@futdevpro/nts-dynamo 1.15.316 → 1.15.320

package/build/_modules/privacy-lifecycle/privacy-lifecycle.mongo-store.d.ts

@@ -0,0 +1,136 @@
+import { Model, Schema } from 'mongoose';
+import { DyNTS_PrivacyContributorOutcome_Interface } from './_models/privacy-contributor-outcome.interface';
+import { DyNTS_PrivacyContributorPlan_Interface } from './_models/privacy-contributor-plan.interface';
+import { DyNTS_PrivacyLifecycleAdapter_Interface } from './_models/privacy-lifecycle-adapter.interface';
+import { DyNTS_PrivacyRequestPersistenceCreateResult_Interface } from './_models/privacy-request-persistence-create-result.interface';
+import { DyNTS_PrivacyRequestListQuery_Interface } from './_models/privacy-request-list.interface';
+import { DyNTS_PrivacyRequestPersistenceListResult_Interface } from './_models/privacy-request-list-result.interface';
+import { DyNTS_PrivacyRequestRecord_Interface } from './_models/privacy-request-record.interface';
+/** Persistence row of a contributor plan: the contract shape plus its lookup key. */
+export type DyNTS_PrivacyStoredPlan_Row = DyNTS_PrivacyContributorPlan_Interface & {
+    requestId: string;
+};
+/** Persistence row of a contributor outcome: the contract shape plus its lookup key. */
+export type DyNTS_PrivacyStoredOutcome_Row = DyNTS_PrivacyContributorOutcome_Interface & {
+    requestId: string;
+};
+/** Optional isolated models — integration tests bind them to a dedicated connection. */
+export interface DyNTS_PrivacyLifecycleMongoStore_Settings {
+    requestModel?: Model<DyNTS_PrivacyRequestRecord_Interface>;
+    planModel?: Model<DyNTS_PrivacyStoredPlan_Row>;
+    outcomeModel?: Model<DyNTS_PrivacyStoredOutcome_Row>;
+}
+/**
+ * Mongo persistence for the privacy lifecycle — the production `DyNTS_PrivacyLifecycleAdapter_Interface`.
+ *
+ * @description BFR-FUTDEVPRO-010 / BFR-ADVENTOR-025. Before this store the module shipped the contract only,
+ *   so `DyNTS_PrivacyLifecycle_ControlService` (which REQUIRES an adapter) could not be started, and three
+ *   products carried their own copies (company-toolmaker, futdevpro, adventor). This is the futdevpro copy,
+ *   lifted verbatim in behaviour; the collection and model names are unchanged, so existing data stays readable.
+ *
+ *   Atomicity does NOT need a transaction here — every guarantee is a single-document operation:
+ *   - replay idempotency: the UNIQUE `idempotencyHash` index (the loser of a race reads the winner);
+ *   - optimistic concurrency: `replaceRequest` puts `revision` INTO the filter, so a stale writer matches
+ *     nothing and gets `false` (the caller turns that into a 409);
+ *   - plan/outcome writes: an upsert on the UNIQUE `(requestId, contributorId)` pair.
+ *
+ *   ⚠️ A broken revision check here is not "a bug": it is a lost or doubly executed erasure request —
+ *   exactly the operation whose provability is the legal requirement (GDPR Art. 17).
+ *
+ *   ⚠️ Consumers that carried a product-side copy must DELETE it in the same change-set that switches to this
+ *   store: both register the same model names, and `resolveModel` silently returns whichever registered first.
+ */
+export declare class DyNTS_PrivacyLifecycle_MongoStore implements DyNTS_PrivacyLifecycleAdapter_Interface {
+    private readonly injected;
+    private readiness?;
+    /** Accepts isolated models for integration tests; production resolves the singletons lazily. */
+    constructor(set?: DyNTS_PrivacyLifecycleMongoStore_Settings);
+    /**
+     * Creates the indexes BEFORE the first read or write.
+     *
+     * @description Not a convenience step: idempotency and optimistic concurrency both rest on the UNIQUE
+     *   indexes. Without them a duplicate would not fail — it would silently become a second record.
+     */
+    ensureReady(): Promise<void>;
+    /**
+     * Creates one request, or returns the EXACT same request on an idempotent replay.
+     *
+     * @description The decision is not a racy "does it exist?" read (two parallel callers would both see
+     *   "no"), but the UNIQUE index: the second writer gets a duplicate-key error and reads the winner.
+     */
+    createOrGetRequest(request: DyNTS_PrivacyRequestRecord_Interface): Promise<DyNTS_PrivacyRequestPersistenceCreateResult_Interface>;
+    /** Loads one request by id. Does not throw when missing — interpreting absence is the caller's job. */
+    findRequestById(requestId: string): Promise<DyNTS_PrivacyRequestRecord_Interface | null>;
+    /**
+     * One bounded, deterministic, newest-first page of the subject's own requests.
+     *
+     * @description Sorted by TWO keys (`createdAt`, then `requestId`): with a single key two requests created in
+     *   the same millisecond would order non-deterministically and paging could skip or repeat a row
+     *   (`createdAt` is ISO-8601 UTC text, so string order is time order). The cursor is opaque and carries no
+     *   personal data — a timestamp and a machine id only.
+     */
+    listRequests(query: DyNTS_PrivacyRequestListQuery_Interface): Promise<DyNTS_PrivacyRequestPersistenceListResult_Interface>;
+    /**
+     * State transition with OPTIMISTIC CONCURRENCY.
+     *
+     * @description `revision` is part of the filter: if someone else rewrote the record meanwhile, the filter
+     *   matches nothing and `false` is returned. That `false` is not an error — it is the correct answer to a
+     *   race, and the caller turns it into a 409.
+     */
+    replaceRequest(request: DyNTS_PrivacyRequestRecord_Interface, expectedRevision: number): Promise<boolean>;
+    /**
+     * Stores one contributor plan.
+     *
+     * @description Overwrites, does not insert: a resumed run may deliver the same plan again. The upsert on the
+     *   `(requestId, contributorId)` pair keeps it idempotent — never two plans for one contributor.
+     */
+    saveContributorPlan(requestId: string, plan: DyNTS_PrivacyContributorPlan_Interface): Promise<void>;
+    /** All contributor plans of one request, in a stable order. */
+    listContributorPlans(requestId: string): Promise<DyNTS_PrivacyContributorPlan_Interface[]>;
+    /**
+     * Stores one contributor outcome.
+     *
+     * @description The overwrite is not only for resumed runs: on a failed verification the lifecycle
+     *   DELIBERATELY replaces an earlier (successful) outcome with a failed one — an insert-only store would make
+     *   the request look falsely successful.
+     */
+    saveContributorOutcome(requestId: string, outcome: DyNTS_PrivacyContributorOutcome_Interface): Promise<void>;
+    /** All contributor outcomes of one request, in a stable order. */
+    listContributorOutcomes(requestId: string): Promise<DyNTS_PrivacyContributorOutcome_Interface[]>;
+    /**
+     * The request-record schema.
+     *
+     * @description Date fields are `String`, not `Date`: the contract uses an EMPTY string for "has not happened
+     *   yet" (`identityVerifiedAt: ''`), which a `Date` field cannot represent. `strict: 'throw'` is deliberate —
+     *   an unknown field must not slip in silently.
+     */
+    static createRequestSchema(): Schema<DyNTS_PrivacyRequestRecord_Interface>;
+    /** The contributor-plan schema. */
+    static createPlanSchema(): Schema<DyNTS_PrivacyStoredPlan_Row>;
+    /** The contributor-outcome schema. */
+    static createOutcomeSchema(): Schema<DyNTS_PrivacyStoredOutcome_Row>;
+    /**
+     * The contract shape from a stored row — an ALLOW-list.
+     *
+     * @description `.lean()` also returns the persistence's own fields (`_id`). Passing them on, the lifecycle's
+     *   `{ ...request }` spread would write them back — the filtering keeps the domain object clean.
+     */
+    private toRequestRecord;
+    /** Opaque, but NOT encrypted, paging cursor — it holds no personal data. */
+    private encodeCursor;
+    /**
+     * Decodes the cursor — FAIL-SAFE: a damaged or forged cursor restarts paging on the FIRST page.
+     *
+     * @description Not a security hole: the `subjectId` + `organizationId` filter is independent of the cursor,
+     *   so the subject still sees only their own requests.
+     */
+    private decodeCursor;
+    private getRequestModel;
+    private getPlanModel;
+    private getOutcomeModel;
+    /** Lazy one-time model resolution — a second `mongoose.model(name, schema)` for one name would throw. */
+    private resolveModel;
+    /** Mongo duplicate-key error — the signal that carries the "idempotent replay" branch. */
+    private isDuplicateKey;
+}
+//# sourceMappingURL=privacy-lifecycle.mongo-store.d.ts.map

