@cosmicdrift/kumiko-framework 0.249.0 → 0.251.0

package/src/engine/registry-validate.ts

@@ -1,6 +1,10 @@
 import { configureEventPiiCatalog } from "../crypto/event-pii";
 import { resolveName } from "./handler-helpers";
-import type { RegistryState, SearchableReferenceField } from "./registry-state";
+import type {
+  RegistryState,
+  SearchableReferenceField,
+  SortableReferenceField,
+} from "./registry-state";
 import { buildImplicitProjection, hasFieldAccessRules, qualify } from "./registry-state";
 import {
   buildSoftDeleteCleanupJob,
@@ -192,12 +196,43 @@ function buildSearchableReferenceField(
   };
 }
 
-// Precompute: searchable/sortable fields, searchable reference fields.
+// fw#2741: ORDER BY runs against the referenced row's label column, so the
+// same explicit-labelField requirement as searchable applies — ordering by the
+// "id" default would be a UUID order that looks deliberate to the user.
+function buildSortableReferenceField(
+  entityName: string,
+  fieldName: string,
+  field: ReferenceFieldDef,
+): SortableReferenceField {
+  if (field.labelField === undefined || field.labelField === "id") {
+    throw new Error(
+      `[Entity ${entityName}] field "${fieldName}": sortable reference fields require an ` +
+        `explicit, non-"id" labelField. Ordering by "id" is a UUID order — arbitrary to the ` +
+        `user while looking deliberate. Set labelField to a human-readable field on the ` +
+        `referenced entity.`,
+    );
+  }
+  if (field.multiple === true) {
+    throw new Error(
+      `[Entity ${entityName}] field "${fieldName}": sortable is not supported on multiple ` +
+        `(array) reference fields — there is no single label to order by; remove "multiple" ` +
+        `or "sortable".`,
+    );
+  }
+  return {
+    fieldName,
+    targetEntityName: parseReferenceTargetEntityName(field.entity),
+    labelField: field.labelField,
+  };
+}
+
+// Precompute: searchable/sortable fields, searchable + sortable reference fields.
 export function buildSearchableSortableCaches(state: RegistryState): void {
   for (const [name, entity] of state.entityMap) {
     const searchable: string[] = [];
     const sortable: string[] = [];
     const searchableReferences: SearchableReferenceField[] = [];
+    const sortableReferences: SortableReferenceField[] = [];
     for (const [fieldName, field] of Object.entries(entity.fields)) {
       if (field.type === "text" && field.searchable === true) searchable.push(fieldName);
       if (field.type === "text" && field.sortable === true) sortable.push(fieldName);
@@ -209,10 +244,14 @@ export function buildSearchableSortableCaches(state: RegistryState): void {
       if (field.type === "reference" && field.searchable === true) {
         searchableReferences.push(buildSearchableReferenceField(name, fieldName, field));
       }
+      if (field.type === "reference" && field.sortable === true) {
+        sortableReferences.push(buildSortableReferenceField(name, fieldName, field));
+      }
     }
     state.searchableFieldsCache.set(name, searchable);
     state.sortableFieldsCache.set(name, sortable);
     state.searchableReferencesCache.set(name, searchableReferences);
+    state.sortableReferencesCache.set(name, sortableReferences);
   }
 }
 
@@ -664,9 +703,21 @@ export function publishEventPiiCatalog(state: RegistryState): void {
   // into kumiko_events — encrypts catalogued payload fields regardless of
   // which path produced the event (ctx.appendEvent, MSP-apply, low-level
   // append in delivery/jobs loggers).
+  //
+  // Defense-in-depth (fw#2558): defineEvent is the only producer of
+  // EventDef.piiFields and already fails closed without a stance, but this
+  // boot gate re-checks every registered event — a future producer that
+  // forgets to run through defineEvent would otherwise leave a hole where
+  // append() silently ships plaintext instead of refusing to boot.
   const eventPiiCatalog = new Map<string, EventPiiFields>();
   for (const [qualified, def] of state.eventMap) {
-    if (def.piiFields) eventPiiCatalog.set(qualified, def.piiFields);
+    if (def.piiFields === undefined) {
+      throw new Error(
+        `Registered event "${qualified}" has no PII stance. Every r.defineEvent(...) call must pass { piiFields: { ... } } or { piiFields: "none" }.`,
+      );
+    }
+    if (def.piiFields === "none") continue;
+    eventPiiCatalog.set(qualified, def.piiFields);
   }
   configureEventPiiCatalog(eventPiiCatalog);
 }

