@futdevpro/nts-dynamo 1.15.157 → 1.15.163

package/src/_collections/archive-service-registry.const.ts

@@ -1,21 +0,0 @@
-import type { DyFM_DataModel_Params, DyFM_Metadata } from '@futdevpro/fsm-dynamo';
-
-import type { DyNTS_ArchiveDataService } from '../_services/base/archive-data.service';
-
-/**
- * Az archive-service osztály runtime-registry-je (BFR-AM-012 — körkörös-import feloldás).
- *
- * A `DyNTS_DataService.getArchiveDataService()` default-implementációja a
- * `DyNTS_ArchiveDataService`-t példányosítaná — de az `archive-data.service` maga a
- * `data.service`-ből örököl, így a KÖZVETLEN value-import futásidejű require-ciklust okozna
- * („Class extends value undefined"). A regisztráció fordítva folyik: az `archive-data.service`
- * modul-inicializáláskor IDE teszi be a saját konstruktorát (a registry-nek nincs runtime-importja
- * → nincs ciklus), a base data-service pedig innen olvassa.
- */
-export const DyNTS_archiveServiceRegistry: {
-  ArchiveDataService?: new <T extends DyFM_Metadata>(
-    data: T,
-    dataParams: DyFM_DataModel_Params<T>,
-    issuer: string
-  ) => DyNTS_ArchiveDataService<T>;
-} = {};

package/src/_collections/archive.util.spec.ts

@@ -1,57 +0,0 @@
-import { DyNTS_getArchivedDBName, DyNTS_archiveSuffix } from './archive.util';
-
-describe('| DyNTS_getArchivedDBName', () => {
-  it('| should append the archive suffix to the database name', () => {
-    const dbName = 'TestDB';
-    const expectedArchivedName = `${dbName}_${DyNTS_archiveSuffix}`;
-    expect(DyNTS_getArchivedDBName(dbName)).toBe(expectedArchivedName);
-  });
-
-  it('| should return only the archive suffix when the database name is an empty string', () => {
-    const dbName = '';
-    const expectedArchivedName = `_${DyNTS_archiveSuffix}`;
-    expect(DyNTS_getArchivedDBName(dbName)).toBe(expectedArchivedName);
-  });
-
-  it('| should handle database names with special characters', () => {
-    const dbName = 'Test_DB-123!';
-    const expectedArchivedName = `${dbName}_${DyNTS_archiveSuffix}`;
-    expect(DyNTS_getArchivedDBName(dbName)).toBe(expectedArchivedName);
-  });
-
-  it('| should handle database names with spaces', () => {
-    const dbName = 'Test DB Name';
-    const expectedArchivedName = `${dbName}_${DyNTS_archiveSuffix}`;
-    expect(DyNTS_getArchivedDBName(dbName)).toBe(expectedArchivedName);
-  });
-
-  it('| should handle database names with numbers', () => {
-    const dbName = 'DB123';
-    const expectedArchivedName = `${dbName}_${DyNTS_archiveSuffix}`;
-    expect(DyNTS_getArchivedDBName(dbName)).toBe(expectedArchivedName);
-  });
-
-  it('| should handle very long database names', () => {
-    const dbName = 'A'.repeat(100);
-    const expectedArchivedName = `${dbName}_${DyNTS_archiveSuffix}`;
-    expect(DyNTS_getArchivedDBName(dbName)).toBe(expectedArchivedName);
-  });
-
-  it('| should use the correct archive suffix constant', () => {
-    expect(DyNTS_archiveSuffix).toBe('archived');
-    const dbName = 'TestDB';
-    const result = DyNTS_getArchivedDBName(dbName);
-    expect(result).toContain('archived');
-    expect(result).toBe('TestDB_archived');
-  });
-});
-
-describe('| DyNTS_archiveSuffix', () => {
-  it('| should have the correct value', () => {
-    expect(DyNTS_archiveSuffix).toBe('archived');
-  });
-
-  it('| should be a string', () => {
-    expect(typeof DyNTS_archiveSuffix).toBe('string');
-  });
-});

package/src/_collections/archive.util.ts

@@ -1,18 +0,0 @@
-
-
-/** Suffix appended to database names when archived. */
-export const DyNTS_archiveSuffix = 'archived';
-
-/**
- * Create the archive database name for a given base database.
- *
- * @example
- * ```ts
- * const name = DyNTS_getArchivedDBName('users');
- * // => 'users_archived'
- * ```
- */
-export function DyNTS_getArchivedDBName(dbName: string): string {
-  return `${dbName}_${DyNTS_archiveSuffix}`;
-}
-