package/build/_modules/privacy-lifecycle/privacy-lifecycle.mongo-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-lifecycle.mongo-store.d.ts","sourceRoot":"","sources":["../../../src/_modules/privacy-lifecycle/privacy-lifecycle.mongo-store.ts"],"names":[],"mappings":"AAAA,OAAiB,EAAoB,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAErE,OAAO,EAAE,yCAAyC,EAAE,MAAM,iDAAiD,CAAC;AAC5G,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EACL,qDAAqD,EACtD,MAAM,+DAA+D,CAAC;AACvE,OAAO,EAAE,uCAAuC,EAAE,MAAM,0CAA0C,CAAC;AACnG,OAAO,EACL,mDAAmD,EACpD,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,oCAAoC,EAAE,MAAM,4CAA4C,CAAC;AAMlG,qFAAqF;AACrF,MAAM,MAAM,2BAA2B,GAAG,sCAAsC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzG,wFAAwF;AACxF,MAAM,MAAM,8BAA8B,GAAG,yCAAyC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/G,wFAAwF;AACxF,MAAM,WAAW,yCAAyC;IACxD,YAAY,CAAC,EAAE,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC3D,SAAS,CAAC,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,YAAY,CAAC,EAAE,KAAK,CAAC,8BAA8B,CAAC,CAAC;CACtD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,iCAAkC,YAAW,uCAAuC;IAC/F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;IACrE,OAAO,CAAC,SAAS,CAAC,CAAgB;IAElC,gGAAgG;gBACpF,GAAG,GAAE,yCAA8C;IAI/D;;;;;OAKG;IACU,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAezC;;;;;OAKG;IACU,kBAAkB,CAC7B,OAAO,EAAE,oCAAoC,GAC5C,OAAO,CAAC,qDAAqD,CAAC;IA4BjE,uGAAuG;IAC1F,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,GAAG,IAAI,CAAC;IAQrG;;;;;;;OAOG;IACU,YAAY,CACvB,KAAK,EAAE,uCAAuC,GAC7C,OAAO,CAAC,mDAAmD,CAAC;IA+B/D;;;;;;OAMG;IACU,cAAc,CACzB,OAAO,EAAE,oCAAoC,EAC7C,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,OAAO,CAAC;IASnB;;;;;OAKG;IACU,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhH,+DAA+D;IAClD,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sCAAsC,EAAE,CAAC;IAWvG;;;;;;OAMG;IACU,sBAAsB,CACjC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,yCAAyC,GACjD,OAAO,CAAC,IAAI,CAAC;IAQhB,kEAAkE;IACrD,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,yCAAyC,EAAE,CAAC;IAgB7G;;;;;;OAMG;WACW,mBAAmB,IAAI,MAAM,CAAC,oCAAoC,CAAC;IAkCjF,mCAAmC;WACrB,gBAAgB,IAAI,MAAM,CAAC,2BAA2B,CAAC;IAiBrE,sCAAsC;WACxB,mBAAmB,IAAI,MAAM,CAAC,8BAA8B,CAAC;IAsB3E;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAqBvB,4EAA4E;IAC5E,OAAO,CAAC,YAAY;IAIpB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,eAAe;IAMvB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,eAAe;IAMvB,yGAAyG;IACzG,OAAO,CAAC,YAAY;IAMpB,0FAA0F;IAC1F,OAAO,CAAC,cAAc;CAIvB"}

