@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/custom-fields/__tests__/user-data-rights.integration.test.ts

@@ -2,26 +2,19 @@
 // REAL export/forget runners (runUserExport / runForgetCleanup), not by
 // calling the registered hooks in isolation.
 //
-// What the real runners prove that direct hook calls cannot:
+// Since #972 the wiring is EXPORT-ONLY: custom fields carry supplemental
+// business data, not PII — runForgetCleanup has nothing to redact in the
+// customFields jsonb. The tests prove:
 //
-//   * runUserExport actually picks up the custom-fields export hook from the
-//     registry and folds its snippet into the user's cross-tenant bundle.
+//   * runUserExport picks up the custom-fields export hook from the registry
+//     and folds its snippet into the user's cross-tenant bundle (Art. 20).
 //
-//   * runForgetCleanup fires BOTH the host EXT_USER_DATA hook (owner-nulling
-//     anonymize) AND the custom-fields strip hook, in the order their declared
-//     `order` demands. The strip declares order -100 so it redacts sensitive
-//     jsonb keyed on `inserted_by_id` BEFORE the host hook nulls that column.
-//     If the ordering regressed, the host hook would null inserted_by_id first,
-//     the strip's `WHERE inserted_by_id = userId` would match 0 rows, and
-//     sensitive PII would silently survive (Art. 17 violation). Calling the
-//     hooks by hand never exercised this interaction.
-//
-//   * The anonymize-vs-delete strategy comes from the data-retention policy:
-//     no override → strategy "delete" (custom-fields strip is a no-op, host
-//     deletes the row); per-tenant anonymize override → strategy "anonymize"
-//     (strip runs, host nulls the owner).
+//   * runForgetCleanup leaves customFields untouched on anonymize (only the
+//     host hook nulls the owner) and lets the host delete-hook remove whole
+//     rows on strategy "delete".
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   buildEntityTable,
@@ -76,9 +69,8 @@ const propertyEntity = createEntity({
 const propertyTable = buildEntityTable("property", propertyEntity);
 
 // Host entity gets its own EXT_USER_DATA-registration too — that's the
-// canonical setup. The host's anonymize hook NULLS inserted_by_id (default
-// order 0); the custom-fields strip (order -100) must run first. Both fire in
-// the same runForgetCleanup sub-transaction.
+// canonical setup. The host's anonymize hook NULLS inserted_by_id; the
+// custom-fields wiring contributes export only (#972).
 const hostExportHook: UserDataExportHook = async (ctx) => {
   const rows = await asRawClient(ctx.db).unsafe(
     `SELECT id, name FROM read_t15c_properties WHERE inserted_by_id = $1 AND tenant_id = $2`,
@@ -99,9 +91,7 @@ const hostDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
       [ctx.userId, ctx.tenantId],
     );
   } else {
-    // anonymize: clear owner, keep row + non-sensitive customFields. Runs AFTER
-    // the custom-fields strip (order -100 < 0) — if it ran first, the strip's
-    // owner-keyed WHERE would match nothing.
+    // anonymize: clear owner, keep row + customFields.
     await asRawClient(ctx.db).unsafe(
       `UPDATE read_t15c_properties SET inserted_by_id = NULL WHERE inserted_by_id = $1 AND tenant_id = $2`,
       [ctx.userId, ctx.tenantId],
@@ -148,6 +138,7 @@ beforeAll(async () => {
   stack = await setupTestStack({
     features: [
       createUserFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
@@ -304,10 +295,10 @@ describe("T1.5c: custom-fields user-data-rights through the real runners", () =>
   test("export: customFields jsonb lands in the user's export bundle", async () => {
     await seedActiveUserWithMembership();
     const propertyId = "11111111-1111-4000-8000-000000000001";
-    await defineField("email", { type: "text", sensitive: true });
+    await defineField("contactRef", { type: "text" });
     await defineField("vipFlag", { type: "boolean" });
     await createProperty(propertyId, "Hofgarten 12");
-    await setField(propertyId, "email", "alice@example.com");
+    await setField(propertyId, "contactRef", "crm-4711");
     await setField(propertyId, "vipFlag", true);
     await stack.eventDispatcher?.runOnce();
 
