@futdevpro/nts-dynamo 1.15.118 → 1.15.120

package/src/_services/base/db.service.ts

@@ -677,8 +677,46 @@ export class DyNTS_DBService<T extends DyFM_Metadata> {
    * @param narrowByDependencyIds id
    * @returns dataList
    */
+  /**
+   * BFR-AM-013 — LEAN + projektált + BATCH-elt cursor-scan (OOM-safe nagy collection-ökhöz).
+   *
+   * A teljes result-set SOSEM él egyszerre a heapen: a Mongo-cursor batch-enként adagolja a
+   * PLAIN (lean, nem-Mongoose-doc) objektumokat a `handler`-nek — a Mongoose-doc-boxing tranziens
+   * (a 32k-vektoros LVS-hidratálás 93%-heap-spike-jának gyökere) kimarad. A `projection`-nel csak
+   * a szükséges mezők jönnek (pl. `{ vectorId: 1, embedding: 1 }` a content-szöveg NÉLKÜL).
+   * Visszaadja a feldolgozott dokumentumok számát.
+   */
+  async findLeanBatched(
+    filterBy: DyFM_DBFilter<T>,
+    set: {
+      projection?: Record<string, number>,
+      batchSize?: number,
+      handler: (batch: Partial<T>[]) => Promise<void> | void,
+    }
+  ): Promise<number> {
+    const batchSize: number = set.batchSize && set.batchSize > 0 ? set.batchSize : 500;
+    const cursor = this.dataModel.find(filterBy, set.projection).lean().cursor();
+
+    let batch: Partial<T>[] = [];
+    let total: number = 0;
+
+    for await (const doc of cursor) {
+      batch.push(doc as Partial<T>);
+      total++;
+      if (batch.length >= batchSize) {
+        await set.handler(batch);
+        batch = [];
+      }
+    }
+    if (batch.length) {
+      await set.handler(batch);
+    }
+
+    return total;
+  }
+
   async searchData(
-    filterBy: DyFM_DBFilter<T>, 
+    filterBy: DyFM_DBFilter<T>,
     narrowByDependencyIds?: string[],
     narrowByDependencyKey?: string,
     findDeleted?: boolean

package/src/_services/core/api.service.spec.ts

@@ -138,3 +138,50 @@ describe('| DyNTS_ApiService', () => {
     );
   });
 });
+
+// BFR-DYNAMOBUILDER-006 — a belső BE-BE URL NEM kerülhet a _message-be (kliens-leak);
+// a confidentialContent-be megy (a response-strip env-függetlenül levágja).
+describe('| DyNTS_ApiService.handleError — internal URL leak guard (BFR-DYNAMOBUILDER-006)', () => {
+  const internalUrl: string = 'http://auth-service:39005/api/auth/login';
+
+  function buildCallParams(): DyNTS_ApiCall_Params {
+    return new DyNTS_ApiCall_Params({
+      baseUrl: 'http://auth-service:39005/api',
+      endpoint: '/auth/login',
+      type: DyFM_HttpCallType.post,
+      httpOptions: { headers: {}, responseType: DyFM_HttpResponseType.json },
+      name: 'loginCall',
+      getFullResponse: false,
+    });
+  }
+
+  function invokeHandleError(error: unknown): DyFM_Error {
+    try {
+      DyNTS_ApiService['handleError'](buildCallParams(), error, { pathParams: {}, body: {} }, internalUrl);
+    } catch (thrown: unknown) {
+      return thrown as DyFM_Error;
+    }
+    throw new Error('handleError did not throw');
+  }
+
+  it('| HE3 (ECONNREFUSED): a _message NEM tartalmazza a belső URL-t; a confidentialContent igen', () => {
+    const thrown: DyFM_Error = invokeHandleError({ code: 'ECONNREFUSED', message: 'connect ECONNREFUSED' });
+
+    expect(thrown._message).not.toContain('auth-service:39005');
+    expect(thrown._message).toContain('loginCall');
+    expect(thrown.confidentialContent?.url).toBe(internalUrl);
+  });
+
+  it('| HE4 (status code): a _message NEM tartalmazza a belső endpointot/URL-t', () => {
+    const axiosLike = {
+      config: {},
+      message: 'Request failed with status code 401',
+      response: { status: 401 },
+    };
+    const thrown: DyFM_Error = invokeHandleError(axiosLike);
+
+    expect(thrown._message).not.toContain('auth-service:39005');
+    expect(thrown.confidentialContent?.url).toBe(internalUrl);
+    expect(thrown.additionalContent?.callName).toBe('loginCall');
+  });
+});

