@cosmicdrift/kumiko-bundled-features 0.252.1 → 0.254.0

package/src/jobs/__tests__/reindex-entity-job.integration.test.ts

@@ -38,7 +38,12 @@ const REINDEX_ENTITY_JOB = "jobs:job:reindex-entity";
 const widgetEntity = createEntity({
   table: "read_reindex_job_widgets",
   fields: {
-    name: createTextField({ required: true, searchable: true }),
+    name: createTextField({
+      required: true,
+      searchable: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
 });
 

package/src/jobs/db/queries/stale-run-sweep.ts

@@ -12,8 +12,9 @@
 // the run becomes retriable via the existing jobs:write:retry gate
 // (retry.write.ts only allows retry from "failed").
 
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { encryptFailureError } from "../../job-run-logger";
 import { jobRunsTable } from "../../job-run-table";
 
 export const STALE_JOB_RUN_ERROR =
@@ -30,22 +31,43 @@ export async function markStaleJobRunsFailed(
   const cutoff = Temporal.Now.instant().subtract({ hours: timeoutHours });
   const now = Temporal.Now.instant();
 
+  // Fetch the matched rows first: `error` carries the same per-triggering-
+  // user subject annotation as job-run-logger.ts's onJobFailed path
+  // (personal: { of: "triggeredById" } on job-run-table.ts), and a batch
+  // updateMany can't encrypt per-row — different matched runs can belong to
+  // different users, each under their own DEK. One updateMany per row keeps
+  // this crash-recovery sweep's write on the same encrypted footing as the
+  // normal failure path instead of writing STALE_JOB_RUN_ERROR in the clear.
+  const stale = await selectMany<{ id: string; triggeredById: string | null }>(db, jobRunsTable, {
+    status: "running",
+    startedAt: { lt: cutoff },
+  });
+
   // duration is deliberately left untouched: we don't know when the run
   // actually died, only that it crossed the timeout, so recording a
   // duration would misrepresent it as measured. detail-screen/list-screen
   // both already render a null duration as "—".
-  const updated = await updateMany(
-    db,
-    jobRunsTable,
-    {
-      status: "failed",
-      error: STALE_JOB_RUN_ERROR,
-      finishedAt: now,
-      modifiedAt: now,
-      modifiedById: "system",
-    },
-    { status: "running", startedAt: { lt: cutoff } },
-  );
+  let runsMarkedFailed = 0;
+  for (const run of stale) {
+    const encryptedError = await encryptFailureError(STALE_JOB_RUN_ERROR, run.triggeredById);
+    const updated = await updateMany(
+      db,
+      jobRunsTable,
+      {
+        status: "failed",
+        error: encryptedError,
+        finishedAt: now,
+        modifiedAt: now,
+        modifiedById: "system",
+      },
+      // Re-assert status: "running" here (not just id) — closes the race
+      // window between the selectMany above and this write, where the run
+      // could have completed/failed normally in between and must not be
+      // clobbered back to "failed" with the stale-timeout message.
+      { id: run.id, status: "running" },
+    );
+    runsMarkedFailed += updated.length;
+  }
 
-  return { runsMarkedFailed: updated.length };
+  return { runsMarkedFailed };
 }

package/src/jobs/feature.ts

@@ -48,6 +48,11 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
     r.systemScope();
     r.storeTable(jobRunsTableMeta, {
       reason: "direct_write.job_runs",
+      // payload/error carry personal:{of:"triggeredById"} (job-run-table.ts).
+      // job-run-logger.ts manually encrypts both before every insert/update
+      // (encryptStartedPayload/encryptFailureError) since this store bypasses
+      // the executor's automatic PII pipeline (#2243).
+      piiEncryptedOnWrite: true,
     });
     r.storeTable(jobRunLogsTableMeta, {
       reason: "read_side.job_run_logs",

