@futdevpro/nts-dynamo 1.15.151 → 1.15.153

package/src/_modules/privacy-lifecycle/privacy-lifecycle.control-service.ts

@@ -1,586 +1,586 @@
-import {
-  createHash,
-  randomUUID
-} from 'crypto';
-
-import { DyFM_Error } from '@futdevpro/fsm-dynamo';
-
-import { DyNTS_global_settings } from '../../_collections/global-settings.const';
-import { DyNTS_PrivacyContributorAction_Type } from './_enums/privacy-contributor-action.type-enum';
-import { DyNTS_PrivacyContributorOutcome_Type } from './_enums/privacy-contributor-outcome.type-enum';
-import { DyNTS_PrivacyRequestState_Type } from './_enums/privacy-request-state.type-enum';
-import { DyNTS_PrivacyRequest_Type } from './_enums/privacy-request.type-enum';
-import { DyNTS_PrivacyContributorContext_Interface } from './_models/privacy-contributor-context.interface';
-import { DyNTS_PrivacyContributorOutcome_Interface } from './_models/privacy-contributor-outcome.interface';
-import { DyNTS_PrivacyContributorPlan_Interface } from './_models/privacy-contributor-plan.interface';
-import { DyNTS_PrivacyContributor_Interface } from './_models/privacy-contributor.interface';
-import { DyNTS_PrivacyLifecycleAdapter_Interface } from './_models/privacy-lifecycle-adapter.interface';
-import { DyNTS_PrivacyLifecycleSettings_Interface } from './_models/privacy-lifecycle-settings.interface';
-import { DyNTS_PrivacyRequestCreateResult_Interface } from './_models/privacy-request-create-result.interface';
-import { DyNTS_PrivacyRequestOpen_Interface } from './_models/privacy-request-open.interface';
-import {
-  DyNTS_PrivacyRequestPersistenceCreateResult_Interface
-} from './_models/privacy-request-persistence-create-result.interface';
-import { DyNTS_PrivacyRequestRecord_Interface } from './_models/privacy-request-record.interface';
-import { DyNTS_PrivacyRequestResult_Interface } from './_models/privacy-request-result.interface';
-import { DyNTS_PrivacyRequestView_Interface } from './_models/privacy-request-view.interface';
-
-/** Coordinates identity-gated, resumable data-subject requests across product-owned data contributors. */
-export class DyNTS_PrivacyLifecycle_ControlService {
-  private readonly adapter: DyNTS_PrivacyLifecycleAdapter_Interface;
-  private readonly contributors: DyNTS_PrivacyContributor_Interface[];
-  private readonly clock: () => Date;
-
-  /** Creates an orchestrator with a stable contributor registry. */
-  constructor(set: DyNTS_PrivacyLifecycleSettings_Interface) {
-    this.adapter = set.adapter;
-    this.contributors = [ ...set.contributors ]
-      .sort((first: DyNTS_PrivacyContributor_Interface, second: DyNTS_PrivacyContributor_Interface): number => (
-        first.contributorId.localeCompare(second.contributorId)
-      ));
-    this.clock = set.clock ?? ((): Date => new Date());
-    this.validateSettings();
-  }
-
-  /** Opens or safely replays a subject-scoped request without persisting the raw idempotency key. */
-  public async openRequest(
-    set: DyNTS_PrivacyRequestOpen_Interface
-  ): Promise<DyNTS_PrivacyRequestCreateResult_Interface> {
-    if (
-      !this.isBoundedText(set.subjectId, 256)
-      || !this.isBoundedText(set.organizationId, 256)
-      || !Object.values(DyNTS_PrivacyRequest_Type).includes(set.type)
-    ) {
-      throw this.buildError(400, 'REQUEST_INVALID', 'The privacy request is invalid.');
-    }
-
-    if (
-      !this.isBoundedText(set.idempotencyKey, 256)
-      || !this.isFutureDate(set.deadlineAt)
-    ) {
-      throw this.buildError(400, 'IDEMPOTENCY_KEY_INVALID', 'The privacy request key is invalid.');
-    }
-
-    const createdAt: string = this.clock().toISOString();
-    const request: DyNTS_PrivacyRequestRecord_Interface = {
-      requestId: randomUUID(),
-      subjectId: set.subjectId,
-      organizationId: set.organizationId,
-      type: set.type,
-      state: DyNTS_PrivacyRequestState_Type.received,
-      idempotencyHash: this.hashIdempotency(set),
-      revision: 0,
-      createdAt: createdAt,
-      deadlineAt: set.deadlineAt,
-      identityVerifiedAt: '',
-      scopedAt: '',
-      plannedAt: '',
-      executionStartedAt: '',
-      verifyingStartedAt: '',
-      completedAt: '',
-    };
-
-    const result: DyNTS_PrivacyRequestPersistenceCreateResult_Interface =
-      await this.adapter.createOrGetRequest(request);
-
-    if (
-      result.request.idempotencyHash !== request.idempotencyHash
-      || result.request.subjectId !== request.subjectId
-      || result.request.organizationId !== request.organizationId
-      || result.request.type !== request.type
-    ) {
-      throw this.buildError(409, 'IDEMPOTENCY_CONFLICT', 'The idempotency key belongs to another request.');
-    }
-
-    return { request: this.toRequestView(result.request), created: result.created };
-  }
-
-  /** Marks request identity verified after the application has completed its security challenge. */
-  public async verifyIdentity(
-    requestId: string,
-    subjectId: string
-  ): Promise<DyNTS_PrivacyRequestView_Interface> {
-    const request: DyNTS_PrivacyRequestRecord_Interface = await this.requireOwnedRequest(requestId, subjectId);
-
-    if (request.state === DyNTS_PrivacyRequestState_Type.identityVerified) {
-      return this.toRequestView(request);
-    }
-
-    if (request.state !== DyNTS_PrivacyRequestState_Type.received) {
-      throw this.buildError(409, 'IDENTITY_STATE_CONFLICT', 'The request cannot be identity-verified now.');
-    }
-
-    const replacement: DyNTS_PrivacyRequestRecord_Interface = await this.replaceState(
-      request,
-      DyNTS_PrivacyRequestState_Type.identityVerified,
-      {
-        identityVerifiedAt: this.clock().toISOString(),
-      }
-    );
-
-    return this.toRequestView(replacement);
-  }
-
-  /** Executes or resumes all contributors and never reports complete while one contributor failed. */
-  public async processRequest(
-    requestId: string,
-    subjectId: string
-  ): Promise<DyNTS_PrivacyRequestResult_Interface> {
