@futdevpro/nts-dynamo 1.15.192 → 1.15.194

package/build/_collections/dependency-host-guard.util.d.ts

@@ -0,0 +1,46 @@
+/**
+ * BFR-FSMED-008 — NEM-LOKÁLIS dependency-host guard.
+ *
+ * A mért incidens: a Social Media test-környezetben az auth-target `http://0.0.0.0:39005/api` lett.
+ * Ez `local`-ban helyes, `test`/`prod`-ban viszont azt jelenti, hogy a szolgáltatás **önmagához**
+ * próbál csatlakozni — és a hiba csak az ELSŐ tényleges login-kísérletnél derült ki, akkor is egy
+ * általános „server is not available" üzenettel, amiből nem látszott sem a függőség neve, sem az,
+ * hogy a **konfiguráció** a hibás, nem a távoli szerver.
+ *
+ * A guard ezért **konfigurációs hibát** jelez, nem elérhetőségit — és a diagnózishoz szükséges
+ * minden mezőt STRUKTURÁLTAN ad vissza, hogy a hívó ne szövegből parse-oljon.
+ */
+export interface DyNTS_DependencyHostViolation_Interface {
+    /** A függőség neve (pl. az auth-szolgáltatás) — melyik downstream targetről van szó. */
+    dependency: string;
+    /** A ténylegesen konfigurált URL. */
+    targetUrl: string;
+    /** A futó környezet, amiben ez tiltott. */
+    environment: string;
+    /** Az env-var, aminek a helyes értéket hordoznia kellene (ha a fogyasztó megadja). */
+    requiredEnvironmentVariable?: string;
+    /** Konkrét teendő — nem általános tanács. */
+    remediation: string;
+    /** A konkrét ok (hiányzó / lokális / malformed host). */
+    reason: 'missing' | 'malformed' | 'local-host';
+}
+export declare class DyNTS_DependencyHostGuard_Util {
+    /** Lokális hostok — `test`/`prod` környezetben ezek downstream-targetként hibák. */
+    private static readonly localHosts;
+    /** Azok a környezetek, ahol a lokális host TILOS. */
+    private static readonly strictEnvironments;
+    /**
+     * Megvizsgál egy downstream URL-t. `null`, ha rendben van — különben a strukturált sértés.
+     *
+     * ⚠️ `local` (és minden nem-strict) környezetben SOHA nem jelez: ott a `localhost` a helyes érték.
+     */
+    static inspect(params: {
+        dependency: string;
+        targetUrl: string | undefined;
+        environment: string;
+        requiredEnvironmentVariable?: string;
+    }): DyNTS_DependencyHostViolation_Interface | null;
+    /** Ember-olvasható egysoros összefoglaló a naplóhoz / hibaüzenethez. */
+    static describe(violation: DyNTS_DependencyHostViolation_Interface): string;
+}
+//# sourceMappingURL=dependency-host-guard.util.d.ts.map

package/build/_collections/dependency-host-guard.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-host-guard.util.d.ts","sourceRoot":"","sources":["../../src/_collections/dependency-host-guard.util.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uCAAuC;IACtD,wFAAwF;IACxF,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;CAChD;AAED,qBAAa,8BAA8B;IAEzC,oFAAoF;IACpF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAE/B;IAEH,qDAAqD;IACrD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAEvC;IAEH;;;;OAIG;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,2BAA2B,CAAC,EAAE,MAAM,CAAC;KACtC,GAAG,uCAAuC,GAAG,IAAI;IAkDlD,wEAAwE;IACxE,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,uCAAuC,GAAG,MAAM;CAI5E"}

package/build/_collections/dependency-host-guard.util.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_DependencyHostGuard_Util = void 0;
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+class DyNTS_DependencyHostGuard_Util {
+    /** Lokális hostok — `test`/`prod` környezetben ezek downstream-targetként hibák. */
+    static localHosts = new Set([
+        '0.0.0.0', '127.0.0.1', 'localhost', '::1', '[::1]',
+    ]);
+    /** Azok a környezetek, ahol a lokális host TILOS. */
+    static strictEnvironments = new Set([
+        `${fsm_dynamo_1.DyFM_EnvironmentFlag.test}`, `${fsm_dynamo_1.DyFM_EnvironmentFlag.prod}`,
+    ]);
+    /**
+     * Megvizsgál egy downstream URL-t. `null`, ha rendben van — különben a strukturált sértés.
+     *
+     * ⚠️ `local` (és minden nem-strict) környezetben SOHA nem jelez: ott a `localhost` a helyes érték.
+     */
+    static inspect(params) {
+        const { dependency, targetUrl, environment, requiredEnvironmentVariable } = params;
+        if (!DyNTS_DependencyHostGuard_Util.strictEnvironments.has(environment)) {
+            return null;
+        }
+        const base = {
+            dependency: dependency,
+            targetUrl: `${targetUrl ?? ''}`,
+            environment: environment,
+            requiredEnvironmentVariable: requiredEnvironmentVariable,
+        };
+        if (!targetUrl || !`${targetUrl}`.trim().length) {
+            return {
+                ...base,
+                reason: 'missing',
+                remediation: requiredEnvironmentVariable
+                    ? `Set '${requiredEnvironmentVariable}' to the public URL of '${dependency}' and redeploy.`
+                    : `Configure the base URL of '${dependency}' and redeploy.`,
+            };
+        }
+        let hostname;
+        try {
+            hostname = new URL(`${targetUrl}`).hostname.toLowerCase();
+        }
+        catch {
+            return {
+                ...base,
+                reason: 'malformed',
+                remediation: `'${targetUrl}' is not a valid absolute URL. Use the 'https://host[:port]/path' form`
+                    + `${requiredEnvironmentVariable ? ` in '${requiredEnvironmentVariable}'` : ''} and redeploy.`,
+            };
+        }
+        if (DyNTS_DependencyHostGuard_Util.localHosts.has(hostname)) {
+            return {
+                ...base,
+                reason: 'local-host',
+                remediation: `In '${environment}' the '${dependency}' target must NOT be a local host ('${hostname}') — `
+                    + `that makes the service call ITSELF. Point it at the deployed '${dependency}' host`
+                    + `${requiredEnvironmentVariable ? ` via '${requiredEnvironmentVariable}'` : ''} and redeploy.`,
+            };
+        }
+        return null;
+    }
+    /** Ember-olvasható egysoros összefoglaló a naplóhoz / hibaüzenethez. */
+    static describe(violation) {
+        return `Dependency '${violation.dependency}' is misconfigured in '${violation.environment}' `
+            + `(${violation.reason}): '${violation.targetUrl}'. ${violation.remediation}`;
+    }
+}
+exports.DyNTS_DependencyHostGuard_Util = DyNTS_DependencyHostGuard_Util;
+//# sourceMappingURL=dependency-host-guard.util.js.map

