@lowdefy/node-utils 0.0.0-experimental-20261007124348 → 0.0.0-experimental-20261009120232

package/dist/bindCredentialScrub.js

@@ -0,0 +1,26 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import credentialStorage from './credentialStorage.js';
+import scrubCredentials from './scrubCredentials.js';
+// Returns a scrub for the current scope's marked credentials that keeps working after the scope
+// has ended, for work a request leaves behind, such as the Sentry transaction sent once the
+// response is written. Values marked later in the scope are scrubbed too.
+function bindCredentialScrub() {
+    const scope = credentialStorage.getStore();
+    return function scrubBoundCredentials(value) {
+        return scrubCredentials(value, scope);
+    };
+}
+export default bindCredentialScrub;

package/dist/collectStringLeaves.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+function collectStringLeaves(value, leaves = []) {
+    if (type.isString(value)) {
+        leaves.push(value);
+        return leaves;
+    }
+    if (type.isArray(value)) {
+        value.forEach((item)=>collectStringLeaves(item, leaves));
+        return leaves;
+    }
+    if (type.isObject(value)) {
+        Object.values(value).forEach((item)=>collectStringLeaves(item, leaves));
+    }
+    return leaves;
+}
+export default collectStringLeaves;

package/dist/createSecretScrubber.js

@@ -13,102 +13,18 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { type } from '@lowdefy/helpers';
-const REDACTED = '[REDACTED]';
-// Shorter values, like `true` or a port number, would shred unrelated text.
-const MIN_SECRET_LENGTH = 8;
-function collectStringLeaves(value, leaves) {
-    if (type.isString(value)) {
-        leaves.push(value);
-        return leaves;
-    }
-    if (type.isArray(value)) {
-        value.forEach((item)=>collectStringLeaves(item, leaves));
-        return leaves;
-    }
-    if (type.isObject(value)) {
-        Object.values(value).forEach((item)=>collectStringLeaves(item, leaves));
-    }
-    return leaves;
-}
-// Authors JSON-encode structured secrets and pick a leaf with `_json.parse`, so the leaf, not
-// the whole encoded string, is what ends up in an error message.
-function parseJsonLeaves(value) {
-    let parsed;
-    try {
-        parsed = JSON.parse(value);
-    } catch  {
-        return [];
-    }
-    if (!type.isObject(parsed) && !type.isArray(parsed)) {
-        return [];
-    }
-    return collectStringLeaves(parsed, []);
-}
-// A secret embedded in a larger base64 payload (a Basic auth header built from
-// `user:password`) only matches the secret's own base64 when both start on the same 3-byte
-// boundary. Encoding at each offset and keeping only the characters whose 6 bits fall wholly
-// inside the secret's bytes gives a fragment that matches whatever surrounds it.
-function base64Fragments(value) {
-    const bytes = Buffer.from(value, 'utf8');
-    const fragments = [];
-    [
-        0,
-        1,
-        2
-    ].forEach((offset)=>{
-        const padded = Buffer.concat([
-            Buffer.alloc(offset),
-            bytes
-        ]);
-        const start = Math.ceil(8 * offset / 6);
-        const end = Math.floor(8 * (offset + bytes.length) / 6);
-        [
-            'base64',
-            'base64url'
-        ].forEach((encoding)=>{
-            fragments.push(padded.toString(encoding).replace(/=+$/, '').slice(start, end));
-        });
-    });
-    return fragments;
-}
-function secretForms(value) {
-    return [
-        value,
-        encodeURIComponent(value),
-        JSON.stringify(value).slice(1, -1),
-        ...base64Fragments(value)
-    ];
-}
+import collectStringLeaves from './collectStringLeaves.js';
+import createValueScrubber from './createValueScrubber.js';
+import scrubCredentials from './scrubCredentials.js';
+// The scrub replaces the app's secrets, and the values the current request marked as
+// credentials (markCredential), with [REDACTED].
 function createSecretScrubber({ secrets, env = process.env }) {
-    const values = collectStringLeaves(secrets, []);
+    const values = collectStringLeaves(secrets);
     if (!type.isNone(env.CRON_SECRET)) values.push(env.CRON_SECRET);
     if (!type.isNone(env.BETTER_AUTH_SECRET)) values.push(env.BETTER_AUTH_SECRET);
-    const expanded = values.flatMap((value)=>[
-            value,
-            ...parseJsonLeaves(value)
-        ]);
-    const secretValues = new Set(expanded.filter((value)=>value.length >= MIN_SECRET_LENGTH));
-    const forms = new Set();
-    secretValues.forEach((value)=>{
-        secretForms(value).forEach((form)=>{
-            if (form.length > 0) forms.add(form);
-        });
-    });
-    // No secrets means no pattern: an empty alternation would match at every position.
-    if (forms.size === 0) {
-        return function scrub(value) {
-            return value;
-        };
-    }
-    // One alternation, so every log line and Sentry string takes a single pass however many
-    // secrets there are. Longest first, so a form is replaced whole before a shorter form it
-    // contains can match at the same position.
-    const pattern = new RegExp([
-        ...forms
-    ].sort((a, b)=>b.length - a.length).map((form)=>form.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|'), 'g');
+    const scrubValues = createValueScrubber(values);
     return function scrub(value) {
-        if (!type.isString(value)) return value;
-        return value.replace(pattern, REDACTED);
+        return scrubCredentials(scrubValues(value));
     };
 }
 export default createSecretScrubber;

