Initial commit

packages/core-dsr/AGENTS.md

@@ -0,0 +1,33 @@
+# @repo/core-dsr
+
+Optional core package providing GDPR Data Subject Rights (DSR) interfaces and implementations. Scaffold via `pnpm turbo gen core-package dsr`.
+
+## Structure
+
+```
+src/
+  data-export.interface.ts          # IDataExport — exportSubjectData
+  data-delete.interface.ts          # IDataDelete — deleteSubjectData
+  data-rectify.interface.ts         # IDataRectify — updateSubjectField
+  processing-restriction.interface.ts  # IProcessingRestriction — setRestriction, isRestricted
+  dsr-types.ts                      # UserDataBundle, DeletionCertificate, DSR value types
+  contexts/
+    user-data.jsonld                # schema.org JSON-LD @context
+  index.ts                          # Barrel export
+```
+
+## Design
+
+Four interfaces map directly to GDPR Articles 15–18 + 20:
+
+- `IDataExport` (Art. 15/20) — export a subject's data as `UserDataBundle`
+- `IDataDelete` (Art. 17) — soft-delete or cascade-hard-delete subject data; returns `DeletionCertificate`
+- `IDataRectify` (Art. 16) — update a specific field for a subject
+- `IProcessingRestriction` (Art. 18) — toggle and read the processing restriction flag
+
+Implementations walk `custom.pii`-tagged fields and `custom.subject`-linked collections. Row semantics:
+
+- `kind: "self" | "owner"` → directly owned by the subject (export full; delete hard or soft)
+- `kind: "reference"` → references the subject from another entity (export redacted; redact link on delete)
+
+See `docs/architecture/agent-first-workflow-and-conformance.md` for the DI conventions.