@lowdefy/node-utils 0.0.0-experimental-20260914131506 → 0.0.0-experimental-20260925210809

package/dist/createSecretScrubber.js

@@ -0,0 +1,106 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+const REDACTED = '[REDACTED]';
+// Shorter values, like `true` or a port number, would shred unrelated text.
+const MIN_SECRET_LENGTH = 8;
+function collectStringLeaves(value, leaves) {
+    if (type.isString(value)) {
+        leaves.push(value);
+        return leaves;
+    }
+    if (type.isArray(value)) {
+        value.forEach((item)=>collectStringLeaves(item, leaves));
+        return leaves;
+    }
+    if (type.isObject(value)) {
+        Object.values(value).forEach((item)=>collectStringLeaves(item, leaves));
+    }
+    return leaves;
+}
+// Authors JSON-encode structured secrets and pick a leaf with `_json.parse`, so the leaf, not
+// the whole encoded string, is what ends up in an error message.
+function parseJsonLeaves(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    } catch  {
+        return [];
+    }
+    if (!type.isObject(parsed) && !type.isArray(parsed)) {
+        return [];
+    }
+    return collectStringLeaves(parsed, []);
+}
+// A secret embedded in a larger base64 payload (a Basic auth header built from
+// `user:password`) only matches the secret's own base64 when both start on the same 3-byte
+// boundary. Encoding at each offset and keeping only the characters whose 6 bits fall wholly
+// inside the secret's bytes gives a fragment that matches whatever surrounds it.
+function base64Fragments(value) {
+    const bytes = Buffer.from(value, 'utf8');
+    const fragments = [];
+    [
+        0,
+        1,
+        2
+    ].forEach((offset)=>{
+        const padded = Buffer.concat([
+            Buffer.alloc(offset),
+            bytes
+        ]);
+        const start = Math.ceil(8 * offset / 6);
+        const end = Math.floor(8 * (offset + bytes.length) / 6);
+        [
+            'base64',
+            'base64url'
+        ].forEach((encoding)=>{
+            fragments.push(padded.toString(encoding).replace(/=+$/, '').slice(start, end));
+        });
+    });
+    return fragments;
+}
+function secretForms(value) {
+    return [
+        value,
+        encodeURIComponent(value),
+        JSON.stringify(value).slice(1, -1),
+        ...base64Fragments(value)
+    ];
+}
+function createSecretScrubber({ secrets, env = process.env }) {
+    const values = collectStringLeaves(secrets, []);
+    if (!type.isNone(env.CRON_SECRET)) values.push(env.CRON_SECRET);
+    if (!type.isNone(env.BETTER_AUTH_SECRET)) values.push(env.BETTER_AUTH_SECRET);
+    const expanded = values.flatMap((value)=>[
+            value,
+            ...parseJsonLeaves(value)
+        ]);
+    const secretValues = new Set(expanded.filter((value)=>value.length >= MIN_SECRET_LENGTH));
+    const forms = new Set();
+    secretValues.forEach((value)=>{
+        secretForms(value).forEach((form)=>{
+            if (form.length > 0) forms.add(form);
+        });
+    });
+    // Longest first, so a form is replaced whole before a shorter form it contains can break it up.
+    const sortedForms = [
+        ...forms
+    ].sort((a, b)=>b.length - a.length);
+    return function scrub(value) {
+        if (!type.isString(value)) return value;
+        return sortedForms.reduce((text, form)=>text.split(form).join(REDACTED), value);
+    };
+}
+export default createSecretScrubber;

package/dist/getDevInstancePath.js

@@ -0,0 +1,22 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import path from 'path';
+// Keyed on the config directory, not the dev server directory, so one app has
+// one record however it was launched (CLI, --dev-directory, the monorepo dev
+// script) and every reader - CLI, MCP shim, hub - finds it the same way.
+function getDevInstancePath({ configDirectory }) {
+    return path.join(configDirectory, '.lowdefy', 'instance.json');
+}
+export default getDevInstancePath;

package/dist/index.js

@@ -14,13 +14,17 @@
   limitations under the License.
 */ import cleanDirectory from './cleanDirectory.js';
 import copyFileOrDirectory from './copyFileOrDirectory.js';
+import createSecretScrubber from './createSecretScrubber.js';
 import findAvailablePort from './findAvailablePort.js';
+import getDevInstancePath from './getDevInstancePath.js';
 import getFileExtension, { getFileSubExtension } from './getFileExtension.js';
 import getSecretsFromEnv from './getSecretsFromEnv.js';
 import installIfPackageJsonChanged from './installIfPackageJsonChanged.js';
+import isPidAlive from './isPidAlive.js';
 import isPortAvailable from './isPortAvailable.js';
+import readDevInstance from './readDevInstance.js';
 import spawnProcess from './spawnProcess.js';
 import readFile from './readFile.js';
 import writeFile from './writeFile.js';
 import writeFileIfChanged from './writeFileIfChanged.js';
-export { cleanDirectory, copyFileOrDirectory, findAvailablePort, getFileExtension, getFileSubExtension, getSecretsFromEnv, installIfPackageJsonChanged, isPortAvailable, spawnProcess, readFile, writeFile, writeFileIfChanged };
+export { cleanDirectory, copyFileOrDirectory, createSecretScrubber, findAvailablePort, getDevInstancePath, getFileExtension, getFileSubExtension, getSecretsFromEnv, installIfPackageJsonChanged, isPidAlive, isPortAvailable, readDevInstance, spawnProcess, readFile, writeFile, writeFileIfChanged };

package/dist/isPidAlive.js

@@ -0,0 +1,24 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    } catch (error) {
+        // EPERM means the process exists but belongs to another user.
+        return error.code === 'EPERM';
+    }
+}
+export default isPidAlive;

package/dist/readDevInstance.js

@@ -0,0 +1,48 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import fs from 'fs';
+import getDevInstancePath from './getDevInstancePath.js';
+import isPidAlive from './isPidAlive.js';
+function readRecord(instancePath) {
+    try {
+        return JSON.parse(fs.readFileSync(instancePath, 'utf8'));
+    } catch  {
+        // No record, or one mid-write - either way no live instance to report.
+        return null;
+    }
+}
+// A record is live only when it was written for this exact directory and its
+// process still runs. The directory check matters because .lowdefy/ gets
+// copied between git worktrees - a copied record names the source checkout
+// and must not make this checkout look occupied.
+function readDevInstance({ configDirectory }) {
+    const record = readRecord(getDevInstancePath({
+        configDirectory
+    }));
+    if (record === null) {
+        return null;
+    }
+    let realConfigDirectory;
+    try {
+        realConfigDirectory = fs.realpathSync(configDirectory);
+    } catch  {
+        return null;
+    }
+    if (record.configDirectory !== realConfigDirectory || !isPidAlive(record.pid)) {
+        return null;
+    }
+    return record;
+}
+export default readDevInstance;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/node-utils",
-  "version": "0.0.0-experimental-20260914131506",
+  "version": "0.0.0-experimental-20260925210809",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -34,8 +34,8 @@
     "dist/*"
   ],
   "dependencies": {
-    "@lowdefy/errors": "0.0.0-experimental-20260914131506",
-    "@lowdefy/helpers": "0.0.0-experimental-20260914131506",
+    "@lowdefy/errors": "0.0.0-experimental-20260925210809",
+    "@lowdefy/helpers": "0.0.0-experimental-20260925210809",
     "fs-extra": "11.3.4"
   },
   "devDependencies": {