@cosmicdrift/kumiko-framework 0.269.1 → 0.270.0

package/README.md

@@ -45,7 +45,11 @@ export const taskFeature = defineFeature("tasks", (r) => {
   // control, all explicit via the options below.
   r.crud("task", taskEntity, {
     write: { access: { roles: ["User"] } },
-    read: { access: { openToAll: true } },
+    read: {
+      access: {
+        openToAll: { reason: "any signed-in user may list and view tasks; only writes are role-gated" },
+      },
+    },
   });
 
   // Read-model fed from task events, rebuildable via the CLI

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.269.1",
+  "version": "0.270.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,7 +198,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.269.1",
+    "@cosmicdrift/kumiko-types": "0.270.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -214,7 +214,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.269.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.270.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/__tests__/anonymous-access.integration.test.ts

@@ -66,7 +66,7 @@ const shopFeature = defineFeature("anonshop", (r) => {
       const rows = await selectMany(ctx.db, productTable);
       return rows;
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   // Anonymous can place a guest order.

package/src/__tests__/error-contract.integration.test.ts

@@ -149,7 +149,7 @@ const errorFeature = defineFeature("errctr", (r) => {
     async (event) => {
       throw new NotFoundError("item", event.payload.id);
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   // InternalError auto-wrap: handler raises an unexpected TypeError; the

package/src/__tests__/fixtures/migrate-db-raw/global-fetch.expected.ts

@@ -0,0 +1,9 @@
+import { userTable } from "./entities/user";
+
+export const userDetail = defineQueryHandler({
+  name: "user:detail",
+  handler: async (query, ctx) => {
+    const row = await ctx.db.global(userTable).fetchOne<UserRow>({ id: query.payload.id });
+    return row ?? null;
+  },
+});

package/src/__tests__/fixtures/migrate-db-raw/global-fetch.input.ts

@@ -0,0 +1,10 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { userTable } from "./entities/user";
+
+export const userDetail = defineQueryHandler({
+  name: "user:detail",
+  handler: async (query, ctx) => {
+    const row = await fetchOne<UserRow>(ctx.db.raw, userTable, { id: query.payload.id });
+    return row ?? null;
+  },
+});

package/src/__tests__/fixtures/migrate-db-raw/global-select.expected.ts

@@ -0,0 +1,6 @@
+import { globalFeatureStateTable } from "./entities/global-feature-state";
+
+export async function loadFlags(ctx: Ctx) {
+  const rows = await ctx.db.global(globalFeatureStateTable).selectMany<FlagRow>({ key: "beta" }, { limit: 10 });
+  return rows;
+}

package/src/__tests__/fixtures/migrate-db-raw/global-select.input.ts

@@ -0,0 +1,12 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { globalFeatureStateTable } from "./entities/global-feature-state";
+
+export async function loadFlags(ctx: Ctx) {
+  const rows = await selectMany<FlagRow>(
+    ctx.db.raw,
+    globalFeatureStateTable,
+    { key: "beta" },
+    { limit: 10 },
+  );
+  return rows;
+}

package/src/__tests__/fixtures/migrate-db-raw/import-pruning.expected.ts

@@ -0,0 +1,12 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { userTable } from "./entities/user";
+
+export const userDetail = defineQueryHandler({
+  name: "user:detail",
+  handler: async (query, ctx) => {
+    const row = await ctx.db.global(userTable).fetchOne<UserRow>({ id: query.payload.id });
+    return row ?? null;
+  },
+});
+
+export const selectManyHelper = selectMany;

package/src/__tests__/fixtures/migrate-db-raw/import-pruning.input.ts

@@ -0,0 +1,12 @@
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { userTable } from "./entities/user";
+
+export const userDetail = defineQueryHandler({
+  name: "user:detail",
+  handler: async (query, ctx) => {
+    const row = await fetchOne<UserRow>(ctx.db.raw, userTable, { id: query.payload.id });
+    return row ?? null;
+  },
+});
+
+export const selectManyHelper = selectMany;

package/src/__tests__/fixtures/migrate-db-raw/manual-only.expected.ts

@@ -0,0 +1,26 @@
+import { countWhere, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { auditTable, invoiceTable } from "./entities";
+
+export const auditWrite = defineWriteHandler({
+  name: "audit:write",
+  handler: async (event, ctx) => {
+    const tenantId = event.payload.tenantId;
+    await insertOne(ctx.db.raw, auditTable, { tenantId, action: event.payload.action });
+    const total = await countWhere(ctx.db.raw, invoiceTable, { status: "open" });
+    return { total };
+  },
+});
+
+export function bootstrapSystemDb(ctx: Ctx, x: unknown) {
+  return createTenantDb(ctx.db.raw, x, "system");
+}
+
+export const crossTenantAck = defineWriteHandler({
+  name: "cross-tenant:ack",
+  handler: async (event, ctx) => {
+    const r = { id: event.payload.id };
+    const acked = ctx.systemDb.acknowledgeCrossTenant(r).raw;
+    return { acked };
+  },
+});

package/src/__tests__/fixtures/migrate-db-raw/manual-only.input.ts

@@ -0,0 +1,26 @@
+import { countWhere, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { auditTable, invoiceTable } from "./entities";
+
+export const auditWrite = defineWriteHandler({
+  name: "audit:write",
+  handler: async (event, ctx) => {
+    const tenantId = event.payload.tenantId;
+    await insertOne(ctx.db.raw, auditTable, { tenantId, action: event.payload.action });
+    const total = await countWhere(ctx.db.raw, invoiceTable, { status: "open" });
+    return { total };
+  },
+});
+
+export function bootstrapSystemDb(ctx: Ctx, x: unknown) {
+  return createTenantDb(ctx.db.raw, x, "system");
+}
+
+export const crossTenantAck = defineWriteHandler({
+  name: "cross-tenant:ack",
+  handler: async (event, ctx) => {
+    const r = { id: event.payload.id };
+    const acked = ctx.systemDb.acknowledgeCrossTenant(r).raw;
+    return { acked };
+  },
+});

package/src/__tests__/fixtures/migrate-db-raw/own-tenant-const-shorthand.expected.ts