package/src/engine/types/index.ts

@@ -158,6 +158,7 @@ export type {
   EventDef,
   EventMigrationDef,
   EventPiiFields,
+  EventPiiStance,
   EventUpcastCtx,
   EventUpcastFn,
   FetchForWritingArgs,

package/src/entrypoint/__tests__/entrypoint-attach-dispatcher.integration.test.ts

@@ -25,7 +25,10 @@ const writeProbeResults: Array<{ isSuccess: boolean }> = [];
 const writeProbeFailures: string[] = [];
 
 const writeProbeFeature = defineFeature("writeProbe", (r) => {
-  const noted = r.defineEvent("noted", z.object({ note: z.string() }), { version: 1 });
+  const noted = r.defineEvent("noted", z.object({ note: z.string() }), {
+    piiFields: "none",
+    version: 1,
+  });
   r.writeHandler(
     "note",
     z.object({ note: z.string() }),

package/src/entrypoint/__tests__/split-deploy.integration.test.ts

@@ -23,7 +23,10 @@ import { createTestRedis, type TestRedis, TestUsers } from "../../stack";
 import { createAllInOneEntrypoint, createApiEntrypoint, createWorkerEntrypoint } from "../index";
 
 const splitFeature = defineFeature("split", (r) => {
-  const tick = r.defineEvent("tick", z.object({ note: z.string() }), { version: 1 });
+  const tick = r.defineEvent("tick", z.object({ note: z.string() }), {
+    piiFields: "none",
+    version: 1,
+  });
   r.multiStreamProjection({
     name: "spy",
     apply: {
@@ -38,7 +41,10 @@ const splitFeature = defineFeature("split", (r) => {
 const consumedNotes: string[] = [];
 
 const workerWriteFeature = defineFeature("workerWrite", (r) => {
-  const noted = r.defineEvent("noted", z.object({ note: z.string() }), { version: 1 });
+  const noted = r.defineEvent("noted", z.object({ note: z.string() }), {
+    piiFields: "none",
+    version: 1,
+  });
   r.writeHandler(
     "note",
     z.object({ note: z.string() }),
@@ -76,6 +82,7 @@ const jobSawFilesRef: string[] = [];
 
 const fileJobFeature = defineFeature("fileJob", (r) => {
   const requested = r.defineEvent("bytes-requested", z.object({ storageKey: z.string() }), {
+    piiFields: "none",
     version: 1,
   });
   // Stands in for file-foundation, which this package cannot import.
@@ -310,7 +317,7 @@ describe("entrypoint factories", () => {
 // process's lane are skipped during buildServer()".
 
 const laneFeature = defineFeature("lane", (r) => {
-  const ping = r.defineEvent("ping", z.object({}), { version: 1 });
+  const ping = r.defineEvent("ping", z.object({}), { piiFields: "none", version: 1 });
   // Three MSPs: one pinned to api, one to worker (explicit), one to both.
   // A fourth would be a default-undefined-runIn MSP which resolves to
   // "worker" — covered implicitly by the worker test below.

