@futdevpro/fsm-dynamo 1.16.1 → 1.16.2

package/build/_collections/utils/secret-mask.util.d.ts

@@ -0,0 +1,90 @@
+/**
+ * FR-093 (2026-06-09) — Universal secret/key masking utility (bedrock level).
+ *
+ * Lehetove teszi az ALL-FDP-systems-szintu secret-szivargas-detection +
+ * maszkolas-t egy bedrock-szinten. A korabban Overseer / runner-worker
+ * helyi util-jai (FR-092) most ezt importaljak — egy SOR konfiguracio +
+ * find-and-replace.
+ *
+ * User feedback ('az osszes rendszerunknek a lenyege az univerzalizalt,
+ * mindenhol hasznalhato, egysegesített megoldások'): every secret-pattern
+ * ennek a egyetlen DyFM_SecretMask_Util-nak a felelossege.
+ *
+ * Strategy — KETTOS:
+ *   1. **PATTERN-based**: ismert secret-formatumokra automatikus felismeres.
+ *   2. **VALUE-based**: a process.env-jenek secret-erteket overlay-eli minden szovegben.
+ *
+ * Identifiability config (`DyFM_SecretMask_Settings.partialReveal`):
+ *   - DEFAULT: `{ prefix: 4, suffix: 4 }` — a kulcsok elso 4 + utolso 4 char-ja
+ *     megorzodik, kozeppe `[redacted-<KIND>]` keruln, pl.:
+ *       `ghp_abcdefghij1234567890abcdefghij12345678` → `ghp_abcd...5678 [redacted-github-pat]`
+ *   - User-extensible: csokkentett vagy 0-os reveal a tobb-biztonsagos
+ *     deploymentekhez (`{ prefix: 0, suffix: 0 }` → tisztan opaque).
+ *
+ * Per memory `[[feedback_rich_error_handling]]`: a maszkolt token jelzes ne
+ * legyen `***` opaque; legyen `[redacted-<KIND>]` hogy ranezessel lassuk MILYEN
+ * tipusu szivargast szuntunk meg.
+ *
+ * Pattern-mapping per memory `[[feedback_individual_plans]]` — single source of
+ * truth: minden uj secret-format hozzaadando a `DyFM_SECRET_PATTERNS` array-hez;
+ * a tobbi rendszerben (Overseer/runner/bedrock packages) automatikusan
+ * megjelenik a fsm-bump utan.
+ */
+export interface DyFM_SecretMask_PartialReveal_Interface {
+    /** Megorzendo elso karakter-szam (0 = teljesen elrejt). */
+    prefix: number;
+    /** Megorzendo utolso karakter-szam (0 = teljesen elrejt). */
+    suffix: number;
+}
+export interface DyFM_SecretMask_Settings_Interface {
+    /**
+     * Identifiability-controls. Default `{ prefix: 4, suffix: 4 }`. Beallitva
+     * pl. `{ prefix: 0, suffix: 0 }` opaque maszkolas-hoz.
+     */
+    partialReveal: DyFM_SecretMask_PartialReveal_Interface;
+    /**
+     * Min karakter-hossz amire az env-overlay alkalmaz. Rovid ertekek false
+     * positivot adnak (pl. `KEY=foo` ahol foo a project-name). Default: 8.
+     */
+    minEnvValueLength: number;
+    /**
+     * `process.env`-bol kulcsneveket szuro regex. Default match: minden olyan
+     * env-var ahol a NEV titkos-jellegu (TOKEN/SECRET/KEY/PASSWORD/PAT/HMAC stb.).
+     */
+    envNameSecretRx: RegExp;
+}
+export declare const DyFM_DEFAULT_SECRET_MASK_SETTINGS: DyFM_SecretMask_Settings_Interface;
+interface SecretPattern_Interface {
+    /** Diagnosztikai cimke a `[redacted-<KIND>]` markerben. */
+    kind: string;
+    /** Detekcios regex (global flag is REQUIRED — a global flow minden match-et kezel). */
+    regex: RegExp;
+    /**
+     * `redactWith` — meghivva minden match-re a "matched" stringgel + settings-szel.
+     * Visszaad a csere-string-et. Default: partial-reveal-szel `<prefix>...<suffix> [redacted-<KIND>]`.
+     */
+    redactWith?: (matched: string, settings: DyFM_SecretMask_Settings_Interface) => string;
+    /**
+     * `wrapPrefix` — ha a regex captures (`$1` group-ja stb.) a literal-prefixet jelzi
+     * (pl. `Bearer ` a Bearer-token-nel), akkor a redact-result `[$1][reveal][marker]`-rel
+     * kerul ossze; a regex group az `wrapPrefix` index-en mutatott group. Default 0 = no wrap.
+     */
+    wrapPrefix?: number;
+}
+export declare const DyFM_SECRET_PATTERNS: SecretPattern_Interface[];
+/**
+ * `DyFM_maskSecrets` — universal pre-Discord-send + pre-log-persist masking.
+ *
+ * @param text bemenet (ha nem string, JSON-szerializalaskor maskoljuk)
+ * @param settings  konfiguracio (default a DyFM_DEFAULT_SECRET_MASK_SETTINGS)
+ * @returns maszkolt szoveg
+ */
+export declare function DyFM_maskSecrets(text: unknown, settings?: DyFM_SecretMask_Settings_Interface): string;
+/**
+ * Recursive object-masker — JSON-szeru struktura minden string-ertekeben alkalmazza
+ * a DyFM_maskSecrets-t. Pl. errors-table additionalContent / logTail tomb / cdpReport
+ * objektum elotti masking-hez.
+ */
+export declare function DyFM_maskSecretsDeep<T = unknown>(input: T, settings?: DyFM_SecretMask_Settings_Interface): T;
+export {};
+//# sourceMappingURL=secret-mask.util.d.ts.map