package/src/jobs/job-run-logger.ts

@@ -106,8 +106,13 @@ async function encryptLogMessages<T extends { readonly message: string }>(
 // Mirrors encryptFailureError for the failure-path `error` column (#2307):
 // stored alongside logs[].message under the same triggering user's DEK, so
 // a log/error pair from the same failed run decrypt together or erase
-// together.
-async function encryptFailureError(error: string, triggeredById: string | null): Promise<string> {
+// together. Exported so stale-run-sweep.ts's crash-recovery write (a
+// separate, per-row batch path outside onJobFailed) applies the identical
+// per-subject encryption instead of writing `error` in the clear.
+export async function encryptFailureError(
+  error: string,
+  triggeredById: string | null,
+): Promise<string> {
   if (triggeredById === null) return error;
   const kms = configuredPiiSubjectKms();
   if (!kms) return error;

package/src/jobs/job-run-table.ts

@@ -41,16 +41,21 @@ export type JobLogLevel = "info" | "warn" | "error";
 export const jobRunEntity = createEntity({
   table: "store_job_runs",
   fields: {
-    jobName: createTextField({ required: true }),
-    bullJobId: createTextField({ required: true }),
-    status: createTextField({ required: true }),
-    payload: createTextField(),
-    error: createTextField(),
+    jobName: createTextField({ required: true, personal: false, reason: "system_metadata" }),
+    bullJobId: createTextField({ required: true, personal: false, reason: "system_metadata" }),
+    status: createTextField({ required: true, personal: false, reason: "system_metadata" }),
+    // The run-started payload can carry arbitrary caller-supplied data,
+    // encrypted by job-run-logger.ts under the triggering user's DEK (see
+    // jobs-pii-kms.integration.test.ts) — same subject as `triggeredById`.
+    payload: createTextField({ personal: { of: "triggeredById" }, find: "none" }),
+    // Failure messages can echo payload content back — same subject/DEK as
+    // `payload` (job-run-logger.ts encryptFailureError).
+    error: createTextField({ personal: { of: "triggeredById" }, find: "none" }),
     attempt: createNumberField({ required: true, default: 1, integer: true }),
     startedAt: createTimestampField({ required: true }),
     finishedAt: createTimestampField(),
     duration: createNumberField({ integer: true }),
-    triggeredById: createTextField(),
+    triggeredById: createTextField({ personal: false, reason: "pseudonymous_fk" }),
   },
 });
 

package/src/ledger/entity.ts

@@ -19,12 +19,17 @@ export const accountEntity = createEntity({
   description:
     "One node of a tenant's chart of accounts: a name, an asset/liability/equity/income/expense type that decides how reports read its balance, an optional account code and an optional parent account forming the account tree; balances are derived from postings, never stored here.",
   fields: {
-    name: createTextField({ required: true, maxLength: 120 }),
+    name: createTextField({
+      required: true,
+      maxLength: 120,
+      personal: false,
+      reason: "is_business_data",
+    }),
     type: createSelectField({ options: ACCOUNT_TYPES, required: true }),
     // Optional account number (Kontonummer / SKR code) — free text in v1.
-    code: createTextField({ maxLength: 32 }),
+    code: createTextField({ maxLength: 32, personal: false, reason: "technical_reference" }),
     // Parent account id, or absent for a root account. No FK (event-sourced).
-    parentId: createTextField({ maxLength: 64 }),
+    parentId: createTextField({ maxLength: 64, personal: false, reason: "technical_reference" }),
   },
 });
 
@@ -52,8 +57,13 @@ export const transactionEntity = createEntity({
       personal: false,
       reason: "is_business_data",
     }),
-    // For a Storno entry this points at the reversed transaction's id.
-    reference: createTextField({ maxLength: 120 }),
+    // Free-text memo (a reversal or confirmed schedule period overwrites it with
+    // a system-generated id, but a manual entry can carry caller-supplied text).
+    reference: createTextField({
+      maxLength: 120,
+      personal: false,
+      reason: "is_business_data",
+    }),
     status: createSelectField({ options: TRANSACTION_STATUS, required: true }),
     // Posting lines are born with the entry and never change on their own —
     // a correction is a new (reversing) entry. The embedded list validates
@@ -94,7 +104,17 @@ export const scheduleEntity = createEntity({
     endDate: createDateField(),
     interval: createSelectField({ options: SCHEDULE_INTERVALS, required: true }),
     amount: createNumberField({ required: true, min: 1, integer: true }),
-    debitAccountId: createTextField({ required: true, maxLength: 64 }),
-    creditAccountId: createTextField({ required: true, maxLength: 64 }),
+    debitAccountId: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    creditAccountId: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
 });

