@cosmicdrift/kumiko-framework 0.289.0 → 0.290.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.289.0",
+  "version": "0.290.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,8 +198,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.289.0",
-    "@cosmicdrift/kumiko-types": "0.289.0",
+    "@cosmicdrift/kumiko-http": "0.290.0",
+    "@cosmicdrift/kumiko-types": "0.290.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -215,7 +215,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.289.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.290.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/__tests__/field-access.integration.test.ts

@@ -26,10 +26,14 @@ import {
 const employeeEntity = createEntity({
   table: "fa_employees",
   fields: {
-    email: createTextField({ required: true }),
-    firstName: createTextField(),
+    email: createTextField({ personal: false, reason: "test_fixture", required: true }),
+    firstName: createTextField({ personal: false, reason: "test_fixture" }),
     salary: createNumberField({ access: { read: ["Admin", "Accounting"], write: ["Admin"] } }),
-    notes: createTextField({ access: { read: ["Admin"], write: ["Admin"] } }),
+    notes: createTextField({
+      personal: false,
+      reason: "test_fixture",
+      access: { read: ["Admin"], write: ["Admin"] },
+    }),
   },
 });
 

package/src/__tests__/ownership-where-write-path.integration.test.ts

@@ -45,7 +45,7 @@ const memoEntity = createEntity({
   table: "fw2626_memos",
   softDelete: true,
   fields: {
-    ownerId: createTextField({ required: true }),
+    ownerId: createTextField({ personal: false, reason: "test_fixture", required: true }),
     title: createTextField({ personal: false, reason: "test_fixture", required: true }),
   },
   access: {

package/src/__tests__/ownership.integration.test.ts

@@ -37,7 +37,7 @@ const contractEntity = createEntity({
   softDelete: true,
   fields: {
     teamId: createTextField({ personal: false, reason: "test_fixture", required: true }),
-    assigneeId: createTextField(),
+    assigneeId: createTextField({ personal: false, reason: "test_fixture" }),
     title: createTextField({ personal: false, reason: "test_fixture", required: true }),
     // propA: public on read + write
     propA: createTextField({ personal: false, reason: "test_fixture" }),

package/src/api/__tests__/server-boot-guards.test.ts

@@ -10,6 +10,7 @@ import {
   defineFeature,
   defineQueryHandler,
   EXT_PRINCIPAL_STATUS,
+  EXT_TENANT_LIFECYCLE_STATUS,
 } from "../../engine";
 import { createInMemorySearchAdapter } from "../../search";
 import { buildServer } from "../server";
@@ -263,3 +264,44 @@ describe("buildServer — auth membershipQuery requires a principalStatus provid
     ).not.toThrow();
   });
 });
+
+describe("buildServer — tenant-lifecycle gate derivation", () => {
+  const lifecyclePlugin = { resolveStatus: async () => null };
+  const providerFeature = defineFeature("lifecycle-provider", (r) => {
+    r.extendsRegistrar(EXT_TENANT_LIFECYCLE_STATUS, {});
+    r.useExtension(EXT_TENANT_LIFECYCLE_STATUS, "lifecycle-provider", lifecyclePlugin);
+  });
+  const secondProviderFeature = defineFeature("lifecycle-provider-2", (r) => {
+    r.useExtension(EXT_TENANT_LIFECYCLE_STATUS, "lifecycle-provider-2", lifecyclePlugin);
+  });
+
+  test("throws when a lifecycle provider is mounted but context.db is missing", () => {
+    expect(() =>
+      buildServer({
+        registry: createRegistry([providerFeature]),
+        context: {},
+        jwtSecret: JWT_SECRET,
+      }),
+    ).toThrow(/tenantLifecycleStatus provider is mounted .* but context\.db is missing/);
+  });
+
+  test("throws when two lifecycle providers are registered", () => {
+    expect(() =>
+      buildServer({
+        registry: createRegistry([providerFeature, secondProviderFeature]),
+        context: {},
+        jwtSecret: JWT_SECRET,
+      }),
+    ).toThrow(/multiple "tenantLifecycleStatus" providers registered/);
+  });
+
+  test("no provider mounted leaves the gate unwired", () => {
+    expect(() =>
+      buildServer({
+        registry: createRegistry([]),
+        context: {},
+        jwtSecret: JWT_SECRET,
+      }),
+    ).not.toThrow();
+  });
+});

