@cosmicdrift/kumiko-bundled-features 0.252.1 → 0.253.0

package/src/jobs/db/queries/stale-run-sweep.ts

@@ -12,8 +12,9 @@
 // the run becomes retriable via the existing jobs:write:retry gate
 // (retry.write.ts only allows retry from "failed").
 
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { encryptFailureError } from "../../job-run-logger";
 import { jobRunsTable } from "../../job-run-table";
 
 export const STALE_JOB_RUN_ERROR =
@@ -30,22 +31,43 @@ export async function markStaleJobRunsFailed(
   const cutoff = Temporal.Now.instant().subtract({ hours: timeoutHours });
   const now = Temporal.Now.instant();
 
+  // Fetch the matched rows first: `error` carries the same per-triggering-
+  // user subject annotation as job-run-logger.ts's onJobFailed path
+  // (personal: { of: "triggeredById" } on job-run-table.ts), and a batch
+  // updateMany can't encrypt per-row — different matched runs can belong to
+  // different users, each under their own DEK. One updateMany per row keeps
+  // this crash-recovery sweep's write on the same encrypted footing as the
+  // normal failure path instead of writing STALE_JOB_RUN_ERROR in the clear.
+  const stale = await selectMany<{ id: string; triggeredById: string | null }>(db, jobRunsTable, {
+    status: "running",
+    startedAt: { lt: cutoff },
+  });
+
   // duration is deliberately left untouched: we don't know when the run
   // actually died, only that it crossed the timeout, so recording a
   // duration would misrepresent it as measured. detail-screen/list-screen
   // both already render a null duration as "—".
-  const updated = await updateMany(
-    db,
-    jobRunsTable,
-    {
-      status: "failed",
-      error: STALE_JOB_RUN_ERROR,
-      finishedAt: now,
-      modifiedAt: now,
-      modifiedById: "system",
-    },
-    { status: "running", startedAt: { lt: cutoff } },
-  );
+  let runsMarkedFailed = 0;
+  for (const run of stale) {
+    const encryptedError = await encryptFailureError(STALE_JOB_RUN_ERROR, run.triggeredById);
+    const updated = await updateMany(
+      db,
+      jobRunsTable,
+      {
+        status: "failed",
+        error: encryptedError,
+        finishedAt: now,
+        modifiedAt: now,
+        modifiedById: "system",
+      },
+      // Re-assert status: "running" here (not just id) — closes the race
+      // window between the selectMany above and this write, where the run
+      // could have completed/failed normally in between and must not be
+      // clobbered back to "failed" with the stale-timeout message.
+      { id: run.id, status: "running" },
+    );
+    runsMarkedFailed += updated.length;
+  }
 
-  return { runsMarkedFailed: updated.length };
+  return { runsMarkedFailed };
 }

package/src/jobs/feature.ts

@@ -48,6 +48,11 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
     r.systemScope();
     r.storeTable(jobRunsTableMeta, {
       reason: "direct_write.job_runs",
+      // payload/error carry personal:{of:"triggeredById"} (job-run-table.ts).
+      // job-run-logger.ts manually encrypts both before every insert/update
+      // (encryptStartedPayload/encryptFailureError) since this store bypasses
+      // the executor's automatic PII pipeline (#2243).
+      piiEncryptedOnWrite: true,
     });
     r.storeTable(jobRunLogsTableMeta, {
       reason: "read_side.job_run_logs",

package/src/jobs/job-run-logger.ts

@@ -106,8 +106,13 @@ async function encryptLogMessages<T extends { readonly message: string }>(
 // Mirrors encryptFailureError for the failure-path `error` column (#2307):
 // stored alongside logs[].message under the same triggering user's DEK, so
 // a log/error pair from the same failed run decrypt together or erase
-// together.
-async function encryptFailureError(error: string, triggeredById: string | null): Promise<string> {
+// together. Exported so stale-run-sweep.ts's crash-recovery write (a
+// separate, per-row batch path outside onJobFailed) applies the identical
+// per-subject encryption instead of writing `error` in the clear.
+export async function encryptFailureError(
+  error: string,
+  triggeredById: string | null,
+): Promise<string> {
   if (triggeredById === null) return error;
   const kms = configuredPiiSubjectKms();
   if (!kms) return error;