package/build/_collections/dependency-host-guard.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-host-guard.util.js","sourceRoot":"","sources":["../../src/_collections/dependency-host-guard.util.ts"],"names":[],"mappings":";;;AAAA,sDAA6D;AA6B7D,MAAa,8BAA8B;IAEzC,oFAAoF;IAC5E,MAAM,CAAU,UAAU,GAAgB,IAAI,GAAG,CAAS;QAChE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO;KACpD,CAAC,CAAC;IAEH,qDAAqD;IAC7C,MAAM,CAAU,kBAAkB,GAAgB,IAAI,GAAG,CAAS;QACxE,GAAG,iCAAoB,CAAC,IAAI,EAAE,EAAE,GAAG,iCAAoB,CAAC,IAAI,EAAE;KAC/D,CAAC,CAAC;IAEH;;;;OAIG;IACH,MAAM,CAAC,OAAO,CAAC,MAKd;QACC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,2BAA2B,EAAE,GAAG,MAAM,CAAC;QAEnF,IAAI,CAAC,8BAA8B,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAA4E;YACpF,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,GAAG,SAAS,IAAI,EAAE,EAAE;YAC/B,WAAW,EAAE,WAAW;YACxB,2BAA2B,EAAE,2BAA2B;SACzD,CAAC;QAEF,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,2BAA2B;oBACtC,CAAC,CAAC,QAAQ,2BAA2B,2BAA2B,UAAU,iBAAiB;oBAC3F,CAAC,CAAC,8BAA8B,UAAU,iBAAiB;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,WAAW;gBACnB,WAAW,EAAE,IAAI,SAAS,wEAAwE;sBAC9F,GAAG,2BAA2B,CAAC,CAAC,CAAC,QAAQ,2BAA2B,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB;aACjG,CAAC;QACJ,CAAC;QAED,IAAI,8BAA8B,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,YAAY;gBACpB,WAAW,EACT,OAAO,WAAW,UAAU,UAAU,uCAAuC,QAAQ,OAAO;sBAC1F,iEAAiE,UAAU,QAAQ;sBACnF,GAAG,2BAA2B,CAAC,CAAC,CAAC,SAAS,2BAA2B,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB;aAClG,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wEAAwE;IACxE,MAAM,CAAC,QAAQ,CAAC,SAAkD;QAChE,OAAO,eAAe,SAAS,CAAC,UAAU,0BAA0B,SAAS,CAAC,WAAW,IAAI;cACzF,IAAI,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,SAAS,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;IAClF,CAAC;;AA5EH,wEA6EC"}

package/build/_collections/global-settings.const.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-settings.const.d.ts","sourceRoot":"","sources":["../../src/_collections/global-settings.const.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AAIxF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,qBAiHnC,CAAC"}
+{"version":3,"file":"global-settings.const.d.ts","sourceRoot":"","sources":["../../src/_collections/global-settings.const.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AAIxF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,qBAmHnC,CAAC"}

package/build/_collections/global-settings.const.js

@@ -24,6 +24,8 @@ exports.DyNTS_global_settings = {
         request: true,
         requestsContent: false,
         responseContent: false,
+        // BFR-MASTERPROMPTER-046 / BFR-CTM-018: alapbol NEM naplozzuk az okot (content-free kontraktus).
+        safeDiagnosticCause: false,
         requestStackLocation: false,
         socket_allEvents: true,
         socket_mainEvents: true,

package/build/_collections/global-settings.const.js.map

@@ -1 +1 @@
-{"version":3,"file":"global-settings.const.js","sourceRoot":"","sources":["../../src/_collections/global-settings.const.ts"],"names":[],"mappings":";;;AAEA,uEAAoE;AAEpE,yFAAsF;AACtF,mFAAgF;AAEhF;;;GAGG;AACU,QAAA,qBAAqB,GAA0B;IAC1D,OAAO,EAAE,MAAM;IACf,aAAa,EAAE,iBAAiB;IAChC,oBAAoB,EAAE,yCAAmB,CAAC,IAAI;IAC9C,qBAAqB,EAAE,2CAAoB,CAAC,IAAI;IAEhD,eAAe,EAAE,EAAE;IACnB,gBAAgB,EAAE,GAAG;IACrB,YAAY,EAAE,IAAA,6DAA6B,GAAE;IAE7C,oCAAoC,EAAE,IAAI;IAC1C,oBAAoB,EAAE,IAAI;IAE1B,YAAY,EAAE;QACZ,gBAAgB,EAAE,KAAK;QAEvB,KAAK,EAAE,KAAK;QAEZ,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,KAAK;QACtB,oBAAoB,EAAE,KAAK;QAE3B,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI;QACvB,mBAAmB,EAAE,KAAK;QAE1B,UAAU,EAAE,IAAI;QAChB,mBAAmB,EAAE,KAAK;QAC1B,mBAAmB,EAAE,KAAK;QAC1B,oBAAoB,EAAE,KAAK;QAC3B,UAAU,EAAE,IAAI;QAEhB,cAAc,EAAE,KAAK;QAErB,YAAY,EAAE,KAAK;QAEnB,aAAa,EAAE;YACb,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,IAAI;SACjB;KACF;IAED,kBAAkB,EAAE,IAAI;IAExB,iFAAiF;IACjF,oFAAoF;IACpF,kEAAkE;IAClE,aAAa,EAAE;QACb,QAAQ,EAAE,KAAK;KAChB;IAED,YAAY,EAAE,IAAI;IAElB,eAAe,EAAE,IAAI;IAErB,aAAa,EAAE,IAAI;IAEnB,kBAAkB,EAAE,IAAI;IAExB,WAAW,EAAE;QACX,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,IAAI;KACpB;IAED,6FAA6F;IAC7F,0FAA0F;IAC1F,+FAA+F;IAC/F,eAAe,EAAE;QACf,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,IAAI;KACtB;IAED,yFAAyF;IACzF,yFAAyF;IACzF,uFAAuF;IACvF,WAAW,EAAE;QACX,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,KAAK;QACrB,oBAAoB,EAAE,EAAE;QACxB,qBAAqB,EAAE,EAAE;QACzB,cAAc,EAAE,EAAE;QAClB,eAAe,EAAE,GAAG;QACpB,kHAAkH;QAClH,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,oBAAoB,EAAE,IAAI;QAC1B,uBAAuB,EAAE,KAAK;QAC9B,sBAAsB,EAAE,CAAC;QACzB,QAAQ,EAAE,GAAG;QACb,WAAW,EAAE,KAAK;QAClB,8FAA8F;QAC9F,eAAe,EAAE,KAAK;QACtB,uBAAuB,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC;KACvE;IACD,+FAA+F;IAC/F,aAAa,EAAE;QACb,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,GAAG;KACrB;IAED,+FAA+F;IAC/F,iGAAiG;IACjG,iGAAiG;IACjG,gGAAgG;IAChG,uBAAuB,EAAE;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,MAAM;QAC7B,sBAAsB,EAAE,EAAE;QAC1B,iBAAiB,EAAE,OAAO;KAC3B;CACF,CAAC"}
+{"version":3,"file":"global-settings.const.js","sourceRoot":"","sources":["../../src/_collections/global-settings.const.ts"],"names":[],"mappings":";;;AAEA,uEAAoE;AAEpE,yFAAsF;AACtF,mFAAgF;AAEhF;;;GAGG;AACU,QAAA,qBAAqB,GAA0B;IAC1D,OAAO,EAAE,MAAM;IACf,aAAa,EAAE,iBAAiB;IAChC,oBAAoB,EAAE,yCAAmB,CAAC,IAAI;IAC9C,qBAAqB,EAAE,2CAAoB,CAAC,IAAI;IAEhD,eAAe,EAAE,EAAE;IACnB,gBAAgB,EAAE,GAAG;IACrB,YAAY,EAAE,IAAA,6DAA6B,GAAE;IAE7C,oCAAoC,EAAE,IAAI;IAC1C,oBAAoB,EAAE,IAAI;IAE1B,YAAY,EAAE;QACZ,gBAAgB,EAAE,KAAK;QAEvB,KAAK,EAAE,KAAK;QAEZ,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,KAAK;QACtB,iGAAiG;QACjG,mBAAmB,EAAE,KAAK;QAC1B,oBAAoB,EAAE,KAAK;QAE3B,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI;QACvB,mBAAmB,EAAE,KAAK;QAE1B,UAAU,EAAE,IAAI;QAChB,mBAAmB,EAAE,KAAK;QAC1B,mBAAmB,EAAE,KAAK;QAC1B,oBAAoB,EAAE,KAAK;QAC3B,UAAU,EAAE,IAAI;QAEhB,cAAc,EAAE,KAAK;QAErB,YAAY,EAAE,KAAK;QAEnB,aAAa,EAAE;YACb,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,IAAI;SACjB;KACF;IAED,kBAAkB,EAAE,IAAI;IAExB,iFAAiF;IACjF,oFAAoF;IACpF,kEAAkE;IAClE,aAAa,EAAE;QACb,QAAQ,EAAE,KAAK;KAChB;IAED,YAAY,EAAE,IAAI;IAElB,eAAe,EAAE,IAAI;IAErB,aAAa,EAAE,IAAI;IAEnB,kBAAkB,EAAE,IAAI;IAExB,WAAW,EAAE;QACX,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,IAAI;KACpB;IAED,6FAA6F;IAC7F,0FAA0F;IAC1F,+FAA+F;IAC/F,eAAe,EAAE;QACf,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,IAAI;KACtB;IAED,yFAAyF;IACzF,yFAAyF;IACzF,uFAAuF;IACvF,WAAW,EAAE;QACX,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,KAAK;QACrB,oBAAoB,EAAE,EAAE;QACxB,qBAAqB,EAAE,EAAE;QACzB,cAAc,EAAE,EAAE;QAClB,eAAe,EAAE,GAAG;QACpB,kHAAkH;QAClH,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,oBAAoB,EAAE,IAAI;QAC1B,uBAAuB,EAAE,KAAK;QAC9B,sBAAsB,EAAE,CAAC;QACzB,QAAQ,EAAE,GAAG;QACb,WAAW,EAAE,KAAK;QAClB,8FAA8F;QAC9F,eAAe,EAAE,KAAK;QACtB,uBAAuB,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC;KACvE;IACD,+FAA+F;IAC/F,aAAa,EAAE;QACb,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,GAAG;KACrB;IAED,+FAA+F;IAC/F,iGAAiG;IACjG,iGAAiG;IACjG,gGAAgG;IAChG,uBAAuB,EAAE;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,MAAM;QAC7B,sBAAsB,EAAE,EAAE;QAC1B,iBAAiB,EAAE,OAAO;KAC3B;CACF,CAAC"}