package/src/_services/core/api.service.ts

@@ -264,12 +264,19 @@ export class DyNTS_ApiService {
         ),
 
         errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-API-HE1`,
-        message: 
+        // BFR-DYNAMOBUILDER-006: a BELSŐ BE-BE URL (Docker-hostname+port) NEM kerülhet a _message-be —
+        // non-prod env-en a teljes error kimegy a kliensnek → info-disclosure. A _message csak a
+        // hívás NEVÉT hordozza; az URL + callParams a confidentialContent-be megy (error-store-ba
+        // perzisztálódik, a response-strip env-FÜGGETLENÜL levágja).
+        message:
           `API call "${callParams.name}" failed on the other end!`+
-          `\nurl: ${url}` +
           `\nerror response found: ${errorMsg}`,
         error: dyfmErrorInAxiosResponse,
         additionalContent: {
+          callName: callParams.name,
+        },
+        confidentialContent: {
+          url: url,
           callParams: callParams,
           inputParams: inputParams,
           response: (error as Axios.AxiosError)?.response,
@@ -287,8 +294,12 @@ export class DyNTS_ApiService {
 
         status: 404,
         errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-API-HE2`,
-        message: 'DNS error; address cannot be resolved!',
+        message: `DNS error; address cannot be resolved! (call: "${callParams.name}")`,
         additionalContent: {
+          callName: callParams.name,
+        },
+        confidentialContent: {
+          url: url,
           callParams: callParams,
           inputParams: inputParams,
           response: (error as Axios.AxiosError)?.response,
@@ -306,11 +317,15 @@ export class DyNTS_ApiService {
 
         status: 404,
         errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-API-HE3`,
-        message: `Can't connect to the endpoint! \n(${callParams.type} "${url}")`,
+        // BFR-DYNAMOBUILDER-006: az URL confidentialContent-be (nem a _message-be) — belső host-leak ellen.
+        message: `Can't connect to the endpoint! (call: "${callParams.name}")`,
         additionalContent: {
+          callName: callParams.name,
+        },
+        confidentialContent: {
+          url: url,
           callParams: callParams,
           inputParams: inputParams,
-          url: url,
           response: (error as Axios.AxiosError)?.response,
         },
       });
@@ -325,15 +340,14 @@ export class DyNTS_ApiService {
         500;
 
       if ((error as Axios.AxiosError)?.message?.includes('status code')) {
-        msg += `"${callParams.name}"` +
-          `\nendpoint: ${callParams.type} "${callParams.baseUrl}${callParams.endpoint}"` +
-          `\nurl: ${url}` +
+        // BFR-DYNAMOBUILDER-006: a _message CSAK a hívás-nevet + path-param-KULCSOKAT hordozza —
+        // a belső endpoint/URL/stack a confidentialContent-be megy (response-ba SOHA).
+        msg += ` "${callParams.name}"` +
           `\npathParams: ${
-            inputParams?.pathParams ? 
-              Object.keys(inputParams.pathParams).join(', ') : 
+            inputParams?.pathParams ?
+              Object.keys(inputParams.pathParams).join(', ') :
               '-no path params-'
-          }` +
-          `\nenpointStackLocation: ${callParams.stack}`;
+          }`;
       }
 
       throw new DyFM_Error({
@@ -346,6 +360,12 @@ export class DyNTS_ApiService {
         message: msg,
         errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-API-HE4`,
         additionalContent: {
+          callName: callParams.name,
+        },
+        confidentialContent: {
+          url: url,
+          endpoint: `${callParams.type} "${callParams.baseUrl}${callParams.endpoint}"`,
+          endpointStackLocation: callParams.stack,
           callParams: callParams,
           inputParams: inputParams,
           response: (error as Axios.AxiosError)?.response,