package/src/event-store/__tests__/upcaster.integration.test.ts

@@ -57,6 +57,7 @@ const orderFeature = defineFeature("upcastshop", (r) => {
     "priced",
     z.object({ totalCents: z.number().int(), currency: z.string() }),
     {
+      piiFields: "none",
       version: 3,
       migrations: [
         // v1 → v2: renamed totalEuros → total (kept as string for this step)
@@ -321,6 +322,7 @@ describe("upcaster: async (Marten AsyncOnlyEventUpcaster — DB-Lookups)", () =>
         "placed",
         z.object({ customerId: z.string(), segment: z.string() }),
         {
+          piiFields: "none",
           version: 2,
           migrations: [
             {
@@ -407,6 +409,7 @@ describe("upcaster: boot-time validation", () => {
       r.entity("hole-order", orderEntity);
       // Only 1→2 registered — the 2→3 gap must be rejected.
       r.defineEvent("bad", z.object({ v3: z.string() }), {
+        piiFields: "none",
         version: 3,
         migrations: [{ fromVersion: 1, toVersion: 2, transform: (p) => p }],
       });
@@ -424,6 +427,7 @@ describe("upcaster: boot-time validation", () => {
     const future = defineFeature("future", (r) => {
       r.entity("future-order", orderEntity);
       r.defineEvent("early", z.object({ x: z.number() }), {
+        piiFields: "none",
         version: 1,
         migrations: [{ fromVersion: 1, toVersion: 2, transform: (p) => p }],
       });
@@ -435,6 +439,7 @@ describe("upcaster: boot-time validation", () => {
     const gaps = defineFeature("gaps", (r) => {
       r.entity("gap-order", orderEntity);
       r.defineEvent("jumpy", z.object({ v: z.number() }), {
+        piiFields: "none",
         version: 4,
         migrations: [
           { fromVersion: 1, toVersion: 2, transform: (p) => p },
@@ -452,6 +457,7 @@ describe("upcaster: registrar input validation", () => {
       defineFeature("bigstep", (r) => {
         r.entity("bigstep-order", orderEntity);
         r.defineEvent("biz", z.object({ x: z.number() }), {
+          piiFields: "none",
           version: 3,
           migrations: [{ fromVersion: 1, toVersion: 3, transform: (p) => p }],
         });
@@ -464,6 +470,7 @@ describe("upcaster: registrar input validation", () => {
       defineFeature("dupestep", (r) => {
         r.entity("dup-order", orderEntity);
         r.defineEvent("dup", z.object({ x: z.number() }), {
+          piiFields: "none",
           version: 2,
           migrations: [
             { fromVersion: 1, toVersion: 2, transform: (p) => p },
@@ -478,7 +485,7 @@ describe("upcaster: registrar input validation", () => {
     expect(() =>
       defineFeature("badver", (r) => {
         r.entity("badver-order", orderEntity);
-        r.defineEvent("neg", z.object({ x: z.number() }), { version: 0 });
+        r.defineEvent("neg", z.object({ x: z.number() }), { piiFields: "none", version: 0 });
       }),
     ).toThrow(/positive integer/);
   });

