@onlineapps/mq-client-core 3.0.1 → 3.2.0

package/CHANGELOG.md

@@ -4,6 +4,104 @@ All notable changes to this package. Follows [Keep a Changelog](https://keepacha
 
 ## [Unreleased]
 
+## [3.2.0] — 2026-09-15
+
+### Added — dead-letter cesty pro rodiny `monitoring.*` a `telemetry.*` (d.475)
+
+Sedm front, které konzumenti monitoringu čtou — `monitoring.workflow`,
+`monitoring.services`, `monitoring.audit`,
+`monitoring.infrastructure.health.events`, `telemetry.logs.queue`,
+`telemetry.metrics.queue`, `telemetry.traces.queue` — dostalo
+`x-dead-letter-exchange: ''` a `x-dead-letter-routing-key: '<prefix>.dlq'`, a obě
+rodiny svou koncovou frontu: `monitoring.dlq` a `telemetry.dlq`, deklarované
+stejným tvarem jako `workflow.dlq` a `delivery.dlq` (durable, `x-max-length`
+50000, žádné TTL, žádná další cesta). TTL ani strop žádné existující fronty se
+nemění.
+
+Je to mechanické pravidlo konfirmace `mq-consumer-contract` 003 bod 1 použité
+podruhé, přesně jak bod 3 předepsal („`monitoring.*`, `telemetry.*` … dostanou
+`<prefix>.dlq`, až jejich konzumenti přejdou na politiku knihovny") — nová
+konfirmace k tomu nepatří. Do té doby brána d.259 ty konzumenty vůbec nepustila:
+`consume()` odmítá frontu, jejíž deklarace neříká, kam s odmítnutou zprávou.
+
+Ostatní rodiny téže věty — `registry.*`, `validation.*`, `infrastructure.*` —
+cestu **nedostávají**: jejich konzumenti pořád potvrzují na vlastních surových
+kanálech (`infra/api_services_registry/src/listeners/registry.listener.js`,
+`infra/api_services_{registry,validator}/src/services/mqManager.js` — DL-007),
+a `.dlq`, do které nikdo nezapisuje, je fronta bez pisatele.
+
+Fronty zakládá `initInfrastructureQueues()` z deklarace samotné (prochází
+`infrastructurePrefixes()` a klíče sekcí), takže obě nové vzniknou při nejbližším
+bootu jejího jediného volajícího, `infra/api_gateway`. Běžící `monitoring.*`
+a `telemetry.*` fronty nesou staré argumenty, takže je podle konfirmace 003 bodu
+4 čeká smazání a znovuzaložení ve vlně; do té doby je `assertQueue` nad nimi
+s novou deklarací 406.
+
+## [3.1.0] — 2026-09-15
+
+### Added — `topology` nese i tři telemetrické fronty (d.461)
+
+`module.exports.topology` vystavuje `telemetryLogsQueue`, `telemetryMetricsQueue`,
+`telemetryTracesQueue`, složené ze sekce `telemetry` v `queueConfig` (tatáž
+deklarace, ne kopie). Monitoring, jediný konzument těch front, může zrušit
+svoje privátní literály a číst jména odtud; `src/config/queueConfig` zůstává
+interní cestou. README § topology popisuje celý export.
+
+### Fixed — `performHealthCheck()` hlásí stav, nemění ho (d.467)
+
+Kontrola spouštěla obnovovací cyklus bezpodmínečně: `_reconnectWithBackoff()`
+nastaví `_reconnecting` synchronně, `isConnected()` ho čte, a tak zdravý klient
+reportoval vlastní vedlejší účinek (`healthy: false`, `Connection is closed or
+missing`, `isConnected()` true → false) a obnova skutečně vyměnila živý socket
