@cosmicdrift/kumiko-bundled-features 0.209.1 → 0.211.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.209.1",
+  "version": "0.211.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.209.1",
-    "@cosmicdrift/kumiko-framework": "0.209.1",
-    "@cosmicdrift/kumiko-headless": "0.209.1",
-    "@cosmicdrift/kumiko-renderer": "0.209.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.209.1",
-    "@cosmicdrift/kumiko-types": "0.209.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.211.0",
+    "@cosmicdrift/kumiko-framework": "0.211.0",
+    "@cosmicdrift/kumiko-headless": "0.211.0",
+    "@cosmicdrift/kumiko-renderer": "0.211.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.211.0",
+    "@cosmicdrift/kumiko-types": "0.211.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,6 +160,6 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.209.1"
+    "@cosmicdrift/kumiko-locale-de": "0.211.0"
   }
 }

package/src/auth-mfa/schema/user-mfa.ts

@@ -16,15 +16,17 @@ export const userMfaEntity = createEntity({
     // FK to the user row, not content — PII-naming heuristic would flag
     // "userId" as content; it's a pseudonymous reference, matching the same
     // annotation `config`'s userId column uses.
-    userId: createTextField({ required: true, allowPlaintext: "pseudonymous-fk" }),
+    userId: createTextField({ required: true, personal: false, reason: "pseudonymous_fk" }),
     // Envelope-encrypted via the same MasterKeyProvider as secrets/config
     // (entity-field-encryption.ts) — no manual wrapDek/unwrapDek needed.
-    // userOwned: crypto-shredding this field is exactly "revoke this
-    // user's 2FA on GDPR forget", which is the correct behavior anyway.
+    // `personal: { of: "userId" }`: crypto-shredding this field is exactly
+    // "revoke this user's 2FA on GDPR forget", which is the correct
+    // behavior anyway.
     totpSecret: createTextField({
       required: true,
       encrypted: true,
-      userOwned: { ownerField: "userId" },
+      personal: { of: "userId" },
+      find: "none",
     }),
     // JSON-stringified `{ hashes: string[] }` (argon2id hashes of unredeemed
     // recovery codes) — both encryption layers (entity-field envelope +
@@ -39,7 +41,8 @@ export const userMfaEntity = createEntity({
     recoveryCodes: createTextField({
       required: true,
       encrypted: true,
-      userOwned: { ownerField: "userId" },
+      personal: { of: "userId" },
+      find: "none",
     }),
     enabledAt: createTimestampField({ required: true }),
     lastUsedAt: createTimestampField(),

package/src/auth-mfa-user-data/hooks.ts

@@ -1,10 +1,11 @@
 // EXT_USER_DATA hooks for userMfa (GDPR Art. 15/17/20). Both totpSecret and
-// recoveryCodes are marked userOwned in the schema for exactly this: on
-// forget, the row must actually disappear — a leftover TOTP secret or
-// recovery-code hash under an anonymized user is still a live credential
-// nobody can rotate. Mirrors folders-user-data/hooks.ts's executor-based
-// delete (rebuild-safe: forget replays via the event, a raw DELETE would be
-// resurrected by a projection rebuild).
+// recoveryCodes are annotated `personal: { of: "userId" }` in the schema
+// for exactly this: on forget, the row must actually disappear — a
+// leftover TOTP secret or recovery-code hash under an anonymized user is
+// still a live credential nobody can rotate. Mirrors
+// folders-user-data/hooks.ts's executor-based delete (rebuild-safe: forget
+// replays via the event, a raw DELETE would be resurrected by a
+// projection rebuild).
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
@@ -36,8 +37,8 @@ export const userMfaExportHook: UserDataExportHook = async (ctx) => {
 };
 