package/src/_services/core/db-stats.service.ts

@@ -0,0 +1,104 @@
+import * as mongoose from 'mongoose';
+
+import { DyFM_Log } from '@futdevpro/fsm-dynamo';
+
+/**
+ * BFR-OVERSEER-004 — stats-only DB-diagnosztika (NO direct data read).
+ *
+ * Per-collection rekordszám + adat-méret + index-méret (a `$collStats` aggregation-stage-en át —
+ * metaadat-olvasás, SOHA nem dokumentum-tartalom) + összesített DB-méret. A 2026-06-23 overseer-incidens
+ * (3 GB-ra hízott archív-collection, csak kézi mongosh-sal látszott) proaktív early-warningja: minden
+ * NTS-szerver default megkapja a `/server/db-stats` endpointon (app-auth-tal gate-elhető).
+ */
+
+export interface DyNTS_CollectionStats {
+  name: string;
+  documentCount: number;
+  sizeMB: number;
+  indexSizeMB: number;
+}
+
+export interface DyNTS_DbStats {
+  dbName: string;
+  collections: DyNTS_CollectionStats[];
+  totalSizeMB: number;
+  totalIndexSizeMB: number;
+  totalDocumentCount: number;
+  /** A gyűjtés közben elhasalt collection-ök (never-silent — a kihagyás látható). */
+  failedCollections: string[];
+}
+
+const BYTES_PER_MB: number = 1024 * 1024;
+
+export class DyNTS_DbStats_Util {
+
+  /**
+   * A teljes stats-only pillanatkép. Hibatűrő: egy-egy collection statjának elhasalása NEM
+   * borítja a többit (failedCollections-be kerül, warn-nal — no-silent-skip).
+   */
+  static async collect(connection: mongoose.Connection): Promise<DyNTS_DbStats> {
+    const db: typeof connection.db = connection?.db;
+    if (!db) {
+      return {
+        dbName: connection?.name ?? '-no-connection-',
+        collections: [],
+        totalSizeMB: 0,
+        totalIndexSizeMB: 0,
+        totalDocumentCount: 0,
+        failedCollections: [],
+      };
+    }
+
+    const collectionInfos: { name: string }[] = await db.listCollections({}, { nameOnly: true }).toArray();
+    const collections: DyNTS_CollectionStats[] = [];
+    const failedCollections: string[] = [];
+
+    for (const info of collectionInfos) {
+      try {
+        // $collStats storageStats: metaadat-only (size/count/totalIndexSize) — nincs dokumentum-olvasás.
+        const statsCursor = db.collection(info.name).aggregate([
+          { $collStats: { storageStats: {} } },
+        ]);
+        const statsDocs: Record<string, unknown>[] = await statsCursor.toArray();
+        const storage: Record<string, unknown> =
+          (statsDocs[0]?.['storageStats'] ?? {}) as Record<string, unknown>;
+
+        collections.push({
+          name: info.name,
+          documentCount: Number(storage['count'] ?? 0),
+          sizeMB: DyNTS_DbStats_Util.toMB(Number(storage['size'] ?? 0)),
+          indexSizeMB: DyNTS_DbStats_Util.toMB(Number(storage['totalIndexSize'] ?? 0)),
+        });
+      } catch (error) {
+        failedCollections.push(info.name);
+        DyFM_Log.warn(`(DyNTS_DbStats) collStats failed for "${info.name}" (non-fatal)`, error);
+      }
+    }
+
+    // Méret szerint csökkenő — a bloat-gyanús collection legyen elöl.
+    collections.sort((a: DyNTS_CollectionStats, b: DyNTS_CollectionStats): number => b.sizeMB - a.sizeMB);
+
+    return {
+      dbName: connection.name,
+      collections: collections,
+      totalSizeMB: DyNTS_DbStats_Util.round2(
+        collections.reduce((sum: number, c: DyNTS_CollectionStats): number => sum + c.sizeMB, 0)
+      ),
+      totalIndexSizeMB: DyNTS_DbStats_Util.round2(
+        collections.reduce((sum: number, c: DyNTS_CollectionStats): number => sum + c.indexSizeMB, 0)
+      ),
+      totalDocumentCount: collections.reduce(
+        (sum: number, c: DyNTS_CollectionStats): number => sum + c.documentCount, 0
+      ),
+      failedCollections: failedCollections,
+    };
+  }
+
+  static toMB(bytes: number): number {
+    return DyNTS_DbStats_Util.round2(bytes / BYTES_PER_MB);
+  }
+
+  static round2(value: number): number {
+    return Math.round(value * 100) / 100;
+  }
+}

