@futdevpro/nts-dynamo 1.15.157 → 1.15.163

package/src/_modules/privacy-lifecycle/privacy-lifecycle.control-service.ts

@@ -1,586 +0,0 @@
-import {
-  createHash,
-  randomUUID
-} from 'crypto';
-
-import { DyFM_Error } from '@futdevpro/fsm-dynamo';
-
-import { DyNTS_global_settings } from '../../_collections/global-settings.const';
-import { DyNTS_PrivacyContributorAction_Type } from './_enums/privacy-contributor-action.type-enum';
-import { DyNTS_PrivacyContributorOutcome_Type } from './_enums/privacy-contributor-outcome.type-enum';
-import { DyNTS_PrivacyRequestState_Type } from './_enums/privacy-request-state.type-enum';
-import { DyNTS_PrivacyRequest_Type } from './_enums/privacy-request.type-enum';
-import { DyNTS_PrivacyContributorContext_Interface } from './_models/privacy-contributor-context.interface';
-import { DyNTS_PrivacyContributorOutcome_Interface } from './_models/privacy-contributor-outcome.interface';
-import { DyNTS_PrivacyContributorPlan_Interface } from './_models/privacy-contributor-plan.interface';
-import { DyNTS_PrivacyContributor_Interface } from './_models/privacy-contributor.interface';
-import { DyNTS_PrivacyLifecycleAdapter_Interface } from './_models/privacy-lifecycle-adapter.interface';
-import { DyNTS_PrivacyLifecycleSettings_Interface } from './_models/privacy-lifecycle-settings.interface';
-import { DyNTS_PrivacyRequestCreateResult_Interface } from './_models/privacy-request-create-result.interface';
-import { DyNTS_PrivacyRequestOpen_Interface } from './_models/privacy-request-open.interface';
-import {
-  DyNTS_PrivacyRequestPersistenceCreateResult_Interface
-} from './_models/privacy-request-persistence-create-result.interface';
-import { DyNTS_PrivacyRequestRecord_Interface } from './_models/privacy-request-record.interface';
-import { DyNTS_PrivacyRequestResult_Interface } from './_models/privacy-request-result.interface';
-import { DyNTS_PrivacyRequestView_Interface } from './_models/privacy-request-view.interface';
-
-/** Coordinates identity-gated, resumable data-subject requests across product-owned data contributors. */
-export class DyNTS_PrivacyLifecycle_ControlService {
-  private readonly adapter: DyNTS_PrivacyLifecycleAdapter_Interface;
-  private readonly contributors: DyNTS_PrivacyContributor_Interface[];
-  private readonly clock: () => Date;
-
-  /** Creates an orchestrator with a stable contributor registry. */
-  constructor(set: DyNTS_PrivacyLifecycleSettings_Interface) {
-    this.adapter = set.adapter;
-    this.contributors = [ ...set.contributors ]
-      .sort((first: DyNTS_PrivacyContributor_Interface, second: DyNTS_PrivacyContributor_Interface): number => (
-        first.contributorId.localeCompare(second.contributorId)
-      ));
-    this.clock = set.clock ?? ((): Date => new Date());
-    this.validateSettings();
-  }
-
-  /** Opens or safely replays a subject-scoped request without persisting the raw idempotency key. */
-  public async openRequest(
-    set: DyNTS_PrivacyRequestOpen_Interface
-  ): Promise<DyNTS_PrivacyRequestCreateResult_Interface> {
-    if (
-      !this.isBoundedText(set.subjectId, 256)
-      || !this.isBoundedText(set.organizationId, 256)
-      || !Object.values(DyNTS_PrivacyRequest_Type).includes(set.type)
-    ) {
-      throw this.buildError(400, 'REQUEST_INVALID', 'The privacy request is invalid.');
-    }
-
-    if (
-      !this.isBoundedText(set.idempotencyKey, 256)
-      || !this.isFutureDate(set.deadlineAt)
-    ) {
-      throw this.buildError(400, 'IDEMPOTENCY_KEY_INVALID', 'The privacy request key is invalid.');
-    }
-
-    const createdAt: string = this.clock().toISOString();
