@strapi/admin 5.57.0 → 5.58.0

package/dist/server/server/src/utils/debug-dump/redact.js

@@ -0,0 +1,197 @@
+'use strict';
+
+const REDACTED = '[REDACTED]';
+// Layer 1a: key names (substring match) whose value must be masked wherever they appear.
+const SECRET_KEY_PATTERN = /(secret|password|passphrase|salt|token|api[_-]?key|access[_-]?key|license[_-]?key|private[_-]?key|encryption[_-]?key|credential|provider[_-]?options|connection[_-]?string|mnemonic|seed[_-]?phrase|authorization|bearer)/i;
+// Layer 1b: short, ambiguous key names matched EXACTLY (case-insensitive), so they
+// do not over-match as substrings (e.g. `pass` must not redact `compass`/`bypass`,
+// and this still catches a nested SMTP `auth.pass`).
+const SECRET_KEY_EXACT = new Set([
+    'pass',
+    'pwd',
+    'passwd',
+    'dsn'
+]);
+// camelCase password suffixes (capitalized), e.g. `smtpAuthPass`, `dbPwd` — the
+// capital letter distinguishes them from lowercase look-alikes (`compass`, `bypass`).
+const SECRET_KEY_SUFFIX = /[a-z](Pass|Pwd|Passwd)$/;
+// separator-delimited short secret names, e.g. `auth.pass`, `db_pwd`, `x-pass`.
+const SECRET_KEY_DELIMITED = /(^|[._-])(pass|pwd|passwd|dsn)([._-]|$)/i;
+const isSecretKey = (key)=>SECRET_KEY_PATTERN.test(key) || SECRET_KEY_EXACT.has(key.toLowerCase()) || SECRET_KEY_SUFFIX.test(key) || SECRET_KEY_DELIMITED.test(key);
+// Layer 3: string values that look like secrets regardless of their key.
+// Real JWTs are base64url-encoded and the header segment always begins with
+// `eyJ` (the base64url encoding of `{"`), so requiring that prefix avoids
+// matching arbitrary three-part dotted strings like semver versions
+// (e.g. "5.50.1", "18.3.1").
+const JWT_PATTERN = /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+const LONG_TOKEN_PATTERN = /^[A-Fa-f0-9]{32,}$|^[A-Za-z0-9+/]{40,}={0,2}$/;
+// Credentials embedded in a URL authority: `user:pass@` or `:pass@` (empty user,
+// as in `redis://:password@host`). The user part stops at the first colon, as in
+// RFC 3986, so the split between user and password is fixed; letting it take colons
+// made a long colon run with no `@` retry every split point, which is quadratic.
+const URL_WITH_CREDENTIALS = /^[a-z][a-z0-9+.-]*:\/\/[^/@\s:]*:[^/@\s]+@/i;
+// PEM private key blocks (certificates are public, so only PRIVATE KEY is masked).
+const PEM_PRIVATE_KEY_PATTERN = /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----/;
+// URLs whose secret is carried in the host/path rather than a `user:pass@` authority:
+// chat webhooks and error-tracking DSNs.
+const SECRET_URL_PATTERN = /^https:\/\/hooks\.slack\.com\/services\/|^https:\/\/(?:discord|discordapp)\.com\/api\/webhooks\/|:\/\/[^/@\s]+@[^/\s]*\bsentry\.io\b/i;
+// Well-known provider secret token formats, matched against the whole value. The
+// prefixes are specific enough to have negligible false-positive risk, so they
+// mask a value even under an innocuous key (e.g. `key: 'sk_live_...'`).
+// `pk_` (publishable) keys are intentionally excluded — they are public by design.
+const PROVIDER_SECRET_PATTERN = new RegExp([
+    '^(sk|rk)_(live|test)_[A-Za-z0-9]{8,}$',
+    '^whsec_[A-Za-z0-9]{16,}$',
+    '^(gh[posru]_|github_pat_)[A-Za-z0-9_]{20,}$',
+    '^xox[baprs]-[A-Za-z0-9-]{10,}$',
+    '^(AKIA|ASIA)[A-Z0-9]{16}$',
+    '^SG\\.[A-Za-z0-9_-]{16,}\\.[A-Za-z0-9_-]{16,}$',
+    '^AIza[A-Za-z0-9_-]{20,}$',
+    '^ya29\\.[A-Za-z0-9_-]{20,}$',
+    '^glpat-[A-Za-z0-9_-]{16,}$',
+    '^(shpat|shpss|shpca|shppa)_[A-Za-z0-9]{20,}$',
+    '^dop_v1_[a-f0-9]{40,}$',
+    '^re_[A-Za-z0-9_]{16,}$',
+    '^nfp_[A-Za-z0-9]{20,}$',
+    '^EAAA[A-Za-z0-9_-]{20,}$'
+].join('|'));
+const looksSecret = (value)=>JWT_PATTERN.test(value) || LONG_TOKEN_PATTERN.test(value) || URL_WITH_CREDENTIALS.test(value) || PROVIDER_SECRET_PATTERN.test(value) || PEM_PRIVATE_KEY_PATTERN.test(value) || SECRET_URL_PATTERN.test(value);
+const isPlainObject = (value)=>{
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+};
+// Accept either separator regardless of the host platform: `os.homedir()` and the app root come
+// back with backslashes on Windows, and a dump may also carry POSIX-style paths (e.g. from
+// config values), so a POSIX-only prefix check would ship absolute Windows paths verbatim.
+const isPathPrefix = (value, prefix)=>{
+    if (value === prefix) {
+        return true;
+    }
+    if (!value.startsWith(prefix)) {
+        return false;
+    }
+    const next = value.charAt(prefix.length);
+    return next === '/' || next === '\\';
+};
+const relativize = (value, appRoot, homeDir)=>{
+    if (appRoot && isPathPrefix(value, appRoot)) {
+        return `<app>${value.slice(appRoot.length)}`;
+    }
+    if (homeDir && isPathPrefix(value, homeDir)) {
+        return `<home>${value.slice(homeDir.length)}`;
+    }
+    return value;
+};
+// Characters that end a URL authority
+const AUTHORITY_END = new Set([
+    '/',
+    '?',
+    '#',
+    ' ',
+    '\t',
+    '\n',
+    '\r',
+    '"',
+    "'",
+    '`'
+]);
+/**
+ * Masks the password of every `scheme://user:password@host` inside a longer string, such as a
+ * package.json script that inlines a database URL. Whole-value credential URLs are already
+ * caught by URL_WITH_CREDENTIALS; this covers the ones in the middle of a value. It is a single
+ * forward scan rather than a regex, because an unanchored pattern backtracks quadratically on
+ * long runs (the reason URL_WITH_CREDENTIALS is anchored and colon-free in the user part).
+ */ const maskEmbeddedCredentials = (value)=>{
+    let result = '';
+    let copiedUpTo = 0;
+    let separator = value.indexOf('://');
+    while(separator !== -1){
+        const authorityStart = separator + 3;
+        let firstColon = -1;
+        let lastAt = -1;
+        let end = authorityStart;
+        while(end < value.length && !AUTHORITY_END.has(value[end])){
+            if (value[end] === ':' && firstColon === -1) {
+                firstColon = end;
+            } else if (value[end] === '@') {
+                lastAt = end;
+            }
+            end += 1;
+        }
+        // A colon before the last `@` separates user and password; one after it is a port.
+        if (firstColon !== -1 && lastAt > firstColon) {
+            result += `${value.slice(copiedUpTo, firstColon + 1)}${REDACTED}`;
+            copiedUpTo = lastAt;
+        }
+        separator = value.indexOf('://', end);
+    }
+    return copiedUpTo === 0 ? value : result + value.slice(copiedUpTo);
+};
+const deleteAtPath = (target, path)=>{
+    const segments = path.split('.');
+    let node = target;
+    for(let i = 0; i < segments.length - 1; i += 1){
+        if (!isPlainObject(node)) {
+            return;
+        }
+        node = node[segments[i]];
+    }
+    const lastKey = segments[segments.length - 1];
+    if (isPlainObject(node) && lastKey in node) {
+        node[lastKey] = REDACTED;
+    }
+};
+const walk = (value, appRoot, homeDir)=>{
+    if (typeof value === 'string') {
+        // Relativization is tried FIRST, and a value it rewrote is returned as-is. A string
+        // that starts with the app root or the home directory is a path, never a credential,
+        // whereas the reverse order let the secret heuristics claim one: a POSIX path made
+        // only of letters, digits and `/` is valid standard base64, so anything past 40
+        // characters matched LONG_TOKEN_PATTERN and shipped as `[REDACTED]` instead of
+        // `<app>/...`. Values that do not relativize still go through the full checks.
+        const relativized = relativize(value, appRoot, homeDir);
+        if (relativized !== value) {
+            return relativized;
+        }
+        return looksSecret(value) ? REDACTED : maskEmbeddedCredentials(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item)=>walk(item, appRoot, homeDir));
+    }
+    if (isPlainObject(value)) {
+        const out = {};
+        for (const [key, val] of Object.entries(value)){
+            if (key === '__proto__') {
+                continue; // never write through the Object.prototype setter
+            }
+            // A secret-named key always collapses wholesale, regardless of the value's
+            // type. Recursing into it (e.g. for `apiToken: { salt, ... }`) would leak
+            // any inner value whose own key/value doesn't independently match a
+            // masking pattern (e.g. `providerOptions.auth.pass`), so there is nothing
+            // safe to preserve underneath a secret-named container.
+            out[key] = isSecretKey(key) ? REDACTED : walk(val, appRoot, homeDir);
+        }
+        return out;
+    }
+    // Any other object type — Buffer, Date, Map, Set, class instances, etc. —
+    // is not a plain data container we can safely walk (Object.entries on a
+    // Buffer leaks its bytes, a Date serializes to `{}`), so redact defensively.