package/build/_collections/utils/secret-mask.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-mask.util.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/secret-mask.util.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,uCAAuC;IACtD,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,aAAa,EAAE,uCAAuC,CAAC;IAEvD;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,eAAO,MAAM,iCAAiC,EAAE,kCAO/C,CAAC;AAEF,UAAU,uBAAuB;IAC/B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kCAAkC,KAAK,MAAM,CAAC;IACvF;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAsBD,eAAO,MAAM,oBAAoB,EAAE,uBAAuB,EA4DzD,CAAC;AAuBF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,QAAQ,GAAE,kCAAsE,GAC/E,MAAM,CAiCR;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,GAAG,OAAO,EAC9C,KAAK,EAAE,CAAC,EACR,QAAQ,GAAE,kCAAsE,GAC/E,CAAC,CAcH"}

package/build/_collections/utils/secret-mask.util.js

@@ -0,0 +1,219 @@
+"use strict";
+/**
+ * FR-093 (2026-06-09) — Universal secret/key masking utility (bedrock level).
+ *
+ * Lehetove teszi az ALL-FDP-systems-szintu secret-szivargas-detection +
+ * maszkolas-t egy bedrock-szinten. A korabban Overseer / runner-worker
+ * helyi util-jai (FR-092) most ezt importaljak — egy SOR konfiguracio +
+ * find-and-replace.
+ *
+ * User feedback ('az osszes rendszerunknek a lenyege az univerzalizalt,
+ * mindenhol hasznalhato, egysegesített megoldások'): every secret-pattern
+ * ennek a egyetlen DyFM_SecretMask_Util-nak a felelossege.
+ *
+ * Strategy — KETTOS:
+ *   1. **PATTERN-based**: ismert secret-formatumokra automatikus felismeres.
+ *   2. **VALUE-based**: a process.env-jenek secret-erteket overlay-eli minden szovegben.
+ *
+ * Identifiability config (`DyFM_SecretMask_Settings.partialReveal`):
+ *   - DEFAULT: `{ prefix: 4, suffix: 4 }` — a kulcsok elso 4 + utolso 4 char-ja
+ *     megorzodik, kozeppe `[redacted-<KIND>]` keruln, pl.:
+ *       `ghp_abcdefghij1234567890abcdefghij12345678` → `ghp_abcd...5678 [redacted-github-pat]`
+ *   - User-extensible: csokkentett vagy 0-os reveal a tobb-biztonsagos
+ *     deploymentekhez (`{ prefix: 0, suffix: 0 }` → tisztan opaque).
+ *
+ * Per memory `[[feedback_rich_error_handling]]`: a maszkolt token jelzes ne
+ * legyen `***` opaque; legyen `[redacted-<KIND>]` hogy ranezessel lassuk MILYEN
+ * tipusu szivargast szuntunk meg.
+ *
+ * Pattern-mapping per memory `[[feedback_individual_plans]]` — single source of
+ * truth: minden uj secret-format hozzaadando a `DyFM_SECRET_PATTERNS` array-hez;
+ * a tobbi rendszerben (Overseer/runner/bedrock packages) automatikusan
+ * megjelenik a fsm-bump utan.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyFM_SECRET_PATTERNS = exports.DyFM_DEFAULT_SECRET_MASK_SETTINGS = void 0;
+exports.DyFM_maskSecrets = DyFM_maskSecrets;
+exports.DyFM_maskSecretsDeep = DyFM_maskSecretsDeep;
+exports.DyFM_DEFAULT_SECRET_MASK_SETTINGS = {
+    partialReveal: {
+        prefix: 4,
+        suffix: 4,
+    },
+    minEnvValueLength: 8,
+    envNameSecretRx: /(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE|CREDENTIAL|API_KEY|WEBHOOK)/i,
+};
+const defaultRevealReplacement = (matched, kind, settings) => {
+    const p = Math.max(0, settings.partialReveal.prefix);
+    const s = Math.max(0, settings.partialReveal.suffix);
+    // Ha a kulcs tul rovid az osszes reveal-osszeghez kepest, ne reveal-juk
+    // (kulonben az egesz secret elerhetonek osszetapadna).
+    if (matched.length <= p + s + 4) {
+        return `[redacted-${kind}]`;
+    }
+    if (p === 0 && s === 0) {
+        return `[redacted-${kind}]`;
+    }
+    const head = matched.slice(0, p);
+    const tail = matched.slice(matched.length - s);
+    return `${head}...${tail} [redacted-${kind}]`;
+};
+exports.DyFM_SECRET_PATTERNS = [
+    // URL-embedded basic auth — sajat replace-pattern megorzi a scheme-et + host-ot.
+    {
+        kind: 'url-cred',
+        regex: /\b(https?:\/\/)([^/\s:@]+):([^\s@]+)@/g,
+        redactWith: (_m) => '$1[redacted-url-cred]@',
+    },
+    // GitHub PATs
+    { kind: 'github-pat', regex: /\bgh[ps]_[A-Za-z0-9]{36,}\b/g },
+    { kind: 'github-pat-fine', regex: /\bgithub_pat_[A-Za-z0-9_]{82,}\b/g },
+    { kind: 'github-oauth', regex: /\bgho_[A-Za-z0-9]{36,}\b/g },
+    { kind: 'github-refresh', regex: /\bghr_[A-Za-z0-9]{36,}\b/g },
+    // NPM token
+    { kind: 'npm-token', regex: /\bnpm_[A-Za-z0-9]{36,}\b/g },
+    // Docker Hub PAT
+    { kind: 'docker-pat', regex: /\bdckr_pat_[A-Za-z0-9_\-]{20,}\b/g },
+    // Slack token
+    { kind: 'slack-token', regex: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g },
+    // Anthropic key (BEFORE OpenAI — `sk-ant-*` more specific than `sk-*`)
+    { kind: 'anthropic-key', regex: /\bsk-ant-[A-Za-z0-9\-_]{32,}\b/g },
+    // OpenAI / generic `sk-*` key
+    { kind: 'openai-key', regex: /\bsk-[A-Za-z0-9]{32,}\b/g },
+    // Google API key
+    { kind: 'google-api-key', regex: /\bAIza[0-9A-Za-z\-_]{35}\b/g },
+    // Discord webhook URL (id + token in URL)
+    {
+        kind: 'discord-webhook',
+        regex: /\bhttps?:\/\/(?:discord(?:app)?\.com|discordapp\.com)\/api\/webhooks\/\d+\/[A-Za-z0-9_\-]+/g,