-    let request: DyNTS_PrivacyRequestRecord_Interface = await this.requireOwnedRequest(requestId, subjectId);
-
-    if (request.state === DyNTS_PrivacyRequestState_Type.completed) {
-      return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
-    }
-
-    if (
-      request.state !== DyNTS_PrivacyRequestState_Type.identityVerified
-      && request.state !== DyNTS_PrivacyRequestState_Type.scoped
-      && request.state !== DyNTS_PrivacyRequestState_Type.planned
-      && request.state !== DyNTS_PrivacyRequestState_Type.executing
-      && request.state !== DyNTS_PrivacyRequestState_Type.verifying
-      && request.state !== DyNTS_PrivacyRequestState_Type.partiallyCompleted
-    ) {
-      throw this.buildError(409, 'EXECUTION_STATE_CONFLICT', 'The request is not ready for execution.');
-    }
-
-    if (request.state === DyNTS_PrivacyRequestState_Type.identityVerified) {
-      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.scoped, {
-        scopedAt: this.clock().toISOString(),
-      });
-    }
-
-    const context: DyNTS_PrivacyContributorContext_Interface = this.buildContext(request);
-    let plans: DyNTS_PrivacyContributorPlan_Interface[] = await this.adapter.listContributorPlans(request.requestId);
-
-    this.validateStoredPlans(plans);
-
-    if (
-      request.state === DyNTS_PrivacyRequestState_Type.scoped
-      || request.state === DyNTS_PrivacyRequestState_Type.partiallyCompleted
-    ) {
-      await this.planMissingContributors(request.requestId, context, plans);
-      plans = await this.adapter.listContributorPlans(request.requestId);
-      this.validateStoredPlans(plans);
-
-      if (!this.hasAllContributorPlans(plans)) {
-        request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.partiallyCompleted, {
-          completedAt: '',
-        });
-
-        return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
-      }
-
-      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.planned, {
-        plannedAt: this.clock().toISOString(),
-      });
-    }
-
-    if (request.state === DyNTS_PrivacyRequestState_Type.planned) {
-      this.validateStoredPlans(plans);
-      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.executing, {
-        executionStartedAt: request.executionStartedAt || this.clock().toISOString(),
-        completedAt: '',
-      });
-    }
-
-    if (request.state === DyNTS_PrivacyRequestState_Type.executing) {
-      await this.executeMissingContributors(request.requestId, context, plans);
-      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.verifying, {
-        verifyingStartedAt: this.clock().toISOString(),
-      });
-    }
-
-    let outcomes: DyNTS_PrivacyContributorOutcome_Interface[] =
-      await this.adapter.listContributorOutcomes(request.requestId);
-
-    if (request.state === DyNTS_PrivacyRequestState_Type.verifying) {
-      await this.verifyContributorOutcomes(context, plans, outcomes);
-      outcomes = await this.adapter.listContributorOutcomes(request.requestId);
-    }
-
-    const isComplete: boolean = this.contributors.every((contributor: DyNTS_PrivacyContributor_Interface): boolean => (
-      outcomes.some((outcome: DyNTS_PrivacyContributorOutcome_Interface): boolean => (
-        outcome.contributorId === contributor.contributorId
-        && outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed
-      ))
-    ));
-    const finalState: DyNTS_PrivacyRequestState_Type = isComplete
-      ? DyNTS_PrivacyRequestState_Type.completed
-      : DyNTS_PrivacyRequestState_Type.partiallyCompleted;
-
-    request = await this.replaceState(request, finalState, {
-      completedAt: isComplete ? this.clock().toISOString() : '',
-    });
-
-    return this.buildResult(request, outcomes);
-  }
-
-  /** Returns an owned request and its content-free contributor outcomes. */
-  public async getRequest(
-    requestId: string,
-    subjectId: string
-  ): Promise<DyNTS_PrivacyRequestResult_Interface> {
-    const request: DyNTS_PrivacyRequestRecord_Interface = await this.requireOwnedRequest(requestId, subjectId);
-
-    return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
-  }
-
-  private async planMissingContributors(
-    requestId: string,
-    context: DyNTS_PrivacyContributorContext_Interface,
-    existingPlans: DyNTS_PrivacyContributorPlan_Interface[]
-  ): Promise<void> {
-    const plannedContributorIds: Set<string> = new Set(existingPlans.map((
-      plan: DyNTS_PrivacyContributorPlan_Interface
-    ): string => plan.contributorId));
-
-    for (const contributor of this.contributors) {
-      if (plannedContributorIds.has(contributor.contributorId)) {
-        continue;
-      }
-
-      try {
-        const plan: DyNTS_PrivacyContributorPlan_Interface = await contributor.plan(context);
-
-        this.validatePlan(contributor, plan);
-        await this.adapter.saveContributorPlan(requestId, plan);
-      } catch (error: unknown) {
-        await this.adapter.saveContributorOutcome(requestId, this.buildFailedOutcome(
-          contributor.contributorId,
-          DyNTS_PrivacyContributorAction_Type.noData,
-          error instanceof DyFM_Error ? 'CONTRIBUTOR_PLAN_INVALID' : 'CONTRIBUTOR_PLAN_FAILED'
-        ));
-      }
-    }
-  }
-
-  private async executeMissingContributors(
-    requestId: string,
-    context: DyNTS_PrivacyContributorContext_Interface,
-    plans: DyNTS_PrivacyContributorPlan_Interface[]
-  ): Promise<void> {
-    const existing: DyNTS_PrivacyContributorOutcome_Interface[] =
-      await this.adapter.listContributorOutcomes(requestId);
-    const completedContributorIds: Set<string> = new Set();
-
-    for (const contributor of this.contributors) {
-      const plan: DyNTS_PrivacyContributorPlan_Interface | undefined = plans.find((
-        item: DyNTS_PrivacyContributorPlan_Interface
-      ): boolean => item.contributorId === contributor.contributorId);
-      const outcome: DyNTS_PrivacyContributorOutcome_Interface | undefined = existing.find((
-        item: DyNTS_PrivacyContributorOutcome_Interface
