@futdevpro/nts-dynamo 1.15.140 → 1.15.142

package/src/_modules/privacy-lifecycle/privacy-lifecycle.control-service.ts

@@ -0,0 +1,586 @@
+import {
+  createHash,
+  randomUUID
+} from 'crypto';
+
+import { DyFM_Error } from '@futdevpro/fsm-dynamo';
+
+import { DyNTS_global_settings } from '../../_collections/global-settings.const';
+import { DyNTS_PrivacyContributorAction_Type } from './_enums/privacy-contributor-action.type-enum';
+import { DyNTS_PrivacyContributorOutcome_Type } from './_enums/privacy-contributor-outcome.type-enum';
+import { DyNTS_PrivacyRequestState_Type } from './_enums/privacy-request-state.type-enum';
+import { DyNTS_PrivacyRequest_Type } from './_enums/privacy-request.type-enum';
+import { DyNTS_PrivacyContributorContext_Interface } from './_models/privacy-contributor-context.interface';
+import { DyNTS_PrivacyContributorOutcome_Interface } from './_models/privacy-contributor-outcome.interface';
+import { DyNTS_PrivacyContributorPlan_Interface } from './_models/privacy-contributor-plan.interface';
+import { DyNTS_PrivacyContributor_Interface } from './_models/privacy-contributor.interface';
+import { DyNTS_PrivacyLifecycleAdapter_Interface } from './_models/privacy-lifecycle-adapter.interface';
+import { DyNTS_PrivacyLifecycleSettings_Interface } from './_models/privacy-lifecycle-settings.interface';
+import { DyNTS_PrivacyRequestCreateResult_Interface } from './_models/privacy-request-create-result.interface';
+import { DyNTS_PrivacyRequestOpen_Interface } from './_models/privacy-request-open.interface';
+import {
+  DyNTS_PrivacyRequestPersistenceCreateResult_Interface
+} from './_models/privacy-request-persistence-create-result.interface';
+import { DyNTS_PrivacyRequestRecord_Interface } from './_models/privacy-request-record.interface';
+import { DyNTS_PrivacyRequestResult_Interface } from './_models/privacy-request-result.interface';
+import { DyNTS_PrivacyRequestView_Interface } from './_models/privacy-request-view.interface';
+
+/** Coordinates identity-gated, resumable data-subject requests across product-owned data contributors. */
+export class DyNTS_PrivacyLifecycle_ControlService {
+  private readonly adapter: DyNTS_PrivacyLifecycleAdapter_Interface;
+  private readonly contributors: DyNTS_PrivacyContributor_Interface[];
+  private readonly clock: () => Date;
+
+  /** Creates an orchestrator with a stable contributor registry. */
+  constructor(set: DyNTS_PrivacyLifecycleSettings_Interface) {
+    this.adapter = set.adapter;
+    this.contributors = [ ...set.contributors ]
+      .sort((first: DyNTS_PrivacyContributor_Interface, second: DyNTS_PrivacyContributor_Interface): number => (
+        first.contributorId.localeCompare(second.contributorId)
+      ));
+    this.clock = set.clock ?? ((): Date => new Date());
+    this.validateSettings();
+  }
+
+  /** Opens or safely replays a subject-scoped request without persisting the raw idempotency key. */
+  public async openRequest(
+    set: DyNTS_PrivacyRequestOpen_Interface
+  ): Promise<DyNTS_PrivacyRequestCreateResult_Interface> {
+    if (
+      !this.isBoundedText(set.subjectId, 256)
+      || !this.isBoundedText(set.organizationId, 256)
+      || !Object.values(DyNTS_PrivacyRequest_Type).includes(set.type)
+    ) {
+      throw this.buildError(400, 'REQUEST_INVALID', 'The privacy request is invalid.');
+    }
+
+    if (
+      !this.isBoundedText(set.idempotencyKey, 256)
+      || !this.isFutureDate(set.deadlineAt)
+    ) {
+      throw this.buildError(400, 'IDEMPOTENCY_KEY_INVALID', 'The privacy request key is invalid.');
+    }
+
+    const createdAt: string = this.clock().toISOString();
+    const request: DyNTS_PrivacyRequestRecord_Interface = {