+    if (value !== null && typeof value === 'object') {
+        return REDACTED;
+    }
+    return value;
+};
+const scrub = (value, options = {})=>{
+    const cloned = walk(value, options.appRoot, options.homeDir);
+    for (const path of options.extraPaths ?? []){
+        deleteAtPath(cloned, path);
+    }
+    return cloned;
+};
+
+exports.REDACTED = REDACTED;
+exports.scrub = scrub;
+//# sourceMappingURL=redact.js.map

package/dist/server/server/src/utils/debug-dump/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sources":["../../../../../../server/src/utils/debug-dump/redact.ts"],"sourcesContent":["export const REDACTED = '[REDACTED]';\n\n// Layer 1a: key names (substring match) whose value must be masked wherever they appear.\nconst SECRET_KEY_PATTERN =\n  /(secret|password|passphrase|salt|token|api[_-]?key|access[_-]?key|license[_-]?key|private[_-]?key|encryption[_-]?key|credential|provider[_-]?options|connection[_-]?string|mnemonic|seed[_-]?phrase|authorization|bearer)/i;\n\n// Layer 1b: short, ambiguous key names matched EXACTLY (case-insensitive), so they\n// do not over-match as substrings (e.g. `pass` must not redact `compass`/`bypass`,\n// and this still catches a nested SMTP `auth.pass`).\nconst SECRET_KEY_EXACT = new Set(['pass', 'pwd', 'passwd', 'dsn']);\n// camelCase password suffixes (capitalized), e.g. `smtpAuthPass`, `dbPwd` — the\n// capital letter distinguishes them from lowercase look-alikes (`compass`, `bypass`).\nconst SECRET_KEY_SUFFIX = /[a-z](Pass|Pwd|Passwd)$/;\n// separator-delimited short secret names, e.g. `auth.pass`, `db_pwd`, `x-pass`.\nconst SECRET_KEY_DELIMITED = /(^|[._-])(pass|pwd|passwd|dsn)([._-]|$)/i;\n\nconst isSecretKey = (key: string): boolean =>\n  SECRET_KEY_PATTERN.test(key) ||\n  SECRET_KEY_EXACT.has(key.toLowerCase()) ||\n  SECRET_KEY_SUFFIX.test(key) ||\n  SECRET_KEY_DELIMITED.test(key);\n\n// Layer 3: string values that look like secrets regardless of their key.\n// Real JWTs are base64url-encoded and the header segment always begins with\n// `eyJ` (the base64url encoding of `{\"`), so requiring that prefix avoids\n// matching arbitrary three-part dotted strings like semver versions\n// (e.g. \"5.50.1\", \"18.3.1\").\nconst JWT_PATTERN = /^eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/;\nconst LONG_TOKEN_PATTERN = /^[A-Fa-f0-9]{32,}$|^[A-Za-z0-9+/]{40,}={0,2}$/;\n// Credentials embedded in a URL authority: `user:pass@` or `:pass@` (empty user,\n// as in `redis://:password@host`). The user part stops at the first colon, as in\n// RFC 3986, so the split between user and password is fixed; letting it take colons\n// made a long colon run with no `@` retry every split point, which is quadratic.\nconst URL_WITH_CREDENTIALS = /^[a-z][a-z0-9+.-]*:\\/\\/[^/@\\s:]*:[^/@\\s]+@/i;\n// PEM private key blocks (certificates are public, so only PRIVATE KEY is masked).\nconst PEM_PRIVATE_KEY_PATTERN = /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----/;\n// URLs whose secret is carried in the host/path rather than a `user:pass@` authority:\n// chat webhooks and error-tracking DSNs.\nconst SECRET_URL_PATTERN =\n  /^https:\\/\\/hooks\\.slack\\.com\\/services\\/|^https:\\/\\/(?:discord|discordapp)\\.com\\/api\\/webhooks\\/|:\\/\\/[^/@\\s]+@[^/\\s]*\\bsentry\\.io\\b/i;\n\n// Well-known provider secret token formats, matched against the whole value. The\n// prefixes are specific enough to have negligible false-positive risk, so they\n// mask a value even under an innocuous key (e.g. `key: 'sk_live_...'`).\n// `pk_` (publishable) keys are intentionally excluded — they are public by design.\nconst PROVIDER_SECRET_PATTERN = new RegExp(\n  [\n    '^(sk|rk)_(live|test)_[A-Za-z0-9]{8,}$', // Stripe secret / restricted\n    '^whsec_[A-Za-z0-9]{16,}$', // Stripe webhook signing secret\n    '^(gh[posru]_|github_pat_)[A-Za-z0-9_]{20,}$', // GitHub tokens / fine-grained PAT\n    '^xox[baprs]-[A-Za-z0-9-]{10,}$', // Slack tokens\n    '^(AKIA|ASIA)[A-Z0-9]{16}$', // AWS access key id\n    '^SG\\\\.[A-Za-z0-9_-]{16,}\\\\.[A-Za-z0-9_-]{16,}$', // SendGrid\n    '^AIza[A-Za-z0-9_-]{20,}$', // Google API key\n    '^ya29\\\\.[A-Za-z0-9_-]{20,}$', // Google OAuth access token\n    '^glpat-[A-Za-z0-9_-]{16,}$', // GitLab personal access token\n    '^(shpat|shpss|shpca|shppa)_[A-Za-z0-9]{20,}$', // Shopify\n    '^dop_v1_[a-f0-9]{40,}$', // DigitalOcean\n    '^re_[A-Za-z0-9_]{16,}$', // Resend\n    '^nfp_[A-Za-z0-9]{20,}$', // Netlify\n    '^EAAA[A-Za-z0-9_-]{20,}$', // Square\n  ].join('|')\n);\n\nconst looksSecret = (value: string): boolean =>\n  JWT_PATTERN.test(value) ||\n  LONG_TOKEN_PATTERN.test(value) ||\n  URL_WITH_CREDENTIALS.test(value) ||\n  PROVIDER_SECRET_PATTERN.test(value) ||\n  PEM_PRIVATE_KEY_PATTERN.test(value) ||\n  SECRET_URL_PATTERN.test(value);\n\nexport interface ScrubOptions {\n  appRoot?: string;\n  homeDir?: string;\n  extraPaths?: string[];\n}\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> => {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    return false;\n  }\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n};\n\n// Accept either separator regardless of the host platform: `os.homedir()` and the app root come\n// back with backslashes on Windows, and a dump may also carry POSIX-style paths (e.g. from\n// config values), so a POSIX-only prefix check would ship absolute Windows paths verbatim.\nconst isPathPrefix = (value: string, prefix: string): boolean => {\n  if (value === prefix) {\n    return true;\n  }\n  if (!value.startsWith(prefix)) {\n    return false;\n  }\n  const next = value.charAt(prefix.length);\n  return next === '/' || next === '\\\\';\n};\n\nconst relativize = (value: string, appRoot?: string, homeDir?: string): string => {\n  if (appRoot && isPathPrefix(value, appRoot)) {\n    return `<app>${value.slice(appRoot.length)}`;\n  }\n  if (homeDir && isPathPrefix(value, homeDir)) {\n    return `<home>${value.slice(homeDir.length)}`;\n  }\n  return value;\n};\n\n// Characters that end a URL authority\nconst AUTHORITY_END = new Set(['/', '?', '#', ' ', '\\t', '\\n', '\\r', '\"', \"'\", '`']);\n\n/**\n * Masks the password of every `scheme://user:password@host` inside a longer string, such as a\n * package.json script that inlines a database URL. Whole-value credential URLs are already\n * caught by URL_WITH_CREDENTIALS; this covers the ones in the middle of a value. It is a single\n * forward scan rather than a regex, because an unanchored pattern backtracks quadratically on\n * long runs (the reason URL_WITH_CREDENTIALS is anchored and colon-free in the user part).\n */\nconst maskEmbeddedCredentials = (value: string): string => {\n  let result = '';\n  let copiedUpTo = 0;\n  let separator = value.indexOf('://');\n\n  while (separator !== -1) {\n    const authorityStart = separator + 3;\n    let firstColon = -1;\n    let lastAt = -1;\n    let end = authorityStart;\n\n    while (end < value.length && !AUTHORITY_END.has(value[end])) {\n      if (value[end] === ':' && firstColon === -1) {\n        firstColon = end;\n      } else if (value[end] === '@') {\n        lastAt = end;\n      }\n      end += 1;\n    }\n\n    // A colon before the last `@` separates user and password; one after it is a port.\n    if (firstColon !