@futdevpro/nts-dynamo 1.15.86 → 1.15.89

package/src/_models/interfaces/global-settings.interface.ts

@@ -1,235 +1,244 @@
-import { DyFM_EnvironmentFlag } from '@futdevpro/fsm-dynamo';
-import { DyNTS_RouteSecurity } from '../../_enums/route-security.enum';
-import { DyNTS_SocketSecurity } from '../../_modules/socket/_enums/socket-security.enum';
-import { DyNTS_GlobalLog_Settings } from './global-log-settings.interface';
-import { DyNTS_Environment_Settings } from './environment-settings.interface';
-
-/**
- * 
- * 
- * @param logRequestsContent only will log if the specific logRequest is also true
- * 
- * @param logEventContent only will log if the specific socket event is also set to log
- * 
- */
-export interface DyNTS_Global_Settings {
-
-  env_settings: DyNTS_Environment_Settings;
-
-  /**
-   * this will be used as the main baseUrl for the application,
-   * this is not required, but we suggest to use at least a '/api' as base route
-   */
-  baseUrl: string;
-  /**
-   * this sets the default security for routes
-   */
-  defaultRouteSecurity: DyNTS_RouteSecurity;
-  /**
-   * this sets the default security for sockets
-   */
-  defaultSocketSecurity: DyNTS_SocketSecurity;
-
-  /**
-   * this is the name of the system, this will be used for the server status
-   */
-  systemName?: string;
-
-  /**
-   * this is the short code name of the system, this will be used for the logs and errors
-   */
-  systemShortCodeName?: string;
-
-  /**
-   * this is the version of the system, this will be used for the logs and errors
-   */
-  systemVersion: string;
-
-  /**
-   * this setting will set if the default route should be created
-   */
-  dontCreateDefaultRoute?: boolean;
-
-  /**
-   * 
-   */
-  autoResolveEndpointCirculationErrors: boolean;
-
-  /**
-   * this setting will set the compact error response mode for the system
-   */
-  compactErrorResponse: boolean;
-
-  /**
-   * this is the default page size for pagination
-   */
-  defaultPageSize: number;
-
-  /**
-   * this is the number of items to archive in the list, this will be used to archive the list
-   */
-  archiveListAfter: number;
-
-  /**
-   * this is the environment of the system
-   */
-  /* environment: DyFM_EnvironmentFlag; */
-
-  /**
-   * this setting will set which logs will be shown
-   */
-  log_settings: DyNTS_GlobalLog_Settings;
-
-  /**
-   * this setting will set the research issues mode for the system
-   */
-  autoResearchIssues: boolean;
-
-  /**
-   * this setting will set the bot settings
-   * (this will be set in the {@link DyNTS_Bot_Main_ControlService} constructor)
-   * 
-   * {@link DyNTS_GlobalBot_Settings}
-   * default settings: {@link DyNTS_Bot_Global_Settings}
-   */
-  bot_settings: any;
-
-  /**
-   * this setting will set the openai settings
-   * (this will be set in the {@link DyNTS_OAI_LLMChat_ServiceBase} constructor)
-   * 
-   * {@link DyNTS_OpenAI_Settings}
-   * default settings: {@link DyNTS_OAI_global_settings}
-   */
-  openAi_settings: any;
-
-  /**
-   * this setting will set the dias settings
-   * (this will be set in the {@link DyNTS_OAI_LLM_ServiceBase} constructor, if not set already)
-   * ({@link DyNTS_OAI_VectorDataService} is not using this, but its own settings)
-   * 
-   * {@link DyNTS_DiAs_Global_Settings}
-   * default settings: {@link DyNTS_DiAs_Global_Settings}
-   */
-  dias_settings: any;
-
-  /**
-   * this setting will set the assistant settings
-   * (this will be set in the {@link DyNTS_Ass_ServiceBase} constructor)
-   * 
-   * {@link DyNTS_Ass_Global_Settings}
-   * default settings: {@link DyNTS_Ass_global_settings}
-   */
-  assistant_settings?: any;
-
-  /**
-   * Auth-service beállítások.
