.
- *
- * `sub` is mandatory: without a user there is no principal, and a pin that
- * compares nothing would report "unchanged" for every change.
- */
-export declare const readSessionPin: (claims: UpgradeSessionClaims) => UpgradeSessionPin | undefined;
-/**
- * Is `current` the same principal the flight was pinned to?
- *
- * `false` when `current` is absent: a pin exists, so the identity WAS readable
- * when the flight began, and an identity that has since become unreadable is a
- * change — the session was torn down. That is fail-closed on token
- * APPLICATION (nothing is written) and still fail-open on session STATE
- * (nothing is invalidated, nobody is logged out). §13.4 revision 6 keeps those
- * two axes separate on purpose.
- *
- * When both sides carry a `sid` it must match as well, which is what catches a
- * logout and re-login as the SAME user.
- */
-export declare const sessionPinMatches: (pin: UpgradeSessionPin, current: UpgradeSessionPin | undefined) => boolean;
-//# sourceMappingURL=session.d.ts.map

package/dist/lib/upgrade/session.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,0FAA0F;AAC1F,MAAM,MAAM,oBAAoB,GAAG;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,WAAY,oBAAoB,KAAG,iBAAiB,GAAG,SAKjF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,QAAS,iBAAiB,WAAW,iBAAiB,GAAG,SAAS,KAAG,OAQlG,CAAC"}

package/dist/lib/upgrade/snapshot.d.ts

@@ -1,196 +0,0 @@
-/**
- * The request snapshot: ONE normalised, immutable description of the request
- * that carried a challenge, captured before dispatch.
- *
- * ## Why this module exists
- *
- * Every authorization decision the upgrade feature makes — is this URL in scope,
- * what does the diagnostic name, what does the replay re-send — must be made on
- * the SAME description of the request, and that description must be the one the
- * platform will actually act on. Three defects in this feature were the same
- * defect from three angles:
- *
- *   1. the scope check hand-parsed the caller's URL *string*, while the browser
- *      normalises it before dispatch;
- *   2. the challenge context re-read the caller's live `input` at challenge
- *      time, while the replay was pinned to the plan-time URL and body;
- *   3. the replay could re-send a different header set than the one that was
- *      examined.
- *
- * So the request is normalised and frozen ONCE, here, and the snapshot is the
- * only thing the scope check, the challenge context, the diagnostics and the
- * replay are given. Nothing downstream holds a live reference to the caller's
- * `Request`, `RequestInit` or axios config.
- *
- * ## The normalisation rule, and why it is the platform's own parser
- *
- * **Resolve with `new URL(raw, base)` and compare `origin` on the result.**
- *
- * WHATWG URL parsing is not a string scan. For a special scheme it converts
- * backslashes to forward slashes and strips ASCII tab (0x09), LF (0x0A) and CR
- * (0x0D) *before* parsing. A scope check that inspects the raw string therefore
- * sees a same-origin relative path where the browser resolves a foreign origin:
- * `'/\\evil.example/x'`, `'/\t/evil.example/x'` and `'\\\\evil.example/x'` all
- * resolve to `https://evil.example` (§13.4's SF-3, SF-4, SF-7). Each one would
- * attach a step-up-elevated credential to a request leaving for an
- * attacker-controlled host.
- *
- * **The percent-encoded forms are the mirror image, and they are POSITIVES.**
- * `'/%5Cevil.example/x'`, `'/%09/evil.example/x'` and `'/%2F%2Fevil.example/x'`
- * all resolve to the page's OWN origin and must stay in scope (SF-9..SF-12):
- * the parser decodes nothing that could change the authority, so `%5C` is not a
- * backslash, `%09` stays an ordinary path character and `%2F%2F` does not begin
- * an authority. They are legitimate same-origin requests with odd-looking paths.
- *
- * That asymmetry is the entire argument for resolving rather than filtering. A
- * list of rejected characters is a denylist against a parser, and the parser is
- * the authority: it is bypassed by the raw forms, whose bytes it rewrites before
- * it parses them, AND it is wrong in the opposite direction on the encoded
- * forms, which it refuses as hostile when the platform treats them as plain
- * path text. Resolving first gets both directions — and the vectors nobody has
- * thought of yet — for free.