package/dist/createValueScrubber.js

@@ -0,0 +1,101 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import collectStringLeaves from './collectStringLeaves.js';
+const REDACTED = '[REDACTED]';
+// Shorter values, like `true` or a port number, would shred unrelated text.
+const MIN_SECRET_LENGTH = 8;
+// Authors JSON-encode structured secrets and pick a leaf with `_json.parse`, so the leaf, not
+// the whole encoded string, is what ends up in an error message.
+function parseJsonLeaves(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    } catch  {
+        return [];
+    }
+    if (!type.isObject(parsed) && !type.isArray(parsed)) {
+        return [];
+    }
+    return collectStringLeaves(parsed);
+}
+// A secret embedded in a larger base64 payload (a Basic auth header built from
+// `user:password`) only matches the secret's own base64 when both start on the same 3-byte
+// boundary. Encoding at each offset and keeping only the characters whose 6 bits fall wholly
+// inside the secret's bytes gives a fragment that matches whatever surrounds it.
+function base64Fragments(value) {
+    const bytes = Buffer.from(value, 'utf8');
+    const fragments = [];
+    [
+        0,
+        1,
+        2
+    ].forEach((offset)=>{
+        const padded = Buffer.concat([
+            Buffer.alloc(offset),
+            bytes
+        ]);
+        const start = Math.ceil(8 * offset / 6);
+        const end = Math.floor(8 * (offset + bytes.length) / 6);
+        [
+            'base64',
+            'base64url'
+        ].forEach((encoding)=>{
+            fragments.push(padded.toString(encoding).replace(/=+$/, '').slice(start, end));
+        });
+    });
+    return fragments;
+}
+function secretForms(value) {
+    return [
+        value,
+        encodeURIComponent(value),
+        JSON.stringify(value).slice(1, -1),
+        ...base64Fragments(value)
+    ];
+}
+function returnUnchanged(value) {
+    return value;
+}
+// Returns a function that replaces each of the values, and the forms they take once encoded,
+// with [REDACTED] in a string.
+function createValueScrubber(values) {
+    const expanded = values.flatMap((value)=>[
+            value,
+            ...parseJsonLeaves(value)
+        ]);
+    const secretValues = new Set(expanded.filter((value)=>value.length >= MIN_SECRET_LENGTH));
+    const forms = new Set();
+    secretValues.forEach((value)=>{
+        secretForms(value).forEach((form)=>{
+            if (form.length > 0) forms.add(form);
+        });
+    });
+    // No values means no pattern: an empty alternation would match at every position.
+    if (forms.size === 0) {
+        return returnUnchanged;
+    }
+    // One alternation, so every log line and Sentry string takes a single pass however many
+    // values there are. Longest first, so a form is replaced whole before a shorter form it
+    // contains can match at the same position.
+    const pattern = new RegExp([
+        ...forms
+    ].sort((a, b)=>b.length - a.length).map((form)=>form.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|'), 'g');
+    return function scrub(value) {
+        if (!type.isString(value)) return value;
+        return value.replace(pattern, REDACTED);
+    };
+}
+export default createValueScrubber;

package/dist/credentialStorage.js

@@ -0,0 +1,21 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { AsyncLocalStorage } from 'node:async_hooks';
+// Holds the credentials marked while one request is handled, so a log line written anywhere in
+// that request, by any logger, can be scrubbed of them. The store is { values, scrub }: values is
+// the Set of marked strings, and scrub the scrubber built from them, or null until the next line
+// needs it.
+const credentialStorage = new AsyncLocalStorage();
+export default credentialStorage;