== -1 && lastAt > firstColon) {\n      result += `${value.slice(copiedUpTo, firstColon + 1)}${REDACTED}`;\n      copiedUpTo = lastAt;\n    }\n\n    separator = value.indexOf('://', end);\n  }\n\n  return copiedUpTo === 0 ? value : result + value.slice(copiedUpTo);\n};\n\nconst deleteAtPath = (target: unknown, path: string): void => {\n  const segments = path.split('.');\n  let node: unknown = target;\n  for (let i = 0; i < segments.length - 1; i += 1) {\n    if (!isPlainObject(node)) {\n      return;\n    }\n    node = node[segments[i]];\n  }\n  const lastKey = segments[segments.length - 1];\n  if (isPlainObject(node) && lastKey in node) {\n    node[lastKey] = REDACTED;\n  }\n};\n\nconst walk = (value: unknown, appRoot?: string, homeDir?: string): unknown => {\n  if (typeof value === 'string') {\n    // Relativization is tried FIRST, and a value it rewrote is returned as-is. A string\n    // that starts with the app root or the home directory is a path, never a credential,\n    // whereas the reverse order let the secret heuristics claim one: a POSIX path made\n    // only of letters, digits and `/` is valid standard base64, so anything past 40\n    // characters matched LONG_TOKEN_PATTERN and shipped as `[REDACTED]` instead of\n    // `<app>/...`. Values that do not relativize still go through the full checks.\n    const relativized = relativize(value, appRoot, homeDir);\n    if (relativized !== value) {\n      return relativized;\n    }\n    return looksSecret(value) ? REDACTED : maskEmbeddedCredentials(value);\n  }\n  if (Array.isArray(value)) {\n    return value.map((item) => walk(item, appRoot, homeDir));\n  }\n  if (isPlainObject(value)) {\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(value)) {\n      if (key === '__proto__') {\n        continue; // never write through the Object.prototype setter\n      }\n      // A secret-named key always collapses wholesale, regardless of the value's\n      // type. Recursing into it (e.g. for `apiToken: { salt, ... }`) would leak\n      // any inner value whose own key/value doesn't independently match a\n      // masking pattern (e.g. `providerOptions.auth.pass`), so there is nothing\n      // safe to preserve underneath a secret-named container.\n      out[key] = isSecretKey(key) ? REDACTED : walk(val, appRoot, homeDir);\n    }\n    return out;\n  }\n  // Any other object type — Buffer, Date, Map, Set, class instances, etc. —\n  // is not a plain data container we can safely walk (Object.entries on a\n  // Buffer leaks its bytes, a Date serializes to `{}`), so redact defensively.\n  if (value !== null && typeof value === 'object') {\n    return REDACTED;\n  }\n  return value;\n};\n\nexport const scrub = (value: unknown, options: ScrubOptions = {}): unknown => {\n  const cloned = walk(value, options.appRoot, options.homeDir);\n  for (const path of options.extraPaths ?? []) {\n    deleteAtPath(cloned, path);\n  }\n  return cloned;\n};\n"],"names":["REDACTED","SECRET_KEY_PATTERN","SECRET_KEY_EXACT","Set","SECRET_KEY_SUFFIX","SECRET_KEY_DELIMITED","isSecretKey","key","test","has","toLowerCase","JWT_PATTERN","LONG_TOKEN_PATTERN","URL_WITH_CREDENTIALS","PEM_PRIVATE_KEY_PATTERN","SECRET_URL_PATTERN","PROVIDER_SECRET_PATTERN","RegExp","join","looksSecret","value","isPlainObject","Array","isArray","proto","Object","getPrototypeOf","prototype","isPathPrefix","prefix","startsWith","next","charAt","length","relativize","appRoot","homeDir","slice","AUTHORITY_END","maskEmbeddedCredentials","result","copiedUpTo","separator","indexOf","authorityStart","firstColon","lastAt","end","deleteAtPath","target","path","segments","split","node","i","lastKey","walk","relativized","map","item","out","val","entries","scrub","options","cloned","extraPaths"],"mappings":";;AAAO,MAAMA,WAAW;AAExB;AACA,MAAMC,kBAAAA,GACJ,4NAAA;AAEF;AACA;AACA;AACA,MAAMC,gBAAAA,GAAmB,IAAIC,GAAAA,CAAI;AAAC,IAAA,MAAA;AAAQ,IAAA,KAAA;AAAO,IAAA,QAAA;AAAU,IAAA;AAAM,CAAA,CAAA;AACjE;AACA;AACA,MAAMC,iBAAAA,GAAoB,yBAAA;AAC1B;AACA,MAAMC,oBAAAA,GAAuB,0CAAA;AAE7B,MAAMC,cAAc,CAACC,GAAAA,GACnBN,mBAAmBO,IAAI,CAACD,QACxBL,gBAAAA,CAAiBO,GAAG,CAACF,GAAAA,CAAIG,WAAW,OACpCN,iBAAAA,CAAkBI,IAAI,CAACD,GAAAA,CAAAA,IACvBF,oBAAAA,CAAqBG,IAAI,CAACD,GAAAA,CAAAA;AAE5B;AACA;AACA;AACA;AACA;AACA,MAAMI,WAAAA,GAAc,qDAAA;AACpB,MAAMC,kBAAAA,GAAqB,+CAAA;AAC3B;AACA;AACA;AACA;AACA,MAAMC,oBAAAA,GAAuB,6CAAA;AAC7B;AACA,MAAMC,uBAAAA,GAA0B,4CAAA;AAChC;AACA;AACA,MAAMC,kBAAAA,GACJ,uIAAA;AAEF;AACA;AACA;AACA;AACA,MAAMC,uBAAAA,GAA0B,IAAIC,MAAAA,CAClC;AACE,IAAA,uCAAA;AACA,IAAA,0BAAA;AACA,IAAA,6CAAA;AACA,IAAA,gCAAA;AACA,IAAA,2BAAA;AACA,IAAA,gDAAA;AACA,IAAA,0BAAA;AACA,IAAA,6BAAA;AACA,IAAA,4BAAA;AACA,IAAA,8CAAA;AACA,IAAA,wBAAA;AACA,IAAA,wBAAA;AACA,IAAA,wBAAA;AACA,IAAA;AACD,CAAA,CAACC,IAAI,CAAC,GAAA,CAAA,CAAA;AAGT,MAAMC,WAAAA,GAAc,CAACC,KAAAA,GACnBT,WAAAA,CAAYH,IAAI,CAACY,KAAAA,CAAAA,IACjBR,kBAAAA,CAAmBJ,IAAI,CAACY,KAAAA,CAAAA,IACxBP,oBAAAA,CAAqBL,IAAI,CAACY,KAAAA,CAAAA,IAC1BJ,uBAAAA,CAAwBR,IAAI,CAACY,KAAAA,CAAAA,IAC7BN,uBAAAA,CAAwBN,IAAI,CAACY,KAAAA,CAAAA,IAC7BL,kBAAAA,CAAmBP,IAAI,CAACY,KAAAA,CAAAA;AAQ1B,MAAMC,gBAAgB,CAACD,KAAAA,GAAAA;IACrB,IAAIA,KAAAA,KAAU,QAAQ,OAAOA,KAAAA,KAAU,YAAYE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,EAAQ;QACvE,OAAO,KAAA;AACT,IAAA;IACA,MAAMI,KAAAA,GAAQC,MAAAA,CAAOC,cAAc,CAACN,KAAAA,CAAAA;AACpC,IAAA,OAAOI,KAAAA,KAAUC,MAAAA,CAAOE,SAAS,IAAIH,KAAAA,KAAU,IAAA;AACjD,CAAA;AAEA;AACA;AACA;AACA,MAAMI,YAAAA,GAAe,CAACR,KAAAA,EAAeS,MAAAA,GAAAA;AACnC,IAAA,IAAIT,UAAUS,MAAAA,EAAQ;QACpB,OAAO,IAAA;AACT,IAAA;AACA,IAAA,IAAI,CAACT,KAAAA,CAAMU,UAAU,CAACD,MAAAA,CAAAA,EAAS;QAC7B,OAAO,KAAA;AACT,IAAA;AACA,IAAA,MAAME,IAAAA,GAAOX,KAAAA,CAAMY,MAAM,CAACH,OAAOI,MAAM,CAAA;IACvC,OAAOF,IAAAA,KAAS,OAAOA,IAAAA,KAAS,IAAA;AAClC,CAAA;AAEA,MAAMG,UAAAA,GAAa,CAACd,KAAAA,EAAee,OAAAA,EAAkBC,OAAAA,GAAAA;IACnD,IAAID,OAAAA,IAAWP,YAAAA,CAAaR,KAAAA,EAAOe,OAAAA,CAAAA,EAAU;QAC3C,OAAO,CAAC,KAAK,EAAEf,KAAAA,CAAMiB,KAAK,CAACF,OAAAA,CAAQF,MAAM,CAAA,CAAA,CAAG;AAC9C,IAAA;IACA,IAAIG,OAAAA,IAAWR,YAAAA,CAAaR,KAAAA,EAAOgB,OAAAA,CAAAA,EAAU;QAC3C,OAAO,CAAC,MAAM,EAAEhB,KAAAA,CAAMiB,KAAK,CAACD,OAAAA,CAAQH,MAAM,CAAA,CAAA,CAAG;AAC/C,IAAA;IACA,OAAOb,KAAAA;AACT,CAAA;AAEA;AACA,MAAMkB,aAAAA,GAAgB,IAAInC,GAAAA,CAAI;AAAC,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA,IAAA;AAAM,IAAA,IAAA;AAAM,IAAA,IAAA;AAAM,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA;AAAI,CAAA,CAAA;AAEnF;;;;;;IAOA,MAAMoC,0BAA0B,CAACnB,KAAAA,GAAAA;AAC/B,IAAA,IAAIoB,MAAAA,GAAS,EAAA;AACb,IAAA,IAAIC,UAAAA,GAAa,CAAA;IACjB,IAAIC,SAAAA,GAAYtB,KAAAA,CAAMuB,OAAO,CAAC,KAAA,CAAA;IAE9B,MAAOD,SAAAA,KAAc,EAAC,CAAG;AACvB,QAAA,MAAME,iBAAiBF,SAAAA,GAAY,CAAA;AACnC,QAAA,IAAIG,aAAa,EAAC;AAClB,QAAA,IAAIC,SAAS,EAAC;AACd,QAAA,IAAIC,GAAAA,GAAMH,cAAAA;QAEV,MAAOG,GAAAA,GAAM3B,KAAAA,CAAMa,MAAM,IAAI,CAACK,aAAAA,CAAc7B,GAAG,CAACW,KAAK,CAAC2B,GAAAA,CAAI,CAAA,CAAG;AAC3D,YAAA,IAAI3B,KAAK,CAAC2B,GAAAA,CAAI,KAAK,GAAA,IAAOF,UAAAA,KAAe,EAAC,EAAG;gBAC3CA,UAAAA,GAAaE,GAAAA;AACf,YAAA,CAAA,MAAO,IAAI3B,KAAK,CAAC2B,GAAAA,CAAI,KAAK,GAAA,EAAK;gBAC7BD,MAAAA,GAASC,GAAAA;AACX,YAAA;YACAA,GAAAA,IAAO,CAAA;AACT,QAAA;;AAGA,QAAA,IAAIF,UAAAA,KAAe,EAAC,IAAKC,MAAAA,GAASD,UAAAA,EAAY;AAC5CL,YAAAA,MAAAA,IAAU,GAAGpB,KAAAA,CAAMiB,KAAK,CAACI,UAAAA,EAAYI,UAAAA,GAAa,KAAK7C,QAAAA,CAAAA,CAAU;YACjEyC,UAAAA,GAAaK,MAAAA;AACf,QAAA;QAEAJ,SAAAA,GAAYtB,KAAAA,CAAMuB,OAAO,CAAC,KAAA,EAAOI,GAAAA,CAAAA;AACnC,IAAA;AAEA,IAAA,OAAON,eAAe,CAAA,GAAIrB,KAAAA,GAAQoB,MAAAA,GAASpB,KAAAA,CAAMiB,KAAK,CAACI,UAAAA,CAAAA;AACzD,CAAA;AAEA,MAAMO,YAAAA,GAAe,CAACC,MAAAA,EAAiBC,IAAAA,GAAAA;IACrC,MAAMC,QAAAA,GAAWD,IAAAA,CAAKE,KAAK,CAAC,GAAA,CAAA;AAC5B,IAAA,IAAIC,IAAAA,GAAgBJ,MAAAA;IACpB,IAAK,IAAIK,IAAI,CAAA,EAAGA,CAAAA,GAAIH,SAASlB,MAAM,GAAG,CAAA,EAAGqB,CAAAA,IAAK,CAAA,CAAG;QAC/C,IAAI,CAACjC,cAAcgC,IAAAA,CAAAA,EAAO;AACxB,YAAA;AACF,QAAA;AACAA,QAAAA,IAAAA,GAAOA,IAAI,CAACF,QAAQ,CAACG,EAAE,CAAC;AAC1B,IAAA;AACA,IAAA,MAAMC,UAAUJ,QAAQ,CAACA,QAAAA,CAASlB,MAAM,GAAG,CAAA,CAAE;IAC7C,IAAIZ,aAAAA,CAAcgC,IAAAA,CAAAA,IAASE,OAAAA,IAAWF,IAAAA,EAAM;QAC1CA,IAAI,CAACE,QAAQ,GAAGvD,QAAAA;AAClB,IAAA;AACF,CAAA;AAEA,MAAMwD,IAAAA,GAAO,CAACpC,KAAAA,EAAgBe,OAAAA,EAAkBC,OAAAA,GAAAA;IAC9C,IAAI,OAAOhB,UAAU,QAAA,EAAU;;;;;;;QAO7B,MAAMqC,WAAAA,GAAcvB,UAAAA,CAAWd,KAAAA,EAAOe,OAAAA,EAASC,OAAAA,CAAAA;AAC/C,QAAA,IAAIqB,gBAAgBrC,KAAAA,EAAO;YACzB,OAAOqC,WAAAA;AACT,QAAA;QACA,OAAOtC,WAAAA,CAAYC,KAAAA,CAAAA,GAASpB,QAAAA,GAAWuC,uBAAAA,CAAwBnB,KAAAA,CAAAA;AACjE,IAAA;IACA,IAAIE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,EAAQ;AACxB,QAAA,OAAOA,MAAMsC,GAAG,CAAC,CAACC,IAAAA,GAASH,IAAAA,CAAKG,MAAMxB,OAAAA,EAASC,OAAAA,CAAAA,CAAAA;AACjD,IAAA;AACA,IAAA,IAAIf,cAAcD,KAAAA,CAAAA,EAAQ;AACxB,QAAA,MAAMwC,MAA+B,EAAC;QACtC,KAAK,MAAM,CAACrD,GAAAA,EAAKsD,GAAAA,CAAI,IAAIpC,MAAAA,CAAOqC,OAAO,CAAC1C,KAAAA,CAAAA,CAAQ;AAC9C,YAAA,IAAIb,QAAQ,WAAA,EAAa;AACvB,gBAAA,SAAA;AACF,YAAA;;;;;;YAMAqD,GAAG,CAACrD,IAAI,GAAGD,WAAAA,CAAYC,OAAOP,QAAAA,GAAWwD,IAAAA,CAAKK,KAAK1B,OAAAA,EAASC,OAAAA,CAAAA;AAC9D,QAAA;QACA,OAAOwB,GAAAA;AACT,IAAA;;;;AAIA,IAAA,IAAIxC,KAAAA,KAAU,IAAA,IAAQ,OAAOA,KAAAA,KAAU,QAAA,EAAU;QAC/C,OAAOpB,QAAAA;AACT,IAAA;IACA,OAAOoB,KAAAA;AACT,CAAA;MAEa2C,KAAAA,GAAQ,CAAC3C,KAAAA,EAAgB4C,OAAAA,GAAwB,EAAE,GAAA;AAC9D,IAAA,MAAMC,SAAST,IAAAA,CAAKpC,KAAAA,EAAO4C,QAAQ7B,OAAO,EAAE6B,QAAQ5B,OAAO,CAAA;AAC3D,IAAA,KAAK,MAAMc,IAAAA,IAAQc,OAAAA,CAAQE,UAAU,IAAI,EAAE,CAAE;AAC3ClB,QAAAA,YAAAA,CAAaiB,MAAAA,EAAQf,IAAAA,CAAAA;AACvB,IAAA;IACA,OAAOe,MAAAA;AACT;;;;;"}

package/dist/server/server/src/utils/debug-dump/redact.mjs

@@ -0,0 +1,194 @@
+const REDACTED = '[REDACTED]';
+// Layer 1a: key names (substring match) whose value must be masked wherever they appear.
+const SECRET_KEY_PATTERN = /(secret|password|passphrase|salt|token|api[_-]?key|access[_-]?key|license[_-]?key|private[_-]?key|encryption[_-]?key|credential|provider[_-]?options|connection[_-]?string|mnemonic|seed[_-]?phrase|authorization|bearer)/i;
+// Layer 1b: short, ambiguous key names matched EXACTLY (case-insensitive), so they
+// do not over-match as substrings (e.g. `pass` must not redact `compass`/`bypass`,
+// and this still catches a nested SMTP `auth.pass`).
+const SECRET_KEY_EXACT = new Set([
+    'pass',
+    'pwd',
+    'passwd',
+    'dsn'
+]);
+// camelCase password suffixes (capitalized), e.g. `smtpAuthPass`, `dbPwd` — the
+// capital letter distinguishes them from lowercase look-alikes (`compass`, `bypass`).
+const SECRET_KEY_SUFFIX = /[a-z](Pass|Pwd|Passwd)$/;
+// separator-delimited short secret names, e.g. `auth.pass`, `db_pwd`, `x-pass`.
+const SECRET_KEY_DELIMITED = /(^|[._-])(pass|pwd|passwd|dsn)([._-]|$)/i;
+const isSecretKey = (key)=>SECRET_KEY_PATTERN.test(key) || SECRET_KEY_EXACT.has(key.toLowerCase()) || SECRET_KEY_SUFFIX.test(key) || SECRET_KEY_DELIMITED.test(key);
+// Layer 3: string values that look like secrets regardless of their key.
+// Real JWTs are base64url-encoded and the header segment always begins with
+// `eyJ` (the base64url encoding of `{"`), so requiring that prefix avoids
+// matching arbitrary three-part dotted strings like semver versions
+// (e.g. "5.50.1", "18.3.1").
+const JWT_PATTERN = /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+const LONG_TOKEN_PATTERN = /^[A-Fa-f0-9]{32,}$|^[A-Za-z0-9+/]{40,}={0,2}$/;
+// Credentials embedded in a URL authority: `user:pass@` or `:pass@` (empty user,
+// as in `redis://:password@host`). The user part stops at the first colon, as in
+// RFC 3986, so the split between user and password is fixed; letting it take colons
+// made a long colon run with no `@` retry every split point, which is quadratic.
+const URL_WITH_CREDENTIALS = /^[a-z][a-z0-9+.-]*:\/\/[^/@\s:]*:[^/@\s]+@/i;
+// PEM private key blocks (certificates are public, so only PRIVATE KEY is masked).
+const PEM_PRIVATE_KEY_PATTERN = /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----/;
+// URLs whose secret is carried in the host/path rather than a `user:pass@` authority:
+// chat webhooks and error-tracking DSNs.
+const SECRET_URL_PATTERN = /^https:\/\/hooks\.slack\.com\/services\/|^https:\/\/(?:discord|discordapp)\.com\/api\/webhooks\/|:\/\/[^/@\s]+@[^/\s]*\bsentry\.io\b/i;
+// Well-known provider secret token formats, matched against the whole value. The
+// prefixes are specific enough to have negligible false-positive risk, so they
+// mask a value even under an innocuous key (e.g. `key: 'sk_live_...'`).
+// `pk_` (publishable) keys are intentionally excluded — they are public by design.
+const PROVIDER_SECRET_PATTERN = new RegExp([
+    '^(sk|rk)_(live|test)_[A-Za-z0-9]{8,}$',
+    '^whsec_[A-Za-z0-9]{16,}$',
+    '^(gh[posru]_|github_pat_)[A-Za-z0-9_]{20,}$',
+    '^xox[baprs]-[A-Za-z0-9-]{10,}$',
+    '^(AKIA|ASIA)[A-Z0-9]{16}$',
+    '^SG\\.[A-Za-z0-9_-]{16,}\\.[A-Za-z0-9_-]{16,}$',
+    '^AIza[A-Za-z0-9_-]{20,}$',
+    '^ya29\\.[A-Za-z0-9_-]{20,}$',
+    '^glpat-[A-Za-z0-9_-]{16,}$',
+    '^(shpat|shpss|shpca|shppa)_[A-Za-z0-9]{20,}$',
+    '^dop_v1_[a-f0-9]{40,}$',
+    '^re_[A-Za-z0-9_]{16,}$',
+    '^nfp_[A-Za-z0-9]{20,}$',
+    '^EAAA[A-Za-z0-9_-]{20,}$'
+].join('|'));
+const looksSecret = (value)=>JWT_PATTERN.test(value) || LONG_TOKEN_PATTERN.test(value) || URL_WITH_CREDENTIALS.test(value) || PROVIDER_SECRET_PATTERN.test(value) || PEM_PRIVATE_KEY_PATTERN.test(value) || SECRET_URL_PATTERN.test(value);
+const isPlainObject = (value)=>{
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+};
+// Accept either separator regardless of the host platform: `os.homedir()` and the app root come
+// back with backslashes on Windows, and a dump may also carry POSIX-style paths (e.g. from
+// config values), so a POSIX-only prefix check would ship absolute Windows paths verbatim.
+const isPathPrefix = (value, prefix)=>{
+    if (value === prefix) {
+        return true;
+    }
+    if (!value.startsWith(prefix)) {
+        return false;
+    }
+    const next = value.charAt(prefix.length);
+    return next === '/' || next === '\\';
+};
+const relativize = (value, appRoot, homeDir)=>{
+    if (appRoot && isPathPrefix(value, appRoot)) {
+        return `<app>${value.slice(appRoot.length)}`;
+    }
+    if (homeDir && isPathPrefix(value, homeDir)) {
+        return `<home>${value.slice(homeDir.length)}`;
+    }
+    return value;
+};
+// Characters that end a URL authority
+const AUTHORITY_END = new Set([
+    '/',
+    '?',
+    '#',
+    ' ',
+    '\t',
+    '\n',
+    '\r',
+    '"',
+    "'",
+    '`'
+]);
+/**
+ * Masks the password of every `scheme://user:password@host` inside a longer string, such as a
+ * package.json script that inlines a database URL. Whole-value credential URLs are already
+ * caught by URL_WITH_CREDENTIALS; this covers the ones in the middle of a value. It is a single
+ * forward scan rather than a regex, because an unanchored pattern backtracks quadratically on
+ * long runs (the reason URL_WITH_CREDENTIALS is anchored and colon-free in the user part).