package/src/jobs/__tests__/job-write-as.integration.test.ts

@@ -0,0 +1,206 @@
+// framework#2585 — JobContext.writeAs.
+//
+// `hasAccess` has no system bypass, so before writeAs existed a job could
+// only write as its own systemUser (roles: ["system"]) and every write
+// handler gated on concrete roles was unreachable from a job: the dispatch
+// came back access_denied and the only signal was a failed job. These tests
+// pin both halves — ctx.write against a role-gated handler is still denied,
+// and ctx.writeAs(actor) reaches the same handler and attributes the event
+// to the actor rather than to SYSTEM.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { z } from "zod";
+import { ROLES } from "../../auth/roles";
+import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
+import { asRawClient } from "../../db/query";
+import { createRegistry, defineFeature, type SessionUser, type WriteResult } from "../../engine";
+import { createWorkerEntrypoint } from "../../entrypoint";
+import { createArchivedStreamsTable, createEventsTable } from "../../event-store";
+import { createEventConsumerStateTable } from "../../pipeline";
+import { createTestRedis, type TestRedis } from "../../stack";
+import { waitFor } from "../../testing";
+import { createJobRunner } from "../job-runner";
+
+const ADMIN_USER_ID = "11111111-1111-4111-8111-111111111111";
+
+type ProbeOutcome = { readonly isSuccess: boolean; readonly errorCode: string | undefined };
+
+const writeOutcomes: ProbeOutcome[] = [];
+const writeAsOutcomes: ProbeOutcome[] = [];
+const writeAsFailures: string[] = [];
+
+function recordOutcome(sink: ProbeOutcome[], result: WriteResult): void {
+  sink.push({
+    isSuccess: result.isSuccess,
+    errorCode: result.isSuccess ? undefined : result.error.code,
+  });
+}
+
+const writeAsProbeFeature = defineFeature("writeAsProbe", (r) => {
+  const noted = r.defineEvent("adminNoted", z.object({ note: z.string() }), {
+    piiFields: "none",
+    version: 1,
+  });
+
+  r.writeHandler(
+    "adminNote",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      await ctx.unsafeAppendEvent({
+        aggregateId: crypto.randomUUID(),
+        aggregateType: "write-as-probe-note",
+        type: noted.name,
+        payload: { note: event.payload.note },
+      });
+      return { isSuccess: true as const, data: { note: event.payload.note } };
+    },
+    { access: { roles: [ROLES.TenantAdmin] } },
+  );
+
+  r.job("writeAsSystem", { trigger: { manual: true }, retries: 0 }, async (payload, ctx) => {
+    const result = await ctx.write("write-as-probe:write:admin-note", {
+      note: payload["note"] as string, // @cast-boundary dynamic-key
+    });
+    recordOutcome(writeOutcomes, result);
+  });
+
+  r.job("writeAsActor", { trigger: { manual: true }, retries: 0 }, async (payload, ctx) => {
+    const actor: SessionUser = {
+      id: payload["actorId"] as string, // @cast-boundary dynamic-key
+      tenantId: ctx.systemUser.tenantId,
+      roles: [ROLES.TenantAdmin],
+    };
+    try {
+      const result = await ctx.writeAs(actor, "write-as-probe:write:admin-note", {
+        note: payload["note"] as string, // @cast-boundary dynamic-key
+      });
+      recordOutcome(writeAsOutcomes, result);
+    } catch (error) {
+      writeAsFailures.push(error instanceof Error ? error.message : String(error));
+      throw error;
+    }
+  });
+});
+
+const JWT = "job-write-as-test-secret-must-be-32-chars!";
+
+let testDb: BunTestDb;
+let testRedis: TestRedis;
+
+beforeAll(async () => {
+  [testDb, testRedis] = await Promise.all([createTestDb(), createTestRedis()]);
+  await createEventsTable(testDb.db);
+  await createArchivedStreamsTable(testDb.db);
+  await createEventConsumerStateTable(testDb.db);
+});
+
+afterAll(async () => {
+  await Promise.all([testDb.cleanup(), testRedis.cleanup()]);
+});
+
+function redisUrl(): string {
+  return `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
+}
+
+function uniquePrefix(label: string): string {
+  return `${label}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+
+async function notesFor(note: string): Promise<Array<{ created_by: string }>> {
+  const rows = await asRawClient(testDb.db).unsafe<{ created_by: string }>(
+    `SELECT created_by FROM kumiko_events
+      WHERE type = 'write-as-probe:event:admin-noted' AND payload->>'note' = $1`,
+    [note],
+  );
+  return [...rows];
+}
+
+describe("JobContext.writeAs reaches a role-gated write handler (framework#2585)", () => {
+  test("ctx.write is denied — the job's systemUser carries no TenantAdmin role", async () => {
+    writeOutcomes.length = 0;
+    const worker = createWorkerEntrypoint({
+      registry: createRegistry([writeAsProbeFeature]),
+      context: { db: testDb.db, redis: testRedis.redis },
+      jwtSecret: JWT,
+      redisUrl: redisUrl(),
+      queueNamePrefix: uniquePrefix("job-write-as-denied"),
+    });
+
+    await worker.start();
+    try {
+      await worker.jobRunner.dispatch("write-as-probe:job:write-as-system", {
+        note: "system attempt",
+      });
+
+      await waitFor(() => {
+        expect(writeOutcomes.length).toBe(1);
+      });
+      expect(writeOutcomes[0]?.isSuccess).toBe(false);
+      expect(writeOutcomes[0]?.errorCode).toBe("access_denied");
+      expect(await notesFor("system attempt")).toHaveLength(0);
+    } finally {
+      await worker.stop();
+    }
+  });
+
+  test("ctx.writeAs(actor) commits and attributes the event to the actor", async () => {
+    writeAsOutcomes.length = 0;
+    const worker = createWorkerEntrypoint({
+      registry: createRegistry([writeAsProbeFeature]),
+      context: { db: testDb.db, redis: testRedis.redis },
+      jwtSecret: JWT,
+      redisUrl: redisUrl(),
+      queueNamePrefix: uniquePrefix("job-write-as-allowed"),
+    });
+
+    await worker.start();
+    try {
+      await worker.jobRunner.dispatch("write-as-probe:job:write-as-actor", {
+        note: "actor attempt",
+        actorId: ADMIN_USER_ID,
+      });
+
+      await waitFor(() => {
+        expect(writeAsOutcomes.length).toBe(1);
+      });
+      expect(writeAsOutcomes[0]?.isSuccess).toBe(true);
+
+      const rows = await notesFor("actor attempt");
+      expect(rows).toHaveLength(1);
+      expect(rows[0]?.created_by).toBe(ADMIN_USER_ID);
+    } finally {
+      await worker.stop();
+    }
+  });
+});
+
+describe("JobContext.writeAs before attachDispatcher()", () => {
+  test("throws the same not-attached stub ctx.write does", async () => {
+    writeAsFailures.length = 0;
+    const runner = createJobRunner({
+      registry: createRegistry([writeAsProbeFeature]),
+      context: { db: testDb.db, redis: testRedis.redis },
+      redisUrl: redisUrl(),
+      consumerLane: "worker",
+      queueNamePrefix: uniquePrefix("job-write-as-bare"),
+    });
+
+    await runner.start();
+    try {
+      await runner.dispatch("write-as-probe:job:write-as-actor", {
+        note: "should never land",
+        actorId: ADMIN_USER_ID,
+      });
+
+      await waitFor(() => {
+        expect(writeAsFailures.length).toBe(1);
+      });
+      expect(writeAsFailures[0]).toContain(
+        "JobContext.writeAs called before dispatcher attached — call attachDispatcher() first",
+      );
+      expect(await notesFor("should never land")).toHaveLength(0);
+    } finally {
+      await runner.stop();
+    }
+  });
+});

