@cosmicdrift/kumiko-bundled-features 0.252.1 → 0.254.0

package/src/notes-history-user-data/__tests__/mention-forget.integration.test.ts

@@ -0,0 +1,244 @@
+// notes-history mention-forget cascade (fw#2787):
+//
+//   - a note carrying a structured @-mention on a forgotten user S has its
+//     `body` (Row-Subject, personal: { of: "id" }) crypto-shredded when S's
+//     Art. 17 forget runs (runForgetCleanup → noteEntryDeleteHook →
+//     note-mention lookup → kms.eraseKey on the note's own record subject)
+//   - a sibling note on the SAME host with NO mention on S stays fully
+//     readable — proves the cascade doesn't collaterally shred every note
+//   - the host entity's retention strategy is consulted BEFORE shredding:
+//     an `anonymize` override on the host blocks the erase entirely
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  PII_ERASED_SENTINEL,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  resetPiiSubjectKmsForTests,
+  resetTestTables,
+  seedRow,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
+import { tenantRetentionOverrideTable } from "../../data-retention/schema/tenant-retention-override";
+import { createFilesFeature } from "../../files";
+import {
+  createNotesHistoryFeature,
+  NotesHistoryHandlers,
+  noteEntryEntity,
+  noteEntryExecutor,
+  noteMentionEntity,
+} from "../../notes-history";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
+import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
+import { createUserDataRightsFeature, runForgetCleanup } from "../../user-data-rights";
+import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
+import { notesHistoryUserDataFeature } from "..";
+
+type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
+function pastInstant(): Instant {
+  return getTemporal().Instant.fromEpochMilliseconds(Date.now() - 60_000);
+}
+
+const CONTACT_TABLE = "notes_mention_forget_test_contacts";
+const contactEntity = createEntity({
+  table: CONTACT_TABLE,
+  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+});
+const contactFixtureFeature = defineFeature("notes-mention-forget-test-contact-fixture", (r) => {
+  r.entity("contact", contactEntity);
+});
+
+const author = createTestUser({ id: 1, roles: ["TenantMember"] });
+const CONTACT_1 = "40000000-0000-4000-8000-000000000001";
+const SUBJECT_S = "40000000-0000-4000-8000-0000000000ff";
+
+let stack: TestStack;
+let overrideExecutor: ReturnType<typeof createEventStoreExecutor>;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createUserFeature(),
+      authFoundationFeature,
+      createSessionsFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      createFilesFeature(),
+      createUserDataRightsFeature(),
+      createUserDataRightsDefaultsFeature(),
+      createNotesHistoryFeature(),
+      notesHistoryUserDataFeature,
+      contactFixtureFeature,
+    ],
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
+  await unsafeCreateEntityTable(stack.db, noteEntryEntity, "note-entry");
+  await unsafeCreateEntityTable(stack.db, noteMentionEntity, "note-mention");
+  await unsafeCreateEntityTable(stack.db, contactEntity);
+  await unsafePushTables(stack.db, { fileRefsTable });
+  await createEventsTable(stack.db);
+  // tenant-membership table (from the tenant feature) manually created — same
+  // minimal setup as run-forget-cleanup.integration.test.ts, no tenant feature
+  // mounted here.
+  await asRawClient(stack.db).unsafe(`
+    CREATE TABLE IF NOT EXISTS read_tenant_memberships (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      tenant_id UUID NOT NULL,
+      user_id TEXT NOT NULL,
+      version INTEGER NOT NULL DEFAULT 0,
+      inserted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      modified_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      inserted_by_id TEXT,
+      modified_by_id TEXT,
+      is_deleted BOOLEAN NOT NULL DEFAULT false,
+      deleted_at TIMESTAMPTZ,
+      deleted_by_id TEXT,
