@nodii/dsar

GDPR Data Subject Access Request (DSAR) library for the Nodii microservice stack — typed 9-RPC DataLifecycleService surface + per-subjectKind handler registry + DsarStore.

Spec: https://planning.dev.nucleus-cloud.in/api/v1/feature-docs?serviceId=nodii-libs&docKey=dsar

v0.1.0 — foundations

import {
  initDsar,
  dsar,
  InMemoryDsarStore,
  registerExportGather,
  registerEraseExecutor,
} from "@nodii/dsar";

initDsar({ store: new InMemoryDsarStore() });

registerExportGather("user", async ({ tenantId, subjectId }) => ({
  id: subjectId,
  email: "...",
}));

const opened = await dsar.beginDsar({
  tenantId: "t1",
  subjectId: "u-1",
  subjectKind: "user",
  requestType: "access",
  requestedBy: "tenant_admin",
  justification: "operator-requested access lookup",
});

const result = await dsar.accessData({ dsarId: opened.dsarId });

Public surface

• initDsar({ store?, logger? }) — bootstrap.
• dsar.beginDsar / getDsar / listDsars / accessData / eraseData / portabilityExport / rectify / markComplete / appealRejection — the 9-RPC DataLifecycleService surface.
• registerExportGather / registerEraseExecutor / registerRectifyHandler — per-subjectKind handler registry.
• canonicalJson(value) — byte-equal across TS / Py / Go.
• applyRetention(policies, dsarRow, dataClass) — retention helper.
• Typed errors: DsarError, DsarNotInitialized, DsarNotFound, JustificationRequired, SubjectKindNotRegistered, DsarTerminalStateViolation, ExportGatherFailed, EraseExecutionFailed, HandlerAlreadyRegistered.

Deferred to v0.1.x (marked // TODO dsar-v0.1.x: in source)

• Real gRPC server wiring + proto codegen for nodii.dsar.v1.
• Real @nodii/pii.decryptForExport integration.
• Real @nodii/audit-chain.emit integration for completion / appeal events.
• RetentionPolicyService separate gRPC server (lib ships types + helpers).
• Multi-format streaming for portabilityExport (jsonl + csv).
• Compensation walk + library-spawned child saga for partial-erasure rollback.