package/dist/getMarkedCredentials.js

@@ -0,0 +1,27 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import credentialStorage from './credentialStorage.js';
+// The values marked so far in the current scope, so work the request hands to another request
+// (a detached CallApi) can mark them there too. Outside any scope nothing has been marked.
+function getMarkedCredentials() {
+    const scope = credentialStorage.getStore();
+    if (scope === undefined) {
+        return [];
+    }
+    return [
+        ...scope.values
+    ];
+}
+export default getMarkedCredentials;

package/dist/index.js

@@ -13,6 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import acquireMachineSlot from './acquireMachineSlot.js';
+import bindCredentialScrub from './bindCredentialScrub.js';
 import checkEnvironmentGuards from './checkEnvironmentGuards.js';
 import cleanDirectory from './cleanDirectory.js';
 import collectEnvironmentGuards from './collectEnvironmentGuards.js';
@@ -29,6 +30,7 @@ import findPnpmWorkspaceRoot from './findPnpmWorkspaceRoot.js';
 import findWorkspacePackages from './findWorkspacePackages.js';
 import getDevInstancePath from './getDevInstancePath.js';
 import getFileExtension, { getFileSubExtension } from './getFileExtension.js';
+import getMarkedCredentials from './getMarkedCredentials.js';
 import getLowdefyHome from './getLowdefyHome.js';
 import getProcessStartTime from './getProcessStartTime.js';
 import getSecretsFromEnv from './getSecretsFromEnv.js';
@@ -54,6 +56,8 @@ import readServerRegistry from './readServerRegistry.js';
 import registerServer from './registerServer.js';
 import listRecordingFiles, { RECORDING_SOURCES } from './recordings/listRecordingFiles.js';
 import readRecordings from './recordings/readRecordings.js';
+import runInCredentialScope from './runInCredentialScope.js';
+import scrubCredentials from './scrubCredentials.js';
 import spawnProcess from './spawnProcess.js';
 import readFile from './readFile.js';
 import writeFile from './writeFile.js';
@@ -72,6 +76,7 @@ import journeyStepSchema, { JOURNEY_STEP_SCHEMAS } from './journeyGrammar/journe
 import hashSequence from './journeyCompiler/hashSequence.js';
 import journeySequence from './journeyCompiler/journeySequence.js';
 import listFailurePaths from './journeyCompiler/listFailurePaths.js';
+import markCredential from './markCredential.js';
 import parseTraceLines from './journeyCompiler/parseTraceLines.js';
 import profileProduction from './journeyEvidence/profileProduction.js';
 import buildSessionReport from './sessionLog/buildSessionReport.js';
@@ -83,4 +88,4 @@ import validateJourneySteps, { getStepKey, INTERACTION_STEP_KEYS, STEP_KEYS, TAR
 import validateJourneyTags, { JOURNEY_TAG_PATTERN } from './journeyGrammar/validateJourneyTags.js';
 import validateJourneyUser from './journeyGrammar/validateJourneyUser.js';
 import validateTraceRecord from './journeyTrace/validateTraceRecord.js';
-export { acquireMachineSlot, buildSessionReport, checkEnvironmentGuards, cleanDirectory, collectEnvironmentGuards, compareProcessStartTimes, compileSegments, copyFileOrDirectory, countDataSetDocuments, countTextTokens, createClientAddressResolver, createConnectPublic, createLookupPublicAddress, createSecretScrubber, devPassiveHeader, dataSetNamePattern, failurePathKey, findAvailablePort, findPlaceholderStep, findPnpmWorkspaceRoot, formatSessionLog, formatSessionReport, findWorkspacePackages, getDevInstancePath, getFileExtension, getFileSubExtension, getLowdefyHome, getProcessStartTime, getSecretsFromEnv, hashSequence, installIfPackageJsonChanged, isBackedBy, isPidAlive, isProcessAlive, isPublicAddress, isProcessStartTime, isPortAvailable, journeySequence, journeyStepSchema, linkDependenciesToWorkspace, linkWorkspaceDependencies, listDataSets, parseDataSet, listFailurePaths, listRecordingFiles, matchPagePath, normaliseBlockId, normaliseJourneySteps, normaliseClickText, parseIpRange, parseSince, parsePsStartTime, parseTraceLines, profileProduction, readDevInstance, readDevInstanceAsync, readProcessStartTime, readServerRegistry, registerServer, readRecordings, RECORDING_SOURCES, spawnProcess, stepIdentity, summariseSessions, readFile, writeFile, writeFileAtomic, watchOwner, writeFileIfChanged, getStepKey, INTERACTION_STEP_KEYS, JOURNEY_STEP_SCHEMAS, STEP_KEYS, TARGET_KEYS, validateJourneySteps, validateTraceRecord, JOURNEY_TAG_PATTERN, validateJourneyTags, validateJourneyUser };
+export { acquireMachineSlot, bindCredentialScrub, buildSessionReport, checkEnvironmentGuards, cleanDirectory, collectEnvironmentGuards, compareProcessStartTimes, compileSegments, copyFileOrDirectory, countDataSetDocuments, countTextTokens, createClientAddressResolver, createConnectPublic, createLookupPublicAddress, createSecretScrubber, devPassiveHeader, dataSetNamePattern, failurePathKey, findAvailablePort, findPlaceholderStep, findPnpmWorkspaceRoot, formatSessionLog, formatSessionReport, findWorkspacePackages, getDevInstancePath, getFileExtension, getFileSubExtension, getMarkedCredentials, getLowdefyHome, getProcessStartTime, getSecretsFromEnv, hashSequence, installIfPackageJsonChanged, isBackedBy, isPidAlive, isProcessAlive, isPublicAddress, isProcessStartTime, isPortAvailable, journeySequence, journeyStepSchema, linkDependenciesToWorkspace, linkWorkspaceDependencies, listDataSets, parseDataSet, listFailurePaths, listRecordingFiles, markCredential, matchPagePath, normaliseBlockId, normaliseJourneySteps, normaliseClickText, parseIpRange, parseSince, parsePsStartTime, parseTraceLines, profileProduction, readDevInstance, readDevInstanceAsync, readProcessStartTime, readServerRegistry, registerServer, readRecordings, RECORDING_SOURCES, runInCredentialScope, scrubCredentials, spawnProcess, stepIdentity, summariseSessions, readFile, writeFile, writeFileAtomic, watchOwner, writeFileIfChanged, getStepKey, INTERACTION_STEP_KEYS, JOURNEY_STEP_SCHEMAS, STEP_KEYS, TARGET_KEYS, validateJourneySteps, validateTraceRecord, JOURNEY_TAG_PATTERN, validateJourneyTags, validateJourneyUser };

