@cosmicdrift/kumiko-framework 0.265.0 → 0.266.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.265.0",
+  "version": "0.266.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,7 +198,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.265.0",
+    "@cosmicdrift/kumiko-types": "0.266.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -214,7 +214,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.265.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.266.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,24 @@
 [
+  {
+    "version": "0.266.0",
+    "type": "breaking",
+    "title": "`publicIntake` is removed; an openToAll write handler declares unbound personal data with `openToAll: { reason, personalData: \"tenant-members\" }`.",
+    "detail": "`OpenToAllAccessRule.publicIntake` (`@cosmicdrift/kumiko-types/handlers`) no longer exists. `OpenToAllDeclaration` gains `personalData?: OpenToAllPersonalData`, a named union (currently only `\"tenant-members\"`, exported from `@cosmicdrift/kumiko-framework/engine` and `/ui-types`): signed-in tenant members may write personal data that no owner rule binds to the caller. The deprecated `openToAll: true` form cannot carry it. `validateAccessDeclarations` requires `personalData: \"tenant-members\"` for a write handler with `openToAll` whose input accepts a personal-data field that is not owner- or self-bound, rejects `personalData` on query and stream handlers, and rejects any other `personalData` value from untyped sources. `openToAll` never admits anonymous callers, so there is no public-intake value; anonymous personal-data intake is tracked separately. The feature-AST extractor reads `openToAll.personalData` and no longer reads `publicIntake`. Bundled `user:update` now declares `openToAll: { reason, personalData: \"tenant-members\" }`: `userEntity` has no entity-level `access.write`, and privileged actors may edit any user.",
+    "migration": "Replace `access: { openToAll: { reason: \"...\" }, publicIntake: true }` (or `openToAll: true, publicIntake: true`) with `access: { openToAll: { reason: \"<why any signed-in tenant member may write this personal data>\", personalData: \"tenant-members\" } }`. Handlers whose personal-data fields are owner- or self-bound through the entity's `access.write` need no declaration. A `publicIntake` key left in an untyped access object (pattern JSON, Designer) is ignored, so the handler fails boot until migrated. No known consumer used `publicIntake`."
+  },
+  {
+    "version": "0.266.0",
+    "type": "breaking",
+    "title": "The openToAll personal-data boot check now finds personal-data fields nested anywhere in a write handler's input schema.",
+    "detail": "`validateAccessDeclarations` (`engine/boot-validator/access-declarations.ts`) previously compared only the top-level keys of a `z.object` input schema (unwrapping `.optional()`/`.nullable()`/`.default()`) against the handler entity's personal-data fields (pii / userOwned / recordOwned); any other schema shape was skipped. It now collects object keys at every depth via `collectZodObjectKeys` (`engine/boot-validator/zod-shape.ts`): through `z.intersection`, `z.union`/`z.discriminatedUnion`/`z.xor`, `.transform()`/`z.preprocess()`/`.pipe()`/codecs, `.optional()`/`.nullable()`/`.default()`/`.prefault()`/`.nonoptional()`/`.readonly()`/`.catch()`/`z.lazy()`, nested objects (e.g. the update shape `{ id, version, changes: {...} }`), arrays, tuples and records. An update handler that accepted the same personal-data field as its create handler used to pass boot while the create handler failed. A schema with more than 10000 distinct nodes (typically a `z.lazy()` getter that returns a new schema on every call) throws at boot instead of looping. Which entity's fields are compared is unchanged: the handler's mapped entity, or every entity of the feature for an unmapped handler.",
+    "migration": "A write handler with `openToAll` whose input accepts a personal-data field of its entity inside an intersection, union, pipe/transform, nested object (update `changes`), array or record now fails boot like a top-level field always did. Known: kumiko-enterprise kumiko-credit `update` (intersection) and `bauspar:update` (`changes.name`) under `trustDomain: \"tenant\"` or with an `access` map that grants any role `\"all\"`. For each affected handler, bind the entity's rows to the caller (owner-binding entry in this release), restrict `access` to roles, or declare `openToAll: { reason: \"...\", personalData: \"tenant-members\" }`."
+  },
+  {
+    "version": "0.266.0",
+    "type": "improvement",
+    "title": "Owner- and self-bound personal-data fields no longer need a declaration on openToAll write handlers.",
+    "detail": "A personal-data field is exempt from the openToAll personal-data boot check when it is bound to the caller: the handler maps to exactly one entity, that entity's `access.write` is a non-empty `OwnershipMap` in which every role's rule is `from(\"user:id\", <column>)` on the binding column, the handler declares no `escapeHatch`, and its feature is not `r.systemScope()`. The binding column is the owner field for `personal: { of: \"<ownerField>\" }` (userOwned), and `id` for `personal: \"self\"` and `personal: { of: \"id\" }` — there the row itself is the caller. The event-store executor enforces such a map on every write: create rejects a row whose binding column is not the caller (`ownership_denied`), update checks the old and the new row, delete/restore the existing row. Not exempt: a missing or empty `access.write`, any `\"all\"` rule (also next to binding rules), a rule on another column, `user:tenantId` or claim refs, `where` rules, `self` fields on an entity without `from(\"user:id\", \"id\")`, handlers not mapped to a single entity, handlers with `escapeHatch` and handlers of `r.systemScope()` features (both can write around the executor via `db.global()`, `systemDb` or a SYSTEM identity)."
+  },
   {
     "version": "0.265.0",
     "type": "improvement",