package/src/api/request-context.ts

@@ -38,6 +38,12 @@ export type RequestContextData = {
   // request-locale.ts. Undefined when neither header carried a valid tag;
   // callers fall back further (dispatch-shared.ts's ctx.locale chain).
   readonly locale?: string;
+  // Attribution of the currently executing scope (#3043): the feature that
+  // owns it and the qualified name of the handler / MSP-consumer / job
+  // inside it. event-store.append() reads both and stamps them onto every
+  // event written under this scope.
+  readonly feature?: string;
+  readonly handler?: string;
 };
 
 const storage = new AsyncLocalStorage<RequestContextData>();
@@ -55,3 +61,25 @@ export const requestContext = {
     return generateId();
   },
 };
+
+// Enter a scope that attributes every event written inside it. Keeps the
+// surrounding request's ids so correlation survives, and mints fresh ones
+// when there is no surrounding request (job-runner, event-dispatcher) —
+// requestId/correlationId are mandatory, `get()` may be undefined.
+export function runWithOrigin<T>(
+  origin: { readonly feature?: string; readonly handler?: string },
+  fn: () => T,
+): T {
+  const current = requestContext.get();
+  const requestId = current?.requestId ?? requestContext.generateId();
+  return requestContext.run(
+    {
+      ...current,
+      requestId,
+      correlationId: current?.correlationId ?? requestId,
+      feature: origin.feature,
+      handler: origin.handler,
+    },
+    fn,
+  );
+}

package/src/api/server.ts

@@ -19,6 +19,7 @@ import {
   registerStandardMetrics,
   wrapRedisClient,
 } from "../observability";
+import { resolveTenantLifecyclePlugin } from "../pipeline/active-membership";
 import type { DispatcherOptions } from "../pipeline/dispatcher";
 import { createDispatcher, type Dispatcher } from "../pipeline/dispatcher";
 import { SHARED_INSTANCE_SENTINEL } from "../pipeline/event-consumer-state";
@@ -43,7 +44,12 @@ import {
 import type { SearchAdapter } from "../search/types";
 import { assertUnreachable, generateId } from "../utils";
 import { NO_ROUTE_MATCH_HEADER_NAME, PUBLIC_API_PATHS } from "./api-constants";
-import { type AnonymousAccessResolved, authMiddleware, getUser } from "./auth-middleware";
+import {
+  type AnonymousAccessResolved,
+  authMiddleware,
+  getUser,
+  type TenantLifecycleStatusResolver,
+} from "./auth-middleware";
 import { type AuthRoutesConfig, createAuthRoutes } from "./auth-routes";
 import { csrfMiddleware } from "./csrf-middleware";
 import { createJwtHelper, type JwtHelper, type JwtKeyring } from "./jwt";
@@ -670,12 +676,16 @@ export function buildServer(options: ServerOptions): KumikoServer {
   // a token (or, when anonymousAccess is wired, falls through as anonymous).
   // A session-checker is forwarded when the auth-config wires one, so the
   // middleware can reject revoked sids on every request.
+  // Mounting a tenantLifecycleStatus provider is what turns the 410 on, so no
+  // entrypoint can forget the wiring; `??` short-circuits, so an explicit
+  // auth.resolveTenantLifecycleStatus remains the override.
+  const tenantLifecycleResolver =
+    options.auth?.resolveTenantLifecycleStatus ??
+    deriveTenantLifecycleResolver(options.registry, baseDb);
   const jwtGuard = authMiddleware(jwt, {
     ...(options.auth?.sessionChecker ? { sessionChecker: options.auth.sessionChecker } : {}),
     ...(options.auth?.tokenVerifier ? { tokenVerifier: options.auth.tokenVerifier } : {}),
-    ...(options.auth?.resolveTenantLifecycleStatus
-      ? { resolveTenantLifecycleStatus: options.auth.resolveTenantLifecycleStatus }
-      : {}),
+    ...(tenantLifecycleResolver ? { resolveTenantLifecycleStatus: tenantLifecycleResolver } : {}),
     ...(options.anonymousAccess ? { anonymousAccess: options.anonymousAccess } : {}),
   });
   app.use("/api/*", async (c, next) => {
@@ -890,6 +900,22 @@ export function buildServer(options: ServerOptions): KumikoServer {
   };
 }
 