package/src/jobs/job-run-table.ts

@@ -41,16 +41,21 @@ export type JobLogLevel = "info" | "warn" | "error";
 export const jobRunEntity = createEntity({
   table: "store_job_runs",
   fields: {
-    jobName: createTextField({ required: true }),
-    bullJobId: createTextField({ required: true }),
-    status: createTextField({ required: true }),
-    payload: createTextField(),
-    error: createTextField(),
+    jobName: createTextField({ required: true, personal: false, reason: "system_metadata" }),
+    bullJobId: createTextField({ required: true, personal: false, reason: "system_metadata" }),
+    status: createTextField({ required: true, personal: false, reason: "system_metadata" }),
+    // The run-started payload can carry arbitrary caller-supplied data,
+    // encrypted by job-run-logger.ts under the triggering user's DEK (see
+    // jobs-pii-kms.integration.test.ts) — same subject as `triggeredById`.
+    payload: createTextField({ personal: { of: "triggeredById" }, find: "none" }),
+    // Failure messages can echo payload content back — same subject/DEK as
+    // `payload` (job-run-logger.ts encryptFailureError).
+    error: createTextField({ personal: { of: "triggeredById" }, find: "none" }),
     attempt: createNumberField({ required: true, default: 1, integer: true }),
     startedAt: createTimestampField({ required: true }),
     finishedAt: createTimestampField(),
     duration: createNumberField({ integer: true }),
-    triggeredById: createTextField(),
+    triggeredById: createTextField({ personal: false, reason: "pseudonymous_fk" }),
   },
 });
 

package/src/ledger/entity.ts

@@ -19,12 +19,17 @@ export const accountEntity = createEntity({
   description:
     "One node of a tenant's chart of accounts: a name, an asset/liability/equity/income/expense type that decides how reports read its balance, an optional account code and an optional parent account forming the account tree; balances are derived from postings, never stored here.",
   fields: {
-    name: createTextField({ required: true, maxLength: 120 }),
+    name: createTextField({
+      required: true,
+      maxLength: 120,
+      personal: false,
+      reason: "is_business_data",
+    }),
     type: createSelectField({ options: ACCOUNT_TYPES, required: true }),
     // Optional account number (Kontonummer / SKR code) — free text in v1.
-    code: createTextField({ maxLength: 32 }),
+    code: createTextField({ maxLength: 32, personal: false, reason: "technical_reference" }),
     // Parent account id, or absent for a root account. No FK (event-sourced).
-    parentId: createTextField({ maxLength: 64 }),
+    parentId: createTextField({ maxLength: 64, personal: false, reason: "technical_reference" }),
   },
 });
 
@@ -52,8 +57,13 @@ export const transactionEntity = createEntity({
       personal: false,
       reason: "is_business_data",
     }),
-    // For a Storno entry this points at the reversed transaction's id.
-    reference: createTextField({ maxLength: 120 }),
+    // Free-text memo (a reversal or confirmed schedule period overwrites it with
+    // a system-generated id, but a manual entry can carry caller-supplied text).
+    reference: createTextField({
+      maxLength: 120,
+      personal: false,
+      reason: "is_business_data",
+    }),
     status: createSelectField({ options: TRANSACTION_STATUS, required: true }),
     // Posting lines are born with the entry and never change on their own —
     // a correction is a new (reversing) entry. The embedded list validates
@@ -94,7 +104,17 @@ export const scheduleEntity = createEntity({
     endDate: createDateField(),
     interval: createSelectField({ options: SCHEDULE_INTERVALS, required: true }),
     amount: createNumberField({ required: true, min: 1, integer: true }),
-    debitAccountId: createTextField({ required: true, maxLength: 64 }),
-    creditAccountId: createTextField({ required: true, maxLength: 64 }),
+    debitAccountId: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    creditAccountId: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
 });

