@futdevpro/nts-dynamo 1.15.156 → 1.15.157

package/__documentations/2026-08-22-bfr-ctm-018-content-free-endpoint-errors.md

@@ -1,54 +1,54 @@
-# BFR-CTM-018 — content-free endpoint error boundary
-
-**Date:** 2026-08-22
-**Status:** implemented and package-verified; consumer adoption is recorded by the requesting project
-**Target:** `@futdevpro/nts-dynamo`
-**Contract:** `dynts-safe-diagnostic/1`
-
-## Measured defect
-
-The shared `DyNTS_Endpoint_Params` error path constructed framework logs from route identity, path parameter
-values, raw `Error.message`, stack location and a request snapshot. The snapshot included URL, query, request
-metadata, header keys, IP address and an authorization-header shape. A plain error and a consumer global-handler
-rejection were also passed directly to Dynamo loggers. The primary raw log was unconditional, so disabling
-application API-error logging did not close the disclosure path.
-
-The same execution function declared a second local `issuer` variable inside the request callback. It shadowed
-the issuer captured by the error path, so a failing endpoint forwarded `undefined` rather than the resolved
-account identity to the consumer global handler.
-
-## Implemented Bedrock response
-
-- Added the closed `endpoint` safe-diagnostic stage.
-- Projected constructor, issuer-resolution, task/pre-process, consumer-handler, secondary-handler and circulation
-  failures through `DyNTS_SafeDiagnostic_ControlService`.
-- Removed framework-owned raw message, stack, route, request and response-preview logging from endpoint failures.
-- Removed mutation of caller errors with `endpointInfo` and `requestDebug` snapshots.
-- Wrapped plain failures with a static internal message and the immutable safe diagnostic while retaining the
-  existing public endpoint error-code shape and validated HTTP status behavior.
-- Sanitized and bounded developer-owned system and endpoint identifiers used in the compatibility error code.
-- Preserved raw failure/request access only for the explicitly installed application global handler; a rejection
-  from that handler is itself projected before logging.
-- Removed the issuer shadow so the resolved account identity reaches the application-owned error persistence
-  boundary.
-
-Normal successful-request logging is outside this change. Its existing request-param, body and response fields
-remain explicit caller-controlled options. This BFR makes the error path content-free regardless of those options
-or detailed logging mode.
-
-## Verification evidence
-
-- TypeScript production build: passed.
-- Focused BFR canary regression: 1/1 passed.
-- Full Jasmine package regression: 1750 specs, 0 failures, 146 explicit pending specs.
-- Package ESLint: 0 errors; the repository retains its pre-existing warning baseline.
-- Canary matrix: raw error message, secondary handler stack/token, workbook/sheet value, URL, query, header,
-  authorization value and path parameter are absent from every captured Dynamo logger call and from the client
-  response. The 503 status, safe diagnostic and resolved issuer are asserted.
-- Import validator baseline: 80 findings in 74 pre-existing files; the modified endpoint and safe-diagnostic files
-  introduce no import finding.
-- Naming validator baseline: 100 findings in 67 pre-existing files. The endpoint class carries its existing public
-  naming findings; this compatible security fix does not rename that public API.
-
-The validator baselines are reported as measured debt, not as green evidence. No unrelated mass rename or import
-rewrite is bundled into this security BFR.
+# BFR-CTM-018 — content-free endpoint error boundary
+
+**Date:** 2026-08-22
+**Status:** implemented and package-verified; consumer adoption is recorded by the requesting project
+**Target:** `@futdevpro/nts-dynamo`
+**Contract:** `dynts-safe-diagnostic/1`
+
+## Measured defect
+
+The shared `DyNTS_Endpoint_Params` error path constructed framework logs from route identity, path parameter
+values, raw `Error.message`, stack location and a request snapshot. The snapshot included URL, query, request
+metadata, header keys, IP address and an authorization-header shape. A plain error and a consumer global-handler
+rejection were also passed directly to Dynamo loggers. The primary raw log was unconditional, so disabling
+application API-error logging did not close the disclosure path.
+
+The same execution function declared a second local `issuer` variable inside the request callback. It shadowed
+the issuer captured by the error path, so a failing endpoint forwarded `undefined` rather than the resolved
+account identity to the consumer global handler.
+
+## Implemented Bedrock response
+
+- Added the closed `endpoint` safe-diagnostic stage.
+- Projected constructor, issuer-resolution, task/pre-process, consumer-handler, secondary-handler and circulation
+  failures through `DyNTS_SafeDiagnostic_ControlService`.
+- Removed framework-owned raw message, stack, route, request and response-preview logging from endpoint failures.
+- Removed mutation of caller errors with `endpointInfo` and `requestDebug` snapshots.
+- Wrapped plain failures with a static internal message and the immutable safe diagnostic while retaining the
+  existing public endpoint error-code shape and validated HTTP status behavior.
+- Sanitized and bounded developer-owned system and endpoint identifiers used in the compatibility error code.
+- Preserved raw failure/request access only for the explicitly installed application global handler; a rejection
+  from that handler is itself projected before logging.
+- Removed the issuer shadow so the resolved account identity reaches the application-owned error persistence
+  boundary.
+
+Normal successful-request logging is outside this change. Its existing request-param, body and response fields
+remain explicit caller-controlled options. This BFR makes the error path content-free regardless of those options
+or detailed logging mode.
+
+## Verification evidence
+
+- TypeScript production build: passed.
+- Focused BFR canary regression: 1/1 passed.
+- Full Jasmine package regression: 1750 specs, 0 failures, 146 explicit pending specs.
+- Package ESLint: 0 errors; the repository retains its pre-existing warning baseline.
+- Canary matrix: raw error message, secondary handler stack/token, workbook/sheet value, URL, query, header,
+  authorization value and path parameter are absent from every captured Dynamo logger call and from the client
+  response. The 503 status, safe diagnostic and resolved issuer are asserted.
+- Import validator baseline: 80 findings in 74 pre-existing files; the modified endpoint and safe-diagnostic files
+  introduce no import finding.
+- Naming validator baseline: 100 findings in 67 pre-existing files. The endpoint class carries its existing public
+  naming findings; this compatible security fix does not rename that public API.
+
+The validator baselines are reported as measured debt, not as green evidence. No unrelated mass rename or import
+rewrite is bundled into this security BFR.