package/src/_collections/atlas-default-db-options.const.ts

@@ -1,10 +0,0 @@
-
-import { second } from '@futdevpro/fsm-dynamo';
-import { ConnectOptions } from 'mongoose';
-
-
-export const DyNTS_atlasDefaultDbOptions: ConnectOptions = {
-  directConnection: false,
-  serverSelectionTimeoutMS: 5 * second,
-  connectTimeoutMS: 10 * second,
-}

package/src/_collections/client-safe-error.util.spec.ts

@@ -1,151 +0,0 @@
-import { DyFM_EnvironmentFlag, DyFM_Error } from '@futdevpro/fsm-dynamo';
-
-import { DyNTS_ClientSafeError_Util } from './client-safe-error.util';
-import { DyNTS_global_settings } from './global-settings.const';
-
-// A kliens-safe error-strip SSOT tesztjei (BFR-FDPAUTHSERVICE-002) — a 3 strip-szabály +
-// a nem-DyFM fail-safe ág. A DyFM_Error mező-neveit a valós instansán verifikáljuk (no-guessing).
-describe('| DyNTS_ClientSafeError_Util', (): void => {
-
-  /** Egy teljes-mezős DyFM_Error a strip-tesztekhez (a leak-vektor mezőkkel feltöltve). */
-  function buildRichError(): DyFM_Error {
-    const error: DyFM_Error = new DyFM_Error({
-      message: 'internal reason',
-      userMessage: 'user facing message',
-      errorCode: 'DyNTS-TEST-CSE0',
-      error: new Error('inner cause'),
-      additionalContent: { userId: 'u1' },
-      confidentialContent: { secret: 's3cr3t' },
-    });
-
-    return error;
-  }
-
-  afterEach((): void => {
-    // a prod-teszt env-átállítását visszaállítjuk (a global-settings megosztott singleton)
-    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.local;
-  });
-
-  it('| MINDIG strip-eli a leak-vektor mezőket (nem-prod env-ben is)', (): void => {
-    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.local;
-    const error: DyFM_Error = buildRichError();
-
-    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(error) as Record<string, unknown>;
-
-    expect(safe['__localStack']).toBeUndefined();
-    expect(safe['stack']).toBeUndefined();
-    expect(safe['___systemVersion']).toBeUndefined();
-    expect(safe['___issuer']).toBeUndefined();
-    expect(safe['___issuerSystem']).toBeUndefined();
-    expect(safe['___issuerService']).toBeUndefined();
-    expect(safe['confidentialContent']).toBeUndefined();
-    expect(safe['error']).toBeUndefined();
-    expect(safe['errors']).toBeUndefined();
-  });
-
-  it('| MEGTARTJA a kliens-fogyasztott mező-alakot (_message, _errorCodes, __userMessage)', (): void => {
-    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.local;
-    const error: DyFM_Error = buildRichError();
-
-    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(error) as Record<string, unknown>;
-
-    // QA2-005: a `_message` ALAKJA marad, de a TARTALMA a user-safe `__userMessage` —
-    // a technikai 'internal reason' (belső URL / nyers DB-hiba osztály) nem megy ki
-    expect(safe['_message']).toBe('user facing message');
-    expect(safe['__userMessage']).toBe('user facing message');
-    expect(Array.isArray(safe['_errorCodes'])).toBeTrue();
-    expect((safe['_errorCodes'] as string[]).join(',')).toContain('DyNTS-TEST-CSE0');
-  });
-
-  it('| QA2-005: a technikai _message / _messages NEM szivárog ki (test-env-ben sem)', (): void => {
-    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.test;
-    const error: DyFM_Error = new DyFM_Error({
-      message: 'API call "registerAccount" failed on the other end!\nurl: http://auth-service:39005/api/account/register' +
-        '\nerror response found: E11000 duplicate key error collection',
-      userMessage: 'Registration failed!',
-      errorCode: 'DyNTS-TEST-CSE1',
-    });
-
-    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(error) as Record<string, unknown>;
-    const serialized: string = JSON.stringify(safe);
