@futdevpro/fsm-dynamo 1.16.37 → 1.16.39

package/build/_collections/utils/secret-mask.util.js

@@ -1,223 +1,223 @@
-"use strict";
-/**
- * FR-093 (2026-06-09) — Universal secret/key masking utility (bedrock level).
- *
- * Lehetove teszi az ALL-FDP-systems-szintu secret-szivargas-detection +
- * maszkolas-t egy bedrock-szinten. A korabban Overseer / runner-worker
- * helyi util-jai (FR-092) most ezt importaljak — egy SOR konfiguracio +
- * find-and-replace.
- *
- * User feedback ('az osszes rendszerunknek a lenyege az univerzalizalt,
- * mindenhol hasznalhato, egysegesített megoldások'): every secret-pattern
- * ennek a egyetlen DyFM_SecretMask_Util-nak a felelossege.
- *
- * Strategy — KETTOS:
- *   1. **PATTERN-based**: ismert secret-formatumokra automatikus felismeres.
- *   2. **VALUE-based**: a process.env-jenek secret-erteket overlay-eli minden szovegben.
- *
- * Identifiability config (`DyFM_SecretMask_Settings.partialReveal`):
- *   - DEFAULT: `{ prefix: 4, suffix: 4 }` — a kulcsok elso 4 + utolso 4 char-ja
- *     megorzodik, kozeppe `[redacted-<KIND>]` keruln, pl.:
- *       `ghp_abcdefghij1234567890abcdefghij12345678` → `ghp_abcd...5678 [redacted-github-pat]`
- *   - User-extensible: csokkentett vagy 0-os reveal a tobb-biztonsagos
- *     deploymentekhez (`{ prefix: 0, suffix: 0 }` → tisztan opaque).
- *
- * Per memory `[[feedback_rich_error_handling]]`: a maszkolt token jelzes ne
- * legyen `***` opaque; legyen `[redacted-<KIND>]` hogy ranezessel lassuk MILYEN
- * tipusu szivargast szuntunk meg.
- *
- * Pattern-mapping per memory `[[feedback_individual_plans]]` — single source of
- * truth: minden uj secret-format hozzaadando a `DyFM_SECRET_PATTERNS` array-hez;
- * a tobbi rendszerben (Overseer/runner/bedrock packages) automatikusan
- * megjelenik a fsm-bump utan.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DyFM_SECRET_PATTERNS = exports.DyFM_DEFAULT_SECRET_MASK_SETTINGS = void 0;
-exports.DyFM_maskSecrets = DyFM_maskSecrets;
-exports.DyFM_maskSecretsDeep = DyFM_maskSecretsDeep;
-exports.DyFM_DEFAULT_SECRET_MASK_SETTINGS = {
-    partialReveal: {
-        prefix: 4,
-        suffix: 4,
-    },
-    minEnvValueLength: 8,
-    envNameSecretRx: /(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE|CREDENTIAL|API_KEY|WEBHOOK)/i,
-};
-const defaultRevealReplacement = (matched, kind, settings) => {
-    const p = Math.max(0, settings.partialReveal.prefix);
-    const s = Math.max(0, settings.partialReveal.suffix);
-    // Ha a kulcs tul rovid az osszes reveal-osszeghez kepest, ne reveal-juk
-    // (kulonben az egesz secret elerhetonek osszetapadna).
-    if (matched.length <= p + s + 4) {
-        return `[redacted-${kind}]`;
-    }
-    if (p === 0 && s === 0) {
-        return `[redacted-${kind}]`;
-    }
-    const head = matched.slice(0, p);
-    const tail = matched.slice(matched.length - s);
-    return `${head}...${tail} [redacted-${kind}]`;
-};
-exports.DyFM_SECRET_PATTERNS = [
-    // URL-embedded basic auth — BARMELY scheme (`http(s)`, `mongodb`, `postgres`, `redis`,
-    // `amqp`, `mysql` stb.), nem csak http: a `mongodb://user:pass@host` connection-string a
-    // leggyakoribb DB-secret-leak vektor a CI-logokban. A `user:pass@` szerkezet kotelezo →
-    // nincs false-positive a sima URL-ekre (port `host:8080/` sem, mert nincs utana `@`).
