@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -0,0 +1,148 @@
+// crypto-shredding forget-subject — end-to-end over real HTTP dispatch:
+//
+//   - DPO erases a user subject → DEK gone (getKey throws KeyErased),
+//     subject-forgotten audit event appended
+//   - tenant subjects shred the same way
+//   - repeat forget is a no-op erase but still audited
+//   - no KMS configured → 500 with actionable message
+//   - Member role → 403 (DPO/SystemAdmin only)
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { setupTestStack, type TestStack, testTenantId } from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
+import { createCryptoShreddingFeature } from "../feature";
+
+const FORGET = "crypto-shredding:write:forget-subject";
+
+let stack: TestStack;
+let kms: InMemoryKmsAdapter;
+
+const TENANT: TenantId = testTenantId(1);
+const TARGET_USER_ID = "aaaaaaaa-aaaa-4aaa-8aaa-000000000001";
+const TARGET_TENANT_ID = "aaaaaaaa-aaaa-4aaa-8aaa-0000000000a1";
+const REASON = "authority request #42 (Art. 17)";
+
+const dpoUser = {
+  id: "aaaaaaaa-aaaa-4aaa-8aaa-0000000000d1",
+  tenantId: TENANT,
+  roles: ["DataProtectionOfficer"],
+};
+
+const memberUser = {
+  id: "aaaaaaaa-aaaa-4aaa-8aaa-0000000000e1",
+  tenantId: TENANT,
+  roles: ["Member"],
+};
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [createCryptoShreddingFeature()] });
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [eventsTable]);
+  kms = new InMemoryKmsAdapter();
+  configurePiiSubjectKms(kms);
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+async function forgottenEvents(): Promise<Array<{ payload: Record<string, unknown> }>> {
+  return (await selectMany(stack.db, eventsTable, {
+    type: SUBJECT_FORGOTTEN_EVENT_NAME,
+  })) as Array<{ payload: Record<string, unknown> }>;
+}
+
+describe("crypto-shredding :: forget-subject", () => {
+  test("DPO forgets a user subject → key erased + audit event", async () => {
+    const subject = { kind: "user", userId: TARGET_USER_ID } as const;
+    await kms.createKey(subject);
+
+    const result = await stack.http.writeOk<{ subjectKey: string }>(
+      FORGET,
+      { subject, reason: REASON },
+      dpoUser,
+    );
+    expect(result.subjectKey).toBe(`user:${TARGET_USER_ID}`);
+
+    await expect(kms.getKey(subject)).rejects.toThrow("Subject key erased");
+
+    const events = await forgottenEvents();
+    expect(events).toHaveLength(1);
+    expect(events[0]?.payload).toMatchObject({
+      subjectKey: `user:${TARGET_USER_ID}`,
+      reason: REASON,
+      forgottenBy: dpoUser.id,
+    });
+  });
+
+  test("tenant subject shreds the same way", async () => {
+    const subject = { kind: "tenant", tenantId: TARGET_TENANT_ID } as const;
+    await kms.createKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId });
+
+    const result = await stack.http.writeOk<{ subjectKey: string }>(
+      FORGET,
+      { subject, reason: REASON },
+      dpoUser,
+    );
+    expect(result.subjectKey).toBe(`tenant:${TARGET_TENANT_ID}`);
+
+    await expect(
+      kms.getKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId }),
+    ).rejects.toThrow("Subject key erased");
+  });
+
+  test("repeat forget: erase is a no-op but each attempt is audited", async () => {
+    const subject = { kind: "user", userId: TARGET_USER_ID } as const;
+    await kms.createKey(subject);
+
+    await stack.http.writeOk(FORGET, { subject, reason: REASON }, dpoUser);
+    await stack.http.writeOk(FORGET, { subject, reason: `${REASON} (repeat)` }, dpoUser);
+
+    expect(await forgottenEvents()).toHaveLength(2);
+  });
+
+  test("no KMS configured → 500 with boot hint", async () => {
+    resetPiiSubjectKmsForTests();
+
+    const err = await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId: TARGET_USER_ID }, reason: REASON },
+      dpoUser,
+    );
+    expect(err.httpStatus).toBe(500);
+  });
+
+  test("Member role → 403", async () => {
+    const err = await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId: TARGET_USER_ID }, reason: REASON },
+      memberUser,
+    );
+    expect(err.httpStatus).toBe(403);
+  });
+
+  test("reason shorter than 10 chars → schema reject", async () => {
+    const err = await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId: TARGET_USER_ID }, reason: "short" },
+      dpoUser,
+    );
+    expect(err.httpStatus).toBe(400);
+  });
+});