-      ): boolean => item.contributorId === contributor.contributorId);
-
-      if (plan && outcome && this.isValidCompletedOutcome(contributor, plan, outcome)) {
-        completedContributorIds.add(contributor.contributorId);
-      }
-    }
-
-    for (const contributor of this.contributors) {
-      if (completedContributorIds.has(contributor.contributorId)) {
-        continue;
-      }
-
-      const plan: DyNTS_PrivacyContributorPlan_Interface | undefined = plans.find((
-        item: DyNTS_PrivacyContributorPlan_Interface
-      ): boolean => item.contributorId === contributor.contributorId);
-      const outcome: DyNTS_PrivacyContributorOutcome_Interface = plan
-        ? await this.executeContributor(contributor, context, plan)
-        : this.buildFailedOutcome(
-          contributor.contributorId,
-          DyNTS_PrivacyContributorAction_Type.noData,
-          'CONTRIBUTOR_PLAN_MISSING'
-        );
-
-      await this.adapter.saveContributorOutcome(requestId, outcome);
-    }
-  }
-
-  private async executeContributor(
-    contributor: DyNTS_PrivacyContributor_Interface,
-    context: DyNTS_PrivacyContributorContext_Interface,
-    plan: DyNTS_PrivacyContributorPlan_Interface
-  ): Promise<DyNTS_PrivacyContributorOutcome_Interface> {
-    try {
-      const outcome: DyNTS_PrivacyContributorOutcome_Interface = await contributor.execute(context, plan);
-
-      this.validateOutcome(contributor, plan, outcome);
-
-      return { ...outcome };
-    } catch (error: unknown) {
-      return this.buildFailedOutcome(
-        contributor.contributorId,
-        plan.action,
-        error instanceof DyFM_Error ? 'CONTRIBUTOR_CONTRACT_FAILED' : 'CONTRIBUTOR_EXECUTION_FAILED'
-      );
-    }
-  }
-
-  private async verifyContributorOutcomes(
-    context: DyNTS_PrivacyContributorContext_Interface,
-    plans: DyNTS_PrivacyContributorPlan_Interface[],
-    outcomes: DyNTS_PrivacyContributorOutcome_Interface[]
-  ): Promise<void> {
-    for (const contributor of this.contributors) {
-      const outcome: DyNTS_PrivacyContributorOutcome_Interface | undefined = outcomes.find((
-        item: DyNTS_PrivacyContributorOutcome_Interface
-      ): boolean => item.contributorId === contributor.contributorId);
-      const plan: DyNTS_PrivacyContributorPlan_Interface | undefined = plans.find((
-        item: DyNTS_PrivacyContributorPlan_Interface
-      ): boolean => item.contributorId === contributor.contributorId);
-
-      if (!outcome || outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.failed || !plan) {
-        continue;
-      }
-
-      try {
-        this.validateOutcome(contributor, plan, outcome);
-
-        if (!await contributor.verify(context, outcome)) {
-          await this.adapter.saveContributorOutcome(context.requestId, this.buildFailedOutcome(
-            contributor.contributorId,
-            outcome.action,
-            'CONTRIBUTOR_VERIFY_FAILED'
-          ));
-        }
-      } catch {
-        await this.adapter.saveContributorOutcome(context.requestId, this.buildFailedOutcome(
-          contributor.contributorId,
-          outcome.action,
-          'CONTRIBUTOR_VERIFY_FAILED'
-        ));
-      }
-    }
-  }
-
-  private validatePlan(
-    contributor: DyNTS_PrivacyContributor_Interface,
-    plan: DyNTS_PrivacyContributorPlan_Interface
-  ): void {
-    if (
-      plan.contributorId !== contributor.contributorId
-      || !this.isBoundedText(plan.contributorId, 128)
-      || !Object.values(DyNTS_PrivacyContributorAction_Type).includes(plan.action)
-      || (plan.action === DyNTS_PrivacyContributorAction_Type.retainWithBasis && !plan.retentionBasisCode)
-      || (plan.action !== DyNTS_PrivacyContributorAction_Type.retainWithBasis && !!plan.retentionBasisCode)
-    ) {
-      throw this.buildError(500, 'CONTRIBUTOR_PLAN_INVALID', 'A privacy contributor returned an invalid plan.');
-    }
-  }
-
-  private validateOutcome(
-    contributor: DyNTS_PrivacyContributor_Interface,
-    plan: DyNTS_PrivacyContributorPlan_Interface,
-    outcome: DyNTS_PrivacyContributorOutcome_Interface
-  ): void {
-    if (
-      outcome.contributorId !== contributor.contributorId
-      || outcome.action !== plan.action
-      || !Object.values(DyNTS_PrivacyContributorOutcome_Type).includes(outcome.outcome)
-      || !Number.isSafeInteger(outcome.processedRecordCount)
-      || outcome.processedRecordCount < 0
-      || (outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
-        && outcome.retentionBasisCode !== plan.retentionBasisCode)
-      || (outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
-        && !!outcome.retentionBasisCode)
-      || (outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.failed && !outcome.errorCode)
-      || (outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed && !!outcome.errorCode)
-      || (outcome.action === DyNTS_PrivacyContributorAction_Type.retainWithBasis
-        && outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
-        && outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed)
-      || (outcome.action !== DyNTS_PrivacyContributorAction_Type.retainWithBasis
-        && outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis)
-      || (!!outcome.artifactChecksum && !/^[a-f0-9]{64}$/u.test(outcome.artifactChecksum))
-      || !Number.isFinite(new Date(outcome.completedAt).getTime())
-    ) {
-      throw this.buildError(500, 'CONTRIBUTOR_OUTCOME_INVALID', 'A privacy contributor returned an invalid outcome.');
-    }
-  }
-
-  private buildFailedOutcome(
-    contributorId: string,
-    action: DyNTS_PrivacyContributorAction_Type,
-    errorCode: string
-  ): DyNTS_PrivacyContributorOutcome_Interface {
-    return {
-      contributorId: contributorId,
-      action: action,
-      outcome: DyNTS_PrivacyContributorOutcome_Type.failed,
-      retentionBasisCode: '',
-      artifactChecksum: '',
-      processedRecordCount: 0,
-      errorCode: errorCode,
-      completedAt: this.clock().toISOString(),
-    };
-  }