package/src/engine/boot-validator/__tests__/access-declarations.test.ts

@@ -2,7 +2,9 @@ import { describe, expect, test } from "bun:test";
 import { z } from "zod";
 import { defineFeature } from "../../define-feature";
 import { createEntity, createTextField } from "../../factories";
-import type { AccessRule } from "../../types";
+import { from } from "../../ownership";
+import { buildInsertSchema, buildUpdateSchema } from "../../schema-builder";
+import type { AccessRule, EntityDefinition, OwnershipMap, WriteHandlerDef } from "../../types";
 import { validateAccessDeclarations } from "../access-declarations";
 
 const noteEntity = createEntity({
@@ -142,8 +144,8 @@ describe("validateAccessDeclarations", () => {
     expect(() => validateAccessDeclarations(feature)).not.toThrow();
   });
 
-  // 3. openToAll write handler accepting a personal-data field needs publicIntake.
-  test("openToAll write handler accepting a personal-data field without publicIntake throws", () => {
+  // 3. openToAll write handler accepting an unbound personal-data field needs personalData.
+  test("openToAll write handler accepting a personal-data field without personalData throws", () => {
     const feature = defineFeature("notes", (r) => {
       r.entity("note", noteEntity);
       r.writeHandler(
@@ -154,16 +156,17 @@ describe("validateAccessDeclarations", () => {
           data: {},
         }),
         {
-          access: { openToAll: { reason: "public signup" } },
+          access: { openToAll: { reason: "members share contacts" } },
         },
       );
     });
     expect(() => validateAccessDeclarations(feature)).toThrow(/Feature notes/);
     expect(() => validateAccessDeclarations(feature)).toThrow(/"note:create"/);
     expect(() => validateAccessDeclarations(feature)).toThrow(/"email"/);
+    expect(() => validateAccessDeclarations(feature)).toThrow(/personalData: "tenant-members"/);
   });
 
-  test("openToAll write handler accepting a personal-data field WITH publicIntake boots fine", () => {
+  test('openToAll write handler accepting a personal-data field WITH personalData: "tenant-members" boots fine', () => {
     const feature = defineFeature("notes", (r) => {
       r.entity("note", noteEntity);
       r.writeHandler(
@@ -174,53 +177,366 @@ describe("validateAccessDeclarations", () => {
           data: {},
         }),
         {
-          access: { openToAll: { reason: "public signup" }, publicIntake: true },
+          access: {
+            openToAll: { reason: "members share contacts", personalData: "tenant-members" },
+          },
         },
       );
     });
     expect(() => validateAccessDeclarations(feature)).not.toThrow();
   });
 
-  // 4. publicIntake is only meaningful on a write handler.
-  test("publicIntake on a query handler throws", () => {
+  test("an unknown personalData value from an untyped source throws", () => {
+    const feature = defineFeature("notes", (r) => {
+      r.entity("note", noteEntity);
+      r.writeHandler(
+        "note:create",
+        z.object({ title: z.string() }),
+        async () => ({ isSuccess: true as const, data: {} }),
+        {
+          // @cast-boundary test — simulates JSON/Designer input that doesn't match the static union
+          access: {
+            openToAll: { reason: "signup", personalData: "public-intake" },
+          } as unknown as AccessRule,
+        },
+      );
+    });
+    expect(() => validateAccessDeclarations(feature)).toThrow(/"public-intake"/);
+  });
+
+  test("the removed publicIntake flag no longer type-checks and no longer exempts", () => {
+    const access: AccessRule = {
+      openToAll: { reason: "members share contacts" },
+      // @ts-expect-error publicIntake was replaced by openToAll.personalData
+      publicIntake: true,
+    };
+    const feature = defineFeature("notes", (r) => {
+      r.entity("note", noteEntity);
+      r.writeHandler(
+        "note:create",
+        z.object({ email: z.string() }),
+        async () => ({ isSuccess: true as const, data: {} }),
+        { access },
+      );
+    });
+    expect(() => validateAccessDeclarations(feature)).toThrow(/"email"/);
+  });
+
+  test("the deprecated openToAll: true form cannot carry personalData", () => {
+    // @ts-expect-error personalData lives only on the { reason } object form
+    const access: AccessRule = { openToAll: true, personalData: "tenant-members" };
+    expect(access).toBeDefined();
+  });
+
+  // 4. personalData is only meaningful on a write handler.
+  test("personalData on a query handler throws", () => {
     const feature = defineFeature("notes", (r) => {
       r.entity("note", noteEntity);
       r.queryHandler("note:list", z.object({}), async () => [], {
-        access: { openToAll: { reason: "public listing" }, publicIntake: true },
+        access: { openToAll: { reason: "member listing", personalData: "tenant-members" } },
       });
     });
     expect(() => validateAccessDeclarations(feature)).toThrow(/Feature notes/);
     expect(() => validateAccessDeclarations(feature)).toThrow(/"note:list"/);
   });
 