package/src/crypto-shredding/constants.ts

@@ -0,0 +1,5 @@
+export const CRYPTO_SHREDDING_FEATURE_NAME = "crypto-shredding";
+
+export const SUBJECT_FORGOTTEN_EVENT_NAME = "crypto-shredding:event:subject-forgotten";
+
+export const CRYPTO_SHREDDING_AGGREGATE_TYPE = "crypto-shredding-subject";

package/src/crypto-shredding/feature.ts

@@ -0,0 +1,18 @@
+import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { CRYPTO_SHREDDING_FEATURE_NAME } from "./constants";
+import { forgetSubjectWrite, subjectForgottenSchema } from "./handlers/forget-subject.write";
+
+export function createCryptoShreddingFeature(): FeatureDefinition {
+  return defineFeature(CRYPTO_SHREDDING_FEATURE_NAME, (r) => {
+    r.describe(
+      "Operator-level crypto-shredding trigger. `forget-subject` erases a user or tenant subject key in the configured KMS adapter, making every PII field encrypted under it permanently unreadable (reads render the `[[erased]]` sentinel), and appends a `subject-forgotten` audit event. Requires a KMS adapter (`runProdApp({ kms })`). The automated Art.-17 deletion pipeline in `user-data-rights` erases keys itself; this command covers manual forgets (authority requests, operator recovery, tenant destroy).",
+    );
+    r.uiHints({
+      displayLabel: "Crypto-Shredding",
+      category: "compliance",
+    });
+
+    r.defineEvent("subject-forgotten", subjectForgottenSchema);
+    r.writeHandler(forgetSubjectWrite);
+  });
+}

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -0,0 +1,91 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
+import {
+  configuredPiiSubjectKms,
+  type SubjectId,
+  subjectIdToKey,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import { nullBlindIndexesForSubject } from "@cosmicdrift/kumiko-framework/db";
+import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { z } from "zod";
+import { CRYPTO_SHREDDING_AGGREGATE_TYPE, SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
+
+export const subjectIdSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("user"), userId: z.uuid() }),
+  z.object({ kind: z.literal("tenant"), tenantId: z.uuid() }),
+]);
+
+export const forgetSubjectSchema = z.object({
+  subject: subjectIdSchema,
+  reason: z.string().min(10),
+});
+
+export const subjectForgottenSchema = z.object({
+  subjectKey: z.string().min(1),
+  reason: z.string().min(10),
+  forgottenBy: z.string().min(1),
+});
+
+// Manual crypto-shred for a DPO / platform operator: erases the subject's
+// DEK immediately (all its PII ciphertext becomes unreadable, reads render
+// "[[erased]]") and appends the audit event. Forget is final — the adapter
+// keeps a tombstone, so the subject can never get a new key.
+//
+// The automated Art.-17 path (user-data-rights forget-cleanup) calls
+// kms.eraseKey directly inside its per-user sub-tx; this command is the
+// standalone trigger for cases outside that pipeline (authority requests,
+// tenant-destroy in Sprint 5, operator recovery).
+export const forgetSubjectWrite = defineWriteHandler({
+  name: "forget-subject",
+  schema: forgetSubjectSchema,
+  access: { roles: [ROLES.DataProtectionOfficer, ROLES.SystemAdmin] },
+  handler: async (event, ctx) => {
+    const kms = configuredPiiSubjectKms();
+    if (!kms) {
+      return writeFailure(
+        new InternalError({
+          message:
+            "[crypto-shredding] forget-subject called but no KMS adapter is configured — " +
+            "pass runProdApp({ kms }) / configurePiiSubjectKms(adapter) at boot.",
+        }),
+      );
+    }
+
+    const raw = event.payload.subject;
+    const subject: SubjectId =
+      raw.kind === "user"
+        ? { kind: "user", userId: raw.userId }
+        : { kind: "tenant", tenantId: raw.tenantId as TenantId }; // @cast-boundary uuid-validated command payload → branded id
+    const subjectKey = subjectIdToKey(subject);
+
+    // Erase BEFORE the audit append: if the append throws, the key is gone
+    // but no event exists — a retry is a no-op erase plus the event. The
+    // reverse order could leave an audit trail claiming a shred that never
+    // happened.
+    await kms.eraseKey(subject, {
+      requestId: requestContext.get()?.requestId ?? "crypto-shredding:forget-subject",
+      userId: event.user.id,
+      eraseReason: event.payload.reason,
+    });
+
+    // Blind-Index-Sweep (#818): bidx-Spalten des erased Subjects sofort
+    // nullen — sonst bliebe der deterministische HMAC bis zum nächsten
+    // Rebuild equality-matchbar. Bewusst ctx.db.raw: der Ciphertext-Prefix
+    // adressiert das Subject tenant-übergreifend.
+    await nullBlindIndexesForSubject(ctx.db.raw, ctx.registry.features, subjectKey);
+
+    await ctx.unsafeAppendEvent({
+      aggregateId: raw.kind === "user" ? raw.userId : raw.tenantId,
+      aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
+      type: SUBJECT_FORGOTTEN_EVENT_NAME,
+      payload: {
+        subjectKey,
+        reason: event.payload.reason,
+        forgottenBy: event.user.id,
+      },
+    });
+
+    return { isSuccess: true as const, data: { subjectKey } };
+  },
+});