-    const request: DyNTS_PrivacyRequestRecord_Interface = {
-      requestId: randomUUID(),
-      subjectId: set.subjectId,
-      organizationId: set.organizationId,
-      type: set.type,
-      state: DyNTS_PrivacyRequestState_Type.received,
-      idempotencyHash: this.hashIdempotency(set),
-      revision: 0,
-      createdAt: createdAt,
-      deadlineAt: set.deadlineAt,
-      identityVerifiedAt: '',
-      scopedAt: '',
-      plannedAt: '',
-      executionStartedAt: '',
-      verifyingStartedAt: '',
-      completedAt: '',
-    };
-
-    const result: DyNTS_PrivacyRequestPersistenceCreateResult_Interface =
-      await this.adapter.createOrGetRequest(request);
-
-    if (
-      result.request.idempotencyHash !== request.idempotencyHash
-      || result.request.subjectId !== request.subjectId
-      || result.request.organizationId !== request.organizationId
-      || result.request.type !== request.type
-    ) {
-      throw this.buildError(409, 'IDEMPOTENCY_CONFLICT', 'The idempotency key belongs to another request.');
-    }
-
-    return { request: this.toRequestView(result.request), created: result.created };
-  }
-
-  /** Marks request identity verified after the application has completed its security challenge. */
-  public async verifyIdentity(
-    requestId: string,
-    subjectId: string
-  ): Promise<DyNTS_PrivacyRequestView_Interface> {
-    const request: DyNTS_PrivacyRequestRecord_Interface = await this.requireOwnedRequest(requestId, subjectId);
-
-    if (request.state === DyNTS_PrivacyRequestState_Type.identityVerified) {
-      return this.toRequestView(request);
-    }
-
-    if (request.state !== DyNTS_PrivacyRequestState_Type.received) {
-      throw this.buildError(409, 'IDENTITY_STATE_CONFLICT', 'The request cannot be identity-verified now.');
-    }
-
-    const replacement: DyNTS_PrivacyRequestRecord_Interface = await this.replaceState(
-      request,
-      DyNTS_PrivacyRequestState_Type.identityVerified,
-      {
-        identityVerifiedAt: this.clock().toISOString(),
-      }
-    );
-
-    return this.toRequestView(replacement);
-  }
-
-  /** Executes or resumes all contributors and never reports complete while one contributor failed. */
-  public async processRequest(
-    requestId: string,
-    subjectId: string
-  ): Promise<DyNTS_PrivacyRequestResult_Interface> {
-    let request: DyNTS_PrivacyRequestRecord_Interface = await this.requireOwnedRequest(requestId, subjectId);
-
-    if (request.state === DyNTS_PrivacyRequestState_Type.completed) {
-      return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
-    }
-
-    if (
-      request.state !== DyNTS_PrivacyRequestState_Type.identityVerified
-      && request.state !== DyNTS_PrivacyRequestState_Type.scoped
-      && request.state !== DyNTS_PrivacyRequestState_Type.planned
-      && request.state !== DyNTS_PrivacyRequestState_Type.executing
-      && request.state !== DyNTS_PrivacyRequestState_Type.verifying
-      && request.state !== DyNTS_PrivacyRequestState_Type.partiallyCompleted
-    ) {
-      throw this.buildError(409, 'EXECUTION_STATE_CONFLICT', 'The request is not ready for execution.');
-    }
-
-    if (request.state === DyNTS_PrivacyRequestState_Type.identityVerified) {
-      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.scoped, {
-        scopedAt: this.clock().toISOString(),
-      });
-    }
-
-    const context: DyNTS_PrivacyContributorContext_Interface = this.buildContext(request);
-    let plans: DyNTS_PrivacyContributorPlan_Interface[] = await this.adapter.listContributorPlans(request.requestId);
-
