@futdevpro/nts-dynamo 1.15.157 → 1.15.163

package/src/_modules/privacy-lifecycle/privacy-ledger.control-service.ts

@@ -1,253 +0,0 @@
-import {
-  createHash,
-  randomUUID
-} from 'crypto';
-
-import { DyFM_Error } from '@futdevpro/fsm-dynamo';
-
-import { DyNTS_global_settings } from '../../_collections/global-settings.const';
-import { DyNTS_PrivacyConsentDecision_Type } from './_enums/privacy-consent-decision.type-enum';
-import { DyNTS_PrivacyConsentInput_Interface } from './_models/privacy-consent-input.interface';
-import {
-  DyNTS_PrivacyConsentPersistenceResult_Interface
-} from './_models/privacy-consent-persistence-result.interface';
-import { DyNTS_PrivacyConsentRecord_Interface } from './_models/privacy-consent-record.interface';
-import { DyNTS_PrivacyConsentResult_Interface } from './_models/privacy-consent-result.interface';
-import { DyNTS_PrivacyConsentView_Interface } from './_models/privacy-consent-view.interface';
-import { DyNTS_PrivacyLedgerAdapter_Interface } from './_models/privacy-ledger-adapter.interface';
-import { DyNTS_PrivacyLedgerResult_Interface } from './_models/privacy-ledger-result.interface';
-import { DyNTS_PrivacyLedgerSettings_Interface } from './_models/privacy-ledger-settings.interface';
-import { DyNTS_PrivacyLegalAcceptanceInput_Interface } from './_models/privacy-legal-acceptance-input.interface';
-import {
-  DyNTS_PrivacyLegalAcceptancePersistenceResult_Interface
-} from './_models/privacy-legal-acceptance-persistence-result.interface';
-import { DyNTS_PrivacyLegalAcceptanceResult_Interface } from './_models/privacy-legal-acceptance-result.interface';
-import {
-  DyNTS_PrivacyLegalAcceptanceView_Interface
-} from './_models/privacy-legal-acceptance-view.interface';
-import { DyNTS_PrivacyLegalAcceptance_Interface } from './_models/privacy-legal-acceptance.interface';
-
-/** Maintains immutable legal acceptance and purpose-specific consent evidence. */
-export class DyNTS_PrivacyLedger_ControlService {
-  private readonly adapter: DyNTS_PrivacyLedgerAdapter_Interface;
-  private readonly clock: () => Date;
-
-  /** Creates a privacy ledger over an append-only persistence adapter. */
-  constructor(set: DyNTS_PrivacyLedgerSettings_Interface) {
-    this.adapter = set.adapter;
-    this.clock = set.clock ?? ((): Date => new Date());
-
-    if (!this.adapter) {
-      throw this.buildError(500, 'SETTINGS_INVALID', 'The privacy ledger settings are invalid.');
-    }
-  }
-
-  /** Appends or replays acceptance of one exact checksummed legal document version. */
-  public async acceptLegalDocument(
-    set: DyNTS_PrivacyLegalAcceptanceInput_Interface
-  ): Promise<DyNTS_PrivacyLegalAcceptanceResult_Interface> {
-    this.validateCommon(set);
-
-    if (
-      !this.isSafeCode(set.documentType)
-      || !this.isSafeCode(set.documentVersion)
-      || !/^[a-f0-9]{64}$/u.test(set.documentChecksum)
-    ) {
-      throw this.buildError(400, 'LEGAL_ACCEPTANCE_INVALID', 'The legal acceptance is invalid.');
-    }
-
-    const acceptance: DyNTS_PrivacyLegalAcceptance_Interface = {
-      acceptanceId: randomUUID(),
-      subjectId: set.subjectId,
-      organizationId: set.organizationId,
-      documentType: set.documentType,
-      documentVersion: set.documentVersion,
-      documentChecksum: set.documentChecksum,
-      sourceCode: set.sourceCode,
-      idempotencyHash: this.hashInput('legal', set),
-      requestFingerprint: this.hashContent([
-        set.documentType,
-        set.documentVersion,
-        set.documentChecksum,
-        set.sourceCode,
-      ]),
-      acceptedAt: this.clock().toISOString(),
-    };
-    const result: DyNTS_PrivacyLegalAcceptancePersistenceResult_Interface =