-    // A sajat replace-pattern megorzi a scheme-et ($1) + host-ot.
-    {
-        kind: 'url-cred',
-        regex: /\b([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]*):([^\s@]+)@/gi,
-        redactWith: (_m) => '$1[redacted-url-cred]@',
-    },
-    // GitHub PATs
-    { kind: 'github-pat', regex: /\bgh[ps]_[A-Za-z0-9]{36,}\b/g },
-    { kind: 'github-pat-fine', regex: /\bgithub_pat_[A-Za-z0-9_]{82,}\b/g },
-    { kind: 'github-oauth', regex: /\bgho_[A-Za-z0-9]{36,}\b/g },
-    { kind: 'github-refresh', regex: /\bghr_[A-Za-z0-9]{36,}\b/g },
-    // NPM token
-    { kind: 'npm-token', regex: /\bnpm_[A-Za-z0-9]{36,}\b/g },
-    // Docker Hub PAT
-    { kind: 'docker-pat', regex: /\bdckr_pat_[A-Za-z0-9_\-]{20,}\b/g },
-    // Slack token
-    { kind: 'slack-token', regex: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g },
-    // Anthropic key (BEFORE OpenAI — `sk-ant-*` more specific than `sk-*`)
-    { kind: 'anthropic-key', regex: /\bsk-ant-[A-Za-z0-9\-_]{32,}\b/g },
-    // OpenAI / generic `sk-*` key
-    { kind: 'openai-key', regex: /\bsk-[A-Za-z0-9]{32,}\b/g },
-    // Google API key
-    { kind: 'google-api-key', regex: /\bAIza[0-9A-Za-z\-_]{35}\b/g },
-    // Discord webhook URL (id + token in URL)
-    {
-        kind: 'discord-webhook',
-        regex: /\bhttps?:\/\/(?:discord(?:app)?\.com|discordapp\.com)\/api\/webhooks\/\d+\/[A-Za-z0-9_\-]+/g,
-        redactWith: (_m) => '[redacted-discord-webhook]',
-    },
-    // Bearer token in HTTP header style — megorizzuk a 'Bearer ' prefixet (literally), a token-t pedig reveal-eljuk.
-    {
-        kind: 'bearer-token',
-        regex: /\b(Bearer)\s+([A-Za-z0-9\-._~+/=]{20,})/gi,
-        redactWith: (matched, settings) => {
-            const tokenStart = matched.search(/\s+/);
-            const prefix = matched.slice(0, tokenStart + 1); // 'Bearer '
-            const token = matched.slice(tokenStart + 1);
-            return prefix + defaultRevealReplacement(token, 'token', settings);
-        },
-    },
-    // JWT (eyJ + .* + .*)
-    { kind: 'jwt', regex: /\beyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\b/g },
-    // AWS Access Key
-    { kind: 'aws-access-key', regex: /\bAKIA[0-9A-Z]{16}\b/g },
-    // Env-style secret-name = value
-    {
-        kind: 'env-style-secret',
-        regex: /\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE)[A-Z0-9_]*)\s*[:=]\s*['"]?([^\s'"]+)['"]?/g,
-        redactWith: (matched, settings) => {
-            // Pull out the key name + value via re-match (avoids capturing groups in redactWith signature)
-            const m = matched.match(/\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE)[A-Z0-9_]*)\s*[:=]\s*['"]?([^\s'"]+)/);
-            if (!m) {
-                return matched;
-            }
-            const keyName = m[1];
-            const value = m[2];
-            const sep = matched.includes(': ') ? '=' : '=';
-            const revealed = defaultRevealReplacement(value, 'env-value', settings);
-            return `${keyName}${sep}${revealed}`;
-        },
-    },
-];
-/**
- * `process.env`-bol kigyujti azokat a kulcsokat ahol a NEV titkos-jellegu
- * ÉS a value >= minEnvValueLength. Visszaad egy listat — ezeket szovegben
- * minden elofordulasban partial-reveal-el felulrak-juk.
