@futdevpro/nts-dynamo 1.15.156 → 1.15.160

package/build/_services/server/app.server.js

@@ -1,1227 +1,1240 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DyNTS_App = void 0;
-const tslib_1 = require("tslib");
-const Mongoose = require("mongoose");
-const Express = require("express");
-/* import Mongoose from 'mongoose';
-import Express from 'express'; */
-const BodyParser = tslib_1.__importStar(require("body-parser"));
-const FileSystem = tslib_1.__importStar(require("fs"));
-const Https = tslib_1.__importStar(require("https"));
-const Path = tslib_1.__importStar(require("path"));
-/* import { version } from '../../../package.json'; */
-const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
-const default_fallback_cache_max_age_const_1 = require("../../_collections/default-fallback-cache-max-age.const");
-const default_not_found_page_const_1 = require("../../_collections/default-not-found-page.const");
-const global_settings_const_1 = require("../../_collections/global-settings.const");
-const client_safe_error_util_1 = require("../../_collections/client-safe-error.util");
-const get_environment_settings_util_1 = require("../../_collections/get-environment-settings.util");
-const security_headers_util_1 = require("../../_collections/security-headers.util");
-const load_shed_util_1 = require("../../_collections/load-shed.util");
-const app_version_header_util_1 = require("../../_collections/app-version-header.util");
-const mongo_reconnect_guard_util_1 = require("../../_collections/mongo-reconnect-guard.util");
-const static_cache_control_util_1 = require("../../_collections/static-cache-control.util");
-const route_security_enum_1 = require("../../_enums/route-security.enum");
-const app_system_controls_control_model_1 = require("../../_models/control-models/app-system-controls.control-model");
-const http_settings_control_model_1 = require("../../_models/control-models/http-settings.control-model");
-const singleton_service_1 = require("../base/singleton.service");
-const global_service_1 = require("../core/global.service");
-const collection_growth_monitor_service_1 = require("../core/collection-growth-monitor.service");
-const memory_guard_service_1 = require("../core/memory-guard.service");
-const event_loop_diag_service_1 = require("../core/event-loop-diag.service");
-const safe_diagnostic_stage_type_enum_1 = require("../../_modules/server/safe-diagnostic/safe-diagnostic-stage.type-enum");
-const safe_diagnostic_control_service_1 = require("../../_modules/server/safe-diagnostic/safe-diagnostic.control-service");
-class DyNTS_App extends singleton_service_1.DyNTS_SingletonService {
-    systemControls = new app_system_controls_control_model_1.DyNTS_AppSystemControls();
-    get started() {
-        return this.systemControls.app.started;
-    }
-    get superStarted() {
-        return this.systemControls.app.started;
-    }
-    constructErrors = [];
-    /* removed since cant use version from package.json
-    private readonly _ntsVersion: string = 'v01.07.18';
-    protected get ntsVersion(): string {
-      return this._ntsVersion;
-    } */
-    get serverName() {
-        return this.params.name;
-    }
-    _params;
-    get params() {
-        return this._params;
-    }
-    mongoose = Mongoose;
-    _security;
-    get security() {
-        return this._security;
-    }
-    _portSettings = new http_settings_control_model_1.DyNTS_Http_Settings();
-    get portSettings() {
-        return this._portSettings;
-    }
-    _cert;
-    get cert() {
-        return this._cert;
-    }
-    openExpress;
-    secureExpress;
-    httpsServer;
-    httpServer;
-    globalService;
-    _rootServices = [];
-    _routingModules = [];
-    defaultReadyTimeout = 30 * fsm_dynamo_1.second;
-    defaultErrorUserMsg = `We encountered an unhandled Server Error, ` +
-        `\nplease contact the responsible development team.` +
-        `\n(Internal Server error)`;
-    get logSetup() {
-        return global_settings_const_1.DyNTS_global_settings.log_settings.setup;
-    }
-    get deepLog() {
-        return global_settings_const_1.DyNTS_global_settings.log_settings.deep;
-    }
-    get fnLogs() {
-        return global_settings_const_1.DyNTS_global_settings.log_settings.functions;
-    }
-    debugLog = global_settings_const_1.DyNTS_global_settings.log_settings.server_debug;
-    reportSafeDiagnostic(code, stage, error, status = 500) {
-        const configuredPrefix = global_settings_const_1.DyNTS_global_settings.systemShortCodeName;
-        const prefix = configuredPrefix && /^[A-Z][A-Z0-9_-]{1,31}$/.test(configuredPrefix)
-            ? configuredPrefix
-            : 'DYNTS';
-        return safe_diagnostic_control_service_1.DyNTS_SafeDiagnostic_ControlService.report({
-            code: `${prefix}|${code}`,
-            stage: stage,
-            error: error,
-            status: status,
-        });
-    }
-    forwardSafeDiagnostic(diagnostic) {
-        try {
-            const pending = global_service_1.DyNTS_GlobalService.globalErrorHandler?.(safe_diagnostic_control_service_1.DyNTS_SafeDiagnostic_ControlService.toError(diagnostic));
-            void pending?.catch((error) => {
-                this.reportSafeDiagnostic('DYNTS-AS0-GLOBAL-HANDLER-REJECTED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.globalErrorHandler, error);
-            });
-        }
-        catch (error) {
-            this.reportSafeDiagnostic('DYNTS-AS0-GLOBAL-HANDLER-THREW', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.globalErrorHandler, error);
-        }
-    }
-    constructor( /* extended?: boolean */) {
-        super();
-        /* dotenv.config() */
-        process.on('unhandledRejection', (reason) => {
-            const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-BASE-UR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.unhandledRejection, reason);
-            this.forwardSafeDiagnostic(diagnostic);
-        });
-        this.asyncConstruct( /* extended */).catch((error) => {
-            const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-BOOTSTRAP-FAILED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.bootstrap, error);
-            this.forwardSafeDiagnostic(diagnostic);
-            process.exit(1);
-        });
-    }
-    async asyncConstruct(extended) {
-        if (this.fnLogs && this.deepLog)
-            fsm_dynamo_1.DyFM_Log.log('\nfn:. asyncConstruct');
-        try {
-            this.systemControls.app.init = true;
-            this._params = this.getAppParams();
-            fsm_dynamo_1.DyFM_Log.log(`\n\n\n\n\n\n\n\n\n\n` +
-                `Starting ${this._params?.name}... ` +
-                /* `v${version}` + */
-                `\n\n\n\n\n\n\n\n\n\n`);
-            if (!this._params) {
-                throw new Error('getAppParams() must return a DyNTS_AppParams object!');
-            }
-            if (this.params.systemShortCodeName) {
-                global_settings_const_1.DyNTS_global_settings.systemShortCodeName = this.params.systemShortCodeName;
-            }
-            if (this.params.systemName) {
-                global_settings_const_1.DyNTS_global_settings.systemName = this.params.systemName;
-                fsm_dynamo_1.DyFM_error_defaults.issuerSystem = this.params.systemName;
-            }
-            if (this.params.version) {
-                global_settings_const_1.DyNTS_global_settings.systemVersion = this.params.version;
-                fsm_dynamo_1.DyFM_error_defaults.systemVersion = this.params.version;
-            }
-            process.stdout.write(String.fromCharCode(27) + ']0;' +
-                this._params?.name +
-                String.fromCharCode(7));
-            fsm_dynamo_1.DyFM_error_defaults.issuerSystem = this._params.systemName;
-            this.overrideDynamoNTSGlobalSettings?.();
-            if (global_settings_const_1.DyNTS_global_settings.log_settings.setup) {
-                fsm_dynamo_1.DyFM_Log.S_info(`env settings;\n`, {
-                    systemName: global_settings_const_1.DyNTS_global_settings.systemName,
-                    systemShortCodeName: global_settings_const_1.DyNTS_global_settings.systemShortCodeName,
-                    systemVersion: global_settings_const_1.DyNTS_global_settings.systemVersion,
-                    environment: global_settings_const_1.DyNTS_global_settings.env_settings.environment,
-                    /* log_settings: DyNTS_global_settings.log_settings,
-                    env_settings: DyNTS_global_settings.env_settings, */
-                });
-            }
-            this.globalService = global_service_1.DyNTS_GlobalService.getInstance();
-            await global_service_1.DyNTS_GlobalService.setServices(this.getGlobalServiceCollection());
-            global_service_1.DyNTS_GlobalService.setParams(this.params);
-            if (this.getPortSettings) {
-                this._portSettings = this.getPortSettings();
-            }
-            if (this.getCertificationSettings) {
-                this._cert = this.getCertificationSettings();
-            }
-            if (this.getApiBasePath) {
-                global_settings_const_1.DyNTS_global_settings.baseUrl = this.getApiBasePath();
-            }
-            if (this.getRoutingModules) {
-                this._routingModules = this.getRoutingModules();
-                // ezt egyelőre csak tesztelem, nem kerül be
-                /* if (
-                  !DyNTS_global_settings.dontCreateDefaultRoute &&
-                  !this._routingModules.some((routingModule: DyNTS_RoutingModule): boolean => routingModule.route === '/*')
-                ) {
-                  this._routingModules.push(
-                    DyNTS_getStarRoute()
-                  );
-                } */
-            }
-            if (this._params.dbUri) {
-                await this.startDB();
-                // createEntries csak akkor fut, ha a DB tényleg fel-jött.
-                // Ha a startDB jelezte a hibát, de továbbment, akkor a started flag false marad,
-                // és nem próbálunk meg írni egy nem létező kapcsolatra.
-                if (this.createEntries && this.systemControls.mongoose.started) {
-                    await this.createEntries();
-                }
-            }
-            else {
-                fsm_dynamo_1.DyFM_Log.log(`\nNo database connection created.`);
-            }
-            if (this._routingModules?.length) {
-                if (this.logSetup)
-                    fsm_dynamo_1.DyFM_Log.log('\nsetting up express routes...');
-                this.setSecurity();
-                await this.initExpresses();
-                await this.startExpresses();
-                if (this._security !== route_security_enum_1.DyNTS_RouteSecurity.secure) {
-                    await this.mountOpenRoutes();
-                }
-                if (this._security !== route_security_enum_1.DyNTS_RouteSecurity.open && this._cert) {
-                    await this.mountSecureRoutes();
-                }
-                // Generikus, auth-agnosztikus extension-point: custom middleware az API
-                // route-ok UTÁN, de a SPA static catch-all (mountStaticClient) ELŐTT.
-                await this.mountCustomMiddleware();
-                await this.mountStaticClient();
-                if (this.logSetup) {
-                    fsm_dynamo_1.DyFM_Log.log(`\nRoutes mounted.... server using security: ${this._security}`);
-                }
-            }
-            else {
-                fsm_dynamo_1.DyFM_Log.warn(`\nNo routes mounted!`);
-            }
-            if (this.getRootServices) {
-                this._rootServices = await this.getRootServices();
-            }
-            if (this.postProcess) {
-                await this.postProcess().catch((error) => {
-                    const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-POST-PROCESS-FAILED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.postProcess, error);
-                    this.forwardSafeDiagnostic(diagnostic);
-                });
-            }
-            // FR-193 — bedrock OOM korai-figyelmeztetés: feltelepítjük a heap-watchdogot, ha
-            // engedélyezve (DyNTS_global_settings.memoryGuard.enabled, default true). Biztonságos:
-            // a guard egy könnyű setInterval, ami SOHA nem dob; csak near-OOM küszöböknél hagy
-            // tartós nyomot az error-sinkbe, mielőtt a fatal heap-OOM megölné a process-t.
-            try {
-                if (global_settings_const_1.DyNTS_global_settings.memoryGuard?.enabled) {
-                    memory_guard_service_1.DyNTS_MemoryGuard.getInstance().install();
-                }
-            }
-            catch (memoryGuardError) {
-                this.reportSafeDiagnostic('DYNTS-AS0-MEMORY-GUARD-SKIPPED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.memoryGuard, memoryGuardError);
-            }
-            // BFR-OVERSEER-007 — event-loop-lag diag a MemoryGuard MELLÉ: a „process él, HTTP néma" wedge
-            // belső mérése (natív histogram, olcsó). Observation-only, sosem dob; a /server/diag olvas belőle.
-            try {
-                event_loop_diag_service_1.DyNTS_EventLoopDiag.getInstance().install();
-            }
-            catch (eventLoopDiagError) {
-                this.reportSafeDiagnostic('DYNTS-AS0-EVENT-LOOP-DIAG-SKIPPED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.eventLoopDiagnostic, eventLoopDiagError);
-            }
-            // FR-258 / SR-4 — proactive collection-growth monitor (companion to the MemoryGuard). Warns
-            // into the Errors-sink when a collection grows unbounded, BEFORE it can be loaded into heap and
-            // OOM. Default-on, observation-only, never throws.
-            try {
-                if (global_settings_const_1.DyNTS_global_settings.collectionGrowthMonitor?.enabled) {
-                    collection_growth_monitor_service_1.DyNTS_CollectionGrowthMonitor.getInstance().install();
-                }
-            }
-            catch (cgmError) {
-                this.reportSafeDiagnostic('DYNTS-AS0-COLLECTION-GROWTH-MONITOR-SKIPPED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.collectionGrowthMonitor, cgmError);
-            }
-            if (!extended) {
-                await this.ready();
-                if (this.params.title) {
-                    fsm_dynamo_1.DyFM_Log.success(this.params.title);
-                }
-                fsm_dynamo_1.DyFM_Log.info(`Version: ${this.params.version}`);
-                /* DyFM_Log.info(`NTS Version: ${this.ntsVersion}`); */
-                fsm_dynamo_1.DyFM_Log.H_success(`${this.params.name} started successfully.`);
-            }
-        }
-        catch (error) {
-            this.constructErrors.push(error);
-            throw new fsm_dynamo_1.DyFM_Error({
-                ...this._getDefaultErrorSettings('asyncConstruct', error),
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-001`,
-                additionalContent: {
-                    constructErrors: this.constructErrors,
-                    systemControls: this.systemControls,
-                    systemReadies: {
-                        app: this.systemControls.app.getIsReady(),
-                        mongoose: this.systemControls.mongoose.getIsReady(),
-                        httpServer: this.systemControls.httpServer.getIsReady(),
-                        httpsServer: this.systemControls.httpsServer.getIsReady(),
-                    },
-                },
-            });
-        }
-    }
-    async ready(timeout = this.defaultReadyTimeout) {
-        try {
-            if (this.fnLogs)
-                fsm_dynamo_1.DyFM_Log.log('\nfn:. ready');
-            await fsm_dynamo_1.DyFM_Async.delay(100);
-            let ready = false;
-            const start = +new Date();
-            if (this.constructErrors.length) {
-                this.reportSafeDiagnostic('DYNTS-AS0-READINESS-CONSTRUCT-ERROR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.readiness, this.constructErrors[0]);
-                throw new fsm_dynamo_1.DyFM_Error({
-                    ...this._getDefaultErrorSettings('ready', new Error(`"${this._params.name}" start failed.`)),
-                    errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-R01`,
-                    additionalContent: this.constructErrors.length === 1 ?