package/src/jobs/job-runner.ts

@@ -144,9 +144,9 @@ export type JobRunner = {
     payload: Record<string, unknown>,
     user?: SessionUser,
   ): Promise<void>;
-  // Wires JobContext.write/queryAs to the real dispatcher — called once at
-  // boot, after the dispatcher exists (job-runner construction happens
-  // before it). Before this runs, JobContext.write/queryAs throw.
+  // Wires JobContext.write/writeAs/queryAs to the real dispatcher — called
+  // once at boot, after the dispatcher exists (job-runner construction happens
+  // before it). Before this runs, JobContext.write/writeAs/queryAs throw.
   attachDispatcher(ref: DispatchWriteRef): void;
 };
 
@@ -362,7 +362,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
   // at job-execution time (after start()), so it is always defined by then.
   let selfRunner: JobRunner | undefined;
   // Set by attachDispatcher() once the boot-level dispatcher exists.
-  // JobContext.write/queryAs throw until this is set — see JobContext doc.
+  // JobContext.write/writeAs/queryAs throw until this is set — see JobContext doc.
   let dispatchWriteRef: DispatchWriteRef | undefined;
 
   // Counts active + waiting jobs with this name for this tenant across
@@ -581,6 +581,14 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
         }
         return dispatchWriteRef.write(jobSystemUser, qn, payload);
       },
+      writeAs: (user: SessionUser, qn: string, payload: unknown) => {
+        if (!dispatchWriteRef) {
+          throw new Error(
+            "JobContext.writeAs called before dispatcher attached — call attachDispatcher() first",
+          );
+        }
+        return dispatchWriteRef.write(user, qn, payload);
+      },
       queryAs: (user: SessionUser, qn: string, payload: unknown) => {
         if (!dispatchWriteRef) {
           throw new Error(

package/src/pipeline/__tests__/archive-stream.integration.test.ts

@@ -32,7 +32,9 @@ const itemTable = buildEntityTable("arch-item", itemEntity);
 const archFeature = defineFeature("archtest", (r) => {
   r.entity("arch-item", itemEntity);
 