package/src/managed-pages/screens/branding-screen.ts

@@ -38,16 +38,30 @@ export function createBrandingSettingsScreen(opts: {
       layoutPreset: BRANDING_QN.layoutPreset,
     },
     fields: {
-      title: createTextField({ maxLength: 200 }),
+      title: createTextField({ maxLength: 200, personal: false, reason: "is_business_data" }),
       description: createTextField({
         maxLength: 500,
         multiline: { rows: 3 },
         personal: false,
         reason: "is_business_data",
       }),
-      siteUrl: createTextField({ maxLength: 2000, format: "url" }),
-      accentColor: createTextField({ maxLength: 9 }),
-      logoUrl: createTextField({ maxLength: 2000, format: "url" }),
+      siteUrl: createTextField({
+        maxLength: 2000,
+        format: "url",
+        personal: false,
+        reason: "is_business_data",
+      }),
+      accentColor: createTextField({
+        maxLength: 9,
+        personal: false,
+        reason: "is_business_data",
+      }),
+      logoUrl: createTextField({
+        maxLength: 2000,
+        format: "url",
+        personal: false,
+        reason: "is_business_data",
+      }),
       layoutPreset: createSelectField({ options: LAYOUT_PRESETS }),
     },
     layout: {
@@ -74,7 +88,15 @@ export function createBrandingSettingsScreen(opts: {
     configKeys: { ...base.configKeys, customCss: BRANDING_QN.customCss },
     fields: {
       ...base.fields,
-      customCss: createTextField({ maxLength: 8000, multiline: { rows: 12 } }),
+      // Tenant-admin-authored branding CSS (raw-CSS gated behind
+      // allowCustomCss), not end-user input — same category as the other
+      // branding fields above.
+      customCss: createTextField({
+        maxLength: 8000,
+        multiline: { rows: 12 },
+        personal: false,
+        reason: "is_business_data",
+      }),
     },
     layout: {
       sections: [

package/src/managed-pages/table.ts

@@ -16,9 +16,28 @@ export const pageEntity = createEntity({
   description:
     "One tenant-editable public web page, unique per slug and language, holding a markdown body plus the title, SEO description and OG image, with a published flag that decides whether anonymous visitors are served it or get a 404.",
   fields: {
-    slug: createTextField({ required: true, maxLength: 64, sortable: true, searchable: true }),
-    lang: createTextField({ required: true, maxLength: 8, sortable: true }),
-    title: createTextField({ required: true, maxLength: 200, searchable: true }),
+    slug: createTextField({
+      required: true,
+      maxLength: 64,
+      sortable: true,
+      searchable: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    lang: createTextField({
+      required: true,
+      maxLength: 8,
+      sortable: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    title: createTextField({
+      required: true,
+      maxLength: 200,
+      searchable: true,
+      personal: false,
+      reason: "is_business_data",
+    }),
     // Body + description sind vom Tenant-Admin authored Business-Content
     // (Markdown), keine User-Generated-PII. `multiline` → der entityEdit-
     // Renderer gibt ein <textarea> aus (createLongTextField hat aktuell
@@ -32,7 +51,7 @@ export const pageEntity = createEntity({
       reason: "is_business_data",
     }),
     description: createTextField({ maxLength: 500, personal: false, reason: "is_business_data" }),
-    ogImage: createTextField({ maxLength: 2000 }),
+    ogImage: createTextField({ maxLength: 2000, personal: false, reason: "is_business_data" }),
     published: createBooleanField({ default: false }),
   },
   indexes: [{ unique: true, columns: ["tenantId", "slug", "lang"], name: "read_pages_unique" }],

package/src/notes-history/__tests__/add-note-author-name-kms.integration.test.ts

@@ -43,7 +43,14 @@ const tenantId = testTenantId(1);
 const CONTACT_TABLE = "notes_kms_test_contacts";
 const contactEntity = createEntity({
   table: CONTACT_TABLE,
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 const contactFixtureFeature = defineFeature("notes-kms-test-contact-fixture", (r) => {
   r.entity("contact", contactEntity);

package/src/notes-history/__tests__/notes-history-ownership.integration.test.ts

@@ -69,7 +69,14 @@ const teamOwnership: NonNullable<EntityDefinition["access"]> = {
 const PROJECT_TABLE = "notes_ownership_test_projects";
 const projectEntity: EntityDefinition = createEntity({
   table: PROJECT_TABLE,
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 const projectFixtureFeature = defineFeature("notes-ownership-test-project-fixture", (r) => {
   r.entity("project", projectEntity);

package/src/notes-history/__tests__/notes-history-parent-visibility.integration.test.ts