-    this.validateStoredPlans(plans);
-
-    if (
-      request.state === DyNTS_PrivacyRequestState_Type.scoped
-      || request.state === DyNTS_PrivacyRequestState_Type.partiallyCompleted
-    ) {
-      await this.planMissingContributors(request.requestId, context, plans);
-      plans = await this.adapter.listContributorPlans(request.requestId);
-      this.validateStoredPlans(plans);
-
-      if (!this.hasAllContributorPlans(plans)) {
-        request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.partiallyCompleted, {
-          completedAt: '',
-        });
-
-        return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
-      }
-
-      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.planned, {
-        plannedAt: this.clock().toISOString(),
-      });
-    }
-
-    if (request.state === DyNTS_PrivacyRequestState_Type.planned) {
-      this.validateStoredPlans(plans);
-      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.executing, {
-        executionStartedAt: request.executionStartedAt || this.clock().toISOString(),
-        completedAt: '',
-      });
-    }
-
-    if (request.state === DyNTS_PrivacyRequestState_Type.executing) {
-      await this.executeMissingContributors(request.requestId, context, plans);
-      request = await this.replaceState(request, DyNTS_PrivacyRequestState_Type.verifying, {
-        verifyingStartedAt: this.clock().toISOString(),
-      });
-    }
-
-    let outcomes: DyNTS_PrivacyContributorOutcome_Interface[] =
-      await this.adapter.listContributorOutcomes(request.requestId);
-
-    if (request.state === DyNTS_PrivacyRequestState_Type.verifying) {
-      await this.verifyContributorOutcomes(context, plans, outcomes);
-      outcomes = await this.adapter.listContributorOutcomes(request.requestId);
-    }
-
-    const isComplete: boolean = this.contributors.every((contributor: DyNTS_PrivacyContributor_Interface): boolean => (
-      outcomes.some((outcome: DyNTS_PrivacyContributorOutcome_Interface): boolean => (
-        outcome.contributorId === contributor.contributorId
-        && outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed
-      ))
-    ));
-    const finalState: DyNTS_PrivacyRequestState_Type = isComplete
-      ? DyNTS_PrivacyRequestState_Type.completed
-      : DyNTS_PrivacyRequestState_Type.partiallyCompleted;
-
-    request = await this.replaceState(request, finalState, {
-      completedAt: isComplete ? this.clock().toISOString() : '',
-    });
-
-    return this.buildResult(request, outcomes);
-  }
-
-  /** Returns an owned request and its content-free contributor outcomes. */
-  public async getRequest(
-    requestId: string,
-    subjectId: string
-  ): Promise<DyNTS_PrivacyRequestResult_Interface> {
-    const request: DyNTS_PrivacyRequestRecord_Interface = await this.requireOwnedRequest(requestId, subjectId);
-
-    return this.buildResult(request, await this.adapter.listContributorOutcomes(request.requestId));
-  }
-
-  private async planMissingContributors(
-    requestId: string,
-    context: DyNTS_PrivacyContributorContext_Interface,
-    existingPlans: DyNTS_PrivacyContributorPlan_Interface[]
-  ): Promise<void> {
-    const plannedContributorIds: Set<string> = new Set(existingPlans.map((
-      plan: DyNTS_PrivacyContributorPlan_Interface
-    ): string => plan.contributorId));
-
-    for (const contributor of this.contributors) {
-      if (plannedContributorIds.has(contributor.contributorId)) {
-        continue;
-      }
-
-      try {
-        const plan: DyNTS_PrivacyContributorPlan_Interface = await contributor.plan(context);
-
-        this.validatePlan(contributor, plan);