+ */ const maskEmbeddedCredentials = (value)=>{
+    let result = '';
+    let copiedUpTo = 0;
+    let separator = value.indexOf('://');
+    while(separator !== -1){
+        const authorityStart = separator + 3;
+        let firstColon = -1;
+        let lastAt = -1;
+        let end = authorityStart;
+        while(end < value.length && !AUTHORITY_END.has(value[end])){
+            if (value[end] === ':' && firstColon === -1) {
+                firstColon = end;
+            } else if (value[end] === '@') {
+                lastAt = end;
+            }
+            end += 1;
+        }
+        // A colon before the last `@` separates user and password; one after it is a port.
+        if (firstColon !== -1 && lastAt > firstColon) {
+            result += `${value.slice(copiedUpTo, firstColon + 1)}${REDACTED}`;
+            copiedUpTo = lastAt;
+        }
+        separator = value.indexOf('://', end);
+    }
+    return copiedUpTo === 0 ? value : result + value.slice(copiedUpTo);
+};
+const deleteAtPath = (target, path)=>{
+    const segments = path.split('.');
+    let node = target;
+    for(let i = 0; i < segments.length - 1; i += 1){
+        if (!isPlainObject(node)) {
+            return;
+        }
+        node = node[segments[i]];
+    }
+    const lastKey = segments[segments.length - 1];
+    if (isPlainObject(node) && lastKey in node) {
+        node[lastKey] = REDACTED;
+    }
+};
+const walk = (value, appRoot, homeDir)=>{
+    if (typeof value === 'string') {
+        // Relativization is tried FIRST, and a value it rewrote is returned as-is. A string
+        // that starts with the app root or the home directory is a path, never a credential,
+        // whereas the reverse order let the secret heuristics claim one: a POSIX path made
+        // only of letters, digits and `/` is valid standard base64, so anything past 40
+        // characters matched LONG_TOKEN_PATTERN and shipped as `[REDACTED]` instead of
+        // `<app>/...`. Values that do not relativize still go through the full checks.
+        const relativized = relativize(value, appRoot, homeDir);
+        if (relativized !== value) {
+            return relativized;
+        }
+        return looksSecret(value) ? REDACTED : maskEmbeddedCredentials(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item)=>walk(item, appRoot, homeDir));
+    }
+    if (isPlainObject(value)) {
+        const out = {};
+        for (const [key, val] of Object.entries(value)){
+            if (key === '__proto__') {
+                continue; // never write through the Object.prototype setter
+            }
+            // A secret-named key always collapses wholesale, regardless of the value's
+            // type. Recursing into it (e.g. for `apiToken: { salt, ... }`) would leak
+            // any inner value whose own key/value doesn't independently match a
+            // masking pattern (e.g. `providerOptions.auth.pass`), so there is nothing
+            // safe to preserve underneath a secret-named container.
+            out[key] = isSecretKey(key) ? REDACTED : walk(val, appRoot, homeDir);
+        }
+        return out;
+    }
+    // Any other object type — Buffer, Date, Map, Set, class instances, etc. —
+    // is not a plain data container we can safely walk (Object.entries on a
+    // Buffer leaks its bytes, a Date serializes to `{}`), so redact defensively.
+    if (value !== null && typeof value === 'object') {
+        return REDACTED;
+    }
+    return value;
+};
+const scrub = (value, options = {})=>{
+    const cloned = walk(value, options.appRoot, options.homeDir);
+    for (const path of options.extraPaths ?? []){
+        deleteAtPath(cloned, path);
+    }
+    return cloned;
+};
+
+export { REDACTED, scrub };
+//# sourceMappingURL=redact.mjs.map

package/dist/server/server/src/utils/debug-dump/redact.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.mjs","sources":["../../../../../../server/src/utils/debug-dump/redact.ts"],"sourcesContent":["export const REDACTED = '[REDACTED]';\n\n// Layer 1a: key names (substring match) whose value must be masked wherever they appear.\nconst SECRET_KEY_PATTERN =\n  /(secret|password|passphrase|salt|token|api[_-]?key|access[_-]?key|license[_-]?key|private[_-]?key|encryption[_-]?key|credential|provider[_-]?options|connection[_-]?string|mnemonic|seed[_-]?phrase|authorization|bearer)/i;\n\n// Layer 1b: short, ambiguous key names matched EXACTLY (case-insensitive), so they\n// do not over-match as substrings (e.g. `pass` must not redact `compass`/`bypass`,\n// and this still catches a nested SMTP `auth.pass`).\nconst SECRET_KEY_EXACT = new Set(['pass', 'pwd', 'passwd', 'dsn']);\n// camelCase password suffixes (capitalized), e.g. `smtpAuthPass`, `dbPwd` — the\n// capital letter distinguishes them from lowercase look-alikes (`compass`, `bypass`).\nconst SECRET_KEY_SUFFIX = /[a-z](Pass|Pwd|Passwd)$/;\n// separator-delimited short secret names, e.g. `auth.pass`, `db_pwd`, `x-pass`.\nconst SECRET_KEY_DELIMITED = /(^|[._-])(pass|pwd|passwd|dsn)([._-]|$)/i;\n\nconst isSecretKey = (key: string): boolean =>\n  SECRET_KEY_PATTERN.test(key) ||\n  SECRET_KEY_EXACT.has(key.toLowerCase()) ||\n  SECRET_KEY_SUFFIX.test(key) ||\n  SECRET_KEY_DELIMITED.test(key);\n\n// Layer 3: string values that look like secrets regardless of their key.\n// Real JWTs are base64url-encoded and the header segment always begins with\n// `eyJ` (the base64url encoding of `{\"`), so requiring that prefix avoids\n// matching arbitrary three-part dotted strings like semver versions\n// (e.g. \"5.50.1\", \"18.3.1\").\nconst JWT_PATTERN = /^eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/;\nconst LONG_TOKEN_PATTERN = /^[A-Fa-f0-9]{32,}$|^[A-Za-z0-9+/]{40,}={0,2}$/;\n// Credentials embedded in a URL authority: `user:pass@` or `:pass@` (empty user,\n// as in `redis://:password@host`). The user part stops at the first colon, as in\n// RFC 3986, so the split between user and password is fixed; letting it take colons\n// made a long colon run with no `@` retry every split point, which is quadratic.\nconst URL_WITH_CREDENTIALS = /^[a-z][a-z0-9+.-]*:\\/\\/[^/@\\s:]*:[^/@\\s]+@/i;\n// PEM private key blocks (certificates are public, so only PRIVATE KEY is masked).\nconst PEM_PRIVATE_KEY_PATTERN = /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----/;\n// URLs whose secret is carried in the host/path rather than a `user:pass@` authority:\n// chat webhooks and error-tracking DSNs.\nconst SECRET_URL_PATTERN =\n  /^https:\\/\\/hooks\\.slack\\.com\\/services\\/|^https:\\/\\/(?:discord|discordapp)\\.com\\/api\\/webhooks\\/|:\\/\\/[^/@\\s]+@[^/\\s]*\\bsentry\\.io\\b/i;\n\n// Well-known provider secret token formats, matched against the whole value. The\n// prefixes are specific enough to have negligible false-positive risk, so they\n// mask a value even under an innocuous key (e.g. `key: 'sk_live_...'`).\n// `pk_` (publishable) keys are intentionally excluded — they are public by design.\nconst PROVIDER_SECRET_PATTERN = new RegExp(\n  [\n    '^(sk|rk)_(live|test)_[A-Za-z0-9]{8,}$', // Stripe secret / restricted\n    '^whsec_[A-Za-z0-9]{16,}$', // Stripe webhook signing secret\n    '^(gh[posru]_|github_pat_)[A-Za-z0-9_]{20,}$', // GitHub tokens / fine-grained PAT\n    '^xox[baprs]-[A-Za-z0-9-]{10,}$', // Slack tokens\n    '^(AKIA|ASIA)[A-Z0-9]{16}$', // AWS access key id\n    '^SG\\\\.