@cosmicdrift/kumiko-bundled-features 0.209.1 → 0.210.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.209.1",
+  "version": "0.210.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.209.1",
-    "@cosmicdrift/kumiko-framework": "0.209.1",
-    "@cosmicdrift/kumiko-headless": "0.209.1",
-    "@cosmicdrift/kumiko-renderer": "0.209.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.209.1",
-    "@cosmicdrift/kumiko-types": "0.209.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.210.0",
+    "@cosmicdrift/kumiko-framework": "0.210.0",
+    "@cosmicdrift/kumiko-headless": "0.210.0",
+    "@cosmicdrift/kumiko-renderer": "0.210.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.210.0",
+    "@cosmicdrift/kumiko-types": "0.210.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,6 +160,6 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.209.1"
+    "@cosmicdrift/kumiko-locale-de": "0.210.0"
   }
 }

package/src/auth-mfa/schema/user-mfa.ts

@@ -16,15 +16,17 @@ export const userMfaEntity = createEntity({
     // FK to the user row, not content — PII-naming heuristic would flag
     // "userId" as content; it's a pseudonymous reference, matching the same
     // annotation `config`'s userId column uses.
-    userId: createTextField({ required: true, allowPlaintext: "pseudonymous-fk" }),
+    userId: createTextField({ required: true, personal: false, reason: "pseudonymous_fk" }),
     // Envelope-encrypted via the same MasterKeyProvider as secrets/config
     // (entity-field-encryption.ts) — no manual wrapDek/unwrapDek needed.
-    // userOwned: crypto-shredding this field is exactly "revoke this
-    // user's 2FA on GDPR forget", which is the correct behavior anyway.
+    // `personal: { of: "userId" }`: crypto-shredding this field is exactly
+    // "revoke this user's 2FA on GDPR forget", which is the correct
+    // behavior anyway.
     totpSecret: createTextField({
       required: true,
       encrypted: true,
-      userOwned: { ownerField: "userId" },
+      personal: { of: "userId" },
+      find: "none",
     }),
     // JSON-stringified `{ hashes: string[] }` (argon2id hashes of unredeemed
     // recovery codes) — both encryption layers (entity-field envelope +
@@ -39,7 +41,8 @@ export const userMfaEntity = createEntity({
     recoveryCodes: createTextField({
       required: true,
       encrypted: true,
-      userOwned: { ownerField: "userId" },
+      personal: { of: "userId" },
+      find: "none",
     }),
     enabledAt: createTimestampField({ required: true }),
     lastUsedAt: createTimestampField(),

package/src/auth-mfa-user-data/hooks.ts

@@ -1,10 +1,11 @@
 // EXT_USER_DATA hooks for userMfa (GDPR Art. 15/17/20). Both totpSecret and
-// recoveryCodes are marked userOwned in the schema for exactly this: on
-// forget, the row must actually disappear — a leftover TOTP secret or
-// recovery-code hash under an anonymized user is still a live credential
-// nobody can rotate. Mirrors folders-user-data/hooks.ts's executor-based
-// delete (rebuild-safe: forget replays via the event, a raw DELETE would be
-// resurrected by a projection rebuild).
+// recoveryCodes are annotated `personal: { of: "userId" }` in the schema
+// for exactly this: on forget, the row must actually disappear — a
+// leftover TOTP secret or recovery-code hash under an anonymized user is
+// still a live credential nobody can rotate. Mirrors
+// folders-user-data/hooks.ts's executor-based delete (rebuild-safe: forget
+// replays via the event, a raw DELETE would be resurrected by a
+// projection rebuild).
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
@@ -36,8 +37,8 @@ export const userMfaExportHook: UserDataExportHook = async (ctx) => {
 };
 
 // Always a real hard-delete regardless of the incoming strategy — a 2FA
-// secret can't be anonymized, and userOwned already means this row belongs
-// to exactly one user (never shared tenant data).
+// secret can't be anonymized, and `personal: { of: "userId" }` already
+// means this row belongs to exactly one user (never shared tenant data).
 export const userMfaDeleteHook: UserDataDeleteHook = async (ctx) => {
   const rows = await selectMany<{ id: string }>(ctx.db, userMfaTable, {
     userId: ctx.userId,

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -119,8 +119,8 @@ beforeAll(async () => {
   // gepusht (r.projection mit `table`-Property → auto-push).
   await createEventsTable(db);
   await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
-  // providerCustomerId/providerSubscriptionId are `tenantOwned` PII-subject
-  // fields — no executor wires the KMS automatically here (raw r.projection,
+  // providerCustomerId/providerSubscriptionId are `personal: "tenant"`
+  // PII-subject fields — no executor wires the KMS automatically here (raw r.projection,
   // see feature.ts), so process-event.write.ts calls configuredPiiSubjectKms()
   // directly and needs one configured, same as run{Prod,Dev}App do at boot.
   configurePiiSubjectKms(new InMemoryKmsAdapter());

package/src/billing-foundation/entities.ts

@@ -40,7 +40,7 @@ export const subscriptionEntity = createEntity({
   table: "read_subscriptions",
   fields: {
     providerName: createTextField({ required: true, maxLength: 50 }),
-    // tenantOwned (not `encrypted`): the field must crypto-shred when
+    // `personal: "tenant"` (not `encrypted`): the field must crypto-shred when
     // eraseSubjectKeys erases the tenant's subject key on tenant-destroy
     // (#800). `encrypted: true` uses the app-wide master key instead — that
     // key is never erased per-tenant, so it would only add encryption-at-
@@ -52,12 +52,14 @@ export const subscriptionEntity = createEntity({
     providerCustomerId: createTextField({
       required: true,
       maxLength: 1000,
-      tenantOwned: true,
+      personal: "tenant",
+      find: "none",
     }),
     providerSubscriptionId: createTextField({
       required: true,
       maxLength: 1000,
-      tenantOwned: true,
+      personal: "tenant",
+      find: "none",
     }),
     status: createTextField({ required: true, maxLength: 30 }),
     tier: createTextField({ required: true, maxLength: 50 }),

package/src/billing-foundation/tenant-destroy-hook.ts

@@ -6,7 +6,7 @@ import { subscriptionAggregateId } from "./aggregate-id";
 import { SUBSCRIPTION_AGGREGATE_TYPE } from "./events";
 import { subscriptionsProjectionTable } from "./projection";
 