package/__documentations/2026-08-22-bfr-ctm-020-content-free-request-telemetry.md

@@ -0,0 +1,65 @@
+# BFR-CTM-020 — content-free request correlation and telemetry
+
+**Date:** 2026-08-22
+**Status:** implemented and package-verified; consumer adoption is recorded by the requesting project
+**Target:** `@futdevpro/nts-dynamo`
+**Contract:** `dynts-request-telemetry/1`
+
+## Measured platform gap
+
+`DyNTS_App` previously exposed only an application middleware hook after API routing. A consumer could not install
+one correlation and request-metric boundary before load shedding and every open and secure route without
+duplicating Bedrock server setup or depending on Express internals. This prevented a direct Dynamo implementation
+of content-free, route-aware operational telemetry.
+
+## Implemented Bedrock capability
+
+- `DyNTS_App.getRequestTelemetrySettings()` opts the application into one immutable process-wide configuration.
+- Both Express applications mount the telemetry middleware after CORS and the application-version header, but
+  before load shedding and API routes.
+- Every request receives a server-generated UUID in `X-Correlation-Id`. Incoming correlation values are never
+  trusted or reused, and the response header is exposed through the existing CORS-header composition utility.
+- `DyNTS_RoutingModule` labels a request only from its declared full route template before endpoint execution.
+- `DyNTS_RequestTelemetry_ControlService.snapshot()` returns a synchronous copy of bounded, event-driven counters:
+  started, completed, aborted and in-flight requests; status classes; duration buckets; and per method/declared-route
+  counts, aborts, server errors, total duration and maximum duration.
+- Response `finish` and `close` listeners settle exactly once and remove each other. Header, listener or completion
+  observation failures are contained and cannot change the application response path.
+- Configuration is validated and idempotent. Conflicting configuration, invalid cardinality and invalid duration
+  buckets fail with stable content-free codes during application setup.
+
+## Privacy and boundedness contract
+
+The telemetry implementation never reads or retains concrete URL, query, request or response body, request header
+values, IP address, user agent, account identity, workbook data, error content or stack information. Correlation IDs
+are generated opaque identifiers and are not accepted from callers.
+
+Route labels accept only the closed declared-template character set and a 160-character maximum. Invalid labels and
+identities beyond the configured cardinality cap aggregate into `__other__`; requests that do not reach a Dynamo
+route aggregate into `__unmatched__`. Methods use a fixed allowlist, duration buckets are strictly increasing and
+bounded, and every numeric accumulator saturates at `Number.MAX_SAFE_INTEGER`. No timer, poller, background worker,
+network exporter or persistence layer is started by this capability.
+
+## Consumer adoption contract
+
+A consumer enables the capability directly in its `DyNTS_App` subclass and reads the singleton snapshot directly
+for its authenticated operator surface or synchronous diagnostic evidence. An application error boundary may call
+`getCorrelationId(req)` while the request is active and persist that opaque identifier beside its own content-free
+error record. Alert evaluation, retention and external export remain explicit consumer policies; Bedrock supplies
+the safe measurement primitive and does not invent those policies.
+
+## Verification evidence
+
+- TypeScript build: passed.
+- Focused BFR regression: 8/8 specs passed.
+- Final full Jasmine regression: 1758 specs, 0 failures, 146 explicit pending specs.
+- New telemetry source and specs: zero ESLint errors and zero warnings.
+- Package ESLint baseline: zero errors and 17,600 pre-existing warnings in 376 files. The new telemetry files are
+  warning-free; the modified routing and app hosts retain their existing warning baseline.
+- Import validator baseline: 80 findings in 74 pre-existing files; none is in a new telemetry file or caused by the
+  added imports.
+- Naming validator baseline: 100 findings in 67 pre-existing files; none is in a new telemetry file.
+- Canary coverage: generated correlation, caller-value rejection, CORS exposure, finish/close exactly-once behavior,
+  aborted requests, 5xx aggregation, declared-route identity, invalid-route redaction, cardinality overflow, disabled
+  no-op behavior, per-template method preservation, immutable configuration, invalid bounds, header setup containment
+  and late completion containment.

