@futdevpro/fsm-dynamo 1.20.9 → 1.20.12

package/src/_collections/utils/round-list.util.spec.ts

@@ -1,79 +0,0 @@
-
-import { DyFM_RoundList } from './round-list.util';
-
-describe('| DyFM_RoundList', () => {
-
-  describe('| getOutboundedIndex', () => {
-    it('| should throw an error if listLength is 0', () => {
-      expect(() => DyFM_RoundList.getOutboundedIndex(0, 5)).toThrowError('roundListPlusIndex failed. list is empty!');
-    });
-
-    it('| should return correct index for positive outboundIndex within bounds', () => {
-      expect(DyFM_RoundList.getOutboundedIndex(5, 3)).toBe(3);
-    });
-
-    it('| should return correct index for positive outboundIndex out of bounds', () => {
-      expect(DyFM_RoundList.getOutboundedIndex(5, 7)).toBe(2);
-    });
-
-    it('| should return correct index for negative outboundIndex', () => {
-      expect(DyFM_RoundList.getOutboundedIndex(5, -2)).toBe(3);
-    });
-  });
-
-  describe('| getIndexOpposite', () => {
-    it('| should return the opposite index in a circular manner', () => {
-      expect(DyFM_RoundList.getIndexOpposite(8, 7)).toBe(3);
-    });
-
-    it('| should handle even length arrays correctly', () => {
-      expect(DyFM_RoundList.getIndexOpposite(4, 1)).toBe(3);
-    });
-
-    it('| should handle odd length arrays correctly', () => {
-      expect(DyFM_RoundList.getIndexOpposite(5, 2)).toBe(0);
-    });
-  });
-
-  describe('| getListIndex', () => {
-    it('| should return the correct element for a given outboundIndex', () => {
-      const list = ['a', 'b', 'c', 'd'];
-      expect(DyFM_RoundList.getListIndex(list, 5)).toBe('b');
-    });
-
-    it('| should handle negative outboundIndex', () => {
-      const list = ['a', 'b', 'c', 'd'];
-      expect(DyFM_RoundList.getListIndex(list, -1)).toBe('d');
-    });
-  });
-
-  describe('| getListOpposite', () => {
-    it('| should return the opposite element in a circular manner', () => {
-      const list = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h'];
-      expect(DyFM_RoundList.getListOpposite(list, 'h')).toBe('d');
-    });
-
-    it('| should handle even length lists correctly', () => {
-      const list = ['a', 'b', 'c', 'd'];
-      expect(DyFM_RoundList.getListOpposite(list, 'b')).toBe('d');
-    });
-
-    it('| should handle odd length lists correctly', () => {
-      const list = ['a', 'b', 'c', 'd', 'e'];
-      expect(DyFM_RoundList.getListOpposite(list, 'c')).toBe('a');
-    });
-  });
-
-  describe('| getLast', () => {
-    it('| should return the last element of the list', () => {
-      const list = ['a', 'b', 'c'];
-      expect(DyFM_RoundList.getLast(list)).toBe('c');
-    });
-
-    it('| should return null for an empty list', () => {
-      const list: string[] = [];
-      expect(DyFM_RoundList.getLast(list)).toBeNull();
-    });
-  });
-
-});

package/src/_collections/utils/round-list.util.ts

@@ -1,162 +0,0 @@
-
-
-/**
- * This class is a collection of static methods for round list operations
- * A round list is a list that is circular
- * - after the last element, the first comes next
- */
-export class DyFM_RoundList {  
-  /**
-   * returns the outbound index of the list
-   * @param listLength 
-   * @param outboundIndex 
-   * @returns 
-   * 
-   * @example
-   * ```ts
-   * const listLength = 10;
-   * const outboundIndex = 15;
-   * const result = DyFM_RoundList.getOutboundedIndex(listLength, outboundIndex);
-   * console.log(result); // 5
-   * ```
-   */
-  static getOutboundedIndex(listLength: number, outboundIndex: number): number {
-    if (!listLength) {
-      throw new Error('roundListPlusIndex failed. list is empty!');
-    }
-  
-    if (outboundIndex < 0) {
-      outboundIndex = outboundIndex % listLength;
-      outboundIndex = listLength + outboundIndex;
-    }
-    