-// providerCustomerId/providerSubscriptionId are `tenantOwned: true` on the
+// providerCustomerId/providerSubscriptionId are `personal: "tenant"` on the
 // entity (envelope-encrypted with the tenant subject key, see entities.ts) —
 // eraseSubjectKeys crypto-shreds them for tenants that hard-delete. HGB
 // can not: it needs the accounting facts (status/tier/period) to survive, so

package/src/compliance-profiles/schema/profile-selection.ts

@@ -34,7 +34,8 @@ export const tenantComplianceProfileEntity = createEntity({
     // bedeutet "Default-Profile, keine Override". Validiert beim
     // set-profile-Handler via Zod.
     override: createLongTextField({
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
   },
   indexes: [

package/src/config/table.ts

@@ -25,7 +25,10 @@ export const configValueEntity = createEntity({
     // breaking the null-vs-missing distinction the resolver already draws.
     value: createTextField({}),
     // user-scope row: userId populated. tenant- / system-scope: null.
-    userId: createTextField({ allowPlaintext: "pseudonymous-fk" }),
+    userId: createTextField({
+      personal: false,
+      reason: "pseudonymous_fk",
+    }),
   },
   indexes: [
     { unique: true, columns: ["key", "tenantId", "userId"], name: "read_config_values_unique" },

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -185,14 +185,14 @@ describe("crypto-shredding :: forget-subject purges the derived search index (#1
       userNote: createTextField({
         required: true,
         maxLength: 100,
-        userOwned: { ownerField: "ownerId" },
-        searchable: true,
+        personal: { of: "ownerId" },
+        find: "fuzzy",
       }),
       tenantNote: createTextField({
         required: true,
         maxLength: 100,
-        tenantOwned: true,
-        searchable: true,
+        personal: "tenant",
+        find: "fuzzy",
       }),
     },
   });

package/src/custom-fields/feature.ts

@@ -6,8 +6,8 @@
 // nicht für personenbezogene Daten. Das frühere `sensitive`-Flag wurde
 // entfernt; das Schema rejected es und `parseSerializedField` wirft auf
 // Alt-Definitionen. Werte stehen vollständig im Event-Log (rebuild-safe).
-// PII gehört in Schema-Entity-Felder mit pii/userOwned/tenantOwned-
-// Annotation (Crypto-Shredding, Event-Ciphertext, Forget-Pipeline).
+// PII belongs in schema-entity fields with a `personal` annotation
+// (crypto-shredding, event ciphertext, forget pipeline).
 //
 // **Was diese Feature liefert (B1 + B2, 2026-05-23):**
 //   1. r.entity("field-definition") — Definition-Storage (event-sourced).

package/src/data-retention/__tests__/retention-cleanup.integration.test.ts

@@ -61,7 +61,10 @@ const staleEntity = createEntity({
 const retainedEntity = createEntity({
   table: "read_c7_retained",
   fields: {
-    label: createTextField({ required: true, anonymize: () => "[ANONYMIZED]" }),
+    // No subject flag on the old fixture either — anonymize alone has no
+    // PersonalAnnotations arm, so this stays a spread instead of a direct
+    // createTextField(...) override (kumiko-framework#2250).
+    label: { ...createTextField({ required: true }), anonymize: () => "[ANONYMIZED]" },
   },
   retention: { keepFor: "30d", strategy: "blockDelete" },
 });
@@ -71,8 +74,11 @@ const retainedEntity = createEntity({
 const anonEntity = createEntity({
   table: "read_c7_anon",
   fields: {
-    label: createTextField({ required: true, anonymize: () => "[ANONYMIZED]" }),
-    note: createTextField({ allowPlaintext: "is-business-data" }),
+    label: { ...createTextField({ required: true }), anonymize: () => "[ANONYMIZED]" },
+    note: createTextField({
+      personal: false,
+      reason: "is_business_data",
+    }),
   },
   retention: { keepFor: "30d", strategy: "anonymize" },
 });
@@ -81,7 +87,9 @@ const anonEntity = createEntity({
 // muss das als skip melden statt still nichts zu tun.
 const bareEntity = createEntity({
   table: "read_c7_bare",
-  fields: { label: createTextField({ required: true, allowPlaintext: "is-business-data" }) },
+  fields: {
+    label: createTextField({ required: true, personal: false, reason: "is_business_data" }),
+  },
   retention: { keepFor: "30d", strategy: "anonymize" },
 });
 

package/src/data-retention/schema/tenant-retention-override.ts

@@ -26,16 +26,19 @@ export const tenantRetentionOverrideEntity = createEntity({
     entityName: createTextField({
       required: true,
       maxLength: 100,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
     config: createLongTextField({
       required: true,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
     reason: createTextField({
       required: true,
       maxLength: 500,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
   },
   indexes: [{ unique: true, columns: ["tenantId", "entityName"] }],