package/src/_services/core/diagnostics.service.spec.ts

@@ -0,0 +1,44 @@
+import { DyNTS_DbStats_Util } from './db-stats.service';
+import { DyNTS_Diagnostics, DyNTS_DoctorCheck } from './diagnostics.service';
+
+/**
+ * BFR-AM-015 / BFR-OVERSEER-004 — a diagnosztika PURE részeinek unit-tesztjei
+ * (interpretHealth / buildSummary / MB-kerekítés).
+ */
+describe('| DyNTS_Diagnostics (pure)', () => {
+
+  const ok: DyNTS_DoctorCheck = { name: 'a', health: 'ok' };
+  const warn: DyNTS_DoctorCheck = { name: 'b', health: 'warn', fixHint: 'do b' };
+  const fail: DyNTS_DoctorCheck = { name: 'c', health: 'fail', fixHint: 'do c' };
+
+  it('| interpretHealth: fail dominál, aztán warn, különben ok', () => {
+    expect(DyNTS_Diagnostics.interpretHealth([ ok, ok ])).toBe('ok');
+    expect(DyNTS_Diagnostics.interpretHealth([ ok, warn ])).toBe('warn');
+    expect(DyNTS_Diagnostics.interpretHealth([ warn, fail, ok ])).toBe('fail');
+    expect(DyNTS_Diagnostics.interpretHealth([])).toBe('ok');
+  });
+
+  it('| buildSummary: all-ok → "all checks ok"; nem-ok check-ek fixHint-tel listázva', () => {
+    expect(DyNTS_Diagnostics.buildSummary([ ok ])).toBe('all checks ok');
+    const summary: string = DyNTS_Diagnostics.buildSummary([ ok, warn, fail ]);
+    expect(summary).toContain('b: warn — do b');
+    expect(summary).toContain('c: fail — do c');
+    expect(summary).not.toContain('a:');
+  });
+});
+
+describe('| DyNTS_DbStats_Util (pure)', () => {
+
+  it('| toMB: byte → MB két tizedesre', () => {
+    expect(DyNTS_DbStats_Util.toMB(1024 * 1024)).toBe(1);
+    expect(DyNTS_DbStats_Util.toMB(1536 * 1024)).toBe(1.5);
+    expect(DyNTS_DbStats_Util.toMB(0)).toBe(0);
+  });
+
+  it('| collect: kapcsolat nélkül üres, nem-dobó eredmény', async () => {
+    const stats = await DyNTS_DbStats_Util.collect(undefined as never);
+    expect(stats.collections).toEqual([]);
+    expect(stats.totalSizeMB).toBe(0);
+    expect(stats.failedCollections).toEqual([]);
+  });
+});