-  test("query handler without publicIntake boots fine", () => {
+  test("query handler without personalData boots fine", () => {
     const feature = defineFeature("notes", (r) => {
       r.entity("note", noteEntity);
       r.queryHandler("note:list", z.object({}), async () => [], {
-        access: { openToAll: { reason: "public listing" } },
+        access: { openToAll: { reason: "member listing" } },
       });
     });
     expect(() => validateAccessDeclarations(feature)).not.toThrow();
   });
 
-  test("publicIntake on a stream handler throws", () => {
+  test("personalData on a stream handler throws", () => {
     const feature = defineFeature("notes", (r) => {
       r.entity("note", noteEntity);
       r.streamHandler("note:watch", z.object({}), async function* () {}, {
-        access: { openToAll: { reason: "public stream" }, publicIntake: true },
+        access: { openToAll: { reason: "member stream", personalData: "tenant-members" } },
       });
     });
     expect(() => validateAccessDeclarations(feature)).toThrow(/Feature notes/);
     expect(() => validateAccessDeclarations(feature)).toThrow(/"note:watch"/);
   });
 
-  test("stream handler without publicIntake boots fine", () => {
+  test("stream handler without personalData boots fine", () => {
     const feature = defineFeature("notes", (r) => {
       r.entity("note", noteEntity);
       r.streamHandler("note:watch", z.object({}), async function* () {}, {
-        access: { openToAll: { reason: "public stream" } },
+        access: { openToAll: { reason: "member stream" } },
       });
     });
     expect(() => validateAccessDeclarations(feature)).not.toThrow();
   });
 });
+
+const openToAll = { openToAll: { reason: "any member may edit" } } as const;
+
+function featureWithWriteHandler(
+  schema: z.ZodType,
+  options: Pick<WriteHandlerDef, "access" | "escapeHatch"> = { access: openToAll },
+  handlerName = "note:update",
+  entity: EntityDefinition = noteEntity,
+) {
+  return defineFeature("notes", (r) => {
+    r.entity("note", entity);
+    r.writeHandler(
+      handlerName,
+      schema,
+      async () => ({ isSuccess: true as const, data: {} }),
+      options,
+    );
+  });
+}
+
+describe("validateAccessDeclarations — personal-data fields beyond a top-level object", () => {
+  test.each([
+    ["intersection", z.intersection(z.object({ email: z.string() }), z.object({ id: z.string() }))],
+    ["union", z.union([z.object({ email: z.string() }), z.object({ title: z.string() })])],
+    [
+      "discriminated union",
+      z.discriminatedUnion("kind", [
+        z.object({ kind: z.literal("a"), email: z.string() }),
+        z.object({ kind: z.literal("b"), title: z.string() }),
+      ]),
+    ],
+    ["transform", z.object({ email: z.string() }).transform((v) => v)],
+    ["preprocess", z.preprocess((v) => v, z.object({ email: z.string() }))],
+    ["pipe", z.unknown().pipe(z.object({ email: z.string() }))],
+    ["readonly", z.object({ email: z.string() }).readonly()],
+    ["catch", z.object({ email: z.string() }).catch({ email: "" })],
+    [
+      "wrapper around intersection",
+      z.intersection(z.object({ email: z.string() }), z.object({})).optional(),
+    ],
+    [
+      "nested update changes",
+      z.object({
+        id: z.string(),
+        version: z.number(),
+        changes: z.object({ email: z.string() }).partial(),
+      }),
+    ],
+    ["array of objects", z.object({ entries: z.array(z.object({ email: z.string() })) })],
+    [
+      "record of objects",
+      z.object({ byId: z.record(z.string(), z.object({ email: z.string() })) }),
+    ],
+    [
+      "lazy",
+      z.object({ inner: z.lazy(() => z.object({ email: z.string().nullable().default(null) })) }),
+    ],
+  ])("openToAll write handler with a personal-data field inside a %s throws", (_label, schema) => {
+    const feature = featureWithWriteHandler(schema);
+    expect(() => validateAccessDeclarations(feature)).toThrow(/"note:update"/);
+    expect(() => validateAccessDeclarations(feature)).toThrow(/"email"/);
+  });
+
+  test("recursive lazy schema terminates and still finds the field", () => {
+    type Tree = { email?: string; children: Tree[] };