package/__documentations/2026-08-22-content-free-process-error-boundary.md

@@ -54,28 +54,28 @@ MongoDB connection success logs only the stable fact that MongoDB is connected.
 initial connection failure and runtime connection failure do not interpolate the URI. The URI remains an input
 to Mongoose because it is operationally required, but it is not a diagnostic value.
 
-The default `DyNTS_GlobalService` handler also projects a raw failure before logging. A consumer-supplied global
-handler remains a consumer boundary; failures forwarded by `DyNTS_App` reach it as a content-free `DyFM_Error`.
-If that handler throws or rejects, Dynamo-NTS projects the secondary failure rather than recursively logging it.
-
-## Endpoint error integration
-
-`DyNTS_Endpoint_Params` applies the same projection at every framework-owned endpoint failure boundary. The
-primary task or pre-process failure, issuer-resolution failure, consumer global-handler rejection, secondary
-error-handler failure and circulation-resolution failure are classified with stable uppercase codes and the
-closed `endpoint` stage. Detailed logging mode does not bypass this projection.
-
-The endpoint boundary does not append route values, path parameters, URL, query, request body, headers, auth
-header shape, error message, stack or nested error content to logs or `additionalContent`. A plain native failure
-is converted to a client-safe `DyFM_Error` with a static internal message, the established
-`<SYSTEM>|DyNTS-EPP-<endpointName>` public code shape and the projected diagnostic. Developer-owned system and
-endpoint code parts are bounded and reduced to the established identifier alphabet. Conventional numeric HTTP
-status fields remain supported without inspecting message or stack.
-
-The raw failure and request remain available to the explicitly installed consumer global handler because that
-handler is the application-owned persistence boundary. If it rejects, the rejection is projected before any
-framework log. The resolved issuer is now carried through the error path rather than being shadowed by a local
-variable, so account-level attribution remains intact.
+The default `DyNTS_GlobalService` handler also projects a raw failure before logging. A consumer-supplied global
+handler remains a consumer boundary; failures forwarded by `DyNTS_App` reach it as a content-free `DyFM_Error`.
+If that handler throws or rejects, Dynamo-NTS projects the secondary failure rather than recursively logging it.
+
+## Endpoint error integration
+
+`DyNTS_Endpoint_Params` applies the same projection at every framework-owned endpoint failure boundary. The
+primary task or pre-process failure, issuer-resolution failure, consumer global-handler rejection, secondary
+error-handler failure and circulation-resolution failure are classified with stable uppercase codes and the
+closed `endpoint` stage. Detailed logging mode does not bypass this projection.
+
+The endpoint boundary does not append route values, path parameters, URL, query, request body, headers, auth
+header shape, error message, stack or nested error content to logs or `additionalContent`. A plain native failure
+is converted to a client-safe `DyFM_Error` with a static internal message, the established
+`<SYSTEM>|DyNTS-EPP-<endpointName>` public code shape and the projected diagnostic. Developer-owned system and
+endpoint code parts are bounded and reduced to the established identifier alphabet. Conventional numeric HTTP
+status fields remain supported without inspecting message or stack.
+
+The raw failure and request remain available to the explicitly installed consumer global handler because that
+handler is the application-owned persistence boundary. If it rejects, the rejection is projected before any
+framework log. The resolved issuer is now carried through the error path rather than being shadowed by a local
+variable, so account-level attribution remains intact.
 