+      requestId: randomUUID(),
+      subjectId: set.subjectId,
+      organizationId: set.organizationId,
+      type: set.type,
+      state: DyNTS_PrivacyRequestState_Type.received,
+      idempotencyHash: this.hashIdempotency(set),
+      revision: 0,
+      createdAt: createdAt,
+      deadlineAt: set.deadlineAt,
+      identityVerifiedAt: '',
+      scopedAt: '',
+      plannedAt: '',
+      executionStartedAt: '',
+      verifyingStartedAt: '',
+      completedAt: '',
+    };
+
+    const result: DyNTS_PrivacyRequestPersistenceCreateResult_Interface =
+      await this.adapter.createOrGetRequest(request);
+
+    if (
+      result.request.idempotencyHash !== request.idempotencyHash
+      || result.request.subjectId !== request.subjectId
+      || result.request.organizationId !== request.organizationId
+      || result.request.type !== request.type
+    ) {
+      throw this.buildError(409, 'IDEMPOTENCY_CONFLICT', 'The idempotency key belongs to another request.');
+    }
+
+    return { request: this.toRequestView(result.request), created: result.created };
+  }
+
+  /** Marks request identity verified after the application has completed its security challenge. */
+  public async verifyIdentity(
+    requestId: string,
+    subjectId: string
+  ): Promise<DyNTS_PrivacyRequestView_Interface> {
+    const request: DyNTS_PrivacyRequestRecord_Interface = await this.requireOwnedRequest(requestId, subjectId);
+
+    if (request.state === DyNTS_PrivacyRequestState_Type.identityVerified) {
+      return this.toRequestView(request);
+    }
+
+    if (request.state !== DyNTS_PrivacyRequestState_Type.received) {
+      throw this.buildError(409, 'IDENTITY_STATE_CONFLICT', 'The request cannot be identity-verified now.');
+    }
+
+    const replacement: DyNTS_PrivacyRequestRecord_Interface = await this.replaceState(
+      request,
+      DyNTS_PrivacyRequestState_Type.identityVerified,
+      {
+        identityVerifiedAt: this.clock().toISOString(),
+      }
+    );
+
+    return this.toRequestView(replacement);
+  }
+
+  /** Executes or resumes all contributors and never reports complete while one contributor failed. */
+  public async processRequest(
+    requestId: string,
+    subjectId: string
+  ): Promise<DyNTS_PrivacyRequestResult_Interface> {
+    let request: DyNTS_PrivacyRequestRecord_Interface = await this.requireOwnedRequest(requestId, subjectId);
+
+    if (request.state === DyNTS_PrivacyRequestState_Type.completed) {
+      return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
+    }
+
+    if (
+      request.state !== DyNTS_PrivacyRequestState_Type.identityVerified
+      && request.state !== DyNTS_PrivacyRequestState_Type.scoped
+      && request.state !== DyNTS_PrivacyRequestState_Type.planned
+      && request.state !== DyNTS_PrivacyRequestState_Type.executing
+      && request.state !== DyNTS_PrivacyRequestState_Type.verifying
+      && request.state !== DyNTS_PrivacyRequestState_Type.partiallyCompleted
+    ) {
+      throw this.buildError(409, 'EXECUTION_STATE_CONFLICT', 'The request is not ready for execution.');
+    }
+
+    if (request.state === DyNTS_PrivacyRequestState_Type.identityVerified) {
+      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.scoped, {
+        scopedAt: this.clock().toISOString(),
+      });
+    }
+
+    const context: DyNTS_PrivacyContributorContext_Interface = this.buildContext(request);
+    let plans: DyNTS_PrivacyContributorPlan_Interface[] = await this.adapter.listContributorPlans(request.requestId);
+
+    this.validateStoredPlans(plans);
+
+    if (
+      request.state === DyNTS_PrivacyRequestState_Type.scoped
+      || request.state === DyNTS_PrivacyRequestState_Type.partiallyCompleted
+    ) {