-
-  private async requireOwnedRequest(
-    requestId: string,
-    subjectId: string
-  ): Promise<DyNTS_PrivacyRequestRecord_Interface> {
-    const request: DyNTS_PrivacyRequestRecord_Interface | null = await this.adapter.findRequestById(requestId);
-
-    if (request?.subjectId !== subjectId) {
-      throw this.buildError(404, 'REQUEST_NOT_FOUND', 'The privacy request was not found.');
-    }
-
-    return request;
-  }
-
-  private async replaceState(
-    request: DyNTS_PrivacyRequestRecord_Interface,
-    state: DyNTS_PrivacyRequestState_Type,
-    dates: {
-      identityVerifiedAt?: string;
-      scopedAt?: string;
-      plannedAt?: string;
-      executionStartedAt?: string;
-      verifyingStartedAt?: string;
-      completedAt?: string;
-    }
-  ): Promise<DyNTS_PrivacyRequestRecord_Interface> {
-    const replacement: DyNTS_PrivacyRequestRecord_Interface = {
-      ...request,
-      ...dates,
-      state: state,
-      revision: request.revision + 1,
-    };
-    const didReplace: boolean = await this.adapter.replaceRequest(replacement, request.revision);
-
-    if (!didReplace) {
-      throw this.buildError(409, 'REQUEST_REVISION_CONFLICT', 'The privacy request changed concurrently.');
-    }
-
-    return replacement;
-  }
-
-  private buildContext(request: DyNTS_PrivacyRequestRecord_Interface): DyNTS_PrivacyContributorContext_Interface {
-    return {
-      requestId: request.requestId,
-      subjectId: request.subjectId,
-      organizationId: request.organizationId,
-      type: request.type,
-    };
-  }
-
-  private buildResult(
-    request: DyNTS_PrivacyRequestRecord_Interface,
-    outcomes: DyNTS_PrivacyContributorOutcome_Interface[]
-  ): DyNTS_PrivacyRequestResult_Interface {
-    if (outcomes.some((outcome: DyNTS_PrivacyContributorOutcome_Interface): boolean => (
-      !this.contributors.some((contributor: DyNTS_PrivacyContributor_Interface): boolean => (
-        contributor.contributorId === outcome.contributorId
-      ))
-    ))) {
-      throw this.buildError(500, 'CONTRIBUTOR_OUTCOME_UNKNOWN', 'An unknown contributor outcome was stored.');
-    }
-
-    return {
-      request: this.toRequestView(request),
-      outcomes: [ ...outcomes ].sort((
-        first: DyNTS_PrivacyContributorOutcome_Interface,
-        second: DyNTS_PrivacyContributorOutcome_Interface
-      ): number => (
-        first.contributorId.localeCompare(second.contributorId)
-      )),
-    };
-  }
-
-  private toRequestView(request: DyNTS_PrivacyRequestRecord_Interface): DyNTS_PrivacyRequestView_Interface {
-    return {
-      requestId: request.requestId,
-      subjectId: request.subjectId,
-      organizationId: request.organizationId,
-      type: request.type,
-      state: request.state,
-      revision: request.revision,
-      createdAt: request.createdAt,
-      deadlineAt: request.deadlineAt,
-      identityVerifiedAt: request.identityVerifiedAt,
-      scopedAt: request.scopedAt,
-      plannedAt: request.plannedAt,
-      executionStartedAt: request.executionStartedAt,
-      verifyingStartedAt: request.verifyingStartedAt,
-      completedAt: request.completedAt,
-    };
-  }
-
-  private hashIdempotency(set: DyNTS_PrivacyRequestOpen_Interface): string {
-    return createHash('sha256')
-      .update(`${set.subjectId}\u0000${set.organizationId}\u0000${set.type}\u0000${set.idempotencyKey}`)
-      .digest('hex');
-  }
-
-  private isFutureDate(value: string): boolean {
-    const timestamp: number = new Date(value).getTime();
-
-    return Number.isFinite(timestamp) && timestamp > this.clock().getTime();
-  }
-
-  private isBoundedText(value: string, maxLength: number): boolean {
-    return typeof value === 'string' && !!value && value.length <= maxLength && !value.includes('\u0000');
-  }
-
-  private hasAllContributorPlans(plans: DyNTS_PrivacyContributorPlan_Interface[]): boolean {
-    return this.contributors.every((contributor: DyNTS_PrivacyContributor_Interface): boolean => (
-      plans.some((plan: DyNTS_PrivacyContributorPlan_Interface): boolean => (
-        plan.contributorId === contributor.contributorId
-      ))
-    ));
-  }
-
-  private validateStoredPlans(plans: DyNTS_PrivacyContributorPlan_Interface[]): void {
-    for (const plan of plans) {
-      const contributor: DyNTS_PrivacyContributor_Interface | undefined = this.contributors.find((
-        item: DyNTS_PrivacyContributor_Interface
-      ): boolean => item.contributorId === plan.contributorId);
-
-      if (!contributor) {
-        throw this.buildError(500, 'CONTRIBUTOR_PLAN_UNKNOWN', 'An unknown privacy contributor plan was stored.');
-      }
-
-      this.validatePlan(contributor, plan);
-    }
-  }
-
-  private isValidCompletedOutcome(
-    contributor: DyNTS_PrivacyContributor_Interface,
-    plan: DyNTS_PrivacyContributorPlan_Interface,
-    outcome: DyNTS_PrivacyContributorOutcome_Interface
-  ): boolean {
-    try {
-      this.validateOutcome(contributor, plan, outcome);
-
-      return outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed;
-    } catch {
-      return false;
-    }
-  }
-
-  private validateSettings(): void {
-    const contributorIds: string[] = this.contributors.map((item: DyNTS_PrivacyContributor_Interface): string => (
-      item.contributorId
-    ));
-
-    if (
-      !this.adapter
-      || !this.contributors.length
-      || contributorIds.some((contributorId: string): boolean => !contributorId)
-      || new Set(contributorIds).size !== contributorIds.length
-    ) {
-      throw this.buildError(500, 'SETTINGS_INVALID', 'The privacy lifecycle settings are invalid.');
-    }
-  }
-
-  private buildError(status: number, errorCode: string, message: string): DyFM_Error {
-    return new DyFM_Error({
-      status: status,
-      errorCode: `${DyNTS_global_settings.systemShortCodeName}|PRIVACY_LIFECYCLE|${errorCode}`,
-      message: message,
-      userMessage: status < 500
-        ? message
-        : 'The privacy request could not be processed safely. Please try again later.',