-  const labelChanged = r.defineEvent("label-changed", z.object({ label: z.string() }));
+  const labelChanged = r.defineEvent("label-changed", z.object({ label: z.string() }), {
+    piiFields: "none",
+  });
 
   const executor = createEventStoreExecutor(itemTable, itemEntity, {
     entityName: "arch-item",

package/src/pipeline/__tests__/causation-chain.integration.test.ts

@@ -54,7 +54,9 @@ const applyObservations: ReqCtxSnapshot[] = [];
 const causationFeature = defineFeature("causation", (r) => {
   r.entity("causation-order", orderEntity);
 
-  const placed = r.defineEvent("placed", z.object({ orderId: z.uuid() }));
+  const placed = r.defineEvent("placed", z.object({ orderId: z.uuid() }), {
+    piiFields: "none",
+  });
 
   const orderExecutor = createEventStoreExecutor(orderTable, orderEntity, {
     entityName: "causation-order",

package/src/pipeline/__tests__/domain-events-projections.integration.test.ts

@@ -58,7 +58,9 @@ const shippingFeature = defineFeature("shipping", (r) => {
   r.entity("domain-shipment", shipmentEntity);
 
   // Domain event. Qualified name is "shipping:event:billed".
-  const shipmentBilled = r.defineEvent("billed", z.object({ cost: z.number() }));
+  const shipmentBilled = r.defineEvent("billed", z.object({ cost: z.number() }), {
+    piiFields: "none",
+  });
 
   r.projection({
     name: "shipment-billing",

package/src/pipeline/__tests__/event-define-event-strict.integration.test.ts

@@ -34,14 +34,18 @@ let foreignEventName = "";
 // emit this from one of its handlers — Sprint-E cross-feature-ownership
 // guard must reject it at the append site.
 const neighborFeature = defineFeature("neighbor", (r) => {
-  const foreign = r.defineEvent("neighbor.signal", z.object({ userId: z.uuid() }));
+  const foreign = r.defineEvent("neighbor.signal", z.object({ userId: z.uuid() }), {
+    piiFields: "none",
+  });
   foreignEventName = foreign.name;
 });
 
 const emitterFeature = defineFeature("emitter", (r) => {
   r.entity("widget", sharedWidgetEntity);
 
-  const welcome = r.defineEvent("user.welcomed", z.object({ userId: z.uuid(), email: z.email() }));
+  const welcome = r.defineEvent("user.welcomed", z.object({ userId: z.uuid(), email: z.email() }), {
+    piiFields: "none",
+  });
   welcomeEventName = welcome.name;
 
   r.writeHandler(

package/src/pipeline/__tests__/fetch-for-writing.integration.test.ts

@@ -31,8 +31,12 @@ const cartTable = buildEntityTable("f4wCart", cartEntity);
 const cartFeature = defineFeature("f4w", (r) => {
   r.entity("f4wCart", cartEntity);
 
-  const itemAdded = r.defineEvent("itemAdded", z.object({ sku: z.string(), qty: z.number() }));
-  const checkedOut = r.defineEvent("checkedOut", z.object({ totalCents: z.number() }));
+  const itemAdded = r.defineEvent("itemAdded", z.object({ sku: z.string(), qty: z.number() }), {
+    piiFields: "none",
+  });
+  const checkedOut = r.defineEvent("checkedOut", z.object({ totalCents: z.number() }), {
+    piiFields: "none",
+  });
 
   const cartExecutor = createEventStoreExecutor(cartTable, cartEntity, {
     entityName: "f4wCart",

package/src/pipeline/__tests__/job-trigger-consumer.integration.test.ts

@@ -30,7 +30,9 @@ const FILE_REF_CREATED = entityEventName("fileRef", "created");
 const processedItems: Array<{ readonly fileRefId: string }> = [];
 
 const jobTriggerFixtureFeature = defineFeature("job-trigger-fixture", (r) => {
-  r.defineEvent("item-requested", z.object({ fileRefId: z.string().min(1) }));
+  r.defineEvent("item-requested", z.object({ fileRefId: z.string().min(1) }), {
+    piiFields: "none",
+  });
 