package/build/_modules/privacy-lifecycle/privacy-lifecycle.mongo-store.js

@@ -0,0 +1,316 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_PrivacyLifecycle_MongoStore = void 0;
+const tslib_1 = require("tslib");
+const mongoose_1 = tslib_1.__importStar(require("mongoose"));
+const DyNTS_privacyRequestModelName = 'DyNTSPrivacyRequest';
+const DyNTS_privacyRequestPlanModelName = 'DyNTSPrivacyRequestPlan';
+const DyNTS_privacyRequestOutcomeModelName = 'DyNTSPrivacyRequestOutcome';
+/**
+ * Mongo persistence for the privacy lifecycle — the production `DyNTS_PrivacyLifecycleAdapter_Interface`.
+ *
+ * @description BFR-FUTDEVPRO-010 / BFR-ADVENTOR-025. Before this store the module shipped the contract only,
+ *   so `DyNTS_PrivacyLifecycle_ControlService` (which REQUIRES an adapter) could not be started, and three
+ *   products carried their own copies (company-toolmaker, futdevpro, adventor). This is the futdevpro copy,
+ *   lifted verbatim in behaviour; the collection and model names are unchanged, so existing data stays readable.
+ *
+ *   Atomicity does NOT need a transaction here — every guarantee is a single-document operation:
+ *   - replay idempotency: the UNIQUE `idempotencyHash` index (the loser of a race reads the winner);
+ *   - optimistic concurrency: `replaceRequest` puts `revision` INTO the filter, so a stale writer matches
+ *     nothing and gets `false` (the caller turns that into a 409);
+ *   - plan/outcome writes: an upsert on the UNIQUE `(requestId, contributorId)` pair.
+ *
+ *   ⚠️ A broken revision check here is not "a bug": it is a lost or doubly executed erasure request —
+ *   exactly the operation whose provability is the legal requirement (GDPR Art. 17).
+ *
+ *   ⚠️ Consumers that carried a product-side copy must DELETE it in the same change-set that switches to this
+ *   store: both register the same model names, and `resolveModel` silently returns whichever registered first.
+ */
+class DyNTS_PrivacyLifecycle_MongoStore {
+    injected;
+    readiness;
+    /** Accepts isolated models for integration tests; production resolves the singletons lazily. */
+    constructor(set = {}) {
+        this.injected = set;
+    }
+    /**
+     * Creates the indexes BEFORE the first read or write.
+     *
+     * @description Not a convenience step: idempotency and optimistic concurrency both rest on the UNIQUE
+     *   indexes. Without them a duplicate would not fail — it would silently become a second record.
+     */
+    async ensureReady() {
+        this.readiness ??= Promise.all([
+            this.getRequestModel().createIndexes(),
+            this.getPlanModel().createIndexes(),
+            this.getOutcomeModel().createIndexes(),
+        ])
+            .then(() => undefined)
+            .catch((error) => {
+            this.readiness = undefined;
+            throw error;
+        });
+        await this.readiness;
+    }
+    /**
+     * Creates one request, or returns the EXACT same request on an idempotent replay.
+     *
+     * @description The decision is not a racy "does it exist?" read (two parallel callers would both see
+     *   "no"), but the UNIQUE index: the second writer gets a duplicate-key error and reads the winner.
+     */
+    async createOrGetRequest(request) {
+        try {
+            const created = await this.getRequestModel().create([request]);
+            const value = created[0]?.toObject();
+            if (!value) {
+                throw new Error('DYNTS|PRIVACY_LIFECYCLE|CREATE_EMPTY');
+            }
+            return { request: this.toRequestRecord(value), created: true };
+        }
+        catch (error) {
+            if (!this.isDuplicateKey(error)) {
+                throw error;
+            }
+            const existing = await this.getRequestModel()
+                .findOne({ idempotencyHash: request.idempotencyHash })
+                .lean().exec();
+            if (!existing) {
+                throw error;
+            }
+            return { request: this.toRequestRecord(existing), created: false };
+        }
+    }
+    /** Loads one request by id. Does not throw when missing — interpreting absence is the caller's job. */
+    async findRequestById(requestId) {
+        const found = await this.getRequestModel()
+            .findOne({ requestId: requestId })
+            .lean().exec();
+        return found ? this.toRequestRecord(found) : null;
+    }
+    /**
+     * One bounded, deterministic, newest-first page of the subject's own requests.
+     *
+     * @description Sorted by TWO keys (`createdAt`, then `requestId`): with a single key two requests created in
+     *   the same millisecond would order non-deterministically and paging could skip or repeat a row
+     *   (`createdAt` is ISO-8601 UTC text, so string order is time order). The cursor is opaque and carries no
+     *   personal data — a timestamp and a machine id only.
+     */
+    async listRequests(query) {
+        const filter = {
+            subjectId: query.subjectId,
+            organizationId: query.organizationId,
+        };
+        const cursor = this.decodeCursor(query.cursor);
+        if (cursor) {
+            filter.$or = [
+                { createdAt: { $lt: cursor.createdAt } },
+                { createdAt: cursor.createdAt, requestId: { $lt: cursor.requestId } },
+            ];
+        }
+        // One MORE than the page size: "is there a next page?" is answered without a separate
