@cosmicdrift/kumiko-bundled-features 0.252.1 → 0.254.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.252.1",
+  "version": "0.254.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.252.1",
-    "@cosmicdrift/kumiko-framework": "0.252.1",
-    "@cosmicdrift/kumiko-headless": "0.252.1",
-    "@cosmicdrift/kumiko-renderer": "0.252.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.252.1",
-    "@cosmicdrift/kumiko-types": "0.252.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.254.0",
+    "@cosmicdrift/kumiko-framework": "0.254.0",
+    "@cosmicdrift/kumiko-headless": "0.254.0",
+    "@cosmicdrift/kumiko-renderer": "0.254.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.254.0",
+    "@cosmicdrift/kumiko-types": "0.254.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.252.1",
-    "@cosmicdrift/kumiko-locale-es": "0.252.1"
+    "@cosmicdrift/kumiko-locale-de": "0.254.0",
+    "@cosmicdrift/kumiko-locale-es": "0.254.0"
   }
 }

package/src/agent-tools/__tests__/agent-manifest.test.ts

@@ -14,7 +14,7 @@ const gatedEntity = createEntity({
   fields: {
     status: createSelectField({ options: ["draft", "active"] as const, filterable: true }),
     ownerId: { type: "reference", entity: "user" } satisfies ReferenceFieldDef,
-    title: createTextField({ searchable: true }),
+    title: createTextField({ searchable: true, personal: false, reason: "technical_reference" }),
     // Raw ResolvedPiiFlags form — the manifest is schema, not rows, so this
     // must never surface a value, only the marker.
     secretNote: { type: "text", pii: true } satisfies TextFieldDef,
@@ -58,7 +58,7 @@ function buildTestFeature() {
 
 const otherEntity = createEntity({
   fields: {
-    label: createTextField({ searchable: true }),
+    label: createTextField({ searchable: true, personal: false, reason: "technical_reference" }),
   },
 });
 

package/src/agent-tools/__tests__/agent-optout.test.ts

@@ -147,7 +147,12 @@ describe("denyQns removes a tool", () => {
 
 const gadgetEntity = createEntity({
   fields: {
-    name: createTextField({ searchable: true, filterable: true }),
+    name: createTextField({
+      searchable: true,
+      filterable: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
 });
 
@@ -193,10 +198,24 @@ describe("denyQns reaches the entity CRUD tools", () => {
 });
 
 const plainItemEntity = createEntity({
-  fields: { label: createTextField({ searchable: true, filterable: true }) },
+  fields: {
+    label: createTextField({
+      searchable: true,
+      filterable: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 const cloakedItemEntity = createEntity({
-  fields: { label: createTextField({ searchable: true, filterable: true }) },
+  fields: {
+    label: createTextField({
+      searchable: true,
+      filterable: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 
 // Both entities mounted in the same feature so the "default stays exposed"

package/src/agent-tools/__tests__/agent-tools.integration.test.ts

@@ -27,7 +27,13 @@ const FEATURE_NAME = "agent-tools-int-test";
 const widgetEntity = createEntity({
   table: "agent_tools_int_test_widgets",
   fields: {
-    name: createTextField({ required: true, searchable: true, filterable: true }),
+    name: createTextField({
+      required: true,
+      searchable: true,
+      filterable: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
     status: createSelectField({ options: ["pending", "approved"] as const, filterable: true }),
   },
 });

package/src/agent-tools/__tests__/tool-catalog.test.ts

@@ -17,13 +17,20 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 
 const widgetEntity = createEntity({
   fields: {
-    name: createTextField({ searchable: true, filterable: true }),
+    name: createTextField({
+      searchable: true,
+      filterable: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
     status: createSelectField({ options: ["open", "closed"] as const, filterable: true }),
-    notes: createTextField(),
+    notes: createTextField({ personal: false, reason: "technical_reference" }),
   },
 });
 