+    const tree: z.ZodType<Tree> = z.lazy(() =>
+      z.object({ email: z.string().optional(), children: z.array(tree) }),
+    );
+    expect(() => validateAccessDeclarations(featureWithWriteHandler(tree))).toThrow(/"email"/);
+  });
+
+  test("a lazy getter that builds a new schema on every call fails loudly instead of looping", () => {
+    const endless = (): z.ZodType => z.object({ title: z.string(), next: z.lazy(endless) });
+    expect(() => validateAccessDeclarations(featureWithWriteHandler(endless()))).toThrow(
+      /more than 10000 nodes/,
+    );
+  });
+
+  // Mirrors kumiko-credit's `update` (intersection of a refined object with { id })
+  // and `bauspar:update` ({ id, version, changes }) on a tenant-trust entity.
+  test("credit-style update schemas without owner binding throw", () => {
+    const credit = createEntity({
+      table: "fw_access_pii_credit",
+      fields: {
+        name: createTextField({ personal: { of: "ownerUserId" }, find: "none" }),
+        ownerUserId: createTextField({ required: false, personal: "ref" }),
+      },
+    });
+    const refined = z.object({ name: z.string() }).refine((c) => c.name.length > 0);
+    const intersectionUpdate = z.intersection(refined, z.object({ id: z.string() }));
+    const changesUpdate = z.object({
+      id: z.uuid(),
+      version: z.number(),
+      changes: buildUpdateSchema(credit).omit({ ownerUserId: true }),
+    });
+    for (const schema of [intersectionUpdate, changesUpdate]) {
+      const feature = featureWithWriteHandler(schema, { access: openToAll }, "note:update", credit);
+      expect(() => validateAccessDeclarations(feature)).toThrow(/"name"/);
+    }
+  });
+});
+
+describe("validateAccessDeclarations — owner-bound personal-data fields", () => {
+  function ownedNoteEntity(write: OwnershipMap | undefined) {
+    return createEntity({
+      table: "fw_access_pii_owned_notes",
+      fields: {
+        name: createTextField({ personal: { of: "ownerUserId" }, find: "none" }),
+        ownerUserId: createTextField({ required: false, personal: "ref" }),
+        assigneeId: createTextField({ required: false, personal: "ref" }),
+      },
+      ...(write && { access: { read: write, write } }),
+    });
+  }
+
+  const ownerBound: OwnershipMap = { Member: from("user:id", "ownerUserId") };
+  const createSchema = z.object({ name: z.string() });
+  const updateSchema = z.object({
+    id: z.string(),
+    version: z.number(),
+    changes: z.object({ name: z.string() }).partial(),
+  });
+
+  test.each([
+    ["create", createSchema],
+    ["update", updateSchema],
+  ])(
+    "%s on an entity whose every write role is bound to the field's owner boots fine",
+    (_l, schema) => {
+      const multiRole: OwnershipMap = { ...ownerBound, Viewer: from("user:id", "ownerUserId") };
+      for (const map of [ownerBound, multiRole]) {
+        const feature = featureWithWriteHandler(
+          schema,
+          { access: openToAll },
+          "note:update",
+          ownedNoteEntity(map),
+        );
+        expect(() => validateAccessDeclarations(feature)).not.toThrow();
+      }
+    },
+  );
+
+  test.each<[string, OwnershipMap | undefined]>([
+    ["no access.write", undefined],
+    ["empty access.write", {}],
+    ['an "all" rule', { Member: "all" }],
+    ['an owner rule plus an "all" role', { ...ownerBound, TenantAdmin: "all" }],
+    ["an owner rule on a different column", { Member: from("user:id", "assigneeId") }],
+    ["a user:tenantId rule on the owner column", { Member: from("user:tenantId", "ownerUserId") }],
+    ["a claim rule on the owner column", { Member: from("claim:crm:ownerUserId", "ownerUserId") }],
+    ["a where rule", { Member: { kind: "where", where: () => ({ sqlText: "TRUE", params: [] }) } }],
+  ])("owner-annotated field on an entity with %s still throws", (_label, map) => {
+    const feature = featureWithWriteHandler(
+      createSchema,
+      { access: openToAll },
+      "note:update",
+      ownedNoteEntity(map),
+    );
+    expect(() => validateAccessDeclarations(feature)).toThrow(/"name"/);
+  });
+
+  test.each([
+    ["self", createTextField({ personal: "self", find: "none" })],