@@ -48,8 +48,18 @@ function createProjectEntity(access?: EntityDefinition["access"]): EntityDefinit
   return createEntity({
     table: PROJECT_TABLE,
     fields: {
-      teamId: createTextField({ required: true, maxLength: 64 }),
-      name: createTextField({ required: true, maxLength: 64 }),
+      teamId: createTextField({
+        required: true,
+        maxLength: 64,
+        personal: false,
+        reason: "technical_reference",
+      }),
+      name: createTextField({
+        required: true,
+        maxLength: 64,
+        personal: false,
+        reason: "technical_reference",
+      }),
     },
     access,
   });
@@ -62,7 +72,14 @@ const guardedProjectEntity = createProjectEntity(projectOwnership);
 // too, not just made-up names.
 const contactEntity = createEntity({
   table: "notes_pv_test_contacts",
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 
 const fixturesFeature = defineFeature("notes-pv-test-fixtures", (r) => {

package/src/notes-history/__tests__/notes-history.integration.test.ts

@@ -36,7 +36,14 @@ const notesHistoryFeature = createNotesHistoryFeature();
 const CONTACT_TABLE = "notes_history_test_contacts";
 const contactEntity = createEntity({
   table: CONTACT_TABLE,
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 const contactFixtureFeature = defineFeature("notes-history-test-contact-fixture", (r) => {
   r.entity("contact", contactEntity);

package/src/notes-history/entity.ts

@@ -36,9 +36,19 @@ export function createNoteEntryEntity(access?: EntityDefinition["access"]) {
       "One note attached to a host entity by entityType and entityId, holding the note body plus the id and the display name of the author as it stood when the note was written. Rows are append-only: a correction is a further note, never an edit of this one.",
     access,
     fields: {
-      entityType: createTextField({ required: true, maxLength: 64 }),
+      entityType: createTextField({
+        required: true,
+        maxLength: 64,
+        personal: false,
+        reason: "technical_reference",
+      }),
       // Host entity ids are uuid/text; 128 covers uuid plus non-uuid text keys.
-      entityId: createTextField({ required: true, maxLength: 128 }),
+      entityId: createTextField({
+        required: true,
+        maxLength: 128,
+        personal: false,
+        reason: "technical_reference",
+      }),
       // Never client-supplied — stamped by the deriveAuthorId preSave hook from
       // ctx.user.id (see feature.ts), so a note can't be authored as someone
       // else. subjectRef feeds the GDPR-hook-coverage boot guard (it's a plain

package/src/notes-history-user-data/__tests__/hooks.integration.test.ts

@@ -30,7 +30,14 @@ const other = createTestUser({ id: 2, roles: ["TenantMember"] });
 const CONTACT_TABLE = "notes_user_data_test_contacts";
 const contactEntity = createEntity({
   table: CONTACT_TABLE,
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 const contactFixtureFeature = defineFeature("notes-user-data-test-contact-fixture", (r) => {
   r.entity("contact", contactEntity);

package/src/personal-access-tokens/schema/api-token.ts

@@ -23,11 +23,15 @@ export const apiTokenEntity = createEntity({
       required: true,
       maxLength: 36,
       access: { write: access.privileged },
+      personal: false,
+      reason: "pseudonymous_fk",
     }),
     tenantId: createTextField({
       required: true,
       maxLength: 36,
       access: { write: access.privileged },
+      personal: false,
+      reason: "pseudonymous_fk",
     }),
     name: createTextField({
       required: true,
@@ -36,19 +40,43 @@ export const apiTokenEntity = createEntity({
       personal: { of: "userId" },
       find: "none",
     }),
+    // SHA-256 hash of the plaintext token — credential material, but kept
+    // Klasse 1 deliberately: resolver.ts point-reads this row with a raw
+    // exact-match `{ tokenHash: hashPatToken(rawToken) }` query on the hot
+    // auth path. A subject annotation here would make encryptForDirectWrite
+    // store ciphertext while the resolver keeps querying for the plaintext
+    // hash — every bearer-token request would 401 once a KMS is active.
+    // Fixing that needs a blind-index-backed lookup (like email's
+    // find:"exact" companion column), a resolver.ts rewrite out of scope
+    // here — see PR body "Offene Fragen".
     tokenHash: createTextField({
       required: true,
       maxLength: 64,
       access: { write: access.privileged },
+      personal: false,
+      reason: "credential_hash_used_as_exact_lookup_key_2809",
     }),
+    // Short displayable prefix ("your tokens" list) — not the secret itself,
+    // but still identifies which of the user's tokens this row is. Kept
+    // Klasse 1: list.query.ts returns `r.prefix` straight through with no
+    // decrypt call (unlike `name`, which goes through decryptStoredPii) — a
+    // subject annotation would leak ciphertext to the UI once a KMS is
+    // active. See PR body "Offene Fragen".
     prefix: createTextField({
       required: true,
       maxLength: 16,
       access: { write: access.privileged },
+      personal: false,
+      reason: "credential_prefix_read_without_decrypt_2809",
     }),
     // JSON-encoded string[] of granted scope names — mirrors the roles-column
     // convention (parseRoles-style text); the resolver JSON.parses it.
-    scopes: createTextField({ required: true, access: { write: access.privileged } }),
+    scopes: createTextField({
+      required: true,
+      access: { write: access.privileged },
+      personal: false,
+      reason: "technical_reference",
+    }),
     createdAt: createTimestampField({ required: true, access: { write: access.privileged } }),
     expiresAt: createTimestampField({ access: { write: access.privileged } }),
     revokedAt: createTimestampField({ access: { write: access.privileged } }),