- */
-const collectEnvSecretValues = (settings) => {
-    const out = [];
-    for (const [key, raw] of Object.entries(process.env)) {
-        if (!raw || raw.length < settings.minEnvValueLength) {
-            continue;
-        }
-        if (!settings.envNameSecretRx.test(key)) {
-            continue;
-        }
-        if (/^(true|false|0|1)$/i.test(raw)) {
-            continue;
-        }
-        out.push({ value: raw, key: key });
-    }
-    // Sort by value length DESC — hosszabb ertekekkel kezdjuk, igy egy rovid
-    // prefix nem sealeze el a hosszabb kornyezetet.
-    out.sort((a, b) => b.value.length - a.value.length);
-    return out;
-};
-/**
- * `DyFM_maskSecrets` — universal pre-Discord-send + pre-log-persist masking.
- *
- * @param text bemenet (ha nem string, JSON-szerializalaskor maskoljuk)
- * @param settings  konfiguracio (default a DyFM_DEFAULT_SECRET_MASK_SETTINGS)
- * @returns maszkolt szoveg
- */
-function DyFM_maskSecrets(text, settings = exports.DyFM_DEFAULT_SECRET_MASK_SETTINGS) {
-    if (text === null || text === undefined) {
-        return '';
-    }
-    let str;
-    if (typeof text === 'string') {
-        str = text;
-    }
-    else {
-        try {
-            str = JSON.stringify(text);
-        }
-        catch {
-            str = String(text);
-        }
-    }
-    // 1. PATTERN-based maszkolas
-    for (const p of exports.DyFM_SECRET_PATTERNS) {
-        str = str.replace(p.regex, (matched, ...groups) => {
-            // Drop the `offset` + `wholeString` args at the end of `groups`
-            if (p.redactWith) {
-                return p.redactWith(matched, settings)
-                    .replace(/\$1/g, groups[0] ?? '')
-                    .replace(/\$2/g, groups[1] ?? '');
-            }
-            // Default: partial-reveal with kind
-            return defaultRevealReplacement(matched, p.kind, settings);
-        });
-    }
-    // 2. ENV-secret value-alapu overlay
-    const envSecrets = collectEnvSecretValues(settings);
-    for (const { value, key } of envSecrets) {
-        if (!str.includes(value)) {
-            continue;
-        }
-        const revealed = defaultRevealReplacement(value, `env-${key}`, settings);
-        str = str.split(value).join(revealed);
-    }
-    return str;
-}
-/**
- * Recursive object-masker — JSON-szeru struktura minden string-ertekeben alkalmazza
- * a DyFM_maskSecrets-t. Pl. errors-table additionalContent / logTail tomb / cdpReport
- * objektum elotti masking-hez.
- */
-function DyFM_maskSecretsDeep(input, settings = exports.DyFM_DEFAULT_SECRET_MASK_SETTINGS) {
-    if (input === null || input === undefined) {
-        return input;
-    }
-    if (typeof input === 'string') {
-        return DyFM_maskSecrets(input, settings);
-    }
-    if (typeof input !== 'object') {
-        return input;
-    }
-    if (Array.isArray(input)) {
-        return input.map((it) => DyFM_maskSecretsDeep(it, settings));
-    }
-    const out = {};
-    for (const [k, v] of Object.entries(input)) {
-        out[k] = DyFM_maskSecretsDeep(v, settings);
-    }
-    return out;
-}
+"use strict";
+/**
+ * FR-093 (2026-06-09) — Universal secret/key masking utility (bedrock level).