@@ -0,0 +1,10 @@
+import { invoiceTable } from "./entities/invoice";
+
+export const invoiceDetailQuery = defineQueryHandler({
+  name: "invoice:detail",
+  handler: async (query, ctx) => {
+    const tenantId = query.user.tenantId;
+    const row = await ctx.db.fetchOne<InvoiceRow>(invoiceTable, { id: query.payload.id, tenantId });
+    return row ?? null;
+  },
+});

package/src/__tests__/fixtures/migrate-db-raw/own-tenant-const-shorthand.input.ts

@@ -0,0 +1,11 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { invoiceTable } from "./entities/invoice";
+
+export const invoiceDetailQuery = defineQueryHandler({
+  name: "invoice:detail",
+  handler: async (query, ctx) => {
+    const tenantId = query.user.tenantId;
+    const row = await fetchOne<InvoiceRow>(ctx.db.raw, invoiceTable, { id: query.payload.id, tenantId });
+    return row ?? null;
+  },
+});

package/src/__tests__/fixtures/migrate-db-raw/own-tenant-event.expected.ts

@@ -0,0 +1,9 @@
+import { invoiceTable } from "./entities/invoice";
+
+export const invoiceListWrite = defineWriteHandler({
+  name: "invoice:list",
+  handler: async (event, ctx) => {
+    const rows = await ctx.db.selectMany(invoiceTable, { tenantId: event.user.tenantId, status: "open" }, { limit: 20 });
+    return rows;
+  },
+});

package/src/__tests__/fixtures/migrate-db-raw/own-tenant-event.input.ts

@@ -0,0 +1,15 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { invoiceTable } from "./entities/invoice";
+
+export const invoiceListWrite = defineWriteHandler({
+  name: "invoice:list",
+  handler: async (event, ctx) => {
+    const rows = await selectMany(
+      ctx.db.raw,
+      invoiceTable,
+      { tenantId: event.user.tenantId, status: "open" },
+      { limit: 20 },
+    );
+    return rows;
+  },
+});

package/src/__tests__/fixtures/migrate-open-to-all/manual-only.expected.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+
+export const listWidgets = {
+  name: "widget:list",
+  schema: z.object({}),
+  description: "Lists all widgets; visible to everyone",
+  access: { openToAll: true },
+  handler: async () => [],
+};
+
+export const legacyPing = {
+  name: "legacy:ping",
+  schema: z.object({}),
+  access: { openToAll: true },
+  handler: async () => "pong",
+};

package/src/__tests__/fixtures/migrate-open-to-all/manual-only.input.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+
+export const listWidgets = {
+  name: "widget:list",
+  schema: z.object({}),
+  description: "Lists all widgets; visible to everyone",
+  access: { openToAll: true },
+  handler: async () => [],
+};
+
+export const legacyPing = {
+  name: "legacy:ping",
+  schema: z.object({}),
+  access: { openToAll: true },
+  handler: async () => "pong",
+};

package/src/__tests__/fixtures/migrate-open-to-all/test-nested-shorthand.expected.ts

@@ -0,0 +1,12 @@
+export const config = {
+  verbAccess: {
+    create: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+    list: { roles: ["admin"] },
+  },
+  read: {
+    access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+  },
+  write: {
+    access: { roles: ["admin"] },
+  },
+};

package/src/__tests__/fixtures/migrate-open-to-all/test-nested-shorthand.input.ts

@@ -0,0 +1,12 @@
+export const config = {
+  verbAccess: {
+    create: { openToAll: true },
+    list: { roles: ["admin"] },
+  },
+  read: {
+    access: { openToAll: true },
+  },
+  write: {
+    access: { roles: ["admin"] },
+  },
+};

package/src/__tests__/fixtures/migrate-open-to-all/test-simple.expected.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+
+export const listHandler = {
+  name: "widget:list",
+  schema: z.object({}),
+  access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+};

package/src/__tests__/fixtures/migrate-open-to-all/test-simple.input.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+
+export const listHandler = {
+  name: "widget:list",
+  schema: z.object({}),
+  access: { openToAll: true },
+};

package/src/__tests__/full-stack.integration.test.ts

@@ -174,14 +174,14 @@ const userFeature = defineFeature("users", (r) => {
       sortDirection: z.enum(["asc", "desc"]).optional(),
     }),
     async (query, ctx) => userExecutor(ctx).list(query.payload, query.user, ctx.db),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.queryHandler(
     "user:detail",
     z.object({ id: z.uuid() }),
     async (query, ctx) => userExecutor(ctx).detail(query.payload, query.user, ctx.db),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.hook("postSave", { allOf: user }, async (result) => {

package/src/__tests__/migrate-db-raw-codemod.test.ts

@@ -0,0 +1,132 @@
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { migrateDbRawSource } from "../scripts/codemod/migrate-db-raw";
+
+const FIXTURES_DIR = join(import.meta.dir, "fixtures", "migrate-db-raw");
+const DEFAULT_GLOBAL_TABLES = new Set(["userTable", "globalFeatureStateTable"]);
+
+function readFixture(name: string): { input: string; expected: string } {
+  return {
+    input: readFileSync(join(FIXTURES_DIR, `${name}.input.ts`), "utf8"),
+    expected: readFileSync(join(FIXTURES_DIR, `${name}.expected.ts`), "utf8"),
+  };
+}
+
+describe("migