@strapi/admin 5.56.0 → 5.58.0

package/dist/server/server/src/strategies/data-transfer.js.map

@@ -1 +1 @@
-{"version":3,"file":"data-transfer.js","sources":["../../../../../server/src/strategies/data-transfer.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { differenceInHours, parseISO } from 'date-fns';\nimport { errors } from '@strapi/utils';\nimport { castArray, isNil } from 'lodash/fp';\n\nimport { getService } from '../utils';\n\nconst { UnauthorizedError, ForbiddenError } = errors;\n\nconst extractToken = (ctx: Context) => {\n  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {\n    const parts = ctx.request.header.authorization.split(/\\s+/);\n\n    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {\n      return null;\n    }\n\n    return parts[1];\n  }\n\n  return null;\n};\n\n/**\n * Authenticate the validity of the token\n *\n *  @type {import('.').AuthenticateFunction}\n */\nexport const authenticate = async (ctx: Context) => {\n  const { token: tokenService } = getService('transfer');\n  const token = extractToken(ctx);\n\n  if (!token) {\n    return { authenticated: false };\n  }\n\n  const transferToken = await tokenService.getBy({ accessKey: tokenService.hash(token) });\n\n  // Check if the token exists\n  if (!transferToken) {\n    return { authenticated: false };\n  }\n\n  // Check if the token has expired\n  const currentDate = new Date();\n\n  if (!isNil(transferToken.expiresAt)) {\n    const expirationDate = new Date(transferToken.expiresAt);\n\n    if (expirationDate < currentDate) {\n      return { authenticated: false, error: new UnauthorizedError('Token expired') };\n    }\n  }\n\n  // Update token metadata if the token has not been used in the last hour\n  // @ts-expect-error - FIXME: verify lastUsedAt is defined\n  const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(transferToken.lastUsedAt));\n  if (hoursSinceLastUsed >= 1) {\n    await strapi.db.query('admin::api-token').update({\n      where: { id: transferToken.id },\n      data: { lastUsedAt: currentDate },\n    });\n  }\n\n  // Generate an ability based on the token permissions\n  const ability = await getService('transfer').permission.engine.generateAbility(\n    transferToken.permissions.map((action: any) => ({ action }))\n  );\n\n  return { authenticated: true, ability, credentials: transferToken };\n};\n\n/**\n * Verify the token has the required abilities for the requested scope\n *\n *  @type {import('.').VerifyFunction}\n */\nexport const verify = async (auth: any, config: any = {}) => {\n  const { credentials: transferToken, ability } = auth;\n\n  if (!transferToken) {\n    throw new UnauthorizedError('Token not found');\n  }\n\n  const currentDate = new Date();\n\n  if (!isNil(transferToken.expiresAt)) {\n    const expirationDate = new Date(transferToken.expiresAt);\n    // token has expired\n    if (expirationDate < currentDate) {\n      throw new UnauthorizedError('Token expired');\n    }\n  }\n\n  if (!ability) {\n    throw new ForbiddenError();\n  }\n\n  const scopes = castArray(config.scope ?? []);\n\n  const isAllowed = scopes.every((scope) => ability.can(scope));\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nexport const name = 'data-transfer';\n\n/** @type {import('.').AuthStrategy} */\nexport default {\n  name,\n  authenticate,\n  verify,\n};\n"],"names":["UnauthorizedError","ForbiddenError","errors","extractToken","ctx","request","header","authorization","parts","split","toLowerCase","length","authenticate","token","tokenService","getService","authenticated","transferToken","getBy","accessKey","hash","currentDate","Date","isNil","expiresAt","expirationDate","error","hoursSinceLastUsed","differenceInHours","parseISO","lastUsedAt","strapi","db","query","update","where","id","data","ability","permission","engine","generateAbility","permissions","map","action","credentials","verify","auth","config","scopes","castArray","scope","isAllowed","every","can","name"],"mappings":";;;;;;;;;AAOA,MAAM,EAAEA,iBAAiB,EAAEC,cAAc,EAAE,GAAGC,YAAAA;AAE9C,MAAMC,eAAe,CAACC,GAAAA,GAAAA;AACpB,IAAA,IAAIA,GAAAA,CAAIC,OAAO,IAAID,GAAAA,CAAIC,OAAO,CAACC,MAAM,IAAIF,GAAAA,CAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,EAAE;QACzE,MAAMC,KAAAA,GAAQJ,IAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,CAACE,KAAK,CAAC,KAAA,CAAA;QAErD,IAAID,KAAK,CAAC,CAAA,CAAE,CAACE,WAAW,OAAO,QAAA,IAAYF,KAAAA,CAAMG,MAAM,KAAK,CAAA,EAAG;YAC7D,OAAO,IAAA;AACT,QAAA;QAEA,OAAOH,KAAK,CAAC,CAAA,CAAE;AACjB,IAAA;IAEA,OAAO,IAAA;AACT,CAAA;AAEA;;;;IAKO,MAAMI,YAAAA,GAAe,OAAOR,GAAAA,GAAAA;AACjC,IAAA,MAAM,EAAES,KAAAA,EAAOC,YAAY,EAAE,GAAGC,gBAAAA,CAAW,UAAA,CAAA;AAC3C,IAAA,MAAMF,QAAQV,YAAAA,CAAaC,GAAAA,CAAAA;AAE3B,IAAA,IAAI,CAACS,KAAAA,EAAO;QACV,OAAO;YAAEG,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,aAAAA,GAAgB,MAAMH,YAAAA,CAAaI,KAAK,CAAC;QAAEC,SAAAA,EAAWL,YAAAA,CAAaM,IAAI,CAACP,KAAAA;AAAO,KAAA,CAAA;;AAGrF,IAAA,IAAI,CAACI,aAAAA,EAAe;QAClB,OAAO;YAAED,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;;AAGA,IAAA,MAAMK,cAAc,IAAIC,IAAAA,EAAAA;AAExB,IAAA,IAAI,CAACC,QAAAA,CAAMN,aAAAA,CAAcO,SAAS,CAAA,EAAG;AACnC,QAAA,MAAMC,cAAAA,GAAiB,IAAIH,IAAAA,CAAKL,aAAAA,CAAcO,SAAS,CAAA;AAEvD,QAAA,IAAIC,iBAAiBJ,WAAAA,EAAa;YAChC,OAAO;gBAAEL,aAAAA,EAAe,KAAA;AAAOU,gBAAAA,KAAAA,EAAO,IAAI1B,iBAAAA,CAAkB,eAAA;AAAiB,aAAA;AAC/E,QAAA;AACF,IAAA;;;AAIA,IAAA,MAAM2B,kBAAAA,GAAqBC,yBAAAA,CAAkBP,WAAAA,EAAaQ,gBAAAA,CAASZ,cAAca,UAAU,CAAA,CAAA;AAC3F,IAAA,IAAIH,sBAAsB,CAAA,EAAG;AAC3B,QAAA,MAAMI,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;YAC/CC,KAAAA,EAAO;AAAEC,gBAAAA,EAAAA,EAAInB,cAAcmB;AAAG,aAAA;YAC9BC,IAAAA,EAAM;gBAAEP,UAAAA,EAAYT;AAAY;AAClC,SAAA,CAAA;AACF,IAAA;;AAGA,IAAA,MAAMiB,UAAU,MAAMvB,gBAAAA,CAAW,UAAA,CAAA,CAAYwB,UAAU,CAACC,MAAM,CAACC,eAAe,CAC5ExB,cAAcyB,WAAW,CAACC,GAAG,CAAC,CAACC,UAAiB;AAAEA,YAAAA;SAAO,CAAA,CAAA,CAAA;IAG3D,OAAO;QAAE5B,aAAAA,EAAe,IAAA;AAAMsB,QAAAA,OAAAA;QAASO,WAAAA,EAAa5B;AAAc,KAAA;AACpE;AAEA;;;;AAIC,IACM,MAAM6B,MAAAA,GAAS,OAAOC,IAAAA,EAAWC,MAAAA,GAAc,EAAE,GAAA;AACtD,IAAA,MAAM,EAAEH,WAAAA,EAAa5B,aAAa,EAAEqB,OAAO,EAAE,GAAGS,IAAAA;AAEhD,IAAA,IAAI,CAAC9B,aAAAA,EAAe;AAClB,QAAA,MAAM,IAAIjB,iBAAAA,CAAkB,iBAAA,CAAA;AAC9B,IAAA;AAEA,IAAA,MAAMqB,cAAc,IAAIC,IAAAA,EAAAA;AAExB,IAAA,IAAI,CAACC,QAAAA,CAAMN,aAAAA,CAAcO,SAAS,CAAA,EAAG;AACnC,QAAA,MAAMC,cAAAA,GAAiB,IAAIH,IAAAA,CAAKL,aAAAA,CAAcO,SAAS,CAAA;;AAEvD,QAAA,IAAIC,iBAAiBJ,WAAAA,EAAa;AAChC,YAAA,MAAM,IAAIrB,iBAAAA,CAAkB,eAAA,CAAA;AAC9B,QAAA;AACF,IAAA;AAEA,IAAA,IAAI,CAACsC,OAAAA,EAAS;AACZ,QAAA,MAAM,IAAIrC,cAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,MAAMgD,MAAAA,GAASC,YAAAA,CAAUF,MAAAA,CAAOG,KAAK,IAAI,EAAE,CAAA;IAE3C,MAAMC,SAAAA,GAAYH,OAAOI,KAAK,CAAC,CAACF,KAAAA,GAAUb,OAAAA,CAAQgB,GAAG,CAACH,KAAAA,CAAAA,CAAAA;AAEtD,IAAA,IAAI,CAACC,SAAAA,EAAW;AACd,QAAA,MAAM,IAAInD,cAAAA,EAAAA;AACZ,IAAA;AACF;AAEO,MAAMsD,OAAO;AAEpB,wCACA,+BAAe;AACbA,IAAAA,IAAAA;AACA3C,IAAAA,YAAAA;AACAkC,IAAAA;AACF,CAAA;;;;;;;"}
+{"version":3,"file":"data-transfer.js","sources":["../../../../../server/src/strategies/data-transfer.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { differenceInHours, parseISO } from 'date-fns';\nimport { errors } from '@strapi/utils';\nimport { castArray } from 'lodash';\n\nimport { getService } from '../utils';\n\nconst { UnauthorizedError, ForbiddenError } = errors;\n\nconst extractToken = (ctx: Context) => {\n  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {\n    const parts = ctx.request.header.authorization.split(/\\s+/);\n\n    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {\n      return null;\n    }\n\n    return parts[1];\n  }\n\n  return null;\n};\n\n/**\n * Authenticate the validity of the token\n *\n *  @type {import('.').AuthenticateFunction}\n */\nexport const authenticate = async (ctx: Context) => {\n  const { token: tokenService } = getService('transfer');\n  const token = extractToken(ctx);\n\n  if (!token) {\n    return { authenticated: false };\n  }\n\n  const transferToken = await tokenService.getBy({ accessKey: tokenService.hash(token) });\n\n  // Check if the token exists\n  if (!transferToken) {\n    return { authenticated: false };\n  }\n\n  // Check if the token has expired\n  const currentDate = new Date();\n\n  if (transferToken.expiresAt != null) {\n    const expirationDate = new Date(transferToken.expiresAt);\n\n    if (expirationDate < currentDate) {\n      return { authenticated: false, error: new UnauthorizedError('Token expired') };\n    }\n  }\n\n  // Update token metadata if the token has not been used in the last hour\n  // @ts-expect-error - FIXME: verify lastUsedAt is defined\n  const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(transferToken.lastUsedAt));\n  if (hoursSinceLastUsed >= 1) {\n    await strapi.db.query('admin::api-token').update({\n      where: { id: transferToken.id },\n      data: { lastUsedAt: currentDate },\n    });\n  }\n\n  // Generate an ability based on the token permissions\n  const ability = await getService('transfer').permission.engine.generateAbility(\n    transferToken.permissions.map((action: any) => ({ action }))\n  );\n\n  return { authenticated: true, ability, credentials: transferToken };\n};\n\n/**\n * Verify the token has the required abilities for the requested scope\n *\n *  @type {import('.').VerifyFunction}\n */\nexport const verify = async (auth: any, config: any = {}) => {\n  const { credentials: transferToken, ability } = auth;\n\n  if (!transferToken) {\n    throw new UnauthorizedError('Token not found');\n  }\n\n  const currentDate = new Date();\n\n  