package/src/managed-pages/screens/branding-screen.ts

@@ -38,16 +38,30 @@ export function createBrandingSettingsScreen(opts: {
       layoutPreset: BRANDING_QN.layoutPreset,
     },
     fields: {
-      title: createTextField({ maxLength: 200 }),
+      title: createTextField({ maxLength: 200, personal: false, reason: "is_business_data" }),
       description: createTextField({
         maxLength: 500,
         multiline: { rows: 3 },
         personal: false,
         reason: "is_business_data",
       }),
-      siteUrl: createTextField({ maxLength: 2000, format: "url" }),
-      accentColor: createTextField({ maxLength: 9 }),
-      logoUrl: createTextField({ maxLength: 2000, format: "url" }),
+      siteUrl: createTextField({
+        maxLength: 2000,
+        format: "url",
+        personal: false,
+        reason: "is_business_data",
+      }),
+      accentColor: createTextField({
+        maxLength: 9,
+        personal: false,
+        reason: "is_business_data",
+      }),
+      logoUrl: createTextField({
+        maxLength: 2000,
+        format: "url",
+        personal: false,
+        reason: "is_business_data",
+      }),
       layoutPreset: createSelectField({ options: LAYOUT_PRESETS }),
     },
     layout: {
@@ -74,7 +88,15 @@ export function createBrandingSettingsScreen(opts: {
     configKeys: { ...base.configKeys, customCss: BRANDING_QN.customCss },
     fields: {
       ...base.fields,
-      customCss: createTextField({ maxLength: 8000, multiline: { rows: 12 } }),
+      // Tenant-admin-authored branding CSS (raw-CSS gated behind
+      // allowCustomCss), not end-user input — same category as the other
+      // branding fields above.
+      customCss: createTextField({
+        maxLength: 8000,
+        multiline: { rows: 12 },
+        personal: false,
+        reason: "is_business_data",
+      }),
     },
     layout: {
       sections: [

package/src/managed-pages/table.ts

@@ -16,9 +16,28 @@ export const pageEntity = createEntity({
   description:
     "One tenant-editable public web page, unique per slug and language, holding a markdown body plus the title, SEO description and OG image, with a published flag that decides whether anonymous visitors are served it or get a 404.",
   fields: {
-    slug: createTextField({ required: true, maxLength: 64, sortable: true, searchable: true }),
-    lang: createTextField({ required: true, maxLength: 8, sortable: true }),
-    title: createTextField({ required: true, maxLength: 200, searchable: true }),
+    slug: createTextField({
+      required: true,
+      maxLength: 64,
+      sortable: true,
+      searchable: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    lang: createTextField({
+      required: true,
+      maxLength: 8,
+      sortable: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    title: createTextField({
+      required: true,
+      maxLength: 200,
+      searchable: true,
+      personal: false,
+      reason: "is_business_data",
+    }),
     // Body + description sind vom Tenant-Admin authored Business-Content
     // (Markdown), keine User-Generated-PII. `multiline` → der entityEdit-
     // Renderer gibt ein <textarea> aus (createLongTextField hat aktuell
@@ -32,7 +51,7 @@ export const pageEntity = createEntity({
       reason: "is_business_data",
     }),
     description: createTextField({ maxLength: 500, personal: false, reason: "is_business_data" }),
-    ogImage: createTextField({ maxLength: 2000 }),
+    ogImage: createTextField({ maxLength: 2000, personal: false, reason: "is_business_data" }),
     published: createBooleanField({ default: false }),
   },
   indexes: [{ unique: true, columns: ["tenantId", "slug", "lang"], name: "read_pages_unique" }],

package/src/notes-history/__tests__/add-note-author-name-kms.integration.test.ts

@@ -43,7 +43,14 @@ const tenantId = testTenantId(1);
 const CONTACT_TABLE = "notes_kms_test_contacts";
 const contactEntity = createEntity({
   table: CONTACT_TABLE,
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 const contactFixtureFeature = defineFeature("notes-kms-test-contact-fixture", (r) => {
   r.entity("contact", contactEntity);

package/src/notes-history/__tests__/notes-history-ownership.integration.test.ts

@@ -69,7 +69,14 @@ const teamOwnership: NonNullable<EntityDefinition["access"]> = {
 const PROJECT_TABLE = "notes_ownership_test_projects";
 const projectEntity: EntityDefinition = createEntity({
   table: PROJECT_TABLE,
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 const projectFixtureFeature = defineFeature("notes-ownership-test-project-fixture", (r) => {
   r.entity("project", projectEntity);

package/src/notes-history/__tests__/notes-history-parent-visibility.integration.test.ts