-const orphanEntity = createEntity({ fields: { label: createTextField() } });
+const orphanEntity = createEntity({
+  fields: { label: createTextField({ personal: false, reason: "technical_reference" }) },
+});
 
 function buildCatalogTestFeature() {
   return defineFeature("catalog-test", (r) => {
@@ -104,7 +111,7 @@ function buildCatalogTestFeature() {
       id: "widget-approve-form",
       type: "actionForm",
       handler: "catalog-test:write:widget:approve",
-      fields: { note: createTextField() },
+      fields: { note: createTextField({ personal: false, reason: "technical_reference" }) },
       layout: { sections: [{ title: "s", fields: ["note"] }] },
     });
   });

package/src/agent-tools/__tests__/tool-dispatch.integration.test.ts

@@ -23,8 +23,19 @@ import { dispatchToolCall } from "../tool-dispatch";
 const vendorEntity = createEntity({
   table: "agent_tools_test_vendors",
   fields: {
-    name: createTextField({ required: true, searchable: true, filterable: true }),
-    iban: createTextField({ required: true, filterable: true }),
+    name: createTextField({
+      required: true,
+      searchable: true,
+      filterable: true,
+      personal: false,
+      reason: "is_business_data",
+    }),
+    iban: createTextField({
+      required: true,
+      filterable: true,
+      personal: false,
+      reason: "is_business_data",
+    }),
   },
 });
 

package/src/audit/__tests__/audit-security.integration.test.ts

@@ -38,7 +38,7 @@ import { createAuditFeature } from "../feature";
 const widgetEntity = createEntity({
   table: "audit_sec_widgets",
   fields: {
-    name: createTextField({ required: true }),
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
   },
 });
 

package/src/audit/__tests__/audit.integration.test.ts

@@ -29,8 +29,8 @@ import { createAuditFeature } from "../feature";
 const widgetEntity = createEntity({
   table: "audit_widgets",
   fields: {
-    name: createTextField({ required: true }),
-    color: createTextField(),
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
+    color: createTextField({ personal: false, reason: "technical_reference" }),
   },
 });
 

package/src/billing-foundation/entities.ts

@@ -39,7 +39,12 @@ import {
 export const subscriptionEntity = createEntity({
   table: "read_subscriptions",
   fields: {
-    providerName: createTextField({ required: true, maxLength: 50 }),
+    providerName: createTextField({
+      required: true,
+      maxLength: 50,
+      personal: false,
+      reason: "technical_reference",
+    }),
     // `personal: "tenant"` (not `encrypted`): the field must crypto-shred when
     // eraseSubjectKeys erases the tenant's subject key on tenant-destroy
     // (#800). `encrypted: true` uses the app-wide master key instead — that
@@ -61,8 +66,18 @@ export const subscriptionEntity = createEntity({
       personal: "tenant",
       find: "none",
     }),
-    status: createTextField({ required: true, maxLength: 30 }),
-    tier: createTextField({ required: true, maxLength: 50 }),
+    status: createTextField({
+      required: true,
+      maxLength: 30,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    tier: createTextField({
+      required: true,
+      maxLength: 50,
+      personal: false,
+      reason: "catalog_label",
+    }),
     currentPeriodEnd: createTimestampField({ required: true }),
   },
 });
@@ -88,7 +103,12 @@ export const SUBSCRIPTION_PII_FIELDS = collectPiiSubjectFields(subscriptionEntit
 export const paymentEntity = createEntity({
   table: "read_payments",
   fields: {
-    providerName: createTextField({ required: true, maxLength: 50 }),
+    providerName: createTextField({
+      required: true,
+      maxLength: 50,
+      personal: false,
+      reason: "technical_reference",
+    }),
     // Same `personal: "tenant"` rationale as subscriptionEntity above —
     // crypto-shreds on tenant-destroy (#800) via eraseSubjectKeys.
     providerCustomerId: createTextField({
@@ -97,7 +117,12 @@ export const paymentEntity = createEntity({
       personal: "tenant",
       find: "none",
     }),
-    priceId: createTextField({ required: true, maxLength: 200 }),
+    priceId: createTextField({
+      required: true,
+      maxLength: 200,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
 });
 

package/src/billing-foundation/handlers/process-event.write.ts

@@ -155,6 +155,7 @@ export const processEventHandler: WriteHandlerDef = {
           SUBSCRIPTION_PII_FIELDS,
           piiKms,
           { requestId: `billing-foundation:process-event:${payload.providerEventId}`, tenantId },
+          { tenantId, entityName: SUBSCRIPTION_AGGREGATE_TYPE },
         )
       : {
           providerCustomerId: payload.providerCustomerId,