if (transferToken.expiresAt != null) {\n    const expirationDate = new Date(transferToken.expiresAt);\n    // token has expired\n    if (expirationDate < currentDate) {\n      throw new UnauthorizedError('Token expired');\n    }\n  }\n\n  if (!ability) {\n    throw new ForbiddenError();\n  }\n\n  const scopes = castArray(config.scope ?? []);\n\n  const isAllowed = scopes.every((scope) => ability.can(scope));\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nexport const name = 'data-transfer';\n\n/** @type {import('.').AuthStrategy} */\nexport default {\n  name,\n  authenticate,\n  verify,\n};\n"],"names":["UnauthorizedError","ForbiddenError","errors","extractToken","ctx","request","header","authorization","parts","split","toLowerCase","length","authenticate","token","tokenService","getService","authenticated","transferToken","getBy","accessKey","hash","currentDate","Date","expiresAt","expirationDate","error","hoursSinceLastUsed","differenceInHours","parseISO","lastUsedAt","strapi","db","query","update","where","id","data","ability","permission","engine","generateAbility","permissions","map","action","credentials","verify","auth","config","scopes","castArray","scope","isAllowed","every","can","name"],"mappings":";;;;;;;;;AAOA,MAAM,EAAEA,iBAAiB,EAAEC,cAAc,EAAE,GAAGC,YAAAA;AAE9C,MAAMC,eAAe,CAACC,GAAAA,GAAAA;AACpB,IAAA,IAAIA,GAAAA,CAAIC,OAAO,IAAID,GAAAA,CAAIC,OAAO,CAACC,MAAM,IAAIF,GAAAA,CAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,EAAE;QACzE,MAAMC,KAAAA,GAAQJ,IAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,CAACE,KAAK,CAAC,KAAA,CAAA;QAErD,IAAID,KAAK,CAAC,CAAA,CAAE,CAACE,WAAW,OAAO,QAAA,IAAYF,KAAAA,CAAMG,MAAM,KAAK,CAAA,EAAG;YAC7D,OAAO,IAAA;AACT,QAAA;QAEA,OAAOH,KAAK,CAAC,CAAA,CAAE;AACjB,IAAA;IAEA,OAAO,IAAA;AACT,CAAA;AAEA;;;;IAKO,MAAMI,YAAAA,GAAe,OAAOR,GAAAA,GAAAA;AACjC,IAAA,MAAM,EAAES,KAAAA,EAAOC,YAAY,EAAE,GAAGC,gBAAAA,CAAW,UAAA,CAAA;AAC3C,IAAA,MAAMF,QAAQV,YAAAA,CAAaC,GAAAA,CAAAA;AAE3B,IAAA,IAAI,CAACS,KAAAA,EAAO;QACV,OAAO;YAAEG,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,aAAAA,GAAgB,MAAMH,YAAAA,CAAaI,KAAK,CAAC;QAAEC,SAAAA,EAAWL,YAAAA,CAAaM,IAAI,CAACP,KAAAA;AAAO,KAAA,CAAA;;AAGrF,IAAA,IAAI,CAACI,aAAAA,EAAe;QAClB,OAAO;YAAED,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;;AAGA,IAAA,MAAMK,cAAc,IAAIC,IAAAA,EAAAA;IAExB,IAAIL,aAAAA,CAAcM,SAAS,IAAI,IAAA,EAAM;AACnC,QAAA,MAAMC,cAAAA,GAAiB,IAAIF,IAAAA,CAAKL,aAAAA,CAAcM,SAAS,CAAA;AAEvD,QAAA,IAAIC,iBAAiBH,WAAAA,EAAa;YAChC,OAAO;gBAAEL,aAAAA,EAAe,KAAA;AAAOS,gBAAAA,KAAAA,EAAO,IAAIzB,iBAAAA,CAAkB,eAAA;AAAiB,aAAA;AAC/E,QAAA;AACF,IAAA;;;AAIA,IAAA,MAAM0B,kBAAAA,GAAqBC,yBAAAA,CAAkBN,WAAAA,EAAaO,gBAAAA,CAASX,cAAcY,UAAU,CAAA,CAAA;AAC3F,IAAA,IAAIH,sBAAsB,CAAA,EAAG;AAC3B,QAAA,MAAMI,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;YAC/CC,KAAAA,EAAO;AAAEC,gBAAAA,EAAAA,EAAIlB,cAAckB;AAAG,aAAA;YAC9BC,IAAAA,EAAM;gBAAEP,UAAAA,EAAYR;AAAY;AAClC,SAAA,CAAA;AACF,IAAA;;AAGA,IAAA,MAAMgB,UAAU,MAAMtB,gBAAAA,CAAW,UAAA,CAAA,CAAYuB,UAAU,CAACC,MAAM,CAACC,eAAe,CAC5EvB,cAAcwB,WAAW,CAACC,GAAG,CAAC,CAACC,UAAiB;AAAEA,YAAAA;SAAO,CAAA,CAAA,CAAA;IAG3D,OAAO;QAAE3B,aAAAA,EAAe,IAAA;AAAMqB,QAAAA,OAAAA;QAASO,WAAAA,EAAa3B;AAAc,KAAA;AACpE;AAEA;;;;AAIC,IACM,MAAM4B,MAAAA,GAAS,OAAOC,IAAAA,EAAWC,MAAAA,GAAc,EAAE,GAAA;AACtD,IAAA,MAAM,EAAEH,WAAAA,EAAa3B,aAAa,EAAEoB,OAAO,EAAE,GAAGS,IAAAA;AAEhD,IAAA,IAAI,CAAC7B,aAAAA,EAAe;AAClB,QAAA,MAAM,IAAIjB,iBAAAA,CAAkB,iBAAA,CAAA;AAC9B,IAAA;AAEA,IAAA,MAAMqB,cAAc,IAAIC,IAAAA,EAAAA;IAExB,IAAIL,aAAAA,CAAcM,SAAS,IAAI,IAAA,EAAM;AACnC,QAAA,MAAMC,cAAAA,GAAiB,IAAIF,IAAAA,CAAKL,aAAAA,CAAcM,SAAS,CAAA;;AAEvD,QAAA,IAAIC,iBAAiBH,WAAAA,EAAa;AAChC,YAAA,MAAM,IAAIrB,iBAAAA,CAAkB,eAAA,CAAA;AAC9B,QAAA;AACF,IAAA;AAEA,IAAA,IAAI,CAACqC,OAAAA,EAAS;AACZ,QAAA,MAAM,IAAIpC,cAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,MAAM+C,MAAAA,GAASC,WAAAA,CAAUF,MAAAA,CAAOG,KAAK,IAAI,EAAE,CAAA;IAE3C,MAAMC,SAAAA,GAAYH,OAAOI,KAAK,CAAC,CAACF,KAAAA,GAAUb,OAAAA,CAAQgB,GAAG,CAACH,KAAAA,CAAAA,CAAAA;AAEtD,IAAA,IAAI,CAACC,SAAAA,EAAW;AACd,QAAA,MAAM,IAAIlD,cAAAA,EAAAA;AACZ,IAAA;AACF;AAEO,MAAMqD,OAAO;AAEpB,wCACA,+BAAe;AACbA,IAAAA,IAAAA;AACA1C,IAAAA,YAAAA;AACAiC,IAAAA;AACF,CAAA;;;;;;;"}

package/dist/server/server/src/strategies/data-transfer.mjs

@@ -1,6 +1,6 @@
 import { differenceInHours, parseISO } from 'date-fns';
 import { errors } from '@strapi/utils';
-import { isNil, castArray } from 'lodash/fp';
+import { castArray } from 'lodash';
 import { getService } from '../utils/index.mjs';
 
 const { UnauthorizedError, ForbiddenError } = errors;
@@ -37,7 +37,7 @@ const extractToken = (ctx)=>{
     }
     // Check if the token has expired
     const currentDate = new Date();
-    if (!isNil(transferToken.expiresAt)) {
+    if (transferToken.expiresAt != null) {
         const expirationDate = new Date(transferToken.expiresAt);
         if (expirationDate < currentDate) {
             return {
@@ -79,7 +79,7 @@ const extractToken = (ctx)=>{
         throw new UnauthorizedError('Token not found');
     }
     const currentDate = new Date();
-    if (!isNil(transferToken.expiresAt)) {
+    if (transferToken.expiresAt != null) {
         const expirationDate = new Date(transferToken.expiresAt);
         // token has expired
         if (expirationDate < currentDate) {

package/dist/server/server/src/strategies/data-transfer.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"data-transfer.mjs","sources":["../../../../../server/src/strategies/data-transfer.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { differenceInHours, parseISO } from 'date-fns';\nimport { errors } from '@strapi/utils';\nimport { castArray, isNil } from 'lodash/fp';\n\nimport { getService } from '../utils';\n\nconst { UnauthorizedError, ForbiddenError } = errors;\n\nconst extractToken = (ctx: Context) => {\n  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {\n    const parts = ctx.request.header.authorization.split(/\\s+/);\n\n    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {\n      return null;\n    }\n\n    return parts[1];\n  }\n\n  return null;\n};\n\n/**\n * Authenticate the validity of the token\n *\n *  @type {import('.').AuthenticateFunction}\n */\nexport const authenticate = async (ctx: Context) => {\n  const { token: tokenService } = getService('transfer');\n  const token = extractToken(ctx);\n\n  if (!token) {\n    return { authenticated: false };\n  }\n\n  const transferToken = await tokenService.getBy({ accessKey: tokenService.hash(token) });\n\n  // Check if the token exists\n  if (!transferToken) {\n    return { authenticated: false };\n  }\n\n  // Check if the token has expired\n  const currentDate = new Date();\n\n  if (!isNil(transferToken.expiresAt)) {\n    const expirationDate = new Date(transferToken.expiresAt);\n\n    if (expirationDate < currentDate) {\n      return { authenticated: false, error: new UnauthorizedError('Token expired') };\n    }\n  }\n\n  // Update token metadata if the token has not been used in the last hour\n  // @ts-expect-error - FIXME: verify lastUsedAt is defined\n  const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(transferToken.lastUsedAt));\n  if (hoursSinceLastUsed >= 1) {\n    await strapi.db.query('admin::api-token').update({\n      where: { id: transferToken.id },\n      data: { lastUsedAt: currentDate },\n    });\n  }\n\n  // Generate an ability based on the token permissions\n  const ability = await getService('transfer').permission.engine.generateAbility(\n    transferToken.permissions.map((action: any) => ({ action }))\n  );\n\n  return { authenticated: true, ability, credentials: transferToken };\n};\n\n/**\n * Verify the token has the required abilities for the requested scope\n *\n *  @type {import('.').VerifyFunction}\n */\nexport const verify = async (auth: any, config: any = {}) => {\n  const { credentials: transferToken, ability } = auth;\n\n  if (!transferToken) {\n    throw new UnauthorizedError('Token not found');\n  }\n\n  const currentDate = new Date();\n\n  if (!isNil(transferToken.expiresAt)) {\n    const expirationDate = new Date(transferToken.expiresAt);\n    // token has expired\n    if (expirationDate < currentDate) {\n      throw new UnauthorizedError('Token expired');\n    }\n  }\n\n  if (!ability) {\n    throw new ForbiddenError();\n  }\n\n  const scopes = castArray(config.scope ?? []);\n\n  const isAllowed = scopes.every((scope) => ability.can(scope));\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nexport const name = 'data-transfer';\n\n/** @type {import('.').AuthStrategy} */\nexport default {\n  name,\n  authenticate,\n  