-      issuerService: this.constructor.name,
-    });
-  }
-}
+import {
+  createHash,
+  randomUUID
+} from 'crypto';
+
+import { DyFM_Error } from '@futdevpro/fsm-dynamo';
+
+import { DyNTS_global_settings } from '../../_collections/global-settings.const';
+import { DyNTS_PrivacyContributorAction_Type } from './_enums/privacy-contributor-action.type-enum';
+import { DyNTS_PrivacyContributorOutcome_Type } from './_enums/privacy-contributor-outcome.type-enum';
+import { DyNTS_PrivacyRequestState_Type } from './_enums/privacy-request-state.type-enum';
+import { DyNTS_PrivacyRequest_Type } from './_enums/privacy-request.type-enum';
+import { DyNTS_PrivacyContributorContext_Interface } from './_models/privacy-contributor-context.interface';
+import { DyNTS_PrivacyContributorOutcome_Interface } from './_models/privacy-contributor-outcome.interface';
+import { DyNTS_PrivacyContributorPlan_Interface } from './_models/privacy-contributor-plan.interface';
+import { DyNTS_PrivacyContributor_Interface } from './_models/privacy-contributor.interface';
+import { DyNTS_PrivacyLifecycleAdapter_Interface } from './_models/privacy-lifecycle-adapter.interface';
+import { DyNTS_PrivacyLifecycleSettings_Interface } from './_models/privacy-lifecycle-settings.interface';
+import { DyNTS_PrivacyRequestCreateResult_Interface } from './_models/privacy-request-create-result.interface';
+import { DyNTS_PrivacyRequestOpen_Interface } from './_models/privacy-request-open.interface';
+import {
+  DyNTS_PrivacyRequestPersistenceCreateResult_Interface
+} from './_models/privacy-request-persistence-create-result.interface';
+import { DyNTS_PrivacyRequestRecord_Interface } from './_models/privacy-request-record.interface';
+import { DyNTS_PrivacyRequestResult_Interface } from './_models/privacy-request-result.interface';
+import { DyNTS_PrivacyRequestView_Interface } from './_models/privacy-request-view.interface';
+
+/** Coordinates identity-gated, resumable data-subject requests across product-owned data contributors. */
+export class DyNTS_PrivacyLifecycle_ControlService {
+  private readonly adapter: DyNTS_PrivacyLifecycleAdapter_Interface;
+  private readonly contributors: DyNTS_PrivacyContributor_Interface[];
+  private readonly clock: () => Date;
+
+  /** Creates an orchestrator with a stable contributor registry. */
+  constructor(set: DyNTS_PrivacyLifecycleSettings_Interface) {
+    this.adapter = set.adapter;
+    this.contributors = [ ...set.contributors ]
+      .sort((first: DyNTS_PrivacyContributor_Interface, second: DyNTS_PrivacyContributor_Interface): number => (
+        first.contributorId.localeCompare(second.contributorId)
+      ));
+    this.clock = set.clock ?? ((): Date => new Date());
+    this.validateSettings();
+  }
+
+  /** Opens or safely replays a subject-scoped request without persisting the raw idempotency key. */
+  public async openRequest(
+    set: DyNTS_PrivacyRequestOpen_Interface
+  ): Promise<DyNTS_PrivacyRequestCreateResult_Interface> {
+    if (
+      !this.isBoundedText(set.subjectId, 256)
+      || !this.isBoundedText(set.organizationId, 256)
+      || !Object.values(DyNTS_PrivacyRequest_Type).includes(set.type)
+    ) {
+      throw this.buildError(400, 'REQUEST_INVALID', 'The privacy request is invalid.');
+    }
+
+    if (
+      !this.isBoundedText(set.idempotencyKey, 256)
+      || !this.isFutureDate(set.deadlineAt)
+    ) {
+      throw this.buildError(400, 'IDEMPOTENCY_KEY_INVALID', 'The privacy request key is invalid.');
+    }
+
+    const createdAt: string = this.clock().toISOString();
+    const request: DyNTS_PrivacyRequestRecord_Interface = {
+      requestId: randomUUID(),
+      subjectId: set.subjectId,
+      organizationId: set.organizationId,
+      type: set.type,
+      state: DyNTS_PrivacyRequestState_Type.received,
+      idempotencyHash: this.hashIdempotency(set),
+      revision: 0,
+      createdAt: createdAt,
+      deadlineAt: set.deadlineAt,
+      identityVerifiedAt: '',
+      scopedAt: '',
+      plannedAt: '',
+      executionStartedAt: '',
+      verifyingStartedAt: '',
+      completedAt: '',
+    };
+
+    const result: DyNTS_PrivacyRequestPersistenceCreateResult_Interface =
+      await this.adapter.createOrGetRequest(request);
+
+    if (
+      result.request.idempotencyHash !== request.idempotencyHash
+      || result.request.subjectId !== request.subjectId
+      || result.request.organizationId !== request.organizationId
+      || result.request.type !== request.type
+    ) {
+      throw this.buildError(409, 'IDEMPOTENCY_CONFLICT', 'The idempotency key belongs to another request.');
+    }
+
+    return { request: this.toRequestView(result.request), created: result.created };
+  }
+
+  /** Marks request identity verified after the application has completed its security challenge. */
+  public async verifyIdentity(
+    requestId: string,
+    subjectId: string
+  ): Promise<DyNTS_PrivacyRequestView_Interface> {
+    const request: DyNTS_PrivacyRequestRecord_Interface = await this.requireOwnedRequest(requestId, subjectId);
+
+    if (request.state === DyNTS_PrivacyRequestState_Type.identityVerified) {
+      return this.toRequestView(request);
+    }
+
+    if (request.state !== DyNTS_PrivacyRequestState_Type.received) {
+      throw this.buildError(409, 'IDENTITY_STATE_CONFLICT', 'The request cannot be identity-verified now.');
+    }
+
+    const replacement: DyNTS_PrivacyRequestRecord_Interface = await this.replaceState(
+      request,
+      DyNTS_PrivacyRequestState_Type.identityVerified,
+      {
+        identityVerifiedAt: this.clock().toISOString(),
+      }
+    );
+
+    return this.toRequestView(replacement);
+  }
+
+  /** Executes or resumes all contributors and never reports complete while one contributor failed. */
+  public async processRequest(
+    requestId: string,
+    subjectId: string
+  ): Promise<DyNTS_PrivacyRequestResult_Interface> {
+    let request: DyNTS_PrivacyRequestRecord_Interface = await this.requireOwnedRequest(requestId, subjectId);