 // Always a real hard-delete regardless of the incoming strategy — a 2FA
-// secret can't be anonymized, and userOwned already means this row belongs
-// to exactly one user (never shared tenant data).
+// secret can't be anonymized, and `personal: { of: "userId" }` already
+// means this row belongs to exactly one user (never shared tenant data).
 export const userMfaDeleteHook: UserDataDeleteHook = async (ctx) => {
   const rows = await selectMany<{ id: string }>(ctx.db, userMfaTable, {
     userId: ctx.userId,

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -119,8 +119,8 @@ beforeAll(async () => {
   // gepusht (r.projection mit `table`-Property → auto-push).
   await createEventsTable(db);
   await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
-  // providerCustomerId/providerSubscriptionId are `tenantOwned` PII-subject
-  // fields — no executor wires the KMS automatically here (raw r.projection,
+  // providerCustomerId/providerSubscriptionId are `personal: "tenant"`
+  // PII-subject fields — no executor wires the KMS automatically here (raw r.projection,
   // see feature.ts), so process-event.write.ts calls configuredPiiSubjectKms()
   // directly and needs one configured, same as run{Prod,Dev}App do at boot.
   configurePiiSubjectKms(new InMemoryKmsAdapter());

package/src/billing-foundation/entities.ts

@@ -40,7 +40,7 @@ export const subscriptionEntity = createEntity({
   table: "read_subscriptions",
   fields: {
     providerName: createTextField({ required: true, maxLength: 50 }),
-    // tenantOwned (not `encrypted`): the field must crypto-shred when
+    // `personal: "tenant"` (not `encrypted`): the field must crypto-shred when
     // eraseSubjectKeys erases the tenant's subject key on tenant-destroy
     // (#800). `encrypted: true` uses the app-wide master key instead — that
     // key is never erased per-tenant, so it would only add encryption-at-
@@ -52,12 +52,14 @@ export const subscriptionEntity = createEntity({
     providerCustomerId: createTextField({
       required: true,
       maxLength: 1000,
-      tenantOwned: true,
+      personal: "tenant",
+      find: "none",
     }),
     providerSubscriptionId: createTextField({
       required: true,
       maxLength: 1000,
-      tenantOwned: true,
+      personal: "tenant",
+      find: "none",
     }),
     status: createTextField({ required: true, maxLength: 30 }),
     tier: createTextField({ required: true, maxLength: 50 }),

package/src/billing-foundation/tenant-destroy-hook.ts

@@ -6,7 +6,7 @@ import { subscriptionAggregateId } from "./aggregate-id";
 import { SUBSCRIPTION_AGGREGATE_TYPE } from "./events";
 import { subscriptionsProjectionTable } from "./projection";
 
-// providerCustomerId/providerSubscriptionId are `tenantOwned: true` on the
+// providerCustomerId/providerSubscriptionId are `personal: "tenant"` on the
 // entity (envelope-encrypted with the tenant subject key, see entities.ts) —
 // eraseSubjectKeys crypto-shreds them for tenants that hard-delete. HGB
 // can not: it needs the accounting facts (status/tier/period) to survive, so

package/src/compliance-profiles/schema/profile-selection.ts

@@ -34,7 +34,8 @@ export const tenantComplianceProfileEntity = createEntity({
     // bedeutet "Default-Profile, keine Override". Validiert beim
     // set-profile-Handler via Zod.
     override: createLongTextField({
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
   },
   indexes: [

package/src/config/table.ts

@@ -25,7 +25,10 @@ export const configValueEntity = createEntity({
     // breaking the null-vs-missing distinction the resolver already draws.
     value: createTextField({}),
     // user-scope row: userId populated. tenant- / system-scope: null.
-    userId: createTextField({ allowPlaintext: "pseudonymous-fk" }),
+    userId: createTextField({
+      personal: false,
+      reason: "pseudonymous_fk",
+    }),
   },
   indexes: [
     { unique: true, columns: ["key", "tenantId", "userId"], name: "read_config_values_unique" },