+    ["record-owned", createTextField({ personal: { of: "id" }, find: "none" })],
+  ])("a %s field is not exempted by an owner-bound write map", (_label, field) => {
+    const entity = createEntity({
+      table: "fw_access_pii_mixed_notes",
+      fields: {
+        email: field,
+        ownerUserId: createTextField({ required: false, personal: "ref" }),
+      },
+      access: { write: ownerBound },
+    });
+    const schema = z.object({ email: z.string() });
+    const feature = featureWithWriteHandler(schema, { access: openToAll }, "note:update", entity);
+    expect(() => validateAccessDeclarations(feature)).toThrow(/"email"/);
+  });
+
+  test("a handler with escapeHatch is not exempted — it can write around the executor", () => {
+    const feature = featureWithWriteHandler(
+      createSchema,
+      { access: openToAll, escapeHatch: { reason: "bulk import" } },
+      "note:update",
+      ownedNoteEntity(ownerBound),
+    );
+    expect(() => validateAccessDeclarations(feature)).toThrow(/"name"/);
+  });
+
+  test("a handler not mapped to a single entity is not exempted (fail-closed)", () => {
+    const feature = defineFeature("notes", (r) => {
+      r.entity("note", ownedNoteEntity(ownerBound));
+      r.entity("memo", noteEntity);
+      r.writeHandler("submit", createSchema, async () => ({ isSuccess: true as const, data: {} }), {
+        access: openToAll,
+      });
+    });
+    expect(feature.handlerEntityMappings["submit"]).toBeUndefined();
+    expect(() => validateAccessDeclarations(feature)).toThrow(/"name"/);
+  });
+
+  test("an insert schema built from the owner-bound entity boots fine", () => {
+    const entity = ownedNoteEntity(ownerBound);
+    const schema = buildInsertSchema(entity).omit({ ownerUserId: true, assigneeId: true });
+    const feature = featureWithWriteHandler(schema, { access: openToAll }, "note:create", entity);
+    expect(() => validateAccessDeclarations(feature)).not.toThrow();
+  });
+});
+
+describe("validateAccessDeclarations — self-bound personal-data fields", () => {
+  const selfBound: OwnershipMap = { Member: from("user:id", "id") };
+
+  function profileEntity(write: OwnershipMap | undefined) {
+    return createEntity({
+      table: "fw_access_pii_profiles",
+      fields: {
+        displayName: createTextField({ personal: "self", find: "none" }),
+        bio: createTextField({ personal: { of: "id" }, find: "none" }),
+      },
+      ...(write && { access: { write } }),
+    });
+  }
+
+  const profileUpdate = z.object({
+    id: z.string(),
+    version: z.number(),
+    changes: z.object({ displayName: z.string(), bio: z.string() }).partial(),
+  });
+
+  test('self and record-owned fields on an entity whose every write role is from("user:id", "id") boot fine', () => {
+    const multiRole: OwnershipMap = { ...selfBound, Viewer: from("user:id", "id") };
+    for (const map of [selfBound, multiRole]) {
+      const feature = featureWithWriteHandler(
+        profileUpdate,
+        { access: openToAll },
+        "note:update",
+        profileEntity(map),
+      );
+      expect(() => validateAccessDeclarations(feature)).not.toThrow();
+    }
+  });
+
+  test.each<[string, OwnershipMap | undefined]>([
+    ["no access.write", undefined],
+    ["an owner rule on another column", { Member: from("user:id", "ownerUserId") }],
+    ['a from("user:id", "id") rule plus an "all" role', { ...selfBound, TenantAdmin: "all" }],
+  ])("a self field on an entity with %s still throws", (_label, map) => {
+    const feature = featureWithWriteHandler(
+      profileUpdate,
+      { access: openToAll },
+      "note:update",
+      profileEntity(map),
+    );
+    expect(() => validateAccessDeclarations(feature)).toThrow(/"displayName"/);
+  });
+
+  test("a self-bound entity in an r.systemScope() feature is not exempted", () => {
+    const feature = defineFeature("notes", (r) => {
+      r.systemScope();
+      r.entity("note", profileEntity(selfBound));
+      r.writeHandler(
+        "note:update",
+        profileUpdate,
+        async () => ({ isSuccess: true as const, data: {} }),
+        { access: openToAll },
+      );
+    });
+    expect(() => validateAccessDeclarations(feature)).toThrow(/"displayName"/);
+  });
+});