- *
- * The operative consequence for anyone editing this file: hand the input to
- * `new URL` **undecoded and un-normalised**. Any decoding, trimming or
- * rewriting before that call reintroduces one half of the defect or the other.
- *
- * Off the browser there is no document, so there is no "same origin" to resolve
- * against. A relative URL is then resolved against a RESERVED sentinel origin
- * (`.invalid` is reserved by RFC 2606 and can never be a real host), which keeps
- * exactly one code path: a URL that resolves to the sentinel's origin is a
- * genuinely relative one, and anything that steers the authority elsewhere —
- * `//evil.example/x` included — resolves away from it and is no longer relative.
- * The sentinel is `https:` precisely because it must be a SPECIAL scheme: the
- * backslash and tab rules above apply only to special schemes, so a custom
- * scheme would be a different parser and would miss the vectors.
- */
-import type { BodyKind } from './replay';
-/** One captured header. Lower-cased name, value verbatim. */
-export type SnapshotHeader = readonly [name: string, value: string];
-/**
- * The frozen description of one request.
- *
- * Immutable by construction: `Object.freeze` on the snapshot and on its header
- * list, and the body already captured by value where the shape is mutable. It
- * carries no live reference to anything the caller can still change.
- */
-export type RequestSnapshot = {
-    /** Exactly what the caller passed, for diagnostics only. NEVER for a decision. */
-    readonly raw: string;
-    /**
-     * The absolute, platform-normalised URL the request will actually be sent to,
-     * or `raw` when it could not be resolved at all (a malformed URL).
-     *
-     * This is the value every decision and the replay use.
-     */
-    readonly href: string;
-    /**
-     * The URL to actually DISPATCH a replay to.
-     *
-     * Identical to `href` wherever a real base existed — a browser, or any host
-     * that resolved the URL absolutely — which is the case every decision cares
-     * about. It falls back to `raw` only when resolution used the reserved
-     * sentinel base, i.e. a relative URL on a host with no document: the
-     * sentinel's origin is a reserved name that resolves to nothing, so sending
-     * `href` there would send the request into a hole. The transport's own base
-     * (axios' `baseURL`, the runtime's fetch base) then resolves the captured
-     * string, exactly as it did for the original send.
-     *
-     * It is still a captured STRING, never the caller's object, so the TOCTOU
-     * this module exists to close stays closed on that path too.
-     */
-    readonly dispatchUrl: string;
-    /** The resolved origin, or `undefined` when the URL could not be resolved. */
-    readonly origin?: string;
-    /** The resolved pathname, or the raw path when the URL could not be resolved. */
-    readonly pathname: string;
-    /** False when the URL could not be parsed even against the base. */
-    readonly resolved: boolean;
-    /**
-     * True when the resolved origin is the base's own — the page's origin on a
-     * browser, the sentinel's off it, which means "genuinely relative".
-     *
-     * This is what a same-origin path-prefix pattern (`backend: '/api'`) tests,
-     * and it is the one bit that makes `'/\\evil.example/x'` fail where `'/api/x'`
-     * passes.
-     */
-    readonly relativeToBase: boolean;
-    /** Upper-cased, with the same precedence the transport itself applies. */
-    readonly method: string;
-    /** The effective header set, captured once. Frozen. */
-    readonly headers: readonly SnapshotHeader[];
-    /** How the body can be re-sent, which is what decides replayability. */
-    readonly bodyKind: BodyKind;
-    /**
-     * The already-captured body. `undefined` means "the caller passed no body
-     * key", which is distinct from an explicit `null`.
-     */
-    readonly body?: unknown;
-};
-/**
- * The reserved origin a relative URL is resolved against when there is no
- * document. RFC 2606 reserves `.invalid`, so no real deployment can collide
- * with it, and `https:` keeps the parser on its special-scheme rules.
- */
-export declare const RELATIVE_BASE = "https://passflow-relative.invalid";
-/** What a URL normalised to. Pure: it takes the base, it does not read one. */
-export type NormalisedUrl = {
-    href: string;
-    origin?: string;
-    pathname: string;
-    resolved: boolean;
-    relativeToBase: boolean;
-    /** True when no real base existed and the reserved sentinel was used. */
-    sentinelBase: boolean;
-};
-/**
- * Resolves one URL with the platform's own parser.
- *
- * `base` defaults to the document base (or the sentinel off the browser). The
- * ONLY comparison any caller may make afterwards is on `origin` — never on the
- * raw string.