-                        { error: this.constructErrors[0] } :
-                        { errors: this.constructErrors },
-                });
-            }
-            while (!ready && +new Date() - start < timeout) {
-                if (this.systemControls.app.init) {
-                    ready = (this.systemControls.mongoose.getIsReady() &&
-                        this.systemControls.httpServer.getIsReady() &&
-                        this.systemControls.httpsServer.getIsReady());
-                }
-                if (!ready) {
-                    await fsm_dynamo_1.DyFM_Async.wait(100);
-                }
-            }
-            if (timeout < +new Date() - start) {
-                this.reportSafeDiagnostic('DYNTS-AS0-READINESS-TIMEOUT', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.readiness, this.constructErrors[0] ?? new Error('readiness-timeout'));
-                throw new fsm_dynamo_1.DyFM_Error({
-                    ...this._getDefaultErrorSettings('ready', new Error(`"${this._params.name}" start failed. TIMEOUT`)),
-                    errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-R02`,
-                    additionalContent: {
-                        constructErrors: this.constructErrors,
-                        systemControls: this.systemControls,
-                        systemReadies: {
-                            mongoose: this.systemControls.mongoose.getIsReady(),
-                            httpServer: this.systemControls.httpServer.getIsReady(),
-                            httpsServer: this.systemControls.httpsServer.getIsReady(),
-                        },
-                    },
-                });
-            }
-            if (this.constructErrors.length) {
-                this.reportSafeDiagnostic('DYNTS-AS0-READINESS-LATE-CONSTRUCT-ERROR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.readiness, this.constructErrors[0]);
-                throw new fsm_dynamo_1.DyFM_Error({
-                    ...this._getDefaultErrorSettings('ready', new Error(`"${this._params.name}" start failed.`)),
-                    errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-R03`,
-                    additionalContent: this.constructErrors,
-                });
-            }
-            if (ready) {
-                this.systemControls.app.started = true;
-                if (this.fnLogs && this.deepLog)
-                    fsm_dynamo_1.DyFM_Log.log('\nfn:. ready: return');
-                return;
-            }
-            this.systemControls.app.started = false;
-            let msg = `"${this._params.name}" start failed. UNKNOWN`;
-            if (this.systemControls.mongoose.init && !this.systemControls.mongoose.started) {
-                msg += `\nMongoose start failed.`;
-            }
-            if (this.systemControls.httpServer.init && !this.systemControls.httpServer.started) {
-                msg += `\nHTTP Server start failed.`;
-            }
-            if (this.systemControls.httpsServer.init && !this.systemControls.httpsServer.started) {
-                msg += `\nHTTPS Server start failed.`;
-            }
-            this.reportSafeDiagnostic('DYNTS-AS0-READINESS-UNKNOWN', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.readiness, this.constructErrors[0] ?? new Error('readiness-unknown'));
-            throw new fsm_dynamo_1.DyFM_Error({
-                ...this._getDefaultErrorSettings('ready', new Error(msg)),
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-R04`,
-                additionalContent: {
-                    constructErrors: this.constructErrors,
-                    systemControls: this.systemControls,
-                    systemReadies: {
-                        app: this.systemControls.app.getIsReady(),
-                        mongoose: this.systemControls.mongoose.getIsReady(),
-                        httpServer: this.systemControls.httpServer.getIsReady(),
-                        httpsServer: this.systemControls.httpsServer.getIsReady(),
-                    },
-                },
-                error: this.constructErrors?.[0] ?? new Error(),
-            });
-        }
-        catch (error) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                ...this._getDefaultErrorSettings('ready', error),
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-READY0`,
-            });
-        }
-    }
-    getSimplifiedConstructErrors() {
-        return this.constructErrors.map((error) => {
-            if (error instanceof fsm_dynamo_1.DyFM_Error) {
-                return error.getErrorSimplified();
-            }
-            else {
-                return error;
-            }
-        });
-    }
-    async stop(dontLog) {
-        try {
-            fsm_dynamo_1.DyFM_Log.info('\nstopping server...\n');
-            await this.ready();
-            if (this.started) {
-                if (this.systemControls.mongoose.init) {
-                    fsm_dynamo_1.DyFM_Log.info(`\nstopping Mongoose....`);
-                    let tryCount = 0;
-                    while (!this.systemControls.mongoose.started &&
-                        !this.constructErrors.length &&
-                        tryCount++ < 10) {
-                        fsm_dynamo_1.DyFM_Log.warn(`Mongoose not even started yet....`);
-                        await fsm_dynamo_1.DyFM_Async.wait(fsm_dynamo_1.second);
-                    }
-                    this.systemControls.mongoose.started = false;
-                    if (this.mongoose) {
-                        await fsm_dynamo_1.DyFM_Array.asyncForEach(Object.keys(this.mongoose.models), async (modelName) => {
-                            this.mongoose.deleteModel(modelName);
-                        });
-                        const disconnect = new Promise((resolve) => {
-                            this.mongoose.connection.on('disconnecting', () => {
-                                resolve();
-                            });
-                        });
-                        await this.mongoose.disconnect();
-                        await this.mongoose.connection.close();
-                        await disconnect;
-                        this.mongoose.connection.removeAllListeners();
-                        while (this.mongoose.connection.readyState !== 0 &&
-                            !this.constructErrors.length) {
-                            fsm_dynamo_1.DyFM_Log.warn(`\nMongoose still not disconnected....`);
-                            await fsm_dynamo_1.DyFM_Async.wait(fsm_dynamo_1.second);
-                        }
-                    }
-                    else {
-                        fsm_dynamo_1.DyFM_Log.error(`\nMongoose not found.`);
-                    }
-                    this.systemControls.mongoose.init = false;
-                }
-                if (this.systemControls.httpServer.init) {
-                    this.systemControls.httpServer.started = false;
-                    if (this.httpServer) {
-                        await new Promise((resolve) => {
-                            this.httpServer.close(resolve);
-                        });
-                    }
-                    else {
-                        fsm_dynamo_1.DyFM_Log.error(`\nHTTP Server not found.`);
-                    }
-                    this.systemControls.httpServer.init = false;
-                }
-                if (this.systemControls.httpsServer.init) {
-                    this.systemControls.httpsServer.started = false;
-                    if (this.httpsServer) {
-                        await new Promise((resolve) => {
-                            this.httpsServer.close(resolve);
-                        });
-                    }
-                    else {
-                        fsm_dynamo_1.DyFM_Log.error(`\nHTTPS Server not found.`);
-                    }
-                    this.systemControls.httpsServer.init = false;
-                }
-                await fsm_dynamo_1.DyFM_Async.wait(fsm_dynamo_1.second);
-                if (!dontLog) {
-                    fsm_dynamo_1.DyFM_Log.H_log(`"${this._params.name}" stopped successfully.`);
-                }
-            }
-        }
-        catch (error) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                ...this._getDefaultErrorSettings('stop', error),
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-STOP0`,
-            });
-        }
-    }
-    /**
-     *
-     */
-    async startDB() {
-        if (this.fnLogs && this.deepLog)
-            fsm_dynamo_1.DyFM_Log.log('\nfn:. startDB');
-        else if (this.logSetup)
-            fsm_dynamo_1.DyFM_Log.log('\nstarting DB connection...');
-        if (!this._params.dbUri) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                ...this._getDefaultErrorSettings('startDB', new Error('DB URI is not set.')),
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SDB0`,
-            });
-        }
-        if (!this._params.dbOptions) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                ...this._getDefaultErrorSettings('startDB', new Error('DB OPTIONS are not set.')),
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SDB0`,
-            });
-        }
-        if (this.systemControls.mongoose.init || this.systemControls.mongoose.started) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                ...this._getDefaultErrorSettings('startDB', new Error('Mongoose is already initialized.')),
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SDB0`,
-            });
-        }
-        try {
-            await new Promise((resolve, reject) => {
-                this.systemControls.mongoose.init = true;
-                this.mongoose.connection
-                    .once('open', () => {
-                    this.systemControls.mongoose.started = true;
-                    fsm_dynamo_1.DyFM_Log.success('\nConnected to MongoDB.\n');
-                    resolve();
-                    // FR-258 / SR-2 — install declared-retention TTL indexes. DEFERRED + fire-and-forget +
-                    // fully non-fatal: a create-if-missing index op (and the `indexes()` probes) must NOT
-                    // compete with boot-readiness. We delay it well past the deploy health-probe window so a
-                    // cold boot is never slowed by it, then run it detached. `.unref()` keeps it from holding
-                    // the event loop open. Any failure is logged but never crashes the app. (`'differs'` never
-                    // rebuilds a live index — see ensureRetentionTtlIndex.)
-                    const ttlInstallTimer = setTimeout(() => {
-                        void this.installRetentionTtlIndexes();
-                    }, 30000);
-                    if (typeof ttlInstallTimer.unref === 'function') {
-                        ttlInstallTimer.unref();
-                    }
-                })
-                    .on('error', (error) => {
-                    if (!this.systemControls.mongoose.started) {
-                        // Initial DB-csatlakozás sikertelen:
-                        // jelezzük a hibát (log + globalErrorHandler), de NEM szakítjuk meg az
-                        // App startup-ot (nincs constructErrors push, nincs reject).
-                        // A mongoose.init-et resetteljük, hogy a ready() ne várjon a DB-re.
-                        // Ha a mongoose később mégis tudna csatlakozni, az 'open' event
-                        // beállítja a started flag-et, így a runtime DB-műveletek elindulnak.
-                        this.systemControls.mongoose.init = false;
-                        const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-SDB1', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.databaseConnect, error, 503);
-                        this.forwardSafeDiagnostic(diagnostic);
-                        resolve();
-                    }
-                    else {
-                        const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-SDB2', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.databaseRuntime, error, 503);
-                        this.forwardSafeDiagnostic(diagnostic);
-                    }
-                });
-                try {
-                    this.mongoose.connect(this._params.dbUri, this._params.dbOptions
-                    /* {
-                      directConnection: true,
-                    } */
-                    );
-                }
-                catch (error) {
-                    throw new fsm_dynamo_1.DyFM_Error({
-                        ...this._getDefaultErrorSettings('startDB', error),
-                        errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SDB3`,
-                    });
-                }
-            });
-        }
-        catch (error) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                ...this._getDefaultErrorSettings('startDB', error),
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SDB0`,
-            });
-        }
-        // 2026-06-20 — Mongo reconnect-guard. A MongoDB-driver a hostnevet connect-kor EGYSZER
-        // resolválja + cache-eli az IP-t; ha a Mongo-konténert recreate-elik (új docker-network IP),
-        // a driver a HALOTT IP-n ragad → ECONNREFUSED + buffering-timeout, és a service magától SOHA
-        // nem áll vissza. A guard sustained-disconnect (readyState !== 1) esetén — a driver saját
-        // grace-e UTÁN — TELJES disconnect()+connect()-et csinál → ÚJ MongoClient → ÚJ DNS-resolve →
-        // új IP → reconnect. Best-effort, always-on, healthy connection-t (===1) SOHA nem bánt; csak
-        // konténer-IP-frissítés, nem ír adatot. Lásd: mongo-reconnect-guard.util.ts.
-        try {
-            (0, mongo_reconnect_guard_util_1.startMongoReconnectGuard)({
-                getReadyState: () => this.mongoose.connection.readyState,
-                reconnect: async () => {
-                    await this.mongoose.disconnect().catch(() => undefined);
-                    await this.mongoose.connect(this._params.dbUri, this._params.dbOptions);
-                },
-                log: (msg) => {
-                    this.reportSafeDiagnostic('DYNTS-AS0-MONGO-RECONNECT-EVENT', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.mongoReconnectGuard, msg, 503);
-                },
-            });
-        }
-        catch (guardErr) {
-            this.reportSafeDiagnostic('DYNTS-AS0-MONGO-RECONNECT-FAILED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.mongoReconnectGuard, guardErr, 503);
-        }
-    }
-    /**
-     * FR-258 / SR-2 — install MongoDB TTL indexes for every data-model that declared `retention`.
-     *
-     * Runs ONCE right after the DB connection opens. For each registered DB service (including the
-     * auto-created `_archived` siblings, which inherit the parent model's `retention`), it ensures a
-     * TTL index on the `__created` Date field with the resolved `expireAfterSeconds` — so MongoDB
-     * NATIVELY auto-deletes documents older than the configured age. This is the fleet-wide defense
-     * against the unbounded-collection-growth → in-memory-load → GC-thrash/OOM class.
-     *
-     * Guarantees:
-     * - **Non-fatal** — any error is logged but NEVER blocks startup (called fire-and-forget).
-     * - **Idempotent** — an existing index with the same TTL is a no-op; a CHANGED retention (different
-     *   `expireAfterSeconds`, or an existing non-TTL `__created` index) is reconciled by drop+recreate
-     *   (the field index is restored immediately, so query coverage is preserved).
-     */
-    async installRetentionTtlIndexes() {
-        try {
-            const services = global_service_1.DyNTS_GlobalService.getAllDBServices();
-            let ensured = 0;
-            for (const service of services) {
-                const ttlSeconds = (0, fsm_dynamo_1.DyFM_resolveRetentionTtlSeconds)(service?.dataParams?.retention);
-                if (!ttlSeconds) {
-                    continue;
-                }
-                const dataName = service.dataParams.dataName;
-                // The mongoose Model exposes the native driver collection (.indexes / .createIndex / .dropIndex).
-                const collection = service?.dataModel?.collection;
-                if (!collection || typeof collection.createIndex !== 'function') {
-                    continue;
-                }
-                try {
-                    const action = await DyNTS_App.ensureRetentionTtlIndex(collection, ttlSeconds);
-                    if (action === 'created') {
-                        ensured++;
-                        if (this.logSetup) {
-                            fsm_dynamo_1.DyFM_Log.success(`[FR-258 retention] TTL index created on "${dataName}" — ` +
-                                `${Math.round(ttlSeconds / 86400)}d (${ttlSeconds}s)`);
-                        }
-                    }
-                    else if (action === 'differs') {
-                        // Live index has a different TTL — left untouched at boot (see ensureRetentionTtlIndex doc).
-                        this.reportSafeDiagnostic('DYNTS-AS0-RETENTION-INDEX-DIFFERS', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.retention, new Error('retention-index-differs'));
-                    }
-                }
-                catch (idxErr) {
-                    this.reportSafeDiagnostic('DYNTS-AS0-RETENTION-INDEX-FAILED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.retention, idxErr);
-                }
-            }
-            if (ensured > 0) {
-                fsm_dynamo_1.DyFM_Log.success(`[FR-258 retention] ${ensured} TTL index(es) ensured (auto-retention active).`);
-            }
-        }
-        catch (err) {
-            this.reportSafeDiagnostic('DYNTS-AS0-RETENTION-INSTALLER-FAILED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.retention, err);
-        }
-    }
-    /**
-     * FR-258 / SR-2 — ensure a single `{ __created: 1 }` TTL index with the given `expireAfterSeconds`.