+za nový. Teď se obnova spouští jen u odstaveného klienta — otázku klade jednomu
+zdroji živosti (`isConnected()` nad `_connectionAlive`), tam, kde ji kladou
+`_ensurePublisherChannel()` a `_ensureConsumerChannel()`. Líný kontrakt d.339
+zůstává: odstavený klient se health checkem dál vrací do provozu. Repro nad
+živým brokerem s `reconnectEnabled: true` (starší sady o health checku stavěly
+klienta s `reconnectEnabled: false`, proto vadu nikdy neviděly).
+
+### Fixed — `redactUrl` se bere z `@onlineapps/logger-contract`, lokální kopie pryč (d.455)
+
+`src/utils/redactCredentials.js` držel vlastní `redactUrl`
+a `UNPARSEABLE_PLACEHOLDER`. Od `@onlineapps/logger-contract` 1.2.0 (d.453) je
+vlastní core vrstva, takže je tenhle modul importuje a `src/index.js` je
+**re-exportuje identitou** — veřejné API se nemění, dependants dál píší
+`require('@onlineapps/mq-client-core').redactUrl`. Zdejší zůstává jen
+`redactConnectionTarget`: fail-fast obal nad deklarovaným config klíčem `host`,
+který v core vrstvě nemá co dělat (vyhazuje tam, kde `redactUrl` vrací
+placeholder — d.292 §2/§3).
+
+Čtyři otázky ke smazané deklaraci (`change-discipline.md` § Removing):
+
+1. **Proč vznikla** — d.448 sjednotila sémantiku (celé userinfo pryč, ne jen
+   heslo) poté, co se na `api_service_hello` 2026-09-07 změřilo heslo brokeru
+   ve stdout a přes monitoring i v Loki. Core domov tehdy neexistoval, takže
+   funkce zůstala tady.
+2. **Která část koncepce ji nesla** — `change-discipline.md` § One rail per
+   concern ji naopak zakazuje: tři kopie jednoho pravidla (tady,
+   `service-common`, `conn-orch-registry`). Ta část koncepce stojí dál.
+3. **Proč ji dnes nikdo nečte** — `@onlineapps/logger-contract` 1.2.0 exportuje
+   `redactUrl` i `UNPARSEABLE_PLACEHOLDER` a všechny tři dependants míří na něj.
+4. **Je náhrada koncepčnější** — ano: `logger-contract` je L1 bez `@onlineapps`
+   závislostí, takže na něj dosáhne i kategorie `orchestration`, které brána G7
+   odmítá pin do kategorie `runtime`.
+
+**Změna chování na jednom okraji:** zdejší kopie vracela `parsed.href` bez
+úpravy, logger-contract navíc utne lomítko, které WHATWG dopisuje prázdné cestě
+u *special* schemat (`http`, `https`, `ws`, `wss`, `ftp`, `file`). Na `amqp` /
+`amqps` — jediných, se kterými tenhle klient pracuje — jsou obě implementace
+bajtově shodné; `http://u:p@host:8080` nově vrátí `http://host:8080` místo
+`http://host:8080/`.
+
+Sada `tests/unit/redact-credentials.test.js`: blok se sémantikou `redactUrl`
+case-by-case odešel (drží ho logger-contract), místo něj drží identitu
+re-exportu, nepřítomnost druhé koleje v `utils/redactCredentials`
+(`Object.keys` = `['redactConnectionTarget']`), shodu výstupu
+`redactConnectionTarget` s `loggerContract.redactUrl` a cestu selhání.
+Zmizely i mrtvé citace na `shared/service-common/src/redactUrl.js`
+a `shared/connector/conn-orch-registry/src/redactUrl.js` — oba soubory už
+neexistují.
+
 ## [3.0.1] — 2026-09-14
 