-    if (listLength <= outboundIndex) {
-      outboundIndex = outboundIndex % listLength;
-    }
-  
-    return outboundIndex;
-  }
-  
-  /**
-   * returns the index of the opposite element of the list
-   * - as they are circular, the opposite is at the half of the list
-   * - as it is circular, for the second half, the opposite is at the first half
-   * @param length 
-   * @param oppositeOf 
-   * @returns 
-   * 
-   * @example
-   * ```ts
-   * const length = 10;
-   * const oppositeOf = 5;
-   * const result = DyFM_RoundList.getIndexOpposite(length, oppositeOf);
-   * console.log(result); // 0
-   * ```
-   */
-  static getIndexOpposite(length: number, oppositeOf: number): number {
-    const plusIndex = oppositeOf + Math.round(length / 2);
-    const res = this.getOutboundedIndex(length, plusIndex);
-  
-    return res;
-  }
-  
-  /**
-   * returns the element at the outbound index of the list
-   * @param list 
-   * @param outboundIndex 
-   * @returns 
-   * 
-   * @example
-   * ```ts
-   * const list = [ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ];
-   * const outboundIndex = 15;
-   * const result = DyFM_RoundList.getListIndex(list, outboundIndex);
-   * console.log(result); // 5
-   * ```
-   */
-  static getListIndex<T>(list: T[], outboundIndex: number): T {
-    return list[this.getOutboundedIndex(list.length, outboundIndex)];
-  }
-  
-  /**
-   * returns the element at the opposite index of the list
-   * @param list 
-   * @param oppositeOf 
-   * @returns 
-   * 
-   * @example
-   * ```ts
-   * const list = [ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ];
-   * const oppositeOf = 5;
-   * const result = DyFM_RoundList.getListOpposite(list, oppositeOf);
-   * console.log(result); // 0
-   * ```
-   */
-  static getListOpposite<T>(list: T[], oppositeOf: T): T {
-    return list[this.getIndexOpposite(list.length, list.indexOf(oppositeOf))];
-  }
-  
-  /**
-   * returns the last element of the list
-   * returns null if the list is empty
-   * 
-   * @example
-   * ```ts
-   * const list = [ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ];
-   * const result = DyFM_RoundList.getLast(list);
-   * console.log(result); // 10
-   * ```
-   */
-  static getLast<T>(list: T[]): T | null {
-    if (0 < list.length) {
-      return list[list.length - 1];
-    } else {
-      return null;
-    }
-  }
-
-  /** 
-   * returns the opposite index as they circular
-   * so after the last index, the first comes next
-   * an array that has 8 elements, the opposite of 7 is 3
-   * */
-  /* static getRoundListOppositeIndex(
-    arrayLength: number, 
-    index: number, 
-    roundUp: boolean = false
-  ): number {
-    const oppositeIndex = index + (
-      roundUp ? 
-        Math.ceil(arrayLength / 2) : 
-        Math.floor(arrayLength / 2)
-    );
-
-    if (arrayLength <= oppositeIndex) {
-      return oppositeIndex - arrayLength;
-    } else {
-      return oppositeIndex;
-    }
-  }
-
-  static getRoundListOutboundIndex<T>(array: T[], index: number): T {
-    try {
-      while (array.length <= index) {
-        index -= array.length;
-      }
-  
-      while (index < 0) {
-        index += array.length;
-      }
-      
-      return array[index];
-    } catch (error) {
-      console.error(
-        'DyFM_Array.getRoundListOutboundIndex error:', error,
-        '\narray:', array,
-        '\nindex:', index
-      );
-      
-      return null;
-    }
-  } */
-}

package/src/_collections/utils/secret-mask.util.spec.ts

@@ -1,66 +0,0 @@
-import { DyFM_maskSecrets, DyFM_maskSecretsDeep } from './secret-mask.util';
-
-/**
- * Spec: `DyFM_SecretMask_Util` (FR-093) — secret/kulcs redaction.
- * Fokusz: az `url-cred` pattern BARMELY scheme-et fogja (nem csak http), es a nem-secret
- * tartalom (commit-SHA / verzio / sima URL) valtozatlan marad.