+        redactWith: (_m) => '[redacted-discord-webhook]',
+    },
+    // Bearer token in HTTP header style — megorizzuk a 'Bearer ' prefixet (literally), a token-t pedig reveal-eljuk.
+    {
+        kind: 'bearer-token',
+        regex: /\b(Bearer)\s+([A-Za-z0-9\-._~+/=]{20,})/gi,
+        redactWith: (matched, settings) => {
+            const tokenStart = matched.search(/\s+/);
+            const prefix = matched.slice(0, tokenStart + 1); // 'Bearer '
+            const token = matched.slice(tokenStart + 1);
+            return prefix + defaultRevealReplacement(token, 'token', settings);
+        },
+    },
+    // JWT (eyJ + .* + .*)
+    { kind: 'jwt', regex: /\beyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\b/g },
+    // AWS Access Key
+    { kind: 'aws-access-key', regex: /\bAKIA[0-9A-Z]{16}\b/g },
+    // Env-style secret-name = value
+    {
+        kind: 'env-style-secret',
+        regex: /\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE)[A-Z0-9_]*)\s*[:=]\s*['"]?([^\s'"]+)['"]?/g,
+        redactWith: (matched, settings) => {
+            // Pull out the key name + value via re-match (avoids capturing groups in redactWith signature)
+            const m = matched.match(/\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE)[A-Z0-9_]*)\s*[:=]\s*['"]?([^\s'"]+)/);
+            if (!m) {
+                return matched;
+            }
+            const keyName = m[1];
+            const value = m[2];
+            const sep = matched.includes(': ') ? '=' : '=';
+            const revealed = defaultRevealReplacement(value, 'env-value', settings);
+            return `${keyName}${sep}${revealed}`;
+        },
+    },
+];
+/**
+ * `process.env`-bol kigyujti azokat a kulcsokat ahol a NEV titkos-jellegu
+ * ÉS a value >= minEnvValueLength. Visszaad egy listat — ezeket szovegben
+ * minden elofordulasban partial-reveal-el felulrak-juk.
+ */
+const collectEnvSecretValues = (settings) => {
+    const out = [];
+    for (const [key, raw] of Object.entries(process.env)) {
+        if (!raw || raw.length < settings.minEnvValueLength) {
+            continue;
+        }
+        if (!settings.envNameSecretRx.test(key)) {
+            continue;
+        }
+        if (/^(true|false|0|1)$/i.test(raw)) {
+            continue;
+        }
+        out.push({ value: raw, key: key });
+    }
+    // Sort by value length DESC — hosszabb ertekekkel kezdjuk, igy egy rovid
+    // prefix nem sealeze el a hosszabb kornyezetet.
+    out.sort((a, b) => b.value.length - a.value.length);
+    return out;
+};
+/**
+ * `DyFM_maskSecrets` — universal pre-Discord-send + pre-log-persist masking.
+ *
+ * @param text bemenet (ha nem string, JSON-szerializalaskor maskoljuk)
+ * @param settings  konfiguracio (default a DyFM_DEFAULT_SECRET_MASK_SETTINGS)
+ * @returns maszkolt szoveg
+ */
+function DyFM_maskSecrets(text, settings = exports.DyFM_DEFAULT_SECRET_MASK_SETTINGS) {
+    if (text === null || text === undefined) {
+        return '';
+    }
+    let str;
+    if (typeof text === 'string') {
+        str = text;
+    }
+    else {
+        try {
+            str = JSON.stringify(text);
+        }
+        catch {
+            str = String(text);
+        }
+    }
+    // 1. PATTERN-based maszkolas
+    for (const p of exports.DyFM_SECRET_PATTERNS) {
+        str = str.replace(p.regex, (matched, ...groups) => {
+            // Drop the `offset` + `wholeString` args at the end of `groups`
+            if (p.redactWith) {
+                return p.redactWith(matched, settings)
+                    .replace(/\$1/g, groups[0] ?? '')
+                    .replace(/\$2/g, groups[1] ?? '');
+            }
+            // Default: partial-reveal with kind
+            return defaultRevealReplacement(matched, p.kind, settings);
+        });
+    }
+    // 2. ENV-secret value-alapu overlay
+    const envSecrets = collectEnvSecretValues(settings);
+    for (const { value, key } of envSecrets) {
+        if (!str.includes(value)) {
+            continue;
+        }
+        const revealed = defaultRevealReplacement(value, `env-${key}`, settings);
+        str = str.split(value).join(revealed);
+    }
+    return str;
+}
+/**
+ * Recursive object-masker — JSON-szeru struktura minden string-ertekeben alkalmazza
+ * a DyFM_maskSecrets-t. Pl. errors-table additionalContent / logTail tomb / cdpReport
+ * objektum elotti masking-hez.
+ */
+function DyFM_maskSecretsDeep(input, settings = exports.DyFM_DEFAULT_SECRET_MASK_SETTINGS) {
+    if (input === null || input === undefined) {
+        return input;
+    }
+    if (typeof input === 'string') {
+        return DyFM_maskSecrets(input, settings);
+    }
+    if (typeof input !== 'object') {
+        return input;
+    }
+    if (Array.isArray(input)) {
+        return input.map((it) => DyFM_maskSecretsDeep(it, settings));
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(input)) {
+        out[k] = DyFM_maskSecretsDeep(v, settings);
+    }
+    return out;
+}
+//# sourceMappingURL=secret-mask.util.js.map