-   *
-   * Ha `optional: true`, a framework NEM követeli meg az egyedi Auth Service-t:
-   * a {@link DyNTS_GlobalService.getAuthService} hiányzó service esetén `undefined`-ot
-   * ad vissza a `"Unique Authentication Service missing!"` hiba DOBÁSA HELYETT, és
-   * a startup-warn ('Authentication Service missing!') is elmarad. Public / no-auth
-   * szervereknek (pl. nyílt RAG/MCP backend), ahol nincs saját auth-réteg.
-   *
-   * Default: `{ optional: false }` — az auth-service kötelező (visszafelé kompatibilis,
-   * a régi viselkedés: hiányzó service → dobott hiba).
-   */
-  auth_settings?: {
-    /**
-     * Ha `true`, az Auth Service opcionális: `getAuthService()` NEM dob hiányzó
-     * service esetén, hanem `undefined`-ot ad vissza (a hívók optional-chaining-gel
-     * kezelik), és a startup 'Authentication Service missing!' warn is elmarad.
-     * Default: `false`.
-     */
-    optional?: boolean;
-  };
-
-  /**
-   * this setting will set the doc chunking settings
-   */
-  docChunking: {
-    maxChunkSize: number;
-    maxChunkCount: number;
-  };
-
-  /**
-   * this setting will set the messaging settings
-   * (this will be set in the {@link DyNTS_Msg_Main_ControlService} constructor)
-   *
-   * {@link DyNTS_Msg_Global_Settings}
-   * default settings: {@link DyNTS_Msg_global_settings}
-   */
-  messaging_settings?: any;
-
-  /**
-   * FR-193 — bedrock OOM korai-figyelmeztető heap-watchdog ({@link DyNTS_MemoryGuard}).
-   * Ha `enabled`, a base `App` startup automatikusan feltelepíti. Periodikusan figyeli a
-   * heap-kihasználtságot, és a `--max-old-space-size` plafonhoz közeledve TARTÓS rekordot
-   * hagy az error-sinkbe (Errors-rendszer + Discord) — mielőtt a fatal OOM megölné a
-   * process-t. Default: enabled, 10s poll, warn 85% / crit 95%.
-   */
-  memoryGuard?: {
-    /** Bekapcsolja a heap-watchdogot (a base App startup feltelepíti). Default: true. */
-    enabled: boolean;
-    /** Poll-intervallum ms-ben. Default: 10000. */
-    pollIntervalMs?: number;
-    /** Warning küszöb a heap-plafon %-ában. Default: 85. */
-    heapWarningThreshold?: number;
-    /** Critical küszöb a heap-plafon %-ában. Default: 95. */
-    heapCriticalThreshold?: number;
-    /** A warning küszöb ALATTI margó %-ban a 'recovered'-hez (hiszterézis). Default: 10. */
-    recoveryMargin?: number;
-    /** Megőrzött események max száma (ring-buffer). Default: 100. */
-    maxHistoryCount?: number;
-    /**
-     * GC-hányad (GC-ben töltött idő / poll-ablak) küszöb a `warning`-hoz, a %-küszöb MELLETT. 0..1. Default: 0.40.
-     * A „Ineffective mark-compacts near heap limit" OOM gyakran a heap-% kritikus küszöb ALATT üt be (a GC thrash-el,
-     * `mutator utilization` lezuhan) — ezt a jelet a puszta % későn/sosem fogja. Ez a GC-jel a valódi OOM-precursor.
-     */
-    gcWarningFraction?: number;
-    /** GC-hányad küszöb a `critical`-hoz (load-shed + graceful-exit zóna). 0..1. Default: 0.60. */
-    gcCriticalFraction?: number;
-    /**
-     * Process-szintű crash-handler (`uncaughtException`) telepítése — a crash ELŐTT TELJES-RÉSZLETŰ error-entry
-     * (message + stack + kód + issuer + memória-snapshot) az error-sinkbe, majd tiszta exit. Default: true.
-     * (Az `unhandledRejection`-t a base App már rögzíti; ez az eddig néma `uncaughtException`-t fedi le.)