package/build/_collections/secret-redaction.util.d.ts

@@ -0,0 +1,51 @@
+/**
+ * BFR-OLDLIGHTSITE-005 + BFR-MASTERPROMPTER-046 — VALUE-PATTERN based secret redaction.
+ *
+ * Two measured needs meet here:
+ *
+ *  1. **Connection URIs must never be logged with credentials** (`mongodb://user:secret@host/db`).
+ *     The startup / connection-error paths logged the full `dbUri`, which is a direct secret
+ *     disclosure, and a consumer-side logger config cannot safely work around it.
+ *
+ *  2. **A framework failure must stay diagnosable.** The safe-diagnostic reporter used the raw
+ *     error only to derive a 4-value `causeType` and then dropped it, so a bootstrap failure was
+ *     undiagnosable even in principle — colliding with the `core-error-debuggable` hard rule.
+ *
+ * The resolution is the same util: keep the diagnostic content, remove the credential.
+ *
+ * ⚠️ Deliberately VALUE-PATTERN based, not field-name based: name-based redaction is measurably
+ * leaky (a `key` field with an innocent name, a snake_case variant, or a credential embedded in a
+ * free-text message all slip through). Here we match the SHAPE of the secret wherever it appears —
+ * including inside an error message or a stack trace.
+ */
+export declare class DyNTS_SecretRedaction_Util {
+    /** Ami a maszkolt érték helyére kerül. */
+    private static readonly mask;
+    /**
+     * Connection-URI userinfo maszkolása: `scheme://user:secret@host/db` → `scheme://***@host/db`.
+     * A séma, a host, a port és az adatbázis-név MEGMARAD — ezek a diagnosztika hordozói.
+     * SRV-alak (`mongodb+srv://`) és percent-encode-olt userinfo is kezelt.
+     */
+    static redactConnectionUri(value: string): string;
+    /**
+     * Ismert token-alakok maszkolása szabad szövegben (npm / GitHub / OpenAI-Anthropic / AWS /
+     * Google / Slack / Stripe / Google OAuth client secret), valamint a `key=value` alakú
+     * query-paraméterek, ahol a kulcs titok-jellegű.
+     */
+    static redactKnownTokens(value: string): string;
+    /** A teljes szöveg-szintű redakció (URI userinfo + ismert token-alakok). */
+    static redactText(value: string): string;
+    /**
+     * Egy hiba diagnosztikai alakja NAPLÓZÁSRA — a tartalom megmarad, a credential nem.
+     *
+     * Azért nem a nyers hibát adjuk tovább: a mért fixtúra szerint a nyers ok tartalmazhat teljes
+     * `mongodb://user:secret@host/db` URI-t. Így a bootstrap-bukás oka (üzenet + stack + név)
+     * megmarad a szerver-naplóban, a jelszó viszont nem.
+     */
+    static redactErrorForLog(error: unknown): {
+        name?: string;
+        message: string;
+        stack?: string;
+    } | unknown;
+}
+//# sourceMappingURL=secret-redaction.util.d.ts.map

package/build/_collections/secret-redaction.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redaction.util.d.ts","sourceRoot":"","sources":["../../src/_collections/secret-redaction.util.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,0BAA0B;IAErC,0CAA0C;IAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAiB;IAE7C;;;;OAIG;IACH,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAWjD;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IA+B/C,4EAA4E;IAC5E,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAMxC;;;;;;OAMG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO;CAuBvG"}