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -185,14 +185,14 @@ describe("crypto-shredding :: forget-subject purges the derived search index (#1
       userNote: createTextField({
         required: true,
         maxLength: 100,
-        userOwned: { ownerField: "ownerId" },
-        searchable: true,
+        personal: { of: "ownerId" },
+        find: "fuzzy",
       }),
       tenantNote: createTextField({
         required: true,
         maxLength: 100,
-        tenantOwned: true,
-        searchable: true,
+        personal: "tenant",
+        find: "fuzzy",
       }),
     },
   });

package/src/custom-fields/feature.ts

@@ -6,8 +6,8 @@
 // nicht für personenbezogene Daten. Das frühere `sensitive`-Flag wurde
 // entfernt; das Schema rejected es und `parseSerializedField` wirft auf
 // Alt-Definitionen. Werte stehen vollständig im Event-Log (rebuild-safe).
-// PII gehört in Schema-Entity-Felder mit pii/userOwned/tenantOwned-
-// Annotation (Crypto-Shredding, Event-Ciphertext, Forget-Pipeline).
+// PII belongs in schema-entity fields with a `personal` annotation
+// (crypto-shredding, event ciphertext, forget pipeline).
 //
 // **Was diese Feature liefert (B1 + B2, 2026-05-23):**
 //   1. r.entity("field-definition") — Definition-Storage (event-sourced).

package/src/data-retention/__tests__/retention-cleanup.integration.test.ts

@@ -61,7 +61,10 @@ const staleEntity = createEntity({
 const retainedEntity = createEntity({
   table: "read_c7_retained",
   fields: {
-    label: createTextField({ required: true, anonymize: () => "[ANONYMIZED]" }),
+    // No subject flag on the old fixture either — anonymize alone has no
+    // PersonalAnnotations arm, so this stays a spread instead of a direct
+    // createTextField(...) override (kumiko-framework#2250).
+    label: { ...createTextField({ required: true }), anonymize: () => "[ANONYMIZED]" },
   },
   retention: { keepFor: "30d", strategy: "blockDelete" },
 });
@@ -71,8 +74,11 @@ const retainedEntity = createEntity({
 const anonEntity = createEntity({
   table: "read_c7_anon",
   fields: {
-    label: createTextField({ required: true, anonymize: () => "[ANONYMIZED]" }),
-    note: createTextField({ allowPlaintext: "is-business-data" }),
+    label: { ...createTextField({ required: true }), anonymize: () => "[ANONYMIZED]" },
+    note: createTextField({
+      personal: false,
+      reason: "is_business_data",
+    }),
   },
   retention: { keepFor: "30d", strategy: "anonymize" },
 });
@@ -81,7 +87,9 @@ const anonEntity = createEntity({
 // muss das als skip melden statt still nichts zu tun.
 const bareEntity = createEntity({
   table: "read_c7_bare",
-  fields: { label: createTextField({ required: true, allowPlaintext: "is-business-data" }) },
+  fields: {
+    label: createTextField({ required: true, personal: false, reason: "is_business_data" }),
+  },
   retention: { keepFor: "30d", strategy: "anonymize" },
 });
 

package/src/data-retention/schema/tenant-retention-override.ts

@@ -26,16 +26,19 @@ export const tenantRetentionOverrideEntity = createEntity({
     entityName: createTextField({
       required: true,
       maxLength: 100,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
     config: createLongTextField({
       required: true,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
     reason: createTextField({
       required: true,
       maxLength: 500,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
   },
   indexes: [{ unique: true, columns: ["tenantId", "entityName"] }],

package/src/delivery/tables.ts

@@ -76,7 +76,7 @@ export const deliveryAttemptsTableMeta: EntityTableMeta = defineUnmanagedTable({
 export const notificationPreferenceEntity = createEntity({
   table: "read_notification_preferences",
   fields: {
-    userId: createTextField({ required: true, allowPlaintext: "pseudonymous-fk" }),
+    userId: createTextField({ required: true, personal: false, reason: "pseudonymous_fk" }),
     notificationType: createTextField({ required: true }), // qualified name or "*"
     channel: createTextField({ required: true }), // "inApp", "email", "push", or "*"
     enabled: createBooleanField({ default: true }),