+ *
+ * Lehetove teszi az ALL-FDP-systems-szintu secret-szivargas-detection +
+ * maszkolas-t egy bedrock-szinten. A korabban Overseer / runner-worker
+ * helyi util-jai (FR-092) most ezt importaljak — egy SOR konfiguracio +
+ * find-and-replace.
+ *
+ * User feedback ('az osszes rendszerunknek a lenyege az univerzalizalt,
+ * mindenhol hasznalhato, egysegesített megoldások'): every secret-pattern
+ * ennek a egyetlen DyFM_SecretMask_Util-nak a felelossege.
+ *
+ * Strategy — KETTOS:
+ *   1. **PATTERN-based**: ismert secret-formatumokra automatikus felismeres.
+ *   2. **VALUE-based**: a process.env-jenek secret-erteket overlay-eli minden szovegben.
+ *
+ * Identifiability config (`DyFM_SecretMask_Settings.partialReveal`):
+ *   - DEFAULT: `{ prefix: 4, suffix: 4 }` — a kulcsok elso 4 + utolso 4 char-ja
+ *     megorzodik, kozeppe `[redacted-<KIND>]` keruln, pl.:
+ *       `ghp_abcdefghij1234567890abcdefghij12345678` → `ghp_abcd...5678 [redacted-github-pat]`
+ *   - User-extensible: csokkentett vagy 0-os reveal a tobb-biztonsagos
+ *     deploymentekhez (`{ prefix: 0, suffix: 0 }` → tisztan opaque).
+ *
+ * Per memory `[[feedback_rich_error_handling]]`: a maszkolt token jelzes ne
+ * legyen `***` opaque; legyen `[redacted-<KIND>]` hogy ranezessel lassuk MILYEN
+ * tipusu szivargast szuntunk meg.
+ *
+ * Pattern-mapping per memory `[[feedback_individual_plans]]` — single source of
+ * truth: minden uj secret-format hozzaadando a `DyFM_SECRET_PATTERNS` array-hez;
+ * a tobbi rendszerben (Overseer/runner/bedrock packages) automatikusan
+ * megjelenik a fsm-bump utan.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyFM_SECRET_PATTERNS = exports.DyFM_DEFAULT_SECRET_MASK_SETTINGS = void 0;
+exports.DyFM_maskSecrets = DyFM_maskSecrets;
+exports.DyFM_maskSecretsDeep = DyFM_maskSecretsDeep;
+exports.DyFM_DEFAULT_SECRET_MASK_SETTINGS = {
+    partialReveal: {
+        prefix: 4,
+        suffix: 4,
+    },
+    minEnvValueLength: 8,
+    envNameSecretRx: /(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE|CREDENTIAL|API_KEY|WEBHOOK)/i,
+};
+const defaultRevealReplacement = (matched, kind, settings) => {
+    const p = Math.max(0, settings.partialReveal.prefix);
+    const s = Math.max(0, settings.partialReveal.suffix);
+    // Ha a kulcs tul rovid az osszes reveal-osszeghez kepest, ne reveal-juk
+    // (kulonben az egesz secret elerhetonek osszetapadna).
+    if (matched.length <= p + s + 4) {
+        return `[redacted-${kind}]`;
+    }
+    if (p === 0 && s === 0) {
+        return `[redacted-${kind}]`;
+    }
+    const head = matched.slice(0, p);
+    const tail = matched.slice(matched.length - s);
+    return `${head}...${tail} [redacted-${kind}]`;
+};
+exports.DyFM_SECRET_PATTERNS = [
+    // URL-embedded basic auth — BARMELY scheme (`http(s)`, `mongodb`, `postgres`, `redis`,
+    // `amqp`, `mysql` stb.), nem csak http: a `mongodb://user:pass@host` connection-string a
+    // leggyakoribb DB-secret-leak vektor a CI-logokban. A `user:pass@` szerkezet kotelezo →
+    // nincs false-positive a sima URL-ekre (port `host:8080/` sem, mert nincs utana `@`).