package/build/_collections/secret-redaction.util.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_SecretRedaction_Util = void 0;
+/**
+ * BFR-OLDLIGHTSITE-005 + BFR-MASTERPROMPTER-046 — VALUE-PATTERN based secret redaction.
+ *
+ * Two measured needs meet here:
+ *
+ *  1. **Connection URIs must never be logged with credentials** (`mongodb://user:secret@host/db`).
+ *     The startup / connection-error paths logged the full `dbUri`, which is a direct secret
+ *     disclosure, and a consumer-side logger config cannot safely work around it.
+ *
+ *  2. **A framework failure must stay diagnosable.** The safe-diagnostic reporter used the raw
+ *     error only to derive a 4-value `causeType` and then dropped it, so a bootstrap failure was
+ *     undiagnosable even in principle — colliding with the `core-error-debuggable` hard rule.
+ *
+ * The resolution is the same util: keep the diagnostic content, remove the credential.
+ *
+ * ⚠️ Deliberately VALUE-PATTERN based, not field-name based: name-based redaction is measurably
+ * leaky (a `key` field with an innocent name, a snake_case variant, or a credential embedded in a
+ * free-text message all slip through). Here we match the SHAPE of the secret wherever it appears —
+ * including inside an error message or a stack trace.
+ */
+class DyNTS_SecretRedaction_Util {
+    /** Ami a maszkolt érték helyére kerül. */
+    static mask = '***';
+    /**
+     * Connection-URI userinfo maszkolása: `scheme://user:secret@host/db` → `scheme://***@host/db`.
+     * A séma, a host, a port és az adatbázis-név MEGMARAD — ezek a diagnosztika hordozói.
+     * SRV-alak (`mongodb+srv://`) és percent-encode-olt userinfo is kezelt.
+     */
+    static redactConnectionUri(value) {
+        if (typeof value !== 'string' || !value.length) {
+            return value;
+        }
+        return value.replace(/\b([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^\s/@]+)@/g, (_match, scheme) => `${scheme}${DyNTS_SecretRedaction_Util.mask}@`);
+    }
+    /**
+     * Ismert token-alakok maszkolása szabad szövegben (npm / GitHub / OpenAI-Anthropic / AWS /
+     * Google / Slack / Stripe / Google OAuth client secret), valamint a `key=value` alakú
+     * query-paraméterek, ahol a kulcs titok-jellegű.
+     */
+    static redactKnownTokens(value) {
+        if (typeof value !== 'string' || !value.length) {
+            return value;
+        }
+        const patterns = [
+            /\bnpm_[A-Za-z0-9]{36}\b/g,
+            /\bgh[posur]_[A-Za-z0-9]{36,}\b/g,
+            /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g,
+            /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}\b/g,
+            /\bAKIA[0-9A-Z]{16}\b/g,
+            /\bAIza[0-9A-Za-z_-]{35}\b/g,
+            /\bGOCSPX-[A-Za-z0-9_-]{20,}\b/g,
+            /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
+            /\b[sr]k_live_[A-Za-z0-9]{20,}\b/g,
+        ];
+        let redacted = value;
+        for (const pattern of patterns) {
+            redacted = redacted.replace(pattern, DyNTS_SecretRedaction_Util.mask);
+        }
+        // `?token=…` / `&apiKey=…` alakú query-paraméterek értéke
+        redacted = redacted.replace(/([?&](?:[A-Za-z0-9_-]*(?:token|secret|password|passwd|key|passphrase)[A-Za-z0-9_-]*)=)[^&\s]+/gi, (_match, prefix) => `${prefix}${DyNTS_SecretRedaction_Util.mask}`);
+        return redacted;
+    }
+    /** A teljes szöveg-szintű redakció (URI userinfo + ismert token-alakok). */
+    static redactText(value) {
+        return DyNTS_SecretRedaction_Util.redactKnownTokens(DyNTS_SecretRedaction_Util.redactConnectionUri(value));
+    }
+    /**
+     * Egy hiba diagnosztikai alakja NAPLÓZÁSRA — a tartalom megmarad, a credential nem.
+     *
+     * Azért nem a nyers hibát adjuk tovább: a mért fixtúra szerint a nyers ok tartalmazhat teljes
+     * `mongodb://user:secret@host/db` URI-t. Így a bootstrap-bukás oka (üzenet + stack + név)
+     * megmarad a szerver-naplóban, a jelszó viszont nem.
+     */
+    static redactErrorForLog(error) {
+        if (error === null || error === undefined) {
+            return error;
+        }
+        if (typeof error === 'string') {
+            return DyNTS_SecretRedaction_Util.redactText(error);
+        }
+        if (error instanceof Error) {
+            return {
+                name: error.name,
+                message: DyNTS_SecretRedaction_Util.redactText(error.message),
+                stack: error.stack ? DyNTS_SecretRedaction_Util.redactText(error.stack) : undefined,
+            };
+        }
+        try {
+            return JSON.parse(DyNTS_SecretRedaction_Util.redactText(JSON.stringify(error)));
+        }
+        catch {
+            return { message: DyNTS_SecretRedaction_Util.redactText(String(error)) };
+        }
+    }
+}
+exports.DyNTS_SecretRedaction_Util = DyNTS_SecretRedaction_Util;
+//# sourceMappingURL=secret-redaction.util.js.map

package/build/_collections/secret-redaction.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redaction.util.js","sourceRoot":"","sources":["../../src/_collections/secret-redaction.util.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,0BAA0B;IAErC,0CAA0C;IAClC,MAAM,CAAU,IAAI,GAAW,KAAK,CAAC;IAE7C;;;;OAIG;IACH,MAAM,CAAC,mBAAmB,CAAC,KAAa;QACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC,OAAO,CAClB,8CAA8C,EAC9C,CAAC,MAAc,EAAE,MAAc,EAAU,EAAE,CAAC,GAAG,MAAM,GAAG,0BAA0B,CAAC,IAAI,GAAG,CAC3F,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAa;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAa;YACzB,0BAA0B;YAC1B,iCAAiC;YACjC,mCAAmC;YACnC,2CAA2C;YAC3C,uBAAuB;YACvB,4BAA4B;YAC5B,gCAAgC;YAChC,mCAAmC;YACnC,kCAAkC;SACnC,CAAC;QAEF,IAAI,QAAQ,GAAW,KAAK,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC;QAED,0DAA0D;QAC1D,QAAQ,GAAG,QAAQ,CAAC,OAAO,CACzB,iGAAiG,EACjG,CAAC,MAAc,EAAE,MAAc,EAAU,EAAE,CAAC,GAAG,MAAM,GAAG,0BAA0B,CAAC,IAAI,EAAE,CAC1F,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,4EAA4E;IAC5E,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,OAAO,0BAA0B,CAAC,iBAAiB,CACjD,0BAA0B,CAAC,mBAAmB,CAAC,KAAK,CAAC,CACtD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAc;QACrC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,0BAA0B,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO;gBACL,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,0BAA0B,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC7D,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;aACpF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;;AA7FH,gEA8FC"}

package/build/_models/interfaces/global-log-settings.interface.d.ts

@@ -29,6 +29,20 @@ export interface DyNTS_GlobalLog_Settings {
      * this is an application wide default setting for route debug logs
      */
     responseContent?: boolean;
+    /**
+     * BFR-MASTERPROMPTER-046 — log the REDACTED cause of a safe-diagnostic failure to the SERVER log.
+     *
+     * Default: **false** — the `dynts-safe-diagnostic/1` contract (BFR-CTM-018) is content-free by
+     * design, and that default is NOT changed here: a framework failure never emits raw content on
+     * its own. Turning this on is an explicit operator decision for environments where a bootstrap
+     * failure would otherwise be undiagnosable (the measured master-prompter case: the whole evidence
+     * was a code, a stage and a fingerprint, which collides with `core-error-debuggable`).
+     *
+     * Even when enabled, the cause goes through `DyNTS_SecretRedaction_Util` first (connection-URI
+     * userinfo and known token shapes masked), so the diagnostic content survives but the credential
+     * does not. The OUTGOING response is unaffected in either case.
+     */
+    safeDiagnosticCause?: boolean;
     /**
      * this is an application wide default setting for route debug logs
      */