package/build/_collections/utils/secret-mask.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-mask.util.js","sourceRoot":"","sources":["../../../src/_collections/utils/secret-mask.util.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AAsKH,4CAoCC;AAOD,oDAiBC;AArMY,QAAA,iCAAiC,GAAuC;IACnF,aAAa,EAAE;QACb,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,CAAC;KACV;IACD,iBAAiB,EAAE,CAAC;IACpB,eAAe,EAAG,wFAAwF;CAC3G,CAAC;AAoBF,MAAM,wBAAwB,GAAG,CAC/B,OAAe,EACf,IAAY,EACZ,QAA4C,EACpC,EAAE;IACV,MAAM,CAAC,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7D,wEAAwE;IACxE,uDAAuD;IACvD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,aAAa,IAAI,GAAG,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,aAAa,IAAI,GAAG,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,GAAW,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAW,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvD,OAAO,GAAG,IAAI,MAAM,IAAI,cAAc,IAAI,GAAG,CAAC;AAChD,CAAC,CAAC;AAEW,QAAA,oBAAoB,GAA8B;IAC7D,iFAAiF;IACjF;QACE,IAAI,EAAS,UAAU;QACvB,KAAK,EAAQ,wCAAwC;QACrD,UAAU,EAAG,CAAC,EAAU,EAAU,EAAE,CAAC,wBAAwB;KAC9D;IACD,cAAc;IACd,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,8BAA8B,EAAE;IAC7D,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IACvE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC5D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC9D,YAAY;IACZ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,2BAA2B,EAAE;IACzD,iBAAiB;IACjB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,mCAAmC,EAAE;IAClE,cAAc;IACd,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,mCAAmC,EAAE;IACnE,uEAAuE;IACvE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACnE,8BAA8B;IAC9B,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,0BAA0B,EAAE;IACzD,iBAAiB;IACjB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAChE,0CAA0C;IAC1C;QACE,IAAI,EAAQ,iBAAiB;QAC7B,KAAK,EAAO,6FAA6F;QACzG,UAAU,EAAE,CAAC,EAAU,EAAU,EAAE,CAAC,4BAA4B;KACjE;IACD,iHAAiH;IACjH;QACE,IAAI,EAAQ,cAAc;QAC1B,KAAK,EAAO,2CAA2C;QACvD,UAAU,EAAE,CAAC,OAAe,EAAE,QAA4C,EAAU,EAAE;YACpF,MAAM,UAAU,GAAW,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,MAAM,GAAW,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY;YACrE,MAAM,KAAK,GAAW,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YACpD,OAAO,MAAM,GAAG,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrE,CAAC;KACF;IACD,sBAAsB;IACtB,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,uEAAuE,EAAE;IAC/F,iBAAiB;IACjB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,uBAAuB,EAAE;IAC1D,gCAAgC;IAChC;QACE,IAAI,EAAQ,kBAAkB;QAC9B,KAAK,EAAO,wHAAwH;QACpI,UAAU,EAAE,CAAC,OAAe,EAAE,QAA4C,EAAU,EAAE;YACpF,+FAA+F;YAC/F,MAAM,CAAC,GAA4B,OAAO,CAAC,KAAK,CAAC,kHAAkH,CAAC,CAAC;YACrK,IAAI,CAAC,CAAC,EAAE,CAAC;gBAAC,OAAO,OAAO,CAAC;YAAC,CAAC;YAC3B,MAAM,OAAO,GAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,KAAK,GAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAW,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACvD,MAAM,QAAQ,GAAW,wBAAwB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YAChF,OAAO,GAAG,OAAO,GAAG,GAAG,GAAG,QAAQ,EAAE,CAAC;QACvC,CAAC;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,CAC7B,QAA4C,EACV,EAAE;IACpC,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACtD,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,yEAAyE;IACzE,gDAAgD;IAChD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAC9B,IAAa,EACb,WAA+C,yCAAiC;IAEhF,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IACvD,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACnC,MAAM,CAAC;YAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IAC/B,CAAC;IAED,6BAA6B;IAC7B,KAAK,MAAM,CAAC,IAAI,4BAAoB,EAAE,CAAC;QACrC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,MAAgB,EAAU,EAAE;YAC1E,gEAAgE;YAChE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBACjB,OAAO,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC;qBACnC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBAChC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtC,CAAC;YACD,oCAAoC;YACpC,OAAO,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oCAAoC;IACpC,MAAM,UAAU,GAAqC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACtF,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACvC,MAAM,QAAQ,GAAW,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjF,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAClC,KAAQ,EACR,WAA+C,yCAAiC;IAEhF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAiB,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAQ,KAAmB,CAAC,GAAG,CAAC,CAAC,EAAW,EAAW,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAiB,CAAC;IAChH,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAmB,CAAC;AAC7B,CAAC"}

package/build/index.d.ts

@@ -10,6 +10,7 @@ export * from './_collections/utils/extract-error-message.util';
 export * from './_collections/utils/json-error-helper.util';
 export * from './_collections/utils/log.util';
 export * from './_collections/utils/round-list.util';
+export * from './_collections/utils/secret-mask.util';
 export * from './_collections/utils/object.util';
 export * from './_collections/utils/require-env.util';
 export * from './_collections/utils/stack.util';

