@cosmicdrift/kumiko-bundled-features 0.209.0 → 0.210.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.209.0",
+  "version": "0.210.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.209.0",
-    "@cosmicdrift/kumiko-framework": "0.209.0",
-    "@cosmicdrift/kumiko-headless": "0.209.0",
-    "@cosmicdrift/kumiko-renderer": "0.209.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.209.0",
-    "@cosmicdrift/kumiko-types": "0.209.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.210.0",
+    "@cosmicdrift/kumiko-framework": "0.210.0",
+    "@cosmicdrift/kumiko-headless": "0.210.0",
+    "@cosmicdrift/kumiko-renderer": "0.210.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.210.0",
+    "@cosmicdrift/kumiko-types": "0.210.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,6 +160,6 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.209.0"
+    "@cosmicdrift/kumiko-locale-de": "0.210.0"
   }
 }

package/src/auth-mfa/schema/user-mfa.ts

@@ -16,15 +16,17 @@ export const userMfaEntity = createEntity({
     // FK to the user row, not content — PII-naming heuristic would flag
     // "userId" as content; it's a pseudonymous reference, matching the same
     // annotation `config`'s userId column uses.
-    userId: createTextField({ required: true, allowPlaintext: "pseudonymous-fk" }),
+    userId: createTextField({ required: true, personal: false, reason: "pseudonymous_fk" }),
     // Envelope-encrypted via the same MasterKeyProvider as secrets/config
     // (entity-field-encryption.ts) — no manual wrapDek/unwrapDek needed.
-    // userOwned: crypto-shredding this field is exactly "revoke this
-    // user's 2FA on GDPR forget", which is the correct behavior anyway.
+    // `personal: { of: "userId" }`: crypto-shredding this field is exactly
+    // "revoke this user's 2FA on GDPR forget", which is the correct
+    // behavior anyway.
     totpSecret: createTextField({
       required: true,
       encrypted: true,
-      userOwned: { ownerField: "userId" },
+      personal: { of: "userId" },
+      find: "none",
     }),
     // JSON-stringified `{ hashes: string[] }` (argon2id hashes of unredeemed
     // recovery codes) — both encryption layers (entity-field envelope +
@@ -39,7 +41,8 @@ export const userMfaEntity = createEntity({
     recoveryCodes: createTextField({
       required: true,
       encrypted: true,
-      userOwned: { ownerField: "userId" },
+      personal: { of: "userId" },
+      find: "none",
     }),
     enabledAt: createTimestampField({ required: true }),
     lastUsedAt: createTimestampField(),

package/src/auth-mfa-user-data/hooks.ts

@@ -1,10 +1,11 @@
 // EXT_USER_DATA hooks for userMfa (GDPR Art. 15/17/20). Both totpSecret and
-// recoveryCodes are marked userOwned in the schema for exactly this: on
-// forget, the row must actually disappear — a leftover TOTP secret or
-// recovery-code hash under an anonymized user is still a live credential
-// nobody can rotate. Mirrors folders-user-data/hooks.ts's executor-based
-// delete (rebuild-safe: forget replays via the event, a raw DELETE would be
-// resurrected by a projection rebuild).
+// recoveryCodes are annotated `personal: { of: "userId" }` in the schema
+// for exactly this: on forget, the row must actually disappear — a
+// leftover TOTP secret or recovery-code hash under an anonymized user is
+// still a live credential nobody can rotate. Mirrors
+// folders-user-data/hooks.ts's executor-based delete (rebuild-safe: forget
+// replays via the event, a raw DELETE would be resurrected by a
+// projection rebuild).
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
@@ -36,8 +37,8 @@ export const userMfaExportHook: UserDataExportHook = async (ctx) => {
 };
 
 // Always a real hard-delete regardless of the incoming strategy — a 2FA
-// secret can't be anonymized, and userOwned already means this row belongs
-// to exactly one user (never shared tenant data).
+// secret can't be anonymized, and `personal: { of: "userId" }` already
+// means this row belongs to exactly one user (never shared tenant data).
 export const userMfaDeleteHook: UserDataDeleteHook = async (ctx) => {
   const rows = await selectMany<{ id: string }>(ctx.db, userMfaTable, {
     userId: ctx.userId,