@@ -48,8 +48,18 @@ function createProjectEntity(access?: EntityDefinition["access"]): EntityDefinit
   return createEntity({
     table: PROJECT_TABLE,
     fields: {
-      teamId: createTextField({ required: true, maxLength: 64 }),
-      name: createTextField({ required: true, maxLength: 64 }),
+      teamId: createTextField({
+        required: true,
+        maxLength: 64,
+        personal: false,
+        reason: "technical_reference",
+      }),
+      name: createTextField({
+        required: true,
+        maxLength: 64,
+        personal: false,
+        reason: "technical_reference",
+      }),
     },
     access,
   });
@@ -62,7 +72,14 @@ const guardedProjectEntity = createProjectEntity(projectOwnership);
 // too, not just made-up names.
 const contactEntity = createEntity({
   table: "notes_pv_test_contacts",
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 
 const fixturesFeature = defineFeature("notes-pv-test-fixtures", (r) => {

package/src/notes-history/__tests__/notes-history.integration.test.ts

@@ -36,7 +36,14 @@ const notesHistoryFeature = createNotesHistoryFeature();
 const CONTACT_TABLE = "notes_history_test_contacts";
 const contactEntity = createEntity({
   table: CONTACT_TABLE,
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 const contactFixtureFeature = defineFeature("notes-history-test-contact-fixture", (r) => {
   r.entity("contact", contactEntity);

package/src/notes-history/entity.ts

@@ -17,18 +17,26 @@ import {
 // that is the whole point of a note *history* instead of the single
 // overwritable textarea this bundle replaces (solon#13).
 //
-// `body` is about the HOST entity (entityType/entityId), not the author —
-// the author is never the data subject of a note's content, so it is
-// deliberately NOT `personal: { of: "authorId" }`. That axis would
-// crypto-shred every note's content the moment its author's data-rights key
-// is destroyed (an employee leaving triggers a forget), garbling unrelated
-// business notes about customers/projects/etc. — data loss, not privacy.
-// `body` stays plaintext (`personal: false`), same call as tags' catalog
-// `name` field. GDPR erasure of the AUTHOR still shreds `authorName`
-// (`personal: { of: "authorId" }`, the name as stamped at write time) —
-// `body` and the note itself are unaffected. If a note's body incidentally
-// names or describes a third party, that isn't tracked by field annotation
-// today; no PII hooks exist for note content.
+// `body` is about the HOST entity (entityType/entityId), not the author — the
+// author is never the data subject of a note's content, so it is deliberately
+// NOT `personal: { of: "authorId" }`. That axis would crypto-shred every
+// note's content the moment its author's data-rights key is destroyed (an
+// employee leaving triggers a forget), garbling unrelated business notes
+// about customers/projects/etc. — data loss, not privacy.
+//
+// `body` is instead `personal: { of: "id" }` (Row-Subject, fw#2596/#2786):
+// the note's OWN row is its content's subject, so `body` is encrypted under a
+// per-note key that nothing else shares. That key gets erased only when
+// `note-mention` (below) names this note as reached by a forgotten subject
+// (see `notes-history-user-data/hooks.ts`) — a note with no mention on the
+// forgotten subject is untouched. GDPR erasure of the AUTHOR still separately
+// shreds `authorName` (`personal: { of: "authorId" }`, the name as stamped at
+// write time); the two erasures are independent.
+//
+// Known gap (fw#2596, not fixed by this entity): prose that names a third
+// party without a structured @-mention is not tracked — regex/NLP over
+// free text is unreliable. The operator's manual `forget-subject` path
+// covers what this structured trigger misses.
 export function createNoteEntryEntity(access?: EntityDefinition["access"]) {
   return createEntity({
     table: "read_note_entries",
@@ -36,9 +44,19 @@ export function createNoteEntryEntity(access?: EntityDefinition["access"]) {
       "One note attached to a host entity by entityType and entityId, holding the note body plus the id and the display name of the author as it stood when the note was written. Rows are append-only: a correction is a further note, never an edit of this one.",
     access,
     fields: {
-      entityType: createTextField({ required: true, maxLength: 64 }),
+      entityType: createTextField({
+        required: true,
+        maxLength: 64,
+        personal: false,
+        reason: "technical_reference",
+      }),
       // Host entity ids are uuid/text; 128 covers uuid plus non-uuid text keys.
-      entityId: createTextField({ required: true, maxLength: 128 }),
+      entityId: createTextField({
+        required: true,
+        maxLength: 128,
+        personal: false,
+        reason: "technical_reference",
+      }),
       // Never client-supplied — stamped by the deriveAuthorId preSave hook from
       // ctx.user.id (see feature.ts), so a note can't be authored as someone
       // else. subjectRef feeds the GDPR-hook-coverage boot guard (it's a plain
@@ -56,14 +74,40 @@ export function createNoteEntryEntity(access?: EntityDefinition["access"]) {
       body: createLongTextField({
         required: true,
         maxLength: 20_000,
-        // Describes the host entity, not the author — no per-user subject to
-        // crypto-shred against. `personal: false` silences the
-        // user-content-name heuristic (`body` is on PII_USER_OWNED_NAME_HINTS).
-        personal: false,
-        reason: "note_content_not_owned_by_author",
+        // Row-Subject (fw#2596/#2786): the note itself is the subject, so its
+        // key is erased per-note via `note-mention` lookups, not tied to any
+        // user's own forget.
+        personal: { of: "id" },
+        find: "none",
       }),
     },
   });
 }
 