@@ -324,19 +315,19 @@ describe("T1.5c: custom-fields user-data-rights through the real runners", () =>
     expect(cfSnippet).toBeDefined();
     expect(cfSnippet?.rows).toHaveLength(1);
     expect(cfSnippet?.rows[0]?.["customFields"]).toMatchObject({
-      email: "alice@example.com",
+      contactRef: "crm-4711",
       vipFlag: true,
     });
   });
 
-  test("forget anonymize: strip runs BEFORE host owner-nulling → sensitive key gone, non-sensitive kept", async () => {
+  test("forget anonymize: customFields stay fully intact (export-only wiring, #972)", async () => {
     await seedForgetUserWithMembership();
     await seedPropertyAnonymizeOverride();
     const propertyId = "22222222-2222-4000-8000-000000000002";
-    await defineField("email", { type: "text", sensitive: true });
+    await defineField("contactRef", { type: "text" });
     await defineField("vipFlag", { type: "boolean" });
     await createProperty(propertyId, "Anonymize-Me");
-    await setField(propertyId, "email", "alice@example.com");
+    await setField(propertyId, "contactRef", "crm-4711");
     await setField(propertyId, "vipFlag", true);
     await stack.eventDispatcher?.runOnce();
 
@@ -349,39 +340,19 @@ describe("T1.5c: custom-fields user-data-rights through the real runners", () =>
     expect(result.errors).toHaveLength(0);
 
     const row = await readRow(propertyId);
-    // Host hook ran (owner nulled), and the strip ran BEFORE it (sensitive
-    // key removed despite the owner-keyed WHERE — proof of the -100 ordering).
+    // Host hook ran (owner nulled); custom fields hold business data, not
+    // PII — nothing was stripped.
     expect(row?.["inserted_by_id"]).toBeNull();
-    const customFields = row?.["custom_fields"] as Record<string, unknown> | undefined;
-    expect(customFields).toBeDefined();
-    expect(customFields).not.toHaveProperty("email");
-    expect(customFields).toMatchObject({ vipFlag: true });
-
-    // The other half of erasure: the sensitive value was self-projected and the
-    // customField.set event was persisted value-less — so PII never entered the
-    // immutable log. Without this, the strip above would be undone by a rebuild.
-    const eventRows = await asRawClient(stack.db).unsafe(
-      "SELECT payload FROM kumiko_events WHERE aggregate_id = $1",
-      [propertyId],
-    );
-    const setPayloads = (eventRows as ReadonlyArray<{ payload: unknown }>).map((r) =>
-      typeof r.payload === "string" ? JSON.parse(r.payload) : r.payload,
-    ) as Array<Record<string, unknown>>;
-    const emailSet = setPayloads.find((p) => p?.["fieldKey"] === "email");
-    expect(emailSet).toBeDefined();
-    expect(emailSet && "value" in emailSet).toBe(false);
-    // Control: the non-sensitive value DID go through the log (normal path).
-    const vipSet = setPayloads.find((p) => p?.["fieldKey"] === "vipFlag");
-    expect(vipSet?.["value"]).toBe(true);
+    expect(row?.["custom_fields"]).toMatchObject({ contactRef: "crm-4711", vipFlag: true });
   });
 
-  test("forget delete (no override → strategy delete): host removes the row, strip is a no-op", async () => {
+  test("forget delete (no override → strategy delete): host removes the row", async () => {
     await seedForgetUserWithMembership();
     // No retention override → policyToStrategy(null) = "delete".
     const propertyId = "33333333-3333-4000-8000-000000000003";
-    await defineField("email", { type: "text", sensitive: true });
+    await defineField("contactRef", { type: "text" });
     await createProperty(propertyId, "Delete-Me");
-    await setField(propertyId, "email", "alice@example.com");
+    await setField(propertyId, "contactRef", "crm-4711");
     await stack.eventDispatcher?.runOnce();
 
     const result = await runForgetCleanup({
@@ -391,8 +362,7 @@ describe("T1.5c: custom-fields user-data-rights through the real runners", () =>
     });
     expect(result.processedUserIds).toContain(admin.id);
 
-    // Host delete-hook removed the row; custom-fields strip stayed out of the
-    // way (it returns early on strategy=delete).
+    // Host delete-hook removed the row wholesale — customFields go with it.
     expect(await readRow(propertyId)).toBeUndefined();
   });
 