 ## Security and privacy properties
 
@@ -98,10 +98,10 @@ variable, so account-level attribution remains intact.
 | Process-boundary runtime test | Unhandled rejection is projected before both logging and global-handler forwarding. |
 | Bootstrap runtime test | Rejected construction is projected before logging/forwarding and terminates with exit code 1. |
 | Default-handler runtime test | Raw input is projected before default global logging. |
-| App-params test | A malformed credential-bearing MongoDB URI triggers a warning without exposing the URI. |
-| Endpoint runtime test | Error, handler, token, workbook, URL, query, header and path canaries are absent from every endpoint log and client response. |
-| Static source scan | No Dynamo-NTS App log call receives raw error, stack, promise, construct-error collection or DB URI. |
-| Full package regression | Build and complete Jasmine suite remain green; validator findings are measured and reported, never hidden. |
+| App-params test | A malformed credential-bearing MongoDB URI triggers a warning without exposing the URI. |
+| Endpoint runtime test | Error, handler, token, workbook, URL, query, header and path canaries are absent from every endpoint log and client response. |
+| Static source scan | No Dynamo-NTS App log call receives raw error, stack, promise, construct-error collection or DB URI. |
+| Full package regression | Build and complete Jasmine suite remain green; validator findings are measured and reported, never hidden. |
 
 ## Consumer adoption requirement
 

package/build/_collections/app-version-header.util.d.ts

@@ -1,42 +1,42 @@
-import * as Express from 'express';
-/**
- * FR-292 (2026-08-08) — a DEPLOYOLT app-verzió kiírása MINDEN válasz headerébe.
- *
- * **Miért kell:** a böngészőben nyitva hagyott SPA a memóriájában tartja a bundle-t, és a
- * deploy után is a RÉGI kódot futtatja, amíg a felhasználó újra nem tölt. Ez nem elméleti:
- * egy órákig nyitva hagyott dashboard-fülön hiányzó gombokat / régi viselkedést mutat, és
- * a felhasználó (jogosan) azt hiszi, hogy a funkció nincs kész.
- *
- * Az itteni megoldás **nem polling**: a szerver minden válaszra ráteszi a saját deployolt
- * app-verzióját, a kliens pedig a MÁR MEGLÉVŐ hívásaiból olvassa ki (ngx oldalon a
- * `DyNX_AppVersion_Interceptor`). Nulla extra kérés, nulla extra terhelés — a jelzés
- * „ingyen" utazik azon, ami úgyis megy.
- *
- * **CORS:** cross-origin kliens csak akkor OLVASHATJA a headert, ha az szerepel az
- * `Access-Control-Expose-Headers`-ben. Ezért a middleware a meglévő értékhez HOZZÁFŰZ
- * (nem felülír) — ezért kell a CORS-mount UTÁN felszerelni.
- */
-/** A deployolt app-verziót hordozó response-header neve (a kliens ezt olvassa). */
-export declare const DYNTS_APP_VERSION_HEADER: string;
-/**
- * Kiszámolja az `Access-Control-Expose-Headers` ÚJ értékét úgy, hogy a meglévő listát
- * megtartja és a verzió-headert csak akkor fűzi hozzá, ha még nincs benne (idempotens).
- *
- * Tiszta függvény: Express nélkül unit-tesztelhető.
- *
- * @param currentValue a válaszon MÁR beállított érték (a CORS-middleware-től), ha van
- * @param headerName a hozzáfűzendő header neve
- */
-export declare function DyNTS_resolveExposeHeaders(currentValue: string | undefined, headerName: string): string;
-/**
- * Express-middleware, ami minden válaszra ráteszi a deployolt app-verziót.
- *
- * A verziót FÜGGVÉNYKÉNT kapja (nem értékként), mert a `DyNTS_global_settings.systemVersion`
- * az app-params betöltésekor áll be — egy induláskor kiolvasott érték `unknown-version`
- * maradhatna örökre.
- *
- * @param getAppVersion a deployolt app-verziót visszaadó getter
- * @param headerName felülírható header-név (default: `X-App-Version`)
- */
-export declare function DyNTS_createAppVersionHeaderMiddleware(getAppVersion: () => string | undefined, headerName?: string): Express.RequestHandler;
+import * as Express from 'express';
+/**
+ * FR-292 (2026-08-08) — a DEPLOYOLT app-verzió kiírása MINDEN válasz headerébe.
+ *
+ * **Miért kell:** a böngészőben nyitva hagyott SPA a memóriájában tartja a bundle-t, és a
+ * deploy után is a RÉGI kódot futtatja, amíg a felhasználó újra nem tölt. Ez nem elméleti:
+ * egy órákig nyitva hagyott dashboard-fülön hiányzó gombokat / régi viselkedést mutat, és
+ * a felhasználó (jogosan) azt hiszi, hogy a funkció nincs kész.
+ *
+ * Az itteni megoldás **nem polling**: a szerver minden válaszra ráteszi a saját deployolt
+ * app-verzióját, a kliens pedig a MÁR MEGLÉVŐ hívásaiból olvassa ki (ngx oldalon a
+ * `DyNX_AppVersion_Interceptor`). Nulla extra kérés, nulla extra terhelés — a jelzés
+ * „ingyen" utazik azon, ami úgyis megy.
+ *
+ * **CORS:** cross-origin kliens csak akkor OLVASHATJA a headert, ha az szerepel az
+ * `Access-Control-Expose-Headers`-ben. Ezért a middleware a meglévő értékhez HOZZÁFŰZ
+ * (nem felülír) — ezért kell a CORS-mount UTÁN felszerelni.
+ */
+/** A deployolt app-verziót hordozó response-header neve (a kliens ezt olvassa). */
+export declare const DYNTS_APP_VERSION_HEADER: string;
+/**
+ * Kiszámolja az `Access-Control-Expose-Headers` ÚJ értékét úgy, hogy a meglévő listát
+ * megtartja és a verzió-headert csak akkor fűzi hozzá, ha még nincs benne (idempotens).
+ *
+ * Tiszta függvény: Express nélkül unit-tesztelhető.
+ *
+ * @param currentValue a válaszon MÁR beállított érték (a CORS-middleware-től), ha van
+ * @param headerName a hozzáfűzendő header neve
+ */
+export declare function DyNTS_resolveExposeHeaders(currentValue: string | undefined, headerName: string): string;
+/**
+ * Express-middleware, ami minden válaszra ráteszi a deployolt app-verziót.
+ *
+ * A verziót FÜGGVÉNYKÉNT kapja (nem értékként), mert a `DyNTS_global_settings.systemVersion`
+ * az app-params betöltésekor áll be — egy induláskor kiolvasott érték `unknown-version`
+ * maradhatna örökre.
+ *
+ * @param getAppVersion a deployolt app-verziót visszaadó getter
+ * @param headerName felülírható header-név (default: `X-App-Version`)
+ */
+export declare function DyNTS_createAppVersionHeaderMiddleware(getAppVersion: () => string | undefined, headerName?: string): Express.RequestHandler;
 //# sourceMappingURL=app-version-header.util.d.ts.map