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -119,8 +119,8 @@ beforeAll(async () => {
   // gepusht (r.projection mit `table`-Property → auto-push).
   await createEventsTable(db);
   await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
-  // providerCustomerId/providerSubscriptionId are `tenantOwned` PII-subject
-  // fields — no executor wires the KMS automatically here (raw r.projection,
+  // providerCustomerId/providerSubscriptionId are `personal: "tenant"`
+  // PII-subject fields — no executor wires the KMS automatically here (raw r.projection,
   // see feature.ts), so process-event.write.ts calls configuredPiiSubjectKms()
   // directly and needs one configured, same as run{Prod,Dev}App do at boot.
   configurePiiSubjectKms(new InMemoryKmsAdapter());

package/src/billing-foundation/entities.ts

@@ -40,7 +40,7 @@ export const subscriptionEntity = createEntity({
   table: "read_subscriptions",
   fields: {
     providerName: createTextField({ required: true, maxLength: 50 }),
-    // tenantOwned (not `encrypted`): the field must crypto-shred when
+    // `personal: "tenant"` (not `encrypted`): the field must crypto-shred when
     // eraseSubjectKeys erases the tenant's subject key on tenant-destroy
     // (#800). `encrypted: true` uses the app-wide master key instead — that
     // key is never erased per-tenant, so it would only add encryption-at-
@@ -52,12 +52,14 @@ export const subscriptionEntity = createEntity({
     providerCustomerId: createTextField({
       required: true,
       maxLength: 1000,
-      tenantOwned: true,
+      personal: "tenant",
+      find: "none",
     }),
     providerSubscriptionId: createTextField({
       required: true,
       maxLength: 1000,
-      tenantOwned: true,
+      personal: "tenant",
+      find: "none",
     }),
     status: createTextField({ required: true, maxLength: 30 }),
     tier: createTextField({ required: true, maxLength: 50 }),

package/src/billing-foundation/tenant-destroy-hook.ts

@@ -6,7 +6,7 @@ import { subscriptionAggregateId } from "./aggregate-id";
 import { SUBSCRIPTION_AGGREGATE_TYPE } from "./events";
 import { subscriptionsProjectionTable } from "./projection";
 
-// providerCustomerId/providerSubscriptionId are `tenantOwned: true` on the
+// providerCustomerId/providerSubscriptionId are `personal: "tenant"` on the
 // entity (envelope-encrypted with the tenant subject key, see entities.ts) —
 // eraseSubjectKeys crypto-shreds them for tenants that hard-delete. HGB
 // can not: it needs the accounting facts (status/tier/period) to survive, so

package/src/compliance-profiles/schema/profile-selection.ts

@@ -34,7 +34,8 @@ export const tenantComplianceProfileEntity = createEntity({
     // bedeutet "Default-Profile, keine Override". Validiert beim
     // set-profile-Handler via Zod.
     override: createLongTextField({
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
   },
   indexes: [

package/src/config/table.ts

@@ -25,7 +25,10 @@ export const configValueEntity = createEntity({
     // breaking the null-vs-missing distinction the resolver already draws.
     value: createTextField({}),
     // user-scope row: userId populated. tenant- / system-scope: null.
-    userId: createTextField({ allowPlaintext: "pseudonymous-fk" }),
+    userId: createTextField({
+      personal: false,
+      reason: "pseudonymous_fk",
+    }),
   },
   indexes: [
     { unique: true, columns: ["key", "tenantId", "userId"], name: "read_config_values_unique" },

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -185,14 +185,14 @@ describe("crypto-shredding :: forget-subject purges the derived search index (#1
       userNote: createTextField({
         required: true,
         maxLength: 100,
-        userOwned: { ownerField: "ownerId" },
-        searchable: true,
+        personal: { of: "ownerId" },
+        find: "fuzzy",
       }),
       tenantNote: createTextField({
         required: true,
         maxLength: 100,
-        tenantOwned: true,
-        searchable: true,
+        personal: "tenant",
+        find: "fuzzy",
       }),
     },
   });

package/src/custom-fields/feature.ts

@@ -6,8 +6,8 @@
 // nicht für personenbezogene Daten. Das frühere `sensitive`-Flag wurde
 // entfernt; das Schema rejected es und `parseSerializedField` wirft auf
 // Alt-Definitionen. Werte stehen vollständig im Event-Log (rebuild-safe).
-// PII gehört in Schema-Entity-Felder mit pii/userOwned/tenantOwned-
-// Annotation (Crypto-Shredding, Event-Ciphertext, Forget-Pipeline).
+// PII belongs in schema-entity fields with a `personal` annotation
+// (crypto-shredding, event ciphertext, forget pipeline).
 //
 // **Was diese Feature liefert (B1 + B2, 2026-05-23):**
 //   1. r.entity("field-definition") — Definition-Storage (event-sourced).