 - **Fixed: `consume()` accepts a TERMINAL queue — one this configuration dead-letters TO — instead of demanding a dead-letter route it must not have.** The d.259 gate refuses a queue for which `queueConfig` declares no `x-dead-letter-exchange`/`-routing-key`, because the policy ends a spent message with `nack(requeue=false)` and the broker drops what it cannot move. True of every working queue — and false of the queues that RECEIVE those moves: `workflow.failed` is named in `x-dead-letter-routing-key` by `workflow.init` and `workflow.control`, `<service>.dlq` by every business template, `workflow.dlq` and `delivery.dlq` by their own families, and the confirmed topology leaves exactly those without a route of their own (`api/docs/governance/confirmations/mq-consumer-contract.md` 002 point 2, 003 point 2 — "workflow.failed and workflow.dlq themselves keep no route"). A dead-letter route on a dead-letter queue is a loop or a chain with no end. So `workflow.failed` — the operator's queue, read by the delivery dispatcher — was unconsumable: `[BaseClient] Cannot consume from queue "workflow.failed": queueConfig declares no dead-letter route`. The gate now asks a second question, `queueConfig.isDeadLetterTarget(queue)`, **derived from the templates** (the set of every declared `x-dead-letter-routing-key`, `{service}` placeholder read through the same `templateShape()` the business templates use) rather than from a list of names that would have to be edited in step with them — the defect d.278 removed from `matchBusinessTemplate()`. The `.dlq` family needs no rule of its own: every `.dlq` this configuration declares is already the target of a declared routing key (measured 2026-09-14). Every other queue with no route is refused exactly as before, with the same sentence. A message that spends its budget on a terminal queue is rejected the same way and then DROPPED by the broker — the end of the chain is the end — never requeued for ever, and the loss is now logged at error level (`Message discarded on terminal queue "<queue>"`, with the queue, the attempts and the error) before the `message_dlq` event is published. Tests: new unit `consume-terminal-queue.test.js` (10 — the derivation from the declared keys, the terminal names and the non-terminal control, `consume('workflow.failed')` and `consume('<svc>.dlq')` attaching, the three refusals that must not change with the refusal verbatim, the discard with its log line and meta, and a routed queue as the control that says nothing about a discard); integration `dead-letter-route-required.integration.test.js` (+2 against the live broker: a message rejected from `<svc>.queue` reaches `<svc>.dlq` and is DELIVERED to a consumer there with `x-death[0].reason = 'rejected'`, and a handler failing on that terminal queue leaves the queue empty with no second delivery after 2 s — the drop no mock can measure). Three tests that encoded the old rule follow the new one: the `<svc>.dlq` refusal leg of `consume-dead-letter-route-required.test.js` (its subject moved to the new file), and the two integration control queues that used a dead-letter queue as "the queue with no route" (`delivery-events-lookup` → `monitoring.workflow`, `queue-declaration-options-one-rail` → `<svc>.events`).
@@ -36,7 +134,7 @@ All notable changes to this package. Follows [Keep a Changelog](https://keepacha
 - **Removed (BREAKING: `persistentBufferEnabled` and `persistentRedisClient` are refused by name):** the persistent publish buffer, which never existed. `buffer/RedisBuffer.js` was a placeholder — `add()` stored nothing, `flush()` returned 0 — and `MessageBuffer.add()` returned after that branch without falling back (the stub did not throw, so there was nothing to fall back from). With `persistentBufferEnabled: true` a critical-priority message that failed transiently was therefore DROPPED, while the same message at normal priority was held in memory and replayed after the reconnect: the key inverted its own promise. The package's own concept node already said so in writing (`docs/architecture/mq-publish-reliability.md` § Buffering: "RedisBuffer is a stub … Leave persistentBufferEnabled at its default") — a mechanism documented as not existing (`automation-gates.md` §5). The four questions of `change-discipline.md` § Removing are answered in the commit and in `tests/unit/persistent-buffer-removed.test.js`: it arrived with the publish-reliability layer (`3588b148`) as a hook for a future extension; no part of the concept requires persistence; nothing ever set either key outside one test (measured across `api`, `api_biz`, `infra`, `fe_adminui`, 2026-09-14); and what stands in its place — one in-memory buffer holding every priority — is more conceptual than a switch that loses messages. `getBufferState()` is therefore `{ size, inMemory }` (the `persistent` count could only ever be 0), `MessageBuffer.flush()` returns the number replayed instead of `{ inMemory, persistent }`, and both key names now fail the constructor with a sentence saying the mechanism is gone rather than a name to rename them to (d.343).
 - **Fixed (BREAKING: `publish()` no longer creates the exchange it publishes to, and `options.exchangeType` is gone):** an exchange is NAMED by a publisher, never declared by one. `_publishOnce()` asserted the exchange before EVERY publish, with arguments it made up on the spot — the type from `options.exchangeType || 'direct'` and the durability from the PUBLISHING client's own config — so the publisher decided the topology and two differently configured publishers declared one exchange two ways. Measured on the live broker: a client configured `durable: false` publishing to a fanout its owner declared durable is refused with `406 PRECONDITION-FAILED … inequivalent arg 'type' … received 'direct' but current is 'fanout'`, on a message that had nothing wrong with it. The owner's decision names this exact defect one object down — "the endpoint's own `{ durable: true }` assert is a second declaration and already yields 406 against the library's" (`docs/governance/confirmations/mq-consumer-contract.md` 003, point 4). Exchanges are declared once in `config/queueConfig.js` and asserted by their owners (measured: every exchange the platform publishes to already is), so an exchange nobody declared is now a broker-side 404 on the publish rather than an exchange invented by whoever published first — the same rule as `README.md` § Queue ownership states for queues. `options.exchangeType` existed for that one assert and left with it, including its only caller inside the library, `monitoring-publish.js` (d.342).