package/build/_models/interfaces/global-log-settings.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-log-settings.interface.d.ts","sourceRoot":"","sources":["../../../src/_models/interfaces/global-log-settings.interface.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;OAEG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAG/B;;OAEG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;OAEG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAG9B;;OAEG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;OAEG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;OAEG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAGrB;;OAEG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;;OAIG;IACH,aAAa,CAAC,EAAE;QACd,2DAA2D;QAC3D,OAAO,EAAE,OAAO,CAAC;QACjB,kDAAkD;QAClD,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB;;;;;;;;;;;;;;;WAeG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;;;;WAMG;QACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACrE,CAAC;IAEF;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE;QACT,+DAA+D;QAC/D,OAAO,EAAE,OAAO,CAAC;QACjB,yEAAyE;QACzE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,sDAAsD;QACtD,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,4CAA4C;QAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,sEAAsE;QACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,0EAA0E;QAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,mEAAmE;QACnE,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,4CAA4C;QAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,4CAA4C;QAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;CACH"}
+{"version":3,"file":"global-log-settings.interface.d.ts","sourceRoot":"","sources":["../../../src/_models/interfaces/global-log-settings.interface.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;OAEG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAG/B;;OAEG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;OAEG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAG9B;;OAEG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;OAEG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;OAEG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAGrB;;OAEG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;;OAIG;IACH,aAAa,CAAC,EAAE;QACd,2DAA2D;QAC3D,OAAO,EAAE,OAAO,CAAC;QACjB,kDAAkD;QAClD,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB;;;;;;;;;;;;;;;WAeG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;;;;WAMG;QACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACrE,CAAC;IAEF;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE;QACT,+DAA+D;QAC/D,OAAO,EAAE,OAAO,CAAC;QACjB,yEAAyE;QACzE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,sDAAsD;QACtD,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,4CAA4C;QAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,sEAAsE;QACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,0EAA0E;QAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,mEAAmE;QACnE,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,4CAA4C;QAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,4CAA4C;QAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;CACH"}

package/build/_modules/server/safe-diagnostic/safe-diagnostic.control-service.d.ts

@@ -7,7 +7,26 @@ export declare class DyNTS_SafeDiagnostic_ControlService {
     private static readonly defaultStatus;
     /** Returns an immutable exact allowlist and never reflects raw failure content. */
     static project(input: DyNTS_SafeDiagnosticInput_Interface): DyNTS_SafeDiagnostic_Interface;
-    /** Logs only the projected allowlist and returns the same immutable diagnostic. */
+    /**
+     * Logs the projected allowlist for correlation AND the RAW cause for server-side debugging,
+     * then returns the same immutable diagnostic.
+     *
+     * BFR-MASTERPROMPTER-046 — the redaction is right for the OUTGOING response, but it was also
+     * applied to the SERVER-SIDE LOG: `report()` used the raw error only to derive a 4-value
+     * `causeType` and then dropped it. A bootstrap failure therefore became undiagnosable even in
+     * principle — the whole evidence was a code, a stage and a fingerprint. That collides with the
+     * `core-error-debuggable` global hard rule ("errors carry debug-level detail") and it made a
+     * measured CI failure unresolvable (master-prompter 01.15.990, 2026-09-01).
+     *
+     * The two logs are deliberately SEPARATE lines: the projection line stays content-free (safe to
+     * forward anywhere), while the cause line is explicitly marked server-only and never leaves the
+     * process. They share the fingerprint, so the public correlation id still leads to the cause.
+     *
+     * ⚠️ The cause is REDACTED before logging (BFR-OLDLIGHTSITE-005): a raw failure can carry a full
+     * `mongodb://user:secret@host/db` connection URI — the measured spec fixture is exactly that.
+     * `DyNTS_SecretRedaction_Util` keeps the diagnostic content (name, message, stack) and removes
+     * the credential, so neither requirement has to lose to the other.
+     */
     static report(input: DyNTS_SafeDiagnosticInput_Interface): DyNTS_SafeDiagnostic_Interface;
     /** Creates a framework error that carries only the safe diagnostic allowlist. */
     static toError(diagnostic: DyNTS_SafeDiagnostic_Interface): DyFM_Error;

package/build/_modules/server/safe-diagnostic/safe-diagnostic.control-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-diagnostic.control-service.d.ts","sourceRoot":"","sources":["../../../../src/_modules/server/safe-diagnostic/safe-diagnostic.control-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAY,MAAM,uBAAuB,CAAC;AAG7D,OAAO,EACL,mCAAmC,EACnC,8BAA8B,EAC/B,MAAM,6BAA6B,CAAC;AAErC,kFAAkF;AAClF,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAwD;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAgD;IACnF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAe;IAEpD,mFAAmF;IACnF,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,mCAAmC,GAAG,8BAA8B;IAsB1F,mFAAmF;IACnF,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,mCAAmC,GAAG,8BAA8B;IAQzF,iFAAiF;IACjF,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,8BAA8B,GAAG,UAAU;IAUtE,OAAO,CAAC,MAAM,CAAC,OAAO;IAItB,OAAO,CAAC,MAAM,CAAC,YAAY;IAwB3B,OAAO,CAAC,MAAM,CAAC,SAAS;IAQxB,OAAO,CAAC,MAAM,CAAC,cAAc;CAG9B"}
+{"version":3,"file":"safe-diagnostic.control-service.d.ts","sourceRoot":"","sources":["../../../../src/_modules/server/safe-diagnostic/safe-diagnostic.control-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAY,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EACL,mCAAmC,EACnC,8BAA8B,EAC/B,MAAM,6BAA6B,CAAC;AAErC,kFAAkF;AAClF,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAwD;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAgD;IACnF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAe;IAEpD,mFAAmF;IACnF,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,mCAAmC,GAAG,8BAA8B;IAsB1F;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,mCAAmC,GAAG,8BAA8B;IAsBzF,iFAAiF;IACjF,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,8BAA8B,GAAG,UAAU;IAUtE,OAAO,CAAC,MAAM,CAAC,OAAO;IAItB,OAAO,CAAC,MAAM,CAAC,YAAY;IAwB3B,OAAO,CAAC,MAAM,CAAC,SAAS;IAQxB,OAAO,CAAC,MAAM,CAAC,cAAc;CAG9B"}