[A-Za-z0-9_-]{16,}\\\\.[A-Za-z0-9_-]{16,}$', // SendGrid\n    '^AIza[A-Za-z0-9_-]{20,}$', // Google API key\n    '^ya29\\\\.[A-Za-z0-9_-]{20,}$', // Google OAuth access token\n    '^glpat-[A-Za-z0-9_-]{16,}$', // GitLab personal access token\n    '^(shpat|shpss|shpca|shppa)_[A-Za-z0-9]{20,}$', // Shopify\n    '^dop_v1_[a-f0-9]{40,}$', // DigitalOcean\n    '^re_[A-Za-z0-9_]{16,}$', // Resend\n    '^nfp_[A-Za-z0-9]{20,}$', // Netlify\n    '^EAAA[A-Za-z0-9_-]{20,}$', // Square\n  ].join('|')\n);\n\nconst looksSecret = (value: string): boolean =>\n  JWT_PATTERN.test(value) ||\n  LONG_TOKEN_PATTERN.test(value) ||\n  URL_WITH_CREDENTIALS.test(value) ||\n  PROVIDER_SECRET_PATTERN.test(value) ||\n  PEM_PRIVATE_KEY_PATTERN.test(value) ||\n  SECRET_URL_PATTERN.test(value);\n\nexport interface ScrubOptions {\n  appRoot?: string;\n  homeDir?: string;\n  extraPaths?: string[];\n}\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> => {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    return false;\n  }\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n};\n\n// Accept either separator regardless of the host platform: `os.homedir()` and the app root come\n// back with backslashes on Windows, and a dump may also carry POSIX-style paths (e.g. from\n// config values), so a POSIX-only prefix check would ship absolute Windows paths verbatim.\nconst isPathPrefix = (value: string, prefix: string): boolean => {\n  if (value === prefix) {\n    return true;\n  }\n  if (!value.startsWith(prefix)) {\n    return false;\n  }\n  const next = value.charAt(prefix.length);\n  return next === '/' || next === '\\\\';\n};\n\nconst relativize = (value: string, appRoot?: string, homeDir?: string): string => {\n  if (appRoot && isPathPrefix(value, appRoot)) {\n    return `<app>${value.slice(appRoot.length)}`;\n  }\n  if (homeDir && isPathPrefix(value, homeDir)) {\n    return `<home>${value.slice(homeDir.length)}`;\n  }\n  return value;\n};\n\n// Characters that end a URL authority\nconst AUTHORITY_END = new Set(['/', '?', '#', ' ', '\\t', '\\n', '\\r', '\"', \"'\", '`']);\n\n/**\n * Masks the password of every `scheme://user:password@host` inside a longer string, such as a\n * package.json script that inlines a database URL. Whole-value credential URLs are already\n * caught by URL_WITH_CREDENTIALS; this covers the ones in the middle of a value. It is a single\n * forward scan rather than a regex, because an unanchored pattern backtracks quadratically on\n * long runs (the reason URL_WITH_CREDENTIALS is anchored and colon-free in the user part).\n */\nconst maskEmbeddedCredentials = (value: string): string => {\n  let result = '';\n  let copiedUpTo = 0;\n  let separator = value.indexOf('://');\n\n  while (separator !== -1) {\n    const authorityStart = separator + 3;\n    let firstColon = -1;\n    let lastAt = -1;\n    let end = authorityStart;\n\n    while (end < value.length && !AUTHORITY_END.has(value[end])) {\n      if (value[end] === ':' && firstColon === -1) {\n        firstColon = end;\n      } else if (value[end] === '@') {\n        lastAt = end;\n      }\n      end += 1;\n    }\n\n    // A colon before the last `@` separates user and password; one after it is a port.\n    if (firstColon !== -1 && lastAt > firstColon) {\n      result += `${value.slice(copiedUpTo, firstColon + 1)}${REDACTED}`;\n      copiedUpTo = lastAt;\n    }\n\n    separator = value.indexOf('://', end);\n  }\n\n  return copiedUpTo === 0 ? value : result + value.slice(copiedUpTo);\n};\n\nconst deleteAtPath = (target: unknown, path: string): void => {\n  const segments = path.split('.');\n  let node: unknown = target;\n  for (let i = 0; i < segments.length - 1; i += 1) {\n    if (!isPlainObject(node)) {\n      return;\n    }\n    node = node[segments[i]];\n  }\n  const lastKey = segments[segments.length - 1];\n  if (isPlainObject(node) && lastKey in node) {\n    node[lastKey] = REDACTED;\n  }\n};\n\nconst walk = (value: unknown, appRoot?: string, homeDir?: string): unknown => {\n  if (typeof value === 'string') {\n    // Relativization is tried FIRST, and a value it rewrote is returned as-is. A string\n    // that starts with the app root or the home directory is a path, never a credential,\n    // whereas the reverse order let the secret heuristics claim one: a POSIX path made\n    // only of letters, digits and `/` is valid standard base64, so anything past 40\n    // characters matched LONG_TOKEN_PATTERN and shipped as `[REDACTED]` instead of\n    // `<app>/...`. Values that do not relativize still go through the full checks.\n    const relativized = relativize(value, appRoot, homeDir);\n    if (relativized !== value) {\n      return relativized;\n    }\n    return looksSecret(value) ? REDACTED : maskEmbeddedCredentials(value);\n  }\n  if (Array.isArray(value)) {\n    return value.map((item) => walk(item, appRoot, homeDir));\n  }\n  if (isPlainObject(value)) {\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(value)) {\n      if (key === '__proto__') {\n        continue; // never write through the Object.prototype setter\n      }\n      // A secret-named key always collapses wholesale, regardless of the value's\n      // type. Recursing into it (e.g. for `apiToken: { salt, ... }`) would leak\n      // any inner value whose own key/value doesn't independently match a\n      // masking pattern (e.g. `providerOptions.auth.pass`), so there is nothing\n      // safe to preserve underneath a secret-named container.\n      out[key] = isSecretKey(key) ? REDACTED : walk(val, appRoot, homeDir);\n    }\n    return out;\n  }\n  // Any other object type — Buffer, Date, Map, Set, class instances, etc. —\n  // is not a plain data container we can safely walk (Object.entries on a\n  // Buffer leaks its bytes, a Date serializes to `{}`), so redact defensively.\n  if (value !== null && typeof value === 'object') {\n    return REDACTED;\n  }\n  return value;\n};\n\nexport const scrub = (value: unknown, options: ScrubOptions = {}): unknown => {\n  const cloned = walk(value, options.appRoot, options.homeDir);\n  for (const path of options.extraPaths ?? []) {\n    deleteAtPath(cloned, path);\n  }\n  return