- */
-export declare const normaliseUrl: (raw: string, base?: string) => NormalisedUrl;
-/**
- * Captures a header bag by value.
- *
- * Every shape the two transports produce arrives here: a DOM `Headers`, an
- * `AxiosHeaders`, a plain object, an entry array, or an array-valued node bag.
- * Copying is the point — the caller may still hold and mutate the original.
- */
-export declare const captureHeaders: (headers: unknown) => readonly SnapshotHeader[];
-/** Reads a captured header. Case is already normalised, so this is exact. */
-export declare const snapshotHeader: (snapshot: RequestSnapshot, name: string) => string | undefined;
-/** What a caller must supply to take a snapshot. Everything else is derived. */
-export type RequestSnapshotInit = {
-    url: string;
-    method?: string;
-    headers?: unknown;
-    bodyKind: BodyKind;
-    /** Pass the key only when the caller supplied a body, so `undefined` stays meaningful. */
-    body?: unknown;
-    /** Overrides the document base. Tests and non-browser hosts only. */
-    base?: string;
-};
-/**
- * Takes the snapshot. Call it ONCE per request, BEFORE dispatch.
- *
- * Frozen on the way out: a snapshot that could be edited after the scope
- * decision would reintroduce the very TOCTOU this module removes.
- */
-export declare const createRequestSnapshot: (init: RequestSnapshotInit) => RequestSnapshot;
-/**
- * Applies the §5.5 credential swap to a captured header set, by EXACT match.
- *
- * Equality with the token we hold is what proves the header was ours; any other
- * value is forwarded untouched, because rewriting a header we do not own would
- * be a security bug. Returns the same frozen array when nothing changed, so the
- * common path allocates nothing.
- */
-export declare const swapAuthorization: (headers: readonly SnapshotHeader[], swap?: {
-    from: string;
-    to: string;
-}) => readonly SnapshotHeader[];
-/** The captured headers as the plain object both transports accept. */
-export declare const headersToObject: (headers: readonly SnapshotHeader[]) => Record<string, string>;
-//# sourceMappingURL=snapshot.d.ts.map

package/dist/lib/upgrade/snapshot.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,6DAA6D;AAC7D,MAAM,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,sCAAsC,CAAC;AAuBjE,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,QAAS,MAAM,SAAQ,MAAM,KAAsB,aAgC3E,CAAC;AAMF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,YAAa,OAAO,KAAG,SAAS,cAAc,EA4CxE,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,cAAc,aAAc,eAAe,QAAQ,MAAM,KAAG,MAAM,GAAG,SAQjF,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,0FAA0F;IAC1F,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,SAAU,mBAAmB,KAAG,eAkBjE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,YACnB,SAAS,cAAc,EAAE,SAC3B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,KAClC,SAAS,cAAc,EAazB,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,eAAe,YAAa,SAAS,cAAc,EAAE,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMzF,CAAC"}

package/dist/lib/upgrade/transport.d.ts

@@ -1,69 +0,0 @@
-/**
- * The HTTP adapter behind the `UpgradeTransport` port.
- *
- * It owns no axios instance. Both rounds arrive as narrow, function-shaped
- * dependencies, which keeps HTTP vocabulary one level away from the controller
- * and lets every test here be a synchronous fake instead of an HTTP mock.
- *
- * It is also STATELESS by design: no cached challenge id, no cached prepare
- * result, no attempt counter. A challenge is single-use and the server consumes
- * it atomically, so there is nothing a second attempt could legitimately reuse.
- * Statelessness is the whole of this module's obligation to "never reuse a spent
- * challenge_id", and it is checkable by calling `prepare()` twice.
- */
-import type { UpgradeRefreshField, UpgradeStartWire } from '../api/model';
-import type { UpgradeTransport } from './controller';
-import { type UpgradePrepared } from './factors';
-import type { UpgradeSessionPin } from './session';
-export type UpgradeTransportDeps = {
-    /** `POST /auth/upgrade/start`. Returns the raw snake_case body; rejects with `PassflowError`. */
-    startUpgrade(payload: {
-        method: string;
-        relying_party_id?: string;
-    }): Promise<UpgradeStartWire>;
-    /**
-     * `POST /auth/refresh` carrying `upgrade`. Resolves once the elevated tokens
-     * are STORED.