@@ -413,27 +383,4 @@ describe("T1.5c: custom-fields user-data-rights through the real runners", () =>
     const cfSnippet = tenantSection?.entities.find((e) => e.entity === "property.customFields");
     expect(cfSnippet).toBeUndefined();
   });
-
-  test("forget anonymize without sensitive fields defined → all customFields kept", async () => {
-    await seedForgetUserWithMembership();
-    await seedPropertyAnonymizeOverride();
-    const propertyId = "55555555-5555-4000-8000-000000000005";
-    await defineField("nonSensitive", { type: "text" });
-    await createProperty(propertyId, "AllStay");
-    await setField(propertyId, "nonSensitive", "still-here");
-    await stack.eventDispatcher?.runOnce();
-
-    const result = await runForgetCleanup({
-      db: stack.db,
-      registry: stack.registry,
-      now: NOW(),
-    });
-    expect(result.processedUserIds).toContain(admin.id);
-
-    const row = await readRow(propertyId);
-    expect(row?.["inserted_by_id"]).toBeNull();
-    expect((row?.["custom_fields"] as Record<string, unknown>)?.["nonSensitive"]).toBe(
-      "still-here",
-    );
-  });
 });

package/src/custom-fields/constants.ts

@@ -31,6 +31,7 @@ export const CUSTOM_FIELDS_FORM_EXTENSION_NAME = "CustomFieldsFormSection";
 // Entity-CRUD auto-events for the `field-definition` entity. registry.ts emits
 // these as `${entityName}.created`/`.updated` (dot form) — they do NOT run
 // through r.defineEvent/toKebab, so the dot MUST stay.
+export const FIELD_DEFINITION_AGGREGATE_TYPE = "field-definition";
 export const FIELD_DEFINITION_CREATED_EVENT = "field-definition.created";
 export const FIELD_DEFINITION_UPDATED_EVENT = "field-definition.updated";
 // Qualified at registration via r.defineEvent — final name is

package/src/custom-fields/db/queries/user-data-rights.ts

@@ -25,26 +25,6 @@ export async function selectCustomFieldsHostRows(
   return Array.isArray(rowsResult) ? rowsResult : [];
 }
 
-export async function stripSensitiveCustomFieldKeys(
-  db: DbRunner,
-  tableName: string,
-  userIdColumn: string,
-  sensitiveKeys: readonly string[],
-  userId: string,
-  tenantId: string,
-): Promise<void> {
-  const tbl = quoteTable(tableName);
-  const userCol = quoteColumn(userIdColumn);
-  await asRawClient(db).unsafe(
-    `UPDATE ${tbl} SET custom_fields = CASE
-       WHEN jsonb_typeof(custom_fields) = 'object' THEN custom_fields - $1::text[]
-       ELSE custom_fields
-     END
-     WHERE ${userCol} = $2 AND tenant_id = $3`,
-    [sensitiveKeys, userId, tenantId],
-  );
-}
-
 export async function selectFieldDefinitionsForEntity(
   db: DbRunner,
   entityName: string,

package/src/custom-fields/entity.ts

@@ -78,7 +78,7 @@ export const fieldDefinitionEntity = createEntity({
     searchable: createBooleanField({ required: true }),
 
     // UI-Display-Order. Tenant kann seine Felder via UI sortieren.
-    displayOrder: createNumberField({ required: true }),
+    displayOrder: createNumberField({ required: true, integer: true }),
 
     // Builder-Reuse: serialisierter r.field.X(opts)-Output als jsonb.
     // Beinhaltet type-options (enum-values, money-currency, embedded-schema),

package/src/custom-fields/events.ts

@@ -11,9 +11,10 @@ import { z } from "zod";
 
 export const customFieldSetSchema = z.object({
   fieldKey: z.string().min(1).max(64),
-  // Optional: a `sensitive`-field set persists a VALUE-LESS event — the value is
-  // self-projected into the host row by the write handler and must never enter
-  // the immutable log. Non-sensitive sets always carry the value.
+  // Every set carries its value (custom fields hold no PII, #972) — replay
+  // reproduces the projection fully. Stays optional at the type layer only
+  // because z.unknown() is inherently optional; the apply side treats
+  // `value === undefined` as an anomaly and warns.
   value: z.unknown().optional(),
 });
 export type CustomFieldSetPayload = z.infer<typeof customFieldSetSchema>;