+function deriveTenantLifecycleResolver(
+  registry: Registry,
+  db: DbConnection | undefined,
+): TenantLifecycleStatusResolver | undefined {
+  const plugin = resolveTenantLifecyclePlugin(registry, "buildServer");
+  if (!plugin) return undefined;
+  if (!db) {
+    throw new Error(
+      "[kumiko] a tenantLifecycleStatus provider is mounted (tenant-lifecycle) but context.db is " +
+        "missing — the request-level teardown gate needs a DbConnection. Pass context.db, or wire " +
+        "auth.resolveTenantLifecycleStatus explicitly.",
+    );
+  }
+  return (tenantId) => plugin.resolveStatus(tenantId, { db });
+}
+
 // Scans every feature's entities for a file/image/files/images field. Short-
 // circuits on the first hit — no need to build a full inventory, we only want
 // the yes/no answer for the boot check.

package/src/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.290.0",
+    "type": "improvement",
+    "title": "Event-Attribution: metadata.feature + metadata.handler auf jedem Event",
+    "detail": "event-store.append() stempelt Feature und Handler-Namen aus dem Ausfuehrungsscope (requestContext) auf jedes geschriebene Event. Dispatch-Handler, Entity-Executor-Writes, MSP-Applies und Jobs sind damit ohne Signaturaenderung attribuiert; Appends ausserhalb eines Scopes tragen UNATTRIBUTED_ORIGIN. appendRaw/appendRawBatch bleiben unveraendert."
+  },
+  {
+    "version": "0.290.0",
+    "type": "fix",
+    "title": "Section readers see groups[].fields",
+    "detail": "Boot-guard and E2E-generator now flatten section.groups via sectionFieldSpecs instead of iterating section.fields only: a function renderer inside groups[].fields fails at boot, and generated E2E specs cover group fields (required fields, fill ops, text assertions)."
+  },
+  {
+    "version": "0.290.0",
+    "type": "improvement",
+    "title": "The tenant-teardown 410 gate is derived from the mounted tenantLifecycleStatus provider (fw#2881).",
+    "detail": "buildServer now resolves the EXT_TENANT_LIFECYCLE_STATUS extension point itself, so every server with tenant-lifecycle mounted rejects requests against a tenant in teardown with 410 tenant_unavailable — prod, dev and test stacks can no longer drift because one entrypoint forgot the wiring. An explicit auth.resolveTenantLifecycleStatus still takes precedence and stays the escape hatch. A mounted provider without context.db is a boot error instead of a silently skipped gate."
+  },
   {
     "version": "0.289.0",
     "type": "breaking",

package/src/crypto/__tests__/blind-index.test.ts

@@ -25,7 +25,7 @@ const TEST_KEY = decodeBlindIndexKey(TEST_KEY_B64);
 const userLikeEntity = createEntity({
   fields: {
     email: createTextField({ required: true, personal: "self", find: "exact" }),
-    role: createTextField(),
+    role: createTextField({ personal: false, reason: "test_fixture" }),
   },
   table: "bidx_users",
 });

package/src/crypto/__tests__/pii-field-encryption.test.ts

@@ -28,7 +28,7 @@ const ENTITY_NAME = "pii-entity";
 const userLikeEntity = createEntity({
   fields: {
     email: createTextField({ required: true, personal: "self", find: "none" }),
-    role: createTextField(),
+    role: createTextField({ personal: false, reason: "test_fixture" }),
   },
   table: "pii_users",
 });
@@ -39,7 +39,7 @@ const commentEntity = createEntity({
       personal: { of: "authorId" },
       find: "none",
     }),
-    authorId: createTextField({ required: true }),
+    authorId: createTextField({ personal: false, reason: "test_fixture", required: true }),
   },
   table: "pii_comments",
 });

package/src/crypto/__tests__/subject-resolver.test.ts

@@ -11,7 +11,7 @@ import {
 const userLikeEntity = createEntity({
   fields: {
     email: createTextField({ required: true, personal: "self", find: "none" }),
-    role: createTextField(),
+    role: createTextField({ personal: false, reason: "test_fixture" }),
   },
   table: "resolver_users",
   idType: "uuid",
@@ -23,7 +23,7 @@ const commentEntity = createEntity({
       personal: { of: "authorId" },
       find: "none",
     }),
-    authorId: createTextField({ required: true }),
+    authorId: createTextField({ personal: false, reason: "test_fixture", required: true }),
   },
   table: "resolver_comments",
 });

package/src/db/__tests__/blind-index.integration.test.ts

@@ -37,7 +37,7 @@ const personEntity = createEntity({
   table: "read_bidx_persons",
   fields: {
     email: createTextField({ required: true, personal: "self", find: "exact" }),
-    firstName: createTextField(),
+    firstName: createTextField({ personal: false, reason: "test_fixture" }),
   },
 });
 const personFeature = defineFeature("bidxtest", (r) => {