package/build/_collections/app-version-header.util.js

@@ -1,67 +1,67 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DYNTS_APP_VERSION_HEADER = void 0;
-exports.DyNTS_resolveExposeHeaders = DyNTS_resolveExposeHeaders;
-exports.DyNTS_createAppVersionHeaderMiddleware = DyNTS_createAppVersionHeaderMiddleware;
-/**
- * FR-292 (2026-08-08) — a DEPLOYOLT app-verzió kiírása MINDEN válasz headerébe.
- *
- * **Miért kell:** a böngészőben nyitva hagyott SPA a memóriájában tartja a bundle-t, és a
- * deploy után is a RÉGI kódot futtatja, amíg a felhasználó újra nem tölt. Ez nem elméleti:
- * egy órákig nyitva hagyott dashboard-fülön hiányzó gombokat / régi viselkedést mutat, és
- * a felhasználó (jogosan) azt hiszi, hogy a funkció nincs kész.
- *
- * Az itteni megoldás **nem polling**: a szerver minden válaszra ráteszi a saját deployolt
- * app-verzióját, a kliens pedig a MÁR MEGLÉVŐ hívásaiból olvassa ki (ngx oldalon a
- * `DyNX_AppVersion_Interceptor`). Nulla extra kérés, nulla extra terhelés — a jelzés
- * „ingyen" utazik azon, ami úgyis megy.
- *
- * **CORS:** cross-origin kliens csak akkor OLVASHATJA a headert, ha az szerepel az
- * `Access-Control-Expose-Headers`-ben. Ezért a middleware a meglévő értékhez HOZZÁFŰZ
- * (nem felülír) — ezért kell a CORS-mount UTÁN felszerelni.
- */
-/** A deployolt app-verziót hordozó response-header neve (a kliens ezt olvassa). */
-exports.DYNTS_APP_VERSION_HEADER = 'X-App-Version';
-/** Az `Access-Control-Expose-Headers` header neve — hogy ne szórjuk el string-literálként. */
-const EXPOSE_HEADERS_HEADER = 'Access-Control-Expose-Headers';
-/**
- * Kiszámolja az `Access-Control-Expose-Headers` ÚJ értékét úgy, hogy a meglévő listát
- * megtartja és a verzió-headert csak akkor fűzi hozzá, ha még nincs benne (idempotens).
- *
- * Tiszta függvény: Express nélkül unit-tesztelhető.
- *
- * @param currentValue a válaszon MÁR beállított érték (a CORS-middleware-től), ha van
- * @param headerName a hozzáfűzendő header neve
- */
-function DyNTS_resolveExposeHeaders(currentValue, headerName) {
-    if (!currentValue) {
-        return headerName;
-    }
-    const alreadyExposed = currentValue
-        .split(',')
-        .some((entry) => entry.trim().toLowerCase() === headerName.toLowerCase());
-    return alreadyExposed ? currentValue : `${currentValue}, ${headerName}`;
-}
-/**
- * Express-middleware, ami minden válaszra ráteszi a deployolt app-verziót.
- *
- * A verziót FÜGGVÉNYKÉNT kapja (nem értékként), mert a `DyNTS_global_settings.systemVersion`
- * az app-params betöltésekor áll be — egy induláskor kiolvasott érték `unknown-version`
- * maradhatna örökre.
- *
- * @param getAppVersion a deployolt app-verziót visszaadó getter
- * @param headerName felülírható header-név (default: `X-App-Version`)
- */
-function DyNTS_createAppVersionHeaderMiddleware(getAppVersion, headerName = exports.DYNTS_APP_VERSION_HEADER) {
-    return (_req, res, next) => {
-        const appVersion = getAppVersion();
-        // Ismeretlen verziónál NEM írunk headert: egy `unknown-version` jelzés rosszabb a
-        // semminél — a kliens „új verzió van" hamis riasztást adna belőle.
-        if (appVersion && appVersion !== 'unknown-version') {
-            res.setHeader(headerName, appVersion);
-            res.setHeader(EXPOSE_HEADERS_HEADER, DyNTS_resolveExposeHeaders(res.getHeader(EXPOSE_HEADERS_HEADER)?.toString(), headerName));
-        }
-        next();