-        await this.adapter.saveContributorPlan(requestId, plan);
-      } catch (error: unknown) {
-        await this.adapter.saveContributorOutcome(requestId, this.buildFailedOutcome(
-          contributor.contributorId,
-          DyNTS_PrivacyContributorAction_Type.noData,
-          error instanceof DyFM_Error ? 'CONTRIBUTOR_PLAN_INVALID' : 'CONTRIBUTOR_PLAN_FAILED'
-        ));
-      }
-    }
-  }
-
-  private async executeMissingContributors(
-    requestId: string,
-    context: DyNTS_PrivacyContributorContext_Interface,
-    plans: DyNTS_PrivacyContributorPlan_Interface[]
-  ): Promise<void> {
-    const existing: DyNTS_PrivacyContributorOutcome_Interface[] =
-      await this.adapter.listContributorOutcomes(requestId);
-    const completedContributorIds: Set<string> = new Set();
-
-    for (const contributor of this.contributors) {
-      const plan: DyNTS_PrivacyContributorPlan_Interface | undefined = plans.find((
-        item: DyNTS_PrivacyContributorPlan_Interface
-      ): boolean => item.contributorId === contributor.contributorId);
-      const outcome: DyNTS_PrivacyContributorOutcome_Interface | undefined = existing.find((
-        item: DyNTS_PrivacyContributorOutcome_Interface
-      ): boolean => item.contributorId === contributor.contributorId);
-
-      if (plan && outcome && this.isValidCompletedOutcome(contributor, plan, outcome)) {
-        completedContributorIds.add(contributor.contributorId);
-      }
-    }
-
-    for (const contributor of this.contributors) {
-      if (completedContributorIds.has(contributor.contributorId)) {
-        continue;
-      }
-
-      const plan: DyNTS_PrivacyContributorPlan_Interface | undefined = plans.find((
-        item: DyNTS_PrivacyContributorPlan_Interface
-      ): boolean => item.contributorId === contributor.contributorId);
-      const outcome: DyNTS_PrivacyContributorOutcome_Interface = plan
-        ? await this.executeContributor(contributor, context, plan)
-        : this.buildFailedOutcome(
-          contributor.contributorId,
-          DyNTS_PrivacyContributorAction_Type.noData,
-          'CONTRIBUTOR_PLAN_MISSING'
-        );
-
-      await this.adapter.saveContributorOutcome(requestId, outcome);
-    }
-  }
-
-  private async executeContributor(
-    contributor: DyNTS_PrivacyContributor_Interface,
-    context: DyNTS_PrivacyContributorContext_Interface,
-    plan: DyNTS_PrivacyContributorPlan_Interface
-  ): Promise<DyNTS_PrivacyContributorOutcome_Interface> {
-    try {
-      const outcome: DyNTS_PrivacyContributorOutcome_Interface = await contributor.execute(context, plan);
-
-      this.validateOutcome(contributor, plan, outcome);
-
-      return { ...outcome };
-    } catch (error: unknown) {
-      return this.buildFailedOutcome(
-        contributor.contributorId,
-        plan.action,
-        error instanceof DyFM_Error ? 'CONTRIBUTOR_CONTRACT_FAILED' : 'CONTRIBUTOR_EXECUTION_FAILED'
-      );
-    }
-  }
-
-  private async verifyContributorOutcomes(
-    context: DyNTS_PrivacyContributorContext_Interface,
-    plans: DyNTS_PrivacyContributorPlan_Interface[],
-    outcomes: DyNTS_PrivacyContributorOutcome_Interface[]
-  ): Promise<void> {
-    for (const contributor of this.contributors) {
-      const outcome: DyNTS_PrivacyContributorOutcome_Interface | undefined = outcomes.find((
-        item: DyNTS_PrivacyContributorOutcome_Interface
-      ): boolean => item.contributorId === contributor.contributorId);
-      const plan: DyNTS_PrivacyContributorPlan_Interface | undefined = plans.find((
-        item: DyNTS_PrivacyContributorPlan_Interface