+      await this.planMissingContributors(request.requestId, context, plans);
+      plans = await this.adapter.listContributorPlans(request.requestId);
+      this.validateStoredPlans(plans);
+
+      if (!this.hasAllContributorPlans(plans)) {
+        request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.partiallyCompleted, {
+          completedAt: '',
+        });
+
+        return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
+      }
+
+      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.planned, {
+        plannedAt: this.clock().toISOString(),
+      });
+    }
+
+    if (request.state === DyNTS_PrivacyRequestState_Type.planned) {
+      this.validateStoredPlans(plans);
+      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.executing, {
+        executionStartedAt: request.executionStartedAt || this.clock().toISOString(),
+        completedAt: '',
+      });
+    }
+
+    if (request.state === DyNTS_PrivacyRequestState_Type.executing) {
+      await this.executeMissingContributors(request.requestId, context, plans);
+      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.verifying, {
+        verifyingStartedAt: this.clock().toISOString(),
+      });
+    }
+
+    let outcomes: DyNTS_PrivacyContributorOutcome_Interface[] =
+      await this.adapter.listContributorOutcomes(request.requestId);
+
+    if (request.state === DyNTS_PrivacyRequestState_Type.verifying) {
+      await this.verifyContributorOutcomes(context, plans, outcomes);
+      outcomes = await this.adapter.listContributorOutcomes(request.requestId);
+    }
+
+    const isComplete: boolean = this.contributors.every((contributor: DyNTS_PrivacyContributor_Interface): boolean => (
+      outcomes.some((outcome: DyNTS_PrivacyContributorOutcome_Interface): boolean => (
+        outcome.contributorId === contributor.contributorId
+        && outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed
+      ))
+    ));
+    const finalState: DyNTS_PrivacyRequestState_Type = isComplete
+      ? DyNTS_PrivacyRequestState_Type.completed
+      : DyNTS_PrivacyRequestState_Type.partiallyCompleted;
+
+    request = await this.replaceState(request, finalState, {
+      completedAt: isComplete ? this.clock().toISOString() : '',
+    });
+
+    return this.buildResult(request, outcomes);
+  }
+
+  /** Returns an owned request and its content-free contributor outcomes. */
+  public async getRequest(
+    requestId: string,
+    subjectId: string
+  ): Promise<DyNTS_PrivacyRequestResult_Interface> {
+    const request: DyNTS_PrivacyRequestRecord_Interface = await this.requireOwnedRequest(requestId, subjectId);
+
+    return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
+  }
+
+  private async planMissingContributors(
+    requestId: string,
+    context: DyNTS_PrivacyContributorContext_Interface,
+    existingPlans: DyNTS_PrivacyContributorPlan_Interface[]
+  ): Promise<void> {
+    const plannedContributorIds: Set<string> = new Set(existingPlans.map((
+      plan: DyNTS_PrivacyContributorPlan_Interface
+    ): string => plan.contributorId));
+
+    for (const contributor of this.contributors) {
+      if (plannedContributorIds.has(contributor.contributorId)) {
+        continue;
+      }
+
+      try {
+        const plan: DyNTS_PrivacyContributorPlan_Interface = await contributor.plan(context);
+
+        this.validatePlan(contributor, plan);
+        await this.adapter.saveContributorPlan(requestId, plan);
+      } catch (error: unknown) {
+        await this.adapter.saveContributorOutcome(requestId, this.buildFailedOutcome(
+          contributor.contributorId,
+          DyNTS_PrivacyContributorAction_Type.noData,
+          error instanceof DyFM_Error ? 'CONTRIBUTOR_PLAN_INVALID' : 'CONTRIBUTOR_PLAN_FAILED'