package/build/_modules/server/safe-diagnostic/safe-diagnostic.control-service.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DyNTS_SafeDiagnostic_ControlService = void 0;
 const crypto_1 = require("crypto");
 const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const secret_redaction_util_1 = require("../../../_collections/secret-redaction.util");
+const global_settings_const_1 = require("../../../_collections/global-settings.const");
 const safe_diagnostic_cause_type_enum_1 = require("./safe-diagnostic-cause.type-enum");
 /** Projects arbitrary failures to a versioned, content-free public diagnostic. */
 class DyNTS_SafeDiagnostic_ControlService {
@@ -30,10 +32,37 @@ class DyNTS_SafeDiagnostic_ControlService {
             status: status,
         });
     }
-    /** Logs only the projected allowlist and returns the same immutable diagnostic. */
+    /**
+     * Logs the projected allowlist for correlation AND the RAW cause for server-side debugging,
+     * then returns the same immutable diagnostic.
+     *
+     * BFR-MASTERPROMPTER-046 — the redaction is right for the OUTGOING response, but it was also
+     * applied to the SERVER-SIDE LOG: `report()` used the raw error only to derive a 4-value
+     * `causeType` and then dropped it. A bootstrap failure therefore became undiagnosable even in
+     * principle — the whole evidence was a code, a stage and a fingerprint. That collides with the
+     * `core-error-debuggable` global hard rule ("errors carry debug-level detail") and it made a
+     * measured CI failure unresolvable (master-prompter 01.15.990, 2026-09-01).
+     *
+     * The two logs are deliberately SEPARATE lines: the projection line stays content-free (safe to
+     * forward anywhere), while the cause line is explicitly marked server-only and never leaves the
+     * process. They share the fingerprint, so the public correlation id still leads to the cause.
+     *
+     * ⚠️ The cause is REDACTED before logging (BFR-OLDLIGHTSITE-005): a raw failure can carry a full
+     * `mongodb://user:secret@host/db` connection URI — the measured spec fixture is exactly that.
+     * `DyNTS_SecretRedaction_Util` keeps the diagnostic content (name, message, stack) and removes
+     * the credential, so neither requirement has to lose to the other.
+     */
     static report(input) {
         const diagnostic = this.project(input);
         fsm_dynamo_1.DyFM_Log.error('[DyNTS safe diagnostic]', diagnostic);
+        // A content-free kontraktus (BFR-CTM-018) a DEFAULT: az ok-naplozas OPT-IN, es akkor is
+        // redaktalva megy ki. Igy a ket bejelentes (MP-046 diagnosztizalhatosag vs. CTM-018
+        // content-free) egyszerre teljesul, es a meglevo szerzodest nem irjuk felul egyoldaluan.
+        if (global_settings_const_1.DyNTS_global_settings.log_settings?.safeDiagnosticCause === true
+            && input.error !== undefined && input.error !== null) {
+            fsm_dynamo_1.DyFM_Log.error(`[DyNTS safe diagnostic] SERVER-ONLY cause (fingerprint ${diagnostic.fingerprint}, `
+                + `stage ${diagnostic.stage}) - never sent to a client:`, secret_redaction_util_1.DyNTS_SecretRedaction_Util.redactErrorForLog(input.error));
+        }
         return diagnostic;
     }
     /** Creates a framework error that carries only the safe diagnostic allowlist. */

package/build/_modules/server/safe-diagnostic/safe-diagnostic.control-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"safe-diagnostic.control-service.js","sourceRoot":"","sources":["../../../../src/_modules/server/safe-diagnostic/safe-diagnostic.control-service.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AAEpC,sDAA6D;AAE7D,uFAAmF;AAMnF,kFAAkF;AAClF,MAAa,mCAAmC;IACtC,MAAM,CAAU,eAAe,GAA8B,yBAAyB,CAAC;IACvF,MAAM,CAAU,WAAW,GAAW,oCAAoC,CAAC;IAC3E,MAAM,CAAU,aAAa,GAAW,GAAG,CAAC;IAEpD,mFAAmF;IACnF,MAAM,CAAC,OAAO,CAAC,KAA0C;QACvD,MAAM,IAAI,GAAW,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAmC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjF,MAAM,MAAM,GAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,WAAW,GAAW,IAAI,CAAC,cAAc,CAAC;YAC9C,IAAI,CAAC,eAAe;YACpB,IAAI;YACJ,KAAK,CAAC,KAAK;YACX,SAAS;YACT,MAAM,CAAC,QAAQ,EAAE;SAClB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,SAAS;YACpB,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,MAAM,CAAC,KAA0C;QACtD,MAAM,UAAU,GAAmC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEvE,qBAAQ,CAAC,KAAK,CAAC,yBAAyB,EAAE,UAAU,CAAC,CAAC;QAEtD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,OAAO,CAAC,UAA0C;QACvD,OAAO,IAAI,uBAAU,CAAC;YACpB,SAAS,EAAE,UAAU,CAAC,IAAI;YAC1B,OAAO,EAAE,wBAAwB,UAAU,CAAC,KAAK,kBAAkB,UAAU,CAAC,WAAW,GAAG;YAC5F,WAAW,EAAE,2FAA2F;YACxG,iBAAiB,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE;YAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,OAAO,CAAC,IAAY;QACjC,OAAO,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1E,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,KAAc;QACxC,IAAI,CAAC;YACH,IAAI,KAAK,YAAY,uBAAU,EAAE,CAAC;gBAChC,OAAO,gEAA8B,CAAC,WAAW,CAAC;YACpD,CAAC;YAED,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,OAAO,gEAA8B,CAAC,WAAW,CAAC;YACpD,CAAC;YAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChD,OAAO,gEAA8B,CAAC,MAAM,CAAC;YAC/C,CAAC;YAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,gEAA8B,CAAC,SAAS,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,gEAA8B,CAAC,OAAO,CAAC;QAChD,CAAC;QAED,OAAO,gEAA8B,CAAC,OAAO,CAAC;IAChD,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,MAAe;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,OAAiB;QAC7C,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;;AAtFH,kFAuFC"}
+{"version":3,"file":"safe-diagnostic.control-service.js","sourceRoot":"","sources":["../../../../src/_modules/server/safe-diagnostic/safe-diagnostic.control-service.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AAEpC,sDAA6D;AAE7D,uFAAyF;AACzF,uFAAoF;AAEpF,uFAAmF;AAMnF,kFAAkF;AAClF,MAAa,mCAAmC;IACtC,MAAM,CAAU,eAAe,GAA8B,yBAAyB,CAAC;IACvF,MAAM,CAAU,WAAW,GAAW,oCAAoC,CAAC;IAC3E,MAAM,CAAU,aAAa,GAAW,GAAG,CAAC;IAEpD,mFAAmF;IACnF,MAAM,CAAC,OAAO,CAAC,KAA0C;QACvD,MAAM,IAAI,GAAW,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAmC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjF,MAAM,MAAM,GAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,WAAW,GAAW,IAAI,CAAC,cAAc,CAAC;YAC9C,IAAI,CAAC,eAAe;YACpB,IAAI;YACJ,KAAK,CAAC,KAAK;YACX,SAAS;YACT,MAAM,CAAC,QAAQ,EAAE;SAClB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,SAAS;YACpB,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,MAAM,CAAC,KAA0C;QACtD,MAAM,UAAU,GAAmC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEvE,qBAAQ,CAAC,KAAK,CAAC,yBAAyB,EAAE,UAAU,CAAC,CAAC;QAEtD,wFAAwF;QACxF,oFAAoF;QACpF,yFAAyF;QACzF,IACE,6CAAqB,CAAC,YAAY,EAAE,mBAAmB,KAAK,IAAI;eAC7D,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EACpD,CAAC;YACD,qBAAQ,CAAC,KAAK,CACZ,0DAA0D,UAAU,CAAC,WAAW,IAAI;kBAClF,SAAS,UAAU,CAAC,KAAK,6BAA6B,EACxD,kDAA0B,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAC1D,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,OAAO,CAAC,UAA0C;QACvD,OAAO,IAAI,uBAAU,CAAC;YACpB,SAAS,EAAE,UAAU,CAAC,IAAI;YAC1B,OAAO,EAAE,wBAAwB,UAAU,CAAC,KAAK,kBAAkB,UAAU,CAAC,WAAW,GAAG;YAC5F,WAAW,EAAE,2FAA2F;YACxG,iBAAiB,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE;YAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,OAAO,CAAC,IAAY;QACjC,OAAO,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1E,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,KAAc;QACxC,IAAI,CAAC;YACH,IAAI,KAAK,YAAY,uBAAU,EAAE,CAAC;gBAChC,OAAO,gEAA8B,CAAC,WAAW,CAAC;YACpD,CAAC;YAED,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,OAAO,gEAA8B,CAAC,WAAW,CAAC;YACpD,CAAC;YAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChD,OAAO,gEAA8B,CAAC,MAAM,CAAC;YAC/C,CAAC;YAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,gEAA8B,CAAC,SAAS,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,gEAA8B,CAAC,OAAO,CAAC;QAChD,CAAC;QAED,OAAO,gEAA8B,CAAC,OAAO,CAAC;IAChD,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,MAAe;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,OAAiB;QAC7C,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;;AAvHH,kFAwHC"}

