@futdevpro/nts-dynamo 1.15.119 → 1.15.121

package/src/_modules/socket/_models/socket-server-service-params.control-model.spec.ts

@@ -43,4 +43,27 @@ describe('| DyNTS_SocketServerService_Params', () => {
     expect(instance.port).toBeUndefined();
     expect(instance.security).toBe(DyNTS_SocketSecurity.open);
   });
+
+  // BFR-MASTERPROMPTER-025 — az attach-mód EXPLICIT opt-in, a port önmagában NEM diszkriminátor
+  it('| dedicatedPort default FALSE (shared) — port-label önmagában nem vált dedikáltra', () => {
+    const instance = new DyNTS_SocketServerService_Params({
+      name: 'LegacyPortLabel',
+      port: 39047,
+      security: DyNTS_SocketSecurity.open,
+    });
+
+    expect(instance.dedicatedPort).toBe(false);
+  });
+
+  it('| dedicatedPort: true explicit opt-in megőrződik', () => {
+    const instance = new DyNTS_SocketServerService_Params({
+      name: 'DedicatedNotif',
+      port: 39157,
+      dedicatedPort: true,
+      security: DyNTS_SocketSecurity.open,
+    });
+
+    expect(instance.dedicatedPort).toBe(true);
+    expect(instance.port).toBe(39157);
+  });
 });

package/src/_modules/socket/_models/socket-server-service-params.control-model.ts

@@ -4,12 +4,22 @@ import { DyNTS_SocketSecurity } from '../_enums/socket-security.enum';
 
 /**
  * Socket service paraméterek.
- * A port opcionális: ha nincs megadva, az app-extended a getPortSettings() httpPort/httpsPort értékét használja (ugyanaz a port, mint a HTTP/HTTPS).
+ *
+ * **BFR-MASTERPROMPTER-025 (attach-mód):** a socket alapból a fő HTTP/HTTPS szerverre attacholódik
+ * (SHARED — unified-port modell). Dedikált saját listener CSAK explicit `dedicatedPort: true`-val kérhető
+ * (+ `port` kötelező és ≠ fő port). A korábbi implicit inferencia (port≠httpPort → dedikált) csendben
+ * regresszálta azokat a unified-appokat, amelyek legacy-label okból adtak portot — ezért az attach-mód
+ * mostantól KÓD-EXPLICIT, a `port` önmagában NEM diszkriminátor.
  */
 export class DyNTS_SocketServerService_Params<T = any> {
   name: string;
   /** Opcionális: ha nincs megadva, az extended app a HTTP/HTTPS portot használja (same port). */
   port?: number;
+  /**
+   * EXPLICIT opt-in a dedikált saját listenerre (a fő szerver HELYETT). Default: false = shared.
+   * `true` esetén a `port` kötelező és el kell térnie a fő HTTP-porttól.
+   */
+  dedicatedPort?: boolean;
   security?: DyNTS_SocketSecurity;
 
   constructor(
@@ -17,6 +27,7 @@ export class DyNTS_SocketServerService_Params<T = any> {
   ) {
     this.name = set.name;
     this.port = set.port;
+    this.dedicatedPort = set.dedicatedPort ?? false;
     this.security = set.security ? set.security : DyNTS_global_settings.defaultSocketSecurity;
   }
 }

package/src/_modules/socket/_services/socket-server.service.ts

@@ -51,6 +51,8 @@ export abstract class DyNTS_SocketServerService<
   protected params: DyNTS_SocketServerService_Params;
   get name(): string { return this.params.name; }
   get port(): number | undefined { return this.params.port; }
+  /** BFR-MASTERPROMPTER-025: explicit dedikált-listener opt-in (default false = shared). */
+  get dedicatedPort(): boolean { return this.params.dedicatedPort ?? false; }
   get security(): DyNTS_SocketSecurity { return this.params.security; }
   get activeSubscriptionsCount(): number { return this.presences.length; }
 

package/src/_modules/socket/app-extended.server.ts

@@ -512,15 +512,21 @@ export abstract class DyNTS_AppExtended extends DyNTS_App {
             if (service.security === DyNTS_SocketSecurity.open) {
               this.systemControlsExt.httpSocketServer.init = true;
 
