@nodii/pii

Substrate PII library for the Nodii microservice stack — deterministic tokenization, per-subject DEK envelope encryption, redaction, DSAR helpers, extensible-entity scaffolding.

Spec: https://planning.dev.nucleus-cloud.in/api/v1/feature-docs?serviceId=nodii-libs&docKey=pii

v0.1.0 surface

import {
  initPii,
  pii,
  provisionTenantPii,
  PII_DETOKENIZE_PERMISSIONS,
  definePiiPolicyMap,
  defineExtensibleEntity,
  NoopKmsClient,
  NoopSecretsManagerClient,
  NoopPiiDbClient,
} from "@nodii/pii";

initPii({
  serviceName: "billing-svc",
  kmsClient,
  secretsManagerClient,
  region: "ap-south-1",
  env: "prod",
  db, // optional — required for detokenize + DSAR paths
});

// Tokenize (16 hex chars; deterministic per (value, tenantId))
const token = await pii.tokenize("[email protected]", {
  tenantId: "t1",
  fieldName: "email",
});

// Encrypt under a per-subject DEK envelope (AES-256-GCM)
const payload = await pii.withSubject("t1", "u1", "USER", () =>
  pii.encrypt("[email protected]"),
);

// DSAR
await pii.erasePerSubject("t1", "u1", "USER");

Deferred to v0.1.x

• Real AWS SDK v3 KMS + Secrets Manager wiring (typed interfaces ship now).
• Augmented Drizzle column types (piiText, piiNumeric, piiJsonb) + INSERT/UPDATE/SELECT middleware.
• Migration generator CLI (npx @nodii/pii migrate-gen <serviceName>).
• Bulk streaming (encryptStream).
• The full DSAR doctrine integration (gather-walk through the subject tree).

See .agent-todo.md at the repo root.