 - **Added:** `BaseClient.isConnectionFatal()` and `BaseClient.performHealthCheck()` — the last two methods a service could not reach. Same hole d.296 closed for the five counters, different question: both were methods of the TRANSPORT alone, and `new RabbitMQClient` is called in exactly one place in the whole workspace (`transports/transportFactory.js`, inside this library), so a service holding a `BaseClient` saw `isConnected() === false` with no way to learn whether to wait or to restart, and the manual probe `docs/architecture/rabbitmq-channel-lifecycle.md` documents was callable on nothing it holds. The transport keeps the computation; the client delegates. `performHealthCheck()` follows the five counters and refuses before `connect()` built a transport; `isConnectionFatal()` deliberately does not — a client that never connected has a true answer (no), and a healthcheck must not be answered by an exception. `onChannelClose` stays the transport's: it is an internal hook on a channel's lifetime, not a question a service asks. The d.296 gate now covers both new counterparts (d.341).
-- **Removed (BREAKING for a caller importing the transport):** `require('@onlineapps/mq-client-core').RabbitMQClient`. The four questions, answered before deleting: it came in with the library's extraction (`7a47b2fa`), as part of publishing the module's surface; no part of the concept ever carried it — `docs/architecture/mq-publish-reliability.md` describes the transport as what `BaseClient` selects, never as what a caller constructs; nothing reads it because `transportFactory` has been the one constructor since that same commit (measured across `api_biz/*`, `infra/*`, `shared/*`: zero uses outside this package); and what stands in its place is more conceptual, not less — the factory picks the transport from `type` (Configuration Over Convention), while constructing it by hand bypasses config composition, schema validation and the instance registry `disconnectAll()` is built on (d.341).
+- **Removed (BREAKING for a caller importing the transport):** `require('@onlineapps/mq-client-core').RabbitMQClient`. The four questions, answered before deleting: it came in with the library's extraction (`7a47b2fa`), as part of publishing the module's surface; no part of the concept ever carried it — `docs/architecture/mq-publish-reliability.md` describes the transport as what `BaseClient` selects, never as what a caller constructs; nothing reads it because `transportFactory` has been the one constructor since that same commit (measured across `api_biz/*`, `infra/*`, `shared/*`: zero uses outside this package — that scope skipped `api/tests/**`, which carried 13 uses in 3 suites; INFRA retires them as a second rail, measured 2026-09-15); and what stands in its place is more conceptual, not less — the factory picks the transport from `type` (Configuration Over Convention), while constructing it by hand bypasses config composition, schema validation and the instance registry `disconnectAll()` is built on (d.341).
 - **Fixed (BREAKING: a spent reconnect budget is no longer the end of the client):** after the attempt budget of one recovery cycle runs out against a broker that never answered, the client **stands down** — `connection:standby` with `{ cycle, cyclesMax, attempts, lastError, timestamp }`, no timer, no socket, `isConnected()` false and `isConnectionFatal()` FALSE — and the next `publish()`, `consume()` or `performHealthCheck()` starts the next cycle. Nothing polls in between, so a client nobody uses costs nothing while the broker is away. Until now one spent budget set the fatal flag and the client refused every operation for the life of the process, which the README taught as "dead until the process restarts"; that is the "give up forever" the owner forbade (`docs/governance/confirmations/mq-client-lifecycle-contract.md` 001 point 3), and it meant a broker restart longer than `maxReconnectAttempts × reconnectMaxDelay` needed a process restart to undo. One rail: the lazy retry re-enters the same `_reconnectWithBackoff()`, there is no second loop (d.339).
 - **Added:** `maxReconnectCycles` (default 3, env `RABBITMQ_MAX_RECONNECT_CYCLES`) — how many recovery cycles the client runs before the connection IS permanently lost. It is what keeps the lazy retry finite; the value is the one `maxDeliveryAttempts` already answers the same question with (how many whole retries one thing gets), and two answers to one question must not differ (d.339).
 - **Changed (BREAKING for a caller reading the fatal error):** `connection:fatal` says WHICH of the two endings it is — `reason: 'broker-refused'` or `'cycles-spent'` — and carries `cycles` beside `attempts`, with a different sentence for each. A broker that ANSWERED and refused (403 `ACCESS-REFUSED`, 530 `NOT-ALLOWED`, 406 `PRECONDITION-FAILED`) is fatal on the spot, with no further attempt spent on an answer that cannot change: measured against amqplib 0.10.9 on the live broker (2026-09-14), such a refusal arrives as a plain `Error` with `code` undefined and the AMQP reply code rendered into the message, so the reply code is what is read — the broker's protocol constant, never wording invented here. Not recognised, and said rather than implied: a wrong vhost reaches amqplib as `Expected ConnectionOpenOk; got <ConnectionClose channel:0>`, so it is treated as an outage and ends at the cycle cap (d.339).