package/src/delivery/tables.ts

@@ -76,7 +76,7 @@ export const deliveryAttemptsTableMeta: EntityTableMeta = defineUnmanagedTable({
 export const notificationPreferenceEntity = createEntity({
   table: "read_notification_preferences",
   fields: {
-    userId: createTextField({ required: true, allowPlaintext: "pseudonymous-fk" }),
+    userId: createTextField({ required: true, personal: false, reason: "pseudonymous_fk" }),
     notificationType: createTextField({ required: true }), // qualified name or "*"
     channel: createTextField({ required: true }), // "inApp", "email", "push", or "*"
     enabled: createBooleanField({ default: true }),

package/src/document-ingest-foundation/entity.ts

@@ -37,14 +37,17 @@ export const documentExtractEntity = createEntity({
   fields: {
     fileRefId: createTextField({ required: true }),
     storageKey: createTextField({ required: true }),
-    // Holds the full extracted document text (PII). `tenantOwned`, NOT
-    // `encrypted: true` (#1621): the master-key path has no erasure subject,
+    // Holds the full extracted document text (PII). `personal: "tenant"`,
+    // NOT `encrypted: true` (#1621): the master-key path has no erasure subject,
     // so nothing here would ever be shreddable. Tenant-subject ciphertext
     // dies with eraseSubjectKeys on tenant-destroy (#800 pattern). Whose
     // subject a third party named inside a document is stays open, same as
     // inbound-mail-foundation (#957). meta is provider telemetry only and
     // stays plaintext jsonb.
-    pages: createLongTextField({ tenantOwned: true }),
+    pages: createLongTextField({
+      personal: "tenant",
+      find: "none",
+    }),
     meta: createJsonbField(),
   },
 });

package/src/files/README.md

@@ -28,19 +28,19 @@ bewirtschaftet. Das öffnet die Tür für Cross-Feature-Hooks:
 ## PII-Annotations (Sprint 0.1+0.7)
 
 ```ts
-fileName    → pii: true                  (Originalname enthält oft Personen-Bezug)
-storageKey  → allowPlaintext: "is-business-data"  (interner UUID-Key)
-mimeType    → allowPlaintext: "is-business-data"
-size        → allowPlaintext: "is-business-data"
-entityType  → allowPlaintext: "is-business-data"
-entityId    → allowPlaintext: "is-business-data"
-fieldName   → allowPlaintext: "is-business-data"
-insertedAt  → kein PII-Marker (Audit-Timestamp, Framework-managed)
-insertedById → allowPlaintext: "is-business-data"  (User-Reference, kein Eigen-PII)
+fileName     → personal: "self", find: "none"  (Originalname enthält oft Personen-Bezug)
+storageKey   → kein PII-Marker (interner UUID-Key, trifft die Heuristik nicht)
+mimeType     → kein PII-Marker
+size         → kein PII-Marker
+entityType   → kein PII-Marker
+entityId     → kein PII-Marker
+fieldName    → kein PII-Marker
+insertedAt   → kein PII-Marker (Audit-Timestamp, Framework-managed Base-Column)
+insertedById → kein PII-Marker (User-Reference, Framework-managed Base-Column, kein Eigen-PII)
 ```
 
-`fileName: pii: true` heißt: Sprint 3 Crypto-Shredding wird den Wert
-mit dem Author-Subject-Key encrypten (für File-INHALTE: separates
+`fileName: personal: "self"` heißt: Sprint 3 Crypto-Shredding verschlüsselt den
+Wert mit dem Author-Subject-Key (für File-INHALTE: separates
 Subject-Resolver-Pattern via `subjectField` — siehe storage-encryption.md
 Sprint 4).
 

package/src/form-draft/entity.ts

@@ -24,13 +24,16 @@ export const formDraftEntity = createEntity({
     // feeds the GDPR-hook-coverage boot guard (it's a plain FK into `user`,
     // not content of its own) — see ../form-draft-user-data for the
     // required export/delete hook coverage.
-    ownerId: createTextField({ subjectRef: true, required: true }),
+    ownerId: createTextField({
+      personal: "ref",
+      required: true,
+    }),
     draftKey: createTextField({ required: true, maxLength: FORM_DRAFT_KEY_MAX_LENGTH }),
     // The blob shape is fixed by issue #1889, not left to the caller:
     // { values: Record<string, unknown>, stepIndex: number, savedAt: string }.
     // Free-form because `values` mirrors whatever fields the in-progress
-    // form has, so it can carry arbitrary user-entered PII. NOT annotated
-    // `userOwned` — the framework's PII field-encryption engine only
+    // form has, so it can carry arbitrary user-entered PII. NOT given a
+    // `personal` annotation — the framework's PII field-encryption engine only
     // accepts string values (pii-field-encryption.ts throws on a non-string
     // field), and this is a jsonb object. Erasure instead runs as a real
     // physical row-delete on forget (see form-draft-user-data/hooks.ts),