package/src/db/__tests__/eagerload.integration.test.ts

@@ -50,7 +50,12 @@ const contactEntity = createEntity({
   fields: {
     name: createTextField({ required: true, personal: false, reason: "test_fixture" }),
     email: createTextField({ required: true, personal: "tenant", find: "none" }),
-    iban: createTextField({ required: true, encrypted: true }),
+    iban: createTextField({
+      personal: false,
+      reason: "test_fixture",
+      required: true,
+      encrypted: true,
+    }),
   },
 });
 const leadEntity = createEntity({
@@ -72,7 +77,12 @@ const ownedContactEntity = createEntity({
   fields: {
     name: createTextField({ required: true, personal: false, reason: "test_fixture" }),
     email: createTextField({ required: true, personal: "tenant", find: "none" }),
-    iban: createTextField({ required: true, encrypted: true }),
+    iban: createTextField({
+      personal: false,
+      reason: "test_fixture",
+      required: true,
+      encrypted: true,
+    }),
   },
   access: { read: { admin: from("user:id", "ownerId") } },
 });

package/src/db/__tests__/entity-field-encryption.test.ts

@@ -13,8 +13,8 @@ describe("entity-field-encryption", () => {
   const entity = createEntity({
     table: "read_enc_test",
     fields: {
-      email: createTextField({ required: true }),
-      secretNote: createTextField({ encrypted: true }),
+      email: createTextField({ personal: false, reason: "test_fixture", required: true }),
+      secretNote: createTextField({ personal: false, reason: "test_fixture", encrypted: true }),
     },
   });
   const encryptedFields = collectEncryptedFieldNames(entity);

package/src/db/__tests__/event-store-executor-context.pii-roundtrip.test.ts

@@ -16,7 +16,7 @@ describe("event-store-executor-context — encryptForStorage/decryptForRead laye
   const entity = createEntity({
     table: "pii_roundtrip_test",
     fields: {
-      userId: createTextField({ required: true }),
+      userId: createTextField({ personal: false, reason: "test_fixture", required: true }),
       // Both markers at once — the auth-mfa.totpSecret/recoveryCodes shape
       // that first surfaced the ordering bug (pii-subject-encryption
       // integration test).

package/src/db/__tests__/event-store-executor-money-rehydrate.integration.test.ts

@@ -34,9 +34,14 @@ const cipher = createTestEnvelopeCipher(TEST_KEY);
 const entity = createEntity({
   table: "read_money_orders",
   fields: {
-    ownerId: createTextField({ required: true }),
+    ownerId: createTextField({ personal: false, reason: "test_fixture", required: true }),
     grossTotal: createMoneyField(),
-    billingIban: createTextField({ required: true, encrypted: true }),
+    billingIban: createTextField({
+      personal: false,
+      reason: "test_fixture",
+      required: true,
+      encrypted: true,
+    }),
   },
   // A non-"all" read rule forces buildOwnershipClause into the
   // ownership.kind==="sql" raw-SQL branch that list()/detail() read through.

package/src/db/__tests__/event-store-executor-write-verbs.integration.test.ts

@@ -227,8 +227,10 @@ describe("event-store-executor write-verbs — restore without softDelete", () =
 const ownedFieldEntity = createEntity({
   table: "read_es_write_owned_field",
   fields: {
-    authorId: createTextField({ required: true }),
+    authorId: createTextField({ personal: false, reason: "test_fixture", required: true }),
     note: createTextField({
+      personal: false,
+      reason: "test_fixture",
       access: { write: { Admin: "all", User: from("user:id", "authorId") } },
     }),
   },