package/src/document-ingest-foundation/entity.ts

@@ -37,14 +37,17 @@ export const documentExtractEntity = createEntity({
   fields: {
     fileRefId: createTextField({ required: true }),
     storageKey: createTextField({ required: true }),
-    // Holds the full extracted document text (PII). `tenantOwned`, NOT
-    // `encrypted: true` (#1621): the master-key path has no erasure subject,
+    // Holds the full extracted document text (PII). `personal: "tenant"`,
+    // NOT `encrypted: true` (#1621): the master-key path has no erasure subject,
     // so nothing here would ever be shreddable. Tenant-subject ciphertext
     // dies with eraseSubjectKeys on tenant-destroy (#800 pattern). Whose
     // subject a third party named inside a document is stays open, same as
     // inbound-mail-foundation (#957). meta is provider telemetry only and
     // stays plaintext jsonb.
-    pages: createLongTextField({ tenantOwned: true }),
+    pages: createLongTextField({
+      personal: "tenant",
+      find: "none",
+    }),
     meta: createJsonbField(),
   },
 });

package/src/file-derivatives/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.194.0",
+    "type": "breaking",
+    "title": "PRESET_VARIANT_NAMES removed from public exports; publicVariantQuery accepts any name.",
+    "detail": "The public GET /media/:fileRefId/:variant route now resolves the variant spec from the FileRef's field declaration (createImageField({ variants: {...} })) instead of a fixed spec table, so an app can declare and publicly serve its own variant names, and a field overriding a built-in preset name (thumb/card/hero/full) is served with its own spec instead of the frozen preset size. publicVariantQuery's schema now accepts any variant name (z.string().min(1).max(64)) instead of z.enum(PRESET_VARIANT_NAMES); resolution requires an exact match against the field's declared variants keys, and an unresolvable name answers 404, same as an unknown FileRef. The route's pre-DB path-param gate is now purely syntactic ([a-zA-Z0-9_-]{1,64}) instead of a name allow-list; a known-valid preset name plus a random fileRefId reached the same DB read as any other name, so the list only blocked the cheaper of two equally-costly attacks, and the actual defense is the existing per-IP rate limit and the UUID guard, both unchanged.",
+    "migration": "PRESET_VARIANT_NAMES only ever named the allow-list this release deletes, so there is nothing to migrate to. thumb/card/hero/full remain as ready-made specs to spread into a field's own variants."
+  }
+]

package/src/files/README.md

@@ -28,19 +28,19 @@ bewirtschaftet. Das öffnet die Tür für Cross-Feature-Hooks:
 ## PII-Annotations (Sprint 0.1+0.7)
 
 ```ts
-fileName    → pii: true                  (Originalname enthält oft Personen-Bezug)
-storageKey  → allowPlaintext: "is-business-data"  (interner UUID-Key)
-mimeType    → allowPlaintext: "is-business-data"
-size        → allowPlaintext: "is-business-data"
-entityType  → allowPlaintext: "is-business-data"
-entityId    → allowPlaintext: "is-business-data"
-fieldName   → allowPlaintext: "is-business-data"
-insertedAt  → kein PII-Marker (Audit-Timestamp, Framework-managed)
-insertedById → allowPlaintext: "is-business-data"  (User-Reference, kein Eigen-PII)
+fileName     → personal: "self", find: "none"  (Originalname enthält oft Personen-Bezug)
+storageKey   → kein PII-Marker (interner UUID-Key, trifft die Heuristik nicht)
+mimeType     → kein PII-Marker
+size         → kein PII-Marker
+entityType   → kein PII-Marker
+entityId     → kein PII-Marker
+fieldName    → kein PII-Marker
+insertedAt   → kein PII-Marker (Audit-Timestamp, Framework-managed Base-Column)
+insertedById → kein PII-Marker (User-Reference, Framework-managed Base-Column, kein Eigen-PII)
 ```
 