package/src/inbound-mail-foundation/entities.ts

@@ -17,9 +17,9 @@ import {
 // Source-of-truth sind die event-store-Streams `mail-account` /
 // `inbound-message` / `mail-thread` — die Tabellen sind rebuild-fähig.
 //
-// **PII-Konvention:** tenantOwned (nicht `encrypted`): Felder müssen
-// crypto-shredden wenn eraseSubjectKeys den Tenant-Subject-Key beim
-// tenant-destroy löscht (#800-Muster aus billing-foundation).
+// **PII convention:** `personal: "tenant"` (not `encrypted`): fields must
+// crypto-shred when eraseSubjectKeys deletes the tenant subject key on
+// tenant-destroy (#800 pattern from billing-foundation).
 // maxLength jeweils Ciphertext-budgetiert (`kumiko-pii:v1:<subject>:
 // <blob>` — Plaintext×~2.3 + Envelope-Overhead).
 //
@@ -41,12 +41,14 @@ export const mailAccountEntity = createEntity({
     // Owner + TenantAdmin (Compliance); KEIN Crypto-Subject-Wechsel in
     // V1 (Subject bleibt Tenant, siehe Header).
     ownerUserId: createTextField({ maxLength: 36 }),
+    // Tenant-authored mailbox label, not a person's name.
     displayName: createTextField({
       maxLength: 200,
-      allowPlaintext: "mailbox display name, tenant config not personal data",
+      personal: false,
+      reason: "tenant_config_not_personal",
     }),
     // Postfach-Adresse — PII des Tenants.
-    address: createTextField({ required: true, maxLength: 1000, tenantOwned: true }),
+    address: createTextField({ required: true, maxLength: 1000, personal: "tenant", find: "none" }),
     status: createTextField({ required: true, maxLength: 30 }),
     watchState: createTextField({ maxLength: 100 }),
     connectedAt: createTimestampField({ required: true }),
@@ -66,12 +68,12 @@ export const inboundMessageEntity = createEntity({
     ownerUserId: createTextField({ maxLength: 36 }),
     messageIdHeader: createTextField({ required: true, maxLength: 500 }),
     threadKey: createTextField({ required: true, maxLength: 500 }),
-    from: createTextField({ required: true, maxLength: 2000, tenantOwned: true }),
+    from: createTextField({ required: true, maxLength: 2000, personal: "tenant", find: "none" }),
     // JSON-stringified string[] — als Ganzes encrypted.
-    to: createTextField({ maxLength: 8000, tenantOwned: true }),
-    cc: createTextField({ maxLength: 8000, tenantOwned: true }),
-    subject: createTextField({ maxLength: 4000, tenantOwned: true }),
-    snippet: createTextField({ maxLength: 4000, tenantOwned: true }),
+    to: createTextField({ maxLength: 8000, personal: "tenant", find: "none" }),
+    cc: createTextField({ maxLength: 8000, personal: "tenant", find: "none" }),
+    subject: createTextField({ maxLength: 4000, personal: "tenant", find: "none" }),
+    snippet: createTextField({ maxLength: 4000, personal: "tenant", find: "none" }),
     receivedAt: createTimestampField({ required: true }),
     bodyRef: createTextField({ maxLength: 500 }),
     scope: createTextField({ maxLength: 200 }),
@@ -84,7 +86,7 @@ export const mailThreadEntity = createEntity({
   table: "read_mail_threads",
   fields: {
     threadKey: createTextField({ required: true, maxLength: 500 }),
-    subject: createTextField({ maxLength: 4000, tenantOwned: true }),
+    subject: createTextField({ maxLength: 4000, personal: "tenant", find: "none" }),
     lastMessageAt: createTimestampField({ required: true }),
     messageCount: createNumberField({ required: true, integer: true }),
   },

package/src/inbound-mail-foundation/feature.ts

@@ -35,11 +35,11 @@
 //     Supervisor-storeBody-Hook, Event trägt nur bodyRef.
 //   - Kein IMAP-Flag-Write-back (V1) — Inbox-Status lebt beim Consumer.
 //
-// **PII/DSGVO:** address/from/to/cc/subject/snippet sind tenantOwned —
-// encrypted VOR jedem Event-Append (einziger Write-Pfad), Event-Log UND
-// Projections tragen Ciphertext; tenant-destroy shreddet den Subject-Key
-// (crypto-shredding, Muster billing-foundation #800). Der Destroy-Hook
-// archiviert zusätzlich alle Streams + löscht die Rows.
+// **PII/GDPR:** address/from/to/cc/subject/snippet are `personal: "tenant"`
+// — encrypted BEFORE every event append (the only write path), event log AND
+// projections carry ciphertext; tenant-destroy shreds the subject key
+// (crypto-shredding, same pattern as billing-foundation #800). The destroy
+// hook additionally archives all streams + deletes the rows.
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, EXT_TENANT_DATA } from "@cosmicdrift/kumiko-framework/engine";

package/src/ledger/entity.ts

@@ -41,11 +41,12 @@ export const transactionEntity = createEntity({
   fields: {
     date: createDateField({ required: true }),
     // Journal narration ("Miete Januar", "Storno: …") is accounting data, not
-    // user-generated PII → allowPlaintext silences the user-content heuristic.
+    // user-generated PII → `personal: false` silences the user-content heuristic.
     description: createTextField({
       required: true,
       maxLength: 200,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
     // For a Storno entry this points at the reversed transaction's id.
     reference: createTextField({ maxLength: 120 }),
@@ -79,7 +80,8 @@ export const scheduleEntity = createEntity({
     description: createTextField({
       required: true,
       maxLength: 200,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
     startDate: createDateField({ required: true }),
     // Absent → open-ended (projects to the window's end).

package/src/managed-pages/screens/branding-screen.ts

@@ -42,7 +42,8 @@ export function createBrandingSettingsScreen(opts: {
       description: createTextField({
         maxLength: 500,
         multiline: { rows: 3 },
-        allowPlaintext: "is-business-data",
+        personal: false,
+        reason: "is_business_data",
       }),
       siteUrl: createTextField({ maxLength: 2000, format: "url" }),
       accentColor: createTextField({ maxLength: 9 }),

package/src/managed-pages/table.ts

@@ -26,9 +26,10 @@ export const pageEntity = createEntity({
     body: createTextField({
       multiline: { rows: 16 },
       maxLength: 100_000,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
-    description: createTextField({ maxLength: 500, allowPlaintext: "is-business-data" }),
+    description: createTextField({ maxLength: 500, personal: false, reason: "is_business_data" }),
     ogImage: createTextField({ maxLength: 2000 }),
     published: createBooleanField({ default: false }),
   },