package/src/_services/core/diagnostics.service.ts

@@ -0,0 +1,158 @@
+import * as mongoose from 'mongoose';
+
+import { DyFM_Log } from '@futdevpro/fsm-dynamo';
+
+import { DyNTS_DbStats, DyNTS_DbStats_Util } from './db-stats.service';
+import { DyNTS_EventLoopDiag } from './event-loop-diag.service';
+import { DyNTS_MemoryGuard } from './memory-guard.service';
+
+/**
+ * BFR-AM-015 (+ BFR-OVERSEER-004 aggregátor-fele) — generikus, újrahasználható diagnosztikai
+ * aggregátor MINDEN `DyNTS_App`-hoz: a `GET /server/doctor` endpoint forrása.
+ *
+ * Check-ek (mind SAJÁT try-ban — egy elhasaló check nem borítja a doctort, néma hiba TILOS):
+ *  - mongo: kapcsolat + ping (readiness-minta);
+ *  - memory: MemoryGuard pressure-snapshot;
+ *  - eventLoop: EventLoopDiag snapshot;
+ *  - dbStats: stats-only collection-méretek + küszöb-warn a bloat-gyanúra.
+ * Az app APP-SPECIFIKUS check-eket regisztrálhat (`registerCheck`) — pl. env-validáció,
+ * provider-probe (a FAM `FAM_Doctor` mintája bedrock-magként).
+ */
+
+export interface DyNTS_DoctorCheck {
+  name: string;
+  health: 'ok' | 'warn' | 'fail';
+  detail?: unknown;
+  /** Mit tegyen az operátor, ha nem ok (néma hiba tilos — a hint kötelező nem-ok esetén). */
+  fixHint?: string;
+}
+
+export interface DyNTS_DoctorReport {
+  health: 'ok' | 'warn' | 'fail';
+  checks: DyNTS_DoctorCheck[];
+  summary: string;
+  uptimeSec: number;
+}
+
+/** App-specifikus check-függvény (a doctor futtatja, saját try-ban). */
+export type DyNTS_DoctorCheckFn = () => Promise<DyNTS_DoctorCheck>;
+
+/** Collection-méret warn-küszöb (MB) — e fölött a dbStats-check warn-ra vált. */
+const DEFAULT_COLLECTION_WARN_MB: number = 512;
+
+export class DyNTS_Diagnostics {
+
+  private static readonly customChecks: DyNTS_DoctorCheckFn[] = [];
+
+  /** App-specifikus check regisztrálása (pl. env-validáció, provider-probe). */
+  static registerCheck(check: DyNTS_DoctorCheckFn): void {
+    DyNTS_Diagnostics.customChecks.push(check);
+  }
+
+  /** A teljes doctor-riport. SOSEM dob — a hibás check `fail`-ként jelenik meg. */
+  static async runDoctor(set: {
+    connection: mongoose.Connection,
+    collectionWarnMB?: number,
+  }): Promise<DyNTS_DoctorReport> {
+    const checks: DyNTS_DoctorCheck[] = [];
+
+    // 1) Mongo-probe (readiness-minta: readyState + admin ping).
+    try {
+      const readyState: number = set.connection?.readyState ?? 0;
+      let pingOk: boolean = false;
+      if (readyState === 1) {
+        await set.connection.db?.admin().ping();
+        pingOk = true;
+      }
+      checks.push({
+        name: 'mongo',
+        health: readyState === 1 && pingOk ? 'ok' : 'fail',
+        detail: { readyState: readyState, pingOk: pingOk },
+        fixHint: readyState === 1 && pingOk ? undefined
+          : 'Check MONGO_URL + DB container/network reachability (readyState 1 + ping expected).',
+      });
+    } catch (error) {
+      checks.push({
+        name: 'mongo', health: 'fail', detail: String(error),
+        fixHint: 'Mongo ping threw — check DB availability/credentials.',
+      });
+    }
+
+    // 2) Memória (MemoryGuard pressure).
+    try {
+      const pressure: unknown = DyNTS_MemoryGuard.getInstance().pressure();
+      const level: string = String((pressure as { level?: string })?.level ?? 'ok');
+      checks.push({