-     *
-     * `pin` is the session and user identity the flight began under (§13.4
-     * revision 6). The host verifies it immediately before it applies the rotated
-     * tokens and discards them on mismatch — the check has to live inside the
-     * token-applying path, because that is the only place it cannot be bypassed
-     * by another entry point. The transport only carries the value; the facade
-     * supplies it, since the flight's start is what it is pinned to.
-     */
-    commitRefresh(upgrade: UpgradeRefreshField, pin?: UpgradeSessionPin): Promise<void>;
-    /** Reports whether this delivery mode can carry an upgrade at all. BFF cannot. */
-    canCommit(): {
-        ok: true;
-    } | {
-        ok: false;
-        reason: string;
-    };
-    /** Optional relying-party id for passkey upgrades; forwarded verbatim. */
-    relyingPartyId?: () => string | undefined;
-    /**
-     * Invalidates the session. Called ONLY for a commit 401 whose error id
-     * positively means the session died (`invalidatesSessionOnCommit`) — a
-     * genuine expiry during an elevation is still an expiry, and the transport is
-     * the only code that can tell, because it knows it issued the request and can
-     * read the error id. Everything else, including an id this SDK does not
-     * recognise, leaves the session alone.
-     */
-    markSessionInvalid?: () => void;
-};
-/**
- * Normalises the prepare round's wire body.
- *
- * `webauthn` is passed through by reference, never re-serialised: the ceremony
- * hands those exact bytes to the authenticator and the server re-parses them on
- * the way back.
- *
- * A missing `challenge_id` or `expires_at` is a protocol violation, not an
- * optional field. Producing `challengeId: undefined` would surface two round
- * trips later as an opaque 401 with nothing to point at.
- */
-export declare const toPrepared: (wire: UpgradeStartWire) => UpgradePrepared;
-/** Builds the transport. Returns the port type, so the controller stays HTTP-agnostic. */
-export declare const createUpgradeTransport: (deps: UpgradeTransportDeps) => UpgradeTransport;
-//# sourceMappingURL=transport.d.ts.map

package/dist/lib/upgrade/transport.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../../lib/upgrade/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQrD,OAAO,EAA0E,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AACzH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,MAAM,MAAM,oBAAoB,GAAG;IACjC,iGAAiG;IACjG,YAAY,CAAC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChG;;;;;;;;;;OAUG;IACH,aAAa,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,kFAAkF;IAClF,SAAS,IAAI;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC1C;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC,CAAC;AAUF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,SAAU,gBAAgB,KAAG,eAenD,CAAC;AAYF,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,SAAU,oBAAoB,KAAG,gBA6ElE,CAAC"}

package/dist/lib/utils/validation.d.ts

@@ -1,54 +0,0 @@
-/**
- * Validates JWT token format (not signature, just structure)
- * Checks that the token has 3 parts separated by dots and each part is valid base64url
- *
- * @param token - The token string to validate
- * @returns true if the token has valid JWT format, false otherwise
- */
-export declare function isValidJWTFormat(token: string): boolean;
-/**
- * Sanitizes error messages from URL parameters to prevent XSS
- * Removes HTML tags and limits length
- *
- * @param message - The error message to sanitize
- * @returns Sanitized error message
- */
-export declare function sanitizeErrorMessage(message: string): string;
-/**
- * Validates email format using RFC 5322 simplified pattern
- *
- * @param email - The email string to validate
- * @returns true if valid email format, false otherwise
- */
-export declare function isValidEmail(email: string): boolean;
-/**
- * Validates phone number format (E.164 format)
- *
- * @param phone - The phone number string to validate
- * @returns true if valid phone format, false otherwise
- */
-export declare function isValidPhoneNumber(phone: string): boolean;
-/**
- * Validates username format
- *
- * @param username - The username string to validate
- * @returns true if valid username format, false otherwise
- */
-export declare function isValidUsername(username: string): boolean;
-/**
- * Validates TOTP code format (6 or 8 numeric digits)
- *
- * @param code - The TOTP code to validate
- * @param digits - Expected number of digits (6 or 8, defaults to 6 for backward compatibility)
- * @returns true if valid TOTP code format, false otherwise
- */
-export declare function isValidTOTPCode(code: string, digits?: 6 | 8): boolean;
-/**
- * Normalizes and validates recovery code format
- * Converts to uppercase and removes whitespace
- *
- * @param code - The recovery code to normalize and validate
- * @returns Normalized recovery code if valid, null if invalid
- */
-export declare function normalizeRecoveryCode(code: string): string | null;
-//# sourceMappingURL=validation.d.ts.map

package/dist/lib/utils/validation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../lib/utils/validation.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CASvD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CASnD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQzD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CASzD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,CAAC,GAAG,CAAK,GAAG,OAAO,CAMxE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcjE"}