package/src/custom-fields/feature.ts

@@ -1,6 +1,14 @@
 // custom-fields — Tenant- + System-scoped Custom-Field-Definitions +
 // generische Custom-Field-VALUE write-handler (host-stream-events).
 //
+// **Scope: supplemental business data, NO PII (#972).** Custom fields sind
+// für tenant-spezifische Zusatzinfos (Referenznummern, Flags, Kategorien) —
+// nicht für personenbezogene Daten. Das frühere `sensitive`-Flag wurde
+// entfernt; das Schema rejected es und `parseSerializedField` wirft auf
+// Alt-Definitionen. Werte stehen vollständig im Event-Log (rebuild-safe).
+// PII gehört in Schema-Entity-Felder mit pii/userOwned/tenantOwned-
+// Annotation (Crypto-Shredding, Event-Ciphertext, Forget-Pipeline).
+//
 // **Was diese Feature liefert (B1 + B2, 2026-05-23):**
 //   1. r.entity("field-definition") — Definition-Storage (event-sourced).
 //   2. define-tenant-field / define-system-field — RBAC write-handlers für

package/src/custom-fields/handlers/delete-system-field.write.ts

@@ -1,5 +1,6 @@
 import { SYSTEM_TENANT_ID, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionAggregateId } from "../aggregate-id";
+import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants";
 import { fieldDefinitionExecutor } from "../executor";
 import { customFieldsFeature } from "../feature";
 import { type DeleteFieldPayload, deleteFieldPayloadSchema } from "../schemas";
@@ -30,7 +31,7 @@ export const deleteSystemFieldHandler: WriteHandlerDef = {
     if (result.isSuccess) {
       await ctx.unsafeAppendEvent({
         aggregateId,
-        aggregateType: "field-definition",
+        aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
         type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
         payload: {
           entityName: payload.entityName,

package/src/custom-fields/handlers/delete-tenant-field.write.ts

@@ -1,5 +1,6 @@
 import { isSystemTenant, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionAggregateId } from "../aggregate-id";
+import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants";
 import { fieldDefinitionExecutor } from "../executor";
 import { customFieldsFeature } from "../feature";
 import { type DeleteFieldPayload, deleteFieldPayloadSchema } from "../schemas";
@@ -38,7 +39,7 @@ export const deleteTenantFieldHandler: WriteHandlerDef = {
     if (result.isSuccess) {
       await ctx.unsafeAppendEvent({
         aggregateId,
-        aggregateType: "field-definition",
+        aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
         type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
         payload: { entityName: payload.entityName, fieldKey: payload.fieldKey, tenantId },
       });

package/src/custom-fields/handlers/set-custom-field.write.ts

@@ -1,9 +1,7 @@
-import { buildEntityTable, extractTableName } from "@cosmicdrift/kumiko-framework/db";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { DEFAULT_VALUE_WRITE_ROLES } from "../constants";
-import { setCustomFieldValue } from "../db/queries/projection";
 import { customFieldsFeature } from "../feature";
 import { fieldWriteAccessDeniedRoles, loadFieldDefinition } from "../lib/field-access";
 import { buildCustomFieldValueSchema } from "../lib/value-schema";
@@ -88,55 +86,16 @@ export const setCustomFieldHandler: WriteHandlerDef = {
       }
     }
 
-    // PII (`sensitive: true` definition): self-project the value here —
-    // synchronously, from the in-memory value — exactly like the entity executor
-    // does for sensitive entity fields. The persisted customField.set event then
-    // omits the value, so PII never enters the immutable event log; the existing
-    // user-data-rights strip of the projection erases it durably. Trade-off: a
-    // projection rebuild replays the value-less event and the MSP skips it (see
-    // wire-for-entity), so the value is gone — identical to a sensitive entity
-    // field. The host table isn't known to this generic handler, so resolve it
-    // per-stack via the registry (no module-global state).
-    const sensitive = loaded.field.sensitive === true;
-    if (sensitive) {
-      const entity = ctx.registry.getEntity(payload.entityName);
-      if (!entity) {
-        // Fail closed: without the host table we cannot self-project, and must
-        // NOT fall back to writing the value into the event log.
-        return failUnprocessable("custom_field_host_unresolved", {
-          entityName: payload.entityName,
-        });
-      }
-      // Resolves the same canonical table name the MSP/postQuery use (the table
-      // NAME, not the drizzle object). Holds unless a host entity is wired with
-      // a custom backing table whose name diverges from its definition — rare,
-      // and the MSP path makes the same assumption.
-      const tableName = extractTableName(
-        buildEntityTable(payload.entityName, entity),
-        "custom-fields/set-custom-field",
-      );
-      await setCustomFieldValue(
-        ctx.db.raw,
-        tableName,
-        payload.fieldKey,
-        payload.value,
-        payload.entityId,
-        event.user.tenantId,
-      );
-    }
-
     // Emit customField.set on host-aggregate stream. unsafeAppendEvent
     // (statt strict appendEvent) weil event-type-map keine cross-feature-
     // augmentation für diesen event-typ hat — wir nutzen den qualified
-    // string-namen direkt. Sensitive fields persist a value-less event (the
-    // value was self-projected above and must stay out of the log).
+    // string-namen direkt. Der Wert steht IMMER im Event (custom fields
+    // tragen keine PII, #972) — Replay reproduziert die Projection voll.
     await ctx.unsafeAppendEvent({
       aggregateId: payload.entityId,
       aggregateType: payload.entityName,
       type: customFieldsFeature.exports.setEvent.name,
-      payload: sensitive
-        ? { fieldKey: payload.fieldKey }
-        : { fieldKey: payload.fieldKey, value: payload.value },
+      payload: { fieldKey: payload.fieldKey, value: payload.value },
     });
 