-
-    expect(safe['_message']).toBe('Registration failed!');
-    expect(safe['_messages']).toBeUndefined();
-    expect(serialized).not.toContain('auth-service:39005');
-    expect(serialized).not.toContain('E11000');
-  });
-
-  it('| QA2-005: __userMessage nélkül a _message generikus szövegre cserélődik (nem a technikai)', (): void => {
-    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.test;
-    const error: DyFM_Error = new DyFM_Error({
-      message: 'raw internal detail: http://auth-service:39005/api',
-      errorCode: 'DyNTS-TEST-CSE2',
-    });
-    // a konstruktor default-userMessage viselkedésétől függetlenül: a technikai szöveg nem mehet ki
-    (error as unknown as Record<string, unknown>)['__userMessage'] = undefined;
-
-    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(error) as Record<string, unknown>;
-
-    expect(typeof safe['_message']).toBe('string');
-    expect(safe['_message'] as string).not.toContain('auth-service:39005');
-    expect((safe['_message'] as string).length).toBeGreaterThan(0);
-  });
-
-  it('| QA2-005: az additionalContent.requestDebug env-FÜGGETLENÜL strip-elve, a többi mező marad (non-prod)', (): void => {
-    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.test;
-    const error: DyFM_Error = new DyFM_Error({
-      message: 'internal reason',
-      userMessage: 'user facing message',
-      errorCode: 'DyNTS-TEST-CSE3',
-      additionalContent: {
-        userId: 'u1',
-        requestDebug: { headerKeys: ['authorization', 'cookie'], remoteAddress: '172.18.0.5' },
-      },
-    });
-
-    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(error) as Record<string, unknown>;
-    const additionalContent: Record<string, unknown> = safe['additionalContent'] as Record<string, unknown>;
-
-    expect(additionalContent).toBeDefined();
-    expect(additionalContent['userId']).toBe('u1');
-    expect(additionalContent['requestDebug']).toBeUndefined();
-  });
-
-  it('| nem-prod env: az additionalContent (diagnosztikai snapshot) MARAD', (): void => {
-    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.local;
-    const error: DyFM_Error = buildRichError();
-
-    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(error) as Record<string, unknown>;
-
-    expect(safe['additionalContent']).toEqual({ userId: 'u1' });
-  });
-
-  it('| prod env: az additionalContent IS strip-elve', (): void => {
-    DyNTS_global_settings.env_settings.environment = DyFM_EnvironmentFlag.prod;
-    const error: DyFM_Error = buildRichError();
-
-    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(error) as Record<string, unknown>;
-
-    expect(safe['additionalContent']).toBeUndefined();
-    // a mindig-strip lista prod-ban is érvényes
-    expect(safe['__localStack']).toBeUndefined();
-    expect(safe['stack']).toBeUndefined();
-  });
-
-  it('| nem-DyFM object-error: fail-safe minimál { message } shape (axios-config nem szivárog)', (): void => {
-    const axiosLike: { message: string; config: { headers: { authorization: string } } } = {
-      message: 'Request failed with status code 401',
-      config: { headers: { authorization: 'Bearer LEAK' } },
-    };
-
-    const safe: Record<string, unknown> = DyNTS_ClientSafeError_Util.toClientSafe(axiosLike) as Record<string, unknown>;
-
-    expect(safe['message']).toBe('Request failed with status code 401');
-    expect(safe['config']).toBeUndefined();
-  });
-
-  it('| nem-object error (string/undefined): változatlanul átmegy', (): void => {
-    expect(DyNTS_ClientSafeError_Util.toClientSafe('plain string')).toBe('plain string');
-    expect(DyNTS_ClientSafeError_Util.toClientSafe(undefined)).toBeUndefined();
-  });
-});