-      ): boolean => item.contributorId === contributor.contributorId);
-
-      if (!outcome || outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.failed || !plan) {
-        continue;
-      }
-
-      try {
-        this.validateOutcome(contributor, plan, outcome);
-
-        if (!await contributor.verify(context, outcome)) {
-          await this.adapter.saveContributorOutcome(context.requestId, this.buildFailedOutcome(
-            contributor.contributorId,
-            outcome.action,
-            'CONTRIBUTOR_VERIFY_FAILED'
-          ));
-        }
-      } catch {
-        await this.adapter.saveContributorOutcome(context.requestId, this.buildFailedOutcome(
-          contributor.contributorId,
-          outcome.action,
-          'CONTRIBUTOR_VERIFY_FAILED'
-        ));
-      }
-    }
-  }
-
-  private validatePlan(
-    contributor: DyNTS_PrivacyContributor_Interface,
-    plan: DyNTS_PrivacyContributorPlan_Interface
-  ): void {
-    if (
-      plan.contributorId !== contributor.contributorId
-      || !this.isBoundedText(plan.contributorId, 128)
-      || !Object.values(DyNTS_PrivacyContributorAction_Type).includes(plan.action)
-      || (plan.action === DyNTS_PrivacyContributorAction_Type.retainWithBasis && !plan.retentionBasisCode)
-      || (plan.action !== DyNTS_PrivacyContributorAction_Type.retainWithBasis && !!plan.retentionBasisCode)
-    ) {
-      throw this.buildError(500, 'CONTRIBUTOR_PLAN_INVALID', 'A privacy contributor returned an invalid plan.');
-    }
-  }
-
-  private validateOutcome(
-    contributor: DyNTS_PrivacyContributor_Interface,
-    plan: DyNTS_PrivacyContributorPlan_Interface,
-    outcome: DyNTS_PrivacyContributorOutcome_Interface
-  ): void {
-    if (
-      outcome.contributorId !== contributor.contributorId
-      || outcome.action !== plan.action
-      || !Object.values(DyNTS_PrivacyContributorOutcome_Type).includes(outcome.outcome)
-      || !Number.isSafeInteger(outcome.processedRecordCount)
-      || outcome.processedRecordCount < 0
-      || (outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
-        && outcome.retentionBasisCode !== plan.retentionBasisCode)
-      || (outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
-        && !!outcome.retentionBasisCode)
-      || (outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.failed && !outcome.errorCode)
-      || (outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed && !!outcome.errorCode)
-      || (outcome.action === DyNTS_PrivacyContributorAction_Type.retainWithBasis
-        && outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis
-        && outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed)
-      || (outcome.action !== DyNTS_PrivacyContributorAction_Type.retainWithBasis
-        && outcome.outcome === DyNTS_PrivacyContributorOutcome_Type.retainedWithBasis)
-      || (!!outcome.artifactChecksum && !/^[a-f0-9]{64}$/u.test(outcome.artifactChecksum))
-      || !Number.isFinite(new Date(outcome.completedAt).getTime())
-    ) {
-      throw this.buildError(500, 'CONTRIBUTOR_OUTCOME_INVALID', 'A privacy contributor returned an invalid outcome.');
-    }
-  }
-
-  private buildFailedOutcome(
-    contributorId: string,
-    action: DyNTS_PrivacyContributorAction_Type,
-    errorCode: string
-  ): DyNTS_PrivacyContributorOutcome_Interface {
-    return {
-      contributorId: contributorId,
-      action: action,
-      outcome: DyNTS_PrivacyContributorOutcome_Type.failed,
-      retentionBasisCode: '',
-      artifactChecksum: '',
-      processedRecordCount: 0,
-      errorCode: errorCode,
-      completedAt: this.clock().toISOString(),
-    };