-      await this.adapter.appendLegalAcceptance(acceptance);
-
-    if (
-      result.acceptance.requestFingerprint !== acceptance.requestFingerprint
-      || result.acceptance.idempotencyHash !== acceptance.idempotencyHash
-      || result.acceptance.subjectId !== acceptance.subjectId
-      || result.acceptance.organizationId !== acceptance.organizationId
-    ) {
-      throw this.buildError(409, 'IDEMPOTENCY_CONFLICT', 'The idempotency key belongs to another ledger event.');
-    }
-
-    return { acceptance: this.toLegalView(result.acceptance), created: result.created };
-  }
-
-  /** Appends or replays a purpose-specific consent grant or withdrawal. */
-  public async recordConsent(
-    set: DyNTS_PrivacyConsentInput_Interface
-  ): Promise<DyNTS_PrivacyConsentResult_Interface> {
-    this.validateCommon(set);
-
-    if (
-      !this.isSafeCode(set.purposeCode)
-      || !this.isSafeCode(set.policyVersion)
-      || !Object.values(DyNTS_PrivacyConsentDecision_Type).includes(set.decision)
-    ) {
-      throw this.buildError(400, 'CONSENT_INVALID', 'The consent decision is invalid.');
-    }
-
-    const consent: DyNTS_PrivacyConsentRecord_Interface = {
-      consentId: randomUUID(),
-      subjectId: set.subjectId,
-      organizationId: set.organizationId,
-      purposeCode: set.purposeCode,
-      policyVersion: set.policyVersion,
-      decision: set.decision,
-      sourceCode: set.sourceCode,
-      idempotencyHash: this.hashInput('consent', set),
-      requestFingerprint: this.hashContent([
-        set.purposeCode,
-        set.policyVersion,
-        set.decision,
-        set.sourceCode,
-      ]),
-      occurredAt: this.clock().toISOString(),
-    };
-    const result: DyNTS_PrivacyConsentPersistenceResult_Interface = await this.adapter.appendConsent(consent);
-
-    if (
-      result.consent.requestFingerprint !== consent.requestFingerprint
-      || result.consent.idempotencyHash !== consent.idempotencyHash
-      || result.consent.subjectId !== consent.subjectId
-      || result.consent.organizationId !== consent.organizationId
-    ) {
-      throw this.buildError(409, 'IDEMPOTENCY_CONFLICT', 'The idempotency key belongs to another ledger event.');
-    }
-
-    return { consent: this.toConsentView(result.consent), created: result.created };
-  }
-
-  /** Returns immutable history plus the latest decision for every purpose. */
-  public async getLedger(subjectId: string, organizationId: string): Promise<DyNTS_PrivacyLedgerResult_Interface> {
-    if (!subjectId || !organizationId) {
-      throw this.buildError(400, 'LEDGER_OWNER_INVALID', 'The privacy ledger owner is invalid.');
-    }
-
-    const legalAcceptances: DyNTS_PrivacyLegalAcceptance_Interface[] =
-      await this.adapter.listLegalAcceptances(subjectId, organizationId);
-    const consentHistory: DyNTS_PrivacyConsentRecord_Interface[] =
-      await this.adapter.listConsentHistory(subjectId, organizationId);
-
-    if (
-      legalAcceptances.some((item: DyNTS_PrivacyLegalAcceptance_Interface): boolean => (
-        item.subjectId !== subjectId || item.organizationId !== organizationId
-      ))
-      || consentHistory.some((item: DyNTS_PrivacyConsentRecord_Interface): boolean => (
-        item.subjectId !== subjectId || item.organizationId !== organizationId
-      ))
-    ) {
-      throw this.buildError(500, 'LEDGER_SCOPE_VIOLATION', 'The privacy ledger returned an invalid scope.');
-    }
-    const consentViews: DyNTS_PrivacyConsentView_Interface[] = consentHistory.map((
-      item: DyNTS_PrivacyConsentRecord_Interface
-    ): DyNTS_PrivacyConsentView_Interface => this.toConsentView(item));