+
+    if (request.state === DyNTS_PrivacyRequestState_Type.completed) {
+      return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
+    }
+
+    if (
+      request.state !== DyNTS_PrivacyRequestState_Type.identityVerified
+      && request.state !== DyNTS_PrivacyRequestState_Type.scoped
+      && request.state !== DyNTS_PrivacyRequestState_Type.planned
+      && request.state !== DyNTS_PrivacyRequestState_Type.executing
+      && request.state !== DyNTS_PrivacyRequestState_Type.verifying
+      && request.state !== DyNTS_PrivacyRequestState_Type.partiallyCompleted
+    ) {
+      throw this.buildError(409, 'EXECUTION_STATE_CONFLICT', 'The request is not ready for execution.');
+    }
+
+    if (request.state === DyNTS_PrivacyRequestState_Type.identityVerified) {
+      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.scoped, {
+        scopedAt: this.clock().toISOString(),
+      });
+    }
+
+    const context: DyNTS_PrivacyContributorContext_Interface = this.buildContext(request);
+    let plans: DyNTS_PrivacyContributorPlan_Interface[] = await this.adapter.listContributorPlans(request.requestId);
+
+    this.validateStoredPlans(plans);
+
+    if (
+      request.state === DyNTS_PrivacyRequestState_Type.scoped
+      || request.state === DyNTS_PrivacyRequestState_Type.partiallyCompleted
+    ) {
+      await this.planMissingContributors(request.requestId, context, plans);
+      plans = await this.adapter.listContributorPlans(request.requestId);
+      this.validateStoredPlans(plans);
+
+      if (!this.hasAllContributorPlans(plans)) {
+        request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.partiallyCompleted, {
+          completedAt: '',
+        });
+
+        return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
+      }
+
+      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.planned, {
+        plannedAt: this.clock().toISOString(),
+      });
+    }
+
+    if (request.state === DyNTS_PrivacyRequestState_Type.planned) {
+      this.validateStoredPlans(plans);
+      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.executing, {
+        executionStartedAt: request.executionStartedAt || this.clock().toISOString(),
+        completedAt: '',
+      });
+    }
+
+    if (request.state === DyNTS_PrivacyRequestState_Type.executing) {
+      await this.executeMissingContributors(request.requestId, context, plans);
+      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.verifying, {
+        verifyingStartedAt: this.clock().toISOString(),
+      });
+    }
+
+    let outcomes: DyNTS_PrivacyContributorOutcome_Interface[] =
+      await this.adapter.listContributorOutcomes(request.requestId);
+
+    if (request.state === DyNTS_PrivacyRequestState_Type.verifying) {
+      await this.verifyContributorOutcomes(context, plans, outcomes);
+      outcomes = await this.adapter.listContributorOutcomes(request.requestId);
+    }
+
+    const isComplete: boolean = this.contributors.every((contributor: DyNTS_PrivacyContributor_Interface): boolean => (
+      outcomes.some((outcome: DyNTS_PrivacyContributorOutcome_Interface): boolean => (
+        outcome.contributorId === contributor.contributorId
+        && outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed
+      ))
+    ));
+    const finalState: DyNTS_PrivacyRequestState_Type = isComplete
+      ? DyNTS_PrivacyRequestState_Type.completed
+      : DyNTS_PrivacyRequestState_Type.partiallyCompleted;
+
+    request = await this.replaceState(request, finalState, {
+      completedAt: isComplete ? this.clock().toISOString() : '',
+    });
+
+    return this.buildResult(request, outcomes);
+  }
+
+  /** Returns an owned request and its content-free contributor outcomes. */
+  public async getRequest(
+    requestId: string,
+    subjectId: string
+  ): Promise<DyNTS_PrivacyRequestResult_Interface> {
+    const request: DyNTS_PrivacyRequestRecord_Interface = await this.requireOwnedRequest(requestId, subjectId);
+
+    return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
+  }
+
+  private async planMissingContributors(
+    requestId: string,
+    context: DyNTS_PrivacyContributorContext_Interface,
+    existingPlans: DyNTS_PrivacyContributorPlan_Interface[]
+  ): Promise<void> {
+    const plannedContributorIds: Set<string> = new Set(existingPlans.map((
+      plan: DyNTS_PrivacyContributorPlan_Interface
+    ): string => plan.contributorId));
+
+    for (const contributor of this.contributors) {
+      if (plannedContributorIds.has(contributor.contributorId)) {
+        continue;
+      }
+
+      try {
+        const plan: DyNTS_PrivacyContributorPlan_Interface = await contributor.plan(context);
+
+        this.validatePlan(contributor, plan);
+        await this.adapter.saveContributorPlan(requestId, plan);
+      } catch (error: unknown) {
+        await this.adapter.saveContributorOutcome(requestId, this.buildFailedOutcome(
+          contributor.contributorId,
+          DyNTS_PrivacyContributorAction_Type.noData,
+          error instanceof DyFM_Error ? 'CONTRIBUTOR_PLAN_INVALID' : 'CONTRIBUTOR_PLAN_FAILED'
+        ));
+      }
+    }
+  }
+
+  private async executeMissingContributors(
+    requestId: string,
+    context: DyNTS_PrivacyContributorContext_Interface,
+    plans: DyNTS_PrivacyContributorPlan_Interface[]
+  ): Promise<void> {
+    const existing: DyNTS_PrivacyContributorOutcome_Interface[] =
+      await this.adapter.listContributorOutcomes(requestId);
+    const completedContributorIds: Set<string> = new Set();
+
+    for (const contributor of this.contributors) {
+      const plan: DyNTS_PrivacyContributorPlan_Interface | undefined = plans.find((
+        item: DyNTS_PrivacyContributorPlan_Interface
+      ): boolean => item.contributorId === contributor.contributorId);
+      const outcome: DyNTS_PrivacyContributorOutcome_Interface | undefined = existing.find((
+        item: DyNTS_PrivacyContributorOutcome_Interface
+      ): boolean => item.contributorId === contributor.contributorId);