+        // (and non-consistent) countDocuments call.
+        const found = await this.getRequestModel().find(filter)
+            .sort({ createdAt: -1, requestId: -1 })
+            .limit(query.limit + 1)
+            .lean().exec();
+        const page = found.slice(0, query.limit)
+            .map((row) => this.toRequestRecord(row));
+        const last = page[page.length - 1];
+        return {
+            requests: page,
+            nextCursor: found.length > query.limit && last ? this.encodeCursor(last) : '',
+        };
+    }
+    /**
+     * State transition with OPTIMISTIC CONCURRENCY.
+     *
+     * @description `revision` is part of the filter: if someone else rewrote the record meanwhile, the filter
+     *   matches nothing and `false` is returned. That `false` is not an error — it is the correct answer to a
+     *   race, and the caller turns it into a 409.
+     */
+    async replaceRequest(request, expectedRevision) {
+        const result = await this.getRequestModel().replaceOne({ requestId: request.requestId, revision: expectedRevision }, this.toRequestRecord(request)).exec();
+        return result.matchedCount === 1;
+    }
+    /**
+     * Stores one contributor plan.
+     *
+     * @description Overwrites, does not insert: a resumed run may deliver the same plan again. The upsert on the
+     *   `(requestId, contributorId)` pair keeps it idempotent — never two plans for one contributor.
+     */
+    async saveContributorPlan(requestId, plan) {
+        await this.getPlanModel().updateOne({ requestId: requestId, contributorId: plan.contributorId }, { $set: { ...plan, requestId: requestId } }, { upsert: true }).exec();
+    }
+    /** All contributor plans of one request, in a stable order. */
+    async listContributorPlans(requestId) {
+        const rows = await this.getPlanModel().find({ requestId: requestId })
+            .sort({ contributorId: 1 }).lean().exec();
+        return rows.map((row) => ({
+            contributorId: row.contributorId,
+            action: row.action,
+            retentionBasisCode: row.retentionBasisCode,
+        }));
+    }
+    /**
+     * Stores one contributor outcome.
+     *
+     * @description The overwrite is not only for resumed runs: on a failed verification the lifecycle
+     *   DELIBERATELY replaces an earlier (successful) outcome with a failed one — an insert-only store would make
+     *   the request look falsely successful.
+     */
+    async saveContributorOutcome(requestId, outcome) {
+        await this.getOutcomeModel().updateOne({ requestId: requestId, contributorId: outcome.contributorId }, { $set: { ...outcome, requestId: requestId } }, { upsert: true }).exec();
+    }
+    /** All contributor outcomes of one request, in a stable order. */
+    async listContributorOutcomes(requestId) {
+        const rows = await this.getOutcomeModel().find({ requestId: requestId })
+            .sort({ contributorId: 1 }).lean().exec();
+        return rows.map((row) => ({
+            contributorId: row.contributorId,
+            action: row.action,
+            outcome: row.outcome,
+            retentionBasisCode: row.retentionBasisCode,
+            artifactChecksum: row.artifactChecksum,
+            processedRecordCount: row.processedRecordCount,
+            errorCode: row.errorCode,
+            completedAt: row.completedAt,
+        }));
+    }
+    /**
+     * The request-record schema.
+     *
+     * @description Date fields are `String`, not `Date`: the contract uses an EMPTY string for "has not happened
+     *   yet" (`identityVerifiedAt: ''`), which a `Date` field cannot represent. `strict: 'throw'` is deliberate —
+     *   an unknown field must not slip in silently.
+     */
+    static createRequestSchema() {
+        const schema = new mongoose_1.Schema({
+            requestId: { type: String, required: true, immutable: true, maxlength: 128 },
+            subjectId: { type: String, required: true, immutable: true, maxlength: 128 },
+            organizationId: { type: String, required: true, immutable: true, maxlength: 128 },
+            type: { type: String, required: true, immutable: true, maxlength: 64 },
+            state: { type: String, required: true, maxlength: 64 },
+            idempotencyHash: { type: String, required: true, immutable: true, match: /^[a-f0-9]{64}$/u },
+            revision: { type: Number, required: true, min: 0, validate: Number.isSafeInteger },
+            createdAt: { type: String, required: true, immutable: true, maxlength: 64 },
+            deadlineAt: { type: String, required: true, maxlength: 64 },
+            identityVerifiedAt: { type: String, default: '', maxlength: 64 },
+            scopedAt: { type: String, default: '', maxlength: 64 },
+            plannedAt: { type: String, default: '', maxlength: 64 },
+            executionStartedAt: { type: String, default: '', maxlength: 64 },
+            verifyingStartedAt: { type: String, default: '', maxlength: 64 },
+            completedAt: { type: String, default: '', maxlength: 64 },
+            cancelledAt: { type: String, default: '', maxlength: 64 },
+        }, {
+            collection: 'dynts_privacy_requests',
+            strict: 'throw',
+            versionKey: false,
+        });
+        schema.index({ idempotencyHash: 1 }, { unique: true, name: 'uq_dynts_privacy_request_idempotency' });