+    // A sajat replace-pattern megorzi a scheme-et ($1) + host-ot.
+    {
+        kind: 'url-cred',
+        regex: /\b([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]*):([^\s@]+)@/gi,
+        redactWith: (_m) => '$1[redacted-url-cred]@',
+    },
+    // GitHub PATs
+    { kind: 'github-pat', regex: /\bgh[ps]_[A-Za-z0-9]{36,}\b/g },
+    { kind: 'github-pat-fine', regex: /\bgithub_pat_[A-Za-z0-9_]{82,}\b/g },
+    { kind: 'github-oauth', regex: /\bgho_[A-Za-z0-9]{36,}\b/g },
+    { kind: 'github-refresh', regex: /\bghr_[A-Za-z0-9]{36,}\b/g },
+    // NPM token
+    { kind: 'npm-token', regex: /\bnpm_[A-Za-z0-9]{36,}\b/g },
+    // Docker Hub PAT
+    { kind: 'docker-pat', regex: /\bdckr_pat_[A-Za-z0-9_\-]{20,}\b/g },
+    // Slack token
+    { kind: 'slack-token', regex: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g },
+    // Anthropic key (BEFORE OpenAI — `sk-ant-*` more specific than `sk-*`)
+    { kind: 'anthropic-key', regex: /\bsk-ant-[A-Za-z0-9\-_]{32,}\b/g },
+    // OpenAI / generic `sk-*` key
+    { kind: 'openai-key', regex: /\bsk-[A-Za-z0-9]{32,}\b/g },
+    // Google API key
+    { kind: 'google-api-key', regex: /\bAIza[0-9A-Za-z\-_]{35}\b/g },
+    // Discord webhook URL (id + token in URL)
+    {
+        kind: 'discord-webhook',
+        regex: /\bhttps?:\/\/(?:discord(?:app)?\.com|discordapp\.com)\/api\/webhooks\/\d+\/[A-Za-z0-9_\-]+/g,
+        redactWith: (_m) => '[redacted-discord-webhook]',
+    },
+    // Bearer token in HTTP header style — megorizzuk a 'Bearer ' prefixet (literally), a token-t pedig reveal-eljuk.
+    {
+        kind: 'bearer-token',
+        regex: /\b(Bearer)\s+([A-Za-z0-9\-._~+/=]{20,})/gi,
+        redactWith: (matched, settings) => {
+            const tokenStart = matched.search(/\s+/);
+            const prefix = matched.slice(0, tokenStart + 1); // 'Bearer '
+            const token = matched.slice(tokenStart + 1);
+            return prefix + defaultRevealReplacement(token, 'token', settings);
+        },
+    },
+    // JWT (eyJ + .* + .*)
+    { kind: 'jwt', regex: /\beyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\b/g },
+    // AWS Access Key
+    { kind: 'aws-access-key', regex: /\bAKIA[0-9A-Z]{16}\b/g },
+    // Env-style secret-name = value
+    {
+        kind: 'env-style-secret',
+        regex: /\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE)[A-Z0-9_]*)\s*[:=]\s*['"]?([^\s'"]+)['"]?/g,
+        redactWith: (matched, settings) => {
+            // Pull out the key name + value via re-match (avoids capturing groups in redactWith signature)
+            const m = matched.match(/\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE)[A-Z0-9_]*)\s*[:=]\s*['"]?([^\s'"]+)/);
+            if (!m) {
+                return matched;
+            }
+            const keyName = m[1];
+            const value = m[2];
+            const sep = matched.includes(': ') ? '=' : '=';
+            const revealed = defaultRevealReplacement(value, 'env-value', settings);
+            return `${keyName}${sep}${revealed}`;
+        },
+    },
+];
+/**
+ * `process.env`-bol kigyujti azokat a kulcsokat ahol a NEV titkos-jellegu
+ * ÉS a value >= minEnvValueLength. Visszaad egy listat — ezeket szovegben
+ * minden elofordulasban partial-reveal-el felulrak-juk.