-  }
-
-  private async requireOwnedRequest(
-    requestId: string,
-    subjectId: string
-  ): Promise<DyNTS_PrivacyRequestRecord_Interface> {
-    const request: DyNTS_PrivacyRequestRecord_Interface | null = await this.adapter.findRequestById(requestId);
-
-    if (request?.subjectId !== subjectId) {
-      throw this.buildError(404, 'REQUEST_NOT_FOUND', 'The privacy request was not found.');
-    }
-
-    return request;
-  }
-
-  private async replaceState(
-    request: DyNTS_PrivacyRequestRecord_Interface,
-    state: DyNTS_PrivacyRequestState_Type,
-    dates: {
-      identityVerifiedAt?: string;
-      scopedAt?: string;
-      plannedAt?: string;
-      executionStartedAt?: string;
-      verifyingStartedAt?: string;
-      completedAt?: string;
-    }
-  ): Promise<DyNTS_PrivacyRequestRecord_Interface> {
-    const replacement: DyNTS_PrivacyRequestRecord_Interface = {
-      ...request,
-      ...dates,
-      state: state,
-      revision: request.revision + 1,
-    };
-    const didReplace: boolean = await this.adapter.replaceRequest(replacement, request.revision);
-
-    if (!didReplace) {
-      throw this.buildError(409, 'REQUEST_REVISION_CONFLICT', 'The privacy request changed concurrently.');
-    }
-
-    return replacement;
-  }
-
-  private buildContext(request: DyNTS_PrivacyRequestRecord_Interface): DyNTS_PrivacyContributorContext_Interface {
-    return {
-      requestId: request.requestId,
-      subjectId: request.subjectId,
-      organizationId: request.organizationId,
-      type: request.type,
-    };
-  }
-
-  private buildResult(
-    request: DyNTS_PrivacyRequestRecord_Interface,
-    outcomes: DyNTS_PrivacyContributorOutcome_Interface[]
-  ): DyNTS_PrivacyRequestResult_Interface {
-    if (outcomes.some((outcome: DyNTS_PrivacyContributorOutcome_Interface): boolean => (
-      !this.contributors.some((contributor: DyNTS_PrivacyContributor_Interface): boolean => (
-        contributor.contributorId === outcome.contributorId
-      ))
-    ))) {
-      throw this.buildError(500, 'CONTRIBUTOR_OUTCOME_UNKNOWN', 'An unknown contributor outcome was stored.');
-    }
-
-    return {
-      request: this.toRequestView(request),
-      outcomes: [ ...outcomes ].sort((
-        first: DyNTS_PrivacyContributorOutcome_Interface,
-        second: DyNTS_PrivacyContributorOutcome_Interface
-      ): number => (
-        first.contributorId.localeCompare(second.contributorId)
-      )),
-    };
-  }
-
-  private toRequestView(request: DyNTS_PrivacyRequestRecord_Interface): DyNTS_PrivacyRequestView_Interface {
-    return {
-      requestId: request.requestId,
-      subjectId: request.subjectId,
-      organizationId: request.organizationId,
-      type: request.type,
-      state: request.state,
-      revision: request.revision,
-      createdAt: request.createdAt,
-      deadlineAt: request.deadlineAt,
-      identityVerifiedAt: request.identityVerifiedAt,
-      scopedAt: request.scopedAt,
-      plannedAt: request.plannedAt,
-      executionStartedAt: request.executionStartedAt,
-      verifyingStartedAt: request.verifyingStartedAt,
-      completedAt: request.completedAt,
-    };
-  }
-
-  private hashIdempotency(set: DyNTS_PrivacyRequestOpen_Interface): string {
-    return createHash('sha256')
-      .update(`${set.subjectId}\u0000${set.organizationId}\u0000${set.type}\u0000${set.idempotencyKey}`)
-      .digest('hex');
-  }
-
-  private isFutureDate(value: string): boolean {
-    const timestamp: number = new Date(value).getTime();
-
-    return Number.isFinite(timestamp) && timestamp > this.clock().getTime();
-  }
-