cloned;\n};\n"],"names":["REDACTED","SECRET_KEY_PATTERN","SECRET_KEY_EXACT","Set","SECRET_KEY_SUFFIX","SECRET_KEY_DELIMITED","isSecretKey","key","test","has","toLowerCase","JWT_PATTERN","LONG_TOKEN_PATTERN","URL_WITH_CREDENTIALS","PEM_PRIVATE_KEY_PATTERN","SECRET_URL_PATTERN","PROVIDER_SECRET_PATTERN","RegExp","join","looksSecret","value","isPlainObject","Array","isArray","proto","Object","getPrototypeOf","prototype","isPathPrefix","prefix","startsWith","next","charAt","length","relativize","appRoot","homeDir","slice","AUTHORITY_END","maskEmbeddedCredentials","result","copiedUpTo","separator","indexOf","authorityStart","firstColon","lastAt","end","deleteAtPath","target","path","segments","split","node","i","lastKey","walk","relativized","map","item","out","val","entries","scrub","options","cloned","extraPaths"],"mappings":"AAAO,MAAMA,WAAW;AAExB;AACA,MAAMC,kBAAAA,GACJ,4NAAA;AAEF;AACA;AACA;AACA,MAAMC,gBAAAA,GAAmB,IAAIC,GAAAA,CAAI;AAAC,IAAA,MAAA;AAAQ,IAAA,KAAA;AAAO,IAAA,QAAA;AAAU,IAAA;AAAM,CAAA,CAAA;AACjE;AACA;AACA,MAAMC,iBAAAA,GAAoB,yBAAA;AAC1B;AACA,MAAMC,oBAAAA,GAAuB,0CAAA;AAE7B,MAAMC,cAAc,CAACC,GAAAA,GACnBN,mBAAmBO,IAAI,CAACD,QACxBL,gBAAAA,CAAiBO,GAAG,CAACF,GAAAA,CAAIG,WAAW,OACpCN,iBAAAA,CAAkBI,IAAI,CAACD,GAAAA,CAAAA,IACvBF,oBAAAA,CAAqBG,IAAI,CAACD,GAAAA,CAAAA;AAE5B;AACA;AACA;AACA;AACA;AACA,MAAMI,WAAAA,GAAc,qDAAA;AACpB,MAAMC,kBAAAA,GAAqB,+CAAA;AAC3B;AACA;AACA;AACA;AACA,MAAMC,oBAAAA,GAAuB,6CAAA;AAC7B;AACA,MAAMC,uBAAAA,GAA0B,4CAAA;AAChC;AACA;AACA,MAAMC,kBAAAA,GACJ,uIAAA;AAEF;AACA;AACA;AACA;AACA,MAAMC,uBAAAA,GAA0B,IAAIC,MAAAA,CAClC;AACE,IAAA,uCAAA;AACA,IAAA,0BAAA;AACA,IAAA,6CAAA;AACA,IAAA,gCAAA;AACA,IAAA,2BAAA;AACA,IAAA,gDAAA;AACA,IAAA,0BAAA;AACA,IAAA,6BAAA;AACA,IAAA,4BAAA;AACA,IAAA,8CAAA;AACA,IAAA,wBAAA;AACA,IAAA,wBAAA;AACA,IAAA,wBAAA;AACA,IAAA;AACD,CAAA,CAACC,IAAI,CAAC,GAAA,CAAA,CAAA;AAGT,MAAMC,WAAAA,GAAc,CAACC,KAAAA,GACnBT,WAAAA,CAAYH,IAAI,CAACY,KAAAA,CAAAA,IACjBR,kBAAAA,CAAmBJ,IAAI,CAACY,KAAAA,CAAAA,IACxBP,oBAAAA,CAAqBL,IAAI,CAACY,KAAAA,CAAAA,IAC1BJ,uBAAAA,CAAwBR,IAAI,CAACY,KAAAA,CAAAA,IAC7BN,uBAAAA,CAAwBN,IAAI,CAACY,KAAAA,CAAAA,IAC7BL,kBAAAA,CAAmBP,IAAI,CAACY,KAAAA,CAAAA;AAQ1B,MAAMC,gBAAgB,CAACD,KAAAA,GAAAA;IACrB,IAAIA,KAAAA,KAAU,QAAQ,OAAOA,KAAAA,KAAU,YAAYE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,EAAQ;QACvE,OAAO,KAAA;AACT,IAAA;IACA,MAAMI,KAAAA,GAAQC,MAAAA,CAAOC,cAAc,CAACN,KAAAA,CAAAA;AACpC,IAAA,OAAOI,KAAAA,KAAUC,MAAAA,CAAOE,SAAS,IAAIH,KAAAA,KAAU,IAAA;AACjD,CAAA;AAEA;AACA;AACA;AACA,MAAMI,YAAAA,GAAe,CAACR,KAAAA,EAAeS,MAAAA,GAAAA;AACnC,IAAA,IAAIT,UAAUS,MAAAA,EAAQ;QACpB,OAAO,IAAA;AACT,IAAA;AACA,IAAA,IAAI,CAACT,KAAAA,CAAMU,UAAU,CAACD,MAAAA,CAAAA,EAAS;QAC7B,OAAO,KAAA;AACT,IAAA;AACA,IAAA,MAAME,IAAAA,GAAOX,KAAAA,CAAMY,MAAM,CAACH,OAAOI,MAAM,CAAA;IACvC,OAAOF,IAAAA,KAAS,OAAOA,IAAAA,KAAS,IAAA;AAClC,CAAA;AAEA,MAAMG,UAAAA,GAAa,CAACd,KAAAA,EAAee,OAAAA,EAAkBC,OAAAA,GAAAA;IACnD,IAAID,OAAAA,IAAWP,YAAAA,CAAaR,KAAAA,EAAOe,OAAAA,CAAAA,EAAU;QAC3C,OAAO,CAAC,KAAK,EAAEf,KAAAA,CAAMiB,KAAK,CAACF,OAAAA,CAAQF,MAAM,CAAA,CAAA,CAAG;AAC9C,IAAA;IACA,IAAIG,OAAAA,IAAWR,YAAAA,CAAaR,KAAAA,EAAOgB,OAAAA,CAAAA,EAAU;QAC3C,OAAO,CAAC,MAAM,EAAEhB,KAAAA,CAAMiB,KAAK,CAACD,OAAAA,CAAQH,MAAM,CAAA,CAAA,CAAG;AAC/C,IAAA;IACA,OAAOb,KAAAA;AACT,CAAA;AAEA;AACA,MAAMkB,aAAAA,GAAgB,IAAInC,GAAAA,CAAI;AAAC,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA,IAAA;AAAM,IAAA,IAAA;AAAM,IAAA,IAAA;AAAM,IAAA,GAAA;AAAK,IAAA,GAAA;AAAK,IAAA;AAAI,CAAA,CAAA;AAEnF;;;;;;IAOA,MAAMoC,0BAA0B,CAACnB,KAAAA,GAAAA;AAC/B,IAAA,IAAIoB,MAAAA,GAAS,EAAA;AACb,IAAA,IAAIC,UAAAA,GAAa,CAAA;IACjB,IAAIC,SAAAA,GAAYtB,KAAAA,CAAMuB,OAAO,CAAC,KAAA,CAAA;IAE9B,MAAOD,SAAAA,KAAc,EAAC,CAAG;AACvB,QAAA,MAAME,iBAAiBF,SAAAA,GAAY,CAAA;AACnC,QAAA,IAAIG,aAAa,EAAC;AAClB,QAAA,IAAIC,SAAS,EAAC;AACd,QAAA,IAAIC,GAAAA,GAAMH,cAAAA;QAEV,MAAOG,GAAAA,GAAM3B,KAAAA,CAAMa,MAAM,IAAI,CAACK,aAAAA,CAAc7B,GAAG,CAACW,KAAK,CAAC2B,GAAAA,CAAI,CAAA,CAAG;AAC3D,YAAA,IAAI3B,KAAK,CAAC2B,GAAAA,CAAI,KAAK,GAAA,IAAOF,UAAAA,KAAe,EAAC,EAAG;gBAC3CA,UAAAA,GAAaE,GAAAA;AACf,YAAA,CAAA,MAAO,IAAI3B,KAAK,CAAC2B,GAAAA,CAAI,KAAK,GAAA,EAAK;gBAC7BD,MAAAA,GAASC,GAAAA;AACX,YAAA;YACAA,GAAAA,IAAO,CAAA;AACT,QAAA;;AAGA,QAAA,IAAIF,UAAAA,KAAe,EAAC,IAAKC,MAAAA,GAASD,UAAAA,EAAY;AAC5CL,YAAAA,MAAAA,IAAU,GAAGpB,KAAAA,CAAMiB,KAAK,CAACI,UAAAA,EAAYI,UAAAA,GAAa,KAAK7C,QAAAA,CAAAA,CAAU;YACjEyC,UAAAA,GAAaK,MAAAA;AACf,QAAA;QAEAJ,SAAAA,GAAYtB,KAAAA,CAAMuB,OAAO,CAAC,KAAA,EAAOI,GAAAA,CAAAA;AACnC,IAAA;AAEA,IAAA,OAAON,eAAe,CAAA,GAAIrB,KAAAA,GAAQoB,MAAAA,GAASpB,KAAAA,CAAMiB,KAAK,CAACI,UAAAA,CAAAA;AACzD,CAAA;AAEA,MAAMO,YAAAA,GAAe,CAACC,MAAAA,EAAiBC,IAAAA,GAAAA;IACrC,MAAMC,QAAAA,GAAWD,IAAAA,CAAKE,KAAK,CAAC,GAAA,CAAA;AAC5B,IAAA,IAAIC,IAAAA,GAAgBJ,MAAAA;IACpB,IAAK,IAAIK,IAAI,CAAA,EAAGA,CAAAA,GAAIH,SAASlB,MAAM,GAAG,CAAA,EAAGqB,CAAAA,IAAK,CAAA,CAAG;QAC/C,IAAI,CAACjC,cAAcgC,IAAAA,CAAAA,EAAO;AACxB,YAAA;AACF,QAAA;AACAA,QAAAA,IAAAA,GAAOA,IAAI,CAACF,QAAQ,CAACG,EAAE,CAAC;AAC1B,IAAA;AACA,IAAA,MAAMC,UAAUJ,QAAQ,CAACA,QAAAA,CAASlB,MAAM,GAAG,CAAA,CAAE;IAC7C,IAAIZ,aAAAA,CAAcgC,IAAAA,CAAAA,IAASE,OAAAA,IAAWF,IAAAA,EAAM;QAC1CA,IAAI,CAACE,QAAQ,GAAGvD,QAAAA;AAClB,IAAA;AACF,CAAA;AAEA,MAAMwD,IAAAA,GAAO,CAACpC,KAAAA,EAAgBe,OAAAA,EAAkBC,OAAAA,GAAAA;IAC9C,IAAI,OAAOhB,UAAU,QAAA,EAAU;;;;;;;QAO7B,MAAMqC,WAAAA,GAAcvB,UAAAA,CAAWd,KAAAA,EAAOe,OAAAA,EAASC,OAAAA,CAAAA;AAC/C,QAAA,IAAIqB,gBAAgBrC,KAAAA,EAAO;YACzB,OAAOqC,WAAAA;AACT,QAAA;QACA,OAAOtC,WAAAA,CAAYC,KAAAA,CAAAA,GAASpB,QAAAA,GAAWuC,uBAAAA,CAAwBnB,KAAAA,CAAAA;AACjE,IAAA;IACA,IAAIE,KAAAA,CAAMC,OAAO,CAACH,KAAAA,CAAAA,EAAQ;AACxB,QAAA,OAAOA,MAAMsC,GAAG,CAAC,CAACC,IAAAA,GAASH,IAAAA,CAAKG,MAAMxB,OAAAA,EAASC,OAAAA,CAAAA,CAAAA;AACjD,IAAA;AACA,IAAA,IAAIf,cAAcD,KAAAA,CAAAA,EAAQ;AACxB,QAAA,MAAMwC,MAA+B,EAAC;QACtC,KAAK,MAAM,CAACrD,GAAAA,EAAKsD,GAAAA,CAAI,IAAIpC,MAAAA,CAAOqC,OAAO,CAAC1C,KAAAA,CAAAA,CAAQ;AAC9C,YAAA,IAAIb,QAAQ,WAAA,EAAa;AACvB,gBAAA,SAAA;AACF,YAAA;;;;;;YAMAqD,GAAG,CAACrD,IAAI,GAAGD,WAAAA,CAAYC,OAAOP,QAAAA,GAAWwD,IAAAA,CAAKK,KAAK1B,OAAAA,EAASC,OAAAA,CAAAA;AAC9D,QAAA;QACA,OAAOwB,GAAAA;AACT,IAAA;;;;AAIA,IAAA,IAAIxC,KAAAA,KAAU,IAAA,IAAQ,OAAOA,KAAAA,KAAU,QAAA,EAAU;QAC/C,OAAOpB,QAAAA;AACT,IAAA;IACA,OAAOoB,KAAAA;AACT,CAAA;MAEa2C,KAAAA,GAAQ,CAAC3C,KAAAA,EAAgB4C,OAAAA,GAAwB,EAAE,GAAA;AAC9D,IAAA,MAAMC,SAAST,IAAAA,CAAKpC,KAAAA,EAAO4C,QAAQ7B,OAAO,EAAE6B,QAAQ5B,OAAO,CAAA;AAC3D,IAAA,KAAK,MAAMc,IAAAA,IAAQc,OAAAA,CAAQE,UAAU,IAAI,EAAE,CAAE;AAC3ClB,QAAAA,YAAAA,CAAaiB,MAAAA,EAAQf,IAAAA,CAAAA;AACvB,IAAA;IACA,OAAOe,MAAAA;AACT;;;;"}

package/dist/server/shared/utils/get-project-type.js

@@ -0,0 +1,49 @@
+'use strict';
+
+/**
+ * Resolves the plan label from the license information returned by the
+ * `/admin/project-type` endpoint (browser) or `strapi.ee` (server).
+ *
+ * This labels the edition that is running: it follows `isEE`, so a lapsed license reads
+ * Community. Browser tracking and NPS report this label and the startup table applies the same
+ * rule; server metrics also label the running edition, but never say Growth. For the plan a
+ * license was issued for, lapsed or not (the Plan card, the Support card and the debug dump),
+ * use `getLicensedPlan` below.
+ *
+ * The label is intentionally limited to three values:
+ * - `Community`  when there is no license (Community Edition).
+ * - `Growth`     when the licensed plan price id contains "growth".
+ * - `Enterprise` for any other licensed plan.
+ */ const getProjectType = ({ isEE, planPriceId })=>{
+    if (!isEE) {
+        return 'Community';
+    }
+    if (planPriceId?.toLowerCase().includes('growth')) {
+        return 'Growth';
+    }
+    return 'Enterprise';
+};
+// The statuses a license can be in once it has been read. `none` (never licensed) is left out
+// on purpose, and so is a missing status, which a mixed-version install can produce.
+const LICENSED_STATUSES = [
+    'active',
+    'expired',
+    'unknown'
+];
+/**
+ * Resolves the plan a license was issued for, including one that has lapsed or can no longer
+ * be read, so Support links, the Plan card and the debug dump can still name it. It unlocks
+ * nothing: feature gating stays on `isEE`.
+ *
+ * A plan is only reported when a type was verified at some point (live, or retained once the
+ * license lapsed) AND the status is licensed. A corrupt license file sets `unknown` before any
+ * type is stored, and with no price id `getProjectType` would fall through to Enterprise, so
+ * both conditions are required. Every caller that derives a plan should go through here.