+      roles TEXT NOT NULL DEFAULT '[]',
+      UNIQUE(user_id, tenant_id)
+    )
+  `);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO ${CONTACT_TABLE} (id, tenant_id, name) VALUES ($1, $2, $3)
+     ON CONFLICT (id) DO NOTHING`,
+    [CONTACT_1, author.tenantId, "Contact 1"],
+  );
+
+  overrideExecutor = createEventStoreExecutor(
+    tenantRetentionOverrideTable,
+    tenantRetentionOverrideEntity,
+    { entityName: "tenant-retention-override" },
+  );
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [
+    userTable,
+    "read_tenant_memberships",
+    tenantRetentionOverrideTable,
+  ]);
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+async function seedForgottenSubject(): Promise<void> {
+  await seedRow(stack.db, userTable, {
+    id: SUBJECT_S,
+    tenantId: author.tenantId,
+    email: "subject-s@example.com",
+    passwordHash: "hashed",
+    displayName: "Subject S",
+    locale: "de",
+    emailVerified: true,
+    roles: '["Member"]',
+    status: USER_STATUS.DeletionRequested,
+    gracePeriodEnd: pastInstant(),
+  });
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO read_tenant_memberships (tenant_id, user_id, roles)
+     VALUES ($1, $2, '["Member"]') ON CONFLICT (user_id, tenant_id) DO NOTHING`,
+    [author.tenantId, SUBJECT_S],
+  );
+}
+
+async function seedContactRetentionOverride(strategy: "anonymize" | "delete"): Promise<void> {
+  const by = { ...TestUsers.systemAdmin, tenantId: author.tenantId };
+  const result = await overrideExecutor.create(
+    {
+      entityName: "contact",
+      config: JSON.stringify({ keepFor: "1y", strategy }),
+      reason: "test",
+      tenantId: author.tenantId,
+    },
+    by,
+    createTenantDb(stack.db, author.tenantId, "system"),
+  );
+  if (!result.isSuccess)
+    throw new Error(`seedContactRetentionOverride failed: ${JSON.stringify(result)}`);
+}
+
+describe("notes-history mention-forget cascade", () => {
+  test("shreds only the note mentioning the forgotten subject, leaves the unmentioned note readable", async () => {
+    await seedForgottenSubject();
+    const tenantDb = createTenantDb(stack.db, author.tenantId, "system");
+
+    const mentioning = await stack.http.writeOk<{ id: string }>(
+      NotesHistoryHandlers.addNote,
+      { entityType: "contact", entityId: CONTACT_1, body: "about S", mentions: [SUBJECT_S] },
+      author,
+    );
+    const unrelated = await stack.http.writeOk<{ id: string }>(
+      NotesHistoryHandlers.addNote,
+      { entityType: "contact", entityId: CONTACT_1, body: "unrelated note" },
+      author,
+    );
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: getTemporal().Now.instant(),
+    });
+    expect(result.processedUserIds).toContain(SUBJECT_S);
+    expect(result.errors).toEqual([]);
+
+    const shredded = await noteEntryExecutor.detail({ id: mentioning.id }, author, tenantDb);
+    expect(shredded?.["body"]).toBe(PII_ERASED_SENTINEL);
+
+    const untouched = await noteEntryExecutor.detail({ id: unrelated.id }, author, tenantDb);
+    expect(untouched?.["body"]).toBe("unrelated note");
+  });
+
+  test("host entity retention override (anonymize) blocks the shred", async () => {
+    await seedForgottenSubject();
+    await seedContactRetentionOverride("anonymize");
+    const tenantDb = createTenantDb(stack.db, author.tenantId, "system");
+
+    const mentioning = await stack.http.writeOk<{ id: string }>(
+      NotesHistoryHandlers.addNote,
+      {
+        entityType: "contact",
+        entityId: CONTACT_1,
+        body: "kept under retention",
+        mentions: [SUBJECT_S],
+      },
+      author,
+    );
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: getTemporal().Now.instant(),
+    });
+    expect(result.processedUserIds).toContain(SUBJECT_S);
+
+    const stillReadable = await noteEntryExecutor.detail({ id: mentioning.id }, author, tenantDb);
+    expect(stillReadable?.["body"]).toBe("kept under retention");
+  });
+});