-     */
-    installCrashHandlers?: boolean;
-    /**
-     * Tartós `critical` (a megadott poll-számon át, GC-vel sem csökkenő) esetén TISZTA kilépés → a wrapper/
-     * restart-policy PREDIKTÍVEN újraindít, a kriptikus fatal OOM (exit 134) helyett. Default: false
-     * (konténer-restart-policy-ra bízva; standalone/`serve`-wrapper-es app opt-in-olja).
-     */
-    exitOnSustainedCritical?: boolean;
-    /** Hány EGYMÁST KÖVETŐ `critical` poll után lépjen ki (`exitOnSustainedCritical`-hez). Default: 3. */
-    sustainedCriticalPolls?: number;
-    /** A graceful-exit kódja (a wrapper ezt látja restart-jelnek). Default: 137. */
-    exitCode?: number;
-    /**
-     * **Boot-grace ms** az `exitOnSustainedCritical`-hez: a guard-install UTÁNI első ennyi ms-ben a sustained-critical
-     * NEM lép ki (csak logol + load-shed). A nehéz-boot appok (nagy in-memory pool-hidratálás) ELEVE GC-thrash-elnek a
-     * boot alatt → e nélkül a sustained-exit boot-loop-ot okozna. A grace UTÁN a tartós critical normálisan kilép (a
-     * VALÓDI futásidejű OOM-ot kezeli). Default: 60000 (60s). 0 → nincs grace (azonnal élesedik).
-     */
-    bootGraceMs?: number;
-  };
-
-  /**
-   * FR-258 / SR-4 — proactive collection-growth monitor (companion to {@link memoryGuard}). Samples
-   * each registered collection's document count (scan-free `estimatedDocumentCount`) on a slow
-   * cadence and raises a warning into the Errors-sink BEFORE an unbounded collection can be loaded
-   * into heap and OOM. Observation only — never deletes (retention SR-1/SR-2 does the deleting).
-   */
-  collectionGrowthMonitor?: {
-    /** Bekapcsolja a monitort (a base App startup feltelepíti). Default: true. */
-    enabled: boolean;
-    /** Poll-intervallum ms-ben. Default: 300000 (5 min). */
-    pollIntervalMs?: number;
-    /** Warning, ha egy collection doc-száma ezt meghaladja. Default: 250000. */
-    sizeThresholdDocCount?: number;
-    /** Warning, ha egy collection az előző poll óta ennél többel nőtt (%). Default: 50. */
-    growthRateThresholdPct?: number;
-    /** Re-alert cooldown collection-önként + alert-típusonként, ms (anti-flood). Default: 3600000 (1 h). */
-    reAlertCooldownMs?: number;
-  };
-}
+import { DyFM_EnvironmentFlag } from '@futdevpro/fsm-dynamo';
+import { DyNTS_RouteSecurity } from '../../_enums/route-security.enum';
+import { DyNTS_SecurityHeaders_Settings } from './security-headers-settings.interface';
+import { DyNTS_SocketSecurity } from '../../_modules/socket/_enums/socket-security.enum';
+import { DyNTS_GlobalLog_Settings } from './global-log-settings.interface';
+import { DyNTS_Environment_Settings } from './environment-settings.interface';
+
+/**
+ * 
+ * 
+ * @param logRequestsContent only will log if the specific logRequest is also true
+ * 
+ * @param logEventContent only will log if the specific socket event is also set to log
+ * 
+ */
+export interface DyNTS_Global_Settings {
+
+  env_settings: DyNTS_Environment_Settings;
+
+  /**
+   * this will be used as the main baseUrl for the application,
+   * this is not required, but we suggest to use at least a '/api' as base route
+   */
+  baseUrl: string;
+  /**
+   * this sets the default security for routes
+   */
+  defaultRouteSecurity: DyNTS_RouteSecurity;
+  /**
+   * this sets the default security for sockets
+   */
+  defaultSocketSecurity: DyNTS_SocketSecurity;
+
+  /**
+   * this is the name of the system, this will be used for the server status
+   */
+  systemName?: string;
+
+  /**
+   * this is the short code name of the system, this will be used for the logs and errors
+   */
+  systemShortCodeName?: string;
+
+  /**
+   * this is the version of the system, this will be used for the logs and errors
+   */
+  systemVersion: string;
+
+  /**
+   * this setting will set if the default route should be created