-    const currentByPurpose: Map<string, DyNTS_PrivacyConsentView_Interface> = new Map();
-
-    consentViews.forEach((record: DyNTS_PrivacyConsentView_Interface): void => {
-      currentByPurpose.set(record.purposeCode, { ...record });
-    });
-
-    return {
-      legalAcceptances: [ ...legalAcceptances ].map((
-        item: DyNTS_PrivacyLegalAcceptance_Interface
-      ): DyNTS_PrivacyLegalAcceptanceView_Interface => this.toLegalView(item)),
-      consentHistory: consentViews,
-      currentConsents: Array.from(currentByPurpose.values())
-        .sort((
-          first: DyNTS_PrivacyConsentView_Interface,
-          second: DyNTS_PrivacyConsentView_Interface
-        ): number => first.purposeCode.localeCompare(second.purposeCode)),
-    };
-  }
-
-  private validateCommon(set: {
-    subjectId: string;
-    organizationId: string;
-    sourceCode: string;
-    idempotencyKey: string;
-  }): void {
-    if (
-      !this.isBoundedText(set.subjectId, 256)
-      || !this.isBoundedText(set.organizationId, 256)
-      || !this.isSafeCode(set.sourceCode)
-      || !this.isBoundedText(set.idempotencyKey, 256)
-    ) {
-      throw this.buildError(400, 'LEDGER_EVENT_INVALID', 'The privacy ledger event is invalid.');
-    }
-  }
-
-  private hashInput(
-    category: string,
-    set: DyNTS_PrivacyLegalAcceptanceInput_Interface | DyNTS_PrivacyConsentInput_Interface
-  ): string {
-    return createHash('sha256')
-      .update(`${category}\u0000${set.subjectId}\u0000${set.organizationId}\u0000${set.idempotencyKey}`)
-      .digest('hex');
-  }
-
-  private hashContent(parts: string[]): string {
-    return createHash('sha256').update(parts.join('\u0000')).digest('hex');
-  }
-
-  private isSafeCode(value: string): boolean {
-    return typeof value === 'string' && /^[a-zA-Z0-9._:-]{1,128}$/u.test(value);
-  }
-
-  private isBoundedText(value: string, maxLength: number): boolean {
-    return typeof value === 'string' && !!value && value.length <= maxLength && !value.includes('\u0000');
-  }
-
-  private toLegalView(
-    acceptance: DyNTS_PrivacyLegalAcceptance_Interface
-  ): DyNTS_PrivacyLegalAcceptanceView_Interface {
-    return {
-      acceptanceId: acceptance.acceptanceId,
-      subjectId: acceptance.subjectId,
-      organizationId: acceptance.organizationId,
-      documentType: acceptance.documentType,
-      documentVersion: acceptance.documentVersion,
-      documentChecksum: acceptance.documentChecksum,
-      sourceCode: acceptance.sourceCode,
-      acceptedAt: acceptance.acceptedAt,
-    };
-  }
-
-  private toConsentView(record: DyNTS_PrivacyConsentRecord_Interface): DyNTS_PrivacyConsentView_Interface {
-    return {
-      consentId: record.consentId,
-      subjectId: record.subjectId,
-      organizationId: record.organizationId,
-      purposeCode: record.purposeCode,
-      policyVersion: record.policyVersion,
-      decision: record.decision,
-      sourceCode: record.sourceCode,
-      occurredAt: record.occurredAt,
-    };
-  }
-
-  private buildError(status: number, errorCode: string, message: string): DyFM_Error {
-    return new DyFM_Error({
-      status: status,
-      errorCode: `${DyNTS_global_settings.systemShortCodeName}|PRIVACY_LEDGER|${errorCode}`,
-      message: message,
-      userMessage: status < 500 ? message : 'The privacy ledger is unavailable. Please try again later.',
-      issuerService: this.constructor.name,
-    });
-  }
-}

package/src/_modules/privacy-lifecycle/privacy-lifecycle.control-service.spec.ts

@@ -1,353 +0,0 @@
-import { DyFM_Error } from '@futdevpro/fsm-dynamo';
-
-import { DyNTS_PrivacyLifecycle_ControlService } from './privacy-lifecycle.control-service';