-     * Extracted as a pure-ish static so it is unit-testable with a mock collection. Idempotent + BOOT-SAFE:
-     * - no existing `__created` index      → create it          → `'created'`
-     * - existing with the SAME TTL          → no-op              → `'noop'`
-     * - existing with a DIFFERENT TTL / non-TTL → leave it as-is → `'differs'` (warn only — NO drop+recreate)
-     *
-     * The `'differs'` case intentionally does NOT mutate the live index. Dropping + recreating a TTL index on a
-     * large (multi-GB) production collection is a heavy server-side operation; doing it automatically inside the
-     * startup path can starve the concurrent boot queries (including the deploy health-probe) and trigger a
-     * fail-safe revert. Create-if-missing is the essential growth-prevention behaviour; a deliberate retention
-     * CHANGE on an already-indexed collection is a maintenance action, not a silent every-boot rebuild.
-     */
-    static async ensureRetentionTtlIndex(collection, ttlSeconds) {
-        const existingList = typeof collection.indexes === 'function'
-            ? await collection.indexes().catch(() => [])
-            : [];
-        const existing = existingList.find((ix) => !!ix?.key && ix.key.__created === 1);
-        if (!existing) {
-            await collection.createIndex({ __created: 1 }, { expireAfterSeconds: ttlSeconds });
-            return 'created';
-        }
-        if (existing.expireAfterSeconds === ttlSeconds) {
-            return 'noop';
-        }
-        // Retention differs from the live index (or it is a non-TTL `__created` index). Leave it UNTOUCHED at
-        // boot — only report it. Avoids a heavy drop+recreate competing with boot-readiness on a large collection.
-        return 'differs';
-    }
-    /**
-     *
-     */
-    async initExpresses() {
-        if (this.fnLogs && this.deepLog)
-            fsm_dynamo_1.DyFM_Log.log('\nfn:. initExpresses');
-        try {
-            if (this._security && this._security !== route_security_enum_1.DyNTS_RouteSecurity.secure) {
-                if (this._portSettings.httpPort === undefined || this._portSettings.httpPort === null) {
-                    let errorMsg = `\nYou have open routes, but httpPort is not set!` +
-                        `\nThere are ${this._routingModules.filter(m => m.security != route_security_enum_1.DyNTS_RouteSecurity.secure).length} open/both routes` +
-                        `\nroot security: ${this._security}` +
-                        `\nset httpPort in DynamoBEServer - setupRoutingModules() to enable secure routes.`;
-                    errorMsg += '\n\nThe routes setted to use open server:';
-                    this._routingModules.forEach((module) => {
-                        if (module.security != route_security_enum_1.DyNTS_RouteSecurity.secure) {
-                            errorMsg += `\n  ${module.route} (security: ${module.security})`;
-                            errorMsg += `\n  subroutes using open sever:`;
-                            module.endpoints.forEach((endpoint) => {
-                                if (endpoint.security != route_security_enum_1.DyNTS_RouteSecurity.secure) {
-                                    errorMsg += `\n    ${endpoint.endpoint} (security: ${endpoint.security})`;
-                                }
-                            });
-                        }
-                    });
-                    const error = new Error(`Open routes cannot be established!\n${errorMsg}`);
-                    const errorStack = error.stack.split('\n');
-                    errorStack.splice(1, 2);
-                    error.stack = errorStack.join('\n');
-                    this.reportSafeDiagnostic('DYNTS-AS0-OPEN-ROUTE-CONFIGURATION', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.routing, error);
-                    throw error;
-                }
-                await this.initOpenExpress();
-            }
-            if (this._security && this._security !== route_security_enum_1.DyNTS_RouteSecurity.open) {
-                if (!this._cert || !this._portSettings.httpsPort) {
-                    let errorMsg = `\nYou have secure routes, but the certification paths or httpsPort are not set!` +
-                        `\nThere are ${this._routingModules.filter(m => m.security && m.security !== route_security_enum_1.DyNTS_RouteSecurity.open).length} secure routes` +
-                        `\nroot security: ${this._security}` +
-                        `\nset...` +
-                        `\n(missing exact howto...)` +
-                        /* `\n  httpsPort and` +
-                        `\n  cert: {` +
-                        `\n    keyPath: FileSystem.PathLike,` +
-                        `\n    certPath: FileSystem.PathLike,` +
-                        `\n  }` + */
-                        `\nin DynamoBEServer - getRoutingModules() to enable secure routes.`;
-                    errorMsg += '\n\nThe routes setted to use secure server:';
-                    this._routingModules.forEach((module) => {
-                        if (module.security && module.security !== route_security_enum_1.DyNTS_RouteSecurity.open) {
-                            errorMsg += `\n  ${module.route} (security: ${module.security})`;
-                            errorMsg += `\n    location: ${module.stackLocation}`;
-                            errorMsg += `\n    subroutes using secure sever:`;
-                            module.endpoints.forEach((endpoint) => {
-                                if (endpoint.security && endpoint.security !== route_security_enum_1.DyNTS_RouteSecurity.open) {
-                                    errorMsg += `\n      ${endpoint.endpoint} (security: ${endpoint.security})`;
-                                    errorMsg += `\n        location: ${endpoint.stackLocation}`;
-                                }
-                            });
-                        }
-                    });
-                    const error = new Error(`Secure routes cannot be established!\n${errorMsg}`);
-                    const errorStack = error.stack.split('\n');
-                    errorStack.splice(1, 2);
-                    error.stack = errorStack.join('\n');
-                    this.reportSafeDiagnostic('DYNTS-AS0-SECURE-ROUTE-CONFIGURATION', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.routing, error);
-                    throw error;
-                }
-                await this.initSecureExpress();
-            }
-        }
-        catch (error) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                ...this._getDefaultErrorSettings('initExpresses', error),
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-IE0`,
-            });
-        }
-    }
-    /**
-     *
-     */
-    async initOpenExpress() {
-        if (this.fnLogs)
-            fsm_dynamo_1.DyFM_Log.log('\nfn:. initOpenExpress');
-        this.openExpress = Express();
-        this.openExpress.set('maxHeaderSize', 10 * fsm_dynamo_1.megabyte); // 1024 * 1024 * 10, // 10MB
-        this.openExpress.use(BodyParser.urlencoded(this._portSettings.httpUrlencoded));
-        this.openExpress.use(BodyParser.json(this._portSettings.httpJson));
-        // BFR-011 / SEC-R2-8 — security headerek a CORS ELŐTT (az OPTIONS preflight-válaszok is kapják).
-        this.mountSecurityHeaders(this.openExpress);
-        // FR-041 — CORS allowlist enforcement. No-op if getCorsSettings() is not overridden.
-        this.mountCors(this.openExpress);
-        // FR-292 — a deployolt app-verzio minden valaszon. A CORS UTAN kell, mert az
-        // `Access-Control-Expose-Headers`-hoz HOZZAFUZ (kulonben a CORS felulirna).
-        this.mountAppVersionHeader(this.openExpress);
-        // BFR-OVERSEER-009 — opt-in auto-load-shed 503 CRITICAL memória-nyomásnál (esszenciális utak kivételével).
-        if (global_settings_const_1.DyNTS_global_settings.memoryGuard?.loadShedEnabled) {
-            this.openExpress.use((0, load_shed_util_1.DyNTS_createLoadShedMiddleware)());
-        }
-    }
-    /**
-     *
-     */
-    async initSecureExpress() {
-        if (this.fnLogs)
-            fsm_dynamo_1.DyFM_Log.log('\nfn:. initSecureExpress');
-        this.secureExpress = Express();
-        this.secureExpress.use(BodyParser.urlencoded(this._portSettings.httpsUrlencoded));
-        this.secureExpress.use(BodyParser.json(this._portSettings.httpsJson));
-        // BFR-011 / SEC-R2-8 — security headerek a CORS ELŐTT (mint az open expressen).
-        this.mountSecurityHeaders(this.secureExpress);
-        // FR-041 — CORS allowlist enforcement (same as open express).
-        this.mountCors(this.secureExpress);
-        // FR-292 — a deployolt app-verzio minden valaszon (mint az open expressen).
-        this.mountAppVersionHeader(this.secureExpress);
-        // BFR-OVERSEER-009 — opt-in auto-load-shed 503 (mint az open expressen).
-        if (global_settings_const_1.DyNTS_global_settings.memoryGuard?.loadShedEnabled) {
-            this.secureExpress.use((0, load_shed_util_1.DyNTS_createLoadShedMiddleware)());
-        }
-        const options = {
-            key: FileSystem.readFileSync(this._cert.keyPath),
-            cert: FileSystem.readFileSync(this._cert.certPath),
-            maxHeaderSize: 10 * fsm_dynamo_1.megabyte, // 1024 * 1024 * 10, // 10MB
-        };
-        this.httpsServer = Https.createServer(options, this.secureExpress);
-    }
-    /**
-     *
-     */
-    async startExpresses() {
-        if (this.fnLogs && this.deepLog)
-            fsm_dynamo_1.DyFM_Log.log('\nfn:. startExpresses');
-        try {
-            if (this._security && this._security !== route_security_enum_1.DyNTS_RouteSecurity.open) {
-                await new Promise((resolve, reject) => {
-                    this.systemControls.httpsServer.init = true;
-                    this.httpsServer
-                        .listen(this._portSettings.httpsPort, this.params.secureHost, this.params.expressBacklog, () => {
-                        this.systemControls.httpsServer.started = true;
-                        fsm_dynamo_1.DyFM_Log.success(`\nHTTPS (secure) server is listening on port: ` +
-                            `${this.params.secureHost}:${this._portSettings.httpsPort}`);
-                        resolve();
-                    })
-                        .on('error', (error) => {
-                        const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-HTTPS-ERROR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.httpsServer, error, 503);
-                        if (!this.systemControls.httpsServer.started) {
-                            const d_error = new fsm_dynamo_1.DyFM_Error({
-                                ...this._getDefaultErrorSettings('startExpresses', error),
-                                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SE1`,
-                                message: `HTTPS (secure) start server ERROR`,
-                            });
-                            this.constructErrors.push(d_error);
-                            this.forwardSafeDiagnostic(diagnostic);
-                            reject(d_error);
-                        }
-                        else {
-                            this.forwardSafeDiagnostic(diagnostic);
-                        }
-                    })
-                        .on('uncaughtException', (exception) => {
-                        const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-HTTPS-UNCAUGHT', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.httpsServer, exception);
-                        this.forwardSafeDiagnostic(diagnostic);
-                    });
-                });
-            }
-            if (this._security && this._security !== route_security_enum_1.DyNTS_RouteSecurity.secure) {
-                this.systemControls.httpServer.init = true;
-                await new Promise((resolve, reject) => {
-                    this.httpServer = this.openExpress
-                        .listen(this._portSettings.httpPort, this.params.openHost, this.params.expressBacklog, () => {
-                        this.systemControls.httpServer.started = true;
-                        const resolvedPort = this.httpServer?.address?.()?.['port'] ?? this._portSettings.httpPort;
-                        if (this._portSettings.httpPort === 0) {
-                            fsm_dynamo_1.DyFM_Log.H_warn(`\nHTTP (open) server is using a randomly selected port by the OS: ${resolvedPort}` +
-                                `\n  (httpPort was set to 0 — this is intended for testing only)`);
-                        }
-                        fsm_dynamo_1.DyFM_Log.success(`\nHTTP (open) server is listening on port: ` +
-                            `${this.params.openHost}:${resolvedPort}`);
-                        resolve();
-                    })
-                        .on('error', (error) => {
-                        const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-HTTP-ERROR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.httpServer, error, 503);
-                        if (!this.systemControls.httpServer.started) {
-                            const d_error = new fsm_dynamo_1.DyFM_Error({
-                                ...this._getDefaultErrorSettings('startExpresses', error),
-                                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SE3`,
-                                message: `HTTP (open) start server ERROR`,
-                            });
-                            this.constructErrors.push(d_error);
-                            this.forwardSafeDiagnostic(diagnostic);
-                            reject(d_error);
-                        }
-                        else {
-                            this.forwardSafeDiagnostic(diagnostic);
-                        }
-                    })
-                        .on('uncaughtException', (exception) => {
-                        const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-HTTP-UNCAUGHT', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.httpServer, exception);
-                        this.forwardSafeDiagnostic(diagnostic);
-                    });
-                });
-            }
-        }
-        catch (error) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                ...this._getDefaultErrorSettings('startExpresses', error),
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SE0`,
-            });
-        }
-    }
-    /**
-     *
-     */
-    async expressErrorHandling(error, req, res, next) {
-        try {
-            if (error) {
-                const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-EXPRESS-ERROR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.expressFallback, error);
-                this.forwardSafeDiagnostic(diagnostic);
-                // Kliens-safe strip (BFR-FDPAUTHSERVICE-002): az express-error út eddig NYERS error-t küldött
-                // (0 strip) — DyFM-nél belső stack/verzió/issuer, axios-jellegű error-nál akár auth-header is
-                // kimehetett. A strip-szabályok SSOT-ja a DyNTS_ClientSafeError_Util.