-              // BFR-FDPTOKENSERVICE-007 (fleet-wide realtime 502): ha a service SAJÁT (dedikált) portot
-              // kér, ami ELTÉR a fő HTTP-porttól, a socket a SAJÁT portjára listen-el — NEM a fő szerverre
-              // attacholódik. Enélkül base-server mellett a dedikált notif-port SOSEM kap listenert (a
-              // socket a fő portra attacholt) → a gateway a notif-porton 502-t ad. A fő-portot MEGOSZTÓ
-              // socket (port nincs, v. == httpPort) viselkedése VÁLTOZATLAN. A dedikált-ág a már bizonyított
-              // non-base útvonalat tükrözi (saját Http.Server + listen).
-              const sharesMainHttpPort: boolean =
-                service.port === undefined || service.port === this.portSettings.httpPort;
-              const attachToMain: boolean = useBaseHttpServer && sharesMainHttpPort;
+              // BFR-MASTERPROMPTER-025 (a BFR-FDPTOKENSERVICE-007 3a2c381 utó-fix-e): az attach-mód
+              // EXPLICIT opt-in (`dedicatedPort: true`), NEM a port-érték implicit inferenciája. A
+              // korábbi `port≠httpPort → dedikált` inferencia CSENDBEN regresszálta a unified-shared
+              // appokat, amelyek legacy-label/notif-konvenció okból adtak portot (MP live-igazolt:
+              // realtime DEAD az nts-bump után; adventor/ccap/warbots latens). Mostantól:
+              //   - default (dedicatedPort hiányzik/false) → SHARED (a fő szerverre attach, a port-label irreleváns);
+              //   - dedicatedPort: true → saját Http.Server + listen a service.port-on (a bizonyított
+              //     non-base útvonal tükre) — pl. a token-service szándékosan-dedikált notif-portja.
+              if (service.dedicatedPort && (service.port === undefined || service.port === this.portSettings.httpPort)) {
+                throw new Error(
+                  `SOCKET CONFIG ERROR: "${service.name}" dedicatedPort:true requires an explicit ` +
+                  `port that differs from the main httpPort (${this.portSettings.httpPort}).`
+                );
+              }
+              const attachToMain: boolean = useBaseHttpServer && !service.dedicatedPort;
               const serverForOpen: Http.Server = attachToMain
                 ? this.httpServer
                 : (useBaseHttpServer

package/src/_services/base/db.service.ts

@@ -677,8 +677,46 @@ export class DyNTS_DBService<T extends DyFM_Metadata> {
    * @param narrowByDependencyIds id
    * @returns dataList
    */
+  /**
+   * BFR-AM-013 — LEAN + projektált + BATCH-elt cursor-scan (OOM-safe nagy collection-ökhöz).
+   *
+   * A teljes result-set SOSEM él egyszerre a heapen: a Mongo-cursor batch-enként adagolja a
+   * PLAIN (lean, nem-Mongoose-doc) objektumokat a `handler`-nek — a Mongoose-doc-boxing tranziens
+   * (a 32k-vektoros LVS-hidratálás 93%-heap-spike-jának gyökere) kimarad. A `projection`-nel csak
+   * a szükséges mezők jönnek (pl. `{ vectorId: 1, embedding: 1 }` a content-szöveg NÉLKÜL).
+   * Visszaadja a feldolgozott dokumentumok számát.
+   */
+  async findLeanBatched(
+    filterBy: DyFM_DBFilter<T>,
+    set: {
+      projection?: Record<string, number>,
+      batchSize?: number,
+      handler: (batch: Partial<T>[]) => Promise<void> | void,
+    }
+  ): Promise<number> {
+    const batchSize: number = set.batchSize && set.batchSize > 0 ? set.batchSize : 500;
+    const cursor = this.dataModel.find(filterBy, set.projection).lean().cursor();
+
+    let batch: Partial<T>[] = [];
+    let total: number = 0;
+
+    for await (const doc of cursor) {
+      batch.push(doc as Partial<T>);
+      total++;
+      if (batch.length >= batchSize) {
+        await set.handler(batch);
+        batch = [];
+      }
+    }
+    if (batch.length) {
+      await set.handler(batch);
+    }
+
+    return total;
+  }
+
   async searchData(
-    filterBy: DyFM_DBFilter<T>, 
+    filterBy: DyFM_DBFilter<T>,
     narrowByDependencyIds?: string[],
     narrowByDependencyKey?: string,
     findDeleted?: boolean