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,wCAAwC,CAAC;AACvD,cAAc,sCAAsC,CAAC;AAGrD,cAAc,iCAAiC,CAAC;AAChD,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iDAAiD,CAAC;AAChE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iDAAiD,CAAC;AAChE,cAAc,qCAAqC,CAAC;AACpD,cAAc,gCAAgC,CAAC;AAG/C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,uCAAuC,CAAC;AACtD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAGvD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAI/D,cAAc,mCAAmC,CAAC;AAClD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wCAAwC,CAAC;AAGvD,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AAGtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AAKjD,cAAc,0DAA0D,CAAC;AACzE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,8CAA8C,CAAC;AAC7D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,uEAAuE,CAAC;AAGtF,cAAc,iEAAiE,CAAC;AAChF,cAAc,0DAA0D,CAAC;AACzE,cAAc,wDAAwD,CAAC;AAGvE,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC;AAG1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,sCAAsC,CAAC;AACrD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wDAAwD,CAAC;AACvE,cAAc,wCAAwC,CAAC;AAGvD,cAAc,gEAAgE,CAAC;AAC/E,cAAc,4DAA4D,CAAC;AAG3E,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,wCAAwC,CAAC;AACvD,cAAc,sCAAsC,CAAC;AAGrD,cAAc,iCAAiC,CAAC;AAChD,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iDAAiD,CAAC;AAChE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iDAAiD,CAAC;AAChE,cAAc,qCAAqC,CAAC;AACpD,cAAc,gCAAgC,CAAC;AAG/C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,uCAAuC,CAAC;AACtD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,wCAAwC,CAAC;AAGvD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAI/D,cAAc,mCAAmC,CAAC;AAClD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wCAAwC,CAAC;AAGvD,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AAGtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AAKjD,cAAc,0DAA0D,CAAC;AACzE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,8CAA8C,CAAC;AAC7D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oDAAoD,CAAC;AACnE,cAAc,sDAAsD,CAAC;AACrE,cAAc,uEAAuE,CAAC;AAGtF,cAAc,iEAAiE,CAAC;AAChF,cAAc,0DAA0D,CAAC;AACzE,cAAc,wDAAwD,CAAC;AAGvE,cAAc,yCAAyC,CAAC;AACxD,cAAc,2CAA2C,CAAC;AAG1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,sCAAsC,CAAC;AACrD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wDAAwD,CAAC;AACvE,cAAc,wCAAwC,CAAC;AAGvD,cAAc,gEAAgE,CAAC;AAC/E,cAAc,4DAA4D,CAAC;AAG3E,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC"}

package/build/index.js

@@ -16,6 +16,7 @@ tslib_1.__exportStar(require("./_collections/utils/extract-error-message.util"),
 tslib_1.__exportStar(require("./_collections/utils/json-error-helper.util"), exports);
 tslib_1.__exportStar(require("./_collections/utils/log.util"), exports);
 tslib_1.__exportStar(require("./_collections/utils/round-list.util"), exports);
+tslib_1.__exportStar(require("./_collections/utils/secret-mask.util"), exports);
 tslib_1.__exportStar(require("./_collections/utils/object.util"), exports);
 tslib_1.__exportStar(require("./_collections/utils/require-env.util"), exports);
 tslib_1.__exportStar(require("./_collections/utils/stack.util"), exports);