verify,\n};\n"],"names":["UnauthorizedError","ForbiddenError","errors","extractToken","ctx","request","header","authorization","parts","split","toLowerCase","length","authenticate","token","tokenService","getService","authenticated","transferToken","getBy","accessKey","hash","currentDate","Date","isNil","expiresAt","expirationDate","error","hoursSinceLastUsed","differenceInHours","parseISO","lastUsedAt","strapi","db","query","update","where","id","data","ability","permission","engine","generateAbility","permissions","map","action","credentials","verify","auth","config","scopes","castArray","scope","isAllowed","every","can","name"],"mappings":";;;;;AAOA,MAAM,EAAEA,iBAAiB,EAAEC,cAAc,EAAE,GAAGC,MAAAA;AAE9C,MAAMC,eAAe,CAACC,GAAAA,GAAAA;AACpB,IAAA,IAAIA,GAAAA,CAAIC,OAAO,IAAID,GAAAA,CAAIC,OAAO,CAACC,MAAM,IAAIF,GAAAA,CAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,EAAE;QACzE,MAAMC,KAAAA,GAAQJ,IAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,CAACE,KAAK,CAAC,KAAA,CAAA;QAErD,IAAID,KAAK,CAAC,CAAA,CAAE,CAACE,WAAW,OAAO,QAAA,IAAYF,KAAAA,CAAMG,MAAM,KAAK,CAAA,EAAG;YAC7D,OAAO,IAAA;AACT,QAAA;QAEA,OAAOH,KAAK,CAAC,CAAA,CAAE;AACjB,IAAA;IAEA,OAAO,IAAA;AACT,CAAA;AAEA;;;;IAKO,MAAMI,YAAAA,GAAe,OAAOR,GAAAA,GAAAA;AACjC,IAAA,MAAM,EAAES,KAAAA,EAAOC,YAAY,EAAE,GAAGC,UAAAA,CAAW,UAAA,CAAA;AAC3C,IAAA,MAAMF,QAAQV,YAAAA,CAAaC,GAAAA,CAAAA;AAE3B,IAAA,IAAI,CAACS,KAAAA,EAAO;QACV,OAAO;YAAEG,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,aAAAA,GAAgB,MAAMH,YAAAA,CAAaI,KAAK,CAAC;QAAEC,SAAAA,EAAWL,YAAAA,CAAaM,IAAI,CAACP,KAAAA;AAAO,KAAA,CAAA;;AAGrF,IAAA,IAAI,CAACI,aAAAA,EAAe;QAClB,OAAO;YAAED,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;;AAGA,IAAA,MAAMK,cAAc,IAAIC,IAAAA,EAAAA;AAExB,IAAA,IAAI,CAACC,KAAAA,CAAMN,aAAAA,CAAcO,SAAS,CAAA,EAAG;AACnC,QAAA,MAAMC,cAAAA,GAAiB,IAAIH,IAAAA,CAAKL,aAAAA,CAAcO,SAAS,CAAA;AAEvD,QAAA,IAAIC,iBAAiBJ,WAAAA,EAAa;YAChC,OAAO;gBAAEL,aAAAA,EAAe,KAAA;AAAOU,gBAAAA,KAAAA,EAAO,IAAI1B,iBAAAA,CAAkB,eAAA;AAAiB,aAAA;AAC/E,QAAA;AACF,IAAA;;;AAIA,IAAA,MAAM2B,kBAAAA,GAAqBC,iBAAAA,CAAkBP,WAAAA,EAAaQ,QAAAA,CAASZ,cAAca,UAAU,CAAA,CAAA;AAC3F,IAAA,IAAIH,sBAAsB,CAAA,EAAG;AAC3B,QAAA,MAAMI,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;YAC/CC,KAAAA,EAAO;AAAEC,gBAAAA,EAAAA,EAAInB,cAAcmB;AAAG,aAAA;YAC9BC,IAAAA,EAAM;gBAAEP,UAAAA,EAAYT;AAAY;AAClC,SAAA,CAAA;AACF,IAAA;;AAGA,IAAA,MAAMiB,UAAU,MAAMvB,UAAAA,CAAW,UAAA,CAAA,CAAYwB,UAAU,CAACC,MAAM,CAACC,eAAe,CAC5ExB,cAAcyB,WAAW,CAACC,GAAG,CAAC,CAACC,UAAiB;AAAEA,YAAAA;SAAO,CAAA,CAAA,CAAA;IAG3D,OAAO;QAAE5B,aAAAA,EAAe,IAAA;AAAMsB,QAAAA,OAAAA;QAASO,WAAAA,EAAa5B;AAAc,KAAA;AACpE;AAEA;;;;AAIC,IACM,MAAM6B,MAAAA,GAAS,OAAOC,IAAAA,EAAWC,MAAAA,GAAc,EAAE,GAAA;AACtD,IAAA,MAAM,EAAEH,WAAAA,EAAa5B,aAAa,EAAEqB,OAAO,EAAE,GAAGS,IAAAA;AAEhD,IAAA,IAAI,CAAC9B,aAAAA,EAAe;AAClB,QAAA,MAAM,IAAIjB,iBAAAA,CAAkB,iBAAA,CAAA;AAC9B,IAAA;AAEA,IAAA,MAAMqB,cAAc,IAAIC,IAAAA,EAAAA;AAExB,IAAA,IAAI,CAACC,KAAAA,CAAMN,aAAAA,CAAcO,SAAS,CAAA,EAAG;AACnC,QAAA,MAAMC,cAAAA,GAAiB,IAAIH,IAAAA,CAAKL,aAAAA,CAAcO,SAAS,CAAA;;AAEvD,QAAA,IAAIC,iBAAiBJ,WAAAA,EAAa;AAChC,YAAA,MAAM,IAAIrB,iBAAAA,CAAkB,eAAA,CAAA;AAC9B,QAAA;AACF,IAAA;AAEA,IAAA,IAAI,CAACsC,OAAAA,EAAS;AACZ,QAAA,MAAM,IAAIrC,cAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,MAAMgD,MAAAA,GAASC,SAAAA,CAAUF,MAAAA,CAAOG,KAAK,IAAI,EAAE,CAAA;IAE3C,MAAMC,SAAAA,GAAYH,OAAOI,KAAK,CAAC,CAACF,KAAAA,GAAUb,OAAAA,CAAQgB,GAAG,CAACH,KAAAA,CAAAA,CAAAA;AAEtD,IAAA,IAAI,CAACC,SAAAA,EAAW;AACd,QAAA,MAAM,IAAInD,cAAAA,EAAAA;AACZ,IAAA;AACF;AAEO,MAAMsD,OAAO;AAEpB,wCACA,+BAAe;AACbA,IAAAA,IAAAA;AACA3C,IAAAA,YAAAA;AACAkC,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"data-transfer.mjs","sources":["../../../../../server/src/strategies/data-transfer.ts"],"sourcesContent":["import type { Context } from 'koa';\nimport { differenceInHours, parseISO } from 'date-fns';\nimport { errors } from '@strapi/utils';\nimport { castArray } from 'lodash';\n\nimport { getService } from '../utils';\n\nconst { UnauthorizedError, ForbiddenError } = errors;\n\nconst extractToken = (ctx: Context) => {\n  if (ctx.request && ctx.request.header && ctx.request.header.authorization) {\n    const parts = ctx.request.header.authorization.split(/\\s+/);\n\n    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {\n      return null;\n    }\n\n    return parts[1];\n  }\n\n  return null;\n};\n\n/**\n * Authenticate the validity of the token\n *\n *  @type {import('.').AuthenticateFunction}\n */\nexport const authenticate = async (ctx: Context) => {\n  const { token: tokenService } = getService('transfer');\n  const token = extractToken(ctx);\n\n  if (!token) {\n    return { authenticated: false };\n  }\n\n  const transferToken = await tokenService.getBy({ accessKey: tokenService.hash(token) });\n\n  // Check if the token exists\n  if (!transferToken) {\n    return { authenticated: false };\n  }\n\n  // Check if the token has expired\n  const currentDate = new Date();\n\n  if (transferToken.expiresAt != null) {\n    const expirationDate = new Date(transferToken.expiresAt);\n\n    if (expirationDate < currentDate) {\n      return { authenticated: false, error: new UnauthorizedError('Token expired') };\n    }\n  }\n\n  // Update token metadata if the token has not been used in the last hour\n  // @ts-expect-error - FIXME: verify lastUsedAt is defined\n  const hoursSinceLastUsed = differenceInHours(currentDate, parseISO(transferToken.lastUsedAt));\n  if (hoursSinceLastUsed >= 1) {\n    await strapi.db.query('admin::api-token').update({\n      where: { id: transferToken.id },\n      data: { lastUsedAt: currentDate },\n    });\n  }\n\n  // Generate an ability based on the token permissions\n  const ability = await getService('transfer').permission.engine.generateAbility(\n    transferToken.permissions.map((action: any) => ({ action }))\n  );\n\n  return { authenticated: true, ability, credentials: transferToken };\n};\n\n/**\n * Verify the token has the required abilities for the requested scope\n *\n *  @type {import('.').VerifyFunction}\n */\nexport const verify = async (auth: any, config: any = {}) => {\n  const { credentials: transferToken, ability } = auth;\n\n  if (!transferToken) {\n    throw new UnauthorizedError('Token not found');\n  }\n\n  const currentDate = new Date();\n\n  if (transferToken.expiresAt != null) {\n    const expirationDate = new Date(transferToken.expiresAt);\n    // token has expired\n    if (expirationDate < currentDate) {\n      throw new UnauthorizedError('Token expired');\n    }\n  }\n\n  if (!ability) {\n    throw new ForbiddenError();\n  }\n\n  const scopes = castArray(config.scope ?? []);\n\n  const isAllowed = scopes.every((scope) => ability.can(scope));\n\n  if (!isAllowed) {\n    throw new ForbiddenError();\n  }\n};\n\nexport const name = 'data-transfer';\n\n/** @type {import('.').AuthStrategy} */\nexport default {\n  name,\n  authenticate,\n  verify,\n};\n"],"names":["UnauthorizedError","ForbiddenError","errors","extractToken","ctx","request","header","authorization","parts","split","toLowerCase","length","authenticate","token","tokenService","getService","authenticated","transferToken","getBy","accessKey","hash","currentDate","Date","expiresAt","expirationDate","error","hoursSinceLastUsed","differenceInHours","parseISO","lastUsedAt","strapi","db","query","update","where","id","data","ability","permission","engine","generateAbility","permissions","map","action","credentials","verify","auth","config","scopes","castArray","scope","isAllowed","every","can","name"],"mappings":";;;;;AAOA,MAAM,EAAEA,iBAAiB,EAAEC,cAAc,EAAE,GAAGC,MAAAA;AAE9C,MAAMC,eAAe,CAACC,GAAAA,GAAAA;AACpB,IAAA,IAAIA,GAAAA,CAAIC,OAAO,IAAID,GAAAA,CAAIC,OAAO,CAACC,MAAM,IAAIF,GAAAA,CAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,EAAE;QACzE,MAAMC,KAAAA,GAAQJ,IAAIC,OAAO,CAACC,MAAM,CAACC,aAAa,CAACE,KAAK,CAAC,KAAA,CAAA;QAErD,IAAID,KAAK,CAAC,CAAA,CAAE,CAACE,WAAW,OAAO,QAAA,IAAYF,KAAAA,CAAMG,MAAM,KAAK,CAAA,EAAG;YAC7D,OAAO,IAAA;AACT,QAAA;QAEA,OAAOH,KAAK,CAAC,CAAA,CAAE;AACjB,IAAA;IAEA,OAAO,IAAA;AACT,CAAA;AAEA;;;;IAKO,MAAMI,YAAAA,GAAe,OAAOR,GAAAA,GAAAA;AACjC,IAAA,MAAM,EAAES,KAAAA,EAAOC,YAAY,EAAE,GAAGC,UAAAA,CAAW,UAAA,CAAA;AAC3C,IAAA,MAAMF,QAAQV,YAAAA,CAAaC,GAAAA,CAAAA;AAE3B,IAAA,IAAI,CAACS,KAAAA,EAAO;QACV,OAAO;YAAEG,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;AAEA,IAAA,MAAMC,aAAAA,GAAgB,MAAMH,YAAAA,CAAaI,KAAK,CAAC;QAAEC,SAAAA,EAAWL,YAAAA,CAAaM,IAAI,CAACP,KAAAA;AAAO,KAAA,CAAA;;AAGrF,IAAA,IAAI,CAACI,aAAAA,EAAe;QAClB,OAAO;YAAED,aAAAA,EAAe;AAAM,SAAA;AAChC,IAAA;;AAGA,IAAA,MAAMK,cAAc,IAAIC,IAAAA,EAAAA;IAExB,IAAIL,aAAAA,CAAcM,SAAS,IAAI,IAAA,EAAM;AACnC,QAAA,MAAMC,cAAAA,GAAiB,IAAIF,IAAAA,CAAKL,aAAAA,CAAcM,SAAS,CAAA;AAEvD,QAAA,IAAIC,iBAAiBH,WAAAA,EAAa;YAChC,OAAO;gBAAEL,aAAAA,EAAe,KAAA;AAAOS,gBAAAA,KAAAA,EAAO,IAAIzB,iBAAAA,CAAkB,eAAA;AAAiB,aAAA;AAC/E,QAAA;AACF,IAAA;;;AAIA,IAAA,MAAM0B,kBAAAA,GAAqBC,iBAAAA,CAAkBN,WAAAA,EAAaO,QAAAA,CAASX,cAAcY,UAAU,CAAA,CAAA;AAC3F,IAAA,IAAIH,sBAAsB,CAAA,EAAG;AAC3B,QAAA,MAAMI,OAAOC,EAAE,CAACC,KAAK,CAAC,kBAAA,CAAA,CAAoBC,MAAM,CAAC;YAC/CC,KAAAA,EAAO;AAAEC,gBAAAA,EAAAA,EAAIlB,cAAckB;AAAG,aAAA;YAC9BC,IAAAA,EAAM;gBAAEP,UAAAA,EAAYR;AAAY;AAClC,SAAA,CAAA;AACF,IAAA;;AAGA,IAAA,MAAMgB,UAAU,MAAMtB,UAAAA,CAAW,UAAA,CAAA,CAAYuB,UAAU,CAACC,MAAM,CAACC,eAAe,CAC5EvB,cAAcwB,WAAW,CAACC,GAAG,CAAC,CAACC,UAAiB;AAAEA,YAAAA;SAAO,CAAA,CAAA,CAAA;IAG3D,OAAO;QAAE3B,aAAAA,EAAe,IAAA;AAAMqB,QAAAA,OAAAA;QAASO,WAAAA,EAAa3B;AAAc,KAAA;AACpE;AAEA;;;;AAIC,IACM,MAAM4B,MAAAA,GAAS,OAAOC,IAAAA,EAAWC,MAAAA,GAAc,EAAE,GAAA;AACtD,IAAA,MAAM,EAAEH,WAAAA,EAAa3B,aAAa,EAAEoB,OAAO,EAAE,GAAGS,IAAAA;AAEhD,IAAA,IAAI,CAAC7B,aAAAA,EAAe;AAClB,QAAA,MAAM,IAAIjB,iBAAAA,CAAkB,iBAAA,CAAA;AAC9B,IAAA;AAEA,IAAA,MAAMqB,cAAc,IAAIC,IAAAA,EAAAA;IAExB,IAAIL,aAAAA,CAAcM,SAAS,IAAI,IAAA,EAAM;AACnC,QAAA,MAAMC,cAAAA,GAAiB,IAAIF,IAAAA,CAAKL,aAAAA,CAAcM,SAAS,CAAA;;AAEvD,QAAA,IAAIC,iBAAiBH,WAAAA,EAAa;AAChC,YAAA,MAAM,IAAIrB,iBAAAA,CAAkB,eAAA,CAAA;AAC9B,QAAA;AACF,IAAA;AAEA,IAAA,IAAI,CAACqC,OAAAA,EAAS;AACZ,QAAA,MAAM,IAAIpC,cAAAA,EAAAA;AACZ,IAAA;AAEA,IAAA,MAAM+C,MAAAA,GAASC,SAAAA,CAAUF,MAAAA,CAAOG,KAAK,IAAI,EAAE,CAAA;IAE3C,MAAMC,SAAAA,GAAYH,OAAOI,KAAK,CAAC,CAACF,KAAAA,GAAUb,OAAAA,CAAQgB,GAAG,CAACH,KAAAA,CAAAA,CAAAA;AAEtD,IAAA,IAAI,CAACC,SAAAA,EAAW;AACd,QAAA,MAAM,IAAIlD,cAAAA,EAAAA;AACZ,IAAA;AACF;AAEO,MAAMqD,OAAO;AAEpB,wCACA,+BAAe;AACbA,IAAAA,IAAAA;AACA1C,IAAAA,YAAAA;AACAiC,IAAAA;AACF,CAAA;;;;"}

package/dist/server/server/src/utils/debug-dump/redact.js

@@ -0,0 +1,197 @@
+'use strict';
+
+const REDACTED = '[REDACTED]';
+// Layer 1a: key names (substring match) whose value must be masked wherever they appear.