-                res.send(client_safe_error_util_1.DyNTS_ClientSafeError_Util.toClientSafe(error));
-            }
-            else {
-                const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-EXPRESS-MISSING-ERROR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.expressFallback);
-                this.forwardSafeDiagnostic(diagnostic);
-            }
-        }
-        catch (error) {
-            const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-EXPRESS-MULTILEVEL', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.expressFallback, error);
-            this.forwardSafeDiagnostic(diagnostic);
-        }
-    }
-    /**
-     *
-     */
-    async mountSecureRoutes() {
-        try {
-            if (this.fnLogs && this.deepLog)
-                fsm_dynamo_1.DyFM_Log.log('\nfn:. mountSecureRoutes');
-            if (!this.secureExpress) {
-                throw new Error('secureExpress was not initialized. ' +
-                    'Secure routes require getCertificationSettings and httpsPort, and cert files must exist.' +
-                    '\n\nYou need to set security to secure or both in any route and set httpsPort in getPortSettings.' +
-                    '\n\nYou need to set cert files in getCertificationSettings.');
-            }
-            this.secureExpress.use((error, req, res, next) => this.expressErrorHandling(error, req, res, next));
-            await fsm_dynamo_1.DyFM_Array.asyncForEach(this._routingModules, async (module) => {
-                if (module.security !== route_security_enum_1.DyNTS_RouteSecurity.open) {
-                    if (this.logSetup) {
-                        fsm_dynamo_1.DyFM_Log.log(`route mount (secure): ${module.route}`);
-                    }
-                    const existingRoutes = this._routingModules.filter((mod) => mod.route === module.route);
-                    if (1 < existingRoutes.length) {
-                        const error = new Error(`ROUTE DUPLICATION: ${module.route}`);
-                        /* const errorStack: string[] = error.stack.split('\n');
-          
-                        errorStack.splice(1, 4);
-                        error.stack = errorStack.join('\n'); */
-                        error.stack = module.stackLocation;
-                        this.reportSafeDiagnostic('DYNTS-AS0-SECURE-ROUTE-DUPLICATION', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.routing, error);
-                        throw new fsm_dynamo_1.DyFM_Error({
-                            ...this._getDefaultErrorSettings('mountSecureRoutes', error),
-                            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-MSR1`,
-                            message: `ROUTE DUPLICATION: ${module.route}`,
-                        });
-                    }
-                    this.secureExpress.use(module.route, module.secureRouter);
-                }
-            });
-        }
-        catch (error) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                ...this._getDefaultErrorSettings('mountSecureRoutes', error),
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-MSR0`,
-            });
-        }
-    }
-    /**
-     *
-     */
-    async mountOpenRoutes() {
-        try {
-            if (this.fnLogs && this.deepLog)
-                fsm_dynamo_1.DyFM_Log.log('\nfn:. mountOpenRoutes');
-            if (!this.openExpress) {
-                throw new Error('openExpress was not initialized. Open routes require getOpenExpress and httpPort.' +
-                    '\n\nYou need to set security to open or both in any route and set httpPort in getPortSettings.');
-            }
-            this.openExpress.use((error, req, res, next) => this.expressErrorHandling(error, req, res, next));
-            await fsm_dynamo_1.DyFM_Array.asyncForEach(this._routingModules, async (module) => {
-                if (module.security !== route_security_enum_1.DyNTS_RouteSecurity.secure) {
-                    if (this.logSetup) {
-                        fsm_dynamo_1.DyFM_Log.log(`route mount (open): ${module.route}`);
-                    }
-                    const existingRoutes = this._routingModules.filter((mod) => mod.route === module.route);
-                    if (1 < existingRoutes.length) {
-                        const error = new Error(`ROUTE DUPLICATION: ${module.route}`);
-                        /* const errorStack: string[] = error.stack.split('\n');
-            
-                        errorStack.splice(1, 4);
-                        error.stack = errorStack.join('\n'); */
-                        error.stack = module.stackLocation;
-                        this.reportSafeDiagnostic('DYNTS-AS0-OPEN-ROUTE-DUPLICATION', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.routing, error);
-                        throw new fsm_dynamo_1.DyFM_Error({
-                            ...this._getDefaultErrorSettings('mountOpenRoutes', error),
-                            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-MOR1`,
-                            message: `ROUTE DUPLICATION: ${module.route}`,
-                        });
-                    }
-                    this.openExpress.use(module.route, module.openRouter);
-                }
-            });
-        }
-        catch (error) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                ...this._getDefaultErrorSettings('mountOpenRoutes', error),
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-MOR0`,
-            });
-        }
-    }
-    /**
-     * FR-041 — CORS middleware. Echoes a matching `Access-Control-Allow-Origin`
-     * for any request whose Origin header is in `getCorsSettings().allowedOrigins`,
-     * adds the canonical `Access-Control-*` companion headers, and short-circuits
-     * the OPTIONS preflight with a 204.
-     *
-     * No-op when the subclass does NOT override `getCorsSettings()` — preserves
-     * back-compat for apps that have always been same-origin and never needed
-     * CORS (the typical pre-FR-041 case).
-     *
-     * Why hand-rolled instead of the `cors` npm package:
-     *  - ~30 lines, zero new dependency.
-     *  - Full control over Vary/credentials/preflight semantics.
-     *  - Aligns with FDP "no unnecessary deps" philosophy.
-     */
-    /**
-     * BFR-011 / SEC-R2-8 — security response-headerek mountolása (a `mountCors` tükörképe).
-     * A `DyNTS_global_settings.securityHeaders` alapján (default-ON) minden válaszra ráteszi a
-     * biztonsági headereket + eltávolítja az `x-powered-by`-t. A CORS-mount ELŐTT hívandó, hogy az
-     * OPTIONS preflight-válaszok (amiket a mountCors 204-gyel rövidre zár) is megkapják.
-     */
-    mountSecurityHeaders(express) {
-        const settings = global_settings_const_1.DyNTS_global_settings.securityHeaders;
-        if (!settings || !settings.enabled) {
-            return;
-        }
-        if (settings.removePoweredBy !== false) {
-            express.disable('x-powered-by');
-        }
-        express.use((0, security_headers_util_1.DyNTS_createSecurityHeadersMiddleware)(settings, (0, get_environment_settings_util_1.DyNTS_getEnvironment_settings)().environment));
-    }
-    /**
-     * FR-292 — a deployolt app-verziot minden valaszra rateszi (`X-App-Version`), hogy a
-     * bongeszoben NYITVA HAGYOTT SPA eszrevegye, ha kozben ujabb kliens-build ment ki.
-     *
-     * Nem polling: a jelzes a MAR MENO API-hivasokon utazik. Az `enabled` default TRUE — egy
-     * informativ response-header, ami se PII-t, se belso reszletet nem szivarogtat, viszont
-     * enelkul minden app kulon-kulon epitene ugyanezt.
-     */
-    mountAppVersionHeader(express) {
-        const settings = global_settings_const_1.DyNTS_global_settings.appVersionHeader;
-        if (settings?.enabled === false) {
-            return;
-        }
-        express.use((0, app_version_header_util_1.DyNTS_createAppVersionHeaderMiddleware)(() => global_settings_const_1.DyNTS_global_settings.systemVersion, settings?.headerName));
-    }
-    mountCors(express) {
-        const settings = this.getCorsSettings?.();
-        if (!settings) {
-            return;
-        }
-        const allowCreds = settings.allowCredentials !== false;
-        const methods = settings.allowedMethods ?? [
-            'GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS',
-        ];
-        const headers = settings.allowedHeaders ?? [
-            'Authorization', 'Content-Type', 'X-Admin-Key', 'X-Requested-With',
-        ];
-        const exposed = settings.exposedHeaders ?? [
-            'Content-Length', 'Content-Type',
-        ];
-        const maxAge = settings.maxAgeSeconds ?? 86400;
-        const isAllowed = (origin) => {
-            if (settings.allowedOrigins === '*')
-                return true;
-            if (typeof settings.allowedOrigins === 'function') {
-                return settings.allowedOrigins(origin);
-            }
-            return settings.allowedOrigins.includes(origin);
-        };
-        express.use((req, res, next) => {
-            const origin = req.headers.origin;
-            if (origin && isAllowed(origin)) {
-                // Echo the matching origin (NOT wildcard) because credentials require it.
-                res.setHeader('Access-Control-Allow-Origin', origin);
-                if (allowCreds) {
-                    res.setHeader('Access-Control-Allow-Credentials', 'true');
-                }
-                res.setHeader('Access-Control-Allow-Methods', methods.join(', '));
-                res.setHeader('Access-Control-Allow-Headers', headers.join(', '));
-                res.setHeader('Access-Control-Expose-Headers', exposed.join(', '));
-                res.setHeader('Access-Control-Max-Age', String(maxAge));
-                res.setHeader('Vary', 'Origin');
-            }
-            if (req.method === 'OPTIONS') {
-                res.status(204).end();
-                return;
-            }
-            next();
-        });
-    }
-    /**
-     * Generikus, auth-agnosztikus extension-point orchestrator. A `registerCustomMiddleware`
-     * hookot hívja (ha a subclass override-olja) minden AKTÍV Express instance-ra
-     * (open + secure), az API route-ok UTÁN, de a SPA static catch-all (`app.get('*')`)
-     * ELŐTT — ez az EGYETLEN korrekt pont egy sub-path middleware-hez (pl. reverse-proxy),
-     * mert a catch-all minden utána mountolt route-ot elnyel. No-op ha nincs override (back-compat).
-     */
-    async mountCustomMiddleware() {
-        if (!this.registerCustomMiddleware) {
-            return;
-        }
-        if (this.openExpress) {
-            await this.registerCustomMiddleware(this.openExpress, route_security_enum_1.DyNTS_RouteSecurity.open);
-        }
-        if (this.secureExpress) {
-            await this.registerCustomMiddleware(this.secureExpress, route_security_enum_1.DyNTS_RouteSecurity.secure);
-        }
-        if (this.logSetup) {
-            fsm_dynamo_1.DyFM_Log.log('\nCustom middleware registered (pre-static).');
-        }
-    }
-    /**
-     * Ha getStaticClientSettings() visszaad beállításokat, a client static fájlok a '/' alatt
-     * lesznek kiszolgálva (API route-ok után). SPA fallback opcionális (fallbackPath).
-     * Asset cache (assetCacheMaxAge, assetCacheImmutable) és fallback cache (fallbackCacheMaxAge)
-     * opcionálisak; ha nincs megadva fallbackCacheMaxAge, DyNTS_defaultFallbackCacheMaxAge (0) marad.
-     */
-    async mountStaticClient() {
-        const settings = this.getStaticClientSettings?.();
-        if (!settings) {
-            return;
-        }
-        const absoluteRoot = Path.isAbsolute(settings.root)
-            ? settings.root
-            : Path.resolve(process.cwd(), settings.root);
-        const hasAssetCache = settings.assetCacheMaxAge !== undefined || settings.assetCacheImmutable === true;
-        const staticOptions = hasAssetCache && settings.assetCacheMaxAge !== undefined
-            ? {
-                setHeaders: (res, filePath) => {
-                    // A HTML entry-fájlok (index.html) no-cache-t kapnak, a hash-elt asset-ek
-                    // immutable long-cache-t — lásd DyNTS_resolveStaticCacheControlHeader (served-stale-index fix).
-                    res.setHeader('Cache-Control', (0, static_cache_control_util_1.DyNTS_resolveStaticCacheControlHeader)({
-                        filePath: filePath,
-                        assetCacheMaxAge: settings.assetCacheMaxAge,
-                        assetCacheImmutable: settings.assetCacheImmutable === true,
-                    }));
-                },
-            }
-            : undefined;
-        const staticMiddleware = staticOptions
-            ? Express.static(absoluteRoot, staticOptions)
-            : Express.static(absoluteRoot);
-        const fallbackMaxAge = settings.fallbackCacheMaxAge ?? default_fallback_cache_max_age_const_1.DyNTS_defaultFallbackCacheMaxAge;
-        // API-namespace guard (BFR-DYNAMOBUILDER-001): a catch-all fallback NE fedje az API-prefixeket —
-        // egy ismeretlen `GET /api/...` 404 JSON-t kapjon, ne megtévesztő `200 + index.html`-t.
-        // Konfigurálható (fallbackExcludePrefixes); default a bevett FDP namespace-pár.
-        const excludePrefixes = settings.fallbackExcludePrefixes ?? ['/api', '/auth-api'];
-        const isApiNamespacePath = (path) => excludePrefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
-        if (this.openExpress) {
-            this.openExpress.use('/', staticMiddleware);
-            if (settings.fallbackPath) {
-                this.openExpress.get('*', (req, res) => {
-                    if (isApiNamespacePath(req.path)) {
-                        res.status(404).send({ message: `Unknown API endpoint: ${req.path}` });
-                        return;
-                    }
-                    res.setHeader('Cache-Control', `max-age=${fallbackMaxAge}`);
-                    res.sendFile(settings.fallbackPath, { root: absoluteRoot });
-                });
-            }
-            else {
-                this.openExpress.get('*', (req, res) => {
-                    if (isApiNamespacePath(req.path)) {
-                        res.status(404).send({ message: `Unknown API endpoint: ${req.path}` });
-                        return;
-                    }
-                    res.status(404).type('html').send(default_not_found_page_const_1.DyNTS_defaultNotFoundPageHtml);
-                });
-            }
-        }
-        if (this.secureExpress) {
-            this.secureExpress.use('/', staticMiddleware);
-            if (settings.fallbackPath) {
-                this.secureExpress.get('*', (req, res) => {
-                    if (isApiNamespacePath(req.path)) {
-                        res.status(404).send({ message: `Unknown API endpoint: ${req.path}` });
-                        return;
-                    }
-                    res.setHeader('Cache-Control', `max-age=${fallbackMaxAge}`);
-                    res.sendFile(settings.fallbackPath, { root: absoluteRoot });
-                });
-            }
-            else {
-                this.secureExpress.get('*', (req, res) => {
-                    if (isApiNamespacePath(req.path)) {
-                        res.status(404).send({ message: `Unknown API endpoint: ${req.path}` });
-                        return;
-                    }
-                    res.status(404).type('html').send(default_not_found_page_const_1.DyNTS_defaultNotFoundPageHtml);
-                });
-            }
-        }
-        if (this.logSetup) {
-            fsm_dynamo_1.DyFM_Log.log(`\nStatic client mounted at / (root: ${absoluteRoot})`);
-        }
-    }
-    /**
-     *
-     */
-    setSecurity() {
-        if (this.fnLogs && this.deepLog)
-            fsm_dynamo_1.DyFM_Log.log('\nfn:. setSecurity');
-        this._routingModules.forEach((module) => {
-            if (!module.security) {
-                fsm_dynamo_1.DyFM_Log.warn(`RoutingModule security is not set for ${module.route}\n`);
-            }
-            else if (!this._security) {
-                this._security = module.security;
-            }
-            else if (this._security !== module.security) {
-                this._security = route_security_enum_1.DyNTS_RouteSecurity.both;
-            }
-        });
-        if (!this._security) {
-            let msg = `Could not set security for the server! (${this.security})`;
-            msg += '\n  RoutingModules:';
-            this._routingModules.forEach((module) => {
-                msg += `\n    ${module.route} (security: ${module.security})`;
-            });
-            if (this._routingModules.length === 0) {
-                msg += '\n    - no RoutingModule found -\n';
-            }
-            fsm_dynamo_1.DyFM_Log.warn(msg);
-        }
-    }
-    _getDefaultErrorSettings(fnName, error) {
-        return {
-            status: error?.___status ?? 500,
-            message: error?.message ??
-                error?._message ??