+ */ const getLicensedPlan = ({ licenseStatus, type, planPriceId })=>getProjectType({
+        isEE: Boolean(type) && LICENSED_STATUSES.includes(licenseStatus ?? ''),
+        planPriceId: planPriceId ?? undefined
+    });
+
+exports.getLicensedPlan = getLicensedPlan;
+exports.getProjectType = getProjectType;
+//# sourceMappingURL=get-project-type.js.map

package/dist/server/shared/utils/get-project-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-project-type.js","sources":["../../../../shared/utils/get-project-type.ts"],"sourcesContent":["type ProjectType = 'Community' | 'Growth' | 'Enterprise';\n\n/**\n * Resolves the plan label from the license information returned by the\n * `/admin/project-type` endpoint (browser) or `strapi.ee` (server).\n *\n * This labels the edition that is running: it follows `isEE`, so a lapsed license reads\n * Community. Browser tracking and NPS report this label and the startup table applies the same\n * rule; server metrics also label the running edition, but never say Growth. For the plan a\n * license was issued for, lapsed or not (the Plan card, the Support card and the debug dump),\n * use `getLicensedPlan` below.\n *\n * The label is intentionally limited to three values:\n * - `Community`  when there is no license (Community Edition).\n * - `Growth`     when the licensed plan price id contains \"growth\".\n * - `Enterprise` for any other licensed plan.\n */\nconst getProjectType = ({\n  isEE,\n  planPriceId,\n}: {\n  isEE: boolean;\n  planPriceId?: string;\n}): ProjectType => {\n  if (!isEE) {\n    return 'Community';\n  }\n\n  if (planPriceId?.toLowerCase().includes('growth')) {\n    return 'Growth';\n  }\n\n  return 'Enterprise';\n};\n\n// The statuses a license can be in once it has been read. `none` (never licensed) is left out\n// on purpose, and so is a missing status, which a mixed-version install can produce.\nconst LICENSED_STATUSES: readonly string[] = ['active', 'expired', 'unknown'];\n\n/**\n * Resolves the plan a license was issued for, including one that has lapsed or can no longer\n * be read, so Support links, the Plan card and the debug dump can still name it. It unlocks\n * nothing: feature gating stays on `isEE`.\n *\n * A plan is only reported when a type was verified at some point (live, or retained once the\n * license lapsed) AND the status is licensed. A corrupt license file sets `unknown` before any\n * type is stored, and with no price id `getProjectType` would fall through to Enterprise, so\n * both conditions are required. Every caller that derives a plan should go through here.\n */\nconst getLicensedPlan = ({\n  licenseStatus,\n  type,\n  planPriceId,\n}: {\n  licenseStatus: string | null | undefined;\n  type: string | null | undefined;\n  planPriceId?: string | null;\n}): ProjectType =>\n  getProjectType({\n    isEE: Boolean(type) && LICENSED_STATUSES.includes(licenseStatus ?? ''),\n    planPriceId: planPriceId ?? undefined,\n  });\n\nexport { getLicensedPlan, getProjectType };\nexport type { ProjectType };\n"],"names":["getProjectType","isEE","planPriceId","toLowerCase","includes","LICENSED_STATUSES","getLicensedPlan","licenseStatus","type","Boolean","undefined"],"mappings":";;AAEA;;;;;;;;;;;;;;AAcC,UACKA,cAAAA,GAAiB,CAAC,EACtBC,IAAI,EACJC,WAAW,EAIZ,GAAA;AACC,IAAA,IAAI,CAACD,IAAAA,EAAM;QACT,OAAO,WAAA;AACT,IAAA;IAEA,IAAIC,WAAAA,EAAaC,WAAAA,EAAAA,CAAcC,QAAAA,CAAS,QAAA,CAAA,EAAW;QACjD,OAAO,QAAA;AACT,IAAA;IAEA,OAAO,YAAA;AACT;AAEA;AACA;AACA,MAAMC,iBAAAA,GAAuC;AAAC,IAAA,QAAA;AAAU,IAAA,SAAA;AAAW,IAAA;AAAU,CAAA;AAE7E;;;;;;;;;IAUA,MAAMC,eAAAA,GAAkB,CAAC,EACvBC,aAAa,EACbC,IAAI,EACJN,WAAW,EAKZ,GACCF,cAAAA,CAAe;AACbC,QAAAA,IAAAA,EAAMQ,OAAAA,CAAQD,IAAAA,CAAAA,IAASH,iBAAAA,CAAkBD,QAAQ,CAACG,aAAAA,IAAiB,EAAA,CAAA;AACnEL,QAAAA,WAAAA,EAAaA,WAAAA,IAAeQ;AAC9B,KAAA;;;;;"}

package/dist/server/shared/utils/get-project-type.mjs

@@ -0,0 +1,46 @@
+/**
+ * Resolves the plan label from the license information returned by the
+ * `/admin/project-type` endpoint (browser) or `strapi.ee` (server).
+ *
+ * This labels the edition that is running: it follows `isEE`, so a lapsed license reads
+ * Community. Browser tracking and NPS report this label and the startup table applies the same
+ * rule; server metrics also label the running edition, but never say Growth. For the plan a
+ * license was issued for, lapsed or not (the Plan card, the Support card and the debug dump),
+ * use `getLicensedPlan` below.
+ *
+ * The label is intentionally limited to three values:
+ * - `Community`  when there is no license (Community Edition).
+ * - `Growth`     when the licensed plan price id contains "growth".
+ * - `Enterprise` for any other licensed plan.
+ */ const getProjectType = ({ isEE, planPriceId })=>{
+    if (!isEE) {
+        return 'Community';
+    }
+    if (planPriceId?.toLowerCase().includes('growth')) {
+        return 'Growth';
+    }
+    return 'Enterprise';
+};
+// The statuses a license can be in once it has been read. `none` (never licensed) is left out
+// on purpose, and so is a missing status, which a mixed-version install can produce.
+const LICENSED_STATUSES = [
+    'active',
+    'expired',
+    'unknown'
+];
+/**
+ * Resolves the plan a license was issued for, including one that has lapsed or can no longer
+ * be read, so Support links, the Plan card and the debug dump can still name it. It unlocks
+ * nothing: feature gating stays on `isEE`.
+ *
+ * A plan is only reported when a type was verified at some point (live, or retained once the
+ * license lapsed) AND the status is licensed. A corrupt license file sets `unknown` before any
+ * type is stored, and with no price id `getProjectType` would fall through to Enterprise, so
+ * both conditions are required. Every caller that derives a plan should go through here.
+ */ const getLicensedPlan = ({ licenseStatus, type, planPriceId })=>getProjectType({
+        isEE: Boolean(type) && LICENSED_STATUSES.includes(licenseStatus ?? ''),
+        planPriceId: planPriceId ?? undefined
+    });
+
+export { getLicensedPlan, getProjectType };
+//# sourceMappingURL=get-project-type.mjs.map

package/dist/server/shared/utils/get-project-type.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-project-type.mjs","sources":["../../../../shared/utils/get-project-type.ts"],"sourcesContent":["type ProjectType = 'Community' | 'Growth' | 'Enterprise';\n\n/**\n * Resolves the plan label from the license information returned by the\n * `/admin/project-type` endpoint (browser) or `strapi.ee` (server).\n *\n * This labels the edition that is running: it follows `isEE`, so a lapsed license reads\n * Community. Browser tracking and NPS report this label and the startup table applies the same\n * rule; server metrics also label the running edition, but never say Growth. For the plan a\n * license was issued for, lapsed or not (the Plan card, the Support card and the debug dump),\n * use `getLicensedPlan` below.\n *\n * The label is intentionally limited to three values:\n * - `Community`  when there is no license (Community Edition).\n * - `Growth`     when the licensed plan price id contains \"growth\".\n * - `Enterprise` for any other licensed plan.\n */\nconst getProjectType = ({\n  isEE,\n  planPriceId,\n}: {\n  isEE: boolean;\n  planPriceId?: string;\n}): ProjectType => {\n  if (!isEE) {\n    return 'Community';\n  }\n\n  if (planPriceId?.toLowerCase().includes('growth')) {\n    return 'Growth';\n  }\n\n  return 'Enterprise';\n};\n\n// The statuses a license can be in once it has been read. `none` (never licensed) is left out\n// on purpose, and so is a missing status, which a mixed-version install can produce.\nconst LICENSED_STATUSES: readonly string[] = ['active', 'expired', 'unknown'];\n\n/**\n * Resolves the plan a license was issued for, including one that has lapsed or can no longer\n * be read, so Support links, the Plan card and the debug dump can still name it. It unlocks\n * nothing: feature gating stays on `isEE`.\n *\n * A plan is only reported when a type was verified at some point (live, or retained once the\n * license lapsed) AND the status is licensed. A corrupt license file sets `unknown` before any\n * type is stored, and with no price id `getProjectType` would fall through to Enterprise, so\n * both conditions are required. Every caller that derives a plan should go through here.\n */\nconst getLicensedPlan = ({\n  licenseStatus,\n  type,\n  planPriceId,\n}: {\n  licenseStatus: string | null | undefined;\n  type: string | null | undefined;\n  planPriceId?: string | null;\n}): ProjectType =>\n  getProjectType({\n    isEE: Boolean(type) && LICENSED_STATUSES.includes(licenseStatus ?? ''),\n    planPriceId: planPriceId ?? undefined,\n  });\n\nexport { getLicensedPlan, getProjectType };\nexport type { ProjectType };\n"],"names":["getProjectType","isEE","planPriceId","toLowerCase","includes","LICENSED_STATUSES","getLicensedPlan","licenseStatus","type","Boolean","undefined"],"mappings":"AAEA;;;;;;;;;;;;;;AAcC,UACKA,cAAAA,GAAiB,CAAC,EACtBC,IAAI,EACJC,WAAW,EAIZ,GAAA;AACC,IAAA,IAAI,CAACD,IAAAA,EAAM;QACT,OAAO,WAAA;AACT,IAAA;IAEA,IAAIC,WAAAA,EAAaC,WAAAA,EAAAA,CAAcC,QAAAA,CAAS,QAAA,CAAA,EAAW;QACjD,OAAO,QAAA;AACT,IAAA;IAEA,OAAO,YAAA;AACT;AAEA;AACA;AACA,MAAMC,iBAAAA,GAAuC;AAAC,IAAA,QAAA;AAAU,IAAA,SAAA;AAAW,IAAA;AAAU,CAAA;AAE7E;;;;;;;;;IAUA,MAAMC,eAAAA,GAAkB,CAAC,EACvBC,aAAa,EACbC,IAAI,EACJN,WAAW,EAKZ,GACCF,cAAAA,CAAe;AACbC,QAAAA,IAAAA,EAAMQ,OAAAA,CAAQD,IAAAA,CAAAA,IAASH,iBAAAA,CAAkBD,QAAQ,CAACG,aAAAA,IAAiB,EAAA,CAAA;AACnEL,QAAAA,WAAAA,EAAaA,WAAAA,IAAeQ;AAC9B,KAAA;;;;"}