package/src/db/__tests__/event-store-executor.integration.test.ts

@@ -139,8 +139,18 @@ const sensitiveEntity = createEntity({
   table: "read_es_exec_sensitive",
   fields: {
     email: createTextField({ required: true, personal: false, reason: "test_fixture" }),
-    passwordHash: createTextField({ sensitive: true, encrypted: true }),
-    apiToken: createTextField({ sensitive: true, encrypted: true }),
+    passwordHash: createTextField({
+      personal: false,
+      reason: "test_fixture",
+      sensitive: true,
+      encrypted: true,
+    }),
+    apiToken: createTextField({
+      personal: false,
+      reason: "test_fixture",
+      sensitive: true,
+      encrypted: true,
+    }),
   },
   softDelete: true,
 });
@@ -343,7 +353,7 @@ const encryptedEntity = createEntity({
   table: "read_es_exec_encrypted",
   fields: {
     email: createTextField({ required: true, personal: false, reason: "test_fixture" }),
-    secretNote: createTextField({ encrypted: true }),
+    secretNote: createTextField({ personal: false, reason: "test_fixture", encrypted: true }),
   },
 });
 const encryptedTable = buildEntityTable("esExecEncrypted", encryptedEntity);
@@ -352,7 +362,7 @@ const encryptedSoftDeleteEntity = createEntity({
   table: "read_es_exec_enc_soft",
   fields: {
     email: createTextField({ required: true, personal: false, reason: "test_fixture" }),
-    secretNote: createTextField({ encrypted: true }),
+    secretNote: createTextField({ personal: false, reason: "test_fixture", encrypted: true }),
   },
   softDelete: true,
 });
@@ -703,7 +713,7 @@ const piiEntity = createEntity({
       personal: { of: "authorId" },
       find: "none",
     }),
-    authorId: createTextField(),
+    authorId: createTextField({ personal: false, reason: "test_fixture" }),
     plain: createTextField({ personal: false, reason: "test_fixture" }),
   },
 });

package/src/db/__tests__/list-filter-field-access.integration.test.ts

@@ -17,14 +17,18 @@ import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } fr
 const filterNoteEntity = createEntity({
   table: "fa_filter_notes",
   fields: {
-    title: createTextField({ required: true }),
-    ownerId: createTextField({ required: true }),
+    title: createTextField({ personal: false, reason: "test_fixture", required: true }),
+    ownerId: createTextField({ personal: false, reason: "test_fixture", required: true }),
     secret: createTextField({
+      personal: false,
+      reason: "test_fixture",
       filterable: true,
       sortable: true,
       access: { read: { Admin: "all" } },
     }),
     ownedNote: createTextField({
+      personal: false,
+      reason: "test_fixture",
       filterable: true,
       access: { read: { Admin: "all", User: from("user:id", "ownerId") } },
     }),

package/src/engine/__tests__/boot-validator-action-wiring.test.ts

@@ -229,6 +229,38 @@ describe("validateBoot — action wiring (no function values)", () => {
     expect(() => validateBoot([feature])).toThrow(/field "name" renderer is a function/);
   });
 
+  test("entityEdit field renderer as function inside groups → Throw", () => {
+    const feature = defineFeature("shop", (r) => {
+      r.entity(
+        "product",
+        createEntity({
+          fields: { name: createTextField({ personal: false, reason: "test_fixture" }) },
+        }),
+      );
+      r.screen({
+        id: "product-edit",
+        type: "entityEdit",
+        entity: "product",
+        layout: {
+          sections: [
+            {
+              columns: 1,
+              fields: [],
+              groups: [
+                {
+                  title: "Basis",
+                  // biome-ignore lint/suspicious/noExplicitAny: intentional type violation under test
+                  fields: [{ field: "name", renderer: ((v: unknown) => String(v)) as any }],
+                },
+              ],
+            },
+          ],
+        },
+      });
+    });
+    expect(() => validateBoot([feature])).toThrow(/field "name" renderer is a function/);
+  });
+
   test("entityEdit field with declarative visible/readOnly/required → kein Throw", () => {
     const feature = defineFeature("shop", (r) => {
       r.entity(

package/src/engine/__tests__/boot-validator-boot-check.test.ts

@@ -62,7 +62,7 @@ describe("r.bootCheck / validateFeatureBootChecks", () => {
   });
 
   test("no PII field → boot succeeds even without the companion", () => {
-    const noPiiFields = { text: createTextField() };
+    const noPiiFields = { text: createTextField({ personal: false, reason: "test_fixture" }) };
     const noPii = defineFeature("prompt-store-no-pii", (r) => {
       r.entity("note", createEntity({ fields: noPiiFields }));
       r.bootCheck(({ features }) => {

package/src/engine/__tests__/boot-validator-pii-retention.test.ts

@@ -40,6 +40,17 @@ import type { LongTextFieldDef, TextFieldDef } from "../types";
 const rawField = <T>(f: T) => f as unknown as TextFieldDef;
 const rawLongTextField = <T>(f: T) => f as unknown as LongTextFieldDef;
 