package/src/secrets/table.ts

@@ -50,7 +50,7 @@ export const tenantSecretEntity = createEntity({
   description:
     "One encrypted secret per tenant and key, holding the sealed envelope, the key-encryption-key version it was sealed under and its last rotation time; plaintext values are never stored or returned.",
   fields: {
-    key: createTextField({ required: true }),
+    key: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     kekVersion: createNumberField({ required: true, integer: true }),
   },
 });

package/src/sessions/schema/user-session.ts

@@ -33,11 +33,15 @@ export const userSessionEntity = createEntity({
       required: true,
       maxLength: 36,
       access: { write: access.privileged },
+      personal: false,
+      reason: "pseudonymous_fk",
     }),
     tenantId: createTextField({
       required: true,
       maxLength: 36,
       access: { write: access.privileged },
+      personal: false,
+      reason: "pseudonymous_fk",
     }),
     createdAt: createTimestampField({
       required: true,

package/src/tags/__tests__/tags-parent-visibility.integration.test.ts

@@ -47,8 +47,18 @@ const projectOwnership: NonNullable<EntityDefinition["access"]> = {
 const projectEntity = createEntity({
   table: PROJECT_TABLE,
   fields: {
-    teamId: createTextField({ required: true, maxLength: 64 }),
-    name: createTextField({ required: true, maxLength: 64 }),
+    teamId: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
   access: projectOwnership,
 });

package/src/tags/__tests__/tags.integration.test.ts

@@ -33,7 +33,14 @@ const tagsFeature = createTagsFeature();
 
 const CREDIT_TABLE = "tags_test_credits";
 const NOTE_TABLE = "tags_test_notes";
-const hostFields = { name: createTextField({ required: true, maxLength: 64 }) };
+const hostFields = {
+  name: createTextField({
+    required: true,
+    maxLength: 64,
+    personal: false,
+    reason: "technical_reference",
+  }),
+};
 const creditEntity = createEntity({ table: CREDIT_TABLE, fields: hostFields });
 const noteEntity = createEntity({ table: NOTE_TABLE, fields: hostFields });
 const hostFixturesFeature = defineFeature("tags-test-host-fixtures", (r) => {

package/src/tags/entity.ts

@@ -28,11 +28,11 @@ export const tagEntity = createEntity({
       reason: "catalog_label",
     }),
     // Optional UI hint (hex or token). No enforcement — purely for rendering.
-    color: createTextField({ maxLength: 32 }),
+    color: createTextField({ maxLength: 32, personal: false, reason: "technical_reference" }),
     // Optional entity-type scope (GitLab project-vs-group labels): empty = global
     // (offered on every entity); a value like "note" restricts the tag to that
     // entityType in the picker. No enforcement on assign — purely a picker hint.
-    scope: createTextField({ maxLength: 64 }),
+    scope: createTextField({ maxLength: 64, personal: false, reason: "technical_reference" }),
   },
 });
 