-    };
-}
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DYNTS_APP_VERSION_HEADER = void 0;
+exports.DyNTS_resolveExposeHeaders = DyNTS_resolveExposeHeaders;
+exports.DyNTS_createAppVersionHeaderMiddleware = DyNTS_createAppVersionHeaderMiddleware;
+/**
+ * FR-292 (2026-08-08) — a DEPLOYOLT app-verzió kiírása MINDEN válasz headerébe.
+ *
+ * **Miért kell:** a böngészőben nyitva hagyott SPA a memóriájában tartja a bundle-t, és a
+ * deploy után is a RÉGI kódot futtatja, amíg a felhasználó újra nem tölt. Ez nem elméleti:
+ * egy órákig nyitva hagyott dashboard-fülön hiányzó gombokat / régi viselkedést mutat, és
+ * a felhasználó (jogosan) azt hiszi, hogy a funkció nincs kész.
+ *
+ * Az itteni megoldás **nem polling**: a szerver minden válaszra ráteszi a saját deployolt
+ * app-verzióját, a kliens pedig a MÁR MEGLÉVŐ hívásaiból olvassa ki (ngx oldalon a
+ * `DyNX_AppVersion_Interceptor`). Nulla extra kérés, nulla extra terhelés — a jelzés
+ * „ingyen" utazik azon, ami úgyis megy.
+ *
+ * **CORS:** cross-origin kliens csak akkor OLVASHATJA a headert, ha az szerepel az
+ * `Access-Control-Expose-Headers`-ben. Ezért a middleware a meglévő értékhez HOZZÁFŰZ
+ * (nem felülír) — ezért kell a CORS-mount UTÁN felszerelni.
+ */
+/** A deployolt app-verziót hordozó response-header neve (a kliens ezt olvassa). */
+exports.DYNTS_APP_VERSION_HEADER = 'X-App-Version';
+/** Az `Access-Control-Expose-Headers` header neve — hogy ne szórjuk el string-literálként. */
+const EXPOSE_HEADERS_HEADER = 'Access-Control-Expose-Headers';
+/**
+ * Kiszámolja az `Access-Control-Expose-Headers` ÚJ értékét úgy, hogy a meglévő listát
+ * megtartja és a verzió-headert csak akkor fűzi hozzá, ha még nincs benne (idempotens).
+ *
+ * Tiszta függvény: Express nélkül unit-tesztelhető.
+ *
+ * @param currentValue a válaszon MÁR beállított érték (a CORS-middleware-től), ha van
+ * @param headerName a hozzáfűzendő header neve
+ */
+function DyNTS_resolveExposeHeaders(currentValue, headerName) {
+    if (!currentValue) {
+        return headerName;
+    }
+    const alreadyExposed = currentValue
+        .split(',')
+        .some((entry) => entry.trim().toLowerCase() === headerName.toLowerCase());
+    return alreadyExposed ? currentValue : `${currentValue}, ${headerName}`;
+}
+/**
+ * Express-middleware, ami minden válaszra ráteszi a deployolt app-verziót.
+ *
+ * A verziót FÜGGVÉNYKÉNT kapja (nem értékként), mert a `DyNTS_global_settings.systemVersion`
+ * az app-params betöltésekor áll be — egy induláskor kiolvasott érték `unknown-version`
+ * maradhatna örökre.
+ *
+ * @param getAppVersion a deployolt app-verziót visszaadó getter
+ * @param headerName felülírható header-név (default: `X-App-Version`)
+ */
+function DyNTS_createAppVersionHeaderMiddleware(getAppVersion, headerName = exports.DYNTS_APP_VERSION_HEADER) {
+    return (_req, res, next) => {
+        const appVersion = getAppVersion();
+        // Ismeretlen verziónál NEM írunk headert: egy `unknown-version` jelzés rosszabb a
+        // semminél — a kliens „új verzió van" hamis riasztást adna belőle.
+        if (appVersion && appVersion !== 'unknown-version') {
+            res.setHeader(headerName, appVersion);
+            res.setHeader(EXPOSE_HEADERS_HEADER, DyNTS_resolveExposeHeaders(res.getHeader(EXPOSE_HEADERS_HEADER)?.toString(), headerName));
+        }
+        next();
+    };
+}
 //# sourceMappingURL=app-version-header.util.js.map