package/src/notes-history-user-data/hooks.ts

@@ -4,9 +4,12 @@
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
-import { noteEntryTable } from "../notes-history";
+import { resolveRetentionPolicyForTenant } from "../data-retention";
+import { noteEntryTable, noteMentionTable } from "../notes-history";
+import { policyToStrategy } from "../user-data-rights";
 
 // note-entry has no per-tenant scope quirk (unlike folders) — it's genuinely
 // per-user content, so the export filters by authorId directly.
@@ -27,19 +30,69 @@ export const noteEntryExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
-// Deliberate no-op: only `authorName` is annotated `personal: { of: "authorId" }`
-// (entity.ts) — `body` is deliberately plaintext (`personal: false`), since it
-// describes the HOST entity the note is attached to, not the author. So a
-// forget here crypto-shreds (mounted KMS) just `authorName`: after erasing
-// the author, who wrote a note is no longer visible, but the note's content
-// stays intact and readable — the note is about the host entity, and other
-// readers of that entity's history still need it. No physical delete is
-// needed for either outcome.
-// Same tradeoff as job-run/delivery-attempt (user-data-rights-defaults).
+// `authorName` is separately annotated `personal: { of: "authorId" }`
+// (entity.ts), so forgetting the AUTHOR already crypto-shreds that field on
+// its own — unrelated to this hook. `body` is Row-Subject (`personal: { of:
+// "id" }`): its key is per-note, not per-user, so forgetting a user only
+// reaches a note's body when that note structurally @-mentions the user via
+// a `note-mention` row (fw#2787). Free-text mentions are NOT detected —
+// that's the documented gap in entity.ts, not a bug here.
+//
+// Per reached note: consult the HOST entity's (entityType, not note-entry's
+// own) retention strategy first — blockDelete/anonymize must win over
+// erasure, same rule the automated forget-cleanup pipeline applies to every
+// other entity. The `strategy` this hook itself is called with is resolved
+// for note-entry, not the host, so it is deliberately unused here.
+//
 // Precondition: this ONLY erases anything if the app mounts a KMS adapter —
-// without one, userOwned fields fall back to plaintext storage framework-wide
-// (see pii-field-encryption.ts) and forget is a true no-op for `authorName`
-// too. That gap is a property of the framework's crypto-shredding design,
-// not specific to this hook; apps that need Art.17 coverage without KMS must
+// without one, record-owned fields fall back to plaintext storage
+// framework-wide (see pii-field-encryption.ts) and forget is a true no-op.
+// That gap is a property of the framework's crypto-shredding design, not
+// specific to this hook; apps that need Art.17 coverage without KMS must
 // mount one.
-export const noteEntryDeleteHook: UserDataDeleteHook = async () => {};
+export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
+  const kms = configuredPiiSubjectKms();
+  // skip: no KMS adapter mounted — record-owned fields stay plaintext framework-wide, forget is a true no-op
+  if (!kms) return;
+
+  const mentions = await selectMany<{ noteId: string }>(ctx.db, noteMentionTable, {
+    subjectId: ctx.userId,
+  });
+  // skip: no note-mention rows for this user — nothing structurally reaches this user's data to shred
+  if (mentions.length === 0) return;
+
+  const noteIds = new Set(mentions.map((m) => m.noteId));
+  for (const noteId of noteIds) {
+    const note = await fetchOne<{ entityType: string }>(ctx.db, noteEntryTable, { id: noteId });
+    // Defensive: append-only rows are never hard-deleted, so this shouldn't
+    // happen — but a missing host means no retention policy to consult.
+    if (!note) continue;
+
+    const hostPolicy = await resolveRetentionPolicyForTenant({
+      db: ctx.db,
+      registry: ctx.registry,
+      tenantId: ctx.tenantId,
+      entityName: note.entityType,
+    });
+    if (policyToStrategy(hostPolicy.policy?.strategy ?? null) === "anonymize") continue;
+
+    await kms.eraseKey(
+      { kind: "record", entity: "note-entry", id: noteId },
+      {
+        requestId: "notes-history-user-data:forget-mentioned-notes",
+        userId: ctx.userId,
+        eraseReason: "notes-history:mention-forget",
+      },
+    );
+  }
+};
+
+// note-mention rows are a plain (noteId, subjectId) pointer — like authorId
+// on note-entry, `subjectId`'s `personal: "ref"` annotation exists for the
+// GDPR-hook-coverage boot guard, not because the row itself holds separately
+// exportable content or needs its own physical erasure: forgetting the
+// mentioned user's data is already handled by noteEntryDeleteHook shredding
+// the mentioned NOTE's row-subject key above. Registered here only so the V3
+// boot guard (validateGdprPiiHookCoverage) sees a hook for "note-mention".
+export const noteMentionExportHook: UserDataExportHook = async () => null;
+export const noteMentionDeleteHook: UserDataDeleteHook = async () => {};

package/src/notes-history-user-data/index.ts

@@ -6,11 +6,16 @@
 // user-data-rights stack. Mirrors folders-user-data.
 