+        schema.index({ requestId: 1 }, { unique: true, name: 'uq_dynts_privacy_request_id' });
+        schema.index({ subjectId: 1, organizationId: 1, createdAt: -1, requestId: -1 }, { name: 'ix_dynts_privacy_request_subject_page' });
+        return schema;
+    }
+    /** The contributor-plan schema. */
+    static createPlanSchema() {
+        const schema = new mongoose_1.Schema({
+            requestId: { type: String, required: true, immutable: true, maxlength: 128 },
+            contributorId: { type: String, required: true, immutable: true, maxlength: 128 },
+            action: { type: String, required: true, maxlength: 64 },
+            retentionBasisCode: { type: String, default: '', maxlength: 128 },
+        }, {
+            collection: 'dynts_privacy_request_plans',
+            strict: 'throw',
+            versionKey: false,
+        });
+        schema.index({ requestId: 1, contributorId: 1 }, { unique: true, name: 'uq_dynts_privacy_plan_scope' });
+        return schema;
+    }
+    /** The contributor-outcome schema. */
+    static createOutcomeSchema() {
+        const schema = new mongoose_1.Schema({
+            requestId: { type: String, required: true, immutable: true, maxlength: 128 },
+            contributorId: { type: String, required: true, immutable: true, maxlength: 128 },
+            action: { type: String, required: true, maxlength: 64 },
+            outcome: { type: String, required: true, maxlength: 64 },
+            retentionBasisCode: { type: String, default: '', maxlength: 128 },
+            artifactChecksum: { type: String, default: '', maxlength: 128 },
+            processedRecordCount: { type: Number, required: true, min: 0, validate: Number.isSafeInteger },
+            errorCode: { type: String, default: '', maxlength: 128 },
+            completedAt: { type: String, required: true, maxlength: 64 },
+        }, {
+            collection: 'dynts_privacy_request_outcomes',
+            strict: 'throw',
+            versionKey: false,
+        });
+        schema.index({ requestId: 1, contributorId: 1 }, { unique: true, name: 'uq_dynts_privacy_outcome_scope' });
+        return schema;
+    }
+    /**
+     * The contract shape from a stored row — an ALLOW-list.
+     *
+     * @description `.lean()` also returns the persistence's own fields (`_id`). Passing them on, the lifecycle's
+     *   `{ ...request }` spread would write them back — the filtering keeps the domain object clean.
+     */
+    toRequestRecord(row) {
+        return {
+            requestId: row.requestId,
+            subjectId: row.subjectId,
+            organizationId: row.organizationId,
+            type: row.type,
+            state: row.state,
+            idempotencyHash: row.idempotencyHash,
+            revision: row.revision,
+            createdAt: row.createdAt,
+            deadlineAt: row.deadlineAt,
+            identityVerifiedAt: row.identityVerifiedAt ?? '',
+            scopedAt: row.scopedAt ?? '',
+            plannedAt: row.plannedAt ?? '',
+            executionStartedAt: row.executionStartedAt ?? '',
+            verifyingStartedAt: row.verifyingStartedAt ?? '',
+            completedAt: row.completedAt ?? '',
+            cancelledAt: row.cancelledAt ?? '',
+        };
+    }
+    /** Opaque, but NOT encrypted, paging cursor — it holds no personal data. */
+    encodeCursor(record) {
+        return Buffer.from(`${record.createdAt}|${record.requestId}`, 'utf8').toString('base64url');
+    }
+    /**
+     * Decodes the cursor — FAIL-SAFE: a damaged or forged cursor restarts paging on the FIRST page.
+     *
+     * @description Not a security hole: the `subjectId` + `organizationId` filter is independent of the cursor,
+     *   so the subject still sees only their own requests.
+     */
+    decodeCursor(cursor) {
+        if (!cursor) {
+            return undefined;
+        }
+        const parts = Buffer.from(cursor, 'base64url').toString('utf8').split('|');
+        return parts.length === 2 && parts[0] && parts[1]
+            ? { createdAt: parts[0], requestId: parts[1] }
+            : undefined;
+    }
+    getRequestModel() {
+        return this.injected.requestModel ?? this.resolveModel(DyNTS_privacyRequestModelName, DyNTS_PrivacyLifecycle_MongoStore.createRequestSchema());
+    }
+    getPlanModel() {
+        return this.injected.planModel ?? this.resolveModel(DyNTS_privacyRequestPlanModelName, DyNTS_PrivacyLifecycle_MongoStore.createPlanSchema());
+    }
+    getOutcomeModel() {
+        return this.injected.outcomeModel ?? this.resolveModel(DyNTS_privacyRequestOutcomeModelName, DyNTS_PrivacyLifecycle_MongoStore.createOutcomeSchema());
+    }
+    /** Lazy one-time model resolution — a second `mongoose.model(name, schema)` for one name would throw. */
+    resolveModel(name, schema) {
+        return mongoose_1.default.modelNames().includes(name)
+            ? mongoose_1.default.model(name)
+            : mongoose_1.default.model(name, schema);
+    }
+    /** Mongo duplicate-key error — the signal that carries the "idempotent replay" branch. */
+    isDuplicateKey(error) {
+        return typeof error === 'object' && error !== null && 'code' in error
+            && Object.getOwnPropertyDescriptor(error, 'code')?.value === 11000;
+    }
+}
+exports.DyNTS_PrivacyLifecycle_MongoStore = DyNTS_PrivacyLifecycle_MongoStore;
+//# sourceMappingURL=privacy-lifecycle.mongo-store.js.map