package/src/engine/boot-validator/access-declarations.ts

@@ -1,38 +1,88 @@
-import type { AccessRule, FeatureDefinition, QueryHandlerDef, WriteHandlerDef } from "../types";
+import type {
+  AccessRule,
+  FeatureDefinition,
+  OwnershipMap,
+  OwnershipRule,
+  QueryHandlerDef,
+  WriteHandlerDef,
+} from "../types";
 import type { EntityDefinition, ResolvedPiiFlags } from "../types/fields";
-import { getZodObjectShape } from "./zod-shape";
+import { collectZodObjectKeys } from "./zod-shape";
 
 type HandlerKind = "write" | "query" | "stream";
 
 // Personal-data annotation check mirrors pii-retention.ts's hasAnonymizableSubjectField,
 // minus tenantOwned: a tenant-scoped field isn't an individual's personal data in the
-// sense openToAll+publicIntake is guarding against.
+// sense the openToAll personal-data check is guarding against.
 function isPersonalDataField(field: unknown): boolean {
   const annot = field as ResolvedPiiFlags; // @cast-boundary schema-walk — see pii-retention.ts
   return Boolean(annot.pii || annot.userOwned || annot.recordOwned);
 }
 
-function personalFieldNames(entity: EntityDefinition): ReadonlySet<string> {
+function isCallerIdRuleOn(rule: OwnershipRule, column: string): boolean {
+  if (rule === "all" || rule.kind !== "from") return false;
+  return rule.refKind === "user" && rule.refPath === "id" && rule.column === column;
+}
+
+// The executor checks access.write against every created/updated row; one "all" role
+// or an empty map (= public) lets a caller write rows owned by someone else.
+function writeMapBindsRowsToCaller(
+  writeMap: OwnershipMap | undefined,
+  ownerColumn: string,
+): boolean {
+  const rules = Object.values(writeMap ?? {});
+  return rules.length > 0 && rules.every((rule) => isCallerIdRuleOn(rule, ownerColumn));
+}
+
+const ROW_ID_COLUMN = "id";
+
+// A self/record-owned field's subject is the row itself, so only from("user:id", "id")
+// makes that row the caller — on any other entity "self" names a third party.
+function callerBindingColumn(annot: ResolvedPiiFlags): string | undefined {
+  if (annot.userOwned) return annot.userOwned.ownerField;
+  if (annot.pii || annot.recordOwned) return ROW_ID_COLUMN;
+  return undefined;
+}
+
+function isOwnerBoundField(field: unknown, entity: EntityDefinition): boolean {
+  const column = callerBindingColumn(field as ResolvedPiiFlags); // @cast-boundary schema-walk — see pii-retention.ts
+  return column !== undefined && writeMapBindsRowsToCaller(entity.access?.write, column);
+}
+
+function personalFieldNames(
+  entity: EntityDefinition,
+  honorOwnerBinding: boolean,
+): ReadonlySet<string> {
   const names = new Set<string>();
   for (const [fieldName, field] of Object.entries(entity.fields)) {
-    if (isPersonalDataField(field)) names.add(fieldName);
+    const exempt = honorOwnerBinding && isOwnerBoundField(field, entity);
+    if (isPersonalDataField(field) && !exempt) names.add(fieldName);
   }
   return names;
 }
 
+// escapeHatch and r.systemScope() can write around the entity's write map
+// (db.global(), systemDb, SYSTEM identity), so the map no longer vouches for the row.
+function canWriteAroundExecutor(feature: FeatureDefinition, handler: WriteHandlerDef): boolean {
+  return handler.escapeHatch !== undefined || feature.systemScope;
+}
+
+// Owner binding counts only for a handler mapped to one entity.
 function candidatePersonalFieldNames(
   feature: FeatureDefinition,
   handlerName: string,
+  handler: WriteHandlerDef,
 ): ReadonlySet<string> {
   const mappedEntityName = feature.handlerEntityMappings?.[handlerName];
   const entities = feature.entities ?? {};
   if (mappedEntityName) {
     const entity = entities[mappedEntityName];
-    return entity ? personalFieldNames(entity) : new Set();
+    const honorOwnerBinding = !canWriteAroundExecutor(feature, handler);
+    return entity ? personalFieldNames(entity, honorOwnerBinding) : new Set();
   }
   const names = new Set<string>();
   for (const entity of Object.values(entities)) {
-    for (const name of personalFieldNames(entity)) names.add(name);
+    for (const name of personalFieldNames(entity, false)) names.add(name);
   }
   return names;
 }
@@ -52,8 +102,16 @@ function hasOpenToAll(access: AccessRule): boolean {
   return "openToAll" in access;
 }
 
-function hasPublicIntake(access: AccessRule): boolean {
-  return "publicIntake" in access && access.publicIntake === true;
+// Read via `unknown`: access can come from untyped sources (pattern JSON, Designer).
+function declaredPersonalData(access: AccessRule): unknown {
+  if (!("openToAll" in access)) return undefined;
+  const openToAll: unknown = access.openToAll;
+  if (typeof openToAll !== "object" || openToAll === null) return undefined;
+  return "personalData" in openToAll ? openToAll.personalData : undefined;
+}
+
+function declaresTenantMembersPersonalData(access: AccessRule): boolean {
+  return declaredPersonalData(access) === "tenant-members";
 }
 
 function validateOpenToAllReason(
@@ -86,19 +144,32 @@ function validateEscapeHatchReason(
   );
 }
 
-function validatePublicIntakeOnlyOnWrite(
+function validatePersonalDataOnlyOnWrite(
   feature: FeatureDefinition,
   kind: HandlerKind,
   handlerName: string,
   access: AccessRule,
 ): void {
-  // skip: write handlers may declare publicIntake, or it wasn't declared here
-  if (kind === "write" || !hasPublicIntake(access)) return;
+  // skip: write handlers may declare personalData, or it wasn't declared here
+  if (kind === "write" || declaredPersonalData(access) === undefined) return;
   throw new Error(
     `[Feature ${feature.name}] ${kind} handler "${handlerName}" declares ` +
-      "{ publicIntake: true } — publicIntake is only meaningful on a write handler " +
-      "(it silences the personal-data + openToAll boot check for the fields a write " +
-      "handler's input accepts).",
+      "openToAll.personalData — it only applies to write handlers, whose input is " +
+      "checked for personal-data fields.",
+  );
+}
+
+function validatePersonalDataValue(
+  feature: FeatureDefinition,
+  handlerName: string,
+  access: AccessRule,
+): void {
+  const declared = declaredPersonalData(access);
+  // skip: nothing declared, or the one supported value
+  if (declared === undefined || declared === "tenant-members") return;
+  throw new Error(
+    `[Feature ${feature.name}] write handler "${handlerName}" declares an unknown ` +
+      `openToAll.personalData ${JSON.stringify(declared)} — the only supported value is "tenant-members".`,
   );
 }
 