+ */
+const collectEnvSecretValues = (settings) => {
+    const out = [];
+    for (const [key, raw] of Object.entries(process.env)) {
+        if (!raw || raw.length < settings.minEnvValueLength) {
+            continue;
+        }
+        if (!settings.envNameSecretRx.test(key)) {
+            continue;
+        }
+        if (/^(true|false|0|1)$/i.test(raw)) {
+            continue;
+        }
+        out.push({ value: raw, key: key });
+    }
+    // Sort by value length DESC — hosszabb ertekekkel kezdjuk, igy egy rovid
+    // prefix nem sealeze el a hosszabb kornyezetet.
+    out.sort((a, b) => b.value.length - a.value.length);
+    return out;
+};
+/**
+ * `DyFM_maskSecrets` — universal pre-Discord-send + pre-log-persist masking.
+ *
+ * @param text bemenet (ha nem string, JSON-szerializalaskor maskoljuk)
+ * @param settings  konfiguracio (default a DyFM_DEFAULT_SECRET_MASK_SETTINGS)
+ * @returns maszkolt szoveg
+ */
+function DyFM_maskSecrets(text, settings = exports.DyFM_DEFAULT_SECRET_MASK_SETTINGS) {
+    if (text === null || text === undefined) {
+        return '';
+    }
+    let str;
+    if (typeof text === 'string') {
+        str = text;
+    }
+    else {
+        try {
+            str = JSON.stringify(text);
+        }
+        catch {
+            str = String(text);
+        }
+    }
+    // 1. PATTERN-based maszkolas
+    for (const p of exports.DyFM_SECRET_PATTERNS) {
+        str = str.replace(p.regex, (matched, ...groups) => {
+            // Drop the `offset` + `wholeString` args at the end of `groups`
+            if (p.redactWith) {
+                return p.redactWith(matched, settings)
+                    .replace(/\$1/g, groups[0] ?? '')
+                    .replace(/\$2/g, groups[1] ?? '');
+            }
+            // Default: partial-reveal with kind
+            return defaultRevealReplacement(matched, p.kind, settings);
+        });
+    }
+    // 2. ENV-secret value-alapu overlay
+    const envSecrets = collectEnvSecretValues(settings);
+    for (const { value, key } of envSecrets) {
+        if (!str.includes(value)) {
+            continue;
+        }
+        const revealed = defaultRevealReplacement(value, `env-${key}`, settings);
+        str = str.split(value).join(revealed);
+    }
+    return str;
+}
+/**
+ * Recursive object-masker — JSON-szeru struktura minden string-ertekeben alkalmazza
+ * a DyFM_maskSecrets-t. Pl. errors-table additionalContent / logTail tomb / cdpReport
+ * objektum elotti masking-hez.
+ */
+function DyFM_maskSecretsDeep(input, settings = exports.DyFM_DEFAULT_SECRET_MASK_SETTINGS) {
+    if (input === null || input === undefined) {
+        return input;
+    }
+    if (typeof input === 'string') {
+        return DyFM_maskSecrets(input, settings);
+    }
+    if (typeof input !== 'object') {
+        return input;
+    }
+    if (Array.isArray(input)) {
+        return input.map((it) => DyFM_maskSecretsDeep(it, settings));
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(input)) {
+        out[k] = DyFM_maskSecretsDeep(v, settings);
+    }
+    return out;
+}
 //# sourceMappingURL=secret-mask.util.js.map

package/build/_collections/utils/secret-mask.util.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secret-mask.util.spec.d.ts.map

package/build/_collections/utils/secret-mask.util.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-mask.util.spec.d.ts","sourceRoot":"","sources":["../../../src/_collections/utils/secret-mask.util.spec.ts"],"names":[],"mappings":""}

package/build/_collections/utils/secret-mask.util.spec.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const secret_mask_util_1 = require("./secret-mask.util");
+/**
+ * Spec: `DyFM_SecretMask_Util` (FR-093) — secret/kulcs redaction.