package/build/_modules/privacy-lifecycle/privacy-lifecycle.mongo-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-lifecycle.mongo-store.js","sourceRoot":"","sources":["../../../src/_modules/privacy-lifecycle/privacy-lifecycle.mongo-store.ts"],"names":[],"mappings":";;;;AAAA,6DAAqE;AAcrE,MAAM,6BAA6B,GAA0B,qBAAqB,CAAC;AACnF,MAAM,iCAAiC,GAA8B,yBAAyB,CAAC;AAC/F,MAAM,oCAAoC,GAAiC,4BAA4B,CAAC;AAexG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,iCAAiC;IAC3B,QAAQ,CAA4C;IAC7D,SAAS,CAAiB;IAElC,gGAAgG;IAChG,YAAY,MAAiD,EAAE;QAC7D,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,WAAW;QACtB,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,GAAG,CAAC;YAC7B,IAAI,CAAC,eAAe,EAAE,CAAC,aAAa,EAAE;YACtC,IAAI,CAAC,YAAY,EAAE,CAAC,aAAa,EAAE;YACnC,IAAI,CAAC,eAAe,EAAE,CAAC,aAAa,EAAE;SACvC,CAAC;aACC,IAAI,CAAC,GAAS,EAAE,CAAC,SAAS,CAAC;aAC3B,KAAK,CAAC,CAAC,KAAc,EAAS,EAAE;YAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAE3B,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACL,MAAM,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,kBAAkB,CAC7B,OAA6C;QAE7C,IAAI,CAAC;YACH,MAAM,OAAO,GACX,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAE,OAAO,CAAE,CAAC,CAAC;YACnD,MAAM,KAAK,GAAqD,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAEvF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAgD,MAAM,IAAI,CAAC,eAAe,EAAE;iBACvF,OAAO,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;iBACrD,IAAI,EAAwC,CAAC,IAAI,EAAE,CAAC;YAEvD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,KAAK,CAAC;YACd,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IAED,uGAAuG;IAChG,KAAK,CAAC,eAAe,CAAC,SAAiB;QAC5C,MAAM,KAAK,GAAgD,MAAM,IAAI,CAAC,eAAe,EAAE;aACpF,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;aACjC,IAAI,EAAwC,CAAC,IAAI,EAAE,CAAC;QAEvD,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,YAAY,CACvB,KAA8C;QAE9C,MAAM,MAAM,GAA4B;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;QACF,MAAM,MAAM,GAAyD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAErG,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,GAAG;gBACX,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE;gBACxC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE;aACtE,CAAC;QACJ,CAAC;QAED,sFAAsF;QACtF,4CAA4C;QAC5C,MAAM,KAAK,GAA2C,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5F,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;aACtC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;aACtB,IAAI,EAA0C,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,GAA2C,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC;aAC7E,GAAG,CAAC,CAAC,GAAyC,EAAwC,EAAE,CACvF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAqD,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAErF,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9E,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,cAAc,CACzB,OAA6C,EAC7C,gBAAwB;QAExB,MAAM,MAAM,GAAiC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,UAAU,CAClF,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAC5D,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAC9B,CAAC,IAAI,EAAE,CAAC;QAET,OAAO,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,mBAAmB,CAAC,SAAiB,EAAE,IAA4C;QAC9F,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CACjC,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAC3D,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAC3C,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;IAED,+DAA+D;IACxD,KAAK,CAAC,oBAAoB,CAAC,SAAiB;QACjD,MAAM,IAAI,GAAkC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;aACjG,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAiC,CAAC,IAAI,EAAE,CAAC;QAE3E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAgC,EAA0C,EAAE,CAAC,CAAC;YAC7F,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,sBAAsB,CACjC,SAAiB,EACjB,OAAkD;QAElD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,SAAS,CACpC,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,EAC9D,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAC9C,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;IAED,kEAAkE;IAC3D,KAAK,CAAC,uBAAuB,CAAC,SAAiB;QACpD,MAAM,IAAI,GAAqC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;aACvG,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAoC,CAAC,IAAI,EAAE,CAAC;QAE9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAmC,EAA6C,EAAE,CAAC,CAAC;YACnG,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;YAC1C,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;YAC9C,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,mBAAmB;QAC/B,MAAM,MAAM,GAAiD,IAAI,iBAAM,CAAuC;YAC5G,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAC5E,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAC5E,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YACjF,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YACtE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YACtD,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE;YAC5F,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE;YAClF,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YAC3E,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YAC3D,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YAChE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YACtD,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YACvD,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YAChE,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YAChE,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YACzD,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;SAC1D,EAAE;YACD,UAAU,EAAE,wBAAwB;YACpC,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;QACrG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,KAAK,CACV,EAAE,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EACjE,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAClD,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mCAAmC;IAC5B,MAAM,CAAC,gBAAgB;QAC5B,MAAM,MAAM,GAAwC,IAAI,iBAAM,CAA8B;YAC1F,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAC5E,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAChF,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YACvD,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;SAClE,EAAE;YACD,UAAU,EAAE,6BAA6B;YACzC,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAExG,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sCAAsC;IAC/B,MAAM,CAAC,mBAAmB;QAC/B,MAAM,MAAM,GAA2C,IAAI,iBAAM,CAAiC;YAChG,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAC5E,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAChF,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YACvD,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YACxD,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;YACjE,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;YAC/D,oBAAoB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE;YAC9F,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;YACxD,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;SAC7D,EAAE;YACD,UAAU,EAAE,gCAAgC;YAC5C,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAE3G,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,GAAyC;QAC/D,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE;YAChD,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;YAC5B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;YAC9B,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE;YAChD,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE;YAChD,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;YAClC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;SACnC,CAAC;IACJ,CAAC;IAED,4EAA4E;IACpE,YAAY,CAAC,MAA4C;QAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9F,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAAC,MAAc;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAa,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAErF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;YAC9C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAEO,eAAe;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CACpD,6BAA6B,EAAE,iCAAiC,CAAC,mBAAmB,EAAE,CACvF,CAAC;IACJ,CAAC;IAEO,YAAY;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CACjD,iCAAiC,EAAE,iCAAiC,CAAC,gBAAgB,EAAE,CACxF,CAAC;IACJ,CAAC;IAEO,eAAe;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CACpD,oCAAoC,EAAE,iCAAiC,CAAC,mBAAmB,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,yGAAyG;IACjG,YAAY,CAAI,IAAY,EAAE,MAAiB;QACrD,OAAO,kBAAQ,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,kBAAQ,CAAC,KAAK,CAAI,IAAI,CAAC;YACzB,CAAC,CAAC,kBAAQ,CAAC,KAAK,CAAI,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,0FAA0F;IAClF,cAAc,CAAC,KAAc;QACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;eAChE,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC;IACvE,CAAC;CACF;AAtWD,8EAsWC"}