+const SECRET_KEY_PATTERN = /(secret|password|passphrase|salt|token|api[_-]?key|access[_-]?key|license[_-]?key|private[_-]?key|encryption[_-]?key|credential|provider[_-]?options|connection[_-]?string|mnemonic|seed[_-]?phrase|authorization|bearer)/i;
+// Layer 1b: short, ambiguous key names matched EXACTLY (case-insensitive), so they
+// do not over-match as substrings (e.g. `pass` must not redact `compass`/`bypass`,
+// and this still catches a nested SMTP `auth.pass`).
+const SECRET_KEY_EXACT = new Set([
+    'pass',
+    'pwd',
+    'passwd',
+    'dsn'
+]);
+// camelCase password suffixes (capitalized), e.g. `smtpAuthPass`, `dbPwd` — the
+// capital letter distinguishes them from lowercase look-alikes (`compass`, `bypass`).
+const SECRET_KEY_SUFFIX = /[a-z](Pass|Pwd|Passwd)$/;
+// separator-delimited short secret names, e.g. `auth.pass`, `db_pwd`, `x-pass`.
+const SECRET_KEY_DELIMITED = /(^|[._-])(pass|pwd|passwd|dsn)([._-]|$)/i;
+const isSecretKey = (key)=>SECRET_KEY_PATTERN.test(key) || SECRET_KEY_EXACT.has(key.toLowerCase()) || SECRET_KEY_SUFFIX.test(key) || SECRET_KEY_DELIMITED.test(key);
+// Layer 3: string values that look like secrets regardless of their key.
+// Real JWTs are base64url-encoded and the header segment always begins with
+// `eyJ` (the base64url encoding of `{"`), so requiring that prefix avoids
+// matching arbitrary three-part dotted strings like semver versions
+// (e.g. "5.50.1", "18.3.1").
+const JWT_PATTERN = /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+const LONG_TOKEN_PATTERN = /^[A-Fa-f0-9]{32,}$|^[A-Za-z0-9+/]{40,}={0,2}$/;
+// Credentials embedded in a URL authority: `user:pass@` or `:pass@` (empty user,
+// as in `redis://:password@host`). The user part stops at the first colon, as in
+// RFC 3986, so the split between user and password is fixed; letting it take colons
+// made a long colon run with no `@` retry every split point, which is quadratic.
+const URL_WITH_CREDENTIALS = /^[a-z][a-z0-9+.-]*:\/\/[^/@\s:]*:[^/@\s]+@/i;
+// PEM private key blocks (certificates are public, so only PRIVATE KEY is masked).
+const PEM_PRIVATE_KEY_PATTERN = /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----/;
+// URLs whose secret is carried in the host/path rather than a `user:pass@` authority:
+// chat webhooks and error-tracking DSNs.
+const SECRET_URL_PATTERN = /^https:\/\/hooks\.slack\.com\/services\/|^https:\/\/(?:discord|discordapp)\.com\/api\/webhooks\/|:\/\/[^/@\s]+@[^/\s]*\bsentry\.io\b/i;
+// Well-known provider secret token formats, matched against the whole value. The
+// prefixes are specific enough to have negligible false-positive risk, so they
+// mask a value even under an innocuous key (e.g. `key: 'sk_live_...'`).
+// `pk_` (publishable) keys are intentionally excluded — they are public by design.
+const PROVIDER_SECRET_PATTERN = new RegExp([
+    '^(sk|rk)_(live|test)_[A-Za-z0-9]{8,}$',
+    '^whsec_[A-Za-z0-9]{16,}$',
+    '^(gh[posru]_|github_pat_)[A-Za-z0-9_]{20,}$',
+    '^xox[baprs]-[A-Za-z0-9-]{10,}$',
+    '^(AKIA|ASIA)[A-Z0-9]{16}$',
+    '^SG\\.[A-Za-z0-9_-]{16,}\\.[A-Za-z0-9_-]{16,}$',
+    '^AIza[A-Za-z0-9_-]{20,}$',
+    '^ya29\\.[A-Za-z0-9_-]{20,}$',
+    '^glpat-[A-Za-z0-9_-]{16,}$',
+    '^(shpat|shpss|shpca|shppa)_[A-Za-z0-9]{20,}$',
+    '^dop_v1_[a-f0-9]{40,}$',
+    '^re_[A-Za-z0-9_]{16,}$',
+    '^nfp_[A-Za-z0-9]{20,}$',
+    '^EAAA[A-Za-z0-9_-]{20,}$'
+].join('|'));
+const looksSecret = (value)=>JWT_PATTERN.test(value) || LONG_TOKEN_PATTERN.test(value) || URL_WITH_CREDENTIALS.test(value) || PROVIDER_SECRET_PATTERN.test(value) || PEM_PRIVATE_KEY_PATTERN.test(value) || SECRET_URL_PATTERN.test(value);
+const isPlainObject = (value)=>{
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+};
+// Accept either separator regardless of the host platform: `os.homedir()` and the app root come
+// back with backslashes on Windows, and a dump may also carry POSIX-style paths (e.g. from
+// config values), so a POSIX-only prefix check would ship absolute Windows paths verbatim.
+const isPathPrefix = (value, prefix)=>{
+    if (value === prefix) {
+        return true;
+    }
+    if (!value.startsWith(prefix)) {
+        return false;
+    }
+    const next = value.charAt(prefix.length);
+    return next === '/' || next === '\\';
+};
+const relativize = (value, appRoot, homeDir)=>{
+    if (appRoot && isPathPrefix(value, appRoot)) {
+        return `<app>${value.slice(appRoot.length)}`;
+    }
+    if (homeDir && isPathPrefix(value, homeDir)) {
+        return `<home>${value.slice(homeDir.length)}`;
+    }
+    return value;
+};
+// Characters that end a URL authority
+const AUTHORITY_END = new Set([
+    '/',
+    '?',
+    '#',
+    ' ',
+    '\t',
+    '\n',
+    '\r',
+    '"',
+    "'",
+    '`'
+]);
+/**
+ * Masks the password of every `scheme://user:password@host` inside a longer string, such as a
+ * package.json script that inlines a database URL. Whole-value credential URLs are already
+ * caught by URL_WITH_CREDENTIALS; this covers the ones in the middle of a value. It is a single
+ * forward scan rather than a regex, because an unanchored pattern backtracks quadratically on
+ * long runs (the reason URL_WITH_CREDENTIALS is anchored and colon-free in the user part).
+ */ const maskEmbeddedCredentials = (value)=>{
+    let result = '';
+    let copiedUpTo = 0;
+    let separator = value.indexOf('://');
+    while(separator !== -1){
+        const authorityStart = separator + 3;
+        let firstColon = -1;
+        let lastAt = -1;
+        let end = authorityStart;
+        while(end < value.length && !AUTHORITY_END.has(value[end])){
+            if (value[end] === ':' && firstColon === -1) {
+                firstColon = end;
+            } else if (value[end] === '@') {
+                lastAt = end;
+            }
+            end += 1;
+        }
+        // A colon before the last `@` separates user and password; one after it is a port.
+        if (firstColon !== -1 && lastAt > firstColon) {
+            result += `${value.slice(copiedUpTo, firstColon + 1)}${REDACTED}`;
+            copiedUpTo = lastAt;
+        }
+        separator = value.indexOf('://', end);
+    }
+    return copiedUpTo === 0 ? value : result + value.slice(copiedUpTo);
+};
+const deleteAtPath = (target, path)=>{
+    const segments = path.split('.');
+    let node = target;
+    for(let i = 0; i < segments.length - 1; i += 1){
+        if (!isPlainObject(node)) {
+            return;
+        }
+        node = node[segments[i]];
+    }
+    const lastKey = segments[segments.length - 1];
+    if (isPlainObject(node) && lastKey in node) {
+        node[lastKey] = REDACTED;
+    }
+};
+const walk = (value, appRoot, homeDir)=>{
+    if (typeof value === 'string') {
+        // Relativization is tried FIRST, and a value it rewrote is returned as-is. A string
+        // that starts with the app root or the home directory is a path, never a credential,
+        // whereas the reverse order let the secret heuristics claim one: a POSIX path made
+        // only of letters, digits and `/` is valid standard base64, so anything past 40
+        // characters matched LONG_TOKEN_PATTERN and shipped as `[REDACTED]` instead of
+        // `<app>/...`. Values that do not relativize still go through the full checks.
+        const relativized = relativize(value, appRoot, homeDir);
+        if (relativized !== value) {
+            return relativized;
+        }
+        return looksSecret(value) ? REDACTED : maskEmbeddedCredentials(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item)=>walk(item, appRoot, homeDir));
+    }
+    if (isPlainObject(value)) {
+        const out = {};
+        for (const [key, val] of Object.entries(value)){
+            if (key === '__proto__') {
+                continue; // never write through the Object.prototype setter
+            }
+            // A secret-named key always collapses wholesale, regardless of the value's
+            // type. Recursing into it (e.g. for `apiToken: { salt, ... }`) would leak
+            // any inner value whose own key/value doesn't independently match a
+            // masking pattern (e.g. `providerOptions.auth.pass`), so there is nothing
+            // safe to preserve underneath a secret-named container.
+            out[key] = isSecretKey(key) ? REDACTED : walk(val, appRoot, homeDir);
+        }
+        return out;
+    }
+    // Any other object type — Buffer, Date, Map, Set, class instances, etc. —
+    // is not a plain data container we can safely walk (Object.entries on a
+    // Buffer leaks its bytes, a Date serializes to `{}`), so redact defensively.
+    if (value !== null && typeof value === 'object') {
+        return REDACTED;
+    }
+    return value;
+};
+const scrub = (value, options = {})=>{
+    const cloned = walk(value, options.appRoot, options.homeDir);
+    for (const path of options.extraPaths ?? []){
+        deleteAtPath(cloned, path);
+    }
+    return cloned;
+};
+
+exports.REDACTED = REDACTED;
+exports.scrub = scrub;
+//# sourceMappingURL=redact.js.map