package/src/data-retention/__tests__/retention-cleanup.integration.test.ts

@@ -61,7 +61,10 @@ const staleEntity = createEntity({
 const retainedEntity = createEntity({
   table: "read_c7_retained",
   fields: {
-    label: createTextField({ required: true, anonymize: () => "[ANONYMIZED]" }),
+    // No subject flag on the old fixture either — anonymize alone has no
+    // PersonalAnnotations arm, so this stays a spread instead of a direct
+    // createTextField(...) override (kumiko-framework#2250).
+    label: { ...createTextField({ required: true }), anonymize: () => "[ANONYMIZED]" },
   },
   retention: { keepFor: "30d", strategy: "blockDelete" },
 });
@@ -71,8 +74,11 @@ const retainedEntity = createEntity({
 const anonEntity = createEntity({
   table: "read_c7_anon",
   fields: {
-    label: createTextField({ required: true, anonymize: () => "[ANONYMIZED]" }),
-    note: createTextField({ allowPlaintext: "is-business-data" }),
+    label: { ...createTextField({ required: true }), anonymize: () => "[ANONYMIZED]" },
+    note: createTextField({
+      personal: false,
+      reason: "is_business_data",
+    }),
   },
   retention: { keepFor: "30d", strategy: "anonymize" },
 });
@@ -81,7 +87,9 @@ const anonEntity = createEntity({
 // muss das als skip melden statt still nichts zu tun.
 const bareEntity = createEntity({
   table: "read_c7_bare",
-  fields: { label: createTextField({ required: true, allowPlaintext: "is-business-data" }) },
+  fields: {
+    label: createTextField({ required: true, personal: false, reason: "is_business_data" }),
+  },
   retention: { keepFor: "30d", strategy: "anonymize" },
 });
 

package/src/data-retention/schema/tenant-retention-override.ts

@@ -26,16 +26,19 @@ export const tenantRetentionOverrideEntity = createEntity({
     entityName: createTextField({
       required: true,
       maxLength: 100,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
     config: createLongTextField({
       required: true,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
     reason: createTextField({
       required: true,
       maxLength: 500,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
   },
   indexes: [{ unique: true, columns: ["tenantId", "entityName"] }],

package/src/delivery/tables.ts

@@ -76,7 +76,7 @@ export const deliveryAttemptsTableMeta: EntityTableMeta = defineUnmanagedTable({
 export const notificationPreferenceEntity = createEntity({
   table: "read_notification_preferences",
   fields: {
-    userId: createTextField({ required: true, allowPlaintext: "pseudonymous-fk" }),
+    userId: createTextField({ required: true, personal: false, reason: "pseudonymous_fk" }),
     notificationType: createTextField({ required: true }), // qualified name or "*"
     channel: createTextField({ required: true }), // "inApp", "email", "push", or "*"
     enabled: createBooleanField({ default: true }),

package/src/document-ingest-foundation/entity.ts

@@ -37,14 +37,17 @@ export const documentExtractEntity = createEntity({
   fields: {
     fileRefId: createTextField({ required: true }),
     storageKey: createTextField({ required: true }),
-    // Holds the full extracted document text (PII). `tenantOwned`, NOT
-    // `encrypted: true` (#1621): the master-key path has no erasure subject,
+    // Holds the full extracted document text (PII). `personal: "tenant"`,
+    // NOT `encrypted: true` (#1621): the master-key path has no erasure subject,
     // so nothing here would ever be shreddable. Tenant-subject ciphertext
     // dies with eraseSubjectKeys on tenant-destroy (#800 pattern). Whose
     // subject a third party named inside a document is stays open, same as
     // inbound-mail-foundation (#957). meta is provider telemetry only and
     // stays plaintext jsonb.
-    pages: createLongTextField({ tenantOwned: true }),
+    pages: createLongTextField({
+      personal: "tenant",
+      find: "none",
+    }),
     meta: createJsonbField(),
   },
 });