-import { DyNTS_PrivacyContributorAction_Type } from './_enums/privacy-contributor-action.type-enum';
-import { DyNTS_PrivacyContributorOutcome_Type } from './_enums/privacy-contributor-outcome.type-enum';
-import { DyNTS_PrivacyRequestState_Type } from './_enums/privacy-request-state.type-enum';
-import { DyNTS_PrivacyRequest_Type } from './_enums/privacy-request.type-enum';
-import { DyNTS_PrivacyContributorContext_Interface } from './_models/privacy-contributor-context.interface';
-import { DyNTS_PrivacyContributorOutcome_Interface } from './_models/privacy-contributor-outcome.interface';
-import { DyNTS_PrivacyContributorPlan_Interface } from './_models/privacy-contributor-plan.interface';
-import { DyNTS_PrivacyContributor_Interface } from './_models/privacy-contributor.interface';
-import { DyNTS_PrivacyLifecycleAdapter_Interface } from './_models/privacy-lifecycle-adapter.interface';
-import { DyNTS_PrivacyRequestCreateResult_Interface } from './_models/privacy-request-create-result.interface';
-import {
-  DyNTS_PrivacyRequestPersistenceCreateResult_Interface
-} from './_models/privacy-request-persistence-create-result.interface';
-import { DyNTS_PrivacyRequestRecord_Interface } from './_models/privacy-request-record.interface';
-import { DyNTS_PrivacyRequestResult_Interface } from './_models/privacy-request-result.interface';
-
-class DyNTS_TestPrivacyAdapter implements DyNTS_PrivacyLifecycleAdapter_Interface {
-  private readonly requests: Map<string, DyNTS_PrivacyRequestRecord_Interface> = new Map();
-  private readonly idempotencyIndex: Map<string, string> = new Map();
-  private readonly plans: Map<string, Map<string, DyNTS_PrivacyContributorPlan_Interface>> = new Map();
-  private readonly outcomes: Map<string, Map<string, DyNTS_PrivacyContributorOutcome_Interface>> = new Map();
-
-  /** Atomically creates a request or returns its idempotent predecessor. */
-  public async createOrGetRequest(
-    request: DyNTS_PrivacyRequestRecord_Interface
-  ): Promise<DyNTS_PrivacyRequestPersistenceCreateResult_Interface> {
-    const existingId: string | undefined = this.idempotencyIndex.get(request.idempotencyHash);
-
-    if (existingId) {
-      return { request: this.cloneRequest(this.requests.get(existingId)), created: false };
-    }
-
-    this.requests.set(request.requestId, this.cloneRequest(request));
-    this.idempotencyIndex.set(request.idempotencyHash, request.requestId);
-
-    return { request: this.cloneRequest(request), created: true };
-  }
-
-  /** Finds a cloned request by identifier. */
-  public async findRequestById(requestId: string): Promise<DyNTS_PrivacyRequestRecord_Interface | null> {
-    const request: DyNTS_PrivacyRequestRecord_Interface | undefined = this.requests.get(requestId);
-
-    return request ? this.cloneRequest(request) : null;
-  }
-
-  /** Applies a compare-and-set request replacement. */
-  public async replaceRequest(
-    request: DyNTS_PrivacyRequestRecord_Interface,
-    expectedRevision: number
-  ): Promise<boolean> {
-    const existing: DyNTS_PrivacyRequestRecord_Interface | undefined = this.requests.get(request.requestId);
-
-    if (existing?.revision !== expectedRevision) {
-      return false;
-    }
-
-    this.requests.set(request.requestId, this.cloneRequest(request));
-
-    return true;
-  }
-
-  /** Upserts the durable test plan for one contributor. */
-  public async saveContributorPlan(
-    requestId: string,
-    plan: DyNTS_PrivacyContributorPlan_Interface
-  ): Promise<void> {
-    const requestPlans: Map<string, DyNTS_PrivacyContributorPlan_Interface> =
-      this.plans.get(requestId) ?? new Map();
-
-    requestPlans.set(plan.contributorId, { ...plan });
-    this.plans.set(requestId, requestPlans);