package/README.md

@@ -218,7 +218,8 @@ carries `{ queue, messageCount, consumerCount }` and no arguments (measured, 202
 
 **A TERMINAL queue is consumed, and it is not an exception to that rule but its other
 half.** A queue something else dead-letters TO — `<service>.dlq`, `workflow.failed`,
-`workflow.dlq`, `delivery.dlq` — declares no onward route because the topology says it
+`workflow.dlq`, `delivery.dlq`, `monitoring.dlq`, `telemetry.dlq` — declares no onward
+route because the topology says it
 must not have one: a dead-letter route on a dead-letter queue closes a loop or starts a
 chain with no end (`api/docs/governance/confirmations/mq-consumer-contract.md` 002
 point 2, 003 point 2). So the gate asks a second question, `queueConfig.isDeadLetterTarget(queue)`,
@@ -565,6 +566,42 @@ file moves. Callers holding the deep path switch to the named export; callers th
 receive `queueConfig` by injection (`initInfrastructureQueues` in
 `@onlineapps/infrastructure-tools`) pass it from here.
 
+### topology — platform queue names, as a declared export
+
+A name that travels ON THE WIRE between services has to have ONE owner, or it has one
+copy per service. `topology` is that owner: a frozen object of the platform names, each
+one composed from the entry that DECLARES it in `queueConfig`, so a rename there moves
+the export with it and an entry that is gone fails fast instead of handing back a
+plausible string.
+
+```javascript
+const { topology } = require('@onlineapps/mq-client-core');
+
+topology.infrastructureHealthEventsExchange; // 'infrastructure.health.events'
+topology.telemetryLogsQueue;                 // 'telemetry.logs.queue'
+topology.telemetryLogsQueue = 'mine';        // TypeError — the object is frozen
+```
+
+| Key | Name on the wire | Who publishes / who drains it |
+|---|---|---|
+| `infrastructureHealthEventsExchange` | `infrastructure.health.events` | Fanout. The registry publishes (`api/infra/api_services_registry/src/services/infrastructureEventPublisher.js`); the two queues below are bound to it. |
+| `monitoringInfrastructureHealthEventsQueue` | `monitoring.infrastructure.health.events` | The monitoring consumer's queue on that fanout (`api/infra/api_monitoring/src/consumer/topology.js`, `MONITORING_INFRA_EVENT_QUEUE`). |
+| `deliveryHealthEventsQueue` | `delivery.health.events` | The delivery endpoint binds it to the fanout and consumes it for WS push (`api/infra/api_delivery_endpoint/src/index.js`, `bindQueueToFanout(config.healthEventsQueue, …)`). |
+| `deliveryResourceEventsQueue` | `delivery.resource.events` | Bound to the `monitoring.resource` exchange by `resource.changed.#`; published by the monitoring watcher `resourceChangedPublisher.js`, drained by `ResourceChangedConsumer.js` in the delivery endpoint. |
+| `telemetryLogsQueue` | `telemetry.logs.queue` | Bound to `telemetry.exchange`, which every service publishes to with its own name as the routing key; drained by the monitoring consumer (`api/infra/api_monitoring/src/consumer/index.js`, `topology.TELEMETRY_LOGS_QUEUE`). |
+| `telemetryMetricsQueue` | `telemetry.metrics.queue` | The same exchange, the same consumer — metric samples. |
+| `telemetryTracesQueue` | `telemetry.traces.queue` | The same exchange, the same consumer — spans. |
+
+- **Frozen on purpose.** An importer must not be able to rewrite platform topology: a
+  name overridden on one side of a fanout loses the events silently, which is why batch
+  243g-C removed the per-service env override for the health-events exchange in the
+  first place.
+- **The named export is the contract.** `@onlineapps/mq-client-core/src/config/queueConfig`
+  is an internal path this package never promised — it resolves today and breaks the day
+  the file moves. Import `topology` (or `queueConfig`) from the package root.
+- A service that still carries one of these names as a private literal is carrying the
+  spelling of a fact declared here; importing it changes the wire by nothing at all.
+
 ### redactUrl — a connection URL that is safe to log
 
 `RABBITMQ_URL` carries the broker account, so anything that renders it verbatim
@@ -589,9 +626,10 @@ redactUrl(undefined);                                   // '<unparseable-url>'
   goes through `redactConnectionTarget()` instead, which refuses a non-string
   outright, because `host` is a declared config key and a wrong type there is a
   boot-time defect.
-- It is the SAME function this package uses internally, and the same semantics as
-  `shared/service-common/src/redactUrl.js`. A dependant that renders a broker URL
-  imports it from here rather than keeping a copy.
+- It is the SAME function this package uses internally. Implementaci vlastní
+  `@onlineapps/logger-contract` (vrstva L1, dosáhne na ni každá kategorie);
+  tenhle balíček ji od d.455 jen **re-exportuje identitou**, aby dependant,
+  který renderuje URL brokeru, importoval funkci místo kopie.
 
 ## Architecture
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlineapps/mq-client-core",
-  "version": "3.0.1",
+  "version": "3.2.0",
   "description": "Core MQ client library for RabbitMQ - shared by infrastructure services and connectors",
   "oa": {
     "category": "connector"
@@ -23,8 +23,8 @@
   "author": "OnlineApps",
   "license": "MIT",
   "dependencies": {
-    "@onlineapps/logger-contract": "1.1.0",
-    "@onlineapps/runtime-config": "1.1.0",
+    "@onlineapps/logger-contract": "2.0.0",
+    "@onlineapps/runtime-config": "1.2.0",
     "ajv": "^8.12.0",
     "amqplib": "^0.10.3"
   },