+        ));
+      }
+    }
+  }
+
+  private async executeMissingContributors(
+    requestId: string,
+    context: DyNTS_PrivacyContributorContext_Interface,
+    plans: DyNTS_PrivacyContributorPlan_Interface[]
+  ): Promise<void> {
+    const existing: DyNTS_PrivacyContributorOutcome_Interface[] =
+      await this.adapter.listContributorOutcomes(requestId);
+    const completedContributorIds: Set<string> = new Set();
+
+    for (const contributor of this.contributors) {
+      const plan: DyNTS_PrivacyContributorPlan_Interface | undefined = plans.find((
+        item: DyNTS_PrivacyContributorPlan_Interface
+      ): boolean => item.contributorId === contributor.contributorId);
+      const outcome: DyNTS_PrivacyContributorOutcome_Interface | undefined = existing.find((
+        item: DyNTS_PrivacyContributorOutcome_Interface
+      ): boolean => item.contributorId === contributor.contributorId);
+
+      if (plan && outcome && this.isValidCompletedOutcome(contributor, plan, outcome)) {
+        completedContributorIds.add(contributor.contributorId);
+      }
+    }
+
+    for (const contributor of this.contributors) {
+      if (completedContributorIds.has(contributor.contributorId)) {
+        continue;
+      }
+
+      const plan: DyNTS_PrivacyContributorPlan_Interface | undefined = plans.find((
+        item: DyNTS_PrivacyContributorPlan_Interface
+      ): boolean => item.contributorId === contributor.contributorId);
+      const outcome: DyNTS_PrivacyContributorOutcome_Interface = plan
+        ? await this.executeContributor(contributor, context, plan)
+        : this.buildFailedOutcome(
+          contributor.contributorId,
+          DyNTS_PrivacyContributorAction_Type.noData,
+          'CONTRIBUTOR_PLAN_MISSING'
+        );
+
+      await this.adapter.saveContributorOutcome(requestId, outcome);
+    }
+  }
+
+  private async executeContributor(
+    contributor: DyNTS_PrivacyContributor_Interface,
+    context: DyNTS_PrivacyContributorContext_Interface,
+    plan: DyNTS_PrivacyContributorPlan_Interface
+  ): Promise<DyNTS_PrivacyContributorOutcome_Interface> {
+    try {
+      const outcome: DyNTS_PrivacyContributorOutcome_Interface = await contributor.execute(context, plan);
+
+      this.validateOutcome(contributor, plan, outcome);
+
+      return { ...outcome };
+    } catch (error: unknown) {
+      return this.buildFailedOutcome(
+        contributor.contributorId,
+        plan.action,
+        error instanceof DyFM_Error ? 'CONTRIBUTOR_CONTRACT_FAILED' : 'CONTRIBUTOR_EXECUTION_FAILED'
+      );
+    }
+  }
+
+  private async verifyContributorOutcomes(
+    context: DyNTS_PrivacyContributorContext_Interface,
+    plans: DyNTS_PrivacyContributorPlan_Interface[],
+    outcomes: DyNTS_PrivacyContributorOutcome_Interface[]
+  ): Promise<void> {
+    for (const contributor of this.contributors) {
+      const outcome: DyNTS_PrivacyContributorOutcome_Interface | undefined = outcomes.find((
+        item: DyNTS_PrivacyContributorOutcome_Interface
+      ): boolean => item.contributorId === contributor.contributorId);
+      const plan: DyNTS_PrivacyContributorPlan_Interface | undefined = plans.find((
+        item: DyNTS_PrivacyContributorPlan_Interface
+      ): boolean => item.contributorId === contributor.contributorId);
+
+      if (!outcome || outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.failed || !plan) {
+        continue;
+      }
+
+      try {
+        this.validateOutcome(contributor, plan, outcome);
+
+        if (!await contributor.verify(context, outcome)) {
+          await this.adapter.saveContributorOutcome(context.requestId, this.buildFailedOutcome(