package/src/_services/core/api.service.spec.ts

@@ -138,3 +138,50 @@ describe('| DyNTS_ApiService', () => {
     );
   });
 });
+
+// BFR-DYNAMOBUILDER-006 — a belső BE-BE URL NEM kerülhet a _message-be (kliens-leak);
+// a confidentialContent-be megy (a response-strip env-függetlenül levágja).
+describe('| DyNTS_ApiService.handleError — internal URL leak guard (BFR-DYNAMOBUILDER-006)', () => {
+  const internalUrl: string = 'http://auth-service:39005/api/auth/login';
+
+  function buildCallParams(): DyNTS_ApiCall_Params {
+    return new DyNTS_ApiCall_Params({
+      baseUrl: 'http://auth-service:39005/api',
+      endpoint: '/auth/login',
+      type: DyFM_HttpCallType.post,
+      httpOptions: { headers: {}, responseType: DyFM_HttpResponseType.json },
+      name: 'loginCall',
+      getFullResponse: false,
+    });
+  }
+
+  function invokeHandleError(error: unknown): DyFM_Error {
+    try {
+      DyNTS_ApiService['handleError'](buildCallParams(), error, { pathParams: {}, body: {} }, internalUrl);
+    } catch (thrown: unknown) {
+      return thrown as DyFM_Error;
+    }
+    throw new Error('handleError did not throw');
+  }
+
+  it('| HE3 (ECONNREFUSED): a _message NEM tartalmazza a belső URL-t; a confidentialContent igen', () => {
+    const thrown: DyFM_Error = invokeHandleError({ code: 'ECONNREFUSED', message: 'connect ECONNREFUSED' });
+
+    expect(thrown._message).not.toContain('auth-service:39005');
+    expect(thrown._message).toContain('loginCall');
+    expect(thrown.confidentialContent?.url).toBe(internalUrl);
+  });
+
+  it('| HE4 (status code): a _message NEM tartalmazza a belső endpointot/URL-t', () => {
+    const axiosLike = {
+      config: {},
+      message: 'Request failed with status code 401',
+      response: { status: 401 },
+    };
+    const thrown: DyFM_Error = invokeHandleError(axiosLike);
+
+    expect(thrown._message).not.toContain('auth-service:39005');
+    expect(thrown.confidentialContent?.url).toBe(internalUrl);
+    expect(thrown.additionalContent?.callName).toBe('loginCall');
+  });
+});

package/src/_services/core/api.service.ts

@@ -264,12 +264,19 @@ export class DyNTS_ApiService {
         ),
 
         errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-API-HE1`,
-        message: 
+        // BFR-DYNAMOBUILDER-006: a BELSŐ BE-BE URL (Docker-hostname+port) NEM kerülhet a _message-be —
+        // non-prod env-en a teljes error kimegy a kliensnek → info-disclosure. A _message csak a
+        // hívás NEVÉT hordozza; az URL + callParams a confidentialContent-be megy (error-store-ba
+        // perzisztálódik, a response-strip env-FÜGGETLENÜL levágja).
+        message:
           `API call "${callParams.name}" failed on the other end!`+
-          `\nurl: ${url}` +
           `\nerror response found: ${errorMsg}`,
         error: dyfmErrorInAxiosResponse,
         additionalContent: {
+          callName: callParams.name,
+        },
+        confidentialContent: {
+          url: url,
           callParams: callParams,
           inputParams: inputParams,
           response: (error as Axios.AxiosError)?.response,
@@ -287,8 +294,12 @@ export class DyNTS_ApiService {
 
         status: 404,
         errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-API-HE2`,
-        message: 'DNS error; address cannot be resolved!',
+        message: `DNS error; address cannot be resolved! (call: "${callParams.name}")`,
         additionalContent: {
+          callName: callParams.name,
+        },
+        confidentialContent: {
+          url: url,
           callParams: callParams,
           inputParams: inputParams,
           response: (error as Axios.AxiosError)?.response,
@@ -306,11 +317,15 @@ export class DyNTS_ApiService {
 
         status: 404,
         errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-API-HE3`,
-        message: `Can't connect to the endpoint! \n(${callParams.type} "${url}")`,
+        // BFR-DYNAMOBUILDER-006: az URL confidentialContent-be (nem a _message-be) — belső host-leak ellen.
+        message: `Can't connect to the endpoint! (call: "${callParams.name}")`,
         additionalContent: {
+          callName: callParams.name,
+        },
+        confidentialContent: {
+          url: url,
           callParams: callParams,
           inputParams: inputParams,
-          url: url,
           response: (error as Axios.AxiosError)?.response,
         },
       });
@@ -325,15 +340,14 @@ export class DyNTS_ApiService {
         500;
 
