esign_css — FaceKom eSign Customer-Side Server

esign_css

Orientation scope

Verified against the devel base branch (the working tree was checked out on update/customization/instacash-2026-05-27; canonical files such as customization/customizations.js were re-read via git show devel: so this doc describes the un-customized product). See customization-architecture / customization-branch-catalog for branch-specific behavior.

1. Purpose & role in FaceKom

esign_css is the FaceKom eSign customer-side server (package.json:4 description: “FaceKom eSign customer side server”; README.md). “CSS” = Customer-Side Server — it is the public-facing web tier the signing customer interacts with, the counterpart to the operator-side OSS (operator-side server, referenced everywhere as esign-oss / esign:rpc-system-oss).

It is a thin Express web/UI tier + Socket.IO server that:

• Serves the customer signing UI (Twig + Dust templated pages: homepage, token-check, offer-sign, waiting-for-offer/contract, agreement-checks, system-check, goodbye, contract download) — server/web/routes.js.
• Exposes a JSON /api/** surface for the browser/native app (customer login, 2-factor auth, document/contract/offer fetch, signature M1/M2, timestamp) — server/web/routes.js:220-306.
• Holds no business logic or database of its own — every operation is delegated over RabbitMQ RPC to backend eSign services (server.js:84-128). CSS is essentially an auth/session + presentation gateway in front of the eSign queue bus.

CSS vs OSS hosts

config.hosts.css and config.hosts.oss are first-class config (config/dev.json:59-62, config.js:47-52). In dev they default to esign-css.<domain> / esign-oss.<domain>.

2. Tech stack & runtime

Aspect	Value	Source
Language	JavaScript (CommonJS, Node)	package.json, *.js
Runtime	Node >=22.13.0	package.json:6-8 (engines.node)
CI Node	Node 24	.github/workflows/pull-request.yaml:11 (NODE_VERSION: "24")
Web framework	Express 5 (express ^5.2.1)	package.json:52, server/web/web-server.js:1
Realtime	Socket.IO 4 (server + client)	package.json:74-75, server/socket/socket-server.js
Message bus	@techteamer/mq ^7.0.1 (RabbitMQ over AMQPS)	package.json:35, server.js:71
Templating	Twig 3 (server pages) + Dust (dustjs-linkedin/dustjs-helpers, client bundles)	package.json:50-51,80, server/web/web-server.js:224, engines/dust/
Sessions	express-session + connect-redis ^9 (Redis store)	package.json:45,54, server/web/web-server.js:106
Auth tokens	jsonwebtoken, node-jose (JWE encrypt of session JWT)	package.json:61,69, server/service/SessionService.js, server/service/TokenService.js
Security	helmet ^8, nocache, csurf (CSRF), custom CSP + IP filter	package.json:48,57,67, server/web/routes.js
Logging	log4js (+ optional syslog/papertrail appenders)	package.json:64, server/logger.js
Frontend build	browserify (JS) + stylus → clean-css/autoprefixer (CSS), via hideout task runner	package.json:40,77,43,6, bin/, engines/build/
Config	getconfig ^4 (NODE_ENV-selected JSON) + optional Spring Cloud Config	package.json:56, config.js, config/
Package manager	Yarn (classic; yarn.lock present, .yarnrc, CI uses yarn install --frozen-lockfile)	yarn.lock, .yarnrc, CI workflow
Lint	ESLint 9 flat config (eslint.config.mjs), eslint-config-standard base	package.json:86-95, eslint.config.mjs

No Dockerfile in the repo

There is no Dockerfile, .dockerignore, or docker-compose anywhere in devel (verified via git ls-tree -r devel). The repo ships nginx + supervisor config instead (nginx_dev.conf, nginx_docker.conf, supervisor_dev.conf, supervisor_docker.conf). The container image is built elsewhere; this repo provides the process/proxy config that image runs. The config profile is chosen by NODE_ENV (dev → config/dev.json, docker → config/docker.json) — set by supervisor (supervisor_dev.conf sets NODE_ENV=dev, supervisor_docker.conf sets NODE_ENV=docker).