- */
-describe('| DyFM_maskSecrets — url-cred (any scheme)', () => {
-
-  it('| masks http(s) basic-auth creds (keeps scheme + host)', () => {
-    expect(DyFM_maskSecrets('https://user:p4ssw0rd123@api.example.com'))
-      .toBe('https://[redacted-url-cred]@api.example.com');
-  });
-
-  it('| masks mongodb / postgres / redis connection-string creds', () => {
-    expect(DyFM_maskSecrets('mongodb://admin:supersecretpw@db:27017/app'))
-      .toBe('mongodb://[redacted-url-cred]@db:27017/app');
-    expect(DyFM_maskSecrets('postgres://u:pw123456@h/db')).toContain('postgres://[redacted-url-cred]@');
-    expect(DyFM_maskSecrets('redis://:authpass99@cache:6379')).toContain('redis://[redacted-url-cred]@');
-    expect(DyFM_maskSecrets('mongodb://admin:supersecretpw@db:27017/app')).not.toContain('supersecretpw');
-  });
-
-  it('| is case-insensitive on the scheme', () => {
-    expect(DyFM_maskSecrets('MONGODB://a:secretval1@h')).toContain('[redacted-url-cred]');
-  });
-
-  it('| does NOT touch credential-less URLs (port is not a false positive)', () => {
-    expect(DyFM_maskSecrets('https://example.com:8080/path')).toBe('https://example.com:8080/path');
-    expect(DyFM_maskSecrets('mongodb://db:27017/app')).toBe('mongodb://db:27017/app');
-  });
-});
-
-describe('| DyFM_maskSecrets — token patterns (regression)', () => {
-
-  it('| masks a github PAT', () => {
-    const out: string = DyFM_maskSecrets('token ghp_0123456789abcdef0123456789abcdef0123 here');
-    expect(out).toContain('[redacted-github-pat]');
-    expect(out).not.toContain('ghp_0123456789abcdef0123456789abcdef0123');
-  });
-
-  it('| masks an env-style secret assignment', () => {
-    expect(DyFM_maskSecrets('GITHUB_TOKEN=ghp_0123456789abcdef0123456789abcdef0123')).toContain('[redacted');
-  });
-});
-
-describe('| DyFM_maskSecrets — non-secrets are untouched', () => {
-
-  it('| leaves a commit SHA and a version untouched', () => {
-    expect(DyFM_maskSecrets('a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2')).toBe('a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2');
-    expect(DyFM_maskSecrets('v01.15.204')).toBe('v01.15.204');
-  });
-});
-
-describe('| DyFM_maskSecretsDeep', () => {
-
-  it('| masks string values recursively, leaves non-secret structure intact', () => {
-    const out = DyFM_maskSecretsDeep({
-      steps: { deploy: { errors: [{ text: 'mongodb://admin:supersecretpw@db:27017' }] } },
-      version: '01.15.204',
-      sha: 'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2',
-    });
-    expect(JSON.stringify(out)).not.toContain('supersecretpw');
-    expect(out.version).toBe('01.15.204');
-    expect(out.sha).toBe('a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2');
-  });
-});

package/src/_collections/utils/secret-mask.util.ts

@@ -1,262 +0,0 @@
-/**
- * FR-093 (2026-06-09) — Universal secret/key masking utility (bedrock level).
- *
- * Lehetove teszi az ALL-FDP-systems-szintu secret-szivargas-detection +
- * maszkolas-t egy bedrock-szinten. A korabban Overseer / runner-worker
- * helyi util-jai (FR-092) most ezt importaljak — egy SOR konfiguracio +
- * find-and-replace.
- *
- * User feedback ('az osszes rendszerunknek a lenyege az univerzalizalt,
- * mindenhol hasznalhato, egysegesített megoldások'): every secret-pattern
- * ennek a egyetlen DyFM_SecretMask_Util-nak a felelossege.
- *
- * Strategy — KETTOS:
- *   1. **PATTERN-based**: ismert secret-formatumokra automatikus felismeres.
- *   2. **VALUE-based**: a process.env-jenek secret-erteket overlay-eli minden szovegben.
- *
- * Identifiability config (`DyFM_SecretMask_Settings.partialReveal`):
- *   - DEFAULT: `{ prefix: 4, suffix: 4 }` — a kulcsok elso 4 + utolso 4 char-ja
- *     megorzodik, kozeppe `[redacted-<KIND>]` keruln, pl.:
- *       `ghp_abcdefghij1234567890abcdefghij12345678` → `ghp_abcd...5678 [redacted-github-pat]`
- *   - User-extensible: csokkentett vagy 0-os reveal a tobb-biztonsagos
- *     deploymentekhez (`{ prefix: 0, suffix: 0 }` → tisztan opaque).