package/dist/tsconfig.build.tsbuildinfo

@@ -1 +0,0 @@
-{"version":"7.0.2","root":["../lib/index.ts","../lib/passflow.ts","../lib/pkce.ts","../lib/store.ts","../lib/api/app.ts","../lib/api/auth.ts","../lib/api/axios-client.ts","../lib/api/cli-auth.ts","../lib/api/index.ts","../lib/api/invitation.ts","../lib/api/model.ts","../lib/api/setting.ts","../lib/api/tenant.ts","../lib/api/two-factor.ts","../lib/api/upgrade.ts","../lib/api/user.ts","../lib/constants/index.ts","../lib/device/index.ts","../lib/interceptors/fetch-registry.ts","../lib/m2m/client.ts","../lib/m2m/errors.ts","../lib/m2m/index.ts","../lib/m2m/types.ts","../lib/platform/index.ts","../lib/platform/types.ts","../lib/platform/web-adapter.ts","../lib/services/auth-service.ts","../lib/services/index.ts","../lib/services/invitation-service.ts","../lib/services/logger.ts","../lib/services/tenant-service.ts","../lib/services/tenant-user-membership.ts","../lib/services/token-cache-service.ts","../lib/services/two-factor-service.ts","../lib/services/user-service.ts","../lib/storage/index.ts","../lib/token/delivery-manager.ts","../lib/token/index.ts","../lib/token/membership.ts","../lib/token/service.ts","../lib/token/token.ts","../lib/types/index.ts","../lib/upgrade/acr.ts","../lib/upgrade/axios-adapter.ts","../lib/upgrade/challenge.ts","../lib/upgrade/client.ts","../lib/upgrade/controller.ts","../lib/upgrade/core.ts","../lib/upgrade/errors.ts","../lib/upgrade/facade.ts","../lib/upgrade/factors.ts","../lib/upgrade/fetch-adapter.ts","../lib/upgrade/index.ts","../lib/upgrade/markers.ts","../lib/upgrade/replay.ts","../lib/upgrade/select.ts","../lib/upgrade/session.ts","../lib/upgrade/snapshot.ts","../lib/upgrade/transport.ts","../lib/utils/validation.ts"],"packageJsons":["../node_modules/.pnpm/@simplewebauthn+browser@14.0.0/node_modules/@simplewebauthn/browser/esm/package.json","../node_modules/.pnpm/@simplewebauthn+browser@14.0.0/node_modules/@simplewebauthn/browser/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/package.json","../node_modules/.pnpm/axios@1.21.0/node_modules/axios/package.json","../node_modules/.pnpm/punycode@2.3.1/node_modules/punycode/package.json","../node_modules/.pnpm/undici-types@8.9.0/node_modules/undici-types/package.json","../node_modules/.pnpm/uuid@14.0.3/node_modules/uuid/package.json","../package.json"],"missingPackageJsons":["../node_modules/.pnpm/@simplewebauthn+browser@14.0.0/node_modules/@simplewebauthn/browser/esm/helpers/package.json","../node_modules/.pnpm/@simplewebauthn+browser@14.0.0/node_modules/@simplewebauthn/browser/esm/methods/package.json","../node_modules/.pnpm/@simplewebauthn+browser@14.0.0/node_modules/@simplewebauthn/browser/esm/types/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/assert/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/assert/strict/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/async_hooks/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/buffer/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/child_process/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/cluster/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/console/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/constants/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/crypto/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/dgram/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/diagnostics_channel/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/dns/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/dns/promises/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/domain/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/events/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/fs/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/fs/promises/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/http/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/http2/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/https/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/inspector/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/inspector/promises/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/module/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/net/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/assert/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/dns/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/fs/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/inspector/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/path/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/readline/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/stream/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/test/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/timers/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/util/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/web-globals/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/node/zlib/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/os/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/path/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/path/posix/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/path/win32/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/perf_hooks/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/process/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/punycode