package/src/crypto-shredding/index.ts

@@ -0,0 +1,11 @@
+export {
+  CRYPTO_SHREDDING_AGGREGATE_TYPE,
+  CRYPTO_SHREDDING_FEATURE_NAME,
+  SUBJECT_FORGOTTEN_EVENT_NAME,
+} from "./constants";
+export { createCryptoShreddingFeature } from "./feature";
+export {
+  forgetSubjectSchema,
+  subjectForgottenSchema,
+  subjectIdSchema,
+} from "./handlers/forget-subject.write";

package/src/custom-fields/__tests__/audit-integration.integration.test.ts

@@ -127,7 +127,7 @@ describe("T1.5a: custom-fields events are visible in the audit log", () => {
 
     const res = await listAudit({ aggregateType: "field-definition" });
 
-    // The fieldDefinition is created via r.entity + r.crud, so the event-type
+    // The fieldDefinition is created via registerEntityCrud, so the event-type
     // follows the entity-CRUD convention `<entity>.created` (with a dot),
     // not the feature-emit-via-defineEvent convention used by set/cleared
     // (`custom-fields:event:<short>`).

package/src/custom-fields/__tests__/custom-fields.integration.test.ts

@@ -22,6 +22,10 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createProjectionStateTable,
+  rebuildProjection,
+} from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   createTestUser,
   setupTestStack,
@@ -84,6 +88,7 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, fieldDefinitionEntity);
   await unsafeCreateEntityTable(stack.db, propertyEntity);
   await createEventsTable(stack.db);
+  await createProjectionStateTable(stack.db);
 });
 
 afterAll(async () => {
@@ -430,9 +435,9 @@ describe("custom-fields integration — define resurrection (B1)", () => {
   });
 });
 
-describe("custom-fields integration — sensitive value self-projected, kept out of the event log (#2)", () => {
-  test("sensitive field: value reaches the projection but NOT kumiko_events", async () => {
-    await stack.http.writeOk(
+describe("custom-fields integration — no PII: `sensitive` rejected, every value in the log (#972)", () => {
+  test("define-tenant-field with `sensitive` is rejected at the schema boundary", async () => {
+    const err = await stack.http.writeErr(
       "custom-fields:write:define-tenant-field",
       {
         entityName: "property",
@@ -444,23 +449,14 @@ describe("custom-fields integration — sensitive value self-projected, kept out
       },
       admin,
     );
-    const propId = "aaaaaaaa-aaaa-4000-8000-0000000000a1";
-    await createProperty(propId, "Sensitive Prop");
-    await setCustomField("property", propId, "taxId", "DE-TAX-999");
-
-    // Read model HAS the value — self-projected directly into the host row.
-    const props = await listProperties();
-    const row = props.rows.find((r) => r["id"] === propId);
-    expect(row?.["taxId"]).toBe("DE-TAX-999");
-
-    // The immutable event log does NOT carry the value (erasable by design).
-    const payload = await fetchSetEventPayload(propId, "taxId");
-    expect(payload).toBeDefined();
-    expect(payload?.["fieldKey"]).toBe("taxId");
-    expect(payload && "value" in payload).toBe(false);
+    expect(err.httpStatus).toBe(400);
+    expect(err.code).toBe("validation_error");
+    // The API sanitises zod messages to i18n keys — the reject surfaces as a
+    // custom validation issue on the serializedField path.
+    expect(JSON.stringify(err.details)).toContain('"serializedField"');
   });
 