package/src/notes-history/entity.ts

@@ -15,8 +15,9 @@ import {
 // registered (see feature.ts). A correction is a new entry, not an edit —
 // that is the whole point of a note *history* instead of the single
 // overwritable textarea this bundle replaces (solon#13). GDPR erasure of the
-// author still works without a delete path: `body` is `userOwned` (crypto-
-// shredding on the author's subject key), not `pii` on the entity itself.
+// author still works without a delete path: `body` is `personal: { of:
+// "authorId" }` (crypto-shredding on the author's subject key), not
+// `personal: "self"` on the entity itself.
 export const noteEntryEntity = createEntity({
   table: "read_note_entries",
   fields: {
@@ -27,11 +28,14 @@ export const noteEntryEntity = createEntity({
     // ctx.user.id (see feature.ts), so a note can't be authored as someone
     // else. subjectRef feeds the GDPR-hook-coverage boot guard (it's a plain
     // FK into `user`, not content of its own).
-    authorId: createTextField({ subjectRef: true }),
+    authorId: createTextField({
+      personal: "ref",
+    }),
     body: createLongTextField({
       required: true,
       maxLength: 20_000,
-      userOwned: { ownerField: "authorId" },
+      personal: { of: "authorId" },
+      find: "none",
     }),
   },
 });

package/src/notes-history-user-data/hooks.ts

@@ -26,11 +26,12 @@ export const noteEntryExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
-// Deliberate no-op: `body` is annotated `userOwned` (entity.ts), which relies
-// on crypto-shredding (mounted KMS) for erasure — destroying the author's
-// subject key makes every note-entry event AND projected row unreadable at
-// once, without needing a physical delete (which would also break the
-// bundle's append-only history for OTHER entities' co-authors reading it).
+// Deliberate no-op: `body` is annotated `personal: { of: "authorId" }`
+// (entity.ts), which relies on crypto-shredding (mounted KMS) for erasure —
+// destroying the author's subject key makes every note-entry event AND
+// projected row unreadable at once, without needing a physical delete
+// (which would also break the bundle's append-only history for OTHER
+// entities' co-authors reading it).
 // Same tradeoff as job-run/delivery-attempt (user-data-rights-defaults).
 // Precondition: this ONLY erases anything if the app mounts a KMS adapter —
 // without one, userOwned fields fall back to plaintext storage framework-wide

package/src/personal-access-tokens/schema/api-token.ts

@@ -33,7 +33,8 @@ export const apiTokenEntity = createEntity({
       required: true,
       maxLength: 120,
       access: { write: access.privileged },
-      userOwned: { ownerField: "userId" },
+      personal: { of: "userId" },
+      find: "none",
     }),
     tokenHash: createTextField({
       required: true,

package/src/sessions/feature.ts

@@ -245,10 +245,6 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       type: "projectionDetail",
       query: SessionQueries.detail,
       listScreenId: SESSION_LIST_SCREEN_ID,
-      // No write path on this screen — a "Cancel" button here would only
-      // ever discard nothing. Back-navigation still works via listScreenId
-      // above (resolveDetailBreadcrumb, renderer-web) — fw#2245.
-      hideActions: true,
       layout: {
         sections: [
           {

package/src/sessions/schema/user-session.ts

@@ -63,12 +63,14 @@ export const userSessionEntity = createEntity({
     ip: createTextField({
       maxLength: 64,
       access: { write: access.privileged },
-      userOwned: { ownerField: "userId" },
+      personal: { of: "userId" },
+      find: "none",
     }),
     userAgent: createTextField({
       maxLength: 512,
       access: { write: access.privileged },
-      userOwned: { ownerField: "userId" },
+      personal: { of: "userId" },
+      find: "none",
     }),
   },
 });

package/src/tags/entity.ts

@@ -7,11 +7,17 @@ export const tagEntity = createEntity({
   table: "read_tags",
   fields: {
     // Catalog labels ("urgent", "billing"), not user-identifying content —
-    // allowPlaintext silences the user-content heuristic (456/5). A tenant
-    // COULD name a tag after a person; if that becomes a real requirement,
-    // this needs a userOwned annotation + forget/export hooks in the
-    // user-data-rights pipeline (none exist for tags today).
-    name: createTextField({ required: true, maxLength: 64, allowPlaintext: "catalog-label" }),
+    // `personal: false` silences the user-content heuristic (456/5). A
+    // tenant COULD name a tag after a person; if that becomes a real
+    // requirement, this needs a `personal: { of: "<f>" }` annotation +
+    // forget/export hooks in the user-data-rights pipeline (none exist for
+    // tags today).
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "catalog_label",
+    }),
     // Optional UI hint (hex or token). No enforcement — purely for rendering.
     color: createTextField({ maxLength: 32 }),
     // Optional entity-type scope (GitLab project-vs-group labels): empty = global

package/src/template-resolver/__tests__/collection-ownership.integration.test.ts

@@ -321,7 +321,7 @@ describe("GDPR :: the owner column is what makes erasure possible", () => {
 
   test("the tenant-wide table keeps its business-data declaration", () => {
     const content = templateResourceEntity.fields["content"];
-    expect((content as { allowPlaintext?: string }).allowPlaintext).toBe("is-business-data");
+    expect((content as { allowPlaintext?: string }).allowPlaintext).toBe("is_business_data");
     expect((content as { userOwned?: unknown }).userOwned).toBeUndefined();
   });
 

package/src/template-resolver/table.ts

@@ -30,7 +30,10 @@ export const templateResourceEntity = createEntity({
     folder: createTextField({}),
     // Template-body is authored by TenantAdmin/Operator (email-templates etc.),
     // business data — kein end-user UGC.
-    content: createLongTextField({ allowPlaintext: "is-business-data" }),
+    content: createLongTextField({
+      personal: false,
+      reason: "is_business_data",
+    }),
     contentFormat: createSelectField({ required: true, options: [...CONTENT_FORMATS] }),
     variableSchema: createLongTextField({}),
     linkedResources: createLongTextField({}),