       if ((error as Axios.AxiosError)?.message?.includes('status code')) {
-        msg += `"${callParams.name}"` +
-          `\nendpoint: ${callParams.type} "${callParams.baseUrl}${callParams.endpoint}"` +
-          `\nurl: ${url}` +
+        // BFR-DYNAMOBUILDER-006: a _message CSAK a hívás-nevet + path-param-KULCSOKAT hordozza —
+        // a belső endpoint/URL/stack a confidentialContent-be megy (response-ba SOHA).
+        msg += ` "${callParams.name}"` +
           `\npathParams: ${
-            inputParams?.pathParams ? 
-              Object.keys(inputParams.pathParams).join(', ') : 
+            inputParams?.pathParams ?
+              Object.keys(inputParams.pathParams).join(', ') :
               '-no path params-'
-          }` +
-          `\nenpointStackLocation: ${callParams.stack}`;
+          }`;
       }
 
       throw new DyFM_Error({
@@ -346,6 +360,12 @@ export class DyNTS_ApiService {
         message: msg,
         errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-API-HE4`,
         additionalContent: {
+          callName: callParams.name,
+        },
+        confidentialContent: {
+          url: url,
+          endpoint: `${callParams.type} "${callParams.baseUrl}${callParams.endpoint}"`,
+          endpointStackLocation: callParams.stack,
           callParams: callParams,
           inputParams: inputParams,
           response: (error as Axios.AxiosError)?.response,

package/src/_services/core/db-stats.service.ts

@@ -0,0 +1,104 @@
+import * as mongoose from 'mongoose';
+
+import { DyFM_Log } from '@futdevpro/fsm-dynamo';
+
+/**
+ * BFR-OVERSEER-004 — stats-only DB-diagnosztika (NO direct data read).
+ *
+ * Per-collection rekordszám + adat-méret + index-méret (a `$collStats` aggregation-stage-en át —
+ * metaadat-olvasás, SOHA nem dokumentum-tartalom) + összesített DB-méret. A 2026-06-23 overseer-incidens
+ * (3 GB-ra hízott archív-collection, csak kézi mongosh-sal látszott) proaktív early-warningja: minden
+ * NTS-szerver default megkapja a `/server/db-stats` endpointon (app-auth-tal gate-elhető).
+ */
+
+export interface DyNTS_CollectionStats {
+  name: string;
+  documentCount: number;
+  sizeMB: number;
+  indexSizeMB: number;
+}
+
+export interface DyNTS_DbStats {
+  dbName: string;
+  collections: DyNTS_CollectionStats[];
+  totalSizeMB: number;
+  totalIndexSizeMB: number;
+  totalDocumentCount: number;
+  /** A gyűjtés közben elhasalt collection-ök (never-silent — a kihagyás látható). */
+  failedCollections: string[];
+}
+
+const BYTES_PER_MB: number = 1024 * 1024;
+
+export class DyNTS_DbStats_Util {
+
+  /**
+   * A teljes stats-only pillanatkép. Hibatűrő: egy-egy collection statjának elhasalása NEM
+   * borítja a többit (failedCollections-be kerül, warn-nal — no-silent-skip).
+   */
+  static async collect(connection: mongoose.Connection): Promise<DyNTS_DbStats> {
+    const db: typeof connection.db = connection?.db;
+    if (!db) {
+      return {
+        dbName: connection?.name ?? '-no-connection-',
+        collections: [],
+        totalSizeMB: 0,
+        totalIndexSizeMB: 0,
+        totalDocumentCount: 0,
+        failedCollections: [],
+      };
+    }
+
+    const collectionInfos: { name: string }[] = await db.listCollections({}, { nameOnly: true }).toArray();
+    const collections: DyNTS_CollectionStats[] = [];
+    const failedCollections: string[] = [];
+
+    for (const info of collectionInfos) {
+      try {
+        // $collStats storageStats: metaadat-only (size/count/totalIndexSize) — nincs dokumentum-olvasás.
+        const statsCursor = db.collection(info.name).aggregate([
+          { $collStats: { storageStats: {} } },
+        ]);
+        const statsDocs: Record<string, unknown>[] = await statsCursor.toArray();
+        const storage: Record<string, unknown> =
+          (statsDocs[0]?.['storageStats'] ?? {}) as Record<string, unknown>;
+
+        collections.push({
+          name: info.name,
+          documentCount: Number(storage['count'] ?? 0),
+          sizeMB: DyNTS_DbStats_Util.toMB(Number(storage['size'] ?? 0)),
+          indexSizeMB: DyNTS_DbStats_Util.toMB(Number(storage['totalIndexSize'] ?? 0)),
+        });
+      } catch (error) {
+        failedCollections.push(info.name);
+        DyFM_Log.warn(`(DyNTS_DbStats) collStats failed for "${info.name}" (non-fatal)`, error);
+      }
+    }
+
+    // Méret szerint csökkenő — a bloat-gyanús collection legyen elöl.
+    collections.sort((a: DyNTS_CollectionStats, b: DyNTS_CollectionStats): number => b.sizeMB - a.sizeMB);
+
+    return {
+      dbName: connection.name,
+      collections: collections,
+      totalSizeMB: DyNTS_DbStats_Util.round2(
+        collections.reduce((sum: number, c: DyNTS_CollectionStats): number => sum + c.sizeMB, 0)
+      ),
+      totalIndexSizeMB: DyNTS_DbStats_Util.round2(
+        collections.reduce((sum: number, c: DyNTS_CollectionStats): number => sum + c.indexSizeMB, 0)
+      ),
+      totalDocumentCount: collections.reduce(
+        (sum: number, c: DyNTS_CollectionStats): number => sum + c.documentCount, 0
+      ),
+      failedCollections: failedCollections,
+    };
+  }
+
+  static toMB(bytes: number): number {
+    return DyNTS_DbStats_Util.round2(bytes / BYTES_PER_MB);
+  }
+
+  static round2(value: number): number {
+    return Math.round(value * 100) / 100;
+  }
+}