package/src/billing-foundation/handlers/process-payment-event.write.ts

@@ -84,6 +84,7 @@ export const processPaymentEventHandler: WriteHandlerDef = {
             requestId: `billing-foundation:process-payment-event:${payload.providerEventId}`,
             tenantId,
           },
+          { tenantId, entityName: PAYMENT_AGGREGATE_TYPE },
         )
       : { providerCustomerId: payload.providerCustomerId };
 

package/src/cap-counter/entity.ts

@@ -42,7 +42,14 @@ export const capCounterEntity = createEntity({
   description:
     "One usage counter per tenant, cap name and calendar period, holding the accumulated value and the timestamp of the last soft-limit warning.",
   fields: {
-    capName: createTextField({ required: true, maxLength: 100, sortable: true, searchable: true }),
+    capName: createTextField({
+      required: true,
+      maxLength: 100,
+      sortable: true,
+      searchable: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
     value: createBigIntField({ required: true, default: 0 }),
     periodStart: createTimestampField({ required: true }),
     lastSoftWarnedAt: createTimestampField(),

package/src/config/table.ts

@@ -19,11 +19,13 @@ import { createEntity, createTextField } from "@cosmicdrift/kumiko-framework/eng
 export const configValueEntity = createEntity({
   table: "read_config_values",
   fields: {
-    key: createTextField({ required: true }),
+    key: createTextField({ required: true, personal: false, reason: "system_metadata" }),
     // value is JSON-encoded primitive (or encrypted blob). Nullable so a
     // deleted-then-recreated stream can signal "reset to default" without
     // breaking the null-vs-missing distinction the resolver already draws.
-    value: createTextField({}),
+    // App/system/tenant config values (service urls, feature toggles,
+    // mail-server settings), not user-authored content.
+    value: createTextField({ personal: false, reason: "system_metadata" }),
     // user-scope row: userId populated. tenant- / system-scope: null.
     userId: createTextField({
       personal: false,

package/src/crypto-shredding/__tests__/forget-subject-record.integration.test.ts

@@ -41,7 +41,13 @@ import { resetPiiSubjectKmsForTests, resetTestTables } from "@cosmicdrift/kumiko
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
-import { RECORD_ENTITY_NOT_REGISTERED, TARGET_RECORD_NOT_ADMIN_TENANT } from "../constants";
+import {
+  RECORD_ENTITY_NOT_REGISTERED,
+  SUBJECT_FORGET_DENIED_EVENT_NAME,
+  SUBJECT_FORGOTTEN_EVENT_NAME,
+  TARGET_RECORD_NOT_ADMIN_TENANT,
+  TARGET_RECORD_RETENTION_BLOCK_DELETE,
+} from "../constants";
 import { createCryptoShreddingFeature } from "../feature";
 
 const FORGET = "crypto-shredding:write:forget-subject";
@@ -160,6 +166,25 @@ describe("crypto-shredding :: forget-subject (record subject, #2786)", () => {
       requestId: "test",
     });
     expect(decrypted["body"]).toBe(PII_ERASED_SENTINEL);
+
+    // fw#2789: the operator path's audit trail — who erased which subject,
+    // and why — must be provable, not just the erase itself. The bystander
+    // user-forget above appended its own subject-forgotten event under the
+    // same rowId (record:<entity>:<id> and user:<id> share aggregate ids
+    // here), so this looks the record subject's event up by its subjectKey
+    // rather than assuming it is the only row.
+    const forgottenEvents = (await selectMany(stack.db, eventsTable, {
+      type: SUBJECT_FORGOTTEN_EVENT_NAME,
+    })) as Array<{ payload: Record<string, unknown> }>;
+    const recordSubjectKey = `record:${RECORD_PROBE_ENTITY_NAME}:${rowId}`;
+    const recordForgottenEvent = forgottenEvents.find(
+      (e) => e.payload["subjectKey"] === recordSubjectKey,
+    );
+    expect(recordForgottenEvent?.payload).toMatchObject({
+      subjectKey: recordSubjectKey,
+      reason: REASON,
+      forgottenBy: dpoUser.id,
+    });
   });
 