+            contributor.contributorId,
+            outcome.action,
+            'CONTRIBUTOR_VERIFY_FAILED'
+          ));
+        }
+      } catch {
+        await this.adapter.saveContributorOutcome(context.requestId, this.buildFailedOutcome(
+          contributor.contributorId,
+          outcome.action,
+          'CONTRIBUTOR_VERIFY_FAILED'
+        ));
+      }
+    }
+  }
+
+  private validatePlan(
+    contributor: DyNTS_PrivacyContributor_Interface,
+    plan: DyNTS_PrivacyContributorPlan_Interface
+  ): void {
+    if (
+      plan.contributorId !== contributor.contributorId
+      || !this.isBoundedText(plan.contributorId, 128)
+      || !Object.values(DyNTS_PrivacyContributorAction_Type).includes(plan.action)
+      || (plan.action === DyNTS_PrivacyContributorAction_Type.retainWithBasis && !plan.retentionBasisCode)
+      || (plan.action !== DyNTS_PrivacyContributorAction_Type.retainWithBasis && !!plan.retentionBasisCode)
+    ) {
+      throw this.buildError(500, 'CONTRIBUTOR_PLAN_INVALID', 'A privacy contributor returned an invalid plan.');
+    }
+  }
+
+  private validateOutcome(
+    contributor: DyNTS_PrivacyContributor_Interface,
+    plan: DyNTS_PrivacyContributorPlan_Interface,
+    outcome: DyNTS_PrivacyContributorOutcome_Interface
+  ): void {
+    if (
+      outcome.contributorId !== contributor.contributorId
+      || outcome.action !== plan.action
+      || !Object.values(DyNTS_PrivacyContributorOutcome_Type).includes(outcome.outcome)
+      || !Number.isSafeInteger(outcome.processedRecordCount)
+      || outcome.processedRecordCount < 0
+      || (outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
+        && outcome.retentionBasisCode !== plan.retentionBasisCode)
+      || (outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
+        && !!outcome.retentionBasisCode)
+      || (outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.failed && !outcome.errorCode)
+      || (outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed && !!outcome.errorCode)
+      || (outcome.action === DyNTS_PrivacyContributorAction_Type.retainWithBasis
+        && outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
+        && outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed)
+      || (outcome.action !== DyNTS_PrivacyContributorAction_Type.retainWithBasis
+        && outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis)
+      || (!!outcome.artifactChecksum && !/^[a-f0-9]{64}$/u.test(outcome.artifactChecksum))
+      || !Number.isFinite(new Date(outcome.completedAt).getTime())
+    ) {
+      throw this.buildError(500, 'CONTRIBUTOR_OUTCOME_INVALID', 'A privacy contributor returned an invalid outcome.');
+    }
+  }
+
+  private buildFailedOutcome(
+    contributorId: string,
+    action: DyNTS_PrivacyContributorAction_Type,
+    errorCode: string
+  ): DyNTS_PrivacyContributorOutcome_Interface {
+    return {
+      contributorId: contributorId,
+      action: action,
+      outcome: DyNTS_PrivacyContributorOutcome_Type.failed,
+      retentionBasisCode: '',
+      artifactChecksum: '',
+      processedRecordCount: 0,
+      errorCode: errorCode,
+      completedAt: this.clock().toISOString(),
+    };
+  }
+
+  private async requireOwnedRequest(
+    requestId: string,
+    subjectId: string
+  ): Promise<DyNTS_PrivacyRequestRecord_Interface> {
+    const request: DyNTS_PrivacyRequestRecord_Interface | null = await this.adapter.findRequestById(requestId);
+
+    if (request?.subjectId !== subjectId) {
+      throw this.buildError(404, 'REQUEST_NOT_FOUND', 'The privacy request was not found.');
+    }
+
+    return request;
+  }
+
+  private async replaceState(
+    request: DyNTS_PrivacyRequestRecord_Interface,