+// The heuristics under test only fire without a personal stance; after #2810
+// the factories can no longer produce that shape.
+const unannotatedText: TextFieldDef = {
+  type: "text",
+  maxLength: 200,
+  required: false,
+  searchable: false,
+  sortable: false,
+};
+const unannotatedLongText: LongTextFieldDef = { type: "longText", required: false };
+
 // Stubt einen leeren `<entity>:list`-Query-Handler damit der reference-
 // Field-Boot-Validator den Audit-Fix-#2-Check durchläßt. Wird gebraucht
 // wenn ein Test ein reference-Feld benutzt — sonst liefert der validator
@@ -136,7 +147,7 @@ describe("validateBoot — PII annotations", () => {
         createEntity({
           fields: {
             confused: rawField({
-              ...createTextField(),
+              ...unannotatedText,
               pii: true,
               tenantOwned: true,
             }),
@@ -153,7 +164,7 @@ describe("validateBoot — PII annotations", () => {
         "vault",
         createEntity({
           fields: {
-            apiToken: createTextField({ sensitive: true }),
+            apiToken: { ...unannotatedText, sensitive: true },
           },
         }),
       );
@@ -188,7 +199,7 @@ describe("validateBoot — PII annotations", () => {
           "vault",
           createEntity({
             fields: {
-              apiToken: createTextField({ sensitive: true, encrypted: true }),
+              apiToken: { ...unannotatedText, sensitive: true, encrypted: true },
             },
           }),
         );
@@ -228,7 +239,7 @@ describe("validateBoot — PII annotations", () => {
               personal: { of: "authorId" },
               find: "none",
             }),
-            authorId: createTextField(),
+            authorId: { ...unannotatedText },
           },
         }),
       );
@@ -258,7 +269,7 @@ describe("validateBoot — PII annotations", () => {
 
   test("userOwned.ownerField referencing non-user entity warns", () => {
     const feature = defineFeature("test", (r) => {
-      r.entity("employee", createEntity({ fields: { name: createTextField() } }));
+      r.entity("employee", createEntity({ fields: { name: { ...unannotatedText } } }));
       stubListHandler(r, "employee");
       r.entity(
         "personalNote",
@@ -286,7 +297,7 @@ describe("validateBoot — PII annotations", () => {
         "thing",
         createEntity({
           fields: {
-            email: createTextField(),
+            email: { ...unannotatedText },
           },
         }),
       );
@@ -304,7 +315,7 @@ describe("validateBoot — PII annotations", () => {
         "thing",
         createEntity({
           fields: {
-            body: createLongTextField(),
+            body: { ...unannotatedLongText },
           },
         }),
       );
@@ -322,7 +333,7 @@ describe("validateBoot — PII annotations", () => {
         "thing",
         createEntity({
           fields: {
-            authorId: createTextField(),
+            authorId: { ...unannotatedText },
           },
         }),
       );
@@ -563,7 +574,7 @@ describe("validateBoot — PII annotations", () => {
         "product",
         createEntity({
           fields: {
-            name: createTextField(),
+            name: { ...unannotatedText },
           },
         }),
       );
@@ -581,7 +592,7 @@ describe("validateBoot — PII annotations", () => {
         "person",
         createEntity({
           fields: {
-            displayName: createTextField(),
+            displayName: { ...unannotatedText },
           },
         }),
       );
@@ -626,7 +637,7 @@ describe("validateBoot — retention", () => {
         "auditEvent",
         createEntity({
           fields: {
-            note: createTextField(),
+            note: { ...unannotatedText },
           },
           retention: { keepFor: "1y", strategy: "hardDelete", reference: "createdAt" },
         }),
@@ -641,7 +652,7 @@ describe("validateBoot — retention", () => {
         "thing",
         createEntity({
           fields: {
-            note: createTextField(),
+            note: { ...unannotatedText },
           },
           retention: { keepFor: "30d", strategy: "hardDelete", reference: "ghostField" },
         }),
@@ -852,7 +863,7 @@ describe("validateBoot — lookupable / blind-index (#818)", () => {
         createEntity({
           fields: {
             slug: rawField({
-              ...createTextField(),
+              ...unannotatedText,
               lookupable: true,
             }),
           },
@@ -872,7 +883,7 @@ describe("validateBoot — lookupable / blind-index (#818)", () => {
               ...createLongTextField({ personal: { of: "ownerId" }, find: "none" }),
               lookupable: true,
             }),
-            ownerId: createTextField({ required: true }),
+            ownerId: { ...unannotatedText, required: true },
           },
         }),
       );
@@ -922,7 +933,7 @@ describe("validateBoot — lookupable / blind-index (#818)", () => {
         createEntity({
           fields: {
             passwordHash: rawField({
-              ...createTextField(),
+              ...unannotatedText,
               pii: true,
               sensitive: true,
               searchable: true,