-`fileName: pii: true` heißt: Sprint 3 Crypto-Shredding wird den Wert
-mit dem Author-Subject-Key encrypten (für File-INHALTE: separates
+`fileName: personal: "self"` heißt: Sprint 3 Crypto-Shredding verschlüsselt den
+Wert mit dem Author-Subject-Key (für File-INHALTE: separates
 Subject-Resolver-Pattern via `subjectField` — siehe storage-encryption.md
 Sprint 4).
 

package/src/form-draft/entity.ts

@@ -24,13 +24,16 @@ export const formDraftEntity = createEntity({
     // feeds the GDPR-hook-coverage boot guard (it's a plain FK into `user`,
     // not content of its own) — see ../form-draft-user-data for the
     // required export/delete hook coverage.
-    ownerId: createTextField({ subjectRef: true, required: true }),
+    ownerId: createTextField({
+      personal: "ref",
+      required: true,
+    }),
     draftKey: createTextField({ required: true, maxLength: FORM_DRAFT_KEY_MAX_LENGTH }),
     // The blob shape is fixed by issue #1889, not left to the caller:
     // { values: Record<string, unknown>, stepIndex: number, savedAt: string }.
     // Free-form because `values` mirrors whatever fields the in-progress
-    // form has, so it can carry arbitrary user-entered PII. NOT annotated
-    // `userOwned` — the framework's PII field-encryption engine only
+    // form has, so it can carry arbitrary user-entered PII. NOT given a
+    // `personal` annotation — the framework's PII field-encryption engine only
     // accepts string values (pii-field-encryption.ts throws on a non-string
     // field), and this is a jsonb object. Erasure instead runs as a real
     // physical row-delete on forget (see form-draft-user-data/hooks.ts),