 export const noteEntryEntity = createNoteEntryEntity();
+
+// note-mention — join row recording that a note names a subject via a
+// structured @-mention in the editor (never parsed out of `body` text — see
+// the header comment above). One row per (note, mentioned subject); a note
+// with several mentions gets several rows.
+//
+// `subjectId` is the plain FK to the mentioned user's id — `personal: "ref"`
+// marks it as a subject reference for the GDPR-hook-coverage boot guard
+// (same role as `authorId` on note-entry above), not itself encrypted.
+// `notes-history-user-data/hooks.ts` looks this table up by `subjectId` when
+// a user is forgotten, to find every note whose row-subject key must be
+// erased; see that file for the cascade and the retention-consult step it
+// runs first.
+export function createNoteMentionEntity() {
+  return createEntity({
+    table: "read_note_mentions",
+    description:
+      "One row recording that a note names a subject via a structured @-mention, keyed by noteId and the mentioned subject's id.",
+    fields: {
+      noteId: createTextField({ required: true, maxLength: 64 }),
+      subjectId: createTextField({ required: true, maxLength: 64, personal: "ref" }),
+    },
+  });
+}
+
+export const noteMentionEntity = createNoteMentionEntity();

package/src/notes-history/executor.ts

@@ -1,7 +1,12 @@
 import { createEntityExecutor } from "@cosmicdrift/kumiko-framework/engine";
-import { noteEntryEntity } from "./entity";
+import { noteEntryEntity, noteMentionEntity } from "./entity";
 
 export const { executor: noteEntryExecutor, table: noteEntryTable } = createEntityExecutor(
   "note-entry",
   noteEntryEntity,
 );
+
+export const { executor: noteMentionExecutor, table: noteMentionTable } = createEntityExecutor(
+  "note-mention",
+  noteMentionEntity,
+);

package/src/notes-history/feature.ts

@@ -22,7 +22,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { hasWhereRule } from "../shared";
 import { DEFAULT_NOTES_HISTORY_ACCESS, NOTES_HISTORY_FEATURE_NAME } from "./constants";
-import { createNoteEntryEntity } from "./entity";
+import { createNoteEntryEntity, noteMentionEntity } from "./entity";
 import { createAddNoteHandler } from "./handlers/add-note.write";
 import { NOTES_HISTORY_FEATURE_I18N } from "./i18n";
 