   // Empirical: update()'s previous-row re-encrypt (encryptForStorage(previous))
@@ -289,3 +314,118 @@ describe("crypto-shredding :: forget-subject (record subject) tenant gate, #2786
     );
   });
 });
+
+// fw#2789: retention.strategy="blockDelete" on the host entity must win over
+// a targeted row-shred — a separate stack (no tenant feature mounted) so the
+// denial is proven independent of the tenant gate above, not a side effect
+// of it.
+const BLOCK_DELETE_PROBE_ENTITY_NAME = "blockDeleteProbe";
+
+const blockDeleteProbeEntity = createEntity({
+  table: "read_forget_subject_blockdelete_probe",
+  retention: { keepFor: "10y", strategy: "blockDelete" },
+  fields: {
+    body: createTextField({
+      required: true,
+      maxLength: 200,
+      personal: { of: "id" },
+      find: "none",
+    }),
+  },
+});
+const blockDeleteProbeTable = buildEntityTable(
+  "forgetSubjectBlockDeleteProbe",
+  blockDeleteProbeEntity,
+);
+const blockDeleteProbeFeature = defineFeature("forget-subject-blockdelete-probe", (r) => {
+  r.entity(BLOCK_DELETE_PROBE_ENTITY_NAME, blockDeleteProbeEntity);
+});
+
+function blockDeleteProbeExecutor() {
+  return createEventStoreExecutor(blockDeleteProbeTable, blockDeleteProbeEntity, {
+    entityName: BLOCK_DELETE_PROBE_ENTITY_NAME,
+  });
+}
+
+describe("crypto-shredding :: forget-subject (record subject) retention gate, #2789", () => {
+  let retentionStack: TestStack;
+  let retentionKms: InMemoryKmsAdapter;
+
+  const RETENTION_TENANT: TenantId = testTenantId(24);
+  const dpoRetentionUser = {
+    id: "cccccccc-cccc-4ccc-8ccc-000000000004",
+    tenantId: RETENTION_TENANT,
+    roles: ["DataProtectionOfficer"],
+  };
+
+  beforeAll(async () => {
+    retentionStack = await setupTestStack({
+      features: [createCryptoShreddingFeature(), blockDeleteProbeFeature],
+    });
+    await unsafeCreateEntityTable(
+      retentionStack.db,
+      blockDeleteProbeEntity,
+      BLOCK_DELETE_PROBE_ENTITY_NAME,
+    );
+    await createEventsTable(retentionStack.db);
+  });
+
+  afterAll(async () => {
+    await retentionStack.cleanup();
+  });
+
+  beforeEach(async () => {
+    await resetTestTables(retentionStack.db, [blockDeleteProbeTable, eventsTable]);
+    retentionKms = new InMemoryKmsAdapter();
+    configurePiiSubjectKms(retentionKms);
+  });
+
+  afterEach(() => {
+    resetPiiSubjectKmsForTests();
+  });
+
+  test("blockDelete entity refuses the shred — key and plaintext survive, denial is audited", async () => {
+    const tenantDb = createTenantDb(retentionStack.db, RETENTION_TENANT, "system");
+    const plaintext = "ledger entry naming a third party";
+    const created = await blockDeleteProbeExecutor().create(
+      { body: plaintext },
+      dpoRetentionUser,
+      tenantDb,
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+    const rowId = String(created.data.id);
+
+    const err = await retentionStack.http.writeErr(
+      FORGET,
+      {
+        subject: { kind: "record", entity: BLOCK_DELETE_PROBE_ENTITY_NAME, id: rowId },
+        reason: REASON,
+      },
+      dpoRetentionUser,
+    );
+    expect(err.httpStatus).toBe(403);
+    expect((err.details as { reason?: string } | undefined)?.reason).toBe(
+      TARGET_RECORD_RETENTION_BLOCK_DELETE,
+    );
+
+    // The load-bearing claim: blockDelete winning means the data survived,
+    // not merely that the request returned 403.
+    const stillReadable = await blockDeleteProbeExecutor().detail(
+      { id: rowId },
+      dpoRetentionUser,
+      tenantDb,
+    );
+    expect(stillReadable?.["body"]).toBe(plaintext);
+
+    const deniedEvents = (await selectMany(retentionStack.db, eventsTable, {
+      type: SUBJECT_FORGET_DENIED_EVENT_NAME,
+    })) as Array<{ payload: Record<string, unknown> }>;
+    expect(deniedEvents).toHaveLength(1);
+    expect(deniedEvents[0]?.payload).toMatchObject({
+      subjectKind: "record",
+      denial: TARGET_RECORD_RETENTION_BLOCK_DELETE,
+      reason: REASON,
+      forgottenBy: dpoRetentionUser.id,
+    });
+  });
+});