+
+      if (plan && outcome && this.isValidCompletedOutcome(contributor, plan, outcome)) {
+        completedContributorIds.add(contributor.contributorId);
+      }
+    }
+
+    for (const contributor of this.contributors) {
+      if (completedContributorIds.has(contributor.contributorId)) {
+        continue;
+      }
+
+      const plan: DyNTS_PrivacyContributorPlan_Interface | undefined = plans.find((
+        item: DyNTS_PrivacyContributorPlan_Interface
+      ): boolean => item.contributorId === contributor.contributorId);
+      const outcome: DyNTS_PrivacyContributorOutcome_Interface = plan
+        ? await this.executeContributor(contributor, context, plan)
+        : this.buildFailedOutcome(
+          contributor.contributorId,
+          DyNTS_PrivacyContributorAction_Type.noData,
+          'CONTRIBUTOR_PLAN_MISSING'
+        );
+
+      await this.adapter.saveContributorOutcome(requestId, outcome);
+    }
+  }
+
+  private async executeContributor(
+    contributor: DyNTS_PrivacyContributor_Interface,
+    context: DyNTS_PrivacyContributorContext_Interface,
+    plan: DyNTS_PrivacyContributorPlan_Interface
+  ): Promise<DyNTS_PrivacyContributorOutcome_Interface> {
+    try {
+      const outcome: DyNTS_PrivacyContributorOutcome_Interface = await contributor.execute(context, plan);
+
+      this.validateOutcome(contributor, plan, outcome);
+
+      return { ...outcome };
+    } catch (error: unknown) {
+      return this.buildFailedOutcome(
+        contributor.contributorId,
+        plan.action,
+        error instanceof DyFM_Error ? 'CONTRIBUTOR_CONTRACT_FAILED' : 'CONTRIBUTOR_EXECUTION_FAILED'
+      );
+    }
+  }
+
+  private async verifyContributorOutcomes(
+    context: DyNTS_PrivacyContributorContext_Interface,
+    plans: DyNTS_PrivacyContributorPlan_Interface[],
+    outcomes: DyNTS_PrivacyContributorOutcome_Interface[]
+  ): Promise<void> {
+    for (const contributor of this.contributors) {
+      const outcome: DyNTS_PrivacyContributorOutcome_Interface | undefined = outcomes.find((
+        item: DyNTS_PrivacyContributorOutcome_Interface
+      ): boolean => item.contributorId === contributor.contributorId);
+      const plan: DyNTS_PrivacyContributorPlan_Interface | undefined = plans.find((
+        item: DyNTS_PrivacyContributorPlan_Interface
+      ): boolean => item.contributorId === contributor.contributorId);
+
+      if (!outcome || outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.failed || !plan) {
+        continue;
+      }
+
+      try {
+        this.validateOutcome(contributor, plan, outcome);
+
+        if (!await contributor.verify(context, outcome)) {
+          await this.adapter.saveContributorOutcome(context.requestId, this.buildFailedOutcome(
+            contributor.contributorId,
+            outcome.action,
+            'CONTRIBUTOR_VERIFY_FAILED'
+          ));
+        }
+      } catch {
+        await this.adapter.saveContributorOutcome(context.requestId, this.buildFailedOutcome(
+          contributor.contributorId,
+          outcome.action,
+          'CONTRIBUTOR_VERIFY_FAILED'
+        ));
+      }
+    }
+  }
+
+  private validatePlan(
+    contributor: DyNTS_PrivacyContributor_Interface,
+    plan: DyNTS_PrivacyContributorPlan_Interface
+  ): void {
+    if (
+      plan.contributorId !== contributor.contributorId
+      || !this.isBoundedText(plan.contributorId, 128)
+      || !Object.values(DyNTS_PrivacyContributorAction_Type).includes(plan.action)
+      || (plan.action === DyNTS_PrivacyContributorAction_Type.retainWithBasis && !plan.retentionBasisCode)
+      || (plan.action !== DyNTS_PrivacyContributorAction_Type.retainWithBasis && !!plan.retentionBasisCode)
+    ) {
+      throw this.buildError(500, 'CONTRIBUTOR_PLAN_INVALID', 'A privacy contributor returned an invalid plan.');
+    }
+  }
+
+  private validateOutcome(
+    contributor: DyNTS_PrivacyContributor_Interface,
+    plan: DyNTS_PrivacyContributorPlan_Interface,
+    outcome: DyNTS_PrivacyContributorOutcome_Interface
+  ): void {
+    if (
+      outcome.contributorId !== contributor.contributorId
+      || outcome.action !== plan.action
+      || !Object.values(DyNTS_PrivacyContributorOutcome_Type).includes(outcome.outcome)
+      || !Number.isSafeInteger(outcome.processedRecordCount)
+      || outcome.processedRecordCount < 0
+      || (outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
+        && outcome.retentionBasisCode !== plan.retentionBasisCode)
+      || (outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
+        && !!outcome.retentionBasisCode)
+      || (outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.failed && !outcome.errorCode)
+      || (outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed && !!outcome.errorCode)
+      || (outcome.action === DyNTS_PrivacyContributorAction_Type.retainWithBasis
+        && outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
+        && outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed)
+      || (outcome.action !== DyNTS_PrivacyContributorAction_Type.retainWithBasis
+        && outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis)
+      || (!!outcome.artifactChecksum && !/^[a-f0-9]{64}$/u.test(outcome.artifactChecksum))
+      || !Number.isFinite(new Date(outcome.completedAt).getTime())
+    ) {
+      throw this.buildError(500, 'CONTRIBUTOR_OUTCOME_INVALID', 'A privacy contributor returned an invalid outcome.');
+    }
+  }
+
+  private buildFailedOutcome(
+    contributorId: string,
+    action: DyNTS_PrivacyContributorAction_Type,
+    errorCode: string
+  ): DyNTS_PrivacyContributorOutcome_Interface {
+    return {
+      contributorId: contributorId,
+      action: action,
+      outcome: DyNTS_PrivacyContributorOutcome_Type.failed,
+      retentionBasisCode: '',
+      artifactChecksum: '',
+      processedRecordCount: 0,
+      errorCode: errorCode,
+      completedAt: this.clock().toISOString(),
+    };
+  }
+
+  private async requireOwnedRequest(
+    requestId: string,