package/dist/server/server/src/utils/debug-dump/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sources":["../../../../../../server/src/utils/debug-dump/redact.ts"],"sourcesContent":["export const REDACTED = '[REDACTED]';\n\n// Layer 1a: key names (substring match) whose value must be masked wherever they appear.\nconst SECRET_KEY_PATTERN =\n  /(secret|password|passphrase|salt|token|api[_-]?key|access[_-]?key|license[_-]?key|private[_-]?key|encryption[_-]?key|credential|provider[_-]?options|connection[_-]?string|mnemonic|seed[_-]?phrase|authorization|bearer)/i;\n\n// Layer 1b: short, ambiguous key names matched EXACTLY (case-insensitive), so they\n// do not over-match as substrings (e.g. `pass` must not redact `compass`/`bypass`,\n// and this still catches a nested SMTP `auth.pass`).\nconst SECRET_KEY_EXACT = new Set(['pass', 'pwd', 'passwd', 'dsn']);\n// camelCase password suffixes (capitalized), e.g. `smtpAuthPass`, `dbPwd` — the\n// capital letter distinguishes them from lowercase look-alikes (`compass`, `bypass`).\nconst SECRET_KEY_SUFFIX = /[a-z](Pass|Pwd|Passwd)$/;\n// separator-delimited short secret names, e.g. `auth.pass`, `db_pwd`, `x-pass`.\nconst SECRET_KEY_DELIMITED = /(^|[._-])(pass|pwd|passwd|dsn)([._-]|$)/i;\n\nconst isSecretKey = (key: string): boolean =>\n  SECRET_KEY_PATTERN.test(key) ||\n  SECRET_KEY_EXACT.has(key.toLowerCase()) ||\n  SECRET_KEY_SUFFIX.test(key) ||\n  SECRET_KEY_DELIMITED.test(key);\n\n// Layer 3: string values that look like secrets regardless of their key.\n// Real JWTs are base64url-encoded and the header segment always begins with\n// `eyJ` (the base64url encoding of `{\"`), so requiring that prefix avoids\n// matching arbitrary three-part dotted strings like semver versions\n// (e.g. \"5.50.1\", \"18.3.1\").\nconst JWT_PATTERN = /^eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/;\nconst LONG_TOKEN_PATTERN = /^[A-Fa-f0-9]{32,}$|^[A-Za-z0-9+/]{40,}={0,2}$/;\n// Credentials embedded in a URL authority: `user:pass@` or `:pass@` (empty user,\n// as in `redis://:password@host`). The user part stops at the first colon, as in\n// RFC 3986, so the split between user and password is fixed; letting it take colons\n// made a long colon run with no `@` retry every split point, which is quadratic.\nconst URL_WITH_CREDENTIALS = /^[a-z][a-z0-9+.-]*:\\/\\/[^/@\\s:]*:[^/@\\s]+@/i;\n// PEM private key blocks (certificates are public, so only PRIVATE KEY is masked).\nconst PEM_PRIVATE_KEY_PATTERN = /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----/;\n// URLs whose secret is carried in the host/path rather than a `user:pass@` authority:\n// chat webhooks and error-tracking DSNs.\nconst SECRET_URL_PATTERN =\n  /^https:\\/\\/hooks\\.slack\\.com\\/services\\/|^https:\\/\\/(?:discord|discordapp)\\.com\\/api\\/webhooks\\/|:\\/\\/[^/@\\s]+@[^/\\s]*\\bsentry\\.io\\b/i;\n\n// Well-known provider secret token formats, matched against the whole value. The\n// prefixes are specific enough to have negligible false-positive risk, so they\n// mask a value even under an innocuous key (e.g. `key: 'sk_live_...'`).\n// `pk_` (publishable) keys are intentionally excluded — they are public by design.\nconst PROVIDER_SECRET_PATTERN = new RegExp(\n  [\n    '^(sk|rk)_(live|test)_[A-Za-z0-9]{8,}$', // Stripe secret / restricted\n    '^whsec_[A-Za-z0-9]{16,}$', // Stripe webhook signing secret\n    '^(gh[posru]_|github_pat_)[A-Za-z0-9_]{20,}$', // GitHub tokens / fine-grained PAT\n    '^xox[baprs]-[A-Za-z0-9-]{10,}$', // Slack tokens\n    '^(AKIA|ASIA)[A-Z0-9]{16}$', // AWS access key id\n    '^SG\\\\.[A-Za-z0-9_-]{16,}\\\\.[A-Za-z0-9_-]{16,}$', // SendGrid\n    '^AIza[A-Za-z0-9_-]{20,}$', // Google API key\n    '^ya29\\\\.[A-Za-z0-9_-]{20,}$', // Google OAuth access token\n    '^glpat-[A-Za-z0-9_-]{16,}$', // GitLab personal access token\n    '^(shpat|shpss|shpca|shppa)_[A-Za-z0-9]{20,}$', // Shopify\n    '^dop_v1_[a-f0-9]{40,}$', // DigitalOcean\n    '^re_[A-Za-z0-9_]{16,}$', // Resend\n    '^nfp_[A-Za-z0-9]{20,}$', // Netlify\n    '^EAAA[A-Za-z0-9_-]{20,}$', // Square\n  ].join('|')\n);\n\nconst looksSecret = (value: string): boolean =>\n  JWT_PATTERN.test(value) ||\n  LONG_TOKEN_PATTERN.test(value) ||\n  URL_WITH_CREDENTIALS.test(value) ||\n  PROVIDER_SECRET_PATTERN.test(value) ||\n  PEM_PRIVATE_KEY_PATTERN.test(value) ||\n  SECRET_URL_PATTERN.test(value);\n\nexport interface ScrubOptions {\n  appRoot?: string;\n  homeDir?: string;\n  extraPaths?: string[];\n}\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> => {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    return false;\n  }\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n};\n\n// Accept either separator regardless of the host platform: `os.homedir()` and the app root come\n// back with backslashes on Windows, and a dump may also carry POSIX-style paths (e.g. from\n// config values), so a POSIX-only prefix check would ship absolute Windows paths verbatim.\nconst isPathPrefix = (value: string, prefix: string): boolean => {\n  if (value === prefix) {\n    return true;\n  }\n  if (!value.startsWith(prefix)) {\n    return false;\n  }\n  const next = value.charAt(prefix.length);\n  return next === '/' || next === '\\\\';\n};\n\nconst relativize = (value: string, appRoot?: string, homeDir?: string): string => {\n  if (appRoot && isPathPrefix(value, appRoot)) {\n    return `<app>${value.slice(appRoot.length)}`;\n  }\n  if (homeDir && isPathPrefix(value, homeDir)) {\n    return `<home>${value.slice(homeDir.length)}`;\n  }\n  return value;\n};\n\n// Characters that end a URL authority\nconst AUTHORITY_END = new Set(['/', '?', '#', ' ', '\\t', '\\n', '\\r', '\"', \"'\", '`']);\n\n/**\n * Masks the password of every `scheme://user:password@host` inside a longer string, such as a\n * package.json script that inlines a database URL. Whole-value credential URLs are already\n * caught by URL_WITH_CREDENTIALS; this covers the ones in the middle of a value. It is a single\n * forward scan rather than a regex, because an unanchored pattern backtracks quadratically on\n * long runs (the reason URL_WITH_CREDENTIALS is anchored and colon-free in the user part).\n */\nconst maskEmbeddedCredentials = (value: string): string => {\n  let result = '';\n  let copiedUpTo = 0;\n  let separator = value.indexOf('://');\n\n  while (separator !== -1) {\n    const authorityStart = separator + 3;\n    let firstColon = -1;\n    let lastAt = -1;\n    let end = authorityStart;\n\n    while (end < value.length && !AUTHORITY_END.has(value[end])) {\n      if (value[end] === ':' && firstColon === -1) {\n        firstColon = end;\n      } else if (value[end] === '@') {\n        lastAt = end;\n      }\n      end += 1;\n    }\n\n    // A colon before the last `@` separates user and password; one after it is a port.\n    if (firstColon !== -1 && lastAt > firstColon) {\n      result += `${value.slice(copiedUpTo, firstColon + 1)}${REDACTED}`;\n      copiedUpTo = lastAt;\n    }\n\n    separator = value.indexOf('://', end);\n  }\n\n  return copiedUpTo === 0 ? value : result + value.slice(copiedUpTo);\n};\n\nconst deleteAtPath = (target: unknown, path: string): void => {\n  const segments = path.split('.');\n  let node: unknown = target;\n  for (let i = 0; i < segments.length - 1; i += 1) {\n    if (!isPlainObject(node)) {\n      return;\n    }\n    node = node[segments[i]];\n  }\n  const lastKey = segments[segments.length - 1];\n  if (isPlainObject(node) && lastKey in node) {\n    node[lastKey] = REDACTED;\n  }\n};\n\nconst walk = (value: unknown, appRoot?: string, homeDir?: string): unknown => {\n  if (typeof value === 'string') {\n    // Relativization is tried FIRST, and a value it rewrote is returned as-is. A string\n    // that starts with the app root or the home directory is a path, never a credential,\n    // whereas the reverse order let the secret heuristics claim one: a POSIX path made\n    // only of letters, digits and `/` is valid standard base64, so anything past 40\n    // characters matched LONG_TOKEN_PATTERN and shipped as `[REDACTED]` instead of\n    // `<app>/...`. Values that do not relativize still go through the full checks.\n    const relativized = relativize(value, appRoot, homeDir);\n    if (relativized !== value) {\n      return relativized;\n    }\n    return looksSecret(value) ? REDACTED : maskEmbeddedCredentials(value);\n  }\n  if (Array.isArray(value)) {\n    return value.map((item) => walk(item, appRoot, homeDir));\n  }\n  if (isPlainObject(value)) {\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(value)) {\n      if (key === '__proto__') {\n        continue; // never write through the Object.prototype setter\n      }\n      // A secret-named key always collapses wholesale, regardless of the value's\n      // type. Recursing into it (e.g. for `apiToken: { salt, ... }`) would leak\n      // any inner value whose own key/value doesn't independently match a\n      // masking pattern (e.g. `providerOptions.auth.pass`), so there is nothing\n      // safe to preserve underneath a secret-named container.\n      out[key] = isSecretKey(key) ? REDACTED : walk(val, appRoot, homeDir);\n    }\n    return out;\n  }\n  // Any other object type — Buffer, Date, Map, Set, class instances, etc. —\n  // is not a plain data container we can safely walk (Object.entries on a\n  // Buffer leaks its bytes, a Date serializes to `{}`), so redact defensively.\n  if (value !== null && typeof value === 'object') {\n    return REDACTED;\n  }\n  return value;\n};\n\nexport const scrub = (value: unknown, options: ScrubOptions = {}): unknown => {\n  const cloned = walk(value, options.appRoot, options.homeDir);\n  for (const path of options.extraPaths ?? []) {\n    deleteAtPath(cloned, path);\n  }\n  return cloned;\n};\n"],"names":["REDACTED","SECRET_KEY_PATTERN","SECRET_KEY_EXACT","Set","SECRET_KEY_SUFFIX","SECRET_KEY_DELIMITED","isSecretKey","key","test","has","toLowerCase","JWT_PATTERN","LONG_TOKEN_PATTERN","URL_WITH_CREDENTIALS","PEM_PRIVATE_KEY_PATTERN","SECRET_URL_PATTERN","PROVIDER_SECRET_PATTERN","RegExp","join","looksSecret","value","isPlainObject","Array","isArray","proto","Object","getPrototypeOf","prototype","isPathPrefix","prefix","startsWith","next","charAt","length","relativize","appRoot","homeDir","slice","AUTHORITY_END","maskEmbeddedCredentials","result","copiedUpTo","separator","indexOf","authorityStart","firstColon","lastAt","end","deleteAtPath","target","path","segments","split","node","i","lastKey","walk","relativized","map","item","out","val","entries","scrub","options","cloned","extraPaths"],"mappings":";;AAAO,MAAMA,WAAW;AAExB;AACA,MAAMC,kBAAAA,GACJ,4NAAA;AAEF;AACA;AACA;AACA,MAAMC,gBAAAA,GAAmB,IAAIC,GAAAA,CAAI;AAAC,IAAA,MAAA;AAAQ,IAAA,KAAA;AAAO,IAAA,QAAA;AAAU,IAAA;AAAM,CAAA,CAAA;AACjE;AACA;AACA,MAAMC,iBAAAA,GAAoB,yBAAA;AAC1B;AACA,MAAMC,oBAAAA,GAAuB,0CAAA;AAE7B,MAAMC,cAAc,CAACC,GAAAA,GACnBN,mBAAmBO,IAAI,CAACD,QACxBL,gBAAAA,CAAiBO,GAAG,CAACF,GAAAA,CAAIG,WAAW,OACpCN,iBAAAA,CAAkBI,IAAI,CAACD,GAAAA,CAAAA,IACvBF,oBAAAA,CAAqBG,IAAI,CAACD,GAAAA,CAAAA;AAE5B;AACA;AACA;AACA;AACA;AACA,MAAMI,WAAAA,GAAc,qDAAA;AACpB,MAAMC,kBAAAA,GAAqB,+CAAA;AAC3B;AACA;AACA;AACA;AACA,MAAMC,oBAAAA,GAAuB,6CAAA;AAC7B;AACA,MAAMC,uBAAAA,GAA0B,4CAAA;AAChC;AACA;AACA,MAAMC,kBAAAA,GACJ,uIAAA;AAEF;AACA;AACA;AACA;AACA,MAAMC,uBAAAA,GAA0B,IAAIC,MAAAA,CAClC;AACE,IAAA,uCAAA;AACA,IAAA,0BAAA;AACA,IAAA,6CAAA;AACA,IAAA,gCAAA;AACA,IAAA,2BAAA;AACA,IAAA,gDAAA;AACA,IAAA,0BAAA;AACA,IAAA,6BAAA;AACA,IAAA,4BAAA;AACA,IAAA,8CAAA;AACA,IAAA,wBAAA;AACA,IAAA,wBAAA;AACA,IAAA,wBAAA;AACA,IAAA;AACD,CAAA,CAACC,IAAI,CAAC,GAAA,CAAA,CAAA;AAGT,MAAMC,WAAAA,GAAc,CAACC,KAAAA,GACnBT,WAAAA,CAAYH,IAAI,CAACY,KAAAA,CAAAA,IACjBR,kBAAAA,CAAmBJ,IAAI,CAACY,KAAAA,CAAAA,IACxBP,oBAAAA,CAAqBL,IAAI,CAACY,KAAAA,CAAAA,IAC1BJ,uBAAAA,CAAwBR,IAAI,CAACY,KAAAA,CAAAA,IAC7BN,uBAAAA,