3. Build & run

Entrypoints

• main: server.js (package.json:5). Boot sequence (server.js:245-254): config.loaded → setupQueue → setupServices → setupCustomizations → StartWebServer → StartSocketServer. On any failure it logs CANNOT START ESIGN_CSS and process.exit(2).
• Web server listens on 127.0.0.1:10183 (server.js:203-206).
• Socket server listens on 127.0.0.1:10184 — only started when features.browserSignature is true (server.js:219-243).
• Public traffic is fronted by nginx on port 30180 which proxies /socket.io → :10184 and everything else → :10183, serving static web/** directly with 1y cache (nginx_dev.conf). nginx_dev.conf and nginx_docker.conf are byte-identical (verified diff).
• Process supervision via supervisord runs nginx, redis, and esign_css (node server.js) as managed programs (supervisor_dev.conf); accepted exit codes 0,2, auto-restart on.

package.json scripts (verbatim → effect)

Script	Command (package.json:9-19)	What it does
start	node server.js	Boots the server (see entrypoint above).
test	eslint . --quiet --ignore-pattern "test/*" && echo 'eslint --quiet'	There is no real test suite — test is just ESLint (errors only). See §8.
lint	eslint . --max-warnings 0 --ignore-pattern "test/*" && echo 'npm run eslint --max-warnings 0'	Strict lint (fails on any warning). This is what CI runs.
lint:fix	eslint . --fix && eslint --max-warnings 0 .	Auto-fix then re-verify zero-warnings.
build	node bin/build/build	Builds both scripts and styles (browserify + stylus) once.
style	node bin/style/style.task	Builds only the CSS bundles.
script	node bin/script/script.task	Builds only the JS bundles.
watch	node bin/watch/watch	Builds scripts+styles and watches for changes (live-reload via browser-sync when configured).
credits	node bin/credits > CREDITS.html	Regenerates CREDITS.html — an HTML license table of all deps via license-checker.

Typical local run

1. yarn install (uses --install.ignore-optional true from .yarnrc).
2. yarn build (or yarn watch during dev) to produce web/js, web/css, web/branding.
3. Provide a config/dev.json-shaped config; RabbitMQ reachable at amqps://localhost:5671 with mTLS certs under /workspace/vuer_mq_cert/... (config/dev.json:143-153); Redis at /var/run/redis/redis-server.sock (config/dev.json:44-48).
4. NODE_ENV=dev node server.js (this is exactly what supervisor_dev.conf does).

4. Top-level structure

Path	Role	Verified
server.js	Boot/wiring entrypoint (queue, services, web, socket)	read
config.js	getconfig loader + Spring Cloud Config + CORS/socket hardening + config.get/has helpers	read
config/	dev.json, docker.json — the two NODE_ENV profiles	read both
server/	Backend: logger.js, serviceContainer.js, SocketTokenStorage.js, dirs queue/ service/ socket/ web/ logger/	mapped + sampled
client/	Browser source compiled into web/ bundles: engine/ features/ ui/ resources/ utils/ assets/ (Dust pages, stylus, MVC engine)	dir-mapped
engines/	First-party build & render engines: build/ dust/ twig/ translator/ util/	mapped + read build/build.js
bin/	CLI tasks: build/ script/ style/ watch/ credits (see §5)	all read
customization/	Per-tenant override layer: ui/ server/ translations/ customization-security/ customization-maintenance/, customizations.js, branding-options.json, RELEASE.md	mapped + read
web/	Build output + static assets served by nginx: entry/ font/ img/ libs/, 502.html, robots.txt (excluded from Sonar)	dir-mapped
security/	Monthly security audit notes (YYYY-MM-DD.md, 34 files)	dir-listed
maintenance/	Monthly maintenance notes (YYYY-MM-DD.md, 34 files)	dir-listed
logs/	Runtime log dir (just .gitkeep)	listed
.github/workflows/	pull-request.yaml CI (lint/audit/sonar/build)	read
.agents/ao/	AgentOps scaffolding dir (empty)	listed
Root configs	.babelrc, .browserslistrc, .editorconfig, eslint.config.mjs, sonar-project.properties, nginx_*.conf, supervisor_*.conf, changelog.md, CREDITS.html, PULL_REQUEST_TEMPLATE.md	listed/sampled

5. Helper scripts under bin/

All read line-by-line. There are no shebang CLI binaries except bin/credits; the others are Node modules invoked via node bin/.... bin/readme.md = "Project related CLI commands."