+   */
+  dontCreateDefaultRoute?: boolean;
+
+  /**
+   * 
+   */
+  autoResolveEndpointCirculationErrors: boolean;
+
+  /**
+   * this setting will set the compact error response mode for the system
+   */
+  compactErrorResponse: boolean;
+
+  /**
+   * this is the default page size for pagination
+   */
+  defaultPageSize: number;
+
+  /**
+   * this is the number of items to archive in the list, this will be used to archive the list
+   */
+  archiveListAfter: number;
+
+  /**
+   * this is the environment of the system
+   */
+  /* environment: DyFM_EnvironmentFlag; */
+
+  /**
+   * this setting will set which logs will be shown
+   */
+  log_settings: DyNTS_GlobalLog_Settings;
+
+  /**
+   * this setting will set the research issues mode for the system
+   */
+  autoResearchIssues: boolean;
+
+  /**
+   * this setting will set the bot settings
+   * (this will be set in the {@link DyNTS_Bot_Main_ControlService} constructor)
+   * 
+   * {@link DyNTS_GlobalBot_Settings}
+   * default settings: {@link DyNTS_Bot_Global_Settings}
+   */
+  bot_settings: any;
+
+  /**
+   * this setting will set the openai settings
+   * (this will be set in the {@link DyNTS_OAI_LLMChat_ServiceBase} constructor)
+   * 
+   * {@link DyNTS_OpenAI_Settings}
+   * default settings: {@link DyNTS_OAI_global_settings}
+   */
+  openAi_settings: any;
+
+  /**
+   * this setting will set the dias settings
+   * (this will be set in the {@link DyNTS_OAI_LLM_ServiceBase} constructor, if not set already)
+   * ({@link DyNTS_OAI_VectorDataService} is not using this, but its own settings)
+   * 
+   * {@link DyNTS_DiAs_Global_Settings}
+   * default settings: {@link DyNTS_DiAs_Global_Settings}
+   */
+  dias_settings: any;
+
+  /**
+   * this setting will set the assistant settings
+   * (this will be set in the {@link DyNTS_Ass_ServiceBase} constructor)
+   * 
+   * {@link DyNTS_Ass_Global_Settings}
+   * default settings: {@link DyNTS_Ass_global_settings}
+   */
+  assistant_settings?: any;
+
+  /**
+   * Auth-service beállítások.
+   *
+   * Ha `optional: true`, a framework NEM követeli meg az egyedi Auth Service-t:
+   * a {@link DyNTS_GlobalService.getAuthService} hiányzó service esetén `undefined`-ot
+   * ad vissza a `"Unique Authentication Service missing!"` hiba DOBÁSA HELYETT, és
+   * a startup-warn ('Authentication Service missing!') is elmarad. Public / no-auth
+   * szervereknek (pl. nyílt RAG/MCP backend), ahol nincs saját auth-réteg.
+   *
+   * Default: `{ optional: false }` — az auth-service kötelező (visszafelé kompatibilis,
+   * a régi viselkedés: hiányzó service → dobott hiba).
+   */
+  auth_settings?: {
+    /**
+     * Ha `true`, az Auth Service opcionális: `getAuthService()` NEM dob hiányzó
+     * service esetén, hanem `undefined`-ot ad vissza (a hívók optional-chaining-gel
+     * kezelik), és a startup 'Authentication Service missing!' warn is elmarad.
+     * Default: `false`.
+     */
+    optional?: boolean;
+  };
+
+  /**
+   * this setting will set the doc chunking settings
+   */
+  docChunking: {
+    maxChunkSize: number;
+    maxChunkCount: number;
+  };
+
+  /**
+   * this setting will set the messaging settings
+   * (this will be set in the {@link DyNTS_Msg_Main_ControlService} constructor)
+   *
+   * {@link DyNTS_Msg_Global_Settings}
+   * default settings: {@link DyNTS_Msg_global_settings}
+   */
+  messaging_settings?: any;
+
+  /**
+   * BFR-MASTERPROMPTER-011 / SEC-R2-8 — security response-header middleware. Ha enabled
+   * (default: true), a base App az open+secure Express-en a CORS-mount ELŐTT minden válaszra
+   * ráteszi a biztonsági headereket (x-powered-by removal + X-Frame-Options + nosniff +
+   * Referrer-Policy; HSTS auto-prod-gated; CSP opt-in). Lásd {@link DyNTS_SecurityHeaders_Settings}.