package/src/template-resolver/user-content-table.ts

@@ -24,13 +24,16 @@ import { CONTENT_FORMATS, TEMPLATE_KINDS } from "./constants";
 export const userContentEntryEntity = createEntity({
   table: "read_user_content_entries",
   fields: {
-    ownerId: createTextField({ required: true, subjectRef: true }),
+    ownerId: createTextField({ required: true, personal: "ref" }),
     slug: createTextField({ required: true }),
     kind: createSelectField({ required: true, options: [...TEMPLATE_KINDS] }),
     locale: createTextField({ required: true }),
     title: createTextField({}),
     folder: createTextField({}),
-    content: createLongTextField({ userOwned: { ownerField: "ownerId" } }),
+    content: createLongTextField({
+      personal: { of: "ownerId" },
+      find: "none",
+    }),
     contentFormat: createSelectField({ required: true, options: [...CONTENT_FORMATS] }),
   },
   indexes: [

package/src/template-resolver-user-data/hooks.ts

@@ -29,11 +29,12 @@ export const userContentExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
-// Deliberate no-op: `content` is annotated `userOwned`, so erasure runs via
-// crypto-shredding — destroying the owner's subject key makes every event AND
-// the projected row unreadable at once. A physical DELETE would not be
-// rebuild-safe here: user-content-entry is event-sourced, so a replay would
-// bring the row back (with unreadable content, but back).
+// Deliberate no-op: `content` is annotated `personal: { of: "ownerId" }`, so
+// erasure runs via crypto-shredding — destroying the owner's subject key
+// makes every event AND the projected row unreadable at once. A physical
+// DELETE would not be rebuild-safe here: user-content-entry is
+// event-sourced, so a replay would bring the row back (with unreadable
+// content, but back).
 // Precondition: this only erases anything if the app mounts a KMS adapter —
 // without one, userOwned fields fall back to plaintext framework-wide and
 // forget is a true no-op for `content`. Same property as notes-history.

package/src/tenant/invitation-table.ts

@@ -58,7 +58,7 @@ export const tenantInvitationEntity = createEntity({
   fields: {
     // Eingeladene Email — case-insensitive normalisiert beim Insert.
     // PII bis zur Annahme (danach hat der User selbst seine email in users).
-    email: createTextField({ required: true, maxLength: 320, pii: true, lookupable: true }),
+    email: createTextField({ required: true, maxLength: 320, personal: "self", find: "exact" }),
     // Membership-Rolle die dem User nach Accept gegeben wird. Default
     // im handler ist "Admin" (Co-Admin-Pattern für kleine Teams).
     role: createTextField({ required: true, maxLength: 50 }),
@@ -76,8 +76,8 @@ export const tenantInvitationEntity = createEntity({
     // decrypt-and-scan (see user-data-rights-defaults' invitation hook).
     invitedBy: createTextField({
       required: true,
-      userOwned: { ownerField: "invitedBy" },
-      lookupable: true,
+      personal: { of: "invitedBy" },
+      find: "exact",
     }),
     // UI-Anzeige — Wahrheit liegt in Redis-TTL.
     expiresAt: createTimestampField({ required: true }),

package/src/tenant-lifecycle/boot-checks.ts

@@ -1,7 +1,7 @@
 import {
   EXT_TENANT_DATA,
   type FeatureDefinition,
-  type PiiAnnotations,
+  type ResolvedPiiFlags,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { entitiesOf } from "../shared";
 
@@ -13,7 +13,7 @@ import { entitiesOf } from "../shared";
 // original guard's "tenant-lifecycle mounted" gate exactly (unlike gating on
 // a sibling feature, which would silently narrow coverage).
 
-function hasTenantOwned(field: unknown): field is PiiAnnotations {
+function hasTenantOwned(field: unknown): field is ResolvedPiiFlags {
   return (
     typeof field === "object" &&
     field !== null &&

package/src/tenant-settings/__tests__/settings-hub-i18n.test.ts

@@ -0,0 +1,58 @@
+// fw-i18n-funde: tenant-settings has admin-write keys at tenant-home scope
+// (see config.ts) — access.admin includes SystemAdmin, which cascades a
+// "set the platform default" screen up to the system audience alongside
+// the tenant-home screen (buildConfigFeatureSchema's ELEVATED_ROLES). Both
+// used to share the exact same `${feature}.settings` nav label, so the
+// sidebar showed the identical raw i18n key twice, once under each
+// audience. This test proves the real, declared translations resolve to
+// actual text (not the raw key) AND that the two nav entries read
+// differently — a regression guard, not an existence check.
+
+import { describe, expect, test } from "bun:test";
+import { createConfigFeature } from "@cosmicdrift/kumiko-bundled-features/config";
+import { buildConfigFeatureSchema, createRegistry } from "@cosmicdrift/kumiko-framework/engine";
+import { createTenantSettingsFeature } from "../feature";
+
+function translate(
+  translations: Readonly<Record<string, Readonly<Record<string, string>> | undefined>>,
+  key: string,
+  locale = "en",
+): string {
+  return translations[key]?.[locale] ?? key;
+}
+
+describe("tenant-settings — Settings-Hub nav/section labels", () => {
+  test("system + tenant scope screens both translate, and their nav labels differ", () => {
+    const registry = createRegistry([createConfigFeature(), createTenantSettingsFeature()]);
+    const schema = buildConfigFeatureSchema(registry);
+    const translations = registry.getFeature("tenant-settings")?.translations ?? {};
+
+    const systemNav = schema.navs.find((n) => n.id === "tenant-settings-system");
+    const tenantNav = schema.navs.find((n) => n.id === "tenant-settings-tenant");
+    expect(systemNav).toBeDefined();
+    expect(tenantNav).toBeDefined();
+    if (systemNav === undefined || tenantNav === undefined) throw new Error("unreachable");
+
+    const systemLabel = translate(translations, systemNav.label);
+    const tenantLabel = translate(translations, tenantNav.label);
+
+    // Both labels actually resolve to text — not an echoed raw key.
+    expect(systemLabel).not.toBe(systemNav.label);
+    expect(tenantLabel).not.toBe(tenantNav.label);
+    // The cross-scope duplicate this test guards against: the two nav
+    // entries read differently instead of repeating the same words under
+    // both "Platform" and "Organization".
+    expect(systemLabel).not.toBe(tenantLabel);
+
+    const systemScreen = schema.screens.find((s) => s.id === "tenant-settings-system");
+    expect(systemScreen).toBeDefined();
+    if (systemScreen === undefined || systemScreen.type !== "configEdit") {
+      throw new Error("unreachable");
+    }
+    const section = systemScreen.layout.sections[0];
+    const sectionTitle = section !== undefined && "title" in section ? section.title : undefined;
+    expect(sectionTitle).toBeDefined();
+    if (sectionTitle === undefined) throw new Error("unreachable");
+    expect(translate(translations, sectionTitle)).not.toBe(sectionTitle);
+  });
+});