-  }
-
-  /** Lists cloned durable contributor plans. */
-  public async listContributorPlans(requestId: string): Promise<DyNTS_PrivacyContributorPlan_Interface[]> {
-    return Array.from(this.plans.get(requestId)?.values() ?? [])
-      .map((plan: DyNTS_PrivacyContributorPlan_Interface): DyNTS_PrivacyContributorPlan_Interface => ({
-        ...plan,
-      }));
-  }
-
-  /** Upserts the latest content-free outcome for one contributor. */
-  public async saveContributorOutcome(
-    requestId: string,
-    outcome: DyNTS_PrivacyContributorOutcome_Interface
-  ): Promise<void> {
-    const requestOutcomes: Map<string, DyNTS_PrivacyContributorOutcome_Interface> =
-      this.outcomes.get(requestId) ?? new Map();
-
-    requestOutcomes.set(outcome.contributorId, { ...outcome });
-    this.outcomes.set(requestId, requestOutcomes);
-  }
-
-  /** Lists cloned contributor outcomes for one request. */
-  public async listContributorOutcomes(requestId: string): Promise<DyNTS_PrivacyContributorOutcome_Interface[]> {
-    return Array.from(this.outcomes.get(requestId)?.values() ?? [])
-      .map((outcome: DyNTS_PrivacyContributorOutcome_Interface): DyNTS_PrivacyContributorOutcome_Interface => ({
-        ...outcome,
-      }));
-  }
-
-  private cloneRequest(
-    request: DyNTS_PrivacyRequestRecord_Interface | undefined
-  ): DyNTS_PrivacyRequestRecord_Interface {
-    if (!request) {
-      throw new Error('The test request does not exist.');
-    }
-
-    return { ...request };
-  }
-}
-
-class DyNTS_TestPrivacyContributor implements DyNTS_PrivacyContributor_Interface {
-  public executionCount: number = 0;
-  public verificationResult: boolean = true;
-  public planFailuresRemaining: number = 0;
-  public failuresRemaining: number = 0;
-
-  /** Creates a configurable deterministic test contributor. */
-  constructor(
-    public readonly contributorId: string,
-    private readonly action: DyNTS_PrivacyContributorAction_Type = DyNTS_PrivacyContributorAction_Type.noData,
-    private readonly retentionBasisCode: string = ''
-  ) {}
-
-  /** Returns the configured non-sensitive test plan. */
-  public async plan(
-    _context: DyNTS_PrivacyContributorContext_Interface
-  ): Promise<DyNTS_PrivacyContributorPlan_Interface> {
-    void _context;
-
-    if (this.planFailuresRemaining) {
-      this.planFailuresRemaining -= 1;
-
-      throw new Error('Synthetic planning failure.');
-    }
-
-    return {
-      contributorId: this.contributorId,
-      action: this.action,
-      retentionBasisCode: this.retentionBasisCode,
-    };
-  }
-
-  /** Returns a deterministic result or simulates a transient domain failure. */
-  public async execute(
-    _context: DyNTS_PrivacyContributorContext_Interface,
-    plan: DyNTS_PrivacyContributorPlan_Interface
-  ): Promise<DyNTS_PrivacyContributorOutcome_Interface> {
-    this.executionCount += 1;
-
-    if (this.failuresRemaining) {
-      this.failuresRemaining -= 1;
-
-      throw new Error('Synthetic contributor failure.');
-    }
-
-    return {
-      contributorId: this.contributorId,
-      action: plan.action,
-      outcome: plan.action === DyNTS_PrivacyContributorAction_Type.retainWithBasis
-        ? DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
-        : DyNTS_PrivacyContributorOutcome_Type.noData,
-      retentionBasisCode: plan.retentionBasisCode,
-      artifactChecksum: '',
-      processedRecordCount: 0,
-      errorCode: '',
-      completedAt: '2026-08-18T10:00:00.000Z',
-    };
-  }
-
-  /** Returns the configured post-execution verification result. */
-  public async verify(
-    _context: DyNTS_PrivacyContributorContext_Interface,