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,cAAc;AACd,wBAAwB;AACxB,oFAA0D;AAC1D,wFAA8D;AAC9D,yFAA+D;AAC/D,iFAAuD;AACvD,+EAAqD;AAErD,oBAAoB;AACpB,0EAAgD;AAChD,0EAAgD;AAChD,yEAA+C;AAC/C,0FAAgE;AAChE,sFAA4D;AAC5D,wEAA8C;AAC9C,+EAAqD;AACrD,2EAAiD;AACjD,gFAAsD;AACtD,0EAAgD;AAChD,2EAAiD;AACjD,gFAAsD;AACtD,yEAA+C;AAC/C,0FAAgE;AAChE,8EAAoD;AACpD,yEAA+C;AAE/C,yBAAyB;AACzB,oFAA0D;AAC1D,8EAAoD;AACpD,gFAAsD;AACtD,sFAA4D;AAC5D,iFAAuD;AAEvD,2BAA2B;AAC3B,yFAA+D;AAC/D,gFAAsD;AACtD,yFAA+D;AAG/D,QAAQ;AACR,4EAAkD;AAClD,wEAA8C;AAC9C,yEAA+C;AAC/C,oEAA0C;AAC1C,kEAAwC;AACxC,iFAAuD;AAEvD,aAAa;AACb,4EAAkD;AAClD,6EAAmD;AACnD,gFAAsD;AAEtD,aAAa;AACb,yEAA+C;AAC/C,mEAAyC;AACzC,2EAAiD;AAGjD,SAAS;AACT,wBAAwB;AACxB,mGAAyE;AACzE,sGAA4E;AAC5E,uFAA6D;AAC7D,sFAA4D;AAC5D,6FAAmE;AACnE,+FAAqE;AACrE,gHAAsF;AAEtF,6BAA6B;AAC7B,0GAAgF;AAChF,mGAAyE;AACzE,iGAAuE;AAEvE,qBAAqB;AACrB,kFAAwD;AACxD,oFAA0D;AAE1D,oBAAoB;AACpB,oFAA0D;AAC1D,wFAA8D;AAC9D,+EAAqD;AACrD,uFAA6D;AAC7D,wFAA8D;AAC9D,sFAA4D;AAC5D,uFAA6D;AAC7D,iGAAuE;AACvE,iFAAuD;AAEvD,gCAAgC;AAChC,yGAA+E;AAC/E,qGAA2E;AAE3E,eAAe;AACf,yEAA+C;AAC/C,uEAA6C;AAC7C,yEAA+C;AAC/C,uEAA6C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,cAAc;AACd,wBAAwB;AACxB,oFAA0D;AAC1D,wFAA8D;AAC9D,yFAA+D;AAC/D,iFAAuD;AACvD,+EAAqD;AAErD,oBAAoB;AACpB,0EAAgD;AAChD,0EAAgD;AAChD,yEAA+C;AAC/C,0FAAgE;AAChE,sFAA4D;AAC5D,wEAA8C;AAC9C,+EAAqD;AACrD,gFAAsD;AACtD,2EAAiD;AACjD,gFAAsD;AACtD,0EAAgD;AAChD,2EAAiD;AACjD,gFAAsD;AACtD,yEAA+C;AAC/C,0FAAgE;AAChE,8EAAoD;AACpD,yEAA+C;AAE/C,yBAAyB;AACzB,oFAA0D;AAC1D,8EAAoD;AACpD,gFAAsD;AACtD,sFAA4D;AAC5D,iFAAuD;AAEvD,2BAA2B;AAC3B,yFAA+D;AAC/D,gFAAsD;AACtD,yFAA+D;AAG/D,QAAQ;AACR,4EAAkD;AAClD,wEAA8C;AAC9C,yEAA+C;AAC/C,oEAA0C;AAC1C,kEAAwC;AACxC,iFAAuD;AAEvD,aAAa;AACb,4EAAkD;AAClD,6EAAmD;AACnD,gFAAsD;AAEtD,aAAa;AACb,yEAA+C;AAC/C,mEAAyC;AACzC,2EAAiD;AAGjD,SAAS;AACT,wBAAwB;AACxB,mGAAyE;AACzE,sGAA4E;AAC5E,uFAA6D;AAC7D,sFAA4D;AAC5D,6FAAmE;AACnE,+FAAqE;AACrE,gHAAsF;AAEtF,6BAA6B;AAC7B,0GAAgF;AAChF,mGAAyE;AACzE,iGAAuE;AAEvE,qBAAqB;AACrB,kFAAwD;AACxD,oFAA0D;AAE1D,oBAAoB;AACpB,oFAA0D;AAC1D,wFAA8D;AAC9D,+EAAqD;AACrD,uFAA6D;AAC7D,wFAA8D;AAC9D,sFAA4D;AAC5D,uFAA6D;AAC7D,iGAAuE;AACvE,iFAAuD;AAEvD,gCAAgC;AAChC,yGAA+E;AAC/E,qGAA2E;AAE3E,eAAe;AACf,yEAA+C;AAC/C,uEAA6C;AAC7C,yEAA+C;AAC/C,uEAA6C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@futdevpro/fsm-dynamo",
-  "version": "01.16.1",
+  "version": "01.16.2",
   "description": "Full Stack Model Collection for Dynamic (NodeJS-Typescript) Framework called Dynamo, by Future Development Ltd.",
   "DyBu_settings": {
     "packageType": "full-stack-package",