+    state: DyNTS_PrivacyRequestState_Type,
+    dates: {
+      identityVerifiedAt?: string;
+      scopedAt?: string;
+      plannedAt?: string;
+      executionStartedAt?: string;
+      verifyingStartedAt?: string;
+      completedAt?: string;
+    }
+  ): Promise<DyNTS_PrivacyRequestRecord_Interface> {
+    const replacement: DyNTS_PrivacyRequestRecord_Interface = {
+      ...request,
+      ...dates,
+      state: state,
+      revision: request.revision + 1,
+    };
+    const didReplace: boolean = await this.adapter.replaceRequest(replacement, request.revision);
+
+    if (!didReplace) {
+      throw this.buildError(409, 'REQUEST_REVISION_CONFLICT', 'The privacy request changed concurrently.');
+    }
+
+    return replacement;
+  }
+
+  private buildContext(request: DyNTS_PrivacyRequestRecord_Interface): DyNTS_PrivacyContributorContext_Interface {
+    return {
+      requestId: request.requestId,
+      subjectId: request.subjectId,
+      organizationId: request.organizationId,
+      type: request.type,
+    };
+  }
+
+  private buildResult(
+    request: DyNTS_PrivacyRequestRecord_Interface,
+    outcomes: DyNTS_PrivacyContributorOutcome_Interface[]
+  ): DyNTS_PrivacyRequestResult_Interface {
+    if (outcomes.some((outcome: DyNTS_PrivacyContributorOutcome_Interface): boolean => (
+      !this.contributors.some((contributor: DyNTS_PrivacyContributor_Interface): boolean => (
+        contributor.contributorId === outcome.contributorId
+      ))
+    ))) {
+      throw this.buildError(500, 'CONTRIBUTOR_OUTCOME_UNKNOWN', 'An unknown contributor outcome was stored.');
+    }
+
+    return {
+      request: this.toRequestView(request),
+      outcomes: [ ...outcomes ].sort((
+        first: DyNTS_PrivacyContributorOutcome_Interface,
+        second: DyNTS_PrivacyContributorOutcome_Interface
+      ): number => (
+        first.contributorId.localeCompare(second.contributorId)
+      )),
+    };
+  }
+
+  private toRequestView(request: DyNTS_PrivacyRequestRecord_Interface): DyNTS_PrivacyRequestView_Interface {
+    return {
+      requestId: request.requestId,
+      subjectId: request.subjectId,
+      organizationId: request.organizationId,
+      type: request.type,
+      state: request.state,
+      revision: request.revision,
+      createdAt: request.createdAt,
+      deadlineAt: request.deadlineAt,
+      identityVerifiedAt: request.identityVerifiedAt,
+      scopedAt: request.scopedAt,
+      plannedAt: request.plannedAt,
+      executionStartedAt: request.executionStartedAt,
+      verifyingStartedAt: request.verifyingStartedAt,
+      completedAt: request.completedAt,
+    };
+  }
+
+  private hashIdempotency(set: DyNTS_PrivacyRequestOpen_Interface): string {
+    return createHash('sha256')
+      .update(`${set.subjectId}\u0000${set.organizationId}\u0000${set.type}\u0000${set.idempotencyKey}`)
+      .digest('hex');
+  }
+
+  private isFutureDate(value: string): boolean {
+    const timestamp: number = new Date(value).getTime();
+
+    return Number.isFinite(timestamp) && timestamp > this.clock().getTime();
+  }
+
+  private isBoundedText(value: string, maxLength: number): boolean {
+    return typeof value === 'string' && !!value && value.length <= maxLength && !value.includes('\u0000');
+  }
+
+  private hasAllContributorPlans(plans: DyNTS_PrivacyContributorPlan_Interface[]): boolean {
+    return this.contributors.every((contributor: DyNTS_PrivacyContributor_Interface): boolean => (
+      plans.some((plan: DyNTS_PrivacyContributorPlan_Interface): boolean => (
+        plan.contributorId === contributor.contributorId
+      ))
+    ));
+  }
+
+  private validateStoredPlans(plans: DyNTS_PrivacyContributorPlan_Interface[]): void {
+    for (const plan of plans) {