package/src/_services/core/diagnostics.service.spec.ts

@@ -0,0 +1,44 @@
+import { DyNTS_DbStats_Util } from './db-stats.service';
+import { DyNTS_Diagnostics, DyNTS_DoctorCheck } from './diagnostics.service';
+
+/**
+ * BFR-AM-015 / BFR-OVERSEER-004 — a diagnosztika PURE részeinek unit-tesztjei
+ * (interpretHealth / buildSummary / MB-kerekítés).
+ */
+describe('| DyNTS_Diagnostics (pure)', () => {
+
+  const ok: DyNTS_DoctorCheck = { name: 'a', health: 'ok' };
+  const warn: DyNTS_DoctorCheck = { name: 'b', health: 'warn', fixHint: 'do b' };
+  const fail: DyNTS_DoctorCheck = { name: 'c', health: 'fail', fixHint: 'do c' };
+
+  it('| interpretHealth: fail dominál, aztán warn, különben ok', () => {
+    expect(DyNTS_Diagnostics.interpretHealth([ ok, ok ])).toBe('ok');
+    expect(DyNTS_Diagnostics.interpretHealth([ ok, warn ])).toBe('warn');
+    expect(DyNTS_Diagnostics.interpretHealth([ warn, fail, ok ])).toBe('fail');
+    expect(DyNTS_Diagnostics.interpretHealth([])).toBe('ok');
+  });
+
+  it('| buildSummary: all-ok → "all checks ok"; nem-ok check-ek fixHint-tel listázva', () => {
+    expect(DyNTS_Diagnostics.buildSummary([ ok ])).toBe('all checks ok');
+    const summary: string = DyNTS_Diagnostics.buildSummary([ ok, warn, fail ]);
+    expect(summary).toContain('b: warn — do b');
+    expect(summary).toContain('c: fail — do c');
+    expect(summary).not.toContain('a:');
+  });
+});
+
+describe('| DyNTS_DbStats_Util (pure)', () => {
+
+  it('| toMB: byte → MB két tizedesre', () => {
+    expect(DyNTS_DbStats_Util.toMB(1024 * 1024)).toBe(1);
+    expect(DyNTS_DbStats_Util.toMB(1536 * 1024)).toBe(1.5);
+    expect(DyNTS_DbStats_Util.toMB(0)).toBe(0);
+  });
+
+  it('| collect: kapcsolat nélkül üres, nem-dobó eredmény', async () => {
+    const stats = await DyNTS_DbStats_Util.collect(undefined as never);
+    expect(stats.collections).toEqual([]);
+    expect(stats.totalSizeMB).toBe(0);
+    expect(stats.failedCollections).toEqual([]);
+  });
+});