/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/querystring/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/readline/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/readline/promises/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/repl/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/stream/consumers/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/stream/iter/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/stream/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/stream/promises/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/stream/web/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/string_decoder/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/timers/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/timers/promises/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/tls/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/trace_events/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/tty/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/url/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/util/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/util/types/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/v8/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/vm/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/wasi/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/worker_threads/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/@types/zlib/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/assert/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/assert/strict/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/async_hooks/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/buffer/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/child_process/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/cluster/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/console/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/constants/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/crypto/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/dgram/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/diagnostics_channel/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/dns/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/dns/promises/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/domain/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/events/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/fs/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/fs/promises/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/http/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/http2/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/https/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/inspector/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/inspector/promises/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/module/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/net/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/os/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/path/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/path/posix/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/path/win32/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/perf_hooks/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/process/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/punycode/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/querystring/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/readline/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/readline/promises/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/repl/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/stream/consumers/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/stream/iter/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/stream/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/stream/promises/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/stream/web/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/string_decoder/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/timers/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/timers/promises/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/tls/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/trace_events/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/tty/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/url/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/util/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/util/types/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/v8/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/vm/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/wasi/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/worker_threads/package.json","../node_modules/.pnpm/@types+node@26.6.6/node_modules/zlib/package.json","../node_modules/.pnpm/node_modules/@types/assert/package.json","../node_modules/.pnpm/node_modules/@types/assert/strict/package.json","../node_modules/.pnpm/node_modules/@types/async_hooks/package.json","../node_modules/.pnpm/node_modules/@types/buffer/package.json","../node_modules/.pnpm/node_modules/@types/child_process/package.json","../node_modules/.pnpm/node_modules/@types/cluster/package.json","../node_modules/.pnpm/node_modules/@types/console/package.json","../node_modules/.pnpm/node_modules/@types/constants/package.json","../node_modules/.pnpm