package/src/inbound-mail-foundation/entities.ts

@@ -17,9 +17,9 @@ import {
 // Source-of-truth sind die event-store-Streams `mail-account` /
 // `inbound-message` / `mail-thread` — die Tabellen sind rebuild-fähig.
 //
-// **PII-Konvention:** tenantOwned (nicht `encrypted`): Felder müssen
-// crypto-shredden wenn eraseSubjectKeys den Tenant-Subject-Key beim
-// tenant-destroy löscht (#800-Muster aus billing-foundation).
+// **PII convention:** `personal: "tenant"` (not `encrypted`): fields must
+// crypto-shred when eraseSubjectKeys deletes the tenant subject key on
+// tenant-destroy (#800 pattern from billing-foundation).
 // maxLength jeweils Ciphertext-budgetiert (`kumiko-pii:v1:<subject>:
 // <blob>` — Plaintext×~2.3 + Envelope-Overhead).
 //
@@ -41,12 +41,14 @@ export const mailAccountEntity = createEntity({
     // Owner + TenantAdmin (Compliance); KEIN Crypto-Subject-Wechsel in
     // V1 (Subject bleibt Tenant, siehe Header).
     ownerUserId: createTextField({ maxLength: 36 }),
+    // Tenant-authored mailbox label, not a person's name.
     displayName: createTextField({
       maxLength: 200,
-      allowPlaintext: "mailbox display name, tenant config not personal data",
+      personal: false,
+      reason: "tenant_config_not_personal",
     }),
     // Postfach-Adresse — PII des Tenants.
-    address: createTextField({ required: true, maxLength: 1000, tenantOwned: true }),
+    address: createTextField({ required: true, maxLength: 1000, personal: "tenant", find: "none" }),
     status: createTextField({ required: true, maxLength: 30 }),
     watchState: createTextField({ maxLength: 100 }),
     connectedAt: createTimestampField({ required: true }),
@@ -66,12 +68,12 @@ export const inboundMessageEntity = createEntity({
     ownerUserId: createTextField({ maxLength: 36 }),
     messageIdHeader: createTextField({ required: true, maxLength: 500 }),
     threadKey: createTextField({ required: true, maxLength: 500 }),
-    from: createTextField({ required: true, maxLength: 2000, tenantOwned: true }),
+    from: createTextField({ required: true, maxLength: 2000, personal: "tenant", find: "none" }),
     // JSON-stringified string[] — als Ganzes encrypted.
-    to: createTextField({ maxLength: 8000, tenantOwned: true }),
-    cc: createTextField({ maxLength: 8000, tenantOwned: true }),
-    subject: createTextField({ maxLength: 4000, tenantOwned: true }),
-    snippet: createTextField({ maxLength: 4000, tenantOwned: true }),
+    to: createTextField({ maxLength: 8000, personal: "tenant", find: "none" }),
+    cc: createTextField({ maxLength: 8000, personal: "tenant", find: "none" }),
+    subject: createTextField({ maxLength: 4000, personal: "tenant", find: "none" }),
+    snippet: createTextField({ maxLength: 4000, personal: "tenant", find: "none" }),
     receivedAt: createTimestampField({ required: true }),
     bodyRef: createTextField({ maxLength: 500 }),
     scope: createTextField({ maxLength: 200 }),
@@ -84,7 +86,7 @@ export const mailThreadEntity = createEntity({
   table: "read_mail_threads",
   fields: {
     threadKey: createTextField({ required: true, maxLength: 500 }),
-    subject: createTextField({ maxLength: 4000, tenantOwned: true }),
+    subject: createTextField({ maxLength: 4000, personal: "tenant", find: "none" }),
     lastMessageAt: createTimestampField({ required: true }),
     messageCount: createNumberField({ required: true, integer: true }),
   },

package/src/inbound-mail-foundation/feature.ts

@@ -35,11 +35,11 @@
 //     Supervisor-storeBody-Hook, Event trägt nur bodyRef.
 //   - Kein IMAP-Flag-Write-back (V1) — Inbox-Status lebt beim Consumer.
 //
-// **PII/DSGVO:** address/from/to/cc/subject/snippet sind tenantOwned —
-// encrypted VOR jedem Event-Append (einziger Write-Pfad), Event-Log UND
-// Projections tragen Ciphertext; tenant-destroy shreddet den Subject-Key
-// (crypto-shredding, Muster billing-foundation #800). Der Destroy-Hook
-// archiviert zusätzlich alle Streams + löscht die Rows.
+// **PII/GDPR:** address/from/to/cc/subject/snippet are `personal: "tenant"`
+// — encrypted BEFORE every event append (the only write path), event log AND
+// projections carry ciphertext; tenant-destroy shreds the subject key
+// (crypto-shredding, same pattern as billing-foundation #800). The destroy
+// hook additionally archives all streams + deletes the rows.
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, EXT_TENANT_DATA } from "@cosmicdrift/kumiko-framework/engine";

package/src/ledger/entity.ts

@@ -41,11 +41,12 @@ export const transactionEntity = createEntity({
   fields: {
     date: createDateField({ required: true }),
     // Journal narration ("Miete Januar", "Storno: …") is accounting data, not
-    // user-generated PII → allowPlaintext silences the user-content heuristic.
+    // user-generated PII → `personal: false` silences the user-content heuristic.
     description: createTextField({
       required: true,
       maxLength: 200,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
     // For a Storno entry this points at the reversed transaction's id.
     reference: createTextField({ maxLength: 120 }),
@@ -79,7 +80,8 @@ export const scheduleEntity = createEntity({
     description: createTextField({
       required: true,
       maxLength: 200,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
     startDate: createDateField({ required: true }),
     // Absent → open-ended (projects to the window's end).