package/src/files/README.md

@@ -28,19 +28,19 @@ bewirtschaftet. Das öffnet die Tür für Cross-Feature-Hooks:
 ## PII-Annotations (Sprint 0.1+0.7)
 
 ```ts
-fileName    → pii: true                  (Originalname enthält oft Personen-Bezug)
-storageKey  → allowPlaintext: "is-business-data"  (interner UUID-Key)
-mimeType    → allowPlaintext: "is-business-data"
-size        → allowPlaintext: "is-business-data"
-entityType  → allowPlaintext: "is-business-data"
-entityId    → allowPlaintext: "is-business-data"
-fieldName   → allowPlaintext: "is-business-data"
-insertedAt  → kein PII-Marker (Audit-Timestamp, Framework-managed)
-insertedById → allowPlaintext: "is-business-data"  (User-Reference, kein Eigen-PII)
+fileName     → personal: "self", find: "none"  (Originalname enthält oft Personen-Bezug)
+storageKey   → kein PII-Marker (interner UUID-Key, trifft die Heuristik nicht)
+mimeType     → kein PII-Marker
+size         → kein PII-Marker
+entityType   → kein PII-Marker
+entityId     → kein PII-Marker
+fieldName    → kein PII-Marker
+insertedAt   → kein PII-Marker (Audit-Timestamp, Framework-managed Base-Column)
+insertedById → kein PII-Marker (User-Reference, Framework-managed Base-Column, kein Eigen-PII)
 ```
 
-`fileName: pii: true` heißt: Sprint 3 Crypto-Shredding wird den Wert
-mit dem Author-Subject-Key encrypten (für File-INHALTE: separates
+`fileName: personal: "self"` heißt: Sprint 3 Crypto-Shredding verschlüsselt den
+Wert mit dem Author-Subject-Key (für File-INHALTE: separates
 Subject-Resolver-Pattern via `subjectField` — siehe storage-encryption.md
 Sprint 4).
 

package/src/form-draft/entity.ts

@@ -24,13 +24,16 @@ export const formDraftEntity = createEntity({
     // feeds the GDPR-hook-coverage boot guard (it's a plain FK into `user`,
     // not content of its own) — see ../form-draft-user-data for the
     // required export/delete hook coverage.
-    ownerId: createTextField({ subjectRef: true, required: true }),
+    ownerId: createTextField({
+      personal: "ref",
+      required: true,
+    }),
     draftKey: createTextField({ required: true, maxLength: FORM_DRAFT_KEY_MAX_LENGTH }),
     // The blob shape is fixed by issue #1889, not left to the caller:
     // { values: Record<string, unknown>, stepIndex: number, savedAt: string }.
     // Free-form because `values` mirrors whatever fields the in-progress
-    // form has, so it can carry arbitrary user-entered PII. NOT annotated
-    // `userOwned` — the framework's PII field-encryption engine only
+    // form has, so it can carry arbitrary user-entered PII. NOT given a
+    // `personal` annotation — the framework's PII field-encryption engine only
     // accepts string values (pii-field-encryption.ts throws on a non-string
     // field), and this is a jsonb object. Erasure instead runs as a real
     // physical row-delete on forget (see form-draft-user-data/hooks.ts),