package/src/_services/core/diagnostics.service.ts

@@ -0,0 +1,158 @@
+import * as mongoose from 'mongoose';
+
+import { DyFM_Log } from '@futdevpro/fsm-dynamo';
+
+import { DyNTS_DbStats, DyNTS_DbStats_Util } from './db-stats.service';
+import { DyNTS_EventLoopDiag } from './event-loop-diag.service';
+import { DyNTS_MemoryGuard } from './memory-guard.service';
+
+/**
+ * BFR-AM-015 (+ BFR-OVERSEER-004 aggregátor-fele) — generikus, újrahasználható diagnosztikai
+ * aggregátor MINDEN `DyNTS_App`-hoz: a `GET /server/doctor` endpoint forrása.
+ *
+ * Check-ek (mind SAJÁT try-ban — egy elhasaló check nem borítja a doctort, néma hiba TILOS):
+ *  - mongo: kapcsolat + ping (readiness-minta);
+ *  - memory: MemoryGuard pressure-snapshot;
+ *  - eventLoop: EventLoopDiag snapshot;
+ *  - dbStats: stats-only collection-méretek + küszöb-warn a bloat-gyanúra.
+ * Az app APP-SPECIFIKUS check-eket regisztrálhat (`registerCheck`) — pl. env-validáció,
+ * provider-probe (a FAM `FAM_Doctor` mintája bedrock-magként).
+ */
+
+export interface DyNTS_DoctorCheck {
+  name: string;
+  health: 'ok' | 'warn' | 'fail';
+  detail?: unknown;
+  /** Mit tegyen az operátor, ha nem ok (néma hiba tilos — a hint kötelező nem-ok esetén). */
+  fixHint?: string;
+}
+
+export interface DyNTS_DoctorReport {
+  health: 'ok' | 'warn' | 'fail';
+  checks: DyNTS_DoctorCheck[];
+  summary: string;
+  uptimeSec: number;
+}
+
+/** App-specifikus check-függvény (a doctor futtatja, saját try-ban). */
+export type DyNTS_DoctorCheckFn = () => Promise<DyNTS_DoctorCheck>;
+
+/** Collection-méret warn-küszöb (MB) — e fölött a dbStats-check warn-ra vált. */
+const DEFAULT_COLLECTION_WARN_MB: number = 512;
+
+export class DyNTS_Diagnostics {
+
+  private static readonly customChecks: DyNTS_DoctorCheckFn[] = [];
+
+  /** App-specifikus check regisztrálása (pl. env-validáció, provider-probe). */
+  static registerCheck(check: DyNTS_DoctorCheckFn): void {
+    DyNTS_Diagnostics.customChecks.push(check);
+  }
+
+  /** A teljes doctor-riport. SOSEM dob — a hibás check `fail`-ként jelenik meg. */
+  static async runDoctor(set: {
+    connection: mongoose.Connection,
+    collectionWarnMB?: number,
+  }): Promise<DyNTS_DoctorReport> {
+    const checks: DyNTS_DoctorCheck[] = [];
+
+    // 1) Mongo-probe (readiness-minta: readyState + admin ping).
+    try {
+      const readyState: number = set.connection?.readyState ?? 0;
+      let pingOk: boolean = false;
+      if (readyState === 1) {
+        await set.connection.db?.admin().ping();
+        pingOk = true;
+      }
+      checks.push({
+        name: 'mongo',
+        health: readyState === 1 && pingOk ? 'ok' : 'fail',
+        detail: { readyState: readyState, pingOk: pingOk },
+        fixHint: readyState === 1 && pingOk ? undefined
+          : 'Check MONGO_URL + DB container/network reachability (readyState 1 + ping expected).',
+      });
+    } catch (error) {
+      checks.push({
+        name: 'mongo', health: 'fail', detail: String(error),
+        fixHint: 'Mongo ping threw — check DB availability/credentials.',
+      });
+    }
+
+    // 2) Memória (MemoryGuard pressure).
+    try {
+      const pressure: unknown = DyNTS_MemoryGuard.getInstance().pressure();
+      const level: string = String((pressure as { level?: string })?.level ?? 'ok');
+      checks.push({
+        name: 'memory',
+        health: level === 'critical' ? 'fail' : level === 'warning' ? 'warn' : 'ok',
+        detail: pressure,
+        fixHint: level === 'ok' ? undefined