+ * Fokusz: az `url-cred` pattern BARMELY scheme-et fogja (nem csak http), es a nem-secret
+ * tartalom (commit-SHA / verzio / sima URL) valtozatlan marad.
+ */
+describe('| DyFM_maskSecrets — url-cred (any scheme)', () => {
+    it('| masks http(s) basic-auth creds (keeps scheme + host)', () => {
+        expect((0, secret_mask_util_1.DyFM_maskSecrets)('https://user:p4ssw0rd123@api.example.com'))
+            .toBe('https://[redacted-url-cred]@api.example.com');
+    });
+    it('| masks mongodb / postgres / redis connection-string creds', () => {
+        expect((0, secret_mask_util_1.DyFM_maskSecrets)('mongodb://admin:supersecretpw@db:27017/app'))
+            .toBe('mongodb://[redacted-url-cred]@db:27017/app');
+        expect((0, secret_mask_util_1.DyFM_maskSecrets)('postgres://u:pw123456@h/db')).toContain('postgres://[redacted-url-cred]@');
+        expect((0, secret_mask_util_1.DyFM_maskSecrets)('redis://:authpass99@cache:6379')).toContain('redis://[redacted-url-cred]@');
+        expect((0, secret_mask_util_1.DyFM_maskSecrets)('mongodb://admin:supersecretpw@db:27017/app')).not.toContain('supersecretpw');
+    });
+    it('| is case-insensitive on the scheme', () => {
+        expect((0, secret_mask_util_1.DyFM_maskSecrets)('MONGODB://a:secretval1@h')).toContain('[redacted-url-cred]');
+    });
+    it('| does NOT touch credential-less URLs (port is not a false positive)', () => {
+        expect((0, secret_mask_util_1.DyFM_maskSecrets)('https://example.com:8080/path')).toBe('https://example.com:8080/path');
+        expect((0, secret_mask_util_1.DyFM_maskSecrets)('mongodb://db:27017/app')).toBe('mongodb://db:27017/app');
+    });
+});
+describe('| DyFM_maskSecrets — token patterns (regression)', () => {
+    it('| masks a github PAT', () => {
+        const out = (0, secret_mask_util_1.DyFM_maskSecrets)('token ghp_0123456789abcdef0123456789abcdef0123 here');
+        expect(out).toContain('[redacted-github-pat]');
+        expect(out).not.toContain('ghp_0123456789abcdef0123456789abcdef0123');
+    });
+    it('| masks an env-style secret assignment', () => {
+        expect((0, secret_mask_util_1.DyFM_maskSecrets)('GITHUB_TOKEN=ghp_0123456789abcdef0123456789abcdef0123')).toContain('[redacted');
+    });
+});
+describe('| DyFM_maskSecrets — non-secrets are untouched', () => {
+    it('| leaves a commit SHA and a version untouched', () => {
+        expect((0, secret_mask_util_1.DyFM_maskSecrets)('a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2')).toBe('a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2');
+        expect((0, secret_mask_util_1.DyFM_maskSecrets)('v01.15.204')).toBe('v01.15.204');
+    });
+});
+describe('| DyFM_maskSecretsDeep', () => {
+    it('| masks string values recursively, leaves non-secret structure intact', () => {
+        const out = (0, secret_mask_util_1.DyFM_maskSecretsDeep)({
+            steps: { deploy: { errors: [{ text: 'mongodb://admin:supersecretpw@db:27017' }] } },
+            version: '01.15.204',
+            sha: 'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2',
+        });
+        expect(JSON.stringify(out)).not.toContain('supersecretpw');
+        expect(out.version).toBe('01.15.204');
+        expect(out.sha).toBe('a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2');
+    });
+});
+//# sourceMappingURL=secret-mask.util.spec.js.map