+    subjectId: string
+  ): Promise<DyNTS_PrivacyRequestRecord_Interface> {
+    const request: DyNTS_PrivacyRequestRecord_Interface | null = await this.adapter.findRequestById(requestId);
+
+    if (request?.subjectId !== subjectId) {
+      throw this.buildError(404, 'REQUEST_NOT_FOUND', 'The privacy request was not found.');
+    }
+
+    return request;
+  }
+
+  private async replaceState(
+    request: DyNTS_PrivacyRequestRecord_Interface,
+    state: DyNTS_PrivacyRequestState_Type,
+    dates: {
+      identityVerifiedAt?: string;
+      scopedAt?: string;
+      plannedAt?: string;
+      executionStartedAt?: string;
+      verifyingStartedAt?: string;
+      completedAt?: string;
+    }
+  ): Promise<DyNTS_PrivacyRequestRecord_Interface> {
+    const replacement: DyNTS_PrivacyRequestRecord_Interface = {
+      ...request,
+      ...dates,
+      state: state,
+      revision: request.revision + 1,
+    };
+    const didReplace: boolean = await this.adapter.replaceRequest(replacement, request.revision);
+
+    if (!didReplace) {
+      throw this.buildError(409, 'REQUEST_REVISION_CONFLICT', 'The privacy request changed concurrently.');
+    }
+
+    return replacement;
+  }
+
+  private buildContext(request: DyNTS_PrivacyRequestRecord_Interface): DyNTS_PrivacyContributorContext_Interface {
+    return {
+      requestId: request.requestId,
+      subjectId: request.subjectId,
+      organizationId: request.organizationId,
+      type: request.type,
+    };
+  }
+
+  private buildResult(
+    request: DyNTS_PrivacyRequestRecord_Interface,
+    outcomes: DyNTS_PrivacyContributorOutcome_Interface[]
+  ): DyNTS_PrivacyRequestResult_Interface {
+    if (outcomes.some((outcome: DyNTS_PrivacyContributorOutcome_Interface): boolean => (
+      !this.contributors.some((contributor: DyNTS_PrivacyContributor_Interface): boolean => (
+        contributor.contributorId === outcome.contributorId
+      ))
+    ))) {
+      throw this.buildError(500, 'CONTRIBUTOR_OUTCOME_UNKNOWN', 'An unknown contributor outcome was stored.');
+    }
+
+    return {
+      request: this.toRequestView(request),
+      outcomes: [ ...outcomes ].sort((
+        first: DyNTS_PrivacyContributorOutcome_Interface,
+        second: DyNTS_PrivacyContributorOutcome_Interface
+      ): number => (
+        first.contributorId.localeCompare(second.contributorId)
+      )),
+    };
+  }
+
+  private toRequestView(request: DyNTS_PrivacyRequestRecord_Interface): DyNTS_PrivacyRequestView_Interface {
+    return {
+      requestId: request.requestId,
+      subjectId: request.subjectId,
+      organizationId: request.organizationId,
+      type: request.type,
+      state: request.state,
+      revision: request.revision,
+      createdAt: request.createdAt,
+      deadlineAt: request.deadlineAt,
+      identityVerifiedAt: request.identityVerifiedAt,
+      scopedAt: request.scopedAt,
+      plannedAt: request.plannedAt,
+      executionStartedAt: request.executionStartedAt,
+      verifyingStartedAt: request.verifyingStartedAt,
+      completedAt: request.completedAt,
+    };
+  }
+
+  private hashIdempotency(set: DyNTS_PrivacyRequestOpen_Interface): string {
+    return createHash('sha256')
+      .update(`${set.subjectId}\u0000${set.organizationId}\u0000${set.type}\u0000${set.idempotencyKey}`)
+      .digest('hex');
+  }
+
+  private isFutureDate(value: string): boolean {
+    const timestamp: number = new Date(value).getTime();
+
+    return Number.isFinite(timestamp) && timestamp > this.clock().getTime();
+  }
+
+  private isBoundedText(value: string, maxLength: number): boolean {
+    return typeof value === 'string' && !!value && value.length <= maxLength && !value.includes('\u0000');
+  }
+
+  private hasAllContributorPlans(plans: DyNTS_PrivacyContributorPlan_Interface[]): boolean {
+    return this.contributors.every((contributor: DyNTS_PrivacyContributor_Interface): boolean => (
+      plans.some((plan: DyNTS_PrivacyContributorPlan_Interface): boolean => (
+        plan.contributorId === contributor.contributorId
+      ))
+    ));
+  }
+
+  private validateStoredPlans(plans: DyNTS_PrivacyContributorPlan_Interface[]): void {
+    for (const plan of plans) {
+      const contributor: DyNTS_PrivacyContributor_Interface | undefined = this.contributors.find((
+        item: DyNTS_PrivacyContributor_Interface
+      ): boolean => item.contributorId === plan.contributorId);
+
+      if (!contributor) {
+        throw this.buildError(500, 'CONTRIBUTOR_PLAN_UNKNOWN', 'An unknown privacy contributor plan was stored.');
+      }
+
+      this.validatePlan(contributor, plan);
+    }
+  }
+
+  private isValidCompletedOutcome(
+    contributor: DyNTS_PrivacyContributor_Interface,
+    plan: DyNTS_PrivacyContributorPlan_Interface,
+    outcome: DyNTS_PrivacyContributorOutcome_Interface
+  ): boolean {
+    try {
+      this.validateOutcome(contributor, plan, outcome);
+
+      return outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed;
+    } catch {
+      return false;
+    }
+  }
+
+  private validateSettings(): void {
+    const contributorIds: string[] = this.contributors.map((item: DyNTS_PrivacyContributor_Interface): string => (
+      item.contributorId
+    ));
+
+    if (
+      !this.adapter
+      || !this.contributors.length
+      || contributorIds.some((contributorId: string): boolean => !contributorId)
+      || new Set(contributorIds).size !== contributorIds.length
+    ) {
+      throw this.buildError(500, 'SETTINGS_INVALID', 'The privacy lifecycle settings are invalid.');
+    }
+  }
+
+  private buildError(status: number, errorCode: string, message: string): DyFM_Error {
+    return new DyFM_Error({
+      status: status,
+      errorCode: `${DyNTS_global_settings.systemShortCodeName}|PRIVACY_LIFECYCLE|${errorCode}`,
+      message: message,
+      userMessage: status < 500
+        ? message
+        : 'The privacy request could not be processed safely. Please try again later.',
+      issuerService: this.constructor.name,
+    });
+  }
+}