package/src/_collections/utils/secret-mask.util.ts

@@ -0,0 +1,258 @@
+/**
+ * FR-093 (2026-06-09) — Universal secret/key masking utility (bedrock level).
+ *
+ * Lehetove teszi az ALL-FDP-systems-szintu secret-szivargas-detection +
+ * maszkolas-t egy bedrock-szinten. A korabban Overseer / runner-worker
+ * helyi util-jai (FR-092) most ezt importaljak — egy SOR konfiguracio +
+ * find-and-replace.
+ *
+ * User feedback ('az osszes rendszerunknek a lenyege az univerzalizalt,
+ * mindenhol hasznalhato, egysegesített megoldások'): every secret-pattern
+ * ennek a egyetlen DyFM_SecretMask_Util-nak a felelossege.
+ *
+ * Strategy — KETTOS:
+ *   1. **PATTERN-based**: ismert secret-formatumokra automatikus felismeres.
+ *   2. **VALUE-based**: a process.env-jenek secret-erteket overlay-eli minden szovegben.
+ *
+ * Identifiability config (`DyFM_SecretMask_Settings.partialReveal`):
+ *   - DEFAULT: `{ prefix: 4, suffix: 4 }` — a kulcsok elso 4 + utolso 4 char-ja
+ *     megorzodik, kozeppe `[redacted-<KIND>]` keruln, pl.:
+ *       `ghp_abcdefghij1234567890abcdefghij12345678` → `ghp_abcd...5678 [redacted-github-pat]`
+ *   - User-extensible: csokkentett vagy 0-os reveal a tobb-biztonsagos
+ *     deploymentekhez (`{ prefix: 0, suffix: 0 }` → tisztan opaque).
+ *
+ * Per memory `[[feedback_rich_error_handling]]`: a maszkolt token jelzes ne
+ * legyen `***` opaque; legyen `[redacted-<KIND>]` hogy ranezessel lassuk MILYEN
+ * tipusu szivargast szuntunk meg.
+ *
+ * Pattern-mapping per memory `[[feedback_individual_plans]]` — single source of
+ * truth: minden uj secret-format hozzaadando a `DyFM_SECRET_PATTERNS` array-hez;
+ * a tobbi rendszerben (Overseer/runner/bedrock packages) automatikusan
+ * megjelenik a fsm-bump utan.
+ */
+
+export interface DyFM_SecretMask_PartialReveal_Interface {
+  /** Megorzendo elso karakter-szam (0 = teljesen elrejt). */
+  prefix: number;
+  /** Megorzendo utolso karakter-szam (0 = teljesen elrejt). */
+  suffix: number;
+}
+
+export interface DyFM_SecretMask_Settings_Interface {
+  /**
+   * Identifiability-controls. Default `{ prefix: 4, suffix: 4 }`. Beallitva
+   * pl. `{ prefix: 0, suffix: 0 }` opaque maszkolas-hoz.
+   */
+  partialReveal: DyFM_SecretMask_PartialReveal_Interface;
+
+  /**
+   * Min karakter-hossz amire az env-overlay alkalmaz. Rovid ertekek false
+   * positivot adnak (pl. `KEY=foo` ahol foo a project-name). Default: 8.
+   */
+  minEnvValueLength: number;
+
+  /**
+   * `process.env`-bol kulcsneveket szuro regex. Default match: minden olyan
+   * env-var ahol a NEV titkos-jellegu (TOKEN/SECRET/KEY/PASSWORD/PAT/HMAC stb.).
+   */
+  envNameSecretRx: RegExp;
+}
+
+export const DyFM_DEFAULT_SECRET_MASK_SETTINGS: DyFM_SecretMask_Settings_Interface = {
+  partialReveal: {
+    prefix: 4,
+    suffix: 4,
+  },
+  minEnvValueLength: 8,
+  envNameSecretRx:  /(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE|CREDENTIAL|API_KEY|WEBHOOK)/i,
+};
+
+interface SecretPattern_Interface {
+  /** Diagnosztikai cimke a `[redacted-<KIND>]` markerben. */
+  kind: string;
+  /** Detekcios regex (global flag is REQUIRED — a global flow minden match-et kezel). */
+  regex: RegExp;
+  /**
+   * `redactWith` — meghivva minden match-re a "matched" stringgel + settings-szel.
+   * Visszaad a csere-string-et. Default: partial-reveal-szel `<prefix>...<suffix> [redacted-<KIND>]`.
+   */
+  redactWith?: (matched: string, settings: DyFM_SecretMask_Settings_Interface) => string;
+  /**
+   * `wrapPrefix` — ha a regex captures (`$1` group-ja stb.) a literal-prefixet jelzi
+   * (pl. `Bearer ` a Bearer-token-nel), akkor a redact-result `[$1][reveal][marker]`-rel
+   * kerul ossze; a regex group az `wrapPrefix` index-en mutatott group. Default 0 = no wrap.
+   */
+  wrapPrefix?: number;
+}
+
+const defaultRevealReplacement = (
+  matched: string,
+  kind: string,
+  settings: DyFM_SecretMask_Settings_Interface,
+): string => {
+  const p: number = Math.max(0, settings.partialReveal.prefix);
+  const s: number = Math.max(0, settings.partialReveal.suffix);
+  // Ha a kulcs tul rovid az osszes reveal-osszeghez kepest, ne reveal-juk
+  // (kulonben az egesz secret elerhetonek osszetapadna).
+  if (matched.length <= p + s + 4) {
+    return `[redacted-${kind}]`;
+  }
+  if (p === 0 && s === 0) {
+    return `[redacted-${kind}]`;
+  }
+  const head: string = matched.slice(0, p);
+  const tail: string = matched.slice(matched.length - s);
+  return `${head}...${tail} [redacted-${kind}]`;
+};
+
+export const DyFM_SECRET_PATTERNS: SecretPattern_Interface[] = [
+  // URL-embedded basic auth — sajat replace-pattern megorzi a scheme-et + host-ot.
+  {
+    kind:        'url-cred',
+    regex:       /\b(https?:\/\/)([^/\s:@]+):([^\s@]+)@/g,
+    redactWith:  (_m: string): string => '$1[redacted-url-cred]@',
+  },
+  // GitHub PATs
+  { kind: 'github-pat', regex: /\bgh[ps]_[A-Za-z0-9]{36,}\b/g },
+  { kind: 'github-pat-fine', regex: /\bgithub_pat_[A-Za-z0-9_]{82,}\b/g },
+  { kind: 'github-oauth', regex: /\bgho_[A-Za-z0-9]{36,}\b/g },
+  { kind: 'github-refresh', regex: /\bghr_[A-Za-z0-9]{36,}\b/g },
+  // NPM token
+  { kind: 'npm-token', regex: /\bnpm_[A-Za-z0-9]{36,}\b/g },
+  // Docker Hub PAT
+  { kind: 'docker-pat', regex: /\bdckr_pat_[A-Za-z0-9_\-]{20,}\b/g },
+  // Slack token
+  { kind: 'slack-token', regex: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g },
+  // Anthropic key (BEFORE OpenAI — `sk-ant-*` more specific than `sk-*`)
+  { kind: 'anthropic-key', regex: /\bsk-ant-[A-Za-z0-9\-_]{32,}\b/g },
+  // OpenAI / generic `sk-*` key
+  { kind: 'openai-key', regex: /\bsk-[A-Za-z0-9]{32,}\b/g },
+  // Google API key
+  { kind: 'google-api-key', regex: /\bAIza[0-9A-Za-z\-_]{35}\b/g },
+  // Discord webhook URL (id + token in URL)
+  {