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -262,7 +262,7 @@ describe("crypto-shredding :: forget-subject purges the derived search index (#1
   const probeEntity = createEntity({
     table: "read_forget_subject_search_probe",
     fields: {
-      ownerId: createTextField({ required: true }),
+      ownerId: createTextField({ required: true, personal: false, reason: "pseudonymous_fk" }),
       userNote: createTextField({
         required: true,
         maxLength: 100,

package/src/crypto-shredding/constants.ts

@@ -8,3 +8,4 @@ export const CRYPTO_SHREDDING_AGGREGATE_TYPE = "crypto-shredding-subject";
 export const TARGET_TENANT_NOT_ADMIN_TENANT = "target_tenant_not_admin_tenant" as const;
 export const RECORD_ENTITY_NOT_REGISTERED = "record_entity_not_registered" as const;
 export const TARGET_RECORD_NOT_ADMIN_TENANT = "target_record_not_admin_tenant" as const;
+export const TARGET_RECORD_RETENTION_BLOCK_DELETE = "target_record_retention_block_delete" as const;

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -44,6 +44,7 @@ import {
   SUBJECT_FORGET_DENIED_EVENT_NAME,
   SUBJECT_FORGOTTEN_EVENT_NAME,
   TARGET_RECORD_NOT_ADMIN_TENANT,
+  TARGET_RECORD_RETENTION_BLOCK_DELETE,
   TARGET_TENANT_NOT_ADMIN_TENANT,
 } from "../constants";
 
@@ -171,6 +172,28 @@ async function resolveTenantScopeDenial(
   return ownedInTenant ? undefined : memberDenied;
 }
 
+// fw#2789: the host entity's OWN retention declaration gets the last word on
+// a targeted row-shred — blockDelete (legally mandated physical retention,
+// e.g. ledger/invoice text) means this command must refuse, not silently
+// anonymize or proceed. Deliberately independent of the tenant feature/gate
+// above: a retention obligation holds in single-tenant apps too, and running
+// unconditionally (not nested under `features.has("tenant")`) keeps that
+// true. Only the entity's declared `retention.strategy` is consulted here —
+// NOT the data-retention feature's tenant-preset/override layering
+// (resolveRetentionPolicy) — so a tenant cannot override its own way past a
+// blockDelete declared on the entity.
+function resolveRetentionDenial(
+  features: ReadonlyMap<string, FeatureDefinition>,
+  raw: SubjectIdInput,
+): WriteFailure | undefined {
+  if (raw.kind !== "record") return undefined;
+  const entity = findRegisteredEntity(features, raw.entity);
+  if (entity?.retention?.strategy !== "blockDelete") return undefined;
+  return writeFailure(
+    new AccessDeniedError({ details: { reason: TARGET_RECORD_RETENTION_BLOCK_DELETE } }),
+  );
+}
+
 // Denied cross-tenant probes must still leave an audit trail (fw#2348).
 // Appended outside the handler tx (fw#2592): the caller's
 // `return tenantScopeDenial` rolls that tx back.
@@ -296,6 +319,25 @@ export const forgetSubjectWrite = defineWriteHandler({
       return auditFailure ?? tenantScopeDenial;
     }
 