@@ -63,10 +63,25 @@ export function createTagAssignmentEntity(access?: EntityDefinition["access"]) {
     softDelete: true,
     access,
     fields: {
-      tagId: createTextField({ required: true, maxLength: 64 }),
-      entityType: createTextField({ required: true, maxLength: 64 }),
+      tagId: createTextField({
+        required: true,
+        maxLength: 64,
+        personal: false,
+        reason: "technical_reference",
+      }),
+      entityType: createTextField({
+        required: true,
+        maxLength: 64,
+        personal: false,
+        reason: "technical_reference",
+      }),
       // Host entity ids are uuid/text; 128 covers uuid plus non-uuid text keys.
-      entityId: createTextField({ required: true, maxLength: 128 }),
+      entityId: createTextField({
+        required: true,
+        maxLength: 128,
+        personal: false,
+        reason: "technical_reference",
+      }),
     },
   });
 }

package/src/template-resolver/table.ts

@@ -18,16 +18,17 @@ import { CONTENT_FORMATS, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES } f
 export const templateResourceEntity = createEntity({
   table: "read_template_resources",
   fields: {
-    slug: createTextField({ required: true }),
+    slug: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     kind: createSelectField({ required: true, options: [...TEMPLATE_KINDS] }),
-    locale: createTextField({ required: true }),
+    locale: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     // Human-facing heading for kind="text-block" (legal pages, marketing
     // copy). Nullable because render templates carry their subject inside
     // the body; a NOT NULL here would break every existing mail row.
-    title: createTextField({}),
+    // Same authorship class as `content` below.
+    title: createTextField({ personal: false, reason: "is_business_data" }),
     // Folder path for the content tree, `/`-separated ("page/marketing").
     // null = root node.
-    folder: createTextField({}),
+    folder: createTextField({ personal: false, reason: "technical_reference" }),
     // Template-body is authored by TenantAdmin/Operator (email-templates etc.),
     // business data — kein end-user UGC.
     content: createLongTextField({
@@ -35,10 +36,10 @@ export const templateResourceEntity = createEntity({
       reason: "is_business_data",
     }),
     contentFormat: createSelectField({ required: true, options: [...CONTENT_FORMATS] }),
-    variableSchema: createLongTextField({}),
-    linkedResources: createLongTextField({}),
+    variableSchema: createLongTextField({ personal: false, reason: "technical_reference" }),
+    linkedResources: createLongTextField({ personal: false, reason: "technical_reference" }),
     scope: createSelectField({ required: true, options: [...TEMPLATE_SCOPES] }),
-    parentTemplateId: createTextField({}),
+    parentTemplateId: createTextField({ personal: false, reason: "technical_reference" }),
     status: createSelectField({ required: true, options: [...TEMPLATE_STATUSES] }),
   },
   indexes: [

package/src/template-resolver/user-content-table.ts

@@ -25,11 +25,13 @@ export const userContentEntryEntity = createEntity({
   table: "read_user_content_entries",
   fields: {
     ownerId: createTextField({ required: true, personal: "ref" }),
-    slug: createTextField({ required: true }),
+    slug: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     kind: createSelectField({ required: true, options: [...TEMPLATE_KINDS] }),
-    locale: createTextField({ required: true }),
-    title: createTextField({}),
-    folder: createTextField({}),
+    locale: createTextField({ required: true, personal: false, reason: "technical_reference" }),
+    // Organizational label for the entry (e.g. "Default signature"), not the
+    // owner's PII itself — that lives in `content` below.
+    title: createTextField({ personal: false, reason: "technical_reference" }),
+    folder: createTextField({ personal: false, reason: "technical_reference" }),
     content: createLongTextField({
       personal: { of: "ownerId" },
       find: "none",

package/src/tenant/invitation-table.ts

@@ -61,7 +61,12 @@ export const tenantInvitationEntity = createEntity({
     email: createTextField({ required: true, maxLength: 320, personal: "self", find: "exact" }),
     // Membership-Rolle die dem User nach Accept gegeben wird. Default
     // im handler ist "Admin" (Co-Admin-Pattern für kleine Teams).
-    role: createTextField({ required: true, maxLength: 50 }),
+    role: createTextField({
+      required: true,
+      maxLength: 50,
+      personal: false,
+      reason: "technical_reference",
+    }),
     // Lifecycle-State. Default "pending"; transitions:
     //   pending → accepted | cancelled | expired
     status: createSelectField({