 import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
-import { noteEntryDeleteHook, noteEntryExportHook } from "./hooks";
+import {
+  noteEntryDeleteHook,
+  noteEntryExportHook,
+  noteMentionDeleteHook,
+  noteMentionExportHook,
+} from "./hooks";
 
 export const notesHistoryUserDataFeature = defineFeature("notes-history-user-data", (r) => {
   r.describe(
-    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` entity. Mounts the EXT_USER_DATA export hook so a user's authored notes are included in the user-data export bundle; the delete hook is a deliberate no-op because `body` is annotated `userOwned` on the entity — erasure runs via crypto-shredding (destroying the author's subject key) instead of a physical delete, keeping the append-only note history intact for entities other co-authors still read. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
+    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook looks up `note-mention` for notes that structurally @-mention the forgotten user and crypto-shreds each reached note's row-subject key (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for notes without such a mention. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
   );
   // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
   // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
@@ -22,4 +27,8 @@ export const notesHistoryUserDataFeature = defineFeature("notes-history-user-dat
     export: noteEntryExportHook,
     delete: noteEntryDeleteHook,
   });
+  r.useExtension(EXT_USER_DATA, "note-mention", {
+    export: noteMentionExportHook,
+    delete: noteMentionDeleteHook,
+  });
 });

package/src/personal-access-tokens/handlers/create.write.ts

@@ -87,6 +87,7 @@ export function createPatCreateHandler(opts: CreatePatOptions = {}) {
       const id = generateId();
       const row = await encryptForDirectWrite(
         apiTokenEntity,
+        "api-token",
         {
           id,
           userId: event.user.id,

package/src/personal-access-tokens/schema/api-token.ts

@@ -23,11 +23,15 @@ export const apiTokenEntity = createEntity({
       required: true,
       maxLength: 36,
       access: { write: access.privileged },
+      personal: false,
+      reason: "pseudonymous_fk",
     }),
     tenantId: createTextField({
       required: true,
       maxLength: 36,
       access: { write: access.privileged },
+      personal: false,
+      reason: "pseudonymous_fk",
     }),
     name: createTextField({
       required: true,
@@ -36,19 +40,43 @@ export const apiTokenEntity = createEntity({
       personal: { of: "userId" },
       find: "none",
     }),
+    // SHA-256 hash of the plaintext token — credential material, but kept
+    // Klasse 1 deliberately: resolver.ts point-reads this row with a raw
+    // exact-match `{ tokenHash: hashPatToken(rawToken) }` query on the hot
+    // auth path. A subject annotation here would make encryptForDirectWrite
+    // store ciphertext while the resolver keeps querying for the plaintext
+    // hash — every bearer-token request would 401 once a KMS is active.
+    // Fixing that needs a blind-index-backed lookup (like email's
+    // find:"exact" companion column), a resolver.ts rewrite out of scope
+    // here — see PR body "Offene Fragen".
     tokenHash: createTextField({
       required: true,
       maxLength: 64,
       access: { write: access.privileged },
+      personal: false,
+      reason: "credential_hash_used_as_exact_lookup_key_2809",
     }),
+    // Short displayable prefix ("your tokens" list) — not the secret itself,
+    // but still identifies which of the user's tokens this row is. Kept
+    // Klasse 1: list.query.ts returns `r.prefix` straight through with no
+    // decrypt call (unlike `name`, which goes through decryptStoredPii) — a
+    // subject annotation would leak ciphertext to the UI once a KMS is
+    // active. See PR body "Offene Fragen".
     prefix: createTextField({
       required: true,
       maxLength: 16,
       access: { write: access.privileged },
+      personal: false,
+      reason: "credential_prefix_read_without_decrypt_2809",
     }),
     // JSON-encoded string[] of granted scope names — mirrors the roles-column
     // convention (parseRoles-style text); the resolver JSON.parses it.
-    scopes: createTextField({ required: true, access: { write: access.privileged } }),
+    scopes: createTextField({
+      required: true,
+      access: { write: access.privileged },
+      personal: false,
+      reason: "technical_reference",
+    }),
     createdAt: createTimestampField({ required: true, access: { write: access.privileged } }),
     expiresAt: createTimestampField({ access: { write: access.privileged } }),
     revokedAt: createTimestampField({ access: { write: access.privileged } }),