package/build/_modules/usage/index.d.ts

@@ -1,4 +1,6 @@
 export * from './usage.controller';
+export * from './usage-session-owner.interface';
+export * from './usage-session-account-query.interface';
 export * from './usage.data-service';
 export * from './get-usage-routing-module.util';
 export * from '@futdevpro/fsm-dynamo/usage';

package/build/_modules/usage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/index.ts"],"names":[],"mappings":"AAUA,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/index.ts"],"names":[],"mappings":"AAUA,cAAc,oBAAoB,CAAC;AACnC,cAAc,iCAAiC,CAAC;AAChD,cAAc,yCAAyC,CAAC;AACxD,cAAc,sBAAsB,CAAC;AACrC,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC"}

package/build/_modules/usage/index.js

@@ -8,6 +8,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
 // USAGE MODULE
 tslib_1.__exportStar(require("./usage.controller"), exports);
+tslib_1.__exportStar(require("./usage-session-owner.interface"), exports);
+tslib_1.__exportStar(require("./usage-session-account-query.interface"), exports);
 tslib_1.__exportStar(require("./usage.data-service"), exports);
 tslib_1.__exportStar(require("./get-usage-routing-module.util"), exports);
 tslib_1.__exportStar(require("@futdevpro/fsm-dynamo/usage"), exports);