package/build/_collections/utils/secret-mask.util.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-mask.util.spec.js","sourceRoot":"","sources":["../../../src/_collections/utils/secret-mask.util.spec.ts"],"names":[],"mappings":";;AAAA,yDAA4E;AAE5E;;;;GAIG;AACH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAE1D,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,IAAA,mCAAgB,EAAC,0CAA0C,CAAC,CAAC;aACjE,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,IAAA,mCAAgB,EAAC,4CAA4C,CAAC,CAAC;aACnE,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACtD,MAAM,CAAC,IAAA,mCAAgB,EAAC,4BAA4B,CAAC,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACpG,MAAM,CAAC,IAAA,mCAAgB,EAAC,gCAAgC,CAAC,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACrG,MAAM,CAAC,IAAA,mCAAgB,EAAC,4CAA4C,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,IAAA,mCAAgB,EAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,IAAA,mCAAgB,EAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAChG,MAAM,CAAC,IAAA,mCAAgB,EAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAEhE,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,GAAG,GAAW,IAAA,mCAAgB,EAAC,qDAAqD,CAAC,CAAC;QAC5F,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,IAAA,mCAAgB,EAAC,uDAAuD,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAE9D,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,IAAA,mCAAgB,EAAC,0CAA0C,CAAC,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACtH,MAAM,CAAC,IAAA,mCAAgB,EAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IAEtC,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,GAAG,GAAG,IAAA,uCAAoB,EAAC;YAC/B,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC,EAAE,EAAE;YACnF,OAAO,EAAE,WAAW;YACpB,GAAG,EAAE,0CAA0C;SAChD,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/build/_collections/utils/stack.util.d.ts

@@ -1,27 +1,27 @@
-/**
- * Get the stack location of the constructor call
- * use it in the constructor of a class to get the stack location of the constructor call
- * @param level - The level of the stack to get the location of
- * @returns The stack location of the constructor call
- *
- * @example
- * ```ts
- * const stackLocation = DyFM_getConstructionStackLocation();
- * console.log(stackLocation); // The stack location of the constructor call
- * ```
- */
-export declare function DyFM_getConstructionStackLocation(level?: number): string;
-/**
- * Get the stack location of the local call
- * use it in the local function to get the stack location of the local call
- * @param level - The level of the stack to get the location of
- * @returns The stack location of the local call
- *
- * @example
- * ```ts
- * const stackLocation = DyFM_getLocalStackLocation(1);
- * console.log(stackLocation); // The stack location of the local call
- * ```
- */
-export declare function DyFM_getLocalStackLocation(level?: number): string;
+/**
+ * Get the stack location of the constructor call
+ * use it in the constructor of a class to get the stack location of the constructor call
+ * @param level - The level of the stack to get the location of
+ * @returns The stack location of the constructor call
+ *
+ * @example
+ * ```ts
+ * const stackLocation = DyFM_getConstructionStackLocation();
+ * console.log(stackLocation); // The stack location of the constructor call
+ * ```
+ */
+export declare function DyFM_getConstructionStackLocation(level?: number): string;
+/**
+ * Get the stack location of the local call
+ * use it in the local function to get the stack location of the local call
+ * @param level - The level of the stack to get the location of
+ * @returns The stack location of the local call
+ *
+ * @example
+ * ```ts
+ * const stackLocation = DyFM_getLocalStackLocation(1);
+ * console.log(stackLocation); // The stack location of the local call
+ * ```
+ */
+export declare function DyFM_getLocalStackLocation(level?: number): string;
 //# sourceMappingURL=stack.util.d.ts.map