+    kind:       'discord-webhook',
+    regex:      /\bhttps?:\/\/(?:discord(?:app)?\.com|discordapp\.com)\/api\/webhooks\/\d+\/[A-Za-z0-9_\-]+/g,
+    redactWith: (_m: string): string => '[redacted-discord-webhook]',
+  },
+  // Bearer token in HTTP header style — megorizzuk a 'Bearer ' prefixet (literally), a token-t pedig reveal-eljuk.
+  {
+    kind:       'bearer-token',
+    regex:      /\b(Bearer)\s+([A-Za-z0-9\-._~+/=]{20,})/gi,
+    redactWith: (matched: string, settings: DyFM_SecretMask_Settings_Interface): string => {
+      const tokenStart: number = matched.search(/\s+/);
+      const prefix: string = matched.slice(0, tokenStart + 1); // 'Bearer '
+      const token: string = matched.slice(tokenStart + 1);
+      return prefix + defaultRevealReplacement(token, 'token', settings);
+    },
+  },
+  // JWT (eyJ + .* + .*)
+  { kind: 'jwt', regex: /\beyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\b/g },
+  // AWS Access Key
+  { kind: 'aws-access-key', regex: /\bAKIA[0-9A-Z]{16}\b/g },
+  // Env-style secret-name = value
+  {
+    kind:       'env-style-secret',
+    regex:      /\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE)[A-Z0-9_]*)\s*[:=]\s*['"]?([^\s'"]+)['"]?/g,
+    redactWith: (matched: string, settings: DyFM_SecretMask_Settings_Interface): string => {
+      // Pull out the key name + value via re-match (avoids capturing groups in redactWith signature)
+      const m: RegExpMatchArray | null = matched.match(/\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE)[A-Z0-9_]*)\s*[:=]\s*['"]?([^\s'"]+)/);
+      if (!m) { return matched; }
+      const keyName: string = m[1];
+      const value: string = m[2];
+      const sep: string = matched.includes(': ') ? '=' : '=';
+      const revealed: string = defaultRevealReplacement(value, 'env-value', settings);
+      return `${keyName}${sep}${revealed}`;
+    },
+  },
+];
+
+/**
+ * `process.env`-bol kigyujti azokat a kulcsokat ahol a NEV titkos-jellegu
+ * ÉS a value >= minEnvValueLength. Visszaad egy listat — ezeket szovegben
+ * minden elofordulasban partial-reveal-el felulrak-juk.
+ */
+const collectEnvSecretValues = (
+  settings: DyFM_SecretMask_Settings_Interface,
+): { value: string; key: string }[] => {
+  const out: { value: string; key: string }[] = [];
+  for (const [key, raw] of Object.entries(process.env)) {
+    if (!raw || raw.length < settings.minEnvValueLength) { continue; }
+    if (!settings.envNameSecretRx.test(key)) { continue; }
+    if (/^(true|false|0|1)$/i.test(raw)) { continue; }
+    out.push({ value: raw, key: key });
+  }
+  // Sort by value length DESC — hosszabb ertekekkel kezdjuk, igy egy rovid
+  // prefix nem sealeze el a hosszabb kornyezetet.
+  out.sort((a, b): number => b.value.length - a.value.length);
+  return out;
+};
+
+/**
+ * `DyFM_maskSecrets` — universal pre-Discord-send + pre-log-persist masking.
+ *
+ * @param text bemenet (ha nem string, JSON-szerializalaskor maskoljuk)
+ * @param settings  konfiguracio (default a DyFM_DEFAULT_SECRET_MASK_SETTINGS)
+ * @returns maszkolt szoveg
+ */
+export function DyFM_maskSecrets(
+  text: unknown,
+  settings: DyFM_SecretMask_Settings_Interface = DyFM_DEFAULT_SECRET_MASK_SETTINGS,
+): string {
+  if (text === null || text === undefined) { return ''; }
+  let str: string;
+  if (typeof text === 'string') {
+    str = text;
+  } else {
+    try { str = JSON.stringify(text); }
+    catch { str = String(text); }
+  }
+
+  // 1. PATTERN-based maszkolas
+  for (const p of DyFM_SECRET_PATTERNS) {
+    str = str.replace(p.regex, (matched: string, ...groups: string[]): string => {
+      // Drop the `offset` + `wholeString` args at the end of `groups`
+      if (p.redactWith) {
+        return p.redactWith(matched, settings)
+          .replace(/\$1/g, groups[0] ?? '')
+          .replace(/\$2/g, groups[1] ?? '');
+      }
+      // Default: partial-reveal with kind
+      return defaultRevealReplacement(matched, p.kind, settings);
+    });
+  }
+
+  // 2. ENV-secret value-alapu overlay
+  const envSecrets: { value: string; key: string }[] = collectEnvSecretValues(settings);
+  for (const { value, key } of envSecrets) {
+    if (!str.includes(value)) { continue; }
+    const revealed: string = defaultRevealReplacement(value, `env-${key}`, settings);
+    str = str.split(value).join(revealed);
+  }
+
+  return str;
+}
+
+/**
+ * Recursive object-masker — JSON-szeru struktura minden string-ertekeben alkalmazza
+ * a DyFM_maskSecrets-t. Pl. errors-table additionalContent / logTail tomb / cdpReport
+ * objektum elotti masking-hez.
+ */
+export function DyFM_maskSecretsDeep<T = unknown>(
+  input: T,
+  settings: DyFM_SecretMask_Settings_Interface = DyFM_DEFAULT_SECRET_MASK_SETTINGS,
+): T {
+  if (input === null || input === undefined) { return input; }
+  if (typeof input === 'string') {
+    return DyFM_maskSecrets(input, settings) as unknown as T;
+  }
+  if (typeof input !== 'object') { return input; }
+  if (Array.isArray(input)) {
+    return (input as unknown[]).map((it: unknown): unknown => DyFM_maskSecretsDeep(it, settings)) as unknown as T;
+  }
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(input as Record<string, unknown>)) {
+    out[k] = DyFM_maskSecretsDeep(v, settings);
+  }
+  return out as unknown as T;
+}

package/src/index.ts

@@ -15,6 +15,7 @@ export * from './_collections/utils/extract-error-message.util';
 export * from './_collections/utils/json-error-helper.util';
 export * from './_collections/utils/log.util';
 export * from './_collections/utils/round-list.util';
+export * from './_collections/utils/secret-mask.util';
 export * from './_collections/utils/object.util';
 export * from './_collections/utils/require-env.util';
 export * from './_collections/utils/stack.util';