-                `${fnName} was UNSUCCESSFUL (NTS)`,
-            userMessage: error?.__userMessage ?? this.defaultErrorUserMsg,
-            addECToUserMsg: !error?.__userMessage,
-            issuerService: `${this?.constructor?.name}-DyNTS_App`,
-            level: fsm_dynamo_1.DyFM_ErrorLevel.fatal,
-            error: error,
-            systemVersion: global_settings_const_1.DyNTS_global_settings.systemVersion,
-        };
-    }
-}
-exports.DyNTS_App = DyNTS_App;
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_App = void 0;
+const tslib_1 = require("tslib");
+const Mongoose = require("mongoose");
+const Express = require("express");
+/* import Mongoose from 'mongoose';
+import Express from 'express'; */
+const BodyParser = tslib_1.__importStar(require("body-parser"));
+const FileSystem = tslib_1.__importStar(require("fs"));
+const Https = tslib_1.__importStar(require("https"));
+const Path = tslib_1.__importStar(require("path"));
+/* import { version } from '../../../package.json'; */
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const default_fallback_cache_max_age_const_1 = require("../../_collections/default-fallback-cache-max-age.const");
+const default_not_found_page_const_1 = require("../../_collections/default-not-found-page.const");
+const global_settings_const_1 = require("../../_collections/global-settings.const");
+const client_safe_error_util_1 = require("../../_collections/client-safe-error.util");
+const get_environment_settings_util_1 = require("../../_collections/get-environment-settings.util");
+const security_headers_util_1 = require("../../_collections/security-headers.util");
+const load_shed_util_1 = require("../../_collections/load-shed.util");
+const app_version_header_util_1 = require("../../_collections/app-version-header.util");
+const mongo_reconnect_guard_util_1 = require("../../_collections/mongo-reconnect-guard.util");
+const static_cache_control_util_1 = require("../../_collections/static-cache-control.util");
+const route_security_enum_1 = require("../../_enums/route-security.enum");
+const app_system_controls_control_model_1 = require("../../_models/control-models/app-system-controls.control-model");
+const http_settings_control_model_1 = require("../../_models/control-models/http-settings.control-model");
+const singleton_service_1 = require("../base/singleton.service");
+const global_service_1 = require("../core/global.service");
+const collection_growth_monitor_service_1 = require("../core/collection-growth-monitor.service");
+const memory_guard_service_1 = require("../core/memory-guard.service");
+const event_loop_diag_service_1 = require("../core/event-loop-diag.service");
+const request_telemetry_control_service_1 = require("../core/request-telemetry.control-service");
+const safe_diagnostic_stage_type_enum_1 = require("../../_modules/server/safe-diagnostic/safe-diagnostic-stage.type-enum");
+const safe_diagnostic_control_service_1 = require("../../_modules/server/safe-diagnostic/safe-diagnostic.control-service");
+class DyNTS_App extends singleton_service_1.DyNTS_SingletonService {
+    systemControls = new app_system_controls_control_model_1.DyNTS_AppSystemControls();
+    get started() {
+        return this.systemControls.app.started;
+    }
+    get superStarted() {
+        return this.systemControls.app.started;
+    }
+    constructErrors = [];
+    /* removed since cant use version from package.json
+    private readonly _ntsVersion: string = 'v01.07.18';
+    protected get ntsVersion(): string {
+      return this._ntsVersion;
+    } */
+    get serverName() {
+        return this.params.name;
+    }
+    _params;
+    get params() {
+        return this._params;
+    }
+    mongoose = Mongoose;
+    _security;
+    get security() {
+        return this._security;
+    }
+    _portSettings = new http_settings_control_model_1.DyNTS_Http_Settings();
+    get portSettings() {
+        return this._portSettings;
+    }
+    _cert;
+    get cert() {
+        return this._cert;
+    }
+    openExpress;
+    secureExpress;
+    httpsServer;
+    httpServer;
+    globalService;
+    _rootServices = [];
+    _routingModules = [];
+    defaultReadyTimeout = 30 * fsm_dynamo_1.second;
+    defaultErrorUserMsg = `We encountered an unhandled Server Error, ` +
+        `\nplease contact the responsible development team.` +
+        `\n(Internal Server error)`;
+    get logSetup() {
+        return global_settings_const_1.DyNTS_global_settings.log_settings.setup;
+    }
+    get deepLog() {
+        return global_settings_const_1.DyNTS_global_settings.log_settings.deep;
+    }
+    get fnLogs() {
+        return global_settings_const_1.DyNTS_global_settings.log_settings.functions;
+    }
+    debugLog = global_settings_const_1.DyNTS_global_settings.log_settings.server_debug;
+    reportSafeDiagnostic(code, stage, error, status = 500) {
+        const configuredPrefix = global_settings_const_1.DyNTS_global_settings.systemShortCodeName;
+        const prefix = configuredPrefix && /^[A-Z][A-Z0-9_-]{1,31}$/.test(configuredPrefix)
+            ? configuredPrefix
+            : 'DYNTS';
+        return safe_diagnostic_control_service_1.DyNTS_SafeDiagnostic_ControlService.report({
+            code: `${prefix}|${code}`,
+            stage: stage,
+            error: error,
+            status: status,
+        });
+    }
+    forwardSafeDiagnostic(diagnostic) {
+        try {
+            const pending = global_service_1.DyNTS_GlobalService.globalErrorHandler?.(safe_diagnostic_control_service_1.DyNTS_SafeDiagnostic_ControlService.toError(diagnostic));
+            void pending?.catch((error) => {
+                this.reportSafeDiagnostic('DYNTS-AS0-GLOBAL-HANDLER-REJECTED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.globalErrorHandler, error);
+            });
+        }
+        catch (error) {
+            this.reportSafeDiagnostic('DYNTS-AS0-GLOBAL-HANDLER-THREW', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.globalErrorHandler, error);
+        }
+    }
+    constructor( /* extended?: boolean */) {
+        super();
+        /* dotenv.config() */
+        process.on('unhandledRejection', (reason) => {
+            const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-BASE-UR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.unhandledRejection, reason);
+            this.forwardSafeDiagnostic(diagnostic);
+        });
+        this.asyncConstruct( /* extended */).catch((error) => {
+            const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-BOOTSTRAP-FAILED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.bootstrap, error);
+            this.forwardSafeDiagnostic(diagnostic);
+            process.exit(1);
+        });
+    }
+    async asyncConstruct(extended) {
+        if (this.fnLogs && this.deepLog)
+            fsm_dynamo_1.DyFM_Log.log('\nfn:. asyncConstruct');
+        try {
+            this.systemControls.app.init = true;
+            this._params = this.getAppParams();
+            fsm_dynamo_1.DyFM_Log.log(`\n\n\n\n\n\n\n\n\n\n` +
+                `Starting ${this._params?.name}... ` +
+                /* `v${version}` + */
+                `\n\n\n\n\n\n\n\n\n\n`);
+            if (!this._params) {
+                throw new Error('getAppParams() must return a DyNTS_AppParams object!');
+            }
+            if (this.params.systemShortCodeName) {
+                global_settings_const_1.DyNTS_global_settings.systemShortCodeName = this.params.systemShortCodeName;
+            }
+            if (this.params.systemName) {
+                global_settings_const_1.DyNTS_global_settings.systemName = this.params.systemName;
+                fsm_dynamo_1.DyFM_error_defaults.issuerSystem = this.params.systemName;
+            }
+            if (this.params.version) {
+                global_settings_const_1.DyNTS_global_settings.systemVersion = this.params.version;
+                fsm_dynamo_1.DyFM_error_defaults.systemVersion = this.params.version;
+            }
+            process.stdout.write(String.fromCharCode(27) + ']0;' +
+                this._params?.name +
+                String.fromCharCode(7));
+            fsm_dynamo_1.DyFM_error_defaults.issuerSystem = this._params.systemName;
+            this.overrideDynamoNTSGlobalSettings?.();
+            if (global_settings_const_1.DyNTS_global_settings.log_settings.setup) {
+                fsm_dynamo_1.DyFM_Log.S_info(`env settings;\n`, {
+                    systemName: global_settings_const_1.DyNTS_global_settings.systemName,
+                    systemShortCodeName: global_settings_const_1.DyNTS_global_settings.systemShortCodeName,
+                    systemVersion: global_settings_const_1.DyNTS_global_settings.systemVersion,
+                    environment: global_settings_const_1.DyNTS_global_settings.env_settings.environment,
+                    /* log_settings: DyNTS_global_settings.log_settings,
+                    env_settings: DyNTS_global_settings.env_settings, */
+                });
+            }
+            this.globalService = global_service_1.DyNTS_GlobalService.getInstance();
+            await global_service_1.DyNTS_GlobalService.setServices(this.getGlobalServiceCollection());
+            global_service_1.DyNTS_GlobalService.setParams(this.params);
+            if (this.getPortSettings) {
+                this._portSettings = this.getPortSettings();
+            }
+            if (this.getCertificationSettings) {
+                this._cert = this.getCertificationSettings();
+            }
+            if (this.getApiBasePath) {
+                global_settings_const_1.DyNTS_global_settings.baseUrl = this.getApiBasePath();
+            }
+            if (this.getRoutingModules) {
+                this._routingModules = this.getRoutingModules();
+                // ezt egyelőre csak tesztelem, nem kerül be
+                /* if (
+                  !DyNTS_global_settings.dontCreateDefaultRoute &&
+                  !this._routingModules.some((routingModule: DyNTS_RoutingModule): boolean => routingModule.route === '/*')
+                ) {
+                  this._routingModules.push(
+                    DyNTS_getStarRoute()
+                  );
+                } */
+            }
+            if (this._params.dbUri) {
+                await this.startDB();
+                // createEntries csak akkor fut, ha a DB tényleg fel-jött.
+                // Ha a startDB jelezte a hibát, de továbbment, akkor a started flag false marad,
+                // és nem próbálunk meg írni egy nem létező kapcsolatra.
+                if (this.createEntries && this.systemControls.mongoose.started) {
+                    await this.createEntries();
+                }
+            }
+            else {
+                fsm_dynamo_1.DyFM_Log.log(`\nNo database connection created.`);
+            }
+            if (this._routingModules?.length) {
+                if (this.logSetup)
+                    fsm_dynamo_1.DyFM_Log.log('\nsetting up express routes...');
+                this.setSecurity();
+                await this.initExpresses();
+                await this.startExpresses();
+                if (this._security !== route_security_enum_1.DyNTS_RouteSecurity.secure) {
+                    await this.mountOpenRoutes();
+                }
+                if (this._security !== route_security_enum_1.DyNTS_RouteSecurity.open && this._cert) {
+                    await this.mountSecureRoutes();
+                }
+                // Generikus, auth-agnosztikus extension-point: custom middleware az API
+                // route-ok UTÁN, de a SPA static catch-all (mountStaticClient) ELŐTT.
+                await this.mountCustomMiddleware();
+                await this.mountStaticClient();
+                if (this.logSetup) {
+                    fsm_dynamo_1.DyFM_Log.log(`\nRoutes mounted.... server using security: ${this._security}`);
+                }
+            }
+            else {
+                fsm_dynamo_1.DyFM_Log.warn(`\nNo routes mounted!`);
+            }
+            if (this.getRootServices) {
+                this._rootServices = await this.getRootServices();
+            }
+            if (this.postProcess) {
+                await this.postProcess().catch((error) => {
+                    const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-POST-PROCESS-FAILED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.postProcess, error);
+                    this.forwardSafeDiagnostic(diagnostic);
+                });
+            }
+            // FR-193 — bedrock OOM korai-figyelmeztetés: feltelepítjük a heap-watchdogot, ha
+            // engedélyezve (DyNTS_global_settings.memoryGuard.enabled, default true). Biztonságos:
+            // a guard egy könnyű setInterval, ami SOHA nem dob; csak near-OOM küszöböknél hagy
+            // tartós nyomot az error-sinkbe, mielőtt a fatal heap-OOM megölné a process-t.
+            try {
+                if (global_settings_const_1.DyNTS_global_settings.memoryGuard?.enabled) {
+                    memory_guard_service_1.DyNTS_MemoryGuard.getInstance().install();
+                }
+            }
+            catch (memoryGuardError) {
+                this.reportSafeDiagnostic('DYNTS-AS0-MEMORY-GUARD-SKIPPED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.memoryGuard, memoryGuardError);
+            }
+            // BFR-OVERSEER-007 — event-loop-lag diag a MemoryGuard MELLÉ: a „process él, HTTP néma" wedge
+            // belső mérése (natív histogram, olcsó). Observation-only, sosem dob; a /server/diag olvas belőle.
+            try {
+                event_loop_diag_service_1.DyNTS_EventLoopDiag.getInstance().install();
+            }
+            catch (eventLoopDiagError) {
+                this.reportSafeDiagnostic('DYNTS-AS0-EVENT-LOOP-DIAG-SKIPPED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.eventLoopDiagnostic, eventLoopDiagError);
+            }
+            // FR-258 / SR-4 — proactive collection-growth monitor (companion to the MemoryGuard). Warns
+            // into the Errors-sink when a collection grows unbounded, BEFORE it can be loaded into heap and
+            // OOM. Default-on, observation-only, never throws.
+            try {
+                if (global_settings_const_1.DyNTS_global_settings.collectionGrowthMonitor?.enabled) {
+                    collection_growth_monitor_service_1.DyNTS_CollectionGrowthMonitor.getInstance().install();
+                }
+            }
+            catch (cgmError) {
+                this.reportSafeDiagnostic('DYNTS-AS0-COLLECTION-GROWTH-MONITOR-SKIPPED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.collectionGrowthMonitor, cgmError);
+            }
+            if (!extended) {
+                await this.ready();
+                if (this.params.title) {
+                    fsm_dynamo_1.DyFM_Log.success(this.params.title);
+                }
+                fsm_dynamo_1.DyFM_Log.info(`Version: ${this.params.version}`);
+                /* DyFM_Log.info(`NTS Version: ${this.ntsVersion}`); */
+                fsm_dynamo_1.DyFM_Log.H_success(`${this.params.name} started successfully.`);
+            }
+        }
+        catch (error) {
+            this.constructErrors.push(error);
+            throw new fsm_dynamo_1.DyFM_Error({
+                ...this._getDefaultErrorSettings('asyncConstruct', error),
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-001`,
+                additionalContent: {
+                    constructErrors: this.constructErrors,
+                    systemControls: this.systemControls,
+                    systemReadies: {
+                        app: this.systemControls.app.getIsReady(),
+                        mongoose: this.systemControls.mongoose.getIsReady(),
+                        httpServer: this.systemControls.httpServer.getIsReady(),
+                        httpsServer: this.systemControls.httpsServer.getIsReady(),
+                    },
+                },
+            });
+        }
+    }
+    async ready(timeout = this.defaultReadyTimeout) {
+        try {
+            if (this.fnLogs)
+                fsm_dynamo_1.DyFM_Log.log('\nfn:. ready');
+            await fsm_dynamo_1.DyFM_Async.delay(100);
+            let ready = false;
+            const start = +new Date();
+            if (this.constructErrors.length) {
+                this.reportSafeDiagnostic('DYNTS-AS0-READINESS-CONSTRUCT-ERROR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.readiness, this.constructErrors[0]);
+                throw new fsm_dynamo_1.DyFM_Error({
+                    ...this._getDefaultErrorSettings('ready', new Error(`"${this._params.name}" start failed.`)),
+                    errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-R01`,
+                    additionalContent: this.constructErrors.length === 1 ?