@@ -43,6 +43,12 @@ function registerNotesHistory(
 
   const entity = createNoteEntryEntity(ownership);
   r.entity("note-entry", entity);
+  // No write/query handler of its own — populated only as a side effect of
+  // add-note (see handlers/add-note.write.ts), looked up by
+  // notes-history-user-data's forget cascade. Registering the entity (not
+  // just building it inline in the handler) is what makes it visible to the
+  // registry-wide GDPR boot guards and to executor.ts's table/projection setup.
+  r.entity("note-mention", noteMentionEntity);
 
   r.writeHandler(createAddNoteHandler(access, parents));
   r.queryHandler(

package/src/notes-history/handlers/add-note.write.ts

@@ -4,7 +4,7 @@ import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/error
 import { decryptStoredPii, parentRowIsVisible } from "../../shared";
 import { userTable } from "../../user";
 import { DEFAULT_NOTES_HISTORY_ACCESS } from "../constants";
-import { noteEntryExecutor } from "../executor";
+import { noteEntryExecutor, noteMentionExecutor } from "../executor";
 import { type AddNotePayload, addNotePayloadSchema } from "../schemas";
 
 // add-note — appends a note-entry to (entityType, entityId). authorId is
@@ -69,11 +69,27 @@ export function createAddNoteHandler(
         authorName = null;
       }
 
-      return noteEntryExecutor.create(
-        { ...payload, authorId: event.user.id, authorName },
+      const { mentions, ...notePayload } = payload;
+      const created = await noteEntryExecutor.create(
+        { ...notePayload, authorId: event.user.id, authorName },
         event.user,
         ctx.db,
       );
+      if (!created.isSuccess) return created;
+
+      // Same tx as the note create above (ctx.db) — a mention-row failure
+      // rolls the note back with it, same as the framework's own nested-write
+      // parent+child pattern (dispatch-write.ts).
+      for (const subjectId of new Set(mentions ?? [])) {
+        const mentionResult = await noteMentionExecutor.create(
+          { noteId: created.data.id, subjectId },
+          event.user,
+          ctx.db,
+        );
+        if (!mentionResult.isSuccess) return mentionResult;
+      }
+
+      return created;
     },
   };
 }

package/src/notes-history/index.ts

@@ -6,8 +6,13 @@ export {
   NotesHistoryHandlers,
   NotesHistoryQueries,
 } from "./constants";
-export { noteEntryEntity } from "./entity";
-export { noteEntryExecutor, noteEntryTable } from "./executor";
+export { noteEntryEntity, noteMentionEntity } from "./entity";
+export {
+  noteEntryExecutor,
+  noteEntryTable,
+  noteMentionExecutor,
+  noteMentionTable,
+} from "./executor";
 export {
   createNotesHistoryFeature,
   type NotesHistoryFeatureOptions,

package/src/notes-history/schemas.ts

@@ -4,9 +4,14 @@ import { z } from "zod";
 // needed here since note-entry has no deterministic aggregate-id derived
 // from these fields (see aggregate-id note in entity.ts): a literal value
 // can't shift stream-id tuple boundaries when there is no such tuple.
+// `mentions` carries structured @-mentions from the editor as user ids —
+// never parsed out of `body` text (regex/NLP over free text is unreliable,
+// see entity.ts). Capped well above any realistic note; a client sending more
+// is a bug, not a use case worth accommodating.
 export const addNotePayloadSchema = z.object({
   entityType: z.string().min(1).max(64),
   entityId: z.string().min(1).max(128),
   body: z.string().trim().min(1).max(20_000),
+  mentions: z.array(z.uuid()).max(50).optional(),
 });
 export type AddNotePayload = z.infer<typeof addNotePayloadSchema>;

package/src/notes-history-user-data/__tests__/hooks.integration.test.ts

@@ -30,7 +30,14 @@ const other = createTestUser({ id: 2, roles: ["TenantMember"] });
 const CONTACT_TABLE = "notes_user_data_test_contacts";
 const contactEntity = createEntity({
   table: CONTACT_TABLE,
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 const contactFixtureFeature = defineFeature("notes-user-data-test-contact-fixture", (r) => {
   r.entity("contact", contactEntity);