/node_modules/@types/crypto/package.json","../node_modules/.pnpm/node_modules/@types/dgram/package.json","../node_modules/.pnpm/node_modules/@types/diagnostics_channel/package.json","../node_modules/.pnpm/node_modules/@types/dns/package.json","../node_modules/.pnpm/node_modules/@types/dns/promises/package.json","../node_modules/.pnpm/node_modules/@types/domain/package.json","../node_modules/.pnpm/node_modules/@types/events/package.json","../node_modules/.pnpm/node_modules/@types/fs/package.json","../node_modules/.pnpm/node_modules/@types/fs/promises/package.json","../node_modules/.pnpm/node_modules/@types/http/package.json","../node_modules/.pnpm/node_modules/@types/http2/package.json","../node_modules/.pnpm/node_modules/@types/https/package.json","../node_modules/.pnpm/node_modules/@types/inspector/package.json","../node_modules/.pnpm/node_modules/@types/inspector/promises/package.json","../node_modules/.pnpm/node_modules/@types/module/package.json","../node_modules/.pnpm/node_modules/@types/net/package.json","../node_modules/.pnpm/node_modules/@types/os/package.json","../node_modules/.pnpm/node_modules/@types/path/package.json","../node_modules/.pnpm/node_modules/@types/path/posix/package.json","../node_modules/.pnpm/node_modules/@types/path/win32/package.json","../node_modules/.pnpm/node_modules/@types/perf_hooks/package.json","../node_modules/.pnpm/node_modules/@types/process/package.json","../node_modules/.pnpm/node_modules/@types/punycode/package.json","../node_modules/.pnpm/node_modules/@types/querystring/package.json","../node_modules/.pnpm/node_modules/@types/readline/package.json","../node_modules/.pnpm/node_modules/@types/readline/promises/package.json","../node_modules/.pnpm/node_modules/@types/repl/package.json","../node_modules/.pnpm/node_modules/@types/stream/consumers/package.json","../node_modules/.pnpm/node_modules/@types/stream/iter/package.json","../node_modules/.pnpm/node_modules/@types/stream/package.json","../node_modules/.pnpm/node_modules/@types/stream/promises/package.json","../node_modules/.pnpm/node_modules/@types/stream/web/package.json","../node_modules/.pnpm/node_modules/@types/string_decoder/package.json","../node_modules/.pnpm/node_modules/@types/timers/package.json","../node_modules/.pnpm/node_modules/@types/timers/promises/package.json","../node_modules/.pnpm/node_modules/@types/tls/package.json","../node_modules/.pnpm/node_modules/@types/trace_events/package.json","../node_modules/.pnpm/node_modules/@types/tty/package.json","../node_modules/.pnpm/node_modules/@types/url/package.json","../node_modules/.pnpm/node_modules/@types/util/package.json","../node_modules/.pnpm/node_modules/@types/util/types/package.json","../node_modules/.pnpm/node_modules/@types/v8/package.json","../node_modules/.pnpm/node_modules/@types/vm/package.json","../node_modules/.pnpm/node_modules/@types/wasi/package.json","../node_modules/.pnpm/node_modules/@types/worker_threads/package.json","../node_modules/.pnpm/node_modules/@types/zlib/package.json","../node_modules/.pnpm/node_modules/assert/package.json","../node_modules/.pnpm/node_modules/assert/strict/package.json","../node_modules/.pnpm/node_modules/async_hooks/package.json","../node_modules/.pnpm/node_modules/buffer/package.json","../node_modules/.pnpm/node_modules/child_process/package.json","../node_modules/.pnpm/node_modules/cluster/package.json","../node_modules/.pnpm/node_modules/console/package.json","../node_modules/.pnpm/node_modules/constants/package.json","../node_modules/.pnpm/node_modules/crypto/package.json","../node_modules/.pnpm/node_modules/dgram/package.json","../node_modules/.pnpm/node_modules/diagnostics_channel/package.json","../node_modules/.pnpm/node_modules/dns/package.json","../node_modules/.pnpm/node_modules/dns/promises/package.json","../node_modules/.pnpm/node_modules/domain/package.json","../node_modules/.pnpm/node_modules/events/package.json","../node_modules/.pnpm/node_modules/fs/package.json","../node_modules/.pnpm/node_modules/fs/promises/package.json","../node_modules/.pnpm/node_modules/http/package.json","../node_modules/.pnpm/node_modules/http2/package.json","../node_modules/.pnpm/node_modules/https/package.json","../node_modules/.pnpm/node_modules/inspector/package.json","../node_modules/.pnpm/node_modules/inspector/promises/package.json","../node_modules/.pnpm/node_modules/module/package.json","../node_modules/.pnpm/node_modules/net/package.json","../node_modules/.pnpm/node_modules/os/package.json","../node_modules/.pnpm/node_modules/path/package.json","../node_modules/.pnpm/node_modules/path/posix/package.json","../node_modules/.pnpm/node_modules/path/win32/package.json","../node_modules/.pnpm/node_modules/perf_hooks/package.json","../node_modules/.pnpm/node_modules/process/package.json","../node_modules/.pnpm/node_modules/querystring/package.json","../node_modules/.pnpm/node_modules/readline/package.json","../node_modules/.pnpm/node_modules/readline/promises/package.json","../node_modules/.pnpm/node_modules/repl/package.json","../node_modules/.pnpm/node_modules/stream/consumers/package.json","../node_modules/.pnpm/node_modules/stream/iter/package.json","../node_modules/.pnpm/node_modules/stream/package.json","../node_modules/.pnpm/node_modules/stream/promises/package.json","../node_modules/.pnpm/node_modules/stream/web/package.json","../node_modules/.pnpm/node_modules/string_decoder/package.json","../node_modules/.pnpm/node_modules/timers/package.json","../node