package/src/_collections/client-safe-error.util.ts

@@ -1,107 +0,0 @@
-import { DyFM_EnvironmentFlag, DyFM_Error } from '@futdevpro/fsm-dynamo';
-
-import { DyNTS_global_settings } from './global-settings.const';
-
-/**
- * Kliens-safe error-body SSOT (BFR-FDPAUTHSERVICE-002 — error-response info-disclosure fix).
- *
- * A DyFM_Error HTTP-response-ba szerializálásakor a belső diagnosztikai mezők NEM mehetnek ki a
- * kliensre — env-FÜGGETLENÜL (a korábbi prod-only strip a test/dev környezetben TELJES leaket
- * hagyott: `__localStack` stack-trace, `___systemVersion`, issuer-lánc). A strip-szabályok:
- *
- *   1. MINDIG ki (env-független, kliens sehol nem fogyasztja → 0 regresszió):
- *      `__localStack`, `stack`, `___systemVersion`, `___issuer`, `___issuerSystem`,
- *      `___issuerService`, `confidentialContent`, `error`, `errors` (a nyers belső error-lánc
- *      stack-eket hordoz), `_messages` (QA2-005: technikai message-lánc — belső URL-ek, DB-hibák).
- *   2. CSAK prod-ban ki: `additionalContent` — test/dev környezetben a diagnosztikai state-snapshot
- *      szándékosan kimegy (a hibafelület-debug erre épül), prod-ban nem. KIVÉTEL (QA2-005):
- *      az `additionalContent.requestDebug` (FR-071 header-lista/belső-IP snapshot) env-FÜGGETLENÜL
- *      strip-elve — csak az error-store-ba perzisztálódik.
- *   3. MARAD (kliens-kompatibilitás — a FDP-kliens error-interceptorok fogyasztják):
- *      `_message`, `_errorCodes`, `__userMessage`, `___status`, `level`. QA2-005: a `_message`
- *      TARTALMA a user-safe `__userMessage`-re cserélve (a technikai üzenet — belső BE-BE URL,
- *      nyers Mongo E11000 — nem hagyhatja el a szervert; a mező-ALAK a kliens-kompat miatt marad).
- *
- * NEM-DyFM error (plain Error / axios-error / bármi más): minimál `{ message }` shape — a plain
- * Error eddig is üres `{}`-ként szerializálódott (non-enumerable mezők), az axios-jellegű error-ok
- * viszont enumerable config/request mezőkben auth-headert is szivárogtathatnak → fail-safe minimál.
- *
- * ⚠️ A metódus MUTÁLJA a kapott DyFM_Error-t (a meglévő endpoint-strip precedensét követve) —
- * a hívási pont a response-küldés, ahol az error-objektum életciklusa véget ér.
- */
-export class DyNTS_ClientSafeError_Util {
-
-  /** A MINDIG strip-elendő DyFM-mezők (env-független — kliens-fogyasztás nélküli leak-vektorok). */
-  private static readonly alwaysStripKeys: string[] = [
-    '__localStack',
-    'stack',
-    '___systemVersion',
-    '___issuer',
-    '___issuerSystem',
-    '___issuerService',
-    'confidentialContent',
-    'error',
-    'errors',
-    // QA2-005 (dynamo-builder MP-23 QA-gate, 2026-07-18): a technikai message-LÁNC — belső BE-BE
-    // URL-eket (pl. http://auth-service:39005/...), nyers DB-driver-hibákat (Mongo E11000) hordoz;
-    // a kliens nem fogyasztja (a display-lánc `__userMessage` → `_message`), az error-store-ban marad.
-    '_messages',
-  ];
-
-  /** QA2-005 — generikus `_message` fallback, ha az errornak nincs `__userMessage`-e. */
-  private static readonly genericClientMessage: string =
-    'An internal error occurred.\nPlease contact the responsible development team.';
-
-  /**
-   * Az error kliens-safe formára hozása a HTTP-response-küldés előtt.
-   * DyFM_Error: in-place strip (1-3. szabályok szerint); nem-DyFM object: minimál `{ message }`.
-   */
-  static toClientSafe(error: unknown): unknown {
-    // DyFM_Error: célzott mező-strip, a kliens-fogyasztott mezők megtartásával
-    if (DyFM_Error.isDyFMError(error)) {
-      const dyError: Record<string, unknown> = error as unknown as Record<string, unknown>;
-
-      for (const key of DyNTS_ClientSafeError_Util.alwaysStripKeys) {
-        delete dyError[key];
-      }
-
-      // ═══════════════════════════════════════════════════════════════════════
-      // QA2-005 — info-disclosure vágás env-FÜGGETLENÜL (test-env-ben SEM mehet ki):
-      //   a) `_message` (technikai üzenet): belső BE-BE URL-t / nyers Mongo-hibát hordozhat →
-      //      a response-ban a user-safe `__userMessage`-dzsel helyettesítjük. A mező ALAKJA
-      //      megmarad (a kliens-interceptorok / `DyFM_extractErrorMessage` fallback-lánca és a
-      //      `_message`-jelenlét-heurisztikák változatlanul működnek); a TELJES technikai üzenet
-      //      az error-store-ban marad (a globalErrorHandler a strip ELŐTT perzisztál).
-      //   b) `additionalContent.requestDebug` (FR-071 request-snapshot: header-kulcs-lista,
-      //      belső IP, params/query): csak az error-store-ba — a response-ból mindig kimarad;
-      //      az additionalContent TÖBBI (app-szintű diagnosztikai) mezője non-prod env-ben marad.
-      // ═══════════════════════════════════════════════════════════════════════
-      const userMessage: unknown = dyError['__userMessage'];
-
-      dyError['_message'] = (typeof userMessage === 'string' && userMessage)
-        ? userMessage
-        : DyNTS_ClientSafeError_Util.genericClientMessage;
-
-      const additionalContent: unknown = dyError['additionalContent'];
-
-      if (additionalContent && typeof additionalContent === 'object') {
-        delete (additionalContent as Record<string, unknown>)['requestDebug'];
-      }
-
-      // prod: a diagnosztikai state-snapshot sem megy ki; test/dev: szándékosan marad (debug-UX)
-      if (DyNTS_global_settings.env_settings.environment === DyFM_EnvironmentFlag.prod) {
-        delete dyError['additionalContent'];
-      }
-
-      return error;
-    }
-
-    // nem-DyFM object-error (plain/axios/egyéb): fail-safe minimál shape — a nyers objektum
-    // enumerable mezői (pl. axios config.headers) szivárogtathatnak
-    if (error && typeof error === 'object') {
-      return { message: (error as Error).message ?? 'Internal server error' };
-    }
-
-    return error;
-  }
-}