package/build/_modules/usage/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/_modules/usage/index.ts"],"names":[],"mappings":";AAEA,EAAE;AACF,eAAe;AACf,EAAE;AACF,qEAAqE;AACrE,EAAE;;;AAGF,eAAe;AACf,6DAAmC;AACnC,+DAAqC;AACrC,0EAAgD;AAChD,sEAA4C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/_modules/usage/index.ts"],"names":[],"mappings":";AAEA,EAAE;AACF,eAAe;AACf,EAAE;AACF,qEAAqE;AACrE,EAAE;;;AAGF,eAAe;AACf,6DAAmC;AACnC,0EAAgD;AAChD,kFAAwD;AACxD,+DAAqC;AACrC,0EAAgD;AAChD,sEAA4C"}

package/build/_modules/usage/usage-session-account-query.interface.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Identifies the sessions of one account (BFR-FUTDEVPRO-015).
+ */
+export interface DyNTS_UsageSession_AccountQuery {
+    /** Account id — sessions since nts-dynamo 1.15.320 store it in `issuer` */
+    accountId: string;
+    /**
+     * Usernames the account has used. Sessions written BEFORE 1.15.320 stored the username in `issuer`
+     * (and nothing in `loggedInAs`), so without these the legacy sessions are NOT found.
+     */
+    legacyUsernames?: string[];
+}
+//# sourceMappingURL=usage-session-account-query.interface.d.ts.map

package/build/_modules/usage/usage-session-account-query.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-session-account-query.interface.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/usage-session-account-query.interface.ts"],"names":[],"mappings":"AACA;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B"}

package/build/_modules/usage/usage-session-account-query.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=usage-session-account-query.interface.js.map

package/build/_modules/usage/usage-session-account-query.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-session-account-query.interface.js","sourceRoot":"","sources":["../../../src/_modules/usage/usage-session-account-query.interface.ts"],"names":[],"mappings":""}

package/build/_modules/usage/usage-session-owner.interface.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The owner of a usage session, as resolved from the incoming request (BFR-FUTDEVPRO-015).
+ *
+ * - `accountId` is what goes into the session's `issuer` (`fdp-issuer-is-account-id`); `'unknown'` when
+ *   the request carries no resolvable account (anonymous visitor, or optional-auth mode).
+ * - `username` goes into `loggedInAs`, and ONLY when an account was resolved — it exists so that legacy
+ *   sessions (written before 1.15.320 with `issuer: <username>`) can still be linked to their account.
+ */
+export interface DyNTS_UsageSessionOwner {
+    /** Account id of the session owner, or `'unknown'` */
+    accountId: string;
+    /** Username of the session owner; `undefined` for anonymous sessions */
+    username?: string;
+}
+//# sourceMappingURL=usage-session-owner.interface.d.ts.map

package/build/_modules/usage/usage-session-owner.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-session-owner.interface.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/usage-session-owner.interface.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/build/_modules/usage/usage-session-owner.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=usage-session-owner.interface.js.map

package/build/_modules/usage/usage-session-owner.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-session-owner.interface.js","sourceRoot":"","sources":["../../../src/_modules/usage/usage-session-owner.interface.ts"],"names":[],"mappings":""}

package/build/_modules/usage/usage.controller.d.ts

@@ -1,7 +1,23 @@
+import { Request } from 'express';
 import { DyNTS_Controller } from '../../_services/route/controller.service';
+import { DyNTS_UsageSessionOwner } from './usage-session-owner.interface';
 export declare class DyNTS_Usage_Controller extends DyNTS_Controller {
     static getInstance(): DyNTS_Usage_Controller;
     private authService;
     setupEndpoints(): void;
+    /**
+     * Resolves the owner of a new usage session (BFR-FUTDEVPRO-015).
+     *
+     * The `issuer` of a session is ALWAYS the account id (`fdp-issuer-is-account-id`) — before this fix it was
+     * the username, so account erasure could not find the sessions (which carry the visitor's IP address).
+     * The username is kept in `loggedInAs` only for logged-in sessions, as a bridge to legacy records.
+     *
+     * Never throws: the endpoint is public, so an absent/invalid token or a missing auth service
+     * (optional-auth mode, BFR-FDPPAL-001) yields an anonymous `'unknown'` owner.
+     *
+     * @param req the incoming request
+     * @returns the resolved owner
+     */
+    getSessionOwnerFromRequest(req: Request): DyNTS_UsageSessionOwner;
 }
 //# sourceMappingURL=usage.controller.d.ts.map

package/build/_modules/usage/usage.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usage.controller.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/usage.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAG5E,qBAAa,sBAAuB,SAAQ,gBAAgB;IAE1D,MAAM,CAAC,WAAW,IAAI,sBAAsB;IAK5C,OAAO,CAAC,WAAW,CAAoB;IAEvC,cAAc,IAAI,IAAI;CAiHvB"}
+{"version":3,"file":"usage.controller.d.ts","sourceRoot":"","sources":["../../../src/_modules/usage/usage.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAY,MAAM,SAAS,CAAC;AAY5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAG1E,qBAAa,sBAAuB,SAAQ,gBAAgB;IAE1D,MAAM,CAAC,WAAW,IAAI,sBAAsB;IAK5C,OAAO,CAAC,WAAW,CAAoB;IAEvC,cAAc,IAAI,IAAI;IA8GtB;;;;;;;;;;;;OAYG;IACH,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB;CA4BlE"}