package/src/config/queueConfig.js

@@ -613,6 +613,15 @@ module.exports = {
    * 
    * CRITICAL: Monitoring is an infrastructure service, monitoring queues are infrastructure queues!
    * All services (both infrastructure and business) publish monitoring events here.
+   *
+   * Every QUEUE of this family dead-letters to `monitoring.dlq` over the DEFAULT
+   * exchange, where the routing key IS the destination queue's name — the mechanical
+   * rule of confirmation `mq-consumer-contract` 003 point 1, applied here by point 3
+   * ("`monitoring.*` … get `<prefix>.dlq` when their consumers move onto the library
+   * policy"). The exchanges declared alongside them carry no arguments and therefore
+   * no route: an exchange holds nothing to dead-letter.
+   *
+   * @see api/docs/governance/confirmations/mq-consumer-contract.md 003
    */
   monitoring: {
     /**
@@ -627,7 +636,9 @@ module.exports = {
       durable: true,
       arguments: {
         'x-message-ttl': 300000,      // 5 minutes TTL
-        'x-max-length': 10000
+        'x-max-length': 10000,
+        'x-dead-letter-exchange': '',        // Default exchange: routing key IS the queue name
+        'x-dead-letter-routing-key': 'monitoring.dlq'
       }
     },
 
@@ -644,7 +655,9 @@ module.exports = {
       durable: true,
       arguments: {
         'x-message-ttl': 600000,      // 10 minutes TTL (longer for service tracking)
-        'x-max-length': 20000
+        'x-max-length': 20000,
+        'x-dead-letter-exchange': '',
+        'x-dead-letter-routing-key': 'monitoring.dlq'
       }
     },
 
@@ -657,7 +670,9 @@ module.exports = {
       durable: true,
       arguments: {
         'x-message-ttl': 300000,
-        'x-max-length': 50000
+        'x-max-length': 50000,
+        'x-dead-letter-exchange': '',
+        'x-dead-letter-routing-key': 'monitoring.dlq'
       }
     },
 
@@ -674,11 +689,39 @@ module.exports = {
     /**
      * monitoring.infrastructure.health.events - the monitoring consumer's own copy of
      * the infrastructure health events, bound to the infrastructure.health.events
-     * fanout exchange. Declared with `durable` and nothing else, exactly as the
-     * consumer creates it.
+     * fanout exchange.
+     *
+     * It carried `durable` and nothing else — the arguments the consumer asserts it
+     * with (`infra/api_monitoring/src/consumer/index.js`, `assertQueue(queue,
+     * { durable: true })`). It keeps no TTL and no cap, because nothing decided it
+     * should have either; what it gains is the family's dead-letter route, without
+     * which `consume()` refuses to attach a consumer to it at all (d.259).
      */
     'infrastructure.health.events': {
-      durable: true
+      durable: true,
+      arguments: {
+        'x-dead-letter-exchange': '',
+        'x-dead-letter-routing-key': 'monitoring.dlq'
+      }
+    },
+
+    /**
+     * monitoring.dlq - Dead letter queue of the whole monitoring family
+     *
+     * The end of this family's chain: the workflow, services and audit queues and the
+     * consumer's health-events copy all reject into it over the default exchange, so
+     * no binding has to exist for the route to work. Declared with the arguments every
+     * other dead-letter queue carries — durable, capped at the same 50k, no TTL and no
+     * onward route — because the operator's dashboard matches `*.dlq` and a message
+     * that expired there is a message nobody got to decide about (confirmation
+     * `mq-consumer-contract` 002 point 2, 003 point 1).
+     */
+    dlq: {
+      durable: true,
+      arguments: {
+        // No TTL for DLQ - messages should persist
+        'x-max-length': 50000         // Higher limit for DLQ
+      }
     }
   },
 
@@ -690,8 +733,15 @@ module.exports = {
    * own name, and these three queues are bound to it
    * (`docs/standards/monitoring-queues.md`, `docs/architecture/monitoring.md`).
    *
-   * The values are the ones the queues are created with today; this config is their
-   * declaration, so whoever asserts them reads it here rather than retyping it.
+   * The TTL and the cap are the ones the queues are created with today; this config is
+   * their declaration, so whoever asserts them reads it here rather than retyping it.
+   *
+   * Each of the three dead-letters to `telemetry.dlq` over the DEFAULT exchange, where
+   * the routing key IS the destination queue's name — the mechanical rule of
+   * confirmation `mq-consumer-contract` 003 point 1, applied to this family by point 3
+   * as its consumer moves onto the library policy.
+   *
+   * @see api/docs/governance/confirmations/mq-consumer-contract.md 003
    */
   telemetry: {
     /** telemetry.logs.queue - OpenTelemetry log records, drained into Loki. */
@@ -699,7 +749,9 @@ module.exports = {
       durable: true,
       arguments: {
         'x-message-ttl': 60000,       // 1 minute TTL for unprocessed messages
-        'x-max-length': 100000        // Max 100k messages in queue
+        'x-max-length': 100000,       // Max 100k messages in queue
+        'x-dead-letter-exchange': '',        // Default exchange: routing key IS the queue name
+        'x-dead-letter-routing-key': 'telemetry.dlq'
       }
     },
 