@@ -108,20 +179,22 @@ function validateOpenToAllPersonalData(
   handler: WriteHandlerDef,
 ): void {
   const access = handler.access;
-  // skip: no openToAll declared, or publicIntake already covers personal data
-  if (!hasOpenToAll(access) || hasPublicIntake(access)) return;
-  const shape = getZodObjectShape(handler.schema);
-  // skip: handler schema isn't a zod object — nothing to inspect
-  if (!shape) return;
-  const personalNames = candidatePersonalFieldNames(feature, handlerName);
-  const offending = Object.keys(shape).filter((key) => personalNames.has(key));
+  // skip: no openToAll declared, or the handler declares tenant members may write personal data
+  if (!hasOpenToAll(access) || declaresTenantMembersPersonalData(access)) return;
+  const inputKeys = collectZodObjectKeys(handler.schema);
+  const personalNames = candidatePersonalFieldNames(feature, handlerName, handler);
+  const offending = [...inputKeys].filter((key) => personalNames.has(key));
   // skip: no personal-data fields in the handler's input
   if (offending.length === 0) return;
   throw new Error(
     `[Feature ${feature.name}] write handler "${handlerName}" declares openToAll and ` +
-      `accepts personal-data field(s) ${offending.map((f) => `"${f}"`).join(", ")} without ` +
-      "{ publicIntake: true }. Restrict access to roles, or declare " +
-      "{ publicIntake: true } if any authenticated user may submit this personal data.",
+      `accepts personal-data field(s) ${offending.map((f) => `"${f}"`).join(", ")} that are ` +
+      "not bound to the caller. Choose one: (1) bind rows to the caller — every role in the " +
+      'entity\'s access.write is from("user:id", "<ownerField>") for a personal: { of: "<ownerField>" } ' +
+      'field, or from("user:id", "id") for a personal: "self" field, with no escapeHatch on the ' +
+      "handler and no r.systemScope() on its feature; (2) restrict access to roles; (3) declare " +
+      '{ openToAll: { reason: "<why any signed-in tenant member may write this personal data>", ' +
+      'personalData: "tenant-members" } }.',
   );
 }
 
@@ -129,15 +202,16 @@ export function validateAccessDeclarations(feature: FeatureDefinition): void {
   for (const [handlerName, handler] of Object.entries(feature.writeHandlers)) {
     validateOpenToAllReason(feature, "write", handlerName, handler.access);
     validateEscapeHatchReason(feature, "write", handlerName, handler.escapeHatch);
+    validatePersonalDataValue(feature, handlerName, handler.access);
     validateOpenToAllPersonalData(feature, handlerName, handler);
   }
   for (const [handlerName, handler] of Object.entries(feature.queryHandlers)) {
     validateOpenToAllReason(feature, "query", handlerName, handler.access);
     validateEscapeHatchReason(feature, "query", handlerName, handler.escapeHatch);
-    validatePublicIntakeOnlyOnWrite(feature, "query", handlerName, handler.access);
+    validatePersonalDataOnlyOnWrite(feature, "query", handlerName, handler.access);
   }
   for (const [handlerName, handler] of Object.entries(feature.streamHandlers)) {
     validateOpenToAllReason(feature, "stream", handlerName, handler.access);
-    validatePublicIntakeOnlyOnWrite(feature, "stream", handlerName, handler.access);
+    validatePersonalDataOnlyOnWrite(feature, "stream", handlerName, handler.access);
   }
 }

package/src/engine/boot-validator/zod-shape.ts

@@ -1,4 +1,23 @@
-import { ZodArray, ZodDefault, ZodNullable, ZodObject, ZodOptional, type ZodType } from "zod";
+import {
+  ZodArray,
+  ZodCatch,
+  ZodDefault,
+  ZodIntersection,
+  ZodLazy,
+  ZodNonOptional,
+  ZodNullable,
+  ZodObject,
+  ZodOptional,
+  ZodPipe,
+  ZodPrefault,
+  ZodReadonly,
+  ZodRecord,
+  ZodTuple,
+  type ZodType,
+  ZodUnion,
+  ZodXor,
+} from "zod";
+import type { $ZodType } from "zod/v4/core";
 