_modules/.pnpm/node_modules/timers/promises/package.json","../node_modules/.pnpm/node_modules/tls/package.json","../node_modules/.pnpm/node_modules/trace_events/package.json","../node_modules/.pnpm/node_modules/tty/package.json","../node_modules/.pnpm/node_modules/url/package.json","../node_modules/.pnpm/node_modules/util/package.json","../node_modules/.pnpm/node_modules/util/types/package.json","../node_modules/.pnpm/node_modules/v8/package.json","../node_modules/.pnpm/node_modules/vm/package.json","../node_modules/.pnpm/node_modules/wasi/package.json","../node_modules/.pnpm/node_modules/worker_threads/package.json","../node_modules/.pnpm/node_modules/zlib/package.json","../node_modules/.pnpm/uuid@14.0.3/node_modules/uuid/dist/package.json","../node_modules/@types/assert/package.json","../node_modules/@types/assert/strict/package.json","../node_modules/@types/async_hooks/package.json","../node_modules/@types/buffer/package.json","../node_modules/@types/child_process/package.json","../node_modules/@types/cluster/package.json","../node_modules/@types/console/package.json","../node_modules/@types/constants/package.json","../node_modules/@types/crypto/package.json","../node_modules/@types/dgram/package.json","../node_modules/@types/diagnostics_channel/package.json","../node_modules/@types/dns/package.json","../node_modules/@types/dns/promises/package.json","../node_modules/@types/domain/package.json","../node_modules/@types/events/package.json","../node_modules/@types/fs/package.json","../node_modules/@types/fs/promises/package.json","../node_modules/@types/http/package.json","../node_modules/@types/http2/package.json","../node_modules/@types/https/package.json","../node_modules/@types/inspector/package.json","../node_modules/@types/inspector/promises/package.json","../node_modules/@types/module/package.json","../node_modules/@types/net/package.json","../node_modules/@types/os/package.json","../node_modules/@types/path/package.json","../node_modules/@types/path/posix/package.json","../node_modules/@types/path/win32/package.json","../node_modules/@types/perf_hooks/package.json","../node_modules/@types/process/package.json","../node_modules/@types/punycode/package.json","../node_modules/@types/querystring/package.json","../node_modules/@types/readline/package.json","../node_modules/@types/readline/promises/package.json","../node_modules/@types/repl/package.json","../node_modules/@types/stream/consumers/package.json","../node_modules/@types/stream/iter/package.json","../node_modules/@types/stream/package.json","../node_modules/@types/stream/promises/package.json","../node_modules/@types/stream/web/package.json","../node_modules/@types/string_decoder/package.json","../node_modules/@types/timers/package.json","../node_modules/@types/timers/promises/package.json","../node_modules/@types/tls/package.json","../node_modules/@types/trace_events/package.json","../node_modules/@types/tty/package.json","../node_modules/@types/url/package.json","../node_modules/@types/util/package.json","../node_modules/@types/util/types/package.json","../node_modules/@types/v8/package.json","../node_modules/@types/vm/package.json","../node_modules/@types/wasi/package.json","../node_modules/@types/worker_threads/package.json","../node_modules/@types/zlib/package.json","../node_modules/assert/package.json","../node_modules/assert/strict/package.json","../node_modules/async_hooks/package.json","../node_modules/buffer/package.json","../node_modules/child_process/package.json","../node_modules/cluster/package.json","../node_modules/console/package.json","../node_modules/constants/package.json","../node_modules/crypto/package.json","../node_modules/dgram/package.json","../node_modules/diagnostics_channel/package.json","../node_modules/dns/package.json","../node_modules/dns/promises/package.json","../node_modules/domain/package.json","../node_modules/events/package.json","../node_modules/fs/package.json","../node_modules/fs/promises/package.json","../node_modules/http/package.json","../node_modules/http2/package.json","../node_modules/https/package.json","../node_modules/inspector/package.json","../node_modules/inspector/promises/package.json","../node_modules/module/package.json","../node_modules/net/package.json","../node_modules/os/package.json","../node_modules/path/package.json","../node_modules/path/posix/package.json","../node_modules/path/win32/package.json","../node_modules/perf_hooks/package.json","../node_modules/process/package.json","../node_modules/punycode/package.json","../node_modules/querystring/package.json","../node_modules/readline/package.json","../node_modules/readline/promises/package.json","../node_modules/repl/package.json","../node_modules/stream/consumers/package.json","../node_modules/stream/iter/package.json","../node_modules/stream/package.json","../node_modules/stream/promises/package.json","../node_modules/stream/web/package.json","../node_modules/string_decoder/package.json","../node_modules/timers/package.json","../node_modules/timers/promises/package.json","../node_modules/tls/package.json","../node_modules/trace_events/package.json","../node_modules/tty/package.json","../node_modules/url/package.json","../node_modules/util/package.json","../node_modules/util/types/package.json","../node_modules/v8/package.json","../node_modules/vm/package.json","../node_modules/wasi/package.json","../node_modules/worker_threads/package.json","../node_modules/zlib/package.json"]}