• bin/build/build.js — pushes --no-exit, then Promise.all([script.task, style.task]); exits when done unless --watch. The build npm script’s engine.
• bin/script/script.task.js — declares the JS bundle targets: client/ui/pages/**/*.script.js, customization/ui/pages/**/*.script.js, customization/ui/layouts/**/*.layout.js, client/ui/layouts/**/*.layout.js → output web/js. Adds watch globs (client/**/*.js, customization/**/*.js, **/*.dust) under --watch. Delegates to engines/build/build.
• bin/script/script.compiler.js — single-file compiler: browserify (noParse: ['./'], browserifyDust transform, browserify-require-not-found-parent plugin) → optional @babel/core minify preset when config.build.minify.
• bin/style/style.task.js — declares the CSS bundle targets (5 bundles): pages, layouts, customization/ui/branding/**/*.branding.styl → web/branding, custom pages, custom layouts → mostly web/css. Watches client/**/*.styl, customization/**/*.styl, customization/branding-options.json under --watch; live-reloads *.css.
• bin/style/style.compiler.js — single-file stylus compiler: imports client/ui/styles/global.styl, injects breakpoints/device-sizes/colors and branding resources+values as stylus vars, runs @techteamer/poststylus + autoprefixer, optional clean-css minify + inline source maps.
• bin/watch/watch.js — three lines: forces --watch and requires both script.task and style.task (the watch npm script).
• bin/credits — #!/usr/bin/env node; runs license-checker over deps and prints an HTML <table> of name/license/url/publisher → piped into CREDITS.html.

6. Key modules / services / entities

Boot & DI

• server/serviceContainer.js — exports a singleton { emitter: ServiceBus }. ServiceBus extends WildEmitter and implements the customization hook system: addHook/callHooks (multi-handler, parallel via Promise.all), registerOverride/callOverride (single route override with default fallback), callOnlyHook. This is the backbone of customization-architecture.
• server/logger.js — log4js config; channels esign|express|session|csp; appenders console always, plus file|syslog|papertrail when configured; throws on any unsupported logging.* appender key (server/logger.js:70-74).
• server/SocketTokenStorage.js — in-memory Map of userId → randomUUID socket tokens (stored on the container at server.js:63).

RabbitMQ wiring (server.js:70-143) — the heart of CSS

Built from config.queue via @techteamer/mq QueueManager. On connection close → process.exit(2).

• RPC servers (CSS answers): esign:css-ping (Ping), esign:rpc-system-oss (SystemOss).
• RPC clients (CSS calls backend): esign:rpc-jwt-auth (JwtAuth), esign:rpc-app (App), esign:rpc-customer (Customer), esign:rpc-timestamp (Timestamp), esign:rpc-document (Document), esign:rpc-contract (Contract), esign:rpc-offer (Offer), esign:rpc-signature (Signature); plus signaturecheck client only when features.browserSignature.
• Queue servers (CSS consumes): esign:queue-service-bus (ServiceBus), esign:queue-customer (Customer), contract.
• Queue clients (CSS publishes): queue-clienterror-log (ClientErrorLog).
• server/queue/{QueueError,QueueMessage,QueueReply}.js are the shared status/error envelope used throughout the API layer (e.g. QueueReply.STATUS_ERROR, QueueError.ERR_INVALID_SESSION/ERR_SESSION_EXPIRED/ERR_SESSION_BLOCKED/ERR_NOT_FOUND/ERR_APP_OUTDATED).
• server/queue/rpc_server/SystemOss.js — answers getConfig by returning a sanitized copy of the whole CSS config (strips getconfig) — lets the OSS read CSS config over the bus.

Services (server.js:145-195, instantiated into serviceContainer.service.*)

All under server/service/. Conditionals on features.browserSignature: CompatibilityService, SignatureCheckService are only created when enabled.

• SocketService, TokenService, SessionService, DisasterModeService, IpFilterService, BrandingService, AppService, CustomerService, SignatureService, TimestampService, DocumentService, ContractService, OfferService (+ CompatibilityService, SignatureCheckService).
• TokenService.loadKeyStore() is awaited at boot (server.js:186-191); failure aborts startup (“Unable to initialize token keystore”).
• SessionService — generateSession: jwt.sign(sessionData, session.secret) → TokenService.encrypt (JWE). resolveSession: decrypt → jwt.verify. The app session token rides in cookie app_session_token or a Bearer token.
• BrandingService — also used standalone by the build (engines/build/build.js:7-8, bin/style/style.task.js branding bundle) to feed branding vars into stylus; setupCustomizations() is called before bundling.