+                        { error: this.constructErrors[0] } :
+                        { errors: this.constructErrors },
+                });
+            }
+            while (!ready && +new Date() - start < timeout) {
+                if (this.systemControls.app.init) {
+                    ready = (this.systemControls.mongoose.getIsReady() &&
+                        this.systemControls.httpServer.getIsReady() &&
+                        this.systemControls.httpsServer.getIsReady());
+                }
+                if (!ready) {
+                    await fsm_dynamo_1.DyFM_Async.wait(100);
+                }
+            }
+            if (timeout < +new Date() - start) {
+                this.reportSafeDiagnostic('DYNTS-AS0-READINESS-TIMEOUT', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.readiness, this.constructErrors[0] ?? new Error('readiness-timeout'));
+                throw new fsm_dynamo_1.DyFM_Error({
+                    ...this._getDefaultErrorSettings('ready', new Error(`"${this._params.name}" start failed. TIMEOUT`)),
+                    errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-R02`,
+                    additionalContent: {
+                        constructErrors: this.constructErrors,
+                        systemControls: this.systemControls,
+                        systemReadies: {
+                            mongoose: this.systemControls.mongoose.getIsReady(),
+                            httpServer: this.systemControls.httpServer.getIsReady(),
+                            httpsServer: this.systemControls.httpsServer.getIsReady(),
+                        },
+                    },
+                });
+            }
+            if (this.constructErrors.length) {
+                this.reportSafeDiagnostic('DYNTS-AS0-READINESS-LATE-CONSTRUCT-ERROR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.readiness, this.constructErrors[0]);
+                throw new fsm_dynamo_1.DyFM_Error({
+                    ...this._getDefaultErrorSettings('ready', new Error(`"${this._params.name}" start failed.`)),
+                    errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-R03`,
+                    additionalContent: this.constructErrors,
+                });
+            }
+            if (ready) {
+                this.systemControls.app.started = true;
+                if (this.fnLogs && this.deepLog)
+                    fsm_dynamo_1.DyFM_Log.log('\nfn:. ready: return');
+                return;
+            }
+            this.systemControls.app.started = false;
+            let msg = `"${this._params.name}" start failed. UNKNOWN`;
+            if (this.systemControls.mongoose.init && !this.systemControls.mongoose.started) {
+                msg += `\nMongoose start failed.`;
+            }
+            if (this.systemControls.httpServer.init && !this.systemControls.httpServer.started) {
+                msg += `\nHTTP Server start failed.`;
+            }
+            if (this.systemControls.httpsServer.init && !this.systemControls.httpsServer.started) {
+                msg += `\nHTTPS Server start failed.`;
+            }
+            this.reportSafeDiagnostic('DYNTS-AS0-READINESS-UNKNOWN', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.readiness, this.constructErrors[0] ?? new Error('readiness-unknown'));
+            throw new fsm_dynamo_1.DyFM_Error({
+                ...this._getDefaultErrorSettings('ready', new Error(msg)),
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-R04`,
+                additionalContent: {
+                    constructErrors: this.constructErrors,
+                    systemControls: this.systemControls,
+                    systemReadies: {
+                        app: this.systemControls.app.getIsReady(),
+                        mongoose: this.systemControls.mongoose.getIsReady(),
+                        httpServer: this.systemControls.httpServer.getIsReady(),
+                        httpsServer: this.systemControls.httpsServer.getIsReady(),
+                    },
+                },
+                error: this.constructErrors?.[0] ?? new Error(),
+            });
+        }
+        catch (error) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                ...this._getDefaultErrorSettings('ready', error),
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-READY0`,
+            });
+        }
+    }
+    getSimplifiedConstructErrors() {
+        return this.constructErrors.map((error) => {
+            if (error instanceof fsm_dynamo_1.DyFM_Error) {
+                return error.getErrorSimplified();
+            }
+            else {
+                return error;
+            }
+        });
+    }
+    async stop(dontLog) {
+        try {
+            fsm_dynamo_1.DyFM_Log.info('\nstopping server...\n');
+            await this.ready();
+            if (this.started) {
+                if (this.systemControls.mongoose.init) {
+                    fsm_dynamo_1.DyFM_Log.info(`\nstopping Mongoose....`);
+                    let tryCount = 0;
+                    while (!this.systemControls.mongoose.started &&
+                        !this.constructErrors.length &&
+                        tryCount++ < 10) {
+                        fsm_dynamo_1.DyFM_Log.warn(`Mongoose not even started yet....`);
+                        await fsm_dynamo_1.DyFM_Async.wait(fsm_dynamo_1.second);
+                    }
+                    this.systemControls.mongoose.started = false;
+                    if (this.mongoose) {
+                        await fsm_dynamo_1.DyFM_Array.asyncForEach(Object.keys(this.mongoose.models), async (modelName) => {
+                            this.mongoose.deleteModel(modelName);
+                        });
+                        const disconnect = new Promise((resolve) => {
+                            this.mongoose.connection.on('disconnecting', () => {
+                                resolve();
+                            });
+                        });
+                        await this.mongoose.disconnect();
+                        await this.mongoose.connection.close();
+                        await disconnect;
+                        this.mongoose.connection.removeAllListeners();
+                        while (this.mongoose.connection.readyState !== 0 &&
+                            !this.constructErrors.length) {
+                            fsm_dynamo_1.DyFM_Log.warn(`\nMongoose still not disconnected....`);
+                            await fsm_dynamo_1.DyFM_Async.wait(fsm_dynamo_1.second);
+                        }
+                    }
+                    else {
+                        fsm_dynamo_1.DyFM_Log.error(`\nMongoose not found.`);
+                    }
+                    this.systemControls.mongoose.init = false;
+                }
+                if (this.systemControls.httpServer.init) {
+                    this.systemControls.httpServer.started = false;
+                    if (this.httpServer) {
+                        await new Promise((resolve) => {
+                            this.httpServer.close(resolve);
+                        });
+                    }
+                    else {
+                        fsm_dynamo_1.DyFM_Log.error(`\nHTTP Server not found.`);
+                    }
+                    this.systemControls.httpServer.init = false;
+                }
+                if (this.systemControls.httpsServer.init) {
+                    this.systemControls.httpsServer.started = false;
+                    if (this.httpsServer) {
+                        await new Promise((resolve) => {
+                            this.httpsServer.close(resolve);
+                        });
+                    }
+                    else {
+                        fsm_dynamo_1.DyFM_Log.error(`\nHTTPS Server not found.`);
+                    }
+                    this.systemControls.httpsServer.init = false;
+                }
+                await fsm_dynamo_1.DyFM_Async.wait(fsm_dynamo_1.second);
+                if (!dontLog) {
+                    fsm_dynamo_1.DyFM_Log.H_log(`"${this._params.name}" stopped successfully.`);
+                }
+            }
+        }
+        catch (error) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                ...this._getDefaultErrorSettings('stop', error),
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-STOP0`,
+            });
+        }
+    }
+    /**
+     *
+     */
+    async startDB() {
+        if (this.fnLogs && this.deepLog)
+            fsm_dynamo_1.DyFM_Log.log('\nfn:. startDB');
+        else if (this.logSetup)
+            fsm_dynamo_1.DyFM_Log.log('\nstarting DB connection...');
+        if (!this._params.dbUri) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                ...this._getDefaultErrorSettings('startDB', new Error('DB URI is not set.')),
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SDB0`,
+            });
+        }
+        if (!this._params.dbOptions) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                ...this._getDefaultErrorSettings('startDB', new Error('DB OPTIONS are not set.')),
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SDB0`,
+            });
+        }
+        if (this.systemControls.mongoose.init || this.systemControls.mongoose.started) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                ...this._getDefaultErrorSettings('startDB', new Error('Mongoose is already initialized.')),
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SDB0`,
+            });
+        }
+        try {
+            await new Promise((resolve, reject) => {
+                this.systemControls.mongoose.init = true;
+                this.mongoose.connection
+                    .once('open', () => {
+                    this.systemControls.mongoose.started = true;
+                    fsm_dynamo_1.DyFM_Log.success('\nConnected to MongoDB.\n');
+                    resolve();
+                    // FR-258 / SR-2 — install declared-retention TTL indexes. DEFERRED + fire-and-forget +
+                    // fully non-fatal: a create-if-missing index op (and the `indexes()` probes) must NOT
+                    // compete with boot-readiness. We delay it well past the deploy health-probe window so a
+                    // cold boot is never slowed by it, then run it detached. `.unref()` keeps it from holding
+                    // the event loop open. Any failure is logged but never crashes the app. (`'differs'` never
+                    // rebuilds a live index — see ensureRetentionTtlIndex.)
+                    const ttlInstallTimer = setTimeout(() => {
+                        void this.installRetentionTtlIndexes();
+                    }, 30000);
+                    if (typeof ttlInstallTimer.unref === 'function') {
+                        ttlInstallTimer.unref();
+                    }
+                })
+                    .on('error', (error) => {
+                    if (!this.systemControls.mongoose.started) {
+                        // Initial DB-csatlakozás sikertelen:
+                        // jelezzük a hibát (log + globalErrorHandler), de NEM szakítjuk meg az
+                        // App startup-ot (nincs constructErrors push, nincs reject).
+                        // A mongoose.init-et resetteljük, hogy a ready() ne várjon a DB-re.
+                        // Ha a mongoose később mégis tudna csatlakozni, az 'open' event
+                        // beállítja a started flag-et, így a runtime DB-műveletek elindulnak.
+                        this.systemControls.mongoose.init = false;
+                        const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-SDB1', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.databaseConnect, error, 503);
+                        this.forwardSafeDiagnostic(diagnostic);
+                        resolve();
+                    }
+                    else {
+                        const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-SDB2', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.databaseRuntime, error, 503);
+                        this.forwardSafeDiagnostic(diagnostic);
+                    }
+                });
+                try {
+                    this.mongoose.connect(this._params.dbUri, this._params.dbOptions
+                    /* {
+                      directConnection: true,
+                    } */
+                    );
+                }
+                catch (error) {
+                    throw new fsm_dynamo_1.DyFM_Error({
+                        ...this._getDefaultErrorSettings('startDB', error),
+                        errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SDB3`,
+                    });
+                }
+            });
+        }
+        catch (error) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                ...this._getDefaultErrorSettings('startDB', error),
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SDB0`,
+            });
+        }
+        // 2026-06-20 — Mongo reconnect-guard. A MongoDB-driver a hostnevet connect-kor EGYSZER
+        // resolválja + cache-eli az IP-t; ha a Mongo-konténert recreate-elik (új docker-network IP),
+        // a driver a HALOTT IP-n ragad → ECONNREFUSED + buffering-timeout, és a service magától SOHA
+        // nem áll vissza. A guard sustained-disconnect (readyState !== 1) esetén — a driver saját
+        // grace-e UTÁN — TELJES disconnect()+connect()-et csinál → ÚJ MongoClient → ÚJ DNS-resolve →
+        // új IP → reconnect. Best-effort, always-on, healthy connection-t (===1) SOHA nem bánt; csak
+        // konténer-IP-frissítés, nem ír adatot. Lásd: mongo-reconnect-guard.util.ts.
+        try {
+            (0, mongo_reconnect_guard_util_1.startMongoReconnectGuard)({
+                getReadyState: () => this.mongoose.connection.readyState,
+                reconnect: async () => {
+                    await this.mongoose.disconnect().catch(() => undefined);
+                    await this.mongoose.connect(this._params.dbUri, this._params.dbOptions);
+                },
+                log: (msg) => {
+                    this.reportSafeDiagnostic('DYNTS-AS0-MONGO-RECONNECT-EVENT', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.mongoReconnectGuard, msg, 503);
+                },
+            });
+        }
+        catch (guardErr) {
+            this.reportSafeDiagnostic('DYNTS-AS0-MONGO-RECONNECT-FAILED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.mongoReconnectGuard, guardErr, 503);
+        }
+    }
+    /**
+     * FR-258 / SR-2 — install MongoDB TTL indexes for every data-model that declared `retention`.
+     *
+     * Runs ONCE right after the DB connection opens. For each registered DB service (including the
+     * auto-created `_archived` siblings, which inherit the parent model's `retention`), it ensures a
+     * TTL index on the `__created` Date field with the resolved `expireAfterSeconds` — so MongoDB
+     * NATIVELY auto-deletes documents older than the configured age. This is the fleet-wide defense
+     * against the unbounded-collection-growth → in-memory-load → GC-thrash/OOM class.
+     *
+     * Guarantees:
+     * - **Non-fatal** — any error is logged but NEVER blocks startup (called fire-and-forget).
+     * - **Idempotent** — an existing index with the same TTL is a no-op; a CHANGED retention (different
+     *   `expireAfterSeconds`, or an existing non-TTL `__created` index) is reconciled by drop+recreate
+     *   (the field index is restored immediately, so query coverage is preserved).
+     */
+    async installRetentionTtlIndexes() {
+        try {
+            const services = global_service_1.DyNTS_GlobalService.getAllDBServices();
+            let ensured = 0;
+            for (const service of services) {
+                const ttlSeconds = (0, fsm_dynamo_1.DyFM_resolveRetentionTtlSeconds)(service?.dataParams?.retention);
+                if (!ttlSeconds) {
+                    continue;
+                }
+                const dataName = service.dataParams.dataName;
+                // The mongoose Model exposes the native driver collection (.indexes / .createIndex / .dropIndex).
+                const collection = service?.dataModel?.collection;
+                if (!collection || typeof collection.createIndex !== 'function') {
+                    continue;
+                }
+                try {
+                    const action = await DyNTS_App.ensureRetentionTtlIndex(collection, ttlSeconds);
+                    if (action === 'created') {
+                        ensured++;
+                        if (this.logSetup) {
+                            fsm_dynamo_1.DyFM_Log.success(`[FR-258 retention] TTL index created on "${dataName}" — ` +
+                                `${Math.round(ttlSeconds / 86400)}d (${ttlSeconds}s)`);
+                        }
+                    }
+                    else if (action === 'differs') {
+                        // Live index has a different TTL — left untouched at boot (see ensureRetentionTtlIndex doc).
+                        this.reportSafeDiagnostic('DYNTS-AS0-RETENTION-INDEX-DIFFERS', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.retention, new Error('retention-index-differs'));
+                    }
+                }
+                catch (idxErr) {
+                    this.reportSafeDiagnostic('DYNTS-AS0-RETENTION-INDEX-FAILED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.retention, idxErr);
+                }
+            }
+            if (ensured > 0) {
+                fsm_dynamo_1.DyFM_Log.success(`[FR-258 retention] ${ensured} TTL index(es) ensured (auto-retention active).`);
+            }
+        }
+        catch (err) {
+            this.reportSafeDiagnostic('DYNTS-AS0-RETENTION-INSTALLER-FAILED', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.retention, err);
+        }
+    }
+    /**
+     * FR-258 / SR-2 — ensure a single `{ __created: 1 }` TTL index with the given `expireAfterSeconds`.