@@ -708,7 +760,9 @@ module.exports = {
       durable: true,
       arguments: {
         'x-message-ttl': 60000,
-        'x-max-length': 100000
+        'x-max-length': 100000,
+        'x-dead-letter-exchange': '',
+        'x-dead-letter-routing-key': 'telemetry.dlq'
       }
     },
 
@@ -717,7 +771,25 @@ module.exports = {
       durable: true,
       arguments: {
         'x-message-ttl': 60000,
-        'x-max-length': 100000
+        'x-max-length': 100000,
+        'x-dead-letter-exchange': '',
+        'x-dead-letter-routing-key': 'telemetry.dlq'
+      }
+    },
+
+    /**
+     * telemetry.dlq - Dead letter queue of the whole telemetry family
+     *
+     * The three intake queues reject into it, and it rejects nowhere: same shape as
+     * `workflow.dlq`, `delivery.dlq` and `monitoring.dlq` — durable, capped at 50k, no
+     * TTL, no onward route. A telemetry record the intake cannot process is the one an
+     * operator most needs to look at, and a TTL here would delete it before they did.
+     */
+    dlq: {
+      durable: true,
+      arguments: {
+        // No TTL for DLQ - messages should persist
+        'x-max-length': 50000         // Higher limit for DLQ
       }
     }
   },

package/src/index.js

@@ -38,7 +38,7 @@ const {
 } = require('./monitoring-publish');
 const queueConfig = require('./config/queueConfig');
 const deliveryPolicy = require('./config/deliveryPolicy');
-const { redactUrl, UNPARSEABLE_PLACEHOLDER } = require('./utils/redactCredentials');
+const { redactUrl, UNPARSEABLE_PLACEHOLDER } = require('@onlineapps/logger-contract');
 
 // Export BaseClient as default (constructor), with additional named exports
 // NOTE: When destructuring, use: const { BaseClient } = require('@onlineapps/mq-client-core');
@@ -117,7 +117,18 @@ module.exports.topology = Object.freeze({
    * names (`api/docs/governance/confirmations/mq-consumer-contract.md` 003 — the
    * endpoint declaring its queues from `queueConfig` is INFRA's step).
    */
-  deliveryResourceEventsQueue: queueConfig.queueName('deliveryEvents', 'resource.events')
+  deliveryResourceEventsQueue: queueConfig.queueName('deliveryEvents', 'resource.events'),
+  /**
+   * The monitoring consumer's OpenTelemetry log intake, bound to `telemetry.exchange`.
+   * Declared in `queueConfig` since d.269; the consumer carries the same literal as a
+   * private constant (`api/infra/api_monitoring/src/consumer/topology.js`), which is the
+   * shape d.270 gave an owner for the health-events names.
+   */
+  telemetryLogsQueue: queueConfig.queueName('telemetry', 'logs.queue'),
+  /** The same consumer's metric-sample intake on that exchange. */
+  telemetryMetricsQueue: queueConfig.queueName('telemetry', 'metrics.queue'),
+  /** The same consumer's span intake on that exchange. */
+  telemetryTracesQueue: queueConfig.queueName('telemetry', 'traces.queue')
 });
 /**
  * The dead-letter policy of `consume()` as a contract, not as an implementation
@@ -137,16 +148,17 @@ module.exports.deliveryPolicy = deliveryPolicy;
  * userinfo out, scheme/host/port/vhost in, and a fixed placeholder for a value that
  * is not a parseable URL.
  *
- * It is exported because it was already written three times — here, in
- * `shared/service-common/src/redactUrl.js` (d.245/d.245b) and in
- * `shared/connector/conn-orch-registry/src/redactUrl.js` (d.446), whose header says
- * plainly that it stayed local only because this package declared no redactor and
- * masked the password alone. Two semantics for one concern are two rails
- * (`change-discipline.md` § One rail per concern); d.448 made them one and put it
- * where a dependant can import it instead of copying it.
+ * It is exported because it was already written three times across the platform.
+ * Two semantics for one concern are two rails (`change-discipline.md` § One rail
+ * per concern); d.448 made them one, a d.455 je přesunula tam, kam patří —
+ * `@onlineapps/logger-contract` (vrstva L1, bez `@onlineapps` závislostí, dosáhne
+ * na ni každá kategorie). Zdejší export je od té chvíle **re-export identitou**:
+ * zůstává, protože dependants ho importují odsud.
  *
  * The placeholder travels with the function: a caller comparing against it must
  * read the same literal, not retype it.
+ *
+ * @see node_modules/@onlineapps/logger-contract/src/redactUrl.js
  */
 module.exports.redactUrl = redactUrl;
 module.exports.UNPARSEABLE_PLACEHOLDER = UNPARSEABLE_PLACEHOLDER;