-  test("non-sensitive field: value IS in the event log (control)", async () => {
+  test("every set carries its value in the event log", async () => {
     const propId = "aaaaaaaa-aaaa-4000-8000-0000000000a2";
     await defineField("property", "publicNote", "text");
     await createProperty(propId, "Public Prop");
@@ -470,24 +466,13 @@ describe("custom-fields integration — sensitive value self-projected, kept out
     expect(payload?.["value"]).toBe("visible");
   });
 
-  test("rebuild replay: re-applying logged events restores non-sensitive, not sensitive", async () => {
+  test("rebuild replay: re-applying logged events restores ALL custom-field values", async () => {
     await defineField("property", "publicTag", "text");
-    await stack.http.writeOk(
-      "custom-fields:write:define-tenant-field",
-      {
-        entityName: "property",
-        fieldKey: "secret",
-        serializedField: { type: "text", sensitive: true },
-        required: false,
-        searchable: false,
-        displayOrder: 0,
-      },
-      admin,
-    );
+    await defineField("property", "vendorRef", "text");
     const propId = "aaaaaaaa-aaaa-4000-8000-0000000000a3";
     await createProperty(propId, "Rebuild Prop");
     await setCustomField("property", propId, "publicTag", "keepme");
-    await setCustomField("property", propId, "secret", "DE-TAX-777");
+    await setCustomField("property", propId, "vendorRef", "VR-777");
     await stack.eventDispatcher?.runOnce();
 
     // Wipe the read model, then replay the logged events through the REAL MSP
@@ -526,30 +511,24 @@ describe("custom-fields integration — sensitive value self-projected, kept out
     }
 
     const row = (await listProperties()).rows.find((r) => r["id"] === propId);
-    // Non-sensitive: restored from its value-bearing event.
+    // Every value restores from its value-bearing event — custom fields are
+    // fully rebuild-safe since #972 (no PII, no value-less events).
     expect(row?.["publicTag"]).toBe("keepme");
-    // Sensitive: the logged event carried no value → gone. The accepted, DURABLE
-    // rebuild-loss — and why a forget can't be undone by a rebuild.
-    expect(row?.["secret"]).toBeUndefined();
+    expect(row?.["vendorRef"]).toBe("VR-777");
   });
+});
 
-  test("update-tenant-field rejects flipping `sensitive` (would orphan logged PII)", async () => {
-    await defineField("property", "maybePii", "text"); // non-sensitive at definition
-    const err = await stack.http.writeErr(
-      "custom-fields:write:update-tenant-field",
-      {
-        entityName: "property",
-        fieldKey: "maybePii",
-        serializedField: { type: "text", sensitive: true }, // attempt the flip
-        required: false,
-        searchable: false,
-        displayOrder: 0,
-      },
-      admin,
-    );
-    expect(err.httpStatus).toBe(422);
-    expect(err.code).toBe("unprocessable");
-    expect(err.details).toMatchObject({ reason: "field_sensitive_immutable" });
+describe("custom-fields integration — registry facade: getMultiStreamProjectionFeature", () => {
+  test("resolves the owning feature name for a registered multi-stream projection", () => {
+    const qualifiedName = "property-test:projection:custom-fields-property-projection";
+
+    expect(stack.registry.getAllMultiStreamProjections().has(qualifiedName)).toBe(true);
+    expect(stack.registry.getMultiStreamProjectionFeature(qualifiedName)).toBe("property-test");
+    // Missing MSP → undefined (not a fallback string). server.ts only spreads
+    // featureName onto the EventConsumer when this returns a defined value.
+    expect(
+      stack.registry.getMultiStreamProjectionFeature("does-not-exist:projection:nope"),
+    ).toBeUndefined();
   });
 });
 