Web layer (server/web/)

• server/web/web-server.js — builds the Express app. Key middleware order: per-request nonce (UUID) → user-agent/browser detection (only when browserSignature) → helmet() + nocache() + referrerPolicy('origin') → body parsers (50mb; special application/csp-report handler) → cookie-parser → locale → express-bearer-token. CSP-report sink at POST /report-violation. Redis-backed session (only when browserSignature) with a 3-try session-lookup retry and an iOS-12 sameSite=false cookie workaround. Twig render engine attached via engines/twig/render-server. 404 → redirect to portal.url for HTML, else 404. Trailing 400 error handler (“Something broke into 400 pieces!”).
• server/web/routes.js — the full route table (read in full). Defines reusable middleware: handleDisaster() (disaster-mode → redirect/404), resolveSession() (bearer or app_session_token cookie → req.appSessionData), requireSession(), registerBrowser() (calls appService.registerApp/updateApp, issues app_session_token), csp() (per-request helmet.contentSecurityPolicy with nonce, sandbox, allowPopups/allowDownloads from config, live-reload exceptions), csrfProtection (csurf cookie-based, only for appType === 'browser'). IP-filtered endpoints: /api/customer/2f-auth and /api/signature/resend-token. Many page routes are wrapped in emitter.callOverride('routes:<name>', ...) so customizations can replace them.
• server/web/api/** — ~30 endpoint modules grouped by domain (app/ customer/ contract/ document/ offer/ signature/ timestamp/ site/ + pre-check.js, sentry.js). Each is a thin (req,res) handler that validates input, calls a serviceContainer.service.* method (which RPCs the backend), maps QueueError.* → HTTP status, and replies via ApiResponse. Representative: server/web/api/signature/m1.js (sends customer public key, persists req.session.authToken to throttle SMS tokens, returns {signatureId, token}).
• server/web/routes/*.endpoint.js — server-rendered Twig pages (homepage, token-check, offer-sign, offer-signed/refused, waiting-for-offer/contract, agreement-checks, system-check, goodbye, download-contract, ui-kit, apple-app-site-association).
• server/web/Template.js — render helper: resolves the page’s web/js, web/css, branding CSS, and .trans.js dictionary (engines/translator/Dictionary), injects config, locale, branding, CSRF token, optional browser-sync live-reload path; res.render(templatePath, this).

Socket layer (server/socket/)

• socket-server.js — start() wraps socket.io(httpServer, config.web.socket); setupEvents() loads modules client, events/auth, events/pagevisit, events/ping, lets customizations push more via callHooks('socket', modules), and binds each on connection.

Client & engines (compiled into web/)

• client/ — a custom browser MVC framework: client/engine/{controller,view,service,network,message,metadata,radio}, client/features/{signature,socket,socket-ping,system-check,webrtc}, client/ui/{pages,layouts,elements,regions,screens,states,styles,libs}, client/resources/{breakpoints,colors,device-sizes.json} (consumed by the stylus compiler). Surveyed structurally (see gaps).
• engines/build/ — build.js (watch/bundle orchestrator + path filtering by page name + branding setup), bundle.js, watch.js, livereload.js (browser-sync). engines/dust/ (client+server Dust render, helpers asset/script/style, filters). engines/twig/render-server.js (server Twig). engines/translator/Dictionary.js (i18n). engines/util/ (date/filesize/timestamp/zeropad/inheritance filters).