package/build/_services/base/api.service-base.d.ts

@@ -4,6 +4,23 @@ export declare abstract class DyNTS_ApiService_Base extends DyNTS_SingletonServi
     abstract get testEndpoint(): string;
     abstract get connectingSystemName(): string;
     runApiCallWithAvailabilityCheck<T>(apiCall: () => Promise<T>, issuer: string): Promise<T>;
+    /**
+     * BFR-FSMED-008 — az az env-var, aminek ennek a fuggosegnek a base URL-jet hordoznia kell.
+     * A fogyaszto felulirhatja; a guard ezt teszi a remediation-be, hogy az uzenet KONKRET legyen.
+     */
+    get requiredBaseUrlEnvVar(): string | undefined;
+    /**
+     * BFR-FSMED-008 — BOOTSTRAP/PREFLIGHT: a downstream target nem lehet lokalis host `test`/`prod`
+     * kornyezetben, es nem lehet hianyzo vagy malformed.
+     *
+     * A mert incidens: az auth-target `http://0.0.0.0:39005/api` lett a test-kornyezetben — a
+     * szolgaltatas ONMAGAHOZ probalt csatlakozni —, es ez csak az ELSO valos login-kiserletnel derult
+     * ki, akkor is egy altalanos "server is not available" uzenettel, amibol nem latszott, hogy a
+     * KONFIGURACIO a hibas. Bootstrapben hivva ez mar indulaskor kimondja a bajt.
+     *
+     * @throws {DyFM_Error} `DyNTS-ASB-DEP0` (503) — strukturalt `additionalContent`-tel.
+     */
+    assertDependencyHostIsValid(issuer?: string): void;
     checkServerAvailability(issuer: string): Promise<void>;
     testGet(issuer: string): Promise<void>;
 }

package/build/_services/base/api.service-base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.service-base.d.ts","sourceRoot":"","sources":["../../../src/_services/base/api.service-base.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAI7D,8BAAsB,qBAAsB,SAAQ,sBAAsB;IAOxE,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC;IAC/B,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC;IACpC,QAAQ,KAAK,oBAAoB,IAAI,MAAM,CAAC;IAEtC,+BAA+B,CAAC,CAAC,EACrC,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC;IAUP,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBtD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAsB7C"}
+{"version":3,"file":"api.service-base.d.ts","sourceRoot":"","sources":["../../../src/_services/base/api.service-base.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAO7D,8BAAsB,qBAAsB,SAAQ,sBAAsB;IAOxE,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC;IAC/B,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC;IACpC,QAAQ,KAAK,oBAAoB,IAAI,MAAM,CAAC;IAEtC,+BAA+B,CAAC,CAAC,EACrC,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC;IAUb;;;OAGG;IACH,IAAI,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAE9C;IAED;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IA0B5C,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4CtD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAsB7C"}

package/build/_services/base/api.service-base.js

@@ -5,6 +5,7 @@ const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
 const singleton_service_1 = require("./singleton.service");
 const api_service_1 = require("../core/api.service");
 const __1 = require("../..");
+const dependency_host_guard_util_1 = require("../../_collections/dependency-host-guard.util");
 class DyNTS_ApiService_Base extends singleton_service_1.DyNTS_SingletonService {
     async runApiCallWithAvailabilityCheck(apiCall, issuer) {
         try {
@@ -15,16 +16,74 @@ class DyNTS_ApiService_Base extends singleton_service_1.DyNTS_SingletonService {
             throw error;
         }
     }
+    /**
+     * BFR-FSMED-008 — az az env-var, aminek ennek a fuggosegnek a base URL-jet hordoznia kell.
+     * A fogyaszto felulirhatja; a guard ezt teszi a remediation-be, hogy az uzenet KONKRET legyen.
+     */
+    get requiredBaseUrlEnvVar() {
+        return undefined;
+    }
+    /**
+     * BFR-FSMED-008 — BOOTSTRAP/PREFLIGHT: a downstream target nem lehet lokalis host `test`/`prod`
+     * kornyezetben, es nem lehet hianyzo vagy malformed.
+     *
+     * A mert incidens: az auth-target `http://0.0.0.0:39005/api` lett a test-kornyezetben — a
+     * szolgaltatas ONMAGAHOZ probalt csatlakozni —, es ez csak az ELSO valos login-kiserletnel derult
+     * ki, akkor is egy altalanos "server is not available" uzenettel, amibol nem latszott, hogy a
+     * KONFIGURACIO a hibas. Bootstrapben hivva ez mar indulaskor kimondja a bajt.
+     *
+     * @throws {DyFM_Error} `DyNTS-ASB-DEP0` (503) — strukturalt `additionalContent`-tel.
+     */
+    assertDependencyHostIsValid(issuer) {
+        const violation = dependency_host_guard_util_1.DyNTS_DependencyHostGuard_Util.inspect({
+            dependency: this.connectingSystemName,
+            targetUrl: this.baseUrl,
+            environment: `${__1.DyNTS_global_settings.env_settings?.environment ?? ''}`,
+            requiredEnvironmentVariable: this.requiredBaseUrlEnvVar,
+        });
+        if (!violation) {
+            return;
+        }
+        throw new fsm_dynamo_1.DyFM_Error({
+            ...this.getDefaultErrorSettings('assertDependencyHostIsValid', new Error(dependency_host_guard_util_1.DyNTS_DependencyHostGuard_Util.describe(violation)), issuer),
+            status: 503,
+            userMessage: `${this.connectingSystemName} is not configured correctly for this environment.`,
+            errorCode: `${__1.DyNTS_global_settings.systemShortCodeName}|DyNTS-ASB-DEP0`,
+            additionalContent: { ...violation },
+        });
+    }
     async checkServerAvailability(issuer) {
+        // BFR-FSMED-008: ELOSZOR a konfiguraciot merjuk. Ha a target lokalis hostra mutat `test`/`prod`-ban,
+        // az NEM elerhetosegi hiba — es a "server is not available" uzenet ilyenkor FELREVEZET: a tavoli
+        // szervert kuldi keresni, holott a sajat konfiguracio a hibas.
+        this.assertDependencyHostIsValid(issuer);
         try {
             await this.testGet(issuer);
         }
         catch (error) {
+            const violation = dependency_host_guard_util_1.DyNTS_DependencyHostGuard_Util.inspect({
+                dependency: this.connectingSystemName,
+                targetUrl: this.baseUrl,
+                environment: `${__1.DyNTS_global_settings.env_settings?.environment ?? ''}`,
+                requiredEnvironmentVariable: this.requiredBaseUrlEnvVar,
+            });
             throw new fsm_dynamo_1.DyFM_Error({
                 ...this.getDefaultErrorSettings('checkServerAvailability', new Error(`${this.connectingSystemName} server is not available` +
                     `\n    baseUrl: ${this.baseUrl}`), issuer),
                 userMessage: `${this.connectingSystemName} server is not available`,
                 errorCode: `${__1.DyNTS_global_settings.systemShortCodeName}|DyNTS-ASB-CSA0`,
+                // BFR-FSMED-008: a strukturalt kontextus a RUNTIME hibaba is bekerul — eddig csak a felso
+                // endpoint-wrapper formazott `endpointInfo` SZOVEGEBEN volt, amibol gepileg nem lehetett
+                // kiolvasni, melyik fuggoseg, milyen URL-lel, milyen kornyezetben bukott.
+                additionalContent: {
+                    dependency: this.connectingSystemName,
+                    targetUrl: this.baseUrl,
+                    environment: `${__1.DyNTS_global_settings.env_settings?.environment ?? ''}`,
+                    requiredEnvironmentVariable: this.requiredBaseUrlEnvVar,
+                    remediation: violation
+                        ? violation.remediation
+                        : `Verify that '${this.connectingSystemName}' is deployed and reachable at the target URL.`,
+                },
             });
         }
     }