+        name: 'memory',
+        health: level === 'critical' ? 'fail' : level === 'warning' ? 'warn' : 'ok',
+        detail: pressure,
+        fixHint: level === 'ok' ? undefined
+          : 'Heap pressure — check collection sizes (/server/db-stats) + recent load; consider retention.',
+      });
+    } catch (error) {
+      checks.push({ name: 'memory', health: 'warn', detail: String(error), fixHint: 'MemoryGuard snapshot failed.' });
+    }
+
+    // 3) Event-loop lag.
+    try {
+      const snapshot: unknown = DyNTS_EventLoopDiag.getInstance().getSnapshot();
+      checks.push({ name: 'eventLoop', health: 'ok', detail: snapshot });
+    } catch (error) {
+      checks.push({ name: 'eventLoop', health: 'warn', detail: String(error), fixHint: 'EventLoopDiag snapshot failed.' });
+    }
+
+    // 4) DB-stats + bloat-küszöb (BFR-OVERSEER-004 early-warning).
+    try {
+      const stats: DyNTS_DbStats = await DyNTS_DbStats_Util.collect(set.connection);
+      const warnMB: number = set.collectionWarnMB ?? DEFAULT_COLLECTION_WARN_MB;
+      const bloated: string[] = stats.collections
+        .filter((c): boolean => c.sizeMB + c.indexSizeMB > warnMB)
+        .map((c): string => `${c.name} (${c.sizeMB}MB + ${c.indexSizeMB}MB idx)`);
+      checks.push({
+        name: 'dbStats',
+        health: bloated.length ? 'warn' : 'ok',
+        detail: { totalSizeMB: stats.totalSizeMB, collectionCount: stats.collections.length, bloated: bloated },
+        fixHint: bloated.length
+          ? `Collections over ${warnMB}MB — add dataParams.retention (TTL) or prune: ${bloated.join(', ')}`
+          : undefined,
+      });
+    } catch (error) {
+      checks.push({ name: 'dbStats', health: 'warn', detail: String(error), fixHint: 'db-stats collection failed.' });
+    }
+
+    // 5) App-specifikus check-ek.
+    for (const customCheck of DyNTS_Diagnostics.customChecks) {
+      try {
+        checks.push(await customCheck());
+      } catch (error) {
+        DyFM_Log.warn('(DyNTS_Diagnostics) custom check threw (reported as fail)', error);
+        checks.push({ name: 'custom', health: 'fail', detail: String(error), fixHint: 'Custom check threw — see detail.' });
+      }
+    }
+
+    return {
+      health: DyNTS_Diagnostics.interpretHealth(checks),
+      checks: checks,
+      summary: DyNTS_Diagnostics.buildSummary(checks),
+      uptimeSec: Math.round(process.uptime()),
+    };
+  }
+
+  /** Aggregált health: bármely fail → fail; különben bármely warn → warn; különben ok. Pure (unit-tesztelt). */
+  static interpretHealth(checks: DyNTS_DoctorCheck[]): 'ok' | 'warn' | 'fail' {
+    if (checks.some((c: DyNTS_DoctorCheck): boolean => c.health === 'fail')) { return 'fail'; }
+    if (checks.some((c: DyNTS_DoctorCheck): boolean => c.health === 'warn')) { return 'warn'; }
+    return 'ok';
+  }
+
+  /** Ember-olvasható összegzés a nem-ok check-ekből. Pure (unit-tesztelt). */
+  static buildSummary(checks: DyNTS_DoctorCheck[]): string {
+    const notOk: DyNTS_DoctorCheck[] = checks.filter((c: DyNTS_DoctorCheck): boolean => c.health !== 'ok');
+    if (!notOk.length) {
+      return 'all checks ok';
+    }
+    return notOk
+      .map((c: DyNTS_DoctorCheck): string => `${c.name}: ${c.health}${c.fixHint ? ` — ${c.fixHint}` : ''}`)
+      .join(' | ');
+  }
+}