package/src/tenant-settings/feature.ts

@@ -41,6 +41,18 @@ export function createTenantSettingsFeature(
           de: "Tenant-Einstellungen",
           en: "Tenant Settings",
         },
+        // Settings-Hub nav label + configEdit section heading (same key, both
+        // scopes fall back here — see buildConfigFeatureSchema).
+        "tenant-settings.settings": { de: "Tenant-Einstellungen", en: "Tenant Settings" },
+        // Both currency/locale are tenant-home with admin write access, which
+        // cascades a SystemAdmin-only "set the platform default" screen up to
+        // the system audience — scoped override so its nav entry reads
+        // differently from the tenant-home entry instead of repeating the
+        // same words under both "Platform" and "Organization".
+        "tenant-settings.settings.system": {
+          de: "Tenant-Einstellungen (Plattform-Standard)",
+          en: "Tenant Settings (Platform Default)",
+        },
       },
     });
   });

package/src/user/schema/user.ts

@@ -67,8 +67,8 @@ export const userEntity = createEntity({
       required: true,
       format: "email",
       maxLength: 320,
-      pii: true,
-      lookupable: true,
+      personal: "self",
+      find: "exact",
       access: { write: access.privileged },
     }),
 
@@ -85,8 +85,8 @@ export const userEntity = createEntity({
     displayName: createTextField({
       required: true,
       maxLength: 100,
-      pii: true,
-      searchable: true,
+      personal: "self",
+      find: "fuzzy",
     }),
     // No default here — tenant-settings owns the app-wide locale default; see #1637.
     locale: createTextField({ maxLength: 10 }),
@@ -169,7 +169,7 @@ export const userEntity = createEntity({
       access: { write: access.privileged },
     }),
   },
-  // fw#2134 — email is `pii: true, lookupable: true`, so the column holds
+  // fw#2134 — email is `personal: "self", find: "exact"`, so the column holds
   // per-row ciphertext: a plain unique index on it can't catch duplicates.
   // `unique: true` over a lookupable column makes buildEntityTable /
   // deriveEntityTableMeta emit a second, partial unique index over the

package/src/user-data-rights/__tests__/boot-checks.test.ts

@@ -96,7 +96,17 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
 
   test("V3: pii entity without any EXT_USER_DATA hook → throws the guard's own message", () => {
     const bad = defineFeature("crm", (r) => {
-      r.entity("contact", createEntity({ fields: { email: createTextField({ pii: true }) } }));
+      r.entity(
+        "contact",
+        createEntity({
+          fields: {
+            email: createTextField({
+              personal: "self",
+              find: "none",
+            }),
+          },
+        }),
+      );
     });
     expect(() => validateBoot([...baseFeatures(), bad])).toThrow(/EXT_USER_DATA hook.*Art\.17 gap/);
   });
@@ -110,7 +120,14 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
         source: "contact",
         table: projectionTable,
         apply: { [contactCreated.name]: async () => {} },
-        entity: createEntity({ fields: { email: createTextField({ pii: true }) } }),
+        entity: createEntity({
+          fields: {
+            email: createTextField({
+              personal: "self",
+              find: "none",
+            }),
+          },
+        }),
       });
     });
     expect(() => validateBoot([...baseFeatures(), bad])).toThrow(/EXT_USER_DATA hook.*Art\.17 gap/);
@@ -120,7 +137,13 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
     const bad = defineFeature("tasks", (r) => {
       r.entity(
         "task",
-        createEntity({ fields: { assigneeId: createTextField({ subjectRef: true }) } }),
+        createEntity({
+          fields: {
+            assigneeId: createTextField({
+              personal: "ref",
+            }),
+          },
+        }),
       );
     });
     expect(() => validateBoot([...baseFeatures(), bad])).toThrow(/EXT_USER_DATA hook.*Art\.17 gap/);
@@ -131,7 +154,13 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
       r.requires("user-data-rights");
       r.entity(
         "task",
-        createEntity({ fields: { assigneeId: createTextField({ subjectRef: true }) } }),
+        createEntity({
+          fields: {
+            assigneeId: createTextField({
+              personal: "ref",
+            }),
+          },
+        }),
       );
       r.useExtension(EXT_USER_DATA, "task", { export: async () => null, delete: async () => {} });
     });
@@ -148,7 +177,14 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
         source: "contact",
         table: projectionTable,
         apply: { [contactCreated.name]: async () => {} },
-        entity: createEntity({ fields: { email: createTextField({ pii: true }) } }),
+        entity: createEntity({
+          fields: {
+            email: createTextField({
+              personal: "self",
+              find: "none",
+            }),
+          },
+        }),
       });
       r.useExtension(EXT_USER_DATA, "contact-summary", {
         export: async () => null,
@@ -162,7 +198,14 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
     const bad = defineFeature("billing", (r) => {
       r.entity(
         "subscription",
-        createEntity({ fields: { providerCustomerId: createTextField({ tenantOwned: true }) } }),
+        createEntity({
+          fields: {
+            providerCustomerId: createTextField({
+              personal: "tenant",
+              find: "none",
+            }),
+          },
+        }),
       );
     });
     expect(() => validateBoot([...minimalTenantLifecycleFeatures(), bad])).toThrow(
@@ -174,7 +217,14 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
     const bad = defineFeature("billing", (r) => {
       r.entity(
         "subscription",
-        createEntity({ fields: { providerCustomerId: createTextField({ tenantOwned: true }) } }),
+        createEntity({
+          fields: {
+            providerCustomerId: createTextField({
+              personal: "tenant",
+              find: "none",
+            }),
+          },
+        }),
       );
     });
     const features = minimalTenantLifecycleFeatures().concat(bad);
@@ -186,7 +236,14 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
     const notMounted = defineFeature("billing-standalone", (r) => {
       r.entity(
         "subscription",
-        createEntity({ fields: { providerCustomerId: createTextField({ tenantOwned: true }) } }),
+        createEntity({
+          fields: {
+            providerCustomerId: createTextField({
+              personal: "tenant",
+              find: "none",
+            }),
+          },
+        }),
       );
     });
     expect(() => validateBoot([...baseFeatures(), notMounted])).not.toThrow();
@@ -197,7 +254,14 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
       r.requires("tenant-lifecycle");
       r.entity(
         "subscription",
-        createEntity({ fields: { providerCustomerId: createTextField({ tenantOwned: true }) } }),
+        createEntity({
+          fields: {
+            providerCustomerId: createTextField({
+              personal: "tenant",
+              find: "none",
+            }),
+          },
+        }),
       );
       r.useExtension(EXT_TENANT_DATA, "subscription", { destroy: async () => {} });
     });