package/build/_collections/archive-service-registry.const.d.ts

@@ -1,16 +1,16 @@
-import type { DyFM_DataModel_Params, DyFM_Metadata } from '@futdevpro/fsm-dynamo';
-import type { DyNTS_ArchiveDataService } from '../_services/base/archive-data.service';
-/**
- * Az archive-service osztály runtime-registry-je (BFR-AM-012 — körkörös-import feloldás).
- *
- * A `DyNTS_DataService.getArchiveDataService()` default-implementációja a
- * `DyNTS_ArchiveDataService`-t példányosítaná — de az `archive-data.service` maga a
- * `data.service`-ből örököl, így a KÖZVETLEN value-import futásidejű require-ciklust okozna
- * („Class extends value undefined"). A regisztráció fordítva folyik: az `archive-data.service`
- * modul-inicializáláskor IDE teszi be a saját konstruktorát (a registry-nek nincs runtime-importja
- * → nincs ciklus), a base data-service pedig innen olvassa.
- */
-export declare const DyNTS_archiveServiceRegistry: {
-    ArchiveDataService?: new <T extends DyFM_Metadata>(data: T, dataParams: DyFM_DataModel_Params<T>, issuer: string) => DyNTS_ArchiveDataService<T>;
-};
+import type { DyFM_DataModel_Params, DyFM_Metadata } from '@futdevpro/fsm-dynamo';
+import type { DyNTS_ArchiveDataService } from '../_services/base/archive-data.service';
+/**
+ * Az archive-service osztály runtime-registry-je (BFR-AM-012 — körkörös-import feloldás).
+ *
+ * A `DyNTS_DataService.getArchiveDataService()` default-implementációja a
+ * `DyNTS_ArchiveDataService`-t példányosítaná — de az `archive-data.service` maga a
+ * `data.service`-ből örököl, így a KÖZVETLEN value-import futásidejű require-ciklust okozna
+ * („Class extends value undefined"). A regisztráció fordítva folyik: az `archive-data.service`
+ * modul-inicializáláskor IDE teszi be a saját konstruktorát (a registry-nek nincs runtime-importja
+ * → nincs ciklus), a base data-service pedig innen olvassa.
+ */
+export declare const DyNTS_archiveServiceRegistry: {
+    ArchiveDataService?: new <T extends DyFM_Metadata>(data: T, dataParams: DyFM_DataModel_Params<T>, issuer: string) => DyNTS_ArchiveDataService<T>;
+};
 //# sourceMappingURL=archive-service-registry.const.d.ts.map