package/src/_services/core/migration-runner.service.spec.ts

@@ -0,0 +1,91 @@
+import { DyNTS_Migration_Runner } from './migration-runner.service';
+import { DyNTS_SchemaMigration } from '../../_models/data-models/schema-migration.data-model';
+import { DyNTS_MigrationEntry } from '../../_models/interfaces/migration-entry.interface';
+
+function entry(id: string, run: () => Promise<{ touched: number }>): DyNTS_MigrationEntry {
+  return { id: id, description: id, run: run };
+}
+
+describe('| DyNTS_Migration_Runner', () => {
+
+  describe('| selectPending (pure)', () => {
+    it('| kiszűri a már-alkalmazottakat, megőrzi a sorrendet', () => {
+      const migs: DyNTS_MigrationEntry[] = [
+        entry('a', async () => ({ touched: 0 })),
+        entry('b', async () => ({ touched: 0 })),
+        entry('c', async () => ({ touched: 0 })),
+      ];
+      const pending: DyNTS_MigrationEntry[] = DyNTS_Migration_Runner.selectPending(migs, new Set([ 'b' ]));
+      expect(pending.map((m) => m.id)).toEqual([ 'a', 'c' ]);
+    });
+
+    it('| mind alkalmazva → üres; üres registry → üres', () => {
+      const migs: DyNTS_MigrationEntry[] = [ entry('a', async () => ({ touched: 0 })) ];
+      expect(DyNTS_Migration_Runner.selectPending(migs, new Set([ 'a' ])).length).toBe(0);
+      expect(DyNTS_Migration_Runner.selectPending([], new Set()).length).toBe(0);
+    });
+  });
+
+  describe('| runPending (mock ledger)', () => {
+    let runner: DyNTS_Migration_Runner;
+    let saved: DyNTS_SchemaMigration[];
+    let appliedRecords: DyNTS_SchemaMigration[];
+
+    beforeEach(() => {
+      runner = DyNTS_Migration_Runner.getInstance();
+      saved = [];
+      appliedRecords = [];
+
+      const fakeLedger: any = { // ccap-review-disable-line no-any-type
+        dataDBService: { find: async (): Promise<DyNTS_SchemaMigration[]> => appliedRecords },
+        data: null,
+        saveData: async function (): Promise<void> { saved.push(this.data); appliedRecords.push(this.data); },
+      };
+
+      spyOn(runner as any, 'createLedgerDataService').and.returnValue(fakeLedger); // ccap-review-disable-line no-any-type
+    });
+
+    it('| a pending-et futtatja + rögzíti (id+version+touched), a már-alkalmazottat SKIP-eli', async () => {
+      appliedRecords.push(new DyNTS_SchemaMigration({ migrationId: 'm1' }));
+      const ran: string[] = [];
+
+      const migs: DyNTS_MigrationEntry[] = [
+        entry('m1', async () => { ran.push('m1'); return { touched: 1 }; }),
+        entry('m2', async () => { ran.push('m2'); return { touched: 5 }; }),
+      ];
+
+      const res = await runner.runPending(migs, '1.0.0');
+
+      expect(ran).toEqual([ 'm2' ]);          // m1 skip (már applied), m2 fut
+      expect(res.applied).toBe(1);
+      expect(res.skipped).toBe(1);
+      expect(saved[0].migrationId).toBe('m2');
+      expect(saved[0].appliedVersion).toBe('1.0.0');
+      expect(saved[0].notes).toBe('touched=5');
+    });
+
+    it('| RUN-ONCE: második sweep-en (m2 már a ledgerben) semmi nem fut', async () => {
+      appliedRecords.push(new DyNTS_SchemaMigration({ migrationId: 'm2' }));
+      const ran: string[] = [];
+      const migs: DyNTS_MigrationEntry[] = [ entry('m2', async () => { ran.push('m2'); return { touched: 0 }; }) ];
+
+      const res = await runner.runPending(migs, '1.0.0');
+      expect(ran.length).toBe(0);
+      expect(res.applied).toBe(0);
+      expect(res.skipped).toBe(1);
+    });
+
+    it('| BOOT-SAFE: egy hibás migráció NEM dob + NEM állítja meg a többit', async () => {
+      const ran: string[] = [];
+      const migs: DyNTS_MigrationEntry[] = [
+        entry('bad', async () => { throw new Error('boom'); }),
+        entry('good', async () => { ran.push('good'); return { touched: 2 }; }),
+      ];
+
+      const res = await runner.runPending(migs, '1.0.0');
+      expect(res.failed).toBe(1);
+      expect(res.applied).toBe(1);            // 'good' a hiba UTÁN is lefutott
+      expect(ran).toEqual([ 'good' ]);
+    });
+  });
+});