package/src/secrets/table.ts

@@ -50,7 +50,7 @@ export const tenantSecretEntity = createEntity({
   description:
     "One encrypted secret per tenant and key, holding the sealed envelope, the key-encryption-key version it was sealed under and its last rotation time; plaintext values are never stored or returned.",
   fields: {
-    key: createTextField({ required: true }),
+    key: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     kekVersion: createNumberField({ required: true, integer: true }),
   },
 });

package/src/sessions/schema/user-session.ts

@@ -33,11 +33,15 @@ export const userSessionEntity = createEntity({
       required: true,
       maxLength: 36,
       access: { write: access.privileged },
+      personal: false,
+      reason: "pseudonymous_fk",
     }),
     tenantId: createTextField({
       required: true,
       maxLength: 36,
       access: { write: access.privileged },
+      personal: false,
+      reason: "pseudonymous_fk",
     }),
     createdAt: createTimestampField({
       required: true,

package/src/sessions/session-callbacks.ts

@@ -85,6 +85,7 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
         userSessionTable,
         await encryptForDirectWrite(
           userSessionEntity,
+          "user-session",
           {
             id: sid,
             tenantId: user.tenantId,

package/src/shared/encrypt-for-direct-write.ts

@@ -12,12 +12,18 @@ import type { EntityDefinition } from "@cosmicdrift/kumiko-framework/engine";
 // true } at the registration site (enforced by the registry, #820).
 export async function encryptForDirectWrite(
   entity: EntityDefinition,
+  entityName: string,
   row: Record<string, unknown>,
   fallbackRequestId: string,
 ): Promise<Record<string, unknown>> {
   const kms = configuredPiiSubjectKms();
   if (!kms) return row;
-  return encryptPiiFieldValues(row, entity, collectPiiSubjectFields(entity), kms, {
-    requestId: requestContext.get()?.requestId ?? fallbackRequestId,
-  });
+  return encryptPiiFieldValues(
+    row,
+    entity,
+    collectPiiSubjectFields(entity),
+    kms,
+    { requestId: requestContext.get()?.requestId ?? fallbackRequestId },
+    { entityName },
+  );
 }

package/src/tags/__tests__/tags-parent-visibility.integration.test.ts

@@ -47,8 +47,18 @@ const projectOwnership: NonNullable<EntityDefinition["access"]> = {
 const projectEntity = createEntity({
   table: PROJECT_TABLE,
   fields: {
-    teamId: createTextField({ required: true, maxLength: 64 }),
-    name: createTextField({ required: true, maxLength: 64 }),
+    teamId: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
   access: projectOwnership,
 });

package/src/tags/__tests__/tags.integration.test.ts

@@ -33,7 +33,14 @@ const tagsFeature = createTagsFeature();
 
 const CREDIT_TABLE = "tags_test_credits";
 const NOTE_TABLE = "tags_test_notes";
-const hostFields = { name: createTextField({ required: true, maxLength: 64 }) };
+const hostFields = {
+  name: createTextField({
+    required: true,
+    maxLength: 64,
+    personal: false,
+    reason: "technical_reference",
+  }),
+};
 const creditEntity = createEntity({ table: CREDIT_TABLE, fields: hostFields });
 const noteEntity = createEntity({ table: NOTE_TABLE, fields: hostFields });
 const hostFixturesFeature = defineFeature("tags-test-host-fixtures", (r) => {

package/src/tags/entity.ts

@@ -28,11 +28,11 @@ export const tagEntity = createEntity({
       reason: "catalog_label",
     }),
     // Optional UI hint (hex or token). No enforcement — purely for rendering.
-    color: createTextField({ maxLength: 32 }),
+    color: createTextField({ maxLength: 32, personal: false, reason: "technical_reference" }),
     // Optional entity-type scope (GitLab project-vs-group labels): empty = global
     // (offered on every entity); a value like "note" restricts the tag to that
     // entityType in the picker. No enforcement on assign — purely a picker hint.
-    scope: createTextField({ maxLength: 64 }),
+    scope: createTextField({ maxLength: 64, personal: false, reason: "technical_reference" }),
   },
 });
 