package/dist/markCredential.js

@@ -0,0 +1,31 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import collectStringLeaves from './collectStringLeaves.js';
+import credentialStorage from './credentialStorage.js';
+// Every string in value is scrubbed from the log lines of the rest of the current scope.
+function markCredential(value) {
+    const scope = credentialStorage.getStore();
+    if (scope === undefined) {
+        throw new Error('A credential can only be marked while the server handles a request.');
+    }
+    const count = scope.values.size;
+    collectStringLeaves(value).forEach((leaf)=>scope.values.add(leaf));
+    // The scrub is rebuilt from every marked value on the next log line, not here, so a routine that
+    // marks many values pays for one build, and one that writes no line pays for none.
+    if (scope.values.size !== count) {
+        scope.scrub = null;
+    }
+}
+export default markCredential;

package/dist/runInCredentialScope.js

@@ -0,0 +1,23 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import credentialStorage from './credentialStorage.js';
+// Runs fn, and everything it starts, with its own empty set of marked credentials.
+function runInCredentialScope(fn) {
+    return credentialStorage.run({
+        values: new Set(),
+        scrub: null
+    }, fn);
+}
+export default runInCredentialScope;

package/dist/scrubCredentials.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createValueScrubber from './createValueScrubber.js';
+import credentialStorage from './credentialStorage.js';
+// Replaces the credentials marked in a scope, by default the current one, with [REDACTED]. A line
+// written outside any scope (server start-up) has none to replace.
+function scrubCredentials(value, scope = credentialStorage.getStore()) {
+    if (scope === undefined) {
+        return value;
+    }
+    if (scope.scrub === null) {
+        scope.scrub = createValueScrubber([
+            ...scope.values
+        ]);
+    }
+    return scope.scrub(value);
+}
+export default scrubCredentials;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/node-utils",
-  "version": "0.0.0-experimental-20261007124348",
+  "version": "0.0.0-experimental-20261009120232",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -34,8 +34,8 @@
     "dist/*"
   ],
   "dependencies": {
-    "@lowdefy/errors": "0.0.0-experimental-20261007124348",
-    "@lowdefy/helpers": "0.0.0-experimental-20261007124348",
+    "@lowdefy/errors": "0.0.0-experimental-20261009120232",
+    "@lowdefy/helpers": "0.0.0-experimental-20261009120232",
     "fs-extra": "11.3.4",
     "undici": "7.30.0",
     "yaml": "2.9.0"