package/build/_services/base/api.service-base.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.service-base.js","sourceRoot":"","sources":["../../../src/_services/base/api.service-base.ts"],"names":[],"mappings":";;;AAAA,sDAG+B;AAE/B,2DAA6D;AAC7D,qDAAuD;AACvD,6BAAoE;AAEpE,MAAsB,qBAAsB,SAAQ,0CAAsB;IAWxE,KAAK,CAAC,+BAA+B,CACnC,OAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAE3C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,MAAc;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAU,CAAC;gBACnB,GAAG,IAAI,CAAC,uBAAuB,CAC7B,yBAAyB,EACzB,IAAI,KAAK,CACP,GAAG,IAAI,CAAC,oBAAoB,0BAA0B;oBACtD,kBAAkB,IAAI,CAAC,OAAO,EAAE,CACjC,EACD,MAAM,CACP;gBACD,WAAW,EAAE,GAAG,IAAI,CAAC,oBAAoB,0BAA0B;gBACnE,SAAS,EAAE,GAAG,yBAAqB,CAAC,mBAAmB,iBAAiB;aACzE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,uBAAU,CAAC;gBACnB,GAAG,IAAI,CAAC,uBAAuB,CAC7B,SAAS,EACT,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,oBAAoB,EAAE,CAAC,EACrE,MAAM,CACP;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,8BAAgB,CAAC,YAAY,CACjC,IAAI,wBAAoB,CAAC;YACvB,IAAI,EAAE,GAAG,IAAI,CAAC,oBAAoB,UAAU;YAC5C,IAAI,EAAE,8BAAiB,CAAC,GAAG;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,YAAY;SAC5B,CAAC,CACH,CAAC;QAEF,qBAAQ,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,oBAAoB,eAAe,CAAC,CAAC;IAChE,CAAC;CACF;AAjED,sDAiEC"}
+{"version":3,"file":"api.service-base.js","sourceRoot":"","sources":["../../../src/_services/base/api.service-base.ts"],"names":[],"mappings":";;;AAAA,sDAG+B;AAE/B,2DAA6D;AAC7D,qDAAuD;AACvD,6BAAoE;AACpE,8FAEuD;AAEvD,MAAsB,qBAAsB,SAAQ,0CAAsB;IAWxE,KAAK,CAAC,+BAA+B,CACnC,OAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAE3C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,IAAI,qBAAqB;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,MAAe;QACzC,MAAM,SAAS,GACb,2DAA8B,CAAC,OAAO,CAAC;YACrC,UAAU,EAAE,IAAI,CAAC,oBAAoB;YACrC,SAAS,EAAE,IAAI,CAAC,OAAO;YACvB,WAAW,EAAE,GAAG,yBAAqB,CAAC,YAAY,EAAE,WAAW,IAAI,EAAE,EAAE;YACvE,2BAA2B,EAAE,IAAI,CAAC,qBAAqB;SACxD,CAAC,CAAC;QAEL,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,MAAM,IAAI,uBAAU,CAAC;YACnB,GAAG,IAAI,CAAC,uBAAuB,CAC7B,6BAA6B,EAC7B,IAAI,KAAK,CAAC,2DAA8B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAC7D,MAAM,CACP;YACD,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,GAAG,IAAI,CAAC,oBAAoB,oDAAoD;YAC7F,SAAS,EAAE,GAAG,yBAAqB,CAAC,mBAAmB,iBAAiB;YACxE,iBAAiB,EAAE,EAAE,GAAG,SAAS,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,MAAc;QAC1C,qGAAqG;QACrG,iGAAiG;QACjG,+DAA+D;QAC/D,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GACb,2DAA8B,CAAC,OAAO,CAAC;gBACrC,UAAU,EAAE,IAAI,CAAC,oBAAoB;gBACrC,SAAS,EAAE,IAAI,CAAC,OAAO;gBACvB,WAAW,EAAE,GAAG,yBAAqB,CAAC,YAAY,EAAE,WAAW,IAAI,EAAE,EAAE;gBACvE,2BAA2B,EAAE,IAAI,CAAC,qBAAqB;aACxD,CAAC,CAAC;YAEL,MAAM,IAAI,uBAAU,CAAC;gBACnB,GAAG,IAAI,CAAC,uBAAuB,CAC7B,yBAAyB,EACzB,IAAI,KAAK,CACP,GAAG,IAAI,CAAC,oBAAoB,0BAA0B;oBACtD,kBAAkB,IAAI,CAAC,OAAO,EAAE,CACjC,EACD,MAAM,CACP;gBACD,WAAW,EAAE,GAAG,IAAI,CAAC,oBAAoB,0BAA0B;gBACnE,SAAS,EAAE,GAAG,yBAAqB,CAAC,mBAAmB,iBAAiB;gBACxE,0FAA0F;gBAC1F,yFAAyF;gBACzF,0EAA0E;gBAC1E,iBAAiB,EAAE;oBACjB,UAAU,EAAE,IAAI,CAAC,oBAAoB;oBACrC,SAAS,EAAE,IAAI,CAAC,OAAO;oBACvB,WAAW,EAAE,GAAG,yBAAqB,CAAC,YAAY,EAAE,WAAW,IAAI,EAAE,EAAE;oBACvE,2BAA2B,EAAE,IAAI,CAAC,qBAAqB;oBACvD,WAAW,EAAE,SAAS;wBACpB,CAAC,CAAC,SAAS,CAAC,WAAW;wBACvB,CAAC,CAAC,gBAAgB,IAAI,CAAC,oBAAoB,gDAAgD;iBAC9F;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,uBAAU,CAAC;gBACnB,GAAG,IAAI,CAAC,uBAAuB,CAC7B,SAAS,EACT,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,oBAAoB,EAAE,CAAC,EACrE,MAAM,CACP;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,8BAAgB,CAAC,YAAY,CACjC,IAAI,wBAAoB,CAAC;YACvB,IAAI,EAAE,GAAG,IAAI,CAAC,oBAAoB,UAAU;YAC5C,IAAI,EAAE,8BAAiB,CAAC,GAAG;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,YAAY;SAC5B,CAAC,CACH,CAAC;QAEF,qBAAQ,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,oBAAoB,eAAe,CAAC,CAAC;IAChE,CAAC;CACF;AAvID,sDAuIC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@futdevpro/nts-dynamo",
-  "version": "01.15.192",
+  "version": "01.15.194",
   "description": "Dynamic NodeTS (NodeJS-Typescript), MongoDB Backend System Framework by Future Development Program Ltd.",
   "DyBu_settings": {
     "packageType": "server-package",