+      const contributor: DyNTS_PrivacyContributor_Interface | undefined = this.contributors.find((
+        item: DyNTS_PrivacyContributor_Interface
+      ): boolean => item.contributorId === plan.contributorId);
+
+      if (!contributor) {
+        throw this.buildError(500, 'CONTRIBUTOR_PLAN_UNKNOWN', 'An unknown privacy contributor plan was stored.');
+      }
+
+      this.validatePlan(contributor, plan);
+    }
+  }
+
+  private isValidCompletedOutcome(
+    contributor: DyNTS_PrivacyContributor_Interface,
+    plan: DyNTS_PrivacyContributorPlan_Interface,
+    outcome: DyNTS_PrivacyContributorOutcome_Interface
+  ): boolean {
+    try {
+      this.validateOutcome(contributor, plan, outcome);
+
+      return outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed;
+    } catch {
+      return false;
+    }
+  }
+
+  private validateSettings(): void {
+    const contributorIds: string[] = this.contributors.map((item: DyNTS_PrivacyContributor_Interface): string => (
+      item.contributorId
+    ));
+
+    if (
+      !this.adapter
+      || !this.contributors.length
+      || contributorIds.some((contributorId: string): boolean => !contributorId)
+      || new Set(contributorIds).size !== contributorIds.length
+    ) {
+      throw this.buildError(500, 'SETTINGS_INVALID', 'The privacy lifecycle settings are invalid.');
+    }
+  }
+
+  private buildError(status: number, errorCode: string, message: string): DyFM_Error {
+    return new DyFM_Error({
+      status: status,
+      errorCode: `${DyNTS_global_settings.systemShortCodeName}|PRIVACY_LIFECYCLE|${errorCode}`,
+      message: message,
+      userMessage: status < 500
+        ? message
+        : 'The privacy request could not be processed safely. Please try again later.',
+      issuerService: this.constructor.name,
+    });
+  }
+}

package/SKILLS.md

@@ -1,75 +0,0 @@
-# SKILLS.md — `dynamo-nts` tooling
-
-Ez a fájl a projektben **ténylegesen használt** CLI-ket és eszközöket írja le, hogy a coding agent
-(Codex / Claude Code) tudja, **mit mivel** kell futtatni. Kísérő fájlok: `CLAUDE.md` / `AGENTS.md`
-(szabályok + architektúra). Rule: `core-agent-file-sync`.
-
-> A `SKILLS:AUTO:BEGIN` … `SKILLS:AUTO:END` markerek közti rész **GENERÁLT** (forrás:
-> `__agent/scripts/skills-md-generate.ps1`; adat: a projekt `package.json`-jai, config-fájljai,
-> `__agent/scripts/` tartalma) — újrafuttatáskor **felülíródik**.
-> Az azon **kívüli** rész kézi és megőrződik: oda írd a projekt-specifikus jegyzeteket.
-
-<!-- SKILLS:AUTO:BEGIN -->
-## 1. Flotta-szintű CLI-k (mindenhol elérhetők)
-
-| CLI | Csomag | Mire való | Tipikus hívás |
-|---|---|---|---|
-| `dc` / `dyn-cli` | `@futdevpro/cli-dynamo` | Dynamo fejlesztői CLI: projekt-/kód-generálás, pipeline-futtatás, review, konvenció-validálás | `dc im` (interaktív), `dc cdp`, `dc ldp`, `dc rev --json` |
-| `fdp` / `fdp-cli` | `@futdevpro/fdp-cli` | DevOps + Overseer lekérdezés: deploy, runner, build-report, logok, errorok | `fdp build-detail --project <p>`, `fdp errors --range 24h`, `fdp deploy-service --services <n>` |
-| `dye2e` | `@futdevpro/dynamo-e2e` | E2E generátor + Visual-QA review-bundle | `dye2e generate-review-bundle`, `dye2e validate-manifest` |
-| `fam` | `fdp-agent-memory` (MCP `:39265`) | Tudás-keresés / recall / szabály-lekérés — **MINDEN feladat elején** (rule: `fam-use-preferentially`) | MCP `read` a `rules` / `documents` / `codebase` táron |
-| `pnpm` | — | **Az egyetlen** csomagkezelő a flottában (npm-kompatibilis) | `pnpm run prep`, `pnpm test` |
-
-**Alap-szabályok a CLI-kre** (kanonikus: `fdp-documentations/rules/fdp-global/`):
-- `fdp-use-existing-tooling` — a meglévő scriptet/CLI-t használd, ne írj sajátot mellé.