CAAwBN,IAAI,CAACY,KAAAA,CAAAA,IAC7BL,kBAAAA,CAAmBP,IAAI,CAACY,KAAAA,CAAAA;AAQ1B,MAAMC,gBAAgB,CAACD,KAAAA,GAAAA;IACrB,IAAIA,KAAAA,KAAU,QAAQ,OAAOA,KAAAA,KAAU,YAAYE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,EAAQ;QACvE,OAAO,KAAA;AACT,IAAA;IACA,MAAMI,KAAAA,GAAQC,MAAAA,CAAOC,cAAc,CAACN,KAAAA,CAAAA;AACpC,IAAA,OAAOI,KAAAA,KAAUC,MAAAA,CAAOE,SAAS,IAAIH,KAAAA,KAAU,IAAA;AACjD,CAAA;AAEA;AACA;AACA;AACA,MAAMI,YAAAA,GAAe,CAACR,KAAAA,EAAeS,MAAAA,GAAAA;AACnC,IAAA,IAAIT,UAAUS,MAAAA,EAAQ;QACpB,OAAO,IAAA;AACT,IAAA;AACA,IAAA,IAAI,CAACT,KAAAA,CAAMU,UAAU,CAACD,MAAAA,CAAAA,EAAS;QAC7B,OAAO,KAAA;AACT,IAAA;AACA,IAAA,MAAME,IAAAA,GAAOX,KAAAA,CAAMY,MAAM,CAACH,OAAOI,MAAM,CAAA;IACvC,OAAOF,IAAAA,KAAS,OAAOA,IAAAA,KAAS,IAAA;AAClC,CAAA;AAEA,MAAMG,UAAAA,GAAa,CAACd,KAAAA,EAAee,OAAAA,EAAkBC,OAAAA,GAAAA;IACnD,IAAID,OAAAA,IAAWP,YAAAA,CAAaR,KAAAA,EAAOe,OAAAA,CAAAA,EAAU;QAC3C,OAAO,CAAC,KAAK,EAAEf,KAAAA,CAAMiB,KAAK,CAACF,OAAAA,CAAQF,MAAM,CAAA,CAAA,CAAG;AAC9C,IAAA;IACA,IAAIG,OAAAA,IAAWR,YAAAA,CAAaR,KAAAA,EAAOgB,OAAAA,CAAAA,EAAU;QAC3C,OAAO,CAAC,MAAM,EAAEhB,KAAAA,CAAMiB,KAAK,CAACD,OAAAA,CAAQH,MAAM,CAAA,CAAA,CAAG;AAC/C,IAAA;IACA,OAAOb,KAAAA;AACT,CAAA;AAEA;AACA,MAAMkB,aAAAA,GAAgB,IAAInC,GAAAA,CAAI;AAAC,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA,IAAA;AAAM,IAAA,IAAA;AAAM,IAAA,IAAA;AAAM,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA;AAAI,CAAA,CAAA;AAEnF;;;;;;IAOA,MAAMoC,0BAA0B,CAACnB,KAAAA,GAAAA;AAC/B,IAAA,IAAIoB,MAAAA,GAAS,EAAA;AACb,IAAA,IAAIC,UAAAA,GAAa,CAAA;IACjB,IAAIC,SAAAA,GAAYtB,KAAAA,CAAMuB,OAAO,CAAC,KAAA,CAAA;IAE9B,MAAOD,SAAAA,KAAc,EAAC,CAAG;AACvB,QAAA,MAAME,iBAAiBF,SAAAA,GAAY,CAAA;AACnC,QAAA,IAAIG,aAAa,EAAC;AAClB,QAAA,IAAIC,SAAS,EAAC;AACd,QAAA,IAAIC,GAAAA,GAAMH,cAAAA;QAEV,MAAOG,GAAAA,GAAM3B,KAAAA,CAAMa,MAAM,IAAI,CAACK,aAAAA,CAAc7B,GAAG,CAACW,KAAK,CAAC2B,GAAAA,CAAI,CAAA,CAAG;AAC3D,YAAA,IAAI3B,KAAK,CAAC2B,GAAAA,CAAI,KAAK,GAAA,IAAOF,UAAAA,KAAe,EAAC,EAAG;gBAC3CA,UAAAA,GAAaE,GAAAA;AACf,YAAA,CAAA,MAAO,IAAI3B,KAAK,CAAC2B,GAAAA,CAAI,KAAK,GAAA,EAAK;gBAC7BD,MAAAA,GAASC,GAAAA;AACX,YAAA;YACAA,GAAAA,IAAO,CAAA;AACT,QAAA;;AAGA,QAAA,IAAIF,UAAAA,KAAe,EAAC,IAAKC,MAAAA,GAASD,UAAAA,EAAY;AAC5CL,YAAAA,MAAAA,IAAU,GAAGpB,KAAAA,CAAMiB,KAAK,CAACI,UAAAA,EAAYI,UAAAA,GAAa,KAAK7C,QAAAA,CAAAA,CAAU;YACjEyC,UAAAA,GAAaK,MAAAA;AACf,QAAA;QAEAJ,SAAAA,GAAYtB,KAAAA,CAAMuB,OAAO,CAAC,KAAA,EAAOI,GAAAA,CAAAA;AACnC,IAAA;AAEA,IAAA,OAAON,eAAe,CAAA,GAAIrB,KAAAA,GAAQoB,MAAAA,GAASpB,KAAAA,CAAMiB,KAAK,CAACI,UAAAA,CAAAA;AACzD,CAAA;AAEA,MAAMO,YAAAA,GAAe,CAACC,MAAAA,EAAiBC,IAAAA,GAAAA;IACrC,MAAMC,QAAAA,GAAWD,IAAAA,CAAKE,KAAK,CAAC,GAAA,CAAA;AAC5B,IAAA,IAAIC,IAAAA,GAAgBJ,MAAAA;IACpB,IAAK,IAAIK,IAAI,CAAA,EAAGA,CAAAA,GAAIH,SAASlB,MAAM,GAAG,CAAA,EAAGqB,CAAAA,IAAK,CAAA,CAAG;QAC/C,IAAI,CAACjC,cAAcgC,IAAAA,CAAAA,EAAO;AACxB,YAAA;AACF,QAAA;AACAA,QAAAA,IAAAA,GAAOA,IAAI,CAACF,QAAQ,CAACG,EAAE,CAAC;AAC1B,IAAA;AACA,IAAA,MAAMC,UAAUJ,QAAQ,CAACA,QAAAA,CAASlB,MAAM,GAAG,CAAA,CAAE;IAC7C,IAAIZ,aAAAA,CAAcgC,IAAAA,CAAAA,IAASE,OAAAA,IAAWF,IAAAA,EAAM;QAC1CA,IAAI,CAACE,QAAQ,GAAGvD,QAAAA;AAClB,IAAA;AACF,CAAA;AAEA,MAAMwD,IAAAA,GAAO,CAACpC,KAAAA,EAAgBe,OAAAA,EAAkBC,OAAAA,GAAAA;IAC9C,IAAI,OAAOhB,UAAU,QAAA,EAAU;;;;;;;QAO7B,MAAMqC,WAAAA,GAAcvB,UAAAA,CAAWd,KAAAA,EAAOe,OAAAA,EAASC,OAAAA,CAAAA;AAC/C,QAAA,IAAIqB,gBAAgBrC,KAAAA,EAAO;YACzB,OAAOqC,WAAAA;AACT,QAAA;QACA,OAAOtC,WAAAA,CAAYC,KAAAA,CAAAA,GAASpB,QAAAA,GAAWuC,uBAAAA,CAAwBnB,KAAAA,CAAAA;AACjE,IAAA;IACA,IAAIE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,EAAQ;AACxB,QAAA,OAAOA,MAAMsC,GAAG,CAAC,CAACC,IAAAA,GAASH,IAAAA,CAAKG,MAAMxB,OAAAA,EAASC,OAAAA,CAAAA,CAAAA;AACjD,IAAA;AACA,IAAA,IAAIf,cAAcD,KAAAA,CAAAA,EAAQ;AACxB,QAAA,MAAMwC,MAA+B,EAAC;QACtC,KAAK,MAAM,CAACrD,GAAAA,EAAKsD,GAAAA,CAAI,IAAIpC,MAAAA,CAAOqC,OAAO,CAAC1C,KAAAA,CAAAA,CAAQ;AAC9C,YAAA,IAAIb,QAAQ,WAAA,EAAa;AACvB,gBAAA,SAAA;AACF,YAAA;;;;;;YAMAqD,GAAG,CAACrD,IAAI,GAAGD,WAAAA,CAAYC,OAAOP,QAAAA,GAAWwD,IAAAA,CAAKK,KAAK1B,OAAAA,EAASC,OAAAA,CAAAA;AAC9D,QAAA;QACA,OAAOwB,GAAAA;AACT,IAAA;;;;AAIA,IAAA,IAAIxC,KAAAA,KAAU,IAAA,IAAQ,OAAOA,KAAAA,KAAU,QAAA,EAAU;QAC/C,OAAOpB,QAAAA;AACT,IAAA;IACA,OAAOoB,KAAAA;AACT,CAAA;MAEa2C,KAAAA,GAAQ,CAAC3C,KAAAA,EAAgB4C,OAAAA,GAAwB,EAAE,GAAA;AAC9D,IAAA,MAAMC,SAAST,IAAAA,CAAKpC,KAAAA,EAAO4C,QAAQ7B,OAAO,EAAE6B,QAAQ5B,OAAO,CAAA;AAC3D,IAAA,KAAK,MAAMc,IAAAA,IAAQc,OAAAA,CAAQE,UAAU,IAAI,EAAE,CAAE;AAC3ClB,QAAAA,YAAAA,CAAaiB,MAAAA,EAAQf,IAAAA,CAAAA;AACvB,IAAA;IACA,OAAOe,MAAAA;AACT;;;;;"}

package/dist/server/server/src/utils/debug-dump/redact.mjs

@@ -0,0 +1,194 @@
+const REDACTED = '[REDACTED]';
+// Layer 1a: key names (substring match) whose value must be masked wherever they appear.
+const SECRET_KEY_PATTERN = /(secret|password|passphrase|salt|token|api[_-]?key|access[_-]?key|license[_-]?key|private[_-]?key|encryption[_-]?key|credential|provider[_-]?options|connection[_-]?string|mnemonic|seed[_-]?phrase|authorization|bearer)/i;
+// Layer 1b: short, ambiguous key names matched EXACTLY (case-insensitive), so they
+// do not over-match as substrings (e.g. `pass` must not redact `compass`/`bypass`,
+// and this still catches a nested SMTP `auth.pass`).
+const SECRET_KEY_EXACT = new Set([
+    'pass',
+    'pwd',
+    'passwd',
+    'dsn'
+]);
+// camelCase password suffixes (capitalized), e.g. `smtpAuthPass`, `dbPwd` — the
+// capital letter distinguishes them from lowercase look-alikes (`compass`, `bypass`).
+const SECRET_KEY_SUFFIX = /[a-z](Pass|Pwd|Passwd)$/;
+// separator-delimited short secret names, e.g. `auth.pass`, `db_pwd`, `x-pass`.
+const SECRET_KEY_DELIMITED = /(^|[._-])(pass|pwd|passwd|dsn)([._-]|$)/i;
+const isSecretKey = (key)=>SECRET_KEY_PATTERN.test(key) || SECRET_KEY_EXACT.has(key.toLowerCase()) || SECRET_KEY_SUFFIX.test(key) || SECRET_KEY_DELIMITED.test(key);
+// Layer 3: string values that look like secrets regardless of their key.
+// Real JWTs are base64url-encoded and the header segment always begins with
+// `eyJ` (the base64url encoding of `{"`), so requiring that prefix avoids
+// matching arbitrary three-part dotted strings like semver versions
+// (e.g. "5.50.1", "18.3.1").
+const JWT_PATTERN = /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+const LONG_TOKEN_PATTERN = /^[A-Fa-f0-9]{32,}$|^[A-Za-z0-9+/]{40,}={0,2}$/;
+// Credentials embedded in a URL authority: `user:pass@` or `:pass@` (empty user,
+// as in `redis://:password@host`). The user part stops at the first colon, as in
+// RFC 3986, so the split between user and password is fixed; letting it take colons
+// made a long colon run with no `@` retry every split point, which is quadratic.
+const URL_WITH_CREDENTIALS = /^[a-z][a-z0-9+.-]*:\/\/[^/@\s:]*:[^/@\s]+@/i;
+// PEM private key blocks (certificates are public, so only PRIVATE KEY is masked).
+const PEM_PRIVATE_KEY_PATTERN = /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----/;
+// URLs whose secret is carried in the host/path rather than a `user:pass@` authority:
+// chat webhooks and error-tracking DSNs.
+const SECRET_URL_PATTERN = /^https:\/\/hooks\.slack\.com\/services\/|^https:\/\/(?:discord|discordapp)\.com\/api\/webhooks\/|:\/\/[^/@\s]+@[^/\s]*\bsentry\.io\b/i;
+// Well-known provider secret token formats, matched against the whole value. The
+// prefixes are specific enough to have negligible false-positive risk, so they
+// mask a value even under an innocuous key (e.g. `key: 'sk_live_...'`).
+// `pk_` (publishable) keys are intentionally excluded — they are public by design.
+const PROVIDER_SECRET_PATTERN = new RegExp([
+    '^(sk|rk)_(live|test)_[A-Za-z0-9]{8,}$',
+    '^whsec_[A-Za-z0-9]{16,}$',
+    '^(gh[posru]_|github_pat_)[A-Za-z0-9_]{20,}$',
+    '^xox[baprs]-[A-Za-z0-9-]{10,}$',
+    '^(AKIA|ASIA)[A-Z0-9]{16}$',
+    '^SG\\.[A-Za-z0-9_-]{16,}\\.[A-Za-z0-9_-]{16,}$',
+    '^AIza[A-Za-z0-9_-]{20,}$',
+    '^ya29\\.[A-Za-z0-9_-]{20,}$',
+    '^glpat-[A-Za-z0-9_-]{16,}$',
+    '^(shpat|shpss|shpca|shppa)_[A-Za-z0-9]{20,}$',
+    '^dop_v1_[a-f0-9]{40,}$',
+    '^re_[A-Za-z0-9_]{16,}$',
+    '^nfp_[A-Za-z0-9]{20,}$',
+    '^EAAA[A-Za-z0-9_-]{20,}$'
+].join('|'));
+const looksSecret = (value)=>JWT_PATTERN.test(value) || LONG_TOKEN_PATTERN.test(value) || URL_WITH_CREDENTIALS.test(value) || PROVIDER_SECRET_PATTERN.test(value) || PEM_PRIVATE_KEY_PATTERN.test(value) || SECRET_URL_PATTERN.test(value);
+const isPlainObject = (value)=>{
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+};
+// Accept either separator regardless of the host platform: `os.homedir()` and the app root come
+// back with backslashes on Windows, and a dump may also carry POSIX-style paths (e.g. from
+// config values), so a POSIX-only prefix check would ship absolute Windows paths verbatim.
+const isPathPrefix = (value, prefix)=>{
+    if (value === prefix) {
+        return true;
+    }
+    if (!value.startsWith(prefix)) {
+        return false;
+    }
+    const next = value.charAt(prefix.length);
+    return next === '/' || next === '\\';
+};
+const relativize = (value, appRoot, homeDir)=>{
+    if (appRoot && isPathPrefix(value, appRoot)) {
+        return `<app>${value.slice(appRoot.length)}`;
+    }
+    if (homeDir && isPathPrefix(value, homeDir)) {
+        return `<home>${value.slice(homeDir.length)}`;
+    }
+    return value;
+};
+// Characters that end a URL authority
+const AUTHORITY_END = new Set([
+    '/',
+    '?',
+    '#',
+    ' ',
+    '\t',
+    '\n',
+    '\r',
+    '"',
+    "'",
+    '`'
+]);
+/**
+ * Masks the password of every `scheme://user:password@host` inside a longer string, such as a
+ * package.json script that inlines a database URL. Whole-value credential URLs are already
+ * caught by URL_WITH_CREDENTIALS; this covers the ones in the middle of a value. It is a single
+ * forward scan rather than a regex, because an unanchored pattern backtracks quadratically on
+ * long runs (the reason URL_WITH_CREDENTIALS is anchored and colon-free in the user part).
+ */ const maskEmbeddedCredentials = (value)=>{
+    let result = '';
+    let copiedUpTo = 0;
+    let separator = value.indexOf('://');
+    while(separator !== -1){
+        const authorityStart = separator + 3;
+        let firstColon = -1;
+        let lastAt = -1;
+        let end = authorityStart;
+        while(end < value.length && !AUTHORITY_END.has(value[end])){
+            if (value[end] === ':' && firstColon === -1) {
+                firstColon = end;
+            } else if (value[end] === '@') {
+                lastAt = end;
+            }
+            end += 1;
+        }
+        // A colon before the last `@` separates user and password; one after it is a port.