package/src/_collections/default-fallback-cache-max-age.const.spec.ts

@@ -1,11 +0,0 @@
-import { DyNTS_defaultFallbackCacheMaxAge } from './default-fallback-cache-max-age.const';
-
-describe('| DyNTS_defaultFallbackCacheMaxAge', () => {
-  it('| should export default fallback cache max-age as 0', () => {
-    expect(DyNTS_defaultFallbackCacheMaxAge).toBe(0);
-  });
-
-  it('| should be a number', () => {
-    expect(typeof DyNTS_defaultFallbackCacheMaxAge).toBe('number');
-  });
-});

package/src/_collections/default-fallback-cache-max-age.const.ts

@@ -1,2 +0,0 @@
-/** SPA fallback (pl. index.html) alapértelmezett cache max-age másodpercben (0 = ne cache-eljük). */
-export const DyNTS_defaultFallbackCacheMaxAge: number = 0;

package/src/_collections/default-not-found-page.const.spec.ts

@@ -1,19 +0,0 @@
-import { DyNTS_defaultNotFoundPageHtml } from './default-not-found-page.const';
-
-describe('| DyNTS_defaultNotFoundPageHtml', () => {
-  it('| should export a non-empty HTML string', () => {
-    expect(typeof DyNTS_defaultNotFoundPageHtml).toBe('string');
-    expect(DyNTS_defaultNotFoundPageHtml.length).toBeGreaterThan(0);
-  });
-
-  it('| should contain DOCTYPE and Page not found', () => {
-    expect(DyNTS_defaultNotFoundPageHtml).toContain('<!DOCTYPE html>');
-    expect(DyNTS_defaultNotFoundPageHtml).toContain('Page not found');
-    expect(DyNTS_defaultNotFoundPageHtml).toContain('</html>');
-  });
-
-  it('| should be valid for 404 response as text/html', () => {
-    expect(DyNTS_defaultNotFoundPageHtml).toContain('lang="en"');
-    expect(DyNTS_defaultNotFoundPageHtml).toContain('<title>');
-  });
-});

package/src/_collections/default-not-found-page.const.ts

@@ -1,22 +0,0 @@
-/**
- * Alapértelmezett "Page not found" (404) HTML, amit a static client default fallbackjaként
- * szolgálunk ki, ha nincs fallbackPath (nem-SPA mód) és a kérés nem egy létező static fájlra mutat.
- */
-export const DyNTS_defaultNotFoundPageHtml: string =
-  '<!DOCTYPE html>\n' +
-  '<html lang="en">\n' +
-  '<head>\n' +
-  '  <meta charset="utf-8">\n' +
-  '  <meta name="viewport" content="width=device-width, initial-scale=1">\n' +
-  '  <title>Page not found</title>\n' +
-  '  <style>\n' +
-  '    body { font-family: system-ui, sans-serif; margin: 2rem; text-align: center; }\n' +
-  '    h1 { font-size: 1.5rem; color: #333; }\n' +
-  '    p { color: #666; }\n' +
-  '  </style>\n' +
-  '</head>\n' +
-  '<body>\n' +
-  '  <h1>Page not found</h1>\n' +
-  '  <p>The requested resource could not be found.</p>\n' +
-  '</body>\n' +
-  '</html>\n';