package/src/managed-pages/screens/branding-screen.ts

@@ -42,7 +42,8 @@ export function createBrandingSettingsScreen(opts: {
       description: createTextField({
         maxLength: 500,
         multiline: { rows: 3 },
-        allowPlaintext: "is-business-data",
+        personal: false,
+        reason: "is_business_data",
       }),
       siteUrl: createTextField({ maxLength: 2000, format: "url" }),
       accentColor: createTextField({ maxLength: 9 }),

package/src/managed-pages/table.ts

@@ -26,9 +26,10 @@ export const pageEntity = createEntity({
     body: createTextField({
       multiline: { rows: 16 },
       maxLength: 100_000,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
-    description: createTextField({ maxLength: 500, allowPlaintext: "is-business-data" }),
+    description: createTextField({ maxLength: 500, personal: false, reason: "is_business_data" }),
     ogImage: createTextField({ maxLength: 2000 }),
     published: createBooleanField({ default: false }),
   },

package/src/notes-history/entity.ts

@@ -15,8 +15,9 @@ import {
 // registered (see feature.ts). A correction is a new entry, not an edit —
 // that is the whole point of a note *history* instead of the single
 // overwritable textarea this bundle replaces (solon#13). GDPR erasure of the
-// author still works without a delete path: `body` is `userOwned` (crypto-
-// shredding on the author's subject key), not `pii` on the entity itself.
+// author still works without a delete path: `body` is `personal: { of:
+// "authorId" }` (crypto-shredding on the author's subject key), not
+// `personal: "self"` on the entity itself.
 export const noteEntryEntity = createEntity({
   table: "read_note_entries",
   fields: {
@@ -27,11 +28,14 @@ export const noteEntryEntity = createEntity({
     // ctx.user.id (see feature.ts), so a note can't be authored as someone
     // else. subjectRef feeds the GDPR-hook-coverage boot guard (it's a plain
     // FK into `user`, not content of its own).
-    authorId: createTextField({ subjectRef: true }),
+    authorId: createTextField({
+      personal: "ref",
+    }),
     body: createLongTextField({
       required: true,
       maxLength: 20_000,
-      userOwned: { ownerField: "authorId" },
+      personal: { of: "authorId" },
+      find: "none",
     }),
   },
 });

package/src/notes-history-user-data/hooks.ts

@@ -26,11 +26,12 @@ export const noteEntryExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
-// Deliberate no-op: `body` is annotated `userOwned` (entity.ts), which relies
-// on crypto-shredding (mounted KMS) for erasure — destroying the author's
-// subject key makes every note-entry event AND projected row unreadable at
-// once, without needing a physical delete (which would also break the
-// bundle's append-only history for OTHER entities' co-authors reading it).
+// Deliberate no-op: `body` is annotated `personal: { of: "authorId" }`
+// (entity.ts), which relies on crypto-shredding (mounted KMS) for erasure —
+// destroying the author's subject key makes every note-entry event AND
+// projected row unreadable at once, without needing a physical delete
+// (which would also break the bundle's append-only history for OTHER
+// entities' co-authors reading it).
 // Same tradeoff as job-run/delivery-attempt (user-data-rights-defaults).
 // Precondition: this ONLY erases anything if the app mounts a KMS adapter —
 // without one, userOwned fields fall back to plaintext storage framework-wide