package/build/_collections/archive-service-registry.const.js

@@ -1,15 +1,15 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DyNTS_archiveServiceRegistry = void 0;
-/**
- * Az archive-service osztály runtime-registry-je (BFR-AM-012 — körkörös-import feloldás).
- *
- * A `DyNTS_DataService.getArchiveDataService()` default-implementációja a
- * `DyNTS_ArchiveDataService`-t példányosítaná — de az `archive-data.service` maga a
- * `data.service`-ből örököl, így a KÖZVETLEN value-import futásidejű require-ciklust okozna
- * („Class extends value undefined"). A regisztráció fordítva folyik: az `archive-data.service`
- * modul-inicializáláskor IDE teszi be a saját konstruktorát (a registry-nek nincs runtime-importja
- * → nincs ciklus), a base data-service pedig innen olvassa.
- */
-exports.DyNTS_archiveServiceRegistry = {};
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_archiveServiceRegistry = void 0;
+/**
+ * Az archive-service osztály runtime-registry-je (BFR-AM-012 — körkörös-import feloldás).
+ *
+ * A `DyNTS_DataService.getArchiveDataService()` default-implementációja a
+ * `DyNTS_ArchiveDataService`-t példányosítaná — de az `archive-data.service` maga a
+ * `data.service`-ből örököl, így a KÖZVETLEN value-import futásidejű require-ciklust okozna
+ * („Class extends value undefined"). A regisztráció fordítva folyik: az `archive-data.service`
+ * modul-inicializáláskor IDE teszi be a saját konstruktorát (a registry-nek nincs runtime-importja
+ * → nincs ciklus), a base data-service pedig innen olvassa.
+ */
+exports.DyNTS_archiveServiceRegistry = {};
 //# sourceMappingURL=archive-service-registry.const.js.map

package/build/_collections/archive.util.d.ts

@@ -1,13 +1,13 @@
-/** Suffix appended to database names when archived. */
-export declare const DyNTS_archiveSuffix = "archived";
-/**
- * Create the archive database name for a given base database.
- *
- * @example
- * ```ts
- * const name = DyNTS_getArchivedDBName('users');
- * // => 'users_archived'
- * ```
- */
-export declare function DyNTS_getArchivedDBName(dbName: string): string;
+/** Suffix appended to database names when archived. */
+export declare const DyNTS_archiveSuffix = "archived";
+/**
+ * Create the archive database name for a given base database.
+ *
+ * @example
+ * ```ts
+ * const name = DyNTS_getArchivedDBName('users');
+ * // => 'users_archived'
+ * ```
+ */
+export declare function DyNTS_getArchivedDBName(dbName: string): string;
 //# sourceMappingURL=archive.util.d.ts.map

package/build/_collections/archive.util.js

@@ -1,19 +1,19 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DyNTS_archiveSuffix = void 0;
-exports.DyNTS_getArchivedDBName = DyNTS_getArchivedDBName;
-/** Suffix appended to database names when archived. */
-exports.DyNTS_archiveSuffix = 'archived';
-/**
- * Create the archive database name for a given base database.
- *
- * @example
- * ```ts
- * const name = DyNTS_getArchivedDBName('users');
- * // => 'users_archived'
- * ```
- */
-function DyNTS_getArchivedDBName(dbName) {
-    return `${dbName}_${exports.DyNTS_archiveSuffix}`;
-}
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_archiveSuffix = void 0;
+exports.DyNTS_getArchivedDBName = DyNTS_getArchivedDBName;
+/** Suffix appended to database names when archived. */
+exports.DyNTS_archiveSuffix = 'archived';
+/**
+ * Create the archive database name for a given base database.
+ *
+ * @example
+ * ```ts
+ * const name = DyNTS_getArchivedDBName('users');
+ * // => 'users_archived'
+ * ```
+ */
+function DyNTS_getArchivedDBName(dbName) {
+    return `${dbName}_${exports.DyNTS_archiveSuffix}`;
+}
 //# sourceMappingURL=archive.util.js.map

package/build/_collections/atlas-default-db-options.const.d.ts

@@ -1,3 +1,3 @@
-import { ConnectOptions } from 'mongoose';
-export declare const DyNTS_atlasDefaultDbOptions: ConnectOptions;
+import { ConnectOptions } from 'mongoose';
+export declare const DyNTS_atlasDefaultDbOptions: ConnectOptions;
 //# sourceMappingURL=atlas-default-db-options.const.d.ts.map

package/build/_collections/atlas-default-db-options.const.js

@@ -1,10 +1,10 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DyNTS_atlasDefaultDbOptions = void 0;
-const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
-exports.DyNTS_atlasDefaultDbOptions = {
-    directConnection: false,
-    serverSelectionTimeoutMS: 5 * fsm_dynamo_1.second,
-    connectTimeoutMS: 10 * fsm_dynamo_1.second,
-};
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_atlasDefaultDbOptions = void 0;
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+exports.DyNTS_atlasDefaultDbOptions = {
+    directConnection: false,
+    serverSelectionTimeoutMS: 5 * fsm_dynamo_1.second,
+    connectTimeoutMS: 10 * fsm_dynamo_1.second,
+};
 //# sourceMappingURL=atlas-default-db-options.const.js.map