+   */
+  securityHeaders?: DyNTS_SecurityHeaders_Settings;
+
+  /**
+   * FR-193 — bedrock OOM korai-figyelmeztető heap-watchdog ({@link DyNTS_MemoryGuard}).
+   * Ha `enabled`, a base `App` startup automatikusan feltelepíti. Periodikusan figyeli a
+   * heap-kihasználtságot, és a `--max-old-space-size` plafonhoz közeledve TARTÓS rekordot
+   * hagy az error-sinkbe (Errors-rendszer + Discord) — mielőtt a fatal OOM megölné a
+   * process-t. Default: enabled, 10s poll, warn 85% / crit 95%.
+   */
+  memoryGuard?: {
+    /** Bekapcsolja a heap-watchdogot (a base App startup feltelepíti). Default: true. */
+    enabled: boolean;
+    /** Poll-intervallum ms-ben. Default: 10000. */
+    pollIntervalMs?: number;
+    /** Warning küszöb a heap-plafon %-ában. Default: 85. */
+    heapWarningThreshold?: number;
+    /** Critical küszöb a heap-plafon %-ában. Default: 95. */
+    heapCriticalThreshold?: number;
+    /** A warning küszöb ALATTI margó %-ban a 'recovered'-hez (hiszterézis). Default: 10. */
+    recoveryMargin?: number;
+    /** Megőrzött események max száma (ring-buffer). Default: 100. */
+    maxHistoryCount?: number;
+    /**
+     * GC-hányad (GC-ben töltött idő / poll-ablak) küszöb a `warning`-hoz, a %-küszöb MELLETT. 0..1. Default: 0.40.
+     * A „Ineffective mark-compacts near heap limit" OOM gyakran a heap-% kritikus küszöb ALATT üt be (a GC thrash-el,
+     * `mutator utilization` lezuhan) — ezt a jelet a puszta % későn/sosem fogja. Ez a GC-jel a valódi OOM-precursor.
+     */
+    gcWarningFraction?: number;
+    /** GC-hányad küszöb a `critical`-hoz (load-shed + graceful-exit zóna). 0..1. Default: 0.60. */
+    gcCriticalFraction?: number;
+    /**
+     * Process-szintű crash-handler (`uncaughtException`) telepítése — a crash ELŐTT TELJES-RÉSZLETŰ error-entry
+     * (message + stack + kód + issuer + memória-snapshot) az error-sinkbe, majd tiszta exit. Default: true.
+     * (Az `unhandledRejection`-t a base App már rögzíti; ez az eddig néma `uncaughtException`-t fedi le.)
+     */
+    installCrashHandlers?: boolean;
+    /**
+     * Tartós `critical` (a megadott poll-számon át, GC-vel sem csökkenő) esetén TISZTA kilépés → a wrapper/
+     * restart-policy PREDIKTÍVEN újraindít, a kriptikus fatal OOM (exit 134) helyett. Default: false
+     * (konténer-restart-policy-ra bízva; standalone/`serve`-wrapper-es app opt-in-olja).
+     */
+    exitOnSustainedCritical?: boolean;
+    /** Hány EGYMÁST KÖVETŐ `critical` poll után lépjen ki (`exitOnSustainedCritical`-hez). Default: 3. */
+    sustainedCriticalPolls?: number;
+    /** A graceful-exit kódja (a wrapper ezt látja restart-jelnek). Default: 137. */
+    exitCode?: number;
+    /**
+     * **Boot-grace ms** az `exitOnSustainedCritical`-hez: a guard-install UTÁNI első ennyi ms-ben a sustained-critical
+     * NEM lép ki (csak logol + load-shed). A nehéz-boot appok (nagy in-memory pool-hidratálás) ELEVE GC-thrash-elnek a
+     * boot alatt → e nélkül a sustained-exit boot-loop-ot okozna. A grace UTÁN a tartós critical normálisan kilép (a
+     * VALÓDI futásidejű OOM-ot kezeli). Default: 60000 (60s). 0 → nincs grace (azonnal élesedik).