package/src/_collections/default-socket-path.const.spec.ts

@@ -1,12 +0,0 @@
-import { DyNTS_defaultSocketPath } from './default-socket-path.const';
-
-describe('| DyNTS_defaultSocketPath', () => {
-  it('| should export default socket path as \'/socket\'', () => {
-    expect(DyNTS_defaultSocketPath).toBe('/socket');
-  });
-
-  it('| should be a non-empty string', () => {
-    expect(typeof DyNTS_defaultSocketPath).toBe('string');
-    expect(DyNTS_defaultSocketPath.length).toBeGreaterThan(0);
-  });
-});

package/src/_collections/default-socket-path.const.ts

@@ -1,2 +0,0 @@
-/** Default Socket.IO path, ha a portSettings.socketPath nincs megadva. */
-export const DyNTS_defaultSocketPath: string = '/socket';

package/src/_collections/field-encryption.util.spec.ts

@@ -1,195 +0,0 @@
-import { Schema, model } from 'mongoose';
-
-import { DyFM_DataProperties } from '@futdevpro/fsm-dynamo';
-import { DyFM_Crypto } from '@futdevpro/fsm-dynamo/crypto';
-
-import { DyNTS_FieldEncryption_Util } from './field-encryption.util';
-
-/**
- * AT-REST field-encryption transzform-util tesztjei (AAA). Lefedi: opt-in no-op, create- ÉS
- * update-alakú doc, roundtrip, legacy-plaintext, beágyazott (subObjectParams tömb), immutabilitás,
- * idempotencia, kulcs-hiány.
- */
-describe('| DyNTS_FieldEncryption_Util', () => {
-  const KEY: string = 'db-content-crypt-key-abcdefgh';
-
-  // encrypt:true a `secret` mezőn; a `name` sima; a `steps[]` beágyazott, benne encrypt:true `prompt`.
-  const encProps: DyFM_DataProperties<any> = {
-    name: { key: 'name', type: 'string' },
-    secret: { key: 'secret', type: 'string', encrypt: true },
-    steps: {
-      key: 'steps', type: 'object[]',
-      subObjectParams: {
-        prompt: { key: 'prompt', type: 'string', encrypt: true },
-        label: { key: 'label', type: 'string' },
-      },
-    },
-  } as unknown as DyFM_DataProperties<any>;
-
-  const plainProps: DyFM_DataProperties<any> = {
-    name: { key: 'name', type: 'string' },
-    email: { key: 'email', type: 'string' },
-  } as unknown as DyFM_DataProperties<any>;
-
-  beforeEach(() => { process.env.FDP_CORE_DBCONTENT_CRYPT_KEY = KEY; });
-  afterEach(() => { delete process.env.FDP_CORE_DBCONTENT_CRYPT_KEY; });
-
-  it('| opt-in: encrypt:true mező nélküli modell → NO-OP (ugyanaz a referencia)', () => {
-    const data = { name: 'x', email: 'y' };
-    expect(DyNTS_FieldEncryption_Util.encryptDoc(data, plainProps)).toBe(data);
-    expect(DyNTS_FieldEncryption_Util.decryptDoc(data, plainProps)).toBe(data);
-  });
-
-  it('| CREATE-alak (nincs _id): encrypt:true mezőt envelope-ba teszi, a simát nem bántja', () => {
-    const data: any = { name: 'plain-name', secret: 'top-secret' };
-    const enc: any = DyNTS_FieldEncryption_Util.encryptDoc(data, encProps);
-
-    expect(DyFM_Crypto.isEncryptedDbValue(enc.secret)).toBe(true);
-    expect(enc.name).toBe('plain-name');
-    // immutabilitás: az eredeti NEM változott
-    expect(data.secret).toBe('top-secret');
-  });
-
-  it('| UPDATE-alak (van _id): ugyanúgy titkosít (a modifyData/findByIdAndUpdate útra)', () => {
-    const data: any = { _id: 'abc123', name: 'n', secret: 'updated-secret' };
-    const enc: any = DyNTS_FieldEncryption_Util.encryptDoc(data, encProps);
-
-    expect(enc._id).toBe('abc123');
-    expect(DyFM_Crypto.isEncryptedDbValue(enc.secret)).toBe(true);