7. Configuration

• Loader: config.js requires getconfig, which selects config/<NODE_ENV>.json (config/dev.json, config/docker.json). config.js adds a custom SyntaxError pretty-printer for malformed config JSON (prints the offending substring, process.exit(2)), config.get(path) / config.has(path) helpers (dot-paths), dev-host defaulting, and secure-by-default CORS/socket.io rewrites (turns origin: '*' into the CSS host). No AJV/JSON-schema validation was found (the only validation is the appender-name check in server/logger.js).
• Spring Cloud Config (optional): if config.springCloudConfigServer is set, config.js loads remote config via cloud-config-client with promise-retry, merging keys with dot-object; config.loaded is the promise the boot chain awaits (config.js:68-97, server.js:245).
• Key config keys (from config/dev.json / config/docker.json):
  • portal.url / urlForExternals — where unauthenticated/404 traffic redirects; agreementUrls (FaceKom trust-service PDFs).
  • web.socketioSettings, web.socket (Socket.IO server opts incl. allowEIO3), web.csp.allowPopups/allowDownloads, web.trustedProxy (loopback, linklocal, uniquelocal).
  • session.{secret,expiryPeriod:'1y',redis.socket.path,name:'esignsid'}.
  • security.ipFilter.{suppressAfterAttempts:5, throttlePeriodMs:60000, coolDownPeriodMs:1800000}.
  • hosts.{css,oss}.
  • app.{appleAppId, compatibleAppVersion, legacySocketio}.
  • browsers.{compatible,incompatible} — large UA/version allow/deny matrix driving CompatibilityService.
  • features.{browserSignature, offerRefuseReason, offerPackage, authTokenResend, requireSignaturePhoto} — feature flags that gate services, routes, and socket server. All five keys are present in both dev.json and docker.json: in dev.json all five are true; in docker.json the first four (browserSignature, offerRefuseReason, offerPackage, authTokenResend) are false while requireSignaturePhoto is true.
  • queue.{url:'amqps://...:5671', options.{cert,key,ca}, rpcTimeoutMs:60000, rpcQueueMaxSize:100} — mTLS client certs under /workspace/vuer_mq_cert/....
  • timezone:'Europe/Budapest', locales.{supported:['hu'],default:'hu'}.
  • jwt.{secret,expiryPeriod:'24h',keystore} (note: an oct keystore key is committed in config — dev/default value).
  • build.{generateSourceMaps, minify, forceCleanCache, liveReloadSettings, uikit} — drives the bundlers.
• Env vars (verified usages): NODE_ENV (selects config + Template.isDev + app.json profile in supervisor), DEV_DOMAIN (dev host derivation, config.js:40), NODE_TLS_REJECT_UNAUTHORIZED (set to '0' when settings.allowSelfSignedCerts, server.js:54-56), TZ (forced to Etc/UTC, server.js:52). Supervisor injects ENV_APP_HOME, ENV_DOCKER_USER (supervisor_*.conf).

8. Tests

There is effectively no automated test suite.

• package.json test script runs ESLint only (eslint . --quiet --ignore-pattern "test/*"). There is no Jest/Mocha runner wired, even though eslint-plugin-jest is a devDependency and sonar-project.properties excludes test/** / customization/test/**.
• No test/ directory exists at the repo root (the eslint ignore-pattern test/* is defensive). The Sonar exclusions (server/__mocks__/**, customization/test/**) reference paths that are not present on devel.
• CI does not run tests — .github/workflows/pull-request.yaml jobs are: lint (yarn lint), audit (yarn audit + improved-yarn-audit --min-severity critical), sonar (SonarCloud scan, project TechTeamer_esign_css), and build (yarn build, gated on the prior three). “How to run”: yarn lint for static checks; yarn build to verify bundles compile.

9. Dependencies on other FaceKom services

Evidenced only in code/config:

• RabbitMQ (eSign queue bus) — central dependency. mTLS AMQPS at config.queue.url (amqps://localhost:5671 dev / amqps://rabbitmq:5671 docker) with certs from /workspace/vuer_mq_cert/.... CSS connects via @techteamer/mq (server.js:71); losing the connection kills the process (server.js:78-82). Queues/RPC names CSS depends on (all read from server.js:84-128):
  • Calls RPC: esign:rpc-jwt-auth, esign:rpc-app, esign:rpc-customer, esign:rpc-timestamp, esign:rpc-document, esign:rpc-contract, esign:rpc-offer, esign:rpc-signature (+ signaturecheck).
  • Serves RPC: esign:css-ping, esign:rpc-system-oss (consumed by the OSS).
  • Consumes queues: esign:queue-service-bus, esign:queue-customer, contract.
  • Publishes queue: queue-clienterror-log. These backend RPC handlers live in sibling eSign services (the OSS and core eSign backend), not in this repo. See architecture-overview / vuer_oss.
• Redis — session store (connect-redis) and run as a supervised process; unix socket /var/run/redis/redis-server.sock (config/*.json:44-48, supervisor_*.conf [program:redis]). Only used when features.browserSignature is on (server/web/web-server.js:99-116).
• nginx — reverse proxy / static file server in front of CSS (nginx_*.conf, supervisor_*.conf [program:nginx]), port 30180 → :10183/:10184.
• Spring Cloud Config server — optional remote config source (config.js:68-97) if springCloudConfigServer is configured.
• Portal — portal.url is the redirect target for unauthenticated/disaster/404 HTML traffic (server/web/routes.js, config.js:54-56).
• No direct SQL/DB — CSS has no database client; all persistence is delegated over the queue bus. (sonar-project.properties lists db/** exclusions but no db/ dir exists on devel.)