+        if (firstColon !== -1 && lastAt > firstColon) {
+            result += `${value.slice(copiedUpTo, firstColon + 1)}${REDACTED}`;
+            copiedUpTo = lastAt;
+        }
+        separator = value.indexOf('://', end);
+    }
+    return copiedUpTo === 0 ? value : result + value.slice(copiedUpTo);
+};
+const deleteAtPath = (target, path)=>{
+    const segments = path.split('.');
+    let node = target;
+    for(let i = 0; i < segments.length - 1; i += 1){
+        if (!isPlainObject(node)) {
+            return;
+        }
+        node = node[segments[i]];
+    }
+    const lastKey = segments[segments.length - 1];
+    if (isPlainObject(node) && lastKey in node) {
+        node[lastKey] = REDACTED;
+    }
+};
+const walk = (value, appRoot, homeDir)=>{
+    if (typeof value === 'string') {
+        // Relativization is tried FIRST, and a value it rewrote is returned as-is. A string
+        // that starts with the app root or the home directory is a path, never a credential,
+        // whereas the reverse order let the secret heuristics claim one: a POSIX path made
+        // only of letters, digits and `/` is valid standard base64, so anything past 40
+        // characters matched LONG_TOKEN_PATTERN and shipped as `[REDACTED]` instead of
+        // `<app>/...`. Values that do not relativize still go through the full checks.
+        const relativized = relativize(value, appRoot, homeDir);
+        if (relativized !== value) {
+            return relativized;
+        }
+        return looksSecret(value) ? REDACTED : maskEmbeddedCredentials(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item)=>walk(item, appRoot, homeDir));
+    }
+    if (isPlainObject(value)) {
+        const out = {};
+        for (const [key, val] of Object.entries(value)){
+            if (key === '__proto__') {
+                continue; // never write through the Object.prototype setter
+            }
+            // A secret-named key always collapses wholesale, regardless of the value's
+            // type. Recursing into it (e.g. for `apiToken: { salt, ... }`) would leak
+            // any inner value whose own key/value doesn't independently match a
+            // masking pattern (e.g. `providerOptions.auth.pass`), so there is nothing
+            // safe to preserve underneath a secret-named container.
+            out[key] = isSecretKey(key) ? REDACTED : walk(val, appRoot, homeDir);
+        }
+        return out;
+    }
+    // Any other object type — Buffer, Date, Map, Set, class instances, etc. —
+    // is not a plain data container we can safely walk (Object.entries on a
+    // Buffer leaks its bytes, a Date serializes to `{}`), so redact defensively.
+    if (value !== null && typeof value === 'object') {
+        return REDACTED;
+    }
+    return value;
+};
+const scrub = (value, options = {})=>{
+    const cloned = walk(value, options.appRoot, options.homeDir);
+    for (const path of options.extraPaths ?? []){
+        deleteAtPath(cloned, path);
+    }
+    return cloned;
+};
+
+export { REDACTED, scrub };
+//# sourceMappingURL=redact.mjs.map

package/dist/server/server/src/utils/debug-dump/redact.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.mjs","sources":["../../../../../../server/src/utils/debug-dump/redact.ts"],"sourcesContent":["export const REDACTED = '[REDACTED]';\n\n// Layer 1a: key names (substring match) whose value must be masked wherever they appear.\nconst SECRET_KEY_PATTERN =\n  /(secret|password|passphrase|salt|token|api[_-]?key|access[_-]?key|license[_-]?key|private[_-]?key|encryption[_-]?key|credential|provider[_-]?options|connection[_-]?string|mnemonic|seed[_-]?phrase|authorization|bearer)/i;\n\n// Layer 1b: short, ambiguous key names matched EXACTLY (case-insensitive), so they\n// do not over-match as substrings (e.g. `pass` must not redact `compass`/`bypass`,\n// and this still catches a nested SMTP `auth.pass`).\nconst SECRET_KEY_EXACT = new Set(['pass', 'pwd', 'passwd', 'dsn']);\n// camelCase password suffixes (capitalized), e.g. `smtpAuthPass`, `dbPwd` — the\n// capital letter distinguishes them from lowercase look-alikes (`compass`, `bypass`).\nconst SECRET_KEY_SUFFIX = /[a-z](Pass|Pwd|Passwd)$/;\n// separator-delimited short secret names, e.g. `auth.pass`, `db_pwd`, `x-pass`.\nconst SECRET_KEY_DELIMITED = /(^|[._-])(pass|pwd|passwd|dsn)([._-]|$)/i;\n\nconst isSecretKey = (key: string): boolean =>\n  SECRET_KEY_PATTERN.test(key) ||\n  SECRET_KEY_EXACT.has(key.toLowerCase()) ||\n  SECRET_KEY_SUFFIX.test(key) ||\n  SECRET_KEY_DELIMITED.test(key);\n\n// Layer 3: string values that look like secrets regardless of their key.\n// Real JWTs are base64url-encoded and the header segment always begins with\n// `eyJ` (the base64url encoding of `{\"`), so requiring that prefix avoids\n// matching arbitrary three-part dotted strings like semver versions\n// (e.g. \"5.50.1\", \"18.3.1\").\nconst JWT_PATTERN = /^eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/;\nconst LONG_TOKEN_PATTERN = /^[A-Fa-f0-9]{32,}$|^[A-Za-z0-9+/]{40,}={0,2}$/;\n// Credentials embedded in a URL authority: `user:pass@` or `:pass@` (empty user,\n// as in `redis://:password@host`). The user part stops at the first colon, as in\n// RFC 3986, so the split between user and password is fixed; letting it take colons\n// made a long colon run with no `@` retry every split point, which is quadratic.\nconst URL_WITH_CREDENTIALS = /^[a-z][a-z0-9+.-]*:\\/\\/[^/@\\s:]*:[^/@\\s]+@/i;\n// PEM private key blocks (certificates are public, so only PRIVATE KEY is masked).\nconst PEM_PRIVATE_KEY_PATTERN = /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----/;\n// URLs whose secret is carried in the host/path rather than a `user:pass@` authority:\n// chat webhooks and error-tracking DSNs.\nconst SECRET_URL_PATTERN =\n  /^https:\\/\\/hooks\\.slack\\.com\\/services\\/|^https:\\/\\/(?:discord|discordapp)\\.com\\/api\\/webhooks\\/|:\\/\\/[^/@\\s]+@[^/\\s]*\\bsentry\\.io\\b/i;\n\n// Well-known provider secret token formats, matched against the whole value. The\n// prefixes are specific enough to have negligible false-positive risk, so they\n// mask a value even under an innocuous key (e.g. `key: 'sk_live_...'`).\n// `pk_` (publishable) keys are intentionally excluded — they are public by design.\nconst PROVIDER_SECRET_PATTERN = new RegExp(\n  [\n    '^(sk|rk)_(live|test)_[A-Za-z0-9]{8,}$', // Stripe secret / restricted\n    '^whsec_[A-Za-z0-9]{16,}$', // Stripe webhook signing secret\n    '^(gh[posru]_|github_pat_)[A-Za-z0-9_]{20,}$', // GitHub tokens / fine-grained PAT\n    '^xox[baprs]-[A-Za-z0-9-]{10,}$', // Slack tokens\n    '^(AKIA|ASIA)[A-Z0-9]{16}$', // AWS access key id\n    '^SG\\\\.[A-Za-z0-9_-]{16,}\\\\.[A-Za-z0-9_-]{16,}$', // SendGrid\n    '^AIza[A-Za-z0-9_-]{20,}$', // Google API key\n    '^ya29\\\\.[A-Za-z0-9_-]{20,}$', // Google OAuth access token\n    '^glpat-[A-Za-z0-9_-]{16,}$', // GitLab personal access token\n    '^(shpat|shpss|shpca|shppa)_[A-Za-z0-9]{20,}$', // Shopify\n    '^dop_v1_[a-f0-9]{40,}$', // DigitalOcean\n    '^re_[A-Za-z0-9_]{16,}$', // Resend\n    '^nfp_[A-Za-z0-9]{20,}$', // Netlify\n    '^EAAA[A-Za-z0-9_-]{20,}$', // Square\n  ].join('|')\n);\n\nconst looksSecret = (value: string): boolean =>\n  JWT_PATTERN.test(value) ||\n  LONG_TOKEN_PATTERN.test(value) ||\n  URL_WITH_CREDENTIALS.test(value) ||\n  PROVIDER_SECRET_PATTERN.test(value) ||\n  PEM_PRIVATE_KEY_PATTERN.test(value) ||\n  SECRET_URL_PATTERN.test(value);\n\nexport interface ScrubOptions {\n  appRoot?: string;\n  homeDir?: string;\n  extraPaths?: string[];\n}\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> => {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    return false;\n  }\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n};\n\n// Accept either separator regardless of the host platform: `os.homedir()` and the app root come\n// back with backslashes on Windows, and a dump may also carry POSIX-style paths (e.g. from\n// config values), so a POSIX-only prefix check would ship absolute Windows paths verbatim.\nconst isPathPrefix = (value: string, prefix: string): boolean => {\n  if (value === prefix) {\n    return true;\n  }\n  if (!value.startsWith(prefix)) {\n    return false;\n  }\n  const next = value.charAt(prefix.length);\n  return next === '/' || next === '\\\\';\n};\n\nconst relativize = (value: string, appRoot?: string, homeDir?: string): string => {\n  if (appRoot && isPathPrefix(value, appRoot)) {\n    return `<app>${value.slice(appRoot.length)}`;\n  }\n  if (homeDir && isPathPrefix(value, homeDir)) {\n    return `<home>${value.slice(homeDir.length)}`;\n  }\n  return value;\n};\n\n// Characters that end a URL authority\nconst AUTHORITY_END = new Set(['/', '?', '#', ' ', '\\t', '\\n', '\\r', '\"', \"'\", '`']);\n\n/**\n * Masks the password of every `scheme://user:password@host` inside a longer string, such as a\n * package.json script that inlines a database URL. Whole-value credential URLs are already\n * caught by URL_WITH_CREDENTIALS; this covers the ones in the middle of a value. It is a single\n * forward scan rather than a regex, because an unanchored pattern backtracks quadratically on\n * long runs (the reason URL_WITH_CREDENTIALS is anchored and colon-free in the user part).\n */\nconst maskEmbeddedCredentials = (value: string): string => {\n  let result = '';\n  let copiedUpTo = 0;\n  let separator = value.indexOf('://');\n\n  while (separator !