+     */
+    bootGraceMs?: number;
+  };
+
+  /**
+   * FR-258 / SR-4 — proactive collection-growth monitor (companion to {@link memoryGuard}). Samples
+   * each registered collection's document count (scan-free `estimatedDocumentCount`) on a slow
+   * cadence and raises a warning into the Errors-sink BEFORE an unbounded collection can be loaded
+   * into heap and OOM. Observation only — never deletes (retention SR-1/SR-2 does the deleting).
+   */
+  collectionGrowthMonitor?: {
+    /** Bekapcsolja a monitort (a base App startup feltelepíti). Default: true. */
+    enabled: boolean;
+    /** Poll-intervallum ms-ben. Default: 300000 (5 min). */
+    pollIntervalMs?: number;
+    /** Warning, ha egy collection doc-száma ezt meghaladja. Default: 250000. */
+    sizeThresholdDocCount?: number;
+    /** Warning, ha egy collection az előző poll óta ennél többel nőtt (%). Default: 50. */
+    growthRateThresholdPct?: number;
+    /** Re-alert cooldown collection-önként + alert-típusonként, ms (anti-flood). Default: 3600000 (1 h). */
+    reAlertCooldownMs?: number;
+  };
+}

package/src/_models/interfaces/routing-module-settings.interface.ts

@@ -1,21 +1,21 @@
-import { DyNTS_RouteSecurity } from '../../_enums/route-security.enum';
-import { DyNTS_Controller } from '../../_services/route/controller.service';
-
-
-/**
- * This is a main route point handler, which collects a list of controllers for the API
- */
-export interface DyNTS_RoutingModule_Settings {
-  /**
-   * main route of the module
-   */
-  route: string;
-  /**
-   * the collection of controllers (sub-routes, with differentlogical parts, to different db elements)
-   */
-  controllers: DyNTS_Controller[];
-  /**
-   * securityOverride will be used to create different security for a single module without changing the default security (http/https/both)
-   */
-  securityOverride?: DyNTS_RouteSecurity;
-}
+import { DyNTS_RouteSecurity } from '../../_enums/route-security.enum';
+import { DyNTS_Controller } from '../../_services/route/controller.service';
+
+
+/**
+ * This is a main route point handler, which collects a list of controllers for the API
+ */
+export interface DyNTS_RoutingModule_Settings {
+  /**
+   * main route of the module
+   */
+  route: string;
+  /**
+   * the collection of controllers (sub-routes, with differentlogical parts, to different db elements)
+   */
+  controllers: DyNTS_Controller[];
+  /**
+   * securityOverride will be used to create different security for a single module without changing the default security (http/https/both)
+   */
+  securityOverride?: DyNTS_RouteSecurity;
+}

package/src/_models/interfaces/security-headers-settings.interface.ts

@@ -0,0 +1,50 @@
+/**
+ * `DyNTS_SecurityHeaders_Settings` — a bedrock security response-header middleware beállításai
+ * (BFR-MASTERPROMPTER-011 / SEC-R2-8). A middleware minden `DyNTS_App`-leszármazott open+secure
+ * Express-én, a CORS-mount ELŐTT fut (így az OPTIONS preflight-válaszok is megkapják a headereket).
+ *
+ * **Default-ON, safe-by-default**: zéró-konfiggal a bizonyítottan nem-törő készlet megy ki
+ * (x-powered-by removal + X-Frame-Options + nosniff + Referrer-Policy). A HSTS auto-env-gated
+ * (csak prod), a CSP opt-in (app-specifikus). Bármely header `false`-szal kikapcsolható;
+ * `enabled: false` = teljes opt-out.