-- `fdp-cli-only` — a DevOps-műveletek az `fdp` CLI-n mennek, nem kézi docker/ssh parancsokon.
-- **Az NPM-scripteket ne bontsd szét** — a `pnpm test` már tartalmazza a build-lépést is.
-
-**Pipeline-ok:**
-- `dc ldp` — Live Dev Pipeline: felhúzza a LOKÁL instance-t és az ellen futtat (`pipeline.config.json`);
-  státusz: `server/logs/live-dev-pipeline/status.json`.
-- `dc cdp` — CI/CD Pipeline: a **deployolt test-szerver** ellen fut (`pipeline.cicd.config.json`).
-  A CI-t az **Overseer** vezérli, nem a GitHub Actions (az csak webhook-trigger).
-
-## 2. Ebben a projektben — MÉRT adatok
-
-> Forrás: a projekt `package.json`-jai, config-fájljai és `__agent/scripts/` tartalma, beolvasva a generáláskor.
-
-### 2.1 gyökér — `@futdevpro/nts-dynamo`
-
-
-| Script | Parancs |
-|---|---|
-| `pnpm run audit:eslintrc` | `dynamo-eslintrc-audit` |
-| `pnpm run build` | `npm run build-base && jasmine && npm publish` |
-| `pnpm run build-base` | `rimraf ./build && npx tsc` |
-| `pnpm run build-tgz` | `npm run build-base && jasmine && npm pack && move ./*.tgz ../tgz-collection/dynamo-nts` |
-| `pnpm run deploy` | `npm run build` |
-| `pnpm run ldp` | `dc ldp` |
-| `pnpm run lint` | `eslint src --ext .ts` |
-| `pnpm run lint:fix` | `eslint src --ext .ts --fix` |
-| `pnpm run prep` | `npm i -g pnpm rimraf nodemon && pnpm i` |
-| `pnpm run start` | `npm run prep && nodemon` |
-| `pnpm run start-clean` | `npm run clean && npm run start` |
-| `pnpm run test` | `npm run build-base && jasmine` |
-| `pnpm run test:coverage` | `npx c8 --reporter=html --reporter=text --reporter=lcov node scripts/run-coverage-tests.js` |
-| `pnpm run validate:imports` | `dynamo-validate-imports` |
-| `pnpm run validate:naming` | `dynamo-validate-naming` |
-
-**További scriptek (csak név):** `build-all` · `build-clean` · `build-n-test` · `build-simple` · `build-tgz-cheap` · `clean` · `clean-deploy` · `fix` · `fix:return-types` · `ldp:clear` · `ldp:status` · `ldp:stop` · `nodemon-run` · `prepare` · `preprep-setup-safechain-linux` · `preprep-setup-safechain-windows` · `start-first` · `test-clean`
-
-**Felismert eszközök a dependency-kből:** Dynamo ESLint konfiguráció (`@futdevpro/dynamo-eslint`) · ESLint (`eslint`) · Jasmine (unit teszt) (`jasmine`) · Socket.IO (`socket.io`) · TypeScript (`tsc`) (`typescript`)
-
-### Konfigurációk és belépési pontok (jelenlévő fájlok)
-
-- `.dynamo` — Dynamo CLI projekt-konfiguráció
-- `.github/workflows` — GitHub Actions (Overseer-migrált projektnél csak webhook-trigger)
-- `.husky` — Git hookok (pre-commit gate)
-- `__documentations` — Projekt-dokumentáció (ARCHITECTURE / DECISIONS / BEDROCK-FRS / CHANGELOG)
-<!-- SKILLS:AUTO:END -->
-
-## 3. Projekt-specifikus jegyzetek (KÉZI — a generátor nem írja felül)
-
-_Ide jön minden, amit mérésből nem lehet kiolvasni: buktatók, kötelező sorrendek, környezeti előfeltételek,
-credential-lelőhely, „ezt sose futtasd" figyelmeztetések. Ha itt üres, az annyit jelent: még nincs feljegyezve —
-NEM azt, hogy nincs ilyen (`core-no-guessing`)._