+     * Extracted as a pure-ish static so it is unit-testable with a mock collection. Idempotent + BOOT-SAFE:
+     * - no existing `__created` index      → create it          → `'created'`
+     * - existing with the SAME TTL          → no-op              → `'noop'`
+     * - existing with a DIFFERENT TTL / non-TTL → leave it as-is → `'differs'` (warn only — NO drop+recreate)
+     *
+     * The `'differs'` case intentionally does NOT mutate the live index. Dropping + recreating a TTL index on a
+     * large (multi-GB) production collection is a heavy server-side operation; doing it automatically inside the
+     * startup path can starve the concurrent boot queries (including the deploy health-probe) and trigger a
+     * fail-safe revert. Create-if-missing is the essential growth-prevention behaviour; a deliberate retention
+     * CHANGE on an already-indexed collection is a maintenance action, not a silent every-boot rebuild.
+     */
+    static async ensureRetentionTtlIndex(collection, ttlSeconds) {
+        const existingList = typeof collection.indexes === 'function'
+            ? await collection.indexes().catch(() => [])
+            : [];
+        const existing = existingList.find((ix) => !!ix?.key && ix.key.__created === 1);
+        if (!existing) {
+            await collection.createIndex({ __created: 1 }, { expireAfterSeconds: ttlSeconds });
+            return 'created';
+        }
+        if (existing.expireAfterSeconds === ttlSeconds) {
+            return 'noop';
+        }
+        // Retention differs from the live index (or it is a non-TTL `__created` index). Leave it UNTOUCHED at
+        // boot — only report it. Avoids a heavy drop+recreate competing with boot-readiness on a large collection.
+        return 'differs';
+    }
+    /**
+     *
+     */
+    async initExpresses() {
+        if (this.fnLogs && this.deepLog)
+            fsm_dynamo_1.DyFM_Log.log('\nfn:. initExpresses');
+        try {
+            if (this._security && this._security !== route_security_enum_1.DyNTS_RouteSecurity.secure) {
+                if (this._portSettings.httpPort === undefined || this._portSettings.httpPort === null) {
+                    let errorMsg = `\nYou have open routes, but httpPort is not set!` +
+                        `\nThere are ${this._routingModules.filter(m => m.security != route_security_enum_1.DyNTS_RouteSecurity.secure).length} open/both routes` +
+                        `\nroot security: ${this._security}` +
+                        `\nset httpPort in DynamoBEServer - setupRoutingModules() to enable secure routes.`;
+                    errorMsg += '\n\nThe routes setted to use open server:';
+                    this._routingModules.forEach((module) => {
+                        if (module.security != route_security_enum_1.DyNTS_RouteSecurity.secure) {
+                            errorMsg += `\n  ${module.route} (security: ${module.security})`;
+                            errorMsg += `\n  subroutes using open sever:`;
+                            module.endpoints.forEach((endpoint) => {
+                                if (endpoint.security != route_security_enum_1.DyNTS_RouteSecurity.secure) {
+                                    errorMsg += `\n    ${endpoint.endpoint} (security: ${endpoint.security})`;
+                                }
+                            });
+                        }
+                    });
+                    const error = new Error(`Open routes cannot be established!\n${errorMsg}`);
+                    const errorStack = error.stack.split('\n');
+                    errorStack.splice(1, 2);
+                    error.stack = errorStack.join('\n');
+                    this.reportSafeDiagnostic('DYNTS-AS0-OPEN-ROUTE-CONFIGURATION', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.routing, error);
+                    throw error;
+                }
+                await this.initOpenExpress();
+            }
+            if (this._security && this._security !== route_security_enum_1.DyNTS_RouteSecurity.open) {
+                if (!this._cert || !this._portSettings.httpsPort) {
+                    let errorMsg = `\nYou have secure routes, but the certification paths or httpsPort are not set!` +
+                        `\nThere are ${this._routingModules.filter(m => m.security && m.security !== route_security_enum_1.DyNTS_RouteSecurity.open).length} secure routes` +
+                        `\nroot security: ${this._security}` +
+                        `\nset...` +
+                        `\n(missing exact howto...)` +
+                        /* `\n  httpsPort and` +
+                        `\n  cert: {` +
+                        `\n    keyPath: FileSystem.PathLike,` +
+                        `\n    certPath: FileSystem.PathLike,` +
+                        `\n  }` + */
+                        `\nin DynamoBEServer - getRoutingModules() to enable secure routes.`;
+                    errorMsg += '\n\nThe routes setted to use secure server:';
+                    this._routingModules.forEach((module) => {
+                        if (module.security && module.security !== route_security_enum_1.DyNTS_RouteSecurity.open) {
+                            errorMsg += `\n  ${module.route} (security: ${module.security})`;
+                            errorMsg += `\n    location: ${module.stackLocation}`;
+                            errorMsg += `\n    subroutes using secure sever:`;
+                            module.endpoints.forEach((endpoint) => {
+                                if (endpoint.security && endpoint.security !== route_security_enum_1.DyNTS_RouteSecurity.open) {
+                                    errorMsg += `\n      ${endpoint.endpoint} (security: ${endpoint.security})`;
+                                    errorMsg += `\n        location: ${endpoint.stackLocation}`;
+                                }
+                            });
+                        }
+                    });
+                    const error = new Error(`Secure routes cannot be established!\n${errorMsg}`);
+                    const errorStack = error.stack.split('\n');
+                    errorStack.splice(1, 2);
+                    error.stack = errorStack.join('\n');
+                    this.reportSafeDiagnostic('DYNTS-AS0-SECURE-ROUTE-CONFIGURATION', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.routing, error);
+                    throw error;
+                }
+                await this.initSecureExpress();
+            }
+        }
+        catch (error) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                ...this._getDefaultErrorSettings('initExpresses', error),
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-IE0`,
+            });
+        }
+    }
+    /**
+     *
+     */
+    async initOpenExpress() {
+        if (this.fnLogs)
+            fsm_dynamo_1.DyFM_Log.log('\nfn:. initOpenExpress');
+        this.openExpress = Express();
+        this.openExpress.set('maxHeaderSize', 10 * fsm_dynamo_1.megabyte); // 1024 * 1024 * 10, // 10MB
+        this.openExpress.use(BodyParser.urlencoded(this._portSettings.httpUrlencoded));
+        this.openExpress.use(BodyParser.json(this._portSettings.httpJson));
+        // BFR-011 / SEC-R2-8 — security headerek a CORS ELŐTT (az OPTIONS preflight-válaszok is kapják).
+        this.mountSecurityHeaders(this.openExpress);
+        // FR-041 — CORS allowlist enforcement. No-op if getCorsSettings() is not overridden.
+        this.mountCors(this.openExpress);
+        // FR-292 — a deployolt app-verzio minden valaszon. A CORS UTAN kell, mert az
+        // `Access-Control-Expose-Headers`-hoz HOZZAFUZ (kulonben a CORS felulirna).
+        this.mountAppVersionHeader(this.openExpress);
+        this.mountRequestTelemetry(this.openExpress);
+        // BFR-OVERSEER-009 — opt-in auto-load-shed 503 CRITICAL memória-nyomásnál (esszenciális utak kivételével).
+        if (global_settings_const_1.DyNTS_global_settings.memoryGuard?.loadShedEnabled) {
+            this.openExpress.use((0, load_shed_util_1.DyNTS_createLoadShedMiddleware)());
+        }
+    }
+    /**
+     *
+     */
+    async initSecureExpress() {
+        if (this.fnLogs)
+            fsm_dynamo_1.DyFM_Log.log('\nfn:. initSecureExpress');
+        this.secureExpress = Express();
+        this.secureExpress.use(BodyParser.urlencoded(this._portSettings.httpsUrlencoded));
+        this.secureExpress.use(BodyParser.json(this._portSettings.httpsJson));
+        // BFR-011 / SEC-R2-8 — security headerek a CORS ELŐTT (mint az open expressen).
+        this.mountSecurityHeaders(this.secureExpress);
+        // FR-041 — CORS allowlist enforcement (same as open express).
+        this.mountCors(this.secureExpress);
+        // FR-292 — a deployolt app-verzio minden valaszon (mint az open expressen).
+        this.mountAppVersionHeader(this.secureExpress);
+        this.mountRequestTelemetry(this.secureExpress);
+        // BFR-OVERSEER-009 — opt-in auto-load-shed 503 (mint az open expressen).
+        if (global_settings_const_1.DyNTS_global_settings.memoryGuard?.loadShedEnabled) {
+            this.secureExpress.use((0, load_shed_util_1.DyNTS_createLoadShedMiddleware)());
+        }
+        const options = {
+            key: FileSystem.readFileSync(this._cert.keyPath),
+            cert: FileSystem.readFileSync(this._cert.certPath),
+            maxHeaderSize: 10 * fsm_dynamo_1.megabyte, // 1024 * 1024 * 10, // 10MB
+        };
+        this.httpsServer = Https.createServer(options, this.secureExpress);
+    }
+    /**
+     *
+     */
+    async startExpresses() {
+        if (this.fnLogs && this.deepLog)
+            fsm_dynamo_1.DyFM_Log.log('\nfn:. startExpresses');
+        try {
+            if (this._security && this._security !== route_security_enum_1.DyNTS_RouteSecurity.open) {
+                await new Promise((resolve, reject) => {
+                    this.systemControls.httpsServer.init = true;
+                    this.httpsServer
+                        .listen(this._portSettings.httpsPort, this.params.secureHost, this.params.expressBacklog, () => {
+                        this.systemControls.httpsServer.started = true;
+                        fsm_dynamo_1.DyFM_Log.success(`\nHTTPS (secure) server is listening on port: ` +
+                            `${this.params.secureHost}:${this._portSettings.httpsPort}`);
+                        resolve();
+                    })
+                        .on('error', (error) => {
+                        const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-HTTPS-ERROR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.httpsServer, error, 503);
+                        if (!this.systemControls.httpsServer.started) {
+                            const d_error = new fsm_dynamo_1.DyFM_Error({
+                                ...this._getDefaultErrorSettings('startExpresses', error),
+                                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SE1`,
+                                message: `HTTPS (secure) start server ERROR`,
+                            });
+                            this.constructErrors.push(d_error);
+                            this.forwardSafeDiagnostic(diagnostic);
+                            reject(d_error);
+                        }
+                        else {
+                            this.forwardSafeDiagnostic(diagnostic);
+                        }
+                    })
+                        .on('uncaughtException', (exception) => {
+                        const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-HTTPS-UNCAUGHT', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.httpsServer, exception);
+                        this.forwardSafeDiagnostic(diagnostic);
+                    });
+                });
+            }
+            if (this._security && this._security !== route_security_enum_1.DyNTS_RouteSecurity.secure) {
+                this.systemControls.httpServer.init = true;
+                await new Promise((resolve, reject) => {
+                    this.httpServer = this.openExpress
+                        .listen(this._portSettings.httpPort, this.params.openHost, this.params.expressBacklog, () => {
+                        this.systemControls.httpServer.started = true;
+                        const resolvedPort = this.httpServer?.address?.()?.['port'] ?? this._portSettings.httpPort;
+                        if (this._portSettings.httpPort === 0) {
+                            fsm_dynamo_1.DyFM_Log.H_warn(`\nHTTP (open) server is using a randomly selected port by the OS: ${resolvedPort}` +
+                                `\n  (httpPort was set to 0 — this is intended for testing only)`);
+                        }
+                        fsm_dynamo_1.DyFM_Log.success(`\nHTTP (open) server is listening on port: ` +
+                            `${this.params.openHost}:${resolvedPort}`);
+                        resolve();
+                    })
+                        .on('error', (error) => {
+                        const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-HTTP-ERROR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.httpServer, error, 503);
+                        if (!this.systemControls.httpServer.started) {
+                            const d_error = new fsm_dynamo_1.DyFM_Error({
+                                ...this._getDefaultErrorSettings('startExpresses', error),
+                                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SE3`,
+                                message: `HTTP (open) start server ERROR`,
+                            });
+                            this.constructErrors.push(d_error);
+                            this.forwardSafeDiagnostic(diagnostic);
+                            reject(d_error);
+                        }
+                        else {
+                            this.forwardSafeDiagnostic(diagnostic);
+                        }
+                    })
+                        .on('uncaughtException', (exception) => {
+                        const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-HTTP-UNCAUGHT', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.httpServer, exception);
+                        this.forwardSafeDiagnostic(diagnostic);
+                    });
+                });
+            }
+        }
+        catch (error) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                ...this._getDefaultErrorSettings('startExpresses', error),
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-SE0`,
+            });
+        }
+    }
+    /**
+     *
+     */
+    async expressErrorHandling(error, req, res, next) {
+        try {
+            if (error) {
+                const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-EXPRESS-ERROR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.expressFallback, error);
+                this.forwardSafeDiagnostic(diagnostic);
+                // Kliens-safe strip (BFR-FDPAUTHSERVICE-002): az express-error út eddig NYERS error-t küldött
+                // (0 strip) — DyFM-nél belső stack/verzió/issuer, axios-jellegű error-nál akár auth-header is
+                // kimehetett. A strip-szabályok SSOT-ja a DyNTS_ClientSafeError_Util.