   // Mirrors document-ingest-foundation's request-ingest MSP exactly: reacts
   // to fileRef.created, appends a NEW event via unsafeAppendEvent — no

package/src/pipeline/__tests__/load-aggregate-query.integration.test.ts

@@ -46,6 +46,7 @@ const asOfFeature = defineFeature("asoftest", (r) => {
     "approved",
     z.object({ amount: z.number().int(), approvedBy: z.string() }),
     {
+      piiFields: "none",
       version: 2,
       migrations: [
         {

package/src/pipeline/__tests__/msp-multi-hop.integration.test.ts

@@ -42,9 +42,11 @@ const confirmLoadCounts: number[] = [];
 const mmhFeature = defineFeature("mmh", (r) => {
   r.entity("mmh-order", orderEntity);
 
-  const placed = r.defineEvent("placed", z.object({ orderId: z.uuid() }));
-  const confirmed = r.defineEvent("confirmed", z.object({ orderId: z.uuid() }));
-  const shipped = r.defineEvent("shipped", z.object({ orderId: z.uuid() }));
+  const placed = r.defineEvent("placed", z.object({ orderId: z.uuid() }), { piiFields: "none" });
+  const confirmed = r.defineEvent("confirmed", z.object({ orderId: z.uuid() }), {
+    piiFields: "none",
+  });
+  const shipped = r.defineEvent("shipped", z.object({ orderId: z.uuid() }), { piiFields: "none" });
 
   const orderExecutor = createEventStoreExecutor(orderTable, orderEntity, {
     entityName: "mmh-order",

package/src/pipeline/__tests__/msp-rebuild.integration.test.ts

@@ -72,14 +72,17 @@ const feature = defineFeature("mspreb", (r) => {
   const invoiceBilled = r.defineEvent(
     "invoice-billed",
     z.object({ customer: z.uuid(), cents: z.number().int() }),
+    { piiFields: "none" },
   );
   const paymentReceived = r.defineEvent(
     "payment-received",
     z.object({ customer: z.uuid(), cents: z.number().int() }),
+    { piiFields: "none" },
   );
   const escalationTriggered = r.defineEvent(
     "escalation-triggered",
     z.object({ customer: z.uuid() }),
+    { piiFields: "none" },
   );
 
   // 1) Main rebuildable MSP — table materialized from two event types.

package/src/pipeline/__tests__/multi-stream-projection.integration.test.ts

@@ -56,10 +56,12 @@ const mspFeature = defineFeature("msptest", (r) => {
   const shipmentBilled = r.defineEvent(
     "shipment-billed",
     z.object({ customer: z.uuid(), cents: z.number().int() }),
+    { piiFields: "none" },
   );
   const refundIssued = r.defineEvent(
     "refund-issued",
     z.object({ customer: z.uuid(), cents: z.number().int() }),
+    { piiFields: "none" },
   );
 
   r.multiStreamProjection({

package/src/pipeline/__tests__/rebuild-poison-quarantine.integration.test.ts

@@ -110,7 +110,9 @@ const MSP_EVENT_SHORT = "poison-noted";
 const feature = defineFeature("poisontest", (r) => {
   r.entity("poison-item", itemEntity);
   r.projection(poisonProjection);
-  const noted = r.defineEvent(MSP_EVENT_SHORT, z.object({ groupId: z.uuid(), name: z.string() }));
+  const noted = r.defineEvent(MSP_EVENT_SHORT, z.object({ groupId: z.uuid(), name: z.string() }), {
+    piiFields: "none",
+  });
   r.multiStreamProjection({
     name: "poison-msp-counter",
     table: mspCounterTable,