package/src/inbound-mail-foundation/entities.ts

@@ -17,9 +17,9 @@ import {
 // Source-of-truth sind die event-store-Streams `mail-account` /
 // `inbound-message` / `mail-thread` — die Tabellen sind rebuild-fähig.
 //
-// **PII-Konvention:** tenantOwned (nicht `encrypted`): Felder müssen
-// crypto-shredden wenn eraseSubjectKeys den Tenant-Subject-Key beim
-// tenant-destroy löscht (#800-Muster aus billing-foundation).
+// **PII convention:** `personal: "tenant"` (not `encrypted`): fields must
+// crypto-shred when eraseSubjectKeys deletes the tenant subject key on
+// tenant-destroy (#800 pattern from billing-foundation).
 // maxLength jeweils Ciphertext-budgetiert (`kumiko-pii:v1:<subject>:
 // <blob>` — Plaintext×~2.3 + Envelope-Overhead).
 //
@@ -41,12 +41,14 @@ export const mailAccountEntity = createEntity({
     // Owner + TenantAdmin (Compliance); KEIN Crypto-Subject-Wechsel in
     // V1 (Subject bleibt Tenant, siehe Header).
     ownerUserId: createTextField({ maxLength: 36 }),
+    // Tenant-authored mailbox label, not a person's name.
     displayName: createTextField({
       maxLength: 200,
-      allowPlaintext: "mailbox display name, tenant config not personal data",
+      personal: false,
+      reason: "tenant_config_not_personal",
     }),
     // Postfach-Adresse — PII des Tenants.
-    address: createTextField({ required: true, maxLength: 1000, tenantOwned: true }),
+    address: createTextField({ required: true, maxLength: 1000, personal: "tenant", find: "none" }),
     status: createTextField({ required: true, maxLength: 30 }),
     watchState: createTextField({ maxLength: 100 }),
     connectedAt: createTimestampField({ required: true }),
@@ -66,12 +68,12 @@ export const inboundMessageEntity = createEntity({
     ownerUserId: createTextField({ maxLength: 36 }),
     messageIdHeader: createTextField({ required: true, maxLength: 500 }),
     threadKey: createTextField({ required: true, maxLength: 500 }),
-    from: createTextField({ required: true, maxLength: 2000, tenantOwned: true }),
+    from: createTextField({ required: true, maxLength: 2000, personal: "tenant", find: "none" }),
     // JSON-stringified string[] — als Ganzes encrypted.
-    to: createTextField({ maxLength: 8000, tenantOwned: true }),
-    cc: createTextField({ maxLength: 8000, tenantOwned: true }),
-    subject: createTextField({ maxLength: 4000, tenantOwned: true }),
-    snippet: createTextField({ maxLength: 4000, tenantOwned: true }),
+    to: createTextField({ maxLength: 8000, personal: "tenant", find: "none" }),
+    cc: createTextField({ maxLength: 8000, personal: "tenant", find: "none" }),
+    subject: createTextField({ maxLength: 4000, personal: "tenant", find: "none" }),
+    snippet: createTextField({ maxLength: 4000, personal: "tenant", find: "none" }),
     receivedAt: createTimestampField({ required: true }),
     bodyRef: createTextField({ maxLength: 500 }),
     scope: createTextField({ maxLength: 200 }),
@@ -84,7 +86,7 @@ export const mailThreadEntity = createEntity({
   table: "read_mail_threads",
   fields: {
     threadKey: createTextField({ required: true, maxLength: 500 }),
-    subject: createTextField({ maxLength: 4000, tenantOwned: true }),
+    subject: createTextField({ maxLength: 4000, personal: "tenant", find: "none" }),
     lastMessageAt: createTimestampField({ required: true }),
     messageCount: createNumberField({ required: true, integer: true }),
   },

package/src/inbound-mail-foundation/feature.ts

@@ -35,11 +35,11 @@
 //     Supervisor-storeBody-Hook, Event trägt nur bodyRef.
 //   - Kein IMAP-Flag-Write-back (V1) — Inbox-Status lebt beim Consumer.
 //
-// **PII/DSGVO:** address/from/to/cc/subject/snippet sind tenantOwned —
-// encrypted VOR jedem Event-Append (einziger Write-Pfad), Event-Log UND
-// Projections tragen Ciphertext; tenant-destroy shreddet den Subject-Key
-// (crypto-shredding, Muster billing-foundation #800). Der Destroy-Hook
-// archiviert zusätzlich alle Streams + löscht die Rows.
+// **PII/GDPR:** address/from/to/cc/subject/snippet are `personal: "tenant"`
+// — encrypted BEFORE every event append (the only write path), event log AND
+// projections carry ciphertext; tenant-destroy shreds the subject key
+// (crypto-shredding, same pattern as billing-foundation #800). The destroy
+// hook additionally archives all streams + deletes the rows.
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, EXT_TENANT_DATA } from "@cosmicdrift/kumiko-framework/engine";