+                res.send(client_safe_error_util_1.DyNTS_ClientSafeError_Util.toClientSafe(error));
+            }
+            else {
+                const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-EXPRESS-MISSING-ERROR', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.expressFallback);
+                this.forwardSafeDiagnostic(diagnostic);
+            }
+        }
+        catch (error) {
+            const diagnostic = this.reportSafeDiagnostic('DYNTS-AS0-EXPRESS-MULTILEVEL', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.expressFallback, error);
+            this.forwardSafeDiagnostic(diagnostic);
+        }
+    }
+    /**
+     *
+     */
+    async mountSecureRoutes() {
+        try {
+            if (this.fnLogs && this.deepLog)
+                fsm_dynamo_1.DyFM_Log.log('\nfn:. mountSecureRoutes');
+            if (!this.secureExpress) {
+                throw new Error('secureExpress was not initialized. ' +
+                    'Secure routes require getCertificationSettings and httpsPort, and cert files must exist.' +
+                    '\n\nYou need to set security to secure or both in any route and set httpsPort in getPortSettings.' +
+                    '\n\nYou need to set cert files in getCertificationSettings.');
+            }
+            this.secureExpress.use((error, req, res, next) => this.expressErrorHandling(error, req, res, next));
+            await fsm_dynamo_1.DyFM_Array.asyncForEach(this._routingModules, async (module) => {
+                if (module.security !== route_security_enum_1.DyNTS_RouteSecurity.open) {
+                    if (this.logSetup) {
+                        fsm_dynamo_1.DyFM_Log.log(`route mount (secure): ${module.route}`);
+                    }
+                    const existingRoutes = this._routingModules.filter((mod) => mod.route === module.route);
+                    if (1 < existingRoutes.length) {
+                        const error = new Error(`ROUTE DUPLICATION: ${module.route}`);
+                        /* const errorStack: string[] = error.stack.split('\n');
+          
+                        errorStack.splice(1, 4);
+                        error.stack = errorStack.join('\n'); */
+                        error.stack = module.stackLocation;
+                        this.reportSafeDiagnostic('DYNTS-AS0-SECURE-ROUTE-DUPLICATION', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.routing, error);
+                        throw new fsm_dynamo_1.DyFM_Error({
+                            ...this._getDefaultErrorSettings('mountSecureRoutes', error),
+                            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-MSR1`,
+                            message: `ROUTE DUPLICATION: ${module.route}`,
+                        });
+                    }
+                    this.secureExpress.use(module.route, module.secureRouter);
+                }
+            });
+        }
+        catch (error) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                ...this._getDefaultErrorSettings('mountSecureRoutes', error),
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-MSR0`,
+            });
+        }
+    }
+    /**
+     *
+     */
+    async mountOpenRoutes() {
+        try {
+            if (this.fnLogs && this.deepLog)
+                fsm_dynamo_1.DyFM_Log.log('\nfn:. mountOpenRoutes');
+            if (!this.openExpress) {
+                throw new Error('openExpress was not initialized. Open routes require getOpenExpress and httpPort.' +
+                    '\n\nYou need to set security to open or both in any route and set httpPort in getPortSettings.');
+            }
+            this.openExpress.use((error, req, res, next) => this.expressErrorHandling(error, req, res, next));
+            await fsm_dynamo_1.DyFM_Array.asyncForEach(this._routingModules, async (module) => {
+                if (module.security !== route_security_enum_1.DyNTS_RouteSecurity.secure) {
+                    if (this.logSetup) {
+                        fsm_dynamo_1.DyFM_Log.log(`route mount (open): ${module.route}`);
+                    }
+                    const existingRoutes = this._routingModules.filter((mod) => mod.route === module.route);
+                    if (1 < existingRoutes.length) {
+                        const error = new Error(`ROUTE DUPLICATION: ${module.route}`);
+                        /* const errorStack: string[] = error.stack.split('\n');
+            
+                        errorStack.splice(1, 4);
+                        error.stack = errorStack.join('\n'); */
+                        error.stack = module.stackLocation;
+                        this.reportSafeDiagnostic('DYNTS-AS0-OPEN-ROUTE-DUPLICATION', safe_diagnostic_stage_type_enum_1.DyNTS_SafeDiagnosticStage_Type.routing, error);
+                        throw new fsm_dynamo_1.DyFM_Error({
+                            ...this._getDefaultErrorSettings('mountOpenRoutes', error),
+                            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-MOR1`,
+                            message: `ROUTE DUPLICATION: ${module.route}`,
+                        });
+                    }
+                    this.openExpress.use(module.route, module.openRouter);
+                }
+            });
+        }
+        catch (error) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                ...this._getDefaultErrorSettings('mountOpenRoutes', error),
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|DyNTS-AS0-MOR0`,
+            });
+        }
+    }
+    /**
+     * FR-041 — CORS middleware. Echoes a matching `Access-Control-Allow-Origin`
+     * for any request whose Origin header is in `getCorsSettings().allowedOrigins`,
+     * adds the canonical `Access-Control-*` companion headers, and short-circuits
+     * the OPTIONS preflight with a 204.
+     *
+     * No-op when the subclass does NOT override `getCorsSettings()` — preserves
+     * back-compat for apps that have always been same-origin and never needed
+     * CORS (the typical pre-FR-041 case).
+     *
+     * Why hand-rolled instead of the `cors` npm package:
+     *  - ~30 lines, zero new dependency.
+     *  - Full control over Vary/credentials/preflight semantics.
+     *  - Aligns with FDP "no unnecessary deps" philosophy.
+     */
+    /**
+     * BFR-011 / SEC-R2-8 — security response-headerek mountolása (a `mountCors` tükörképe).
+     * A `DyNTS_global_settings.securityHeaders` alapján (default-ON) minden válaszra ráteszi a
+     * biztonsági headereket + eltávolítja az `x-powered-by`-t. A CORS-mount ELŐTT hívandó, hogy az
+     * OPTIONS preflight-válaszok (amiket a mountCors 204-gyel rövidre zár) is megkapják.
+     */
+    mountSecurityHeaders(express) {
+        const settings = global_settings_const_1.DyNTS_global_settings.securityHeaders;
+        if (!settings || !settings.enabled) {
+            return;
+        }
+        if (settings.removePoweredBy !== false) {
+            express.disable('x-powered-by');
+        }
+        express.use((0, security_headers_util_1.DyNTS_createSecurityHeadersMiddleware)(settings, (0, get_environment_settings_util_1.DyNTS_getEnvironment_settings)().environment));
+    }
+    /**
+     * FR-292 — a deployolt app-verziot minden valaszra rateszi (`X-App-Version`), hogy a
+     * bongeszoben NYITVA HAGYOTT SPA eszrevegye, ha kozben ujabb kliens-build ment ki.
+     *
+     * Nem polling: a jelzes a MAR MENO API-hivasokon utazik. Az `enabled` default TRUE — egy
+     * informativ response-header, ami se PII-t, se belso reszletet nem szivarogtat, viszont
+     * enelkul minden app kulon-kulon epitene ugyanezt.
+     */
+    mountAppVersionHeader(express) {
+        const settings = global_settings_const_1.DyNTS_global_settings.appVersionHeader;
+        if (settings?.enabled === false) {
+            return;
+        }
+        express.use((0, app_version_header_util_1.DyNTS_createAppVersionHeaderMiddleware)(() => global_settings_const_1.DyNTS_global_settings.systemVersion, settings?.headerName));
+    }
+    /** Mounts opt-in correlation and aggregate metrics before load shedding and every API route. */
+    mountRequestTelemetry(express) {
+        const settings = this.getRequestTelemetrySettings?.();
+        if (settings?.enabled !== true) {
+            return;
+        }
+        const telemetry = request_telemetry_control_service_1.DyNTS_RequestTelemetry_ControlService.getInstance();
+        telemetry.configure(settings);
+        express.use(telemetry.createMiddleware());
+    }
+    mountCors(express) {
+        const settings = this.getCorsSettings?.();
+        if (!settings) {
+            return;
+        }
+        const allowCreds = settings.allowCredentials !== false;
+        const methods = settings.allowedMethods ?? [
+            'GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS',
+        ];
+        const headers = settings.allowedHeaders ?? [
+            'Authorization', 'Content-Type', 'X-Admin-Key', 'X-Requested-With',
+        ];
+        const exposed = settings.exposedHeaders ?? [
+            'Content-Length', 'Content-Type',
+        ];
+        const maxAge = settings.maxAgeSeconds ?? 86400;
+        const isAllowed = (origin) => {
+            if (settings.allowedOrigins === '*')
+                return true;
+            if (typeof settings.allowedOrigins === 'function') {
+                return settings.allowedOrigins(origin);
+            }
+            return settings.allowedOrigins.includes(origin);
+        };
+        express.use((req, res, next) => {
+            const origin = req.headers.origin;
+            if (origin && isAllowed(origin)) {
+                // Echo the matching origin (NOT wildcard) because credentials require it.
+                res.setHeader('Access-Control-Allow-Origin', origin);
+                if (allowCreds) {
+                    res.setHeader('Access-Control-Allow-Credentials', 'true');
+                }
+                res.setHeader('Access-Control-Allow-Methods', methods.join(', '));
+                res.setHeader('Access-Control-Allow-Headers', headers.join(', '));
+                res.setHeader('Access-Control-Expose-Headers', exposed.join(', '));
+                res.setHeader('Access-Control-Max-Age', String(maxAge));
+                res.setHeader('Vary', 'Origin');
+            }
+            if (req.method === 'OPTIONS') {
+                res.status(204).end();
+                return;
+            }
+            next();
+        });
+    }
+    /**
+     * Generikus, auth-agnosztikus extension-point orchestrator. A `registerCustomMiddleware`
+     * hookot hívja (ha a subclass override-olja) minden AKTÍV Express instance-ra
+     * (open + secure), az API route-ok UTÁN, de a SPA static catch-all (`app.get('*')`)
+     * ELŐTT — ez az EGYETLEN korrekt pont egy sub-path middleware-hez (pl. reverse-proxy),
+     * mert a catch-all minden utána mountolt route-ot elnyel. No-op ha nincs override (back-compat).
+     */
+    async mountCustomMiddleware() {
+        if (!this.registerCustomMiddleware) {
+            return;
+        }
+        if (this.openExpress) {
+            await this.registerCustomMiddleware(this.openExpress, route_security_enum_1.DyNTS_RouteSecurity.open);
+        }
+        if (this.secureExpress) {
+            await this.registerCustomMiddleware(this.secureExpress, route_security_enum_1.DyNTS_RouteSecurity.secure);
+        }
+        if (this.logSetup) {
+            fsm_dynamo_1.DyFM_Log.log('\nCustom middleware registered (pre-static).');
+        }
+    }
+    /**
+     * Ha getStaticClientSettings() visszaad beállításokat, a client static fájlok a '/' alatt
+     * lesznek kiszolgálva (API route-ok után). SPA fallback opcionális (fallbackPath).
+     * Asset cache (assetCacheMaxAge, assetCacheImmutable) és fallback cache (fallbackCacheMaxAge)
+     * opcionálisak; ha nincs megadva fallbackCacheMaxAge, DyNTS_defaultFallbackCacheMaxAge (0) marad.
+     */
+    async mountStaticClient() {
+        const settings = this.getStaticClientSettings?.();
+        if (!settings) {
+            return;
+        }
+        const absoluteRoot = Path.isAbsolute(settings.root)
+            ? settings.root
+            : Path.resolve(process.cwd(), settings.root);
+        const hasAssetCache = settings.assetCacheMaxAge !== undefined || settings.assetCacheImmutable === true;
+        const staticOptions = hasAssetCache && settings.assetCacheMaxAge !== undefined
+            ? {
+                setHeaders: (res, filePath) => {
+                    // A HTML entry-fájlok (index.html) no-cache-t kapnak, a hash-elt asset-ek
+                    // immutable long-cache-t — lásd DyNTS_resolveStaticCacheControlHeader (served-stale-index fix).
+                    res.setHeader('Cache-Control', (0, static_cache_control_util_1.DyNTS_resolveStaticCacheControlHeader)({
+                        filePath: filePath,
+                        assetCacheMaxAge: settings.assetCacheMaxAge,
+                        assetCacheImmutable: settings.assetCacheImmutable === true,
+                    }));
+                },
+            }
+            : undefined;
+        const staticMiddleware = staticOptions
+            ? Express.static(absoluteRoot, staticOptions)
+            : Express.static(absoluteRoot);
+        const fallbackMaxAge = settings.fallbackCacheMaxAge ?? default_fallback_cache_max_age_const_1.DyNTS_defaultFallbackCacheMaxAge;
+        // API-namespace guard (BFR-DYNAMOBUILDER-001): a catch-all fallback NE fedje az API-prefixeket —
+        // egy ismeretlen `GET /api/...` 404 JSON-t kapjon, ne megtévesztő `200 + index.html`-t.
+        // Konfigurálható (fallbackExcludePrefixes); default a bevett FDP namespace-pár.
+        const excludePrefixes = settings.fallbackExcludePrefixes ?? ['/api', '/auth-api'];
+        const isApiNamespacePath = (path) => excludePrefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+        if (this.openExpress) {
+            this.openExpress.use('/', staticMiddleware);
+            if (settings.fallbackPath) {
+                this.openExpress.get('*', (req, res) => {
+                    if (isApiNamespacePath(req.path)) {
+                        res.status(404).send({ message: `Unknown API endpoint: ${req.path}` });
+                        return;
+                    }
+                    res.setHeader('Cache-Control', `max-age=${fallbackMaxAge}`);
+                    res.sendFile(settings.fallbackPath, { root: absoluteRoot });
+                });
+            }
+            else {
+                this.openExpress.get('*', (req, res) => {
+                    if (isApiNamespacePath(req.path)) {
+                        res.status(404).send({ message: `Unknown API endpoint: ${req.path}` });
+                        return;
+                    }
+                    res.status(404).type('html').send(default_not_found_page_const_1.DyNTS_defaultNotFoundPageHtml);
+                });
+            }
+        }
+        if (this.secureExpress) {
+            this.secureExpress.use('/', staticMiddleware);
+            if (settings.fallbackPath) {
+                this.secureExpress.get('*', (req, res) => {
+                    if (isApiNamespacePath(req.path)) {
+                        res.status(404).send({ message: `Unknown API endpoint: ${req.path}` });
+                        return;
+                    }
+                    res.setHeader('Cache-Control', `max-age=${fallbackMaxAge}`);
+                    res.sendFile(settings.fallbackPath, { root: absoluteRoot });
+                });
+            }
+            else {
+                this.secureExpress.get('*', (req, res) => {
+                    if (isApiNamespacePath(req.path)) {
+                        res.status(404).send({ message: `Unknown API endpoint: ${req.path}` });
+                        return;
+                    }
+                    res.status(404).type('html').send(default_not_found_page_const_1.DyNTS_defaultNotFoundPageHtml);
+                });
+            }
+        }
+        if (this.logSetup) {
+            fsm_dynamo_1.DyFM_Log.log(`\nStatic client mounted at / (root: ${absoluteRoot})`);
+        }
+    }
+    /**
+     *
+     */
+    setSecurity() {
+        if (this.fnLogs && this.deepLog)
+            fsm_dynamo_1.DyFM_Log.log('\nfn:. setSecurity');
+        this._routingModules.forEach((module) => {
+            if (!module.security) {
+                fsm_dynamo_1.DyFM_Log.warn(`RoutingModule security is not set for ${module.route}\n`);
+            }
+            else if (!this._security) {
+                this._security = module.security;
+            }
+            else if (this._security !== module.security) {
+                this._security = route_security_enum_1.DyNTS_RouteSecurity.both;
+            }
+        });
+        if (!this._security) {
+            let msg = `Could not set security for the server! (${this.security})`;
+            msg += '\n  RoutingModules:';
+            this._routingModules.forEach((module) => {
+                msg += `\n    ${module.route} (security: ${module.security})`;
+            });
+            if (this._routingModules.length === 0) {
+                msg += '\n    - no RoutingModule found -\n';
+            }
+            fsm_dynamo_1.DyFM_Log.warn(msg);
+        }
+    }
+    _getDefaultErrorSettings(fnName, error) {
+        return {
+            status: error?.___status ?? 500,
+            message: error?.message ??
+                error?._message ??
+                `${fnName} was UNSUCCESSFUL (NTS)`,
+            userMessage: error?.__userMessage ?? this.defaultErrorUserMsg,
+            addECToUserMsg: !error?.__userMessage,
+            issuerService: `${this?.constructor?.name}-DyNTS_App`,
+            level: fsm_dynamo_1.DyFM_ErrorLevel.fatal,
+            error: error,
+            systemVersion: global_settings_const_1.DyNTS_global_settings.systemVersion,
+        };
+    }
+}
+exports.DyNTS_App = DyNTS_App;
 //# sourceMappingURL=app.server.js.map