-    _outcome: DyNTS_PrivacyContributorOutcome_Interface
-  ): Promise<boolean> {
-    void _context;
-    void _outcome;
-
-    return this.verificationResult;
-  }
-}
-
-describe('| DyNTS_PrivacyLifecycle_ControlService', (): void => {
-  let adapter: DyNTS_TestPrivacyAdapter;
-  let contributor: DyNTS_TestPrivacyContributor;
-  let service: DyNTS_PrivacyLifecycle_ControlService;
-
-  beforeEach((): void => {
-    adapter = new DyNTS_TestPrivacyAdapter();
-    contributor = new DyNTS_TestPrivacyContributor('pipeline-data');
-    service = new DyNTS_PrivacyLifecycle_ControlService({
-      adapter: adapter,
-      contributors: [ contributor ],
-      clock: (): Date => new Date('2026-08-18T10:00:00.000Z'),
-    });
-  });
-
-  it('| creates idempotently within the subject and organization boundary', async (): Promise<void> => {
-    const first: DyNTS_PrivacyRequestCreateResult_Interface = await openRequest(service);
-    const replay: DyNTS_PrivacyRequestCreateResult_Interface = await openRequest(service);
-    const otherOrganization: DyNTS_PrivacyRequestCreateResult_Interface = await service.openRequest({
-      subjectId: 'subject-1',
-      organizationId: 'organization-2',
-      type: DyNTS_PrivacyRequest_Type.erasure,
-      idempotencyKey: 'request-key',
-      deadlineAt: '2026-09-18T10:00:00.000Z',
-    });
-
-    expect(first.created).toBeTrue();
-    expect(replay.created).toBeFalse();
-    expect(replay.request.requestId).toBe(first.request.requestId);
-    expect(otherOrganization.request.requestId).not.toBe(first.request.requestId);
-    expect(JSON.stringify(first.request)).not.toContain('idempotencyHash');
-  });
-
-  it('| requires identity verification and hides requests from another subject', async (): Promise<void> => {
-    const opened: DyNTS_PrivacyRequestCreateResult_Interface = await openRequest(service);
-
-    await expectAsync(service.processRequest(opened.request.requestId, 'subject-1')).toBeRejectedWithError(DyFM_Error);
-    const hiddenError: DyFM_Error = await captureError(
-      service.getRequest(opened.request.requestId, 'subject-2')
-    );
-
-    expect(hiddenError._errorCode).toContain('REQUEST_NOT_FOUND');
-  });
-
-  it('| completes only after every contributor result verifies', async (): Promise<void> => {
-    const opened: DyNTS_PrivacyRequestCreateResult_Interface = await openRequest(service);
-
-    await service.verifyIdentity(opened.request.requestId, 'subject-1');
-    const result: DyNTS_PrivacyRequestResult_Interface = await service.processRequest(
-      opened.request.requestId,
-      'subject-1'
-    );
-
-    expect(result.request.state).toBe(DyNTS_PrivacyRequestState_Type.completed);
-    expect(result.request.completedAt).toBe('2026-08-18T10:00:00.000Z');
-    expect(result.request.scopedAt).toBe('2026-08-18T10:00:00.000Z');
-    expect(result.request.plannedAt).toBe('2026-08-18T10:00:00.000Z');
-    expect(result.request.verifyingStartedAt).toBe('2026-08-18T10:00:00.000Z');
-    expect(result.outcomes[0].outcome).toBe(DyNTS_PrivacyContributorOutcome_Type.noData);
-  });
-
-  it('| reports partial completion and resumes only failed contributors', async (): Promise<void> => {
-    const stable: DyNTS_TestPrivacyContributor = new DyNTS_TestPrivacyContributor('account-data');
-
-    contributor.failuresRemaining = 1;
-    service = new DyNTS_PrivacyLifecycle_ControlService({
-      adapter: adapter,
-      contributors: [ contributor, stable ],
-    });
-    const opened: DyNTS_PrivacyRequestCreateResult_Interface = await openRequest(service);
-
-    await service.verifyIdentity(opened.request.requestId, 'subject-1');
-    const partial: DyNTS_PrivacyRequestResult_Interface = await service.processRequest(