@@ -919,3 +898,63 @@ describe("custom-fields integration — update-tenant-field (Bug-Bash D2)", () =
     expect(causeMessage).toContain("update-tenant-field");
   });
 });
+
+describe("custom-fields integration — official host-entity rebuild (#759)", () => {
+  test("rebuildProjection replays customField.set/cleared + fieldDefinition.deleted", async () => {
+    await defineField("property", "color", "text");
+    await defineField("property", "doomed", "text");
+    const propId = "dddddddd-dddd-4000-8000-00000000000d";
+    await createProperty(propId, "RebuildOfficial");
+    await setCustomField("property", propId, "color", "blue");
+    await setCustomField("property", propId, "doomed", "bye");
+    // fieldDef-delete cascade removes the key — the rebuild must preserve the
+    // removal (fieldDefinition.deleted rides the extra "field-definition" source).
+    await stack.http.writeOk(
+      "custom-fields:write:delete-tenant-field",
+      { entityName: "property", fieldKey: "doomed" },
+      admin,
+    );
+    await stack.eventDispatcher?.runOnce();
+
+    let row = (await listProperties()).rows.find((r) => r["id"] === propId);
+    expect(row?.["color"]).toBe("blue");
+    expect(row?.["doomed"]).toBeUndefined();
+
+    // The routine schema-migration path: full official rebuild of the host
+    // entity's implicit projection. Pre-#759 this reset every custom_fields
+    // jsonb to its default '{}' with no recovery path.
+    const result = await rebuildProjection("property-test:projection:property-entity", {
+      db: stack.db,
+      registry: stack.registry,
+    });
+    expect(result.eventsProcessed).toBeGreaterThan(0);
+
+    row = (await listProperties()).rows.find((r) => r["id"] === propId);
+    expect(row?.["name"]).toBe("RebuildOfficial");
+    expect(row?.["color"]).toBe("blue");
+    expect(row?.["doomed"]).toBeUndefined();
+  });
+
+  test("clear-custom-field removal survives the official rebuild", async () => {
+    await defineField("property", "flag", "text");
+    await defineField("property", "keep", "text");
+    const propId = "eeeeeeee-eeee-4000-8000-00000000000e";
+    await createProperty(propId, "ClearSurvives");
+    await setCustomField("property", propId, "flag", "on");
+    await setCustomField("property", propId, "keep", "yes");
+    await clearCustomField("property", propId, "flag");
+    await stack.eventDispatcher?.runOnce();
+
+    await rebuildProjection("property-test:projection:property-entity", {
+      db: stack.db,
+      registry: stack.registry,
+    });
+
+    const row = (await listProperties()).rows.find((r) => r["id"] === propId);
+    // Kontrollfeld beweist dass der Rebuild die set-Events real replayt hat —
+    // ein leeres {} wuerde "flag undefined" trivial erfuellen.
+    expect(row?.["keep"]).toBe("yes");
+    expect(row?.["flag"]).toBeUndefined();
+    expect(row?.["name"]).toBe("ClearSurvives");
+  });
+});

package/src/custom-fields/__tests__/field-access.integration.test.ts

@@ -324,4 +324,29 @@ describe("fail-closed on corrupt serialized_field", () => {
       fieldKey: "corruptField",
     });
   });
+
+  test("set: legacy `sensitive`-key definition (#972) → unprocessable field_definition_corrupt, not a 500", async () => {
+    const propertyId = "99999999-9999-4000-8000-000000000009";
+    await defineField("legacyPii", { type: "text" });
+    await asRawClient(stack.db).unsafe(
+      `UPDATE read_custom_field_definitions SET serialized_field = '{"type":"text","sensitive":true}' WHERE field_key = 'legacyPii'`,
+    );
+    await stack.http.writeOk(
+      "property-t15b:write:property:create",
+      { id: propertyId, name: "LegacySensitive" },
+      tenantAdmin,
+    );
+
+    const err = await stack.http.writeErr(
+      "custom-fields:write:set-custom-field",
+      { entityName: "property", entityId: propertyId, fieldKey: "legacyPii", value: "X-42" },
+      tenantAdmin,
+    );
+
+    expect(err.code).toBe("unprocessable");
+    expect(err.details).toMatchObject({
+      reason: "field_definition_corrupt",
+      fieldKey: "legacyPii",
+    });
+  });
 });