 // Drills through wrapper types (.nullable(), .optional(), .default()) a
 // handler's schema may use around its actual object/array shape — e.g. a
@@ -49,3 +68,75 @@ export function getZodRowShape(schema: ZodType | undefined): Record<string, ZodT
     ? getZodObjectShape(rowsArray.element as ZodType)
     : undefined;
 }
+
+type SingleInnerSchema =
+  | ZodOptional
+  | ZodNullable
+  | ZodDefault
+  | ZodPrefault
+  | ZodNonOptional
+  | ZodCatch
+  | ZodReadonly
+  | ZodLazy;
+
+const SINGLE_INNER_SCHEMA_CLASSES = [
+  ZodOptional,
+  ZodNullable,
+  ZodDefault,
+  ZodPrefault,
+  ZodNonOptional,
+  ZodCatch,
+  ZodReadonly,
+  ZodLazy,
+] as const;
+
+function isSingleInnerSchema(schema: $ZodType): schema is SingleInnerSchema {
+  return SINGLE_INNER_SCHEMA_CLASSES.some((schemaClass) => schema instanceof schemaClass);
+}
+
+function combinatorChildSchemas(schema: $ZodType): readonly $ZodType[] {
+  if (schema instanceof ZodUnion || schema instanceof ZodXor) return schema.options;
+  if (schema instanceof ZodIntersection) return [schema.def.left, schema.def.right];
+  // z.preprocess() carries the accepted shape on `out`, .transform() on `in`.
+  if (schema instanceof ZodPipe) return [schema.in, schema.out];
+  return [];
+}
+
+function childSchemas(schema: $ZodType): readonly $ZodType[] {
+  if (schema instanceof ZodObject) return Object.values(schema.shape);
+  if (schema instanceof ZodArray) return [schema.element];
+  if (schema instanceof ZodRecord) return [schema.valueType];
+  if (schema instanceof ZodTuple) {
+    const { items, rest } = schema.def;
+    return rest ? [...items, rest] : items;
+  }
+  if (isSingleInnerSchema(schema)) return [schema.unwrap()];
+  return combinatorChildSchemas(schema);
+}
+
+// A z.lazy() getter that builds a fresh schema per call never revisits a node.
+const MAX_WALKED_SCHEMAS = 10_000;
+
+// Object keys at any depth, so a field nested in an intersection, union or an
+// update's `changes` object is found too.
+export function collectZodObjectKeys(schema: $ZodType | undefined): ReadonlySet<string> {
+  const keys = new Set<string>();
+  if (schema === undefined) return keys;
+  const visited = new Set<$ZodType>();
+  const pending: $ZodType[] = [schema];
+  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {
+    if (visited.has(next)) continue;
+    if (visited.size >= MAX_WALKED_SCHEMAS) {
+      throw new Error(
+        `collectZodObjectKeys: schema has more than ${MAX_WALKED_SCHEMAS} nodes — ` +
+          "a z.lazy() getter probably returns a new schema on every call; hoist it into a constant.",
+      );
+    }
+    visited.add(next);
+    if (next instanceof ZodObject) {
+      for (const key of Object.keys(next.shape)) keys.add(key);
+    }
+    pending.push(...childSchemas(next));
+  }
+  return keys;
+}

package/src/engine/feature-ast/__tests__/read-optional-access-rule.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from "bun:test";
+import { readOptionalAccessRule } from "../extractors/hooks";
+
+describe("readOptionalAccessRule — openToAll.personalData", () => {
+  test("keeps personalData: tenant-members on the object form", () => {
+    expect(
+      readOptionalAccessRule({
+        openToAll: { reason: "members edit their team roster", personalData: "tenant-members" },
+      }),
+    ).toEqual({
+      openToAll: { reason: "members edit their team roster", personalData: "tenant-members" },
+    });
+  });
+
+  test("drops an unknown personalData value", () => {
+    expect(
+      readOptionalAccessRule({
+        openToAll: { reason: "signup", personalData: "public-intake" },
+      }),
+    ).toEqual({ openToAll: { reason: "signup" } });
+  });
+
+  test("the deprecated openToAll: true form carries no personalData", () => {
+    expect(readOptionalAccessRule({ openToAll: true, personalData: "tenant-members" })).toEqual({
+      openToAll: true,
+    });
+  });
+});

package/src/engine/feature-ast/extractors/hooks.ts

@@ -42,12 +42,16 @@ export function readOptionalAccessRule(value: unknown): AccessRule | undefined {
   if (Array.isArray(value["roles"]) && value["roles"].every((r) => typeof r === "string")) {
     return { roles: value["roles"] as readonly string[] };
   }
-  const publicIntake = value["publicIntake"] === true ? { publicIntake: true as const } : {};
   if (value["openToAll"] === true) {
-    return { openToAll: true, ...publicIntake };
+    return { openToAll: true };
   }
-  if (isPlainObject(value["openToAll"]) && typeof value["openToAll"]["reason"] === "string") {
-    return { openToAll: { reason: value["openToAll"]["reason"] }, ...publicIntake };
+  const openToAll = value["openToAll"];
+  if (isPlainObject(openToAll) && typeof openToAll["reason"] === "string") {
+    const personalData =
+      openToAll["personalData"] === "tenant-members"
+        ? { personalData: "tenant-members" as const }
+        : {};
+    return { openToAll: { reason: openToAll["reason"], ...personalData } };
   }
   return undefined;
 }

package/src/engine/index.ts

@@ -432,6 +432,7 @@ export type {
   OnDeleteStrategy,
   OpenToAllAccessRule,
   OpenToAllDeclaration,
+  OpenToAllPersonalData,
   ParentRefDef,
   PersonalAnnotations,
   PersonalAnnotationsLongText,

package/src/engine/types/index.ts

@@ -178,6 +178,7 @@ export type {
   NotifyPriority,
   OpenToAllAccessRule,
   OpenToAllDeclaration,
+  OpenToAllPersonalData,
   QualifiedEventName,
   QueryEvent,
   QueryHandlerDef,

package/src/ui-types/index.ts

@@ -56,6 +56,7 @@ export type {
   AccessRule,
   OpenToAllAccessRule,
   OpenToAllDeclaration,
+  OpenToAllPersonalData,
 } from "../engine/types/handlers";
 export { isOpenToAllGranted } from "../engine/types/handlers";
 export type { IconKey, NavDefinition, NavIconKey } from "../engine/types/nav";