-  private isBoundedText(value: string, maxLength: number): boolean {
-    return typeof value === 'string' && !!value && value.length <= maxLength && !value.includes('\u0000');
-  }
-
-  private hasAllContributorPlans(plans: DyNTS_PrivacyContributorPlan_Interface[]): boolean {
-    return this.contributors.every((contributor: DyNTS_PrivacyContributor_Interface): boolean => (
-      plans.some((plan: DyNTS_PrivacyContributorPlan_Interface): boolean => (
-        plan.contributorId === contributor.contributorId
-      ))
-    ));
-  }
-
-  private validateStoredPlans(plans: DyNTS_PrivacyContributorPlan_Interface[]): void {
-    for (const plan of plans) {
-      const contributor: DyNTS_PrivacyContributor_Interface | undefined = this.contributors.find((
-        item: DyNTS_PrivacyContributor_Interface
-      ): boolean => item.contributorId === plan.contributorId);
-
-      if (!contributor) {
-        throw this.buildError(500, 'CONTRIBUTOR_PLAN_UNKNOWN', 'An unknown privacy contributor plan was stored.');
-      }
-
-      this.validatePlan(contributor, plan);
-    }
-  }
-
-  private isValidCompletedOutcome(
-    contributor: DyNTS_PrivacyContributor_Interface,
-    plan: DyNTS_PrivacyContributorPlan_Interface,
-    outcome: DyNTS_PrivacyContributorOutcome_Interface
-  ): boolean {
-    try {
-      this.validateOutcome(contributor, plan, outcome);
-
-      return outcome.outcome !== DyNTS_PrivacyContributorOutcome_Type.failed;
-    } catch {
-      return false;
-    }
-  }
-
-  private validateSettings(): void {
-    const contributorIds: string[] = this.contributors.map((item: DyNTS_PrivacyContributor_Interface): string => (
-      item.contributorId
-    ));
-
-    if (
-      !this.adapter
-      || !this.contributors.length
-      || contributorIds.some((contributorId: string): boolean => !contributorId)
-      || new Set(contributorIds).size !== contributorIds.length
-    ) {
-      throw this.buildError(500, 'SETTINGS_INVALID', 'The privacy lifecycle settings are invalid.');
-    }
-  }
-
-  private buildError(status: number, errorCode: string, message: string): DyFM_Error {
-    return new DyFM_Error({
-      status: status,
-      errorCode: `${DyNTS_global_settings.systemShortCodeName}|PRIVACY_LIFECYCLE|${errorCode}`,
-      message: message,
-      userMessage: status < 500
-        ? message
-        : 'The privacy request could not be processed safely. Please try again later.',
-      issuerService: this.constructor.name,
-    });
-  }
-}

package/src/_modules/rate-limit/_enums/rate-limit-store-kind.type-enum.ts

@@ -1,5 +0,0 @@
-/** Persistence scope advertised by a rate-limit store implementation. */
-export enum DyNTS_RateLimitStoreKind_Type {
-  inMemory = 'in-memory',
-  shared = 'shared',
-}

package/src/_modules/rate-limit/_models/rate-limit-config.interface.ts

@@ -1,82 +0,0 @@
-import { Request } from 'express';
-
-import { DyNTS_RateLimit_Policy } from './rate-limit-policy.interface';
-import { DyNTS_RateLimit_Store_Interface } from './rate-limit-store.interface';
-
-/**
- * Config a `DyNTS_RateLimit_Middleware.configure(...)`-hoz.
- *
- * Minden mezo opcionalis — a default-ok megfelelnek a tipikus API
- * rate-limit-elvarasoknak (100 req/min, sliding window, IP-alapu kulcs,
- * path-alapu endpoint-csoportositas, X-RateLimit-* response header-ek).
- */
-export interface DyNTS_RateLimit_Config {
-  /**
-   * Default request-limit `windowMs` alatt, ha az adott kulcsra nincs
-   * `setPolicyForKey()`-szel beallitott egyedi policy. Default: `100`.
-   */
-  defaultLimit?: number;
-
-  /**
-   * Default sliding-window hossza milliszekundumban. Default: `60000` (1 perc).