package/src/user-data-rights/__tests__/forget-cleanup-search-purge-ordering.integration.test.ts

@@ -46,8 +46,8 @@ const noteEntity = createEntity({
     authorId: createTextField({ required: true }),
     body: createTextField({
       required: true,
-      searchable: true,
-      userOwned: { ownerField: "authorId" },
+      personal: { of: "authorId" },
+      find: "fuzzy",
     }),
   },
 });

package/src/user-data-rights/boot-checks.ts

@@ -1,7 +1,7 @@
 import {
   EXT_USER_DATA,
   type FeatureDefinition,
-  type PiiAnnotations,
+  type ResolvedPiiFlags,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { entitiesOf } from "../shared";
 
@@ -58,7 +58,7 @@ export function validateGdprPiiHookCoverage(features: readonly FeatureDefinition
       if (hookedEntities.has(entityName)) continue;
       const subjectFields = Object.entries(entity.fields)
         .filter(([, field]) => {
-          const annot = field as PiiAnnotations; // @cast-boundary schema-walk
+          const annot = field as ResolvedPiiFlags; // @cast-boundary schema-walk
           return Boolean(annot.pii) || Boolean(annot.userOwned) || Boolean(annot.subjectRef);
         })
         .map(([name]) => name);

package/src/user-data-rights/schema/download-token.ts

@@ -75,21 +75,23 @@ export const exportDownloadTokenEntity = createEntity({
     // (z.B. broken Sync-Tool).
     useCount: createBigIntField({}),
 
-    // Audit: Source-IP des letzten Downloads. Hilft DPO bei Untersuchung
-    // ungewoehnlicher Aktivitaeten ("Token wurde von 5 verschiedenen
-    // IPs genutzt"). Plain-IP-V4/IPv6, kein hash — DPO braucht direkt
-    // lesbar. is-business-data weil Token-Audit kein User-PII ist
-    // (gehoert dem Tenant-Operator).
+    // Audit: source IP of the last download. Helps the DPO investigate
+    // unusual activity ("token was used from 5 different IPs"). Plain
+    // IPv4/IPv6, no hash — DPO needs it directly readable.
+    // `reason: "is_business_data"` because token-audit data isn't user
+    // PII (it belongs to the tenant operator).
     lastUsedFromIp: createTextField({
-      maxLength: 45, // IPv6 max
-      allowPlaintext: "is-business-data",
+      maxLength: 45,
+      personal: false,
+      reason: "is_business_data",
     }),
 
-    // Audit: User-Agent des letzten Downloads. Audit-Wert (Email-Client
-    // vs Browser vs CLI-Tool unterscheidbar). is-business-data analog.
+    // Audit: user agent of the last download (distinguishes email
+    // client vs browser vs CLI tool). Same `reason` as above.
     lastUsedUserAgent: createTextField({
       maxLength: 500,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
   },
 

package/src/user-data-rights/schema/export-job.ts

@@ -133,11 +133,12 @@ export const exportJobEntity = createEntity({
     // verbleiben.
     expiresAt: createTimestampField({}),
 
-    // Failed-State Diagnose. longText weil Hook-Errors mit Stack-Trace
-    // mehrere KB werden koennen. is-business-data weil Job-Status
-    // public im UI-Polling sichtbar (kein PII).
+    // Failed-state diagnostics. longText because hook errors with stack
+    // traces can run several KB. `reason: "is_business_data"` because
+    // job status is publicly visible in UI polling (no PII).
     errorMessage: createLongTextField({
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
 
     // Audit-Info fuer Operator: wie gross war der Export. Hilft beim