@@ -63,10 +63,25 @@ export function createTagAssignmentEntity(access?: EntityDefinition["access"]) {
     softDelete: true,
     access,
     fields: {
-      tagId: createTextField({ required: true, maxLength: 64 }),
-      entityType: createTextField({ required: true, maxLength: 64 }),
+      tagId: createTextField({
+        required: true,
+        maxLength: 64,
+        personal: false,
+        reason: "technical_reference",
+      }),
+      entityType: createTextField({
+        required: true,
+        maxLength: 64,
+        personal: false,
+        reason: "technical_reference",
+      }),
       // Host entity ids are uuid/text; 128 covers uuid plus non-uuid text keys.
-      entityId: createTextField({ required: true, maxLength: 128 }),
+      entityId: createTextField({
+        required: true,
+        maxLength: 128,
+        personal: false,
+        reason: "technical_reference",
+      }),
     },
   });
 }

package/src/template-resolver/table.ts

@@ -18,16 +18,17 @@ import { CONTENT_FORMATS, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES } f
 export const templateResourceEntity = createEntity({
   table: "read_template_resources",
   fields: {
-    slug: createTextField({ required: true }),
+    slug: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     kind: createSelectField({ required: true, options: [...TEMPLATE_KINDS] }),
-    locale: createTextField({ required: true }),
+    locale: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     // Human-facing heading for kind="text-block" (legal pages, marketing
     // copy). Nullable because render templates carry their subject inside
     // the body; a NOT NULL here would break every existing mail row.
-    title: createTextField({}),
+    // Same authorship class as `content` below.
+    title: createTextField({ personal: false, reason: "is_business_data" }),
     // Folder path for the content tree, `/`-separated ("page/marketing").
     // null = root node.
-    folder: createTextField({}),
+    folder: createTextField({ personal: false, reason: "technical_reference" }),
     // Template-body is authored by TenantAdmin/Operator (email-templates etc.),
     // business data — kein end-user UGC.
     content: createLongTextField({
@@ -35,10 +36,10 @@ export const templateResourceEntity = createEntity({
       reason: "is_business_data",
     }),
     contentFormat: createSelectField({ required: true, options: [...CONTENT_FORMATS] }),
-    variableSchema: createLongTextField({}),
-    linkedResources: createLongTextField({}),
+    variableSchema: createLongTextField({ personal: false, reason: "technical_reference" }),
+    linkedResources: createLongTextField({ personal: false, reason: "technical_reference" }),
     scope: createSelectField({ required: true, options: [...TEMPLATE_SCOPES] }),
-    parentTemplateId: createTextField({}),
+    parentTemplateId: createTextField({ personal: false, reason: "technical_reference" }),
     status: createSelectField({ required: true, options: [...TEMPLATE_STATUSES] }),
   },
   indexes: [

package/src/template-resolver/user-content-table.ts

@@ -25,11 +25,13 @@ export const userContentEntryEntity = createEntity({
   table: "read_user_content_entries",
   fields: {
     ownerId: createTextField({ required: true, personal: "ref" }),
-    slug: createTextField({ required: true }),
+    slug: createTextField({ required: true, personal: false, reason: "technical_reference" }),
     kind: createSelectField({ required: true, options: [...TEMPLATE_KINDS] }),
-    locale: createTextField({ required: true }),
-    title: createTextField({}),
-    folder: createTextField({}),
+    locale: createTextField({ required: true, personal: false, reason: "technical_reference" }),
+    // Organizational label for the entry (e.g. "Default signature"), not the
+    // owner's PII itself — that lives in `content` below.
+    title: createTextField({ personal: false, reason: "technical_reference" }),
+    folder: createTextField({ personal: false, reason: "technical_reference" }),
     content: createLongTextField({
       personal: { of: "ownerId" },
       find: "none",

package/src/tenant/invitation-table.ts

@@ -61,7 +61,12 @@ export const tenantInvitationEntity = createEntity({
     email: createTextField({ required: true, maxLength: 320, personal: "self", find: "exact" }),
     // Membership-Rolle die dem User nach Accept gegeben wird. Default
     // im handler ist "Admin" (Co-Admin-Pattern für kleine Teams).
-    role: createTextField({ required: true, maxLength: 50 }),
+    role: createTextField({
+      required: true,
+      maxLength: 50,
+      personal: false,
+      reason: "technical_reference",
+    }),
     // Lifecycle-State. Default "pending"; transitions:
     //   pending → accepted | cancelled | expired
     status: createSelectField({