+          : 'Heap pressure — check collection sizes (/server/db-stats) + recent load; consider retention.',
+      });
+    } catch (error) {
+      checks.push({ name: 'memory', health: 'warn', detail: String(error), fixHint: 'MemoryGuard snapshot failed.' });
+    }
+
+    // 3) Event-loop lag.
+    try {
+      const snapshot: unknown = DyNTS_EventLoopDiag.getInstance().getSnapshot();
+      checks.push({ name: 'eventLoop', health: 'ok', detail: snapshot });
+    } catch (error) {
+      checks.push({ name: 'eventLoop', health: 'warn', detail: String(error), fixHint: 'EventLoopDiag snapshot failed.' });
+    }
+
+    // 4) DB-stats + bloat-küszöb (BFR-OVERSEER-004 early-warning).
+    try {
+      const stats: DyNTS_DbStats = await DyNTS_DbStats_Util.collect(set.connection);
+      const warnMB: number = set.collectionWarnMB ?? DEFAULT_COLLECTION_WARN_MB;
+      const bloated: string[] = stats.collections
+        .filter((c): boolean => c.sizeMB + c.indexSizeMB > warnMB)
+        .map((c): string => `${c.name} (${c.sizeMB}MB + ${c.indexSizeMB}MB idx)`);
+      checks.push({
+        name: 'dbStats',
+        health: bloated.length ? 'warn' : 'ok',
+        detail: { totalSizeMB: stats.totalSizeMB, collectionCount: stats.collections.length, bloated: bloated },
+        fixHint: bloated.length
+          ? `Collections over ${warnMB}MB — add dataParams.retention (TTL) or prune: ${bloated.join(', ')}`
+          : undefined,
+      });
+    } catch (error) {
+      checks.push({ name: 'dbStats', health: 'warn', detail: String(error), fixHint: 'db-stats collection failed.' });
+    }
+
+    // 5) App-specifikus check-ek.
+    for (const customCheck of DyNTS_Diagnostics.customChecks) {
+      try {
+        checks.push(await customCheck());
+      } catch (error) {
+        DyFM_Log.warn('(DyNTS_Diagnostics) custom check threw (reported as fail)', error);
+        checks.push({ name: 'custom', health: 'fail', detail: String(error), fixHint: 'Custom check threw — see detail.' });
+      }
+    }
+
+    return {
+      health: DyNTS_Diagnostics.interpretHealth(checks),
+      checks: checks,
+      summary: DyNTS_Diagnostics.buildSummary(checks),
+      uptimeSec: Math.round(process.uptime()),
+    };
+  }
+
+  /** Aggregált health: bármely fail → fail; különben bármely warn → warn; különben ok. Pure (unit-tesztelt). */
+  static interpretHealth(checks: DyNTS_DoctorCheck[]): 'ok' | 'warn' | 'fail' {
+    if (checks.some((c: DyNTS_DoctorCheck): boolean => c.health === 'fail')) { return 'fail'; }
+    if (checks.some((c: DyNTS_DoctorCheck): boolean => c.health === 'warn')) { return 'warn'; }
+    return 'ok';
+  }
+
+  /** Ember-olvasható összegzés a nem-ok check-ekből. Pure (unit-tesztelt). */
+  static buildSummary(checks: DyNTS_DoctorCheck[]): string {
+    const notOk: DyNTS_DoctorCheck[] = checks.filter((c: DyNTS_DoctorCheck): boolean => c.health !== 'ok');
+    if (!notOk.length) {
+      return 'all checks ok';
+    }
+    return notOk
+      .map((c: DyNTS_DoctorCheck): string => `${c.name}: ${c.health}${c.fixHint ? ` — ${c.fixHint}` : ''}`)
+      .join(' | ');
+  }
+}

package/src/index.ts

@@ -58,6 +58,8 @@ export * from './_collections/security-headers.util';
 export * from './_collections/client-safe-error.util';
 export * from './_collections/load-shed.util';
 export * from './_services/core/event-loop-diag.service';
+export * from './_services/core/db-stats.service';
+export * from './_services/core/diagnostics.service';
 
 // models/CONTROL MODELS
 export * from './_models/control-models/api-call-params.control-model';