-    expect(DyNTS_FieldEncryption_Util.decryptDoc(enc, encProps).secret).toBe('updated-secret');
-  });
-
-  it('| roundtrip: encrypt → decrypt visszaadja az eredetit', () => {
-    const data: any = { name: 'n', secret: 'a hosszú ő/ű prompt' };
-    const enc: any = DyNTS_FieldEncryption_Util.encryptDoc(data, encProps);
-    const dec: any = DyNTS_FieldEncryption_Util.decryptDoc(enc, encProps);
-
-    expect(dec.secret).toBe('a hosszú ő/ű prompt');
-  });
-
-  it('| beágyazott tömb (subObjectParams): a steps[].prompt titkosítva/visszafejtve, label érintetlen', () => {
-    const data: any = { name: 'n', steps: [ { prompt: 'p1', label: 'l1' }, { prompt: 'p2', label: 'l2' } ] };
-    const enc: any = DyNTS_FieldEncryption_Util.encryptDoc(data, encProps);
-
-    expect(DyFM_Crypto.isEncryptedDbValue(enc.steps[0].prompt)).toBe(true);
-    expect(enc.steps[0].label).toBe('l1');
-    expect(data.steps[0].prompt).toBe('p1'); // eredeti nem mutálódott
-
-    const dec: any = DyNTS_FieldEncryption_Util.decryptDoc(enc, encProps);
-    expect(dec.steps[0].prompt).toBe('p1');
-    expect(dec.steps[1].prompt).toBe('p2');
-  });
-
-  it('| decrypt: legacy plaintext (envelope nélkül) VÁLTOZATLAN', () => {
-    const data: any = { name: 'n', secret: 'legacy plaintext, még nem migrált' };
-    const dec: any = DyNTS_FieldEncryption_Util.decryptDoc(data, encProps);
-    expect(dec.secret).toBe('legacy plaintext, még nem migrált');
-  });
-
-  it('| idempotens: már-envelope értéket nem titkosít újra', () => {
-    const enc1: any = DyNTS_FieldEncryption_Util.encryptDoc({ secret: 's' }, encProps);
-    const enc2: any = DyNTS_FieldEncryption_Util.encryptDoc(enc1, encProps);
-    expect(enc2.secret).toBe(enc1.secret);
-  });
-
-  it('| üres/undefined encrypt:true értéket NEM titkosít (a crypto arra dobna)', () => {
-    const enc: any = DyNTS_FieldEncryption_Util.encryptDoc({ name: 'n', secret: '' }, encProps);
-    expect(enc.secret).toBe('');
-  });
-
-  it('| kulcs-hiány + encrypt:true mező → encrypt DOB (fail-loud misconfig)', () => {
-    delete process.env.FDP_CORE_DBCONTENT_CRYPT_KEY;
-    expect(() => DyNTS_FieldEncryption_Util.encryptDoc({ secret: 's' }, encProps)).toThrow();
-  });
-
-  it('| kulcs-hiány READ-en NEM dob (a read ne törjön) → az envelope visszafejtetlen marad', () => {
-    const enc: any = DyNTS_FieldEncryption_Util.encryptDoc({ secret: 's' }, encProps);
-    delete process.env.FDP_CORE_DBCONTENT_CRYPT_KEY;
-    const dec: any = DyNTS_FieldEncryption_Util.decryptDoc(enc, encProps);
-    expect(dec.secret).toBe(enc.secret); // envelope marad, nincs throw
-  });
-
-  // ─── 🔴 MONGOOSE-DOCUMENT (BFR-MASTERPROMPTER-027) ─────────────────────────────────────────
-  //
-  // A regresszio-or SZANDEKOSAN VALODI mongoose-Documenttel dolgozik (nem mockkal): a hiba pont abbol
-  // eredt, hogy egy Document adatai NEM sajat mezok (a `_doc`-ban ulnek), ezert a `{ ...doc }` a belso
-  // burkot masolja. Egy kezzel gyartott mock ezt a jellemzot nem hordozza — vagyis a mock-alapu teszt
-  // AKKOR IS zold maradna, ha a hiba visszakerulne.
-  //
-  // DB-kapcsolat NEM kell: a `new Model({...})` offline is valodi Documentet ad.
-  describe('| mongoose-Document bemenet (BFR-MASTERPROMPTER-027)', () => {
-    const stepSchema: Schema = new Schema({ prompt: String, label: String }, { _id: false });
-    const flowSchema: Schema = new Schema({ name: String, secret: String, steps: [ stepSchema ] });