+ */
+export interface DyNTS_SecurityHeaders_Settings {
+  /** Fő kapcsoló. Default: true (a middleware minden szerveren aktív). */
+  enabled: boolean;
+
+  /** `app.disable('x-powered-by')` — Express tech-leak eltávolítás. Default: true. */
+  removePoweredBy?: boolean;
+
+  /** `X-Frame-Options` értéke, vagy `false` a kihagyáshoz. Default: 'SAMEORIGIN'. */
+  frameOptions?: string | false;
+
+  /** `X-Content-Type-Options` értéke, vagy `false`. Default: 'nosniff'. */
+  contentTypeOptions?: string | false;
+
+  /** `Referrer-Policy` értéke, vagy `false`. Default: 'strict-origin-when-cross-origin'. */
+  referrerPolicy?: string | false;
+
+  /** `Permissions-Policy` értéke, vagy `false`. Default: false (opt-in — app-specifikus). */
+  permissionsPolicy?: string | false;
+
+  /**
+   * HSTS (`Strict-Transport-Security`). Default: AUTO — CSAK prod environment-en emittál
+   * (`max-age=15768000; includeSubDomains`); a test-en a sticky-HSTS strukturálisan elkerülve.
+   * Explicit `{ enabled: true }` bármely env-en bekapcsolja; `false` mindenhol kikapcsolja.
+   */
+  hsts?: {
+    enabled?: boolean;
+    maxAgeSeconds?: number;
+    includeSubDomains?: boolean;
+    preload?: boolean;
+  } | false;
+
+  /** `Content-Security-Policy` string, vagy `false`. Default: false (app-specifikus, OPT-IN). */
+  csp?: string | false;
+
+  /** Ha true, a CSP a `Content-Security-Policy-Report-Only` header-névvel megy ki (rollout-segéd). */
+  cspReportOnly?: boolean;
+
+  /** További tetszőleges fix headerek (merge a resolvelt készletre). */
+  additionalHeaders?: Record<string, string>;
+}

package/src/_models/interfaces/static-client-settings.interface.spec.ts

@@ -1,29 +1,29 @@
-import { DyNTS_StaticClient_Settings } from './static-client-settings.interface';
-
-describe('| DyNTS_StaticClient_Settings', () => {
-  it('| should allow minimal settings with only root', () => {
-    const s: DyNTS_StaticClient_Settings = { root: '/dist' };
-    expect(s.root).toBe('/dist');
-    expect(s.fallbackPath).toBeUndefined();
-  });
-
-  it('| should allow optional fallbackPath', () => {
-    const s: DyNTS_StaticClient_Settings = {
-      root: '/dist',
-      fallbackPath: 'index.html',
-    };
-    expect(s.fallbackPath).toBe('index.html');
-  });
-
-  it('| should allow SPA cache options', () => {
-    const s: DyNTS_StaticClient_Settings = {
-      root: '/dist',
-      assetCacheMaxAge: 31536000,
-      assetCacheImmutable: true,
-      fallbackCacheMaxAge: 0,
-    };
-    expect(s.assetCacheMaxAge).toBe(31536000);
-    expect(s.assetCacheImmutable).toBe(true);
-    expect(s.fallbackCacheMaxAge).toBe(0);
-  });
-});
+import { DyNTS_StaticClient_Settings } from './static-client-settings.interface';
+
+describe('| DyNTS_StaticClient_Settings', () => {
+  it('| should allow minimal settings with only root', () => {
+    const s: DyNTS_StaticClient_Settings = { root: '/dist' };
+    expect(s.root).toBe('/dist');
+    expect(s.fallbackPath).toBeUndefined();
+  });
+
+  it('| should allow optional fallbackPath', () => {
+    const s: DyNTS_StaticClient_Settings = {
+      root: '/dist',
+      fallbackPath: 'index.html',
+    };
+    expect(s.fallbackPath).toBe('index.html');
+  });
+
+  it('| should allow SPA cache options', () => {
+    const s: DyNTS_StaticClient_Settings = {
+      root: '/dist',
+      assetCacheMaxAge: 31536000,
+      assetCacheImmutable: true,
+      fallbackCacheMaxAge: 0,
+    };
+    expect(s.assetCacheMaxAge).toBe(31536000);
+    expect(s.assetCacheImmutable).toBe(true);
+    expect(s.fallbackCacheMaxAge).toBe(0);
+  });
+});