-      opened.request.requestId,
-      'subject-1'
-    );
-    const resumed: DyNTS_PrivacyRequestResult_Interface = await service.processRequest(
-      opened.request.requestId,
-      'subject-1'
-    );
-
-    expect(partial.request.state).toBe(DyNTS_PrivacyRequestState_Type.partiallyCompleted);
-    expect(resumed.request.state).toBe(DyNTS_PrivacyRequestState_Type.completed);
-    expect(contributor.executionCount).toBe(2);
-    expect(stable.executionCount).toBe(1);
-  });
-
-  it('| accepts explicit retention only with a matching legal-basis code', async (): Promise<void> => {
-    contributor = new DyNTS_TestPrivacyContributor(
-      'billing-data',
-      DyNTS_PrivacyContributorAction_Type.retainWithBasis,
-      'statutory-accounting-retention'
-    );
-    service = new DyNTS_PrivacyLifecycle_ControlService({ adapter: adapter, contributors: [ contributor ] });
-    const opened: DyNTS_PrivacyRequestCreateResult_Interface = await openRequest(service);
-
-    await service.verifyIdentity(opened.request.requestId, 'subject-1');
-    const result: DyNTS_PrivacyRequestResult_Interface = await service.processRequest(
-      opened.request.requestId,
-      'subject-1'
-    );
-
-    expect(result.request.state).toBe(DyNTS_PrivacyRequestState_Type.completed);
-    expect(result.outcomes[0].retentionBasisCode).toBe('statutory-accounting-retention');
-  });
-
-  it('| persists partial planning and resumes before any execution', async (): Promise<void> => {
-    contributor.planFailuresRemaining = 1;
-    const opened: DyNTS_PrivacyRequestCreateResult_Interface = await openRequest(service);
-
-    await service.verifyIdentity(opened.request.requestId, 'subject-1');
-    const partial: DyNTS_PrivacyRequestResult_Interface = await service.processRequest(
-      opened.request.requestId,
-      'subject-1'
-    );
-
-    expect(partial.request.state).toBe(DyNTS_PrivacyRequestState_Type.partiallyCompleted);
-    expect(contributor.executionCount).toBe(0);
-
-    const resumed: DyNTS_PrivacyRequestResult_Interface = await service.processRequest(
-      opened.request.requestId,
-      'subject-1'
-    );
-
-    expect(resumed.request.state).toBe(DyNTS_PrivacyRequestState_Type.completed);
-    expect(contributor.executionCount).toBe(1);
-  });
-
-  it('| converts a verification failure into a content-free partial result', async (): Promise<void> => {
-    contributor.verificationResult = false;
-    const opened: DyNTS_PrivacyRequestCreateResult_Interface = await openRequest(service);
-
-    await service.verifyIdentity(opened.request.requestId, 'subject-1');
-    const result: DyNTS_PrivacyRequestResult_Interface = await service.processRequest(
-      opened.request.requestId,
-      'subject-1'
-    );
-
-    expect(result.request.state).toBe(DyNTS_PrivacyRequestState_Type.partiallyCompleted);
-    expect(result.outcomes[0].errorCode).toBe('CONTRIBUTOR_VERIFY_FAILED');
-    expect(JSON.stringify(result.outcomes)).not.toContain('Synthetic contributor failure');
-  });
-});
-
-async function openRequest(
-  service: DyNTS_PrivacyLifecycle_ControlService
-): Promise<DyNTS_PrivacyRequestCreateResult_Interface> {
-  return service.openRequest({
-    subjectId: 'subject-1',
-    organizationId: 'organization-1',
-    type: DyNTS_PrivacyRequest_Type.erasure,
-    idempotencyKey: 'request-key',
-    deadlineAt: '2026-09-18T10:00:00.000Z',
-  });
-}
-
-async function captureError(promise: Promise<unknown>): Promise<DyFM_Error> {
-  try {
-    await promise;
-  } catch (error: unknown) {
-    if (error instanceof DyFM_Error) {
-      return error;
-    }
-  }
-
-  throw new Error('Expected a DyFM_Error rejection.');
-}