10. Verified gotchas

Working tree ≠ product

The checked-out branch update/customization/instacash-2026-05-27 carries Instacash/MBH overrides: customization/customizations.js registers route overrides for waiting-for-contract, goodbye, offer-signed, offer-refused (all → offer-signed.endpoint), and branding-options.json points logos at mbh_logo*. The devel customizations.js is an empty template (verified via git show devel:). Always check which branch you’re on. See customization-branch-catalog.

Process exits with code 2 on many failures

Boot failures, RabbitMQ disconnect, malformed config JSON, and uncaught startup errors all process.exit(2) — supervisor treats 0,2 as clean exits and restarts. A crash-loop will look “healthy” to supervisor.

browserSignature feature flag is load-bearing

When features.browserSignature is false, the Socket.IO server, Redis sessions, Twig rendering, browser/UA detection, and all public page routes are disabled — CSS degrades to a bare JSON API. web-server.js even warns about a “404 loop” if portal.url === '/' with the flag off (server/web/web-server.js:232-235).

Secrets committed as dev defaults

session.secret, jwt.secret, and a JWK in jwt.keystore are committed in config/dev.json & config/docker.json. These are environment defaults expected to be overridden (e.g. via Spring Cloud Config) in real deployments — do not treat as production secrets.

Express 5 / dependency-major churn

The repo recently moved to Express 5, jQuery 3.7/4, connect-redis v9, redis v5, body-parser 2, helmet 8 (see changelog.md, customization/RELEASE.md, recent commits f20fba7/71fb0fd/9cce25f). Several fixes are Express-5 compat (res.sendStatus vs res.send(statusCode)) and connect-redis v9 named RedisStore export — keep this in mind when porting code from older eSign repos.

Unverified / gaps

• client/ tree (browser MVC framework) — mapped structurally (all dirs listed in §4/§6) but not read line-by-line: client/engine/*, client/features/{signature,webrtc,socket,system-check}, client/ui/{pages,layouts,elements,screens,states}. The build targets and compilers were fully read; the page/feature implementations were not.
• engines/ internals — engines/build/build.js read in full; bundle.js, livereload.js, dust/*, twig/render-server.js, translator/Dictionary.js, util/* were mapped/named but not read line-by-line.
• Individual server/web/api/** handlers — the routing table and one representative handler (signature/m1.js) were read; the other ~29 handlers were enumerated but not each read in full. Their pattern is uniform (validate → service RPC → QueueError→HTTP map → ApiResponse).
• Individual server/service/* and server/queue/** files — SessionService, SystemOss, JwtAuth read in full; the remaining services/RPC clients were enumerated from server.js wiring but not each opened.
• security/ and maintenance/ notes (34 files each) — listed by name only, not read.
• No JSON-schema/AJV config validation was found; if one exists it is not in this repo on devel.

Sources

Files/dirs actually opened:

• package.json, README.md, changelog.md, config.js, server.js
• config/dev.json, config/docker.json
• server/serviceContainer.js, server/logger.js, server/SocketTokenStorage.js
• server/web/web-server.js, server/web/routes.js, server/web/Template.js, server/web/api/signature/m1.js
• server/service/SessionService.js
• server/queue/rpc_server/SystemOss.js, server/queue/rpc_client/JwtAuth.js
• server/socket/socket-server.js
• bin/readme.md, bin/credits, bin/build/build.js, bin/script/script.task.js, bin/script/script.compiler.js, bin/style/style.task.js, bin/style/style.compiler.js, bin/watch/watch.js
• engines/build/build.js
• customization/customizations.js (working tree + git show devel:), customization/RELEASE.md, customization/branding-options.json
• nginx_dev.conf, nginx_docker.conf (diff), supervisor_dev.conf, supervisor_docker.conf (diff)
• .github/workflows/pull-request.yaml, sonar-project.properties, .yarnrc, .browserslistrc
• Directory listings: repo root, bin/, client/, config/, customization/, engines/, server/ (+ queue/ service/ socket/ web/), web/, security/, maintenance/, .github/, .agents/
• Git: git branch -a, git log (devel + working branch), git ls-tree -r devel (Dockerfile check)