package/src/transports/rabbitmqClient.js

@@ -1784,7 +1784,22 @@ class RabbitMQClient extends EventEmitter {
     // The internal monitor calls `_performHealthCheck()` instead, deliberately:
     // a timer resuming recovery would make the retry periodic, which is the
     // opposite of the lazy contract.
-    this._resumeRecovery();
+    //
+    // "If this client stood down" is a QUESTION, and it is asked of the one
+    // liveness source (`_connectionAlive`, read through `isConnected()` — d.260)
+    // the two other uses already read it from: `_ensurePublisherChannel()` and
+    // `_ensureConsumerChannel()` resume recovery inside their
+    // `if (!this._connectionAlive)` branch. Until d.467 this one did not ask:
+    // `_reconnectWithBackoff()` sets `_reconnecting` synchronously and
+    // `isConnected()` reads it, so a check on a LIVE client reported its own
+    // side effect — `connection: { exists: true, closed: true }`, the issue
+    // `Connection is closed or missing`, `isConnected()` true before and false
+    // after — and then really replaced a healthy socket with a new one. A
+    // report that changes what it reports is not a report (INFRA 326b,
+    // measured 2026-09-15 against the live broker, amqplib 0.10.9).
+    if (!this.isConnected()) {
+      this._resumeRecovery();
+    }
     return this._performHealthCheck();
   }
   

package/src/utils/redactCredentials.js

@@ -12,53 +12,21 @@
  * boot, so the broker account was readable in container stdout and, through the
  * monitoring consumer, in Loki (measured 2026-09-07 on api_service_hello).
  *
- * `redactUrl` returns the URL with the WHOLE userinfo removed: what stays is
- * scheme, host, port, vhost and query — the part a reader of the log actually
- * came for. The account NAME goes with the password, because it is the other
- * half of the same credential, and because this is the redaction semantics the
- * platform already writes: `shared/service-common/src/redactUrl.js`
- * (d.245/d.245b, Redis) and `shared/connector/conn-orch-registry/src/redactUrl.js`
- * (d.446, AMQP). Until d.448 this module masked the password only, which made
- * two semantics for one concern — two rails (`change-discipline.md` § One rail
- * per concern). `src/index.js` exports the function so the dependants import it
- * instead of keeping a local copy.
+ * Samotné pravidlo „co smí z URL dorazit do logu“ tenhle balíček neimplementuje.
+ * Od d.455 je bere z `@onlineapps/logger-contract` (`redactUrl`,
+ * `UNPARSEABLE_PLACEHOLDER`): userinfo ven, scheme/host/port/vhost/query
+ * dovnitř, neparsovatelná hodnota nahrazená placeholderem místo echa. Do d.455
+ * tu stála bajtově stejná kopie jako v `@onlineapps/service-common` — tři
+ * vlastníci jednoho pravidla, tedy přesně to, co `change-discipline.md`
+ * § One rail per concern označuje za vadu.
  *
- * A value that is not a parseable URL is answered with a fixed placeholder
- * rather than echoed: an unparseable string is exactly the case where nobody can
- * say whether it holds a credential, and echoing it would be the leak this
- * helper exists to prevent.
- */
-
-const UNPARSEABLE_PLACEHOLDER = '<unparseable-url>';
-
-/**
- * Strip userinfo (`user:password@`) from a connection URL.
+ * Zdejší zůstává jediná věc, kterou core vrstva nemá proč znát:
+ * `redactConnectionTarget`, fail-fast obal nad DEKLAROVANÝM config klíčem.
  *
- * @param {string} url - connection URL, e.g. `amqp://oa_dev:secret@queuer:5672/vhost`
- * @returns {string} the URL without userinfo, e.g. `amqp://queuer:5672/vhost`,
- *   or `<unparseable-url>` when the input is not a URL.
+ * @see node_modules/@onlineapps/logger-contract/src/redactUrl.js
  */
-function redactUrl(url) {
-  if (typeof url !== 'string' || url.length === 0) {
-    return UNPARSEABLE_PLACEHOLDER;
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch (_) {
-    return UNPARSEABLE_PLACEHOLDER;
-  }
-  // `new URL('api_services_queuer:5672')` SUCCEEDS — it reads `api_services_queuer:`
-  // as the scheme and `5672` as an opaque path, so the value comes back with an
-  // empty host and no userinfo to strip. Without this guard such a value would be
-  // echoed verbatim, which is the leak this helper exists to prevent.
-  if (!parsed.host) {
-    return UNPARSEABLE_PLACEHOLDER;
-  }
-  parsed.username = '';
-  parsed.password = '';
-  return parsed.href;
-}
+
+const { redactUrl, UNPARSEABLE_PLACEHOLDER } = require('@onlineapps/logger-contract');
 
 /**
  * Makes a connection target safe to log.
@@ -103,4 +71,4 @@ function redactConnectionTarget(target) {
   );
 }
 
-module.exports = { redactConnectionTarget, redactUrl, UNPARSEABLE_PLACEHOLDER };
+module.exports = { redactConnectionTarget };