     return {

package/src/custom-fields/handlers/update-tenant-field.write.ts

@@ -3,7 +3,6 @@ import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/e
 import { fieldDefinitionAggregateId } from "../aggregate-id";
 import { fieldDefinitionExecutor } from "../executor";
 import { buildFieldDefinitionColumns } from "../lib/field-definition-row";
-import { parseSerializedField } from "../lib/parse-serialized-field";
 import { type UpdateFieldPayload, updateFieldPayloadSchema } from "../schemas";
 
 // update-tenant-field — TenantAdmin ersetzt den Stand einer bestehenden
@@ -60,22 +59,6 @@ export const updateTenantFieldHandler: WriteHandlerDef = {
       });
     }
 
-    // `sensitive` is immutable. Flipping it on an existing field would leave a
-    // GDPR hole: a non-sensitive→sensitive switch can't retroactively erase the
-    // values already written to host rows by past sets (set-custom-field only
-    // routes the PII-safe path at write time). To change sensitivity, delete +
-    // re-define (the honest cut — same rationale as the type guard above).
-    const currentSensitive = parseSerializedField(existing["serializedField"])?.sensitive === true;
-    const requestedSensitive = payload.serializedField.sensitive === true;
-    if (currentSensitive !== requestedSensitive) {
-      return failUnprocessable("field_sensitive_immutable", {
-        entityName: payload.entityName,
-        fieldKey: payload.fieldKey,
-        currentSensitive,
-        requestedSensitive,
-      });
-    }
-
     // entityName/fieldKey sind die Identität — nicht Teil der changes.
     const {
       entityName: _entityName,

package/src/custom-fields/lib/field-access.ts

@@ -29,7 +29,14 @@ export async function loadFieldDefinition(
 ): Promise<LoadedFieldDefinition> {
   const serialized = await selectSerializedFieldDefinition(db, tenantId, entityName, fieldKey);
   if (serialized === null) return { found: false };
-  return { found: true, field: parseSerializedField(serialized) };
+  // parseSerializedField throws on a #972 legacy `sensitive` definition —
+  // that's a corrupt/unprocessable row from this write-gate's perspective,
+  // same fail-closed treatment as a shape that fails isShape().
+  try {
+    return { found: true, field: parseSerializedField(serialized) };
+  } catch {
+    return { found: true, field: null };
+  }
 }
 
 // Pure access-check on an already-loaded definition. Returns the required

package/src/custom-fields/lib/parse-serialized-field.ts

@@ -8,8 +8,8 @@
 // across the bundle.
 //
 // All structured `serializedField`-keys recognised today (`fieldAccess`,
-// `sensitive`, `retention`) live on this shape. New keys go here so the
-// other call-sites can read them via the typed result instead of re-parsing.
+// `retention`) live on this shape. New keys go here so the other call-sites
+// can read them via the typed result instead of re-parsing.
 