- *
- * Per memory `[[feedback_rich_error_handling]]`: a maszkolt token jelzes ne
- * legyen `***` opaque; legyen `[redacted-<KIND>]` hogy ranezessel lassuk MILYEN
- * tipusu szivargast szuntunk meg.
- *
- * Pattern-mapping per memory `[[feedback_individual_plans]]` — single source of
- * truth: minden uj secret-format hozzaadando a `DyFM_SECRET_PATTERNS` array-hez;
- * a tobbi rendszerben (Overseer/runner/bedrock packages) automatikusan
- * megjelenik a fsm-bump utan.
- */
-
-export interface DyFM_SecretMask_PartialReveal_Interface {
-  /** Megorzendo elso karakter-szam (0 = teljesen elrejt). */
-  prefix: number;
-  /** Megorzendo utolso karakter-szam (0 = teljesen elrejt). */
-  suffix: number;
-}
-
-export interface DyFM_SecretMask_Settings_Interface {
-  /**
-   * Identifiability-controls. Default `{ prefix: 4, suffix: 4 }`. Beallitva
-   * pl. `{ prefix: 0, suffix: 0 }` opaque maszkolas-hoz.
-   */
-  partialReveal: DyFM_SecretMask_PartialReveal_Interface;
-
-  /**
-   * Min karakter-hossz amire az env-overlay alkalmaz. Rovid ertekek false
-   * positivot adnak (pl. `KEY=foo` ahol foo a project-name). Default: 8.
-   */
-  minEnvValueLength: number;
-
-  /**
-   * `process.env`-bol kulcsneveket szuro regex. Default match: minden olyan
-   * env-var ahol a NEV titkos-jellegu (TOKEN/SECRET/KEY/PASSWORD/PAT/HMAC stb.).
-   */
-  envNameSecretRx: RegExp;
-}
-
-export const DyFM_DEFAULT_SECRET_MASK_SETTINGS: DyFM_SecretMask_Settings_Interface = {
-  partialReveal: {
-    prefix: 4,
-    suffix: 4,
-  },
-  minEnvValueLength: 8,
-  envNameSecretRx:  /(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE|CREDENTIAL|API_KEY|WEBHOOK)/i,
-};
-
-interface SecretPattern_Interface {
-  /** Diagnosztikai cimke a `[redacted-<KIND>]` markerben. */
-  kind: string;
-  /** Detekcios regex (global flag is REQUIRED — a global flow minden match-et kezel). */
-  regex: RegExp;
-  /**
-   * `redactWith` — meghivva minden match-re a "matched" stringgel + settings-szel.
-   * Visszaad a csere-string-et. Default: partial-reveal-szel `<prefix>...<suffix> [redacted-<KIND>]`.
-   */
-  redactWith?: (matched: string, settings: DyFM_SecretMask_Settings_Interface) => string;
-  /**
-   * `wrapPrefix` — ha a regex captures (`$1` group-ja stb.) a literal-prefixet jelzi
-   * (pl. `Bearer ` a Bearer-token-nel), akkor a redact-result `[$1][reveal][marker]`-rel
-   * kerul ossze; a regex group az `wrapPrefix` index-en mutatott group. Default 0 = no wrap.
-   */
-  wrapPrefix?: number;
-}
-
-const defaultRevealReplacement = (
-  matched: string,
-  kind: string,
-  settings: DyFM_SecretMask_Settings_Interface,
-): string => {
-  const p: number = Math.max(0, settings.partialReveal.prefix);
-  const s: number = Math.max(0, settings.partialReveal.suffix);
-  // Ha a kulcs tul rovid az osszes reveal-osszeghez kepest, ne reveal-juk
-  // (kulonben az egesz secret elerhetonek osszetapadna).