== -1) {\n    const authorityStart = separator + 3;\n    let firstColon = -1;\n    let lastAt = -1;\n    let end = authorityStart;\n\n    while (end < value.length && !AUTHORITY_END.has(value[end])) {\n      if (value[end] === ':' && firstColon === -1) {\n        firstColon = end;\n      } else if (value[end] === '@') {\n        lastAt = end;\n      }\n      end += 1;\n    }\n\n    // A colon before the last `@` separates user and password; one after it is a port.\n    if (firstColon !== -1 && lastAt > firstColon) {\n      result += `${value.slice(copiedUpTo, firstColon + 1)}${REDACTED}`;\n      copiedUpTo = lastAt;\n    }\n\n    separator = value.indexOf('://', end);\n  }\n\n  return copiedUpTo === 0 ? value : result + value.slice(copiedUpTo);\n};\n\nconst deleteAtPath = (target: unknown, path: string): void => {\n  const segments = path.split('.');\n  let node: unknown = target;\n  for (let i = 0; i < segments.length - 1; i += 1) {\n    if (!isPlainObject(node)) {\n      return;\n    }\n    node = node[segments[i]];\n  }\n  const lastKey = segments[segments.length - 1];\n  if (isPlainObject(node) && lastKey in node) {\n    node[lastKey] = REDACTED;\n  }\n};\n\nconst walk = (value: unknown, appRoot?: string, homeDir?: string): unknown => {\n  if (typeof value === 'string') {\n    // Relativization is tried FIRST, and a value it rewrote is returned as-is. A string\n    // that starts with the app root or the home directory is a path, never a credential,\n    // whereas the reverse order let the secret heuristics claim one: a POSIX path made\n    // only of letters, digits and `/` is valid standard base64, so anything past 40\n    // characters matched LONG_TOKEN_PATTERN and shipped as `[REDACTED]` instead of\n    // `<app>/...`. Values that do not relativize still go through the full checks.\n    const relativized = relativize(value, appRoot, homeDir);\n    if (relativized !== value) {\n      return relativized;\n    }\n    return looksSecret(value) ? REDACTED : maskEmbeddedCredentials(value);\n  }\n  if (Array.isArray(value)) {\n    return value.map((item) => walk(item, appRoot, homeDir));\n  }\n  if (isPlainObject(value)) {\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(value)) {\n      if (key === '__proto__') {\n        continue; // never write through the Object.prototype setter\n      }\n      // A secret-named key always collapses wholesale, regardless of the value's\n      // type. Recursing into it (e.g. for `apiToken: { salt, ... }`) would leak\n      // any inner value whose own key/value doesn't independently match a\n      // masking pattern (e.g. `providerOptions.auth.pass`), so there is nothing\n      // safe to preserve underneath a secret-named container.\n      out[key] = isSecretKey(key) ? REDACTED : walk(val, appRoot, homeDir);\n    }\n    return out;\n  }\n  // Any other object type — Buffer, Date, Map, Set, class instances, etc. —\n  // is not a plain data container we can safely walk (Object.entries on a\n  // Buffer leaks its bytes, a Date serializes to `{}`), so redact defensively.\n  if (value !== null && typeof value === 'object') {\n    return REDACTED;\n  }\n  return value;\n};\n\nexport const scrub = (value: unknown, options: ScrubOptions = {}): unknown => {\n  const cloned = walk(value, options.appRoot, options.homeDir);\n  for (const path of options.extraPaths ?? []) {\n    deleteAtPath(cloned, path);\n  }\n  return cloned;\n};\n"],"names":["REDACTED","SECRET_KEY_PATTERN","SECRET_KEY_EXACT","Set","SECRET_KEY_SUFFIX","SECRET_KEY_DELIMITED","isSecretKey","key","test","has","toLowerCase","JWT_PATTERN","LONG_TOKEN_PATTERN","URL_WITH_CREDENTIALS","PEM_PRIVATE_KEY_PATTERN","SECRET_URL_PATTERN","PROVIDER_SECRET_PATTERN","RegExp","join","looksSecret","value","isPlainObject","Array","isArray","proto","Object","getPrototypeOf","prototype","isPathPrefix","prefix","startsWith","next","charAt","length","relativize","appRoot","homeDir","slice","AUTHORITY_END","maskEmbeddedCredentials","result","copiedUpTo","separator","indexOf","authorityStart","firstColon","lastAt","end","deleteAtPath","target","path","segments","split","node","i","lastKey","walk","relativized","map","item","out","val","entries","scrub","options","cloned","extraPaths"],"mappings":"AAAO,MAAMA,WAAW;AAExB;AACA,MAAMC,kBAAAA,GACJ,4NAAA;AAEF;AACA;AACA;AACA,MAAMC,gBAAAA,GAAmB,IAAIC,GAAAA,CAAI;AAAC,IAAA,MAAA;AAAQ,IAAA,KAAA;AAAO,IAAA,QAAA;AAAU,IAAA;AAAM,CAAA,CAAA;AACjE;AACA;AACA,MAAMC,iBAAAA,GAAoB,yBAAA;AAC1B;AACA,MAAMC,oBAAAA,GAAuB,0CAAA;AAE7B,MAAMC,cAAc,CAACC,GAAAA,GACnBN,mBAAmBO,IAAI,CAACD,QACxBL,gBAAAA,CAAiBO,GAAG,CAACF,GAAAA,CAAIG,WAAW,OACpCN,iBAAAA,CAAkBI,IAAI,CAACD,GAAAA,CAAAA,IACvBF,oBAAAA,CAAqBG,IAAI,CAACD,GAAAA,CAAAA;AAE5B;AACA;AACA;AACA;AACA;AACA,MAAMI,WAAAA,GAAc,qDAAA;AACpB,MAAMC,kBAAAA,GAAqB,+CAAA;AAC3B;AACA;AACA;AACA;AACA,MAAMC,oBAAAA,GAAuB,6CAAA;AAC7B;AACA,MAAMC,uBAAAA,GAA0B,4CAAA;AAChC;AACA;AACA,MAAMC,kBAAAA,GACJ,uIAAA;AAEF;AACA;AACA;AACA;AACA,MAAMC,uBAAAA,GAA0B,IAAIC,MAAAA,CAClC;AACE,IAAA,uCAAA;AACA,IAAA,0BAAA;AACA,IAAA,6CAAA;AACA,IAAA,gCAAA;AACA,IAAA,2BAAA;AACA,IAAA,gDAAA;AACA,IAAA,0BAAA;AACA,IAAA,6BAAA;AACA,IAAA,4BAAA;AACA,IAAA,8CAAA;AACA,IAAA,wBAAA;AACA,IAAA,wBAAA;AACA,IAAA,wBAAA;AACA,IAAA;AACD,CAAA,CAACC,IAAI,CAAC,GAAA,CAAA,CAAA;AAGT,MAAMC,WAAAA,GAAc,CAACC,KAAAA,GACnBT,WAAAA,CAAYH,IAAI,CAACY,KAAAA,CAAAA,IACjBR,kBAAAA,CAAmBJ,IAAI,CAACY,KAAAA,CAAAA,IACxBP,oBAAAA,CAAqBL,IAAI,CAACY,KAAAA,CAAAA,IAC1BJ,uBAAAA,CAAwBR,IAAI,CAACY,KAAAA,CAAAA,IAC7BN,uBAAAA,CAAwBN,IAAI,CAACY,KAAAA,CAAAA,IAC7BL,kBAAAA,CAAmBP,IAAI,CAACY,KAAAA,CAAAA;AAQ1B,MAAMC,gBAAgB,CAACD,KAAAA,GAAAA;IACrB,IAAIA,KAAAA,KAAU,QAAQ,OAAOA,KAAAA,KAAU,YAAYE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,EAAQ;QACvE,OAAO,KAAA;AACT,IAAA;IACA,MAAMI,KAAAA,GAAQC,MAAAA,CAAOC,cAAc,CAACN,KAAAA,CAAAA;AACpC,IAAA,OAAOI,KAAAA,KAAUC,MAAAA,CAAOE,SAAS,IAAIH,KAAAA,KAAU,IAAA;AACjD,CAAA;AAEA;AACA;AACA;AACA,MAAMI,YAAAA,GAAe,CAACR,KAAAA,EAAeS,MAAAA,GAAAA;AACnC,IAAA,IAAIT,UAAUS,MAAAA,EAAQ;QACpB,OAAO,IAAA;AACT,IAAA;AACA,IAAA,IAAI,CAACT,KAAAA,CAAMU,UAAU,CAACD,MAAAA,CAAAA,EAAS;QAC7B,OAAO,KAAA;AACT,IAAA;AACA,IAAA,MAAME,IAAAA,GAAOX,KAAAA,CAAMY,MAAM,CAACH,OAAOI,MAAM,CAAA;IACvC,OAAOF,IAAAA,KAAS,OAAOA,IAAAA,KAAS,IAAA;AAClC,CAAA;AAEA,MAAMG,UAAAA,GAAa,CAACd,KAAAA,EAAee,OAAAA,EAAkBC,OAAAA,GAAAA;IACnD,IAAID,OAAAA,IAAWP,YAAAA,CAAaR,KAAAA,EAAOe,OAAAA,CAAAA,EAAU;QAC3C,OAAO,CAAC,KAAK,EAAEf,KAAAA,CAAMiB,KAAK,CAACF,OAAAA,CAAQF,MAAM,CAAA,CAAA,CAAG;AAC9C,IAAA;IACA,IAAIG,OAAAA,IAAWR,YAAAA,CAAaR,KAAAA,EAAOgB,OAAAA,CAAAA,EAAU;QAC3C,OAAO,CAAC,MAAM,EAAEhB,KAAAA,CAAMiB,KAAK,CAACD,OAAAA,CAAQH,MAAM,CAAA,CAAA,CAAG;AAC/C,IAAA;IACA,OAAOb,KAAAA;AACT,CAAA;AAEA;AACA,MAAMkB,aAAAA,GAAgB,IAAInC,GAAAA,CAAI;AAAC,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA,IAAA;AAAM,IAAA,IAAA;AAAM,IAAA,IAAA;AAAM,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA;AAAI,CAAA,CAAA;AAEnF;;;;;;IAOA,MAAMoC,0BAA0B,CAACnB,KAAAA,GAAAA;AAC/B,IAAA,IAAIoB,MAAAA,GAAS,EAAA;AACb,IAAA,IAAIC,UAAAA,GAAa,CAAA;IACjB,IAAIC,SAAAA,GAAYtB,KAAAA,CAAMuB,OAAO,CAAC,KAAA,CAAA;IAE9B,MAAOD,SAAAA,KAAc,EAAC,CAAG;AACvB,QAAA,MAAME,iBAAiBF,SAAAA,GAAY,CAAA;AACnC,QAAA,IAAIG,aAAa,EAAC;AAClB,QAAA,IAAIC,SAAS,EAAC;AACd,QAAA,IAAIC,GAAAA,GAAMH,cAAAA;QAEV,MAAOG,GAAAA,GAAM3B,KAAAA,CAAMa,MAAM,IAAI,CAACK,aAAAA,CAAc7B,GAAG,CAACW,KAAK,CAAC2B,GAAAA,CAAI,CAAA,CAAG;AAC3D,YAAA,IAAI3B,KAAK,CAAC2B,GAAAA,CAAI,KAAK,GAAA,IAAOF,UAAAA,KAAe,EAAC,EAAG;gBAC3CA,UAAAA,GAAaE,GAAAA;AACf,YAAA,CAAA,MAAO,IAAI3B,KAAK,CAAC2B,GAAAA,CAAI,KAAK,GAAA,EAAK;gBAC7BD,MAAAA,GAASC,GAAAA;AACX,YAAA;YACAA,GAAAA,IAAO,CAAA;AACT,QAAA;;AAGA,QAAA,IAAIF,UAAAA,KAAe,EAAC,IAAKC,MAAAA,GAASD,UAAAA,EAAY;AAC5CL,YAAAA,MAAAA,IAAU,GAAGpB,KAAAA,CAAMiB,KAAK,CAACI,UAAAA,EAAYI,UAAAA,GAAa,KAAK7C,QAAAA,CAAAA,CAAU;YACjEyC,UAAAA,GAAaK,MAAAA;AACf,QAAA;QAEAJ,SAAAA,GAAYtB,KAAAA,CAAMuB,OAAO,CAAC,KAAA,EAAOI,GAAAA,CAAAA;AACnC,IAAA;AAEA,IAAA,OAAON,eAAe,CAAA,GAAIrB,KAAAA,GAAQoB,MAAAA,GAASpB,KAAAA,CAAMiB,KAAK,CAACI,UAAAA,CAAAA;AACzD,CAAA;AAEA,MAAMO,YAAAA,GAAe,CAACC,MAAAA,EAAiBC,IAAAA,GAAAA;IACrC,MAAMC,QAAAA,GAAWD,IAAAA,CAAKE,KAAK,CAAC,GAAA,CAAA;AAC5B,IAAA,IAAIC,IAAAA,GAAgBJ,MAAAA;IACpB,IAAK,IAAIK,IAAI,CAAA,EAAGA,CAAAA,GAAIH,SAASlB,MAAM,GAAG,CAAA,EAAGqB,CAAAA,IAAK,CAAA,CAAG;QAC/C,IAAI,CAACjC,cAAcgC,IAAAA,CAAAA,EAAO;AACxB,YAAA;AACF,QAAA;AACAA,QAAAA,IAAAA,GAAOA,IAAI,CAACF,QAAQ,CAACG,EAAE,CAAC;AAC1B,IAAA;AACA,IAAA,MAAMC,UAAUJ,QAAQ,CAACA,QAAAA,CAASlB,MAAM,GAAG,CAAA,CAAE;IAC7C,IAAIZ,aAAAA,CAAcgC,IAAAA,CAAAA,IAASE,OAAAA,IAAWF,IAAAA,EAAM;QAC1CA,IAAI,CAACE,QAAQ,GAAGvD,QAAAA;AAClB,IAAA;AACF,CAAA;AAEA,MAAMwD,IAAAA,GAAO,CAACpC,KAAAA,EAAgBe,OAAAA,EAAkBC,OAAAA,GAAAA;IAC9C,IAAI,OAAOhB,UAAU,QAAA,EAAU;;;;;;;QAO7B,MAAMqC,WAAAA,GAAcvB,UAAAA,CAAWd,KAAAA,EAAOe,OAAAA,EAASC,OAAAA,CAAAA;AAC/C,QAAA,IAAIqB,gBAAgBrC,KAAAA,EAAO;YACzB,OAAOqC,WAAAA;AACT,QAAA;QACA,OAAOtC,WAAAA,CAAYC,KAAAA,CAAAA,GAASpB,QAAAA,GAAWuC,uBAAAA,CAAwBnB,KAAAA,CAAAA;AACjE,IAAA;IACA,IAAIE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,EAAQ;AACxB,QAAA,OAAOA,MAAMsC,GAAG,CAAC,CAACC,IAAAA,GAASH,IAAAA,CAAKG,MAAMxB,OAAAA,EAASC,OAAAA,CAAAA,CAAAA;AACjD,IAAA;AACA,IAAA,IAAIf,cAAcD,KAAAA,CAAAA,EAAQ;AACxB,QAAA,MAAMwC,MAA+B,EAAC;QACtC,KAAK,MAAM,CAACrD,GAAAA,EAAKsD,GAAAA,CAAI,IAAIpC,MAAAA,CAAOqC,OAAO,CAAC1C,KAAAA,CAAAA,CAAQ;AAC9C,YAAA,IAAIb,QAAQ,WAAA,EAAa;AACvB,gBAAA,SAAA;AACF,YAAA;;;;;;YAMAqD,GAAG,CAACrD,IAAI,GAAGD,WAAAA,CAAYC,OAAOP,QAAAA,GAAWwD,IAAAA,CAAKK,KAAK1B,OAAAA,EAASC,OAAAA,CAAAA;AAC9D,QAAA;QACA,OAAOwB,GAAAA;AACT,IAAA;;;;AAIA,IAAA,IAAIxC,KAAAA,KAAU,IAAA,IAAQ,OAAOA,KAAAA,KAAU,QAAA,EAAU;QAC/C,OAAOpB,QAAAA;AACT,IAAA;IACA,OAAOoB,KAAAA;AACT,CAAA;MAEa2C,KAAAA,GAAQ,CAAC3C,KAAAA,EAAgB4C,OAAAA,GAAwB,EAAE,GAAA;AAC9D,IAAA,MAAMC,SAAST,IAAAA,CAAKpC,KAAAA,EAAO4C,QAAQ7B,OAAO,EAAE6B,QAAQ5B,OAAO,CAAA;AAC3D,IAAA,KAAK,MAAMc,IAAAA,IAAQc,OAAAA,CAAQE,UAAU,IAAI,EAAE,CAAE;AAC3ClB,QAAAA,YAAAA,CAAaiB,MAAAA,EAAQf,IAAAA,CAAAA;AACvB,IAAA;IACA,OAAOe,MAAAA;AACT;;;;"}