 import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
 
@@ -19,7 +19,6 @@ export interface SerializedFieldShape {
     readonly read?: ReadonlyArray<string>;
     readonly write?: ReadonlyArray<string>;
   };
-  readonly sensitive?: boolean;
   readonly retention?: {
     readonly keepFor: string;
     readonly strategy: "delete" | "anonymize";
@@ -41,7 +40,16 @@ function isShape(v: unknown): v is SerializedFieldShape {
  */
 export function parseSerializedField(raw: unknown): SerializedFieldShape | null {
   const parsed = typeof raw === "string" ? parseJsonSafe<unknown>(raw, null) : raw;
-  return isShape(parsed) ? parsed : null;
+  if (!isShape(parsed)) return null;
+  // Fail loud instead of silently dropping the key: a stored definition with
+  // `sensitive` predates #972 and its PII expectations (event-log exclusion,
+  // forget-strip) no longer hold — the field must be recreated.
+  if ("sensitive" in parsed) {
+    throw new Error(
+      "custom-field definition contains the removed `sensitive` key (#972) — custom fields don't support PII. Recreate the field without it; model personal data as a schema entity field with a pii annotation.",
+    );
+  }
+  return parsed;
 }
 
 export interface FieldDefinitionRow {

package/src/custom-fields/lib/value-schema.ts

@@ -86,6 +86,6 @@ export function buildCustomFieldValueSchema(parsedField: unknown): z.ZodTypeAny
 
   // @cast-boundary serialized-field is the dehydrated r.field.X() output =
   // a FieldDefinition; fieldToZod reads only its type-specific keys (the
-  // extra fieldAccess/sensitive/retention/label keys are ignored).
+  // extra fieldAccess/retention/label keys are ignored).
   return fieldToZod(fieldDef as unknown as FieldDefinition, currencies);
 }

package/src/custom-fields/run-retention.ts

@@ -158,7 +158,15 @@ async function loadRetentionPolicies(
   for (const raw of rows) {
     // skip: see asHostRow rationale.
     if (!isFieldDefinitionRow(raw)) continue;
-    const parsed = parseSerializedField(raw.serialized_field);
+    // parseSerializedField throws on a #972 legacy `sensitive` definition —
+    // one unmigrated field must not abort the whole tenant's retention sweep
+    // for every other field; skip it (no retention policy to apply anyway).
+    let parsed: ReturnType<typeof parseSerializedField>;
+    try {
+      parsed = parseSerializedField(raw.serialized_field);
+    } catch {
+      continue;
+    }
     if (parsed?.retention) {
       out.set(raw.field_key, parsed.retention);
     }

package/src/custom-fields/schemas.ts

@@ -33,18 +33,14 @@ export type CustomFieldAccess = z.infer<typeof customFieldAccessSchema>;
 //   money:    { type: "money", required: false, currency: "EUR" }
 //   embedded: { type: "embedded", required: false, schema: { ... } }
 //
-// `fieldAccess` (T1.5b) and `sensitive` (T1.5c) are the structured keys
-// recognised by the handlers / user-data-rights wiring. Everything else
-// stays loose pending B2's per-type discriminated-union.
+// `fieldAccess` (T1.5b) is the structured key recognised by the handlers.
+// Everything else stays loose pending B2's per-type discriminated-union —
+// EXCEPT `sensitive`, which is explicitly rejected below: custom fields
+// carry supplemental business data only, PII support was removed (#972).
 const serializedFieldSchema = z
   .looseObject({
     type: fieldTypeSchema,
     fieldAccess: customFieldAccessSchema,
-    // `sensitive: true` marks the field as PII — the user-data-rights
-    // wiring (wireCustomFieldsUserDataRightsFor) removes its value from
-    // the host row's customFields jsonb on user-forget when the strategy
-    // is "anonymize". Non-sensitive fields are untouched.
-    sensitive: z.boolean().optional(),
     // `retention` (T1.5d): per-field expiry. The retention-cron strips
     // values whose host-row `modified_at` is older than `keepFor`. Strategy
     // `delete` removes the key from the customFields jsonb; `anonymize`
@@ -59,7 +55,11 @@ const serializedFieldSchema = z
       })
       .optional(),
   })
-  .refine((v) => typeof v["type"] === "string", "serializedField must have a string `type`");
+  .refine((v) => typeof v["type"] === "string", "serializedField must have a string `type`")
+  .refine(
+    (v) => !("sensitive" in v),
+    "custom fields don't support PII — `sensitive` was removed (#972). Model personal data as a schema entity field with a pii/userOwned/tenantOwned annotation instead.",
+  );
 
 // i18n-labels — `{ de: "...", en: "...", ... }`. Mindestens ein Eintrag.
 const labelSchema = z.record(z.string().min(2).max(8), z.string().min(1));