package/src/personal-access-tokens/changes.json

@@ -4,5 +4,12 @@
     "type": "improvement",
     "title": "personal-access-tokens: add `toggleable` option so the whole feature can be tier-gated vi…",
     "detail": "personal-access-tokens: add `toggleable` option so the whole feature can be tier-gated via the tier-engine (mirrors ledger/tags). Pass `{ toggleable: { default: false } }` for fail-closed gating — PAT is then off until a tier lists `\"personal-access-tokens\"` in its features. Omitting the option keeps PAT always-on (no behaviour change for existing consumers)."
+  },
+  {
+    "version": "0.202.0",
+    "type": "breaking",
+    "title": "personal-access-tokens: `write:create` now requires `currentPassword` (+ `mfaCode` if MFA enrolled) (e91d4cb).",
+    "detail": "`personal-access-tokens:write:create` now requires `currentPassword` (verified against the caller's password hash) before minting a token, and rejects when the caller has MFA enrolled and `mfaCode` is missing or wrong — a session cookie alone is no longer enough to stand up a durable API credential. `expiresInDays` now defaults to 90 days instead of never-expiring when omitted (the existing 3650-day cap is unchanged, so a genuinely long-lived token is still possible if requested explicitly). Changing a user's password, or enabling/disabling MFA, now revokes all of that user's live PAT tokens — mirrors the existing session auto-revoke-on-password-change behavior. `run-prod-app`/`run-dev-app` wire the new MFA↔PAT revoke callback automatically when both `auth-mfa` and `personal-access-tokens` are mounted; no app-level change needed for that part.",
+    "migration": "Apps that already mint PATs (their own client code, scripts, or tests) need to add `currentPassword` to the `create` request payload — this is a breaking change to the `create` request shape despite the minor bump (bundled-features doesn't follow strict semver across its handler schemas yet). If the caller has MFA enrolled, also include a valid `mfaCode`."
   }
 ]

package/src/personal-access-tokens/schema/api-token.ts

@@ -33,7 +33,8 @@ export const apiTokenEntity = createEntity({
       required: true,
       maxLength: 120,
       access: { write: access.privileged },
-      userOwned: { ownerField: "userId" },
+      personal: { of: "userId" },
+      find: "none",
     }),
     tokenHash: createTextField({
       required: true,

package/src/sessions/feature.ts

@@ -245,10 +245,6 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       type: "projectionDetail",
       query: SessionQueries.detail,
       listScreenId: SESSION_LIST_SCREEN_ID,
-      // No write path on this screen — a "Cancel" button here would only
-      // ever discard nothing. Back-navigation still works via listScreenId
-      // above (resolveDetailBreadcrumb, renderer-web) — fw#2245.
-      hideActions: true,
       layout: {
         sections: [
           {

package/src/sessions/schema/user-session.ts

@@ -63,12 +63,14 @@ export const userSessionEntity = createEntity({
     ip: createTextField({
       maxLength: 64,
       access: { write: access.privileged },
-      userOwned: { ownerField: "userId" },
+      personal: { of: "userId" },
+      find: "none",
     }),
     userAgent: createTextField({
       maxLength: 512,
       access: { write: access.privileged },
-      userOwned: { ownerField: "userId" },
+      personal: { of: "userId" },
+      find: "none",
     }),
   },
 });

package/src/tags/entity.ts

@@ -7,11 +7,17 @@ export const tagEntity = createEntity({
   table: "read_tags",
   fields: {
     // Catalog labels ("urgent", "billing"), not user-identifying content —
-    // allowPlaintext silences the user-content heuristic (456/5). A tenant
-    // COULD name a tag after a person; if that becomes a real requirement,
-    // this needs a userOwned annotation + forget/export hooks in the
-    // user-data-rights pipeline (none exist for tags today).
-    name: createTextField({ required: true, maxLength: 64, allowPlaintext: "catalog-label" }),
+    // `personal: false` silences the user-content heuristic (456/5). A
+    // tenant COULD name a tag after a person; if that becomes a real
+    // requirement, this needs a `personal: { of: "<f>" }` annotation +
+    // forget/export hooks in the user-data-rights pipeline (none exist for
+    // tags today).
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "catalog_label",
+    }),
     // Optional UI hint (hex or token). No enforcement — purely for rendering.
     color: createTextField({ maxLength: 32 }),
     // Optional entity-type scope (GitLab project-vs-group labels): empty = global