-   */
-  defaultWindowMs?: number;
-
-  /**
-   * Rate-limit subject-extractor. Visszater a karakterlanccal, ami azonositja
-   * a rate-limit alanyat (pl. IP-cim, API-kulcs ID, account ID).
-   *
-   * Default: az Express altal mar megbizhatonak minositett `req.ip`, vagy ha
-   * hianyzik akkor `'unknown'`. A middleware szandekosan nem olvassa kozvetlenul
-   * az ugyfel altal hamisithato `x-forwarded-for` headert. Production uzemben a
-   * shared-store gate explicit, opaque extractort kovetel.
-   */
-  keyExtractor?: (req: Request) => string;
-
-  /**
-   * Endpoint-csoportosito. Visszater a karakterlanccal, ami azonositja az
-   * adott endpoint-csoportot. A storage-key egyertelmuen hossz-prefixelt
-   * subject + endpoint kompozicio lesz.
-   *
-   * Default: `req.path` — minden uri-path kulon vodorbe kerul. Csoportositas
-   * mas szempontok szerint (pl. "datasets" csoport = `/api/datasets/*`)
-   * a hostnal felulirhato.
-   */
-  endpointGrouper?: (req: Request) => string;
-
-  /** Optional permit cost per request. Default: one. */
-  costExtractor?: (req: Request) => number;
-
-  /** Atomic store. The default in-memory implementation is for tests and single-instance development only. */
-  store?: DyNTS_RateLimit_Store_Interface;
-
-  /** Fail configuration unless a shared store plus explicit opaque key/group extractors are supplied. */
-  requireSharedStore?: boolean;
-
-  /** Deterministic clock seam. Production callers normally omit it. */
-  clock?: () => number;
-
-  /**
-   * Beallitja-e a `X-RateLimit-Limit`, `X-RateLimit-Remaining`,
-   * `X-RateLimit-Reset` (es a 429-re `Retry-After`) response header-eket.
-   * Default: `true`.
-   *
-   * Test/dev kornyezetben opcionalisan kikapcsolhato.
-   */
-  responseHeaders?: boolean;
-
-  /**
-   * Per-policy override-ok az induloskor. A `setPolicyForKey()` runtime-ban is
-   * felulhatja ezeket.
-   */
-  initialKeyPolicies?: Record<string, DyNTS_RateLimit_Policy>;
-
-  /**
-   * Per-endpoint(-csoport) policy override-ok az induloskor. A `setPolicyForEndpoint()`
-   * runtime-ban is felulhatja ezeket. A kulcs annak felel meg, amit az `endpointGrouper`
-   * visszaad (default: `req.path`). Akkor hasznos, ha kulonbozo endpointoknak kulonbozo
-   * limit kell (pl. egy webhook nagy burst-toleranciat igenyel a legit forgalomhoz, mig
-   * egy admin-endpoint szuk limitet). Precedencia: per-kulcs policy > per-endpoint policy > default.
-   */
-  initialEndpointPolicies?: Record<string, DyNTS_RateLimit_Policy>;
-}

package/src/_modules/rate-limit/_models/rate-limit-consume-request.interface.ts

@@ -1,9 +0,0 @@
-import { DyNTS_RateLimit_Policy } from './rate-limit-policy.interface';
-
-/** Atomic permit request passed to a rate-limit store. */
-export interface DyNTS_RateLimit_ConsumeRequest_Interface {
-  bucketKey: string;
-  policy: DyNTS_RateLimit_Policy;
-  cost: number;
-  now: number;
-}

package/src/_modules/rate-limit/_models/rate-limit-consume-result.interface.ts

@@ -1,6 +0,0 @@
-/** Content-free result of one atomically committed permit request. */
-export interface DyNTS_RateLimit_ConsumeResult_Interface {
-  allowed: boolean;
-  remaining: number;
-  resetAt: number;
-}