-    const FlowModel = model('EncUtilSpecFlow', flowSchema);
-
-    function newDocument(): any { // ccap-review-disable-line no-any-type
-      return new FlowModel({
-        name: 'my flow',
-        secret: DyFM_Crypto.encryptDbValue('titok', KEY, 1),
-        steps: [ { prompt: DyFM_Crypto.encryptDbValue('lepes-prompt', KEY, 1), label: 'A' } ],
-      });
-    }
-
-    it('| a visszafejtett eredmeny SIMA objektum — NINCS benne $__ / $isNew / _doc', () => {
-      const doc: any = newDocument(); // ccap-review-disable-line no-any-type
-
-      const result: any = DyNTS_FieldEncryption_Util.decryptDoc(doc, encProps); // ccap-review-disable-line no-any-type
-
-      expect(Object.keys(result)).not.toContain('$__');
-      expect(Object.keys(result)).not.toContain('$isNew');
-      expect(Object.keys(result)).not.toContain('_doc');
-    });
-
-    /** ⚠️ EZ a fazis lenyegi kontroll-assertje: a kliens ezt az `_id`-t nem kapta meg. */
-    it('| az `_id` MEGMARAD (a kliens enelkul nem tud torolni/megnyitni)', () => {
-      const doc: any = newDocument(); // ccap-review-disable-line no-any-type
-
-      const result: any = DyNTS_FieldEncryption_Util.decryptDoc(doc, encProps); // ccap-review-disable-line no-any-type
-
-      expect(result._id).withContext('az _id elveszett a transzform soran').toBeDefined();
-      expect(`${result._id}`).toBe(`${doc._id}`);
-    });
-
-    it('| az adat-mezok es a visszafejtes helyesek Documenten is', () => {
-      const doc: any = newDocument(); // ccap-review-disable-line no-any-type
-
-      const result: any = DyNTS_FieldEncryption_Util.decryptDoc(doc, encProps); // ccap-review-disable-line no-any-type
-
-      expect(result.name).toBe('my flow');
-      expect(result.secret).withContext('a top-level enc-mezo nem fejtodott vissza').toBe('titok');
-      expect(result.steps[0].prompt).withContext('a beagyazott enc-mezo nem fejtodott vissza')
-        .toBe('lepes-prompt');
-      expect(result.steps[0].label).toBe('A');
-    });
-
-    /**
-     * A JSON-korut is merjuk: a hiba VEGSO tunete az volt, hogy a `res.send` a burkot szerializalta.
-     * Ez az assert azt a kimenetet nezi, amit a kliens TENYLEGESEN megkap.
-     */
-    it('| a JSON-szerializalt alak a valodi adatot adja (a kliens ezt kapja)', () => {
-      const doc: any = newDocument(); // ccap-review-disable-line no-any-type
-
-      const serialized: Record<string, unknown> =
-        JSON.parse(JSON.stringify(DyNTS_FieldEncryption_Util.decryptDoc(doc, encProps)));
-
-      expect(serialized['_id']).toBeDefined();
-      expect(serialized['name']).toBe('my flow');
-      expect(Object.keys(serialized)).not.toContain('_doc');
-    });
-
-    it('| Document-TOMB (lista-endpoint alak) minden eleme sima objektum, _id-vel', () => {
-      const list: any[] = [ newDocument(), newDocument() ]; // ccap-review-disable-line no-any-type
-
-      const results: any[] = list.map( // ccap-review-disable-line no-any-type
-        (d: any): any => DyNTS_FieldEncryption_Util.decryptDoc(d, encProps), // ccap-review-disable-line no-any-type
-      );
-
-      results.forEach((r: any): void => { // ccap-review-disable-line no-any-type
-        expect(r._id).toBeDefined();
-        expect(Object.keys(r)).not.toContain('_doc');
-        expect(r.secret).toBe('titok');
-      });
-    });
-  });
-
-});