package/src/custom-fields/__tests__/parse-serialized-field.test.ts

@@ -3,8 +3,16 @@ import { isFieldDefinitionRow, parseSerializedField } from "../lib/parse-seriali
 
 describe("parseSerializedField", () => {
   test("parses a valid JSON string into the typed shape", () => {
-    const parsed = parseSerializedField('{"type":"text","sensitive":true}');
-    expect(parsed).toEqual({ type: "text", sensitive: true });
+    const parsed = parseSerializedField(
+      '{"type":"text","retention":{"keepFor":"30d","strategy":"delete"}}',
+    );
+    expect(parsed).toEqual({ type: "text", retention: { keepFor: "30d", strategy: "delete" } });
+  });
+
+  test("throws on a stored definition with the removed `sensitive` key (#972)", () => {
+    expect(() => parseSerializedField('{"type":"text","sensitive":true}')).toThrow(
+      /custom fields don't support PII/,
+    );
   });
 
   test("accepts an already-parsed object (jsonb-tolerant driver path)", () => {
@@ -17,7 +25,7 @@ describe("parseSerializedField", () => {
   });
 
   test("returns null when the shape lacks a string type", () => {
-    expect(parseSerializedField('{"sensitive":true}')).toBeNull();
+    expect(parseSerializedField('{"fieldAccess":{}}')).toBeNull();
     expect(parseSerializedField({ type: 42 })).toBeNull();
   });
 

package/src/custom-fields/__tests__/retention.integration.test.ts

@@ -337,4 +337,44 @@ describe("T1.5d: per-field retention sweep", () => {
     expect(cf).not.toHaveProperty("temp");
     expect(cf["liveEdit"]).toBe("written-mid-sweep");
   });
+
+  test("#975: a legacy field with the removed `sensitive` key is skipped, not fatal to the sweep", async () => {
+    const propertyId = "88888888-8888-4000-8000-000000000008";
+    await defineField("temp", {
+      type: "text",
+      retention: { keepFor: "30d", strategy: "delete" },
+    });
+    // Pre-#972 legacy definition — parseSerializedField throws on `sensitive`.
+    // Simulate a pre-#972 legacy definition: define normally (valid shape),
+    // then rewrite the stored column directly — write-time validation would
+    // reject `sensitive` today, but legacy rows written before #972 exist.
+    await defineField("legacyPii", { type: "text" });
+    await asRawClient(stack.db).unsafe(
+      `UPDATE read_custom_field_definitions SET serialized_field = '{"type":"text","sensitive":true}' WHERE field_key = 'legacyPii' AND entity_name = 'property'`,
+    );
+    await createProperty(propertyId, "LegacyMix");
+    await setField(propertyId, "temp", "expired-value");
+    // setField would now be denied (fail-closed on the corrupt/legacy
+    // definition) — write the value directly to simulate data that was
+    // already stored before #972 removed `sensitive` support.
+    await asRawClient(stack.db).unsafe(
+      `UPDATE read_t15d_properties SET custom_fields = custom_fields || '{"legacyPii":"untouched-value"}'::jsonb WHERE id = $1`,
+      [propertyId],
+    );
+    await stack.eventDispatcher?.runOnce();
+    await backdateRow(propertyId, "2026-04-22T10:00:00Z");
+
+    const report = await runCustomFieldsRetention({
+      db: stack.db,
+      tenantId: admin.tenantId,
+      entityName: "property",
+      entityTable: propertyTable,
+      now: NOW,
+    });
+
+    expect(report.rowsUpdated).toBe(1);
+    const cf = (await readRow(propertyId))?.["custom_fields"] as Record<string, unknown>;
+    expect(cf).not.toHaveProperty("temp");
+    expect(cf["legacyPii"]).toBe("untouched-value");
+  });
 });