-  if (matched.length <= p + s + 4) {
-    return `[redacted-${kind}]`;
-  }
-  if (p === 0 && s === 0) {
-    return `[redacted-${kind}]`;
-  }
-  const head: string = matched.slice(0, p);
-  const tail: string = matched.slice(matched.length - s);
-  return `${head}...${tail} [redacted-${kind}]`;
-};
-
-export const DyFM_SECRET_PATTERNS: SecretPattern_Interface[] = [
-  // URL-embedded basic auth — BARMELY scheme (`http(s)`, `mongodb`, `postgres`, `redis`,
-  // `amqp`, `mysql` stb.), nem csak http: a `mongodb://user:pass@host` connection-string a
-  // leggyakoribb DB-secret-leak vektor a CI-logokban. A `user:pass@` szerkezet kotelezo →
-  // nincs false-positive a sima URL-ekre (port `host:8080/` sem, mert nincs utana `@`).
-  // A sajat replace-pattern megorzi a scheme-et ($1) + host-ot.
-  {
-    kind:        'url-cred',
-    regex:       /\b([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]*):([^\s@]+)@/gi,
-    redactWith:  (_m: string): string => '$1[redacted-url-cred]@',
-  },
-  // GitHub PATs
-  { kind: 'github-pat', regex: /\bgh[ps]_[A-Za-z0-9]{36,}\b/g },
-  { kind: 'github-pat-fine', regex: /\bgithub_pat_[A-Za-z0-9_]{82,}\b/g },
-  { kind: 'github-oauth', regex: /\bgho_[A-Za-z0-9]{36,}\b/g },
-  { kind: 'github-refresh', regex: /\bghr_[A-Za-z0-9]{36,}\b/g },
-  // NPM token
-  { kind: 'npm-token', regex: /\bnpm_[A-Za-z0-9]{36,}\b/g },
-  // Docker Hub PAT
-  { kind: 'docker-pat', regex: /\bdckr_pat_[A-Za-z0-9_\-]{20,}\b/g },
-  // Slack token
-  { kind: 'slack-token', regex: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g },
-  // Anthropic key (BEFORE OpenAI — `sk-ant-*` more specific than `sk-*`)
-  { kind: 'anthropic-key', regex: /\bsk-ant-[A-Za-z0-9\-_]{32,}\b/g },
-  // OpenAI / generic `sk-*` key
-  { kind: 'openai-key', regex: /\bsk-[A-Za-z0-9]{32,}\b/g },
-  // Google API key
-  { kind: 'google-api-key', regex: /\bAIza[0-9A-Za-z\-_]{35}\b/g },
-  // Discord webhook URL (id + token in URL)
-  {
-    kind:       'discord-webhook',
-    regex:      /\bhttps?:\/\/(?:discord(?:app)?\.com|discordapp\.com)\/api\/webhooks\/\d+\/[A-Za-z0-9_\-]+/g,
-    redactWith: (_m: string): string => '[redacted-discord-webhook]',
-  },
-  // Bearer token in HTTP header style — megorizzuk a 'Bearer ' prefixet (literally), a token-t pedig reveal-eljuk.
-  {
-    kind:       'bearer-token',
-    regex:      /\b(Bearer)\s+([A-Za-z0-9\-._~+/=]{20,})/gi,
-    redactWith: (matched: string, settings: DyFM_SecretMask_Settings_Interface): string => {
-      const tokenStart: number = matched.search(/\s+/);
-      const prefix: string = matched.slice(0, tokenStart + 1); // 'Bearer '
-      const token: string = matched.slice(tokenStart + 1);
-      return prefix + defaultRevealReplacement(token, 'token', settings);
-    },
-  },
-  // JWT (eyJ + .* + .*)
-  { kind: 'jwt', regex: /\beyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\b/g },
-  // AWS Access Key
-  { kind: 'aws-access-key', regex: /\bAKIA[0-9A-Z]{16}\b/g },
-  // Env-style secret-name = value
-  {
-    kind:       'env-style-secret',
-    regex:      /\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE)[A-Z0-9_]*)\s*[:=]\s*['"]?([^\s'"]+)['"]?/g,
-    redactWith: (matched: string, settings: DyFM_SecretMask_Settings_Interface): string => {
-      // Pull out the key name + value via re-match (avoids capturing groups in redactWith signature)
-      const m: RegExpMatchArray | null = matched.match(/\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|PAT|HMAC|AUTH|PRIVATE)[A-Z0-9_]*)\s*[:=]\s*['"]?([^\s'"]+)/);
-      if (!m) { return matched; }
-      const keyName: string = m[1];
-      const value: string = m[2];
-      const sep: string = matched.includes(': ') ? '=' : '=';
-      const revealed: string = defaultRevealReplacement(value, 'env-value', settings);
-      return `${keyName}${sep}${revealed}`;
-    },
-  },
-];
-
-/**
- * `process.env`-bol kigyujti azokat a kulcsokat ahol a NEV titkos-jellegu
- * ÉS a value >= minEnvValueLength. Visszaad egy listat — ezeket szovegben
- * minden elofordulasban partial-reveal-el felulrak-juk.