+    // Runs AFTER the tenant gate (VORHER only means "before the shred"): a
+    // retention check ahead of the tenant gate would leak a foreign
+    // entity's retention posture to a cross-tenant prober.
+    const retentionDenial = resolveRetentionDenial(ctx.registry.features, raw);
+    if (retentionDenial) {
+      // Own reason constant, not tenantScopeDenial's `.error.code` pattern:
+      // AccessDeniedError.code is the generic "access_denied" for every
+      // branch, so re-deriving it here would make a blockDelete refusal
+      // indistinguishable from a cross-tenant one in the audit trail.
+      const auditFailure = await appendDenialAuditEvent(
+        ctx,
+        event,
+        subjectKey,
+        raw.kind,
+        TARGET_RECORD_RETENTION_BLOCK_DELETE,
+      );
+      return auditFailure ?? retentionDenial;
+    }
+
     // Erase BEFORE the audit append: if the append throws, the key is gone
     // but no event exists — a retry is a no-op erase plus the event. The
     // reverse order could leave an audit trail claiming a shred that never

package/src/custom-fields/__tests__/audit-integration.integration.test.ts

@@ -40,7 +40,7 @@ import { customFieldsField, wireCustomFieldsFor } from "../wire-for-entity";
 const propertyEntity = createEntity({
   table: "read_t15a_properties",
   fields: {
-    name: createTextField({ required: true }),
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     customFields: customFieldsField(),
   },
 });

package/src/custom-fields/__tests__/cross-tenant-field-delete.integration.test.ts

@@ -37,7 +37,7 @@ import { customFieldsField, wireCustomFieldsFor } from "../wire-for-entity";
 const propertyEntity = createEntity({
   table: "read_xt_properties",
   fields: {
-    name: createTextField({ required: true }),
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     customFields: customFieldsField(),
   },
 });

package/src/custom-fields/__tests__/cross-tenant-set-write.integration.test.ts

@@ -33,7 +33,7 @@ import { customFieldsField, wireCustomFieldsFor } from "../wire-for-entity";
 const propertyEntity = createEntity({
   table: "read_xt_set_properties",
   fields: {
-    name: createTextField({ required: true }),
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     customFields: customFieldsField(),
   },
 });

package/src/custom-fields/__tests__/custom-fields.integration.test.ts

@@ -42,7 +42,7 @@ import { customFieldsField, wireCustomFieldsFor } from "../wire-for-entity";
 const propertyEntity = createEntity({
   table: "read_t1_properties",
   fields: {
-    name: createTextField({ required: true }),
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     customFields: customFieldsField(),
   },
 });

package/src/custom-fields/__tests__/field-access.integration.test.ts

@@ -34,7 +34,7 @@ import { customFieldsField, wireCustomFieldsFor } from "../wire-for-entity";
 const propertyEntity = createEntity({
   table: "read_t15b_properties",
   fields: {
-    name: createTextField({ required: true }),
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     customFields: customFieldsField(),
   },
 });

package/src/custom-fields/__tests__/quota.integration.test.ts

@@ -30,7 +30,7 @@ import { customFieldsField, wireCustomFieldsFor } from "../wire-for-entity";
 const propertyEntity = createEntity({
   table: "read_t15e_properties",
   fields: {
-    name: createTextField({ required: true }),
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     customFields: customFieldsField(),
   },
 });

package/src/custom-fields/__tests__/retention.integration.test.ts

@@ -37,7 +37,7 @@ import { customFieldsField, wireCustomFieldsFor } from "../wire-for-entity";
 const propertyEntity = createEntity({
   table: "read_t15d_properties",
   fields: {
-    name: createTextField({ required: true }),
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     customFields: customFieldsField(),
   },
 });

package/src/custom-fields/__tests__/user-data-rights.integration.test.ts

@@ -62,7 +62,7 @@ const PAST = (): Instant => getTemporal().Now.instant().subtract({ minutes: 1 })
 const propertyEntity = createEntity({
   table: "read_t15c_properties",
   fields: {
-    name: createTextField({ required: true }),
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     customFields: customFieldsField(),
   },
 });

package/src/custom-fields/__tests__/wire-for-entity.test.ts

@@ -10,7 +10,7 @@ import { customFieldsField, wireCustomFieldsFor } from "../wire-for-entity";
 const propertyEntity = createEntity({
   table: "read_test_properties",
   fields: {
-    name: createTextField({ required: true }),
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     customFields: customFieldsField(),
   },
 });