- */
-const collectEnvSecretValues = (
-  settings: DyFM_SecretMask_Settings_Interface,
-): { value: string; key: string }[] => {
-  const out: { value: string; key: string }[] = [];
-  for (const [key, raw] of Object.entries(process.env)) {
-    if (!raw || raw.length < settings.minEnvValueLength) { continue; }
-    if (!settings.envNameSecretRx.test(key)) { continue; }
-    if (/^(true|false|0|1)$/i.test(raw)) { continue; }
-    out.push({ value: raw, key: key });
-  }
-  // Sort by value length DESC — hosszabb ertekekkel kezdjuk, igy egy rovid
-  // prefix nem sealeze el a hosszabb kornyezetet.
-  out.sort((a, b): number => b.value.length - a.value.length);
-  return out;
-};
-
-/**
- * `DyFM_maskSecrets` — universal pre-Discord-send + pre-log-persist masking.
- *
- * @param text bemenet (ha nem string, JSON-szerializalaskor maskoljuk)
- * @param settings  konfiguracio (default a DyFM_DEFAULT_SECRET_MASK_SETTINGS)
- * @returns maszkolt szoveg
- */
-export function DyFM_maskSecrets(
-  text: unknown,
-  settings: DyFM_SecretMask_Settings_Interface = DyFM_DEFAULT_SECRET_MASK_SETTINGS,
-): string {
-  if (text === null || text === undefined) { return ''; }
-  let str: string;
-  if (typeof text === 'string') {
-    str = text;
-  } else {
-    try { str = JSON.stringify(text); }
-    catch { str = String(text); }
-  }
-
-  // 1. PATTERN-based maszkolas
-  for (const p of DyFM_SECRET_PATTERNS) {
-    str = str.replace(p.regex, (matched: string, ...groups: string[]): string => {
-      // Drop the `offset` + `wholeString` args at the end of `groups`
-      if (p.redactWith) {
-        return p.redactWith(matched, settings)
-          .replace(/\$1/g, groups[0] ?? '')
-          .replace(/\$2/g, groups[1] ?? '');
-      }
-      // Default: partial-reveal with kind
-      return defaultRevealReplacement(matched, p.kind, settings);
-    });
-  }
-
-  // 2. ENV-secret value-alapu overlay
-  const envSecrets: { value: string; key: string }[] = collectEnvSecretValues(settings);
-  for (const { value, key } of envSecrets) {
-    if (!str.includes(value)) { continue; }
-    const revealed: string = defaultRevealReplacement(value, `env-${key}`, settings);
-    str = str.split(value).join(revealed);
-  }
-
-  return str;
-}
-
-/**
- * Recursive object-masker — JSON-szeru struktura minden string-ertekeben alkalmazza
- * a DyFM_maskSecrets-t. Pl. errors-table additionalContent / logTail tomb / cdpReport
- * objektum elotti masking-hez.
- */
-export function DyFM_maskSecretsDeep<T = unknown>(
-  input: T,
-  settings: DyFM_SecretMask_Settings_Interface = DyFM_DEFAULT_SECRET_MASK_SETTINGS,
-): T {
-  if (input === null || input === undefined) { return input; }
-  if (typeof input === 'string') {
-    return DyFM_maskSecrets(input, settings) as unknown as T;
-  }
-  if (typeof input !== 'object') { return input; }
-  if (Array.isArray(input)) {
-    return (input as unknown[]).map((it: unknown): unknown => DyFM_maskSecretsDeep(it, settings)) as unknown as T;
-  }
-  const out: Record<string, unknown> = {};
-  for (const [k, v] of Object.entries(input as Record<string, unknown>)) {
-    out[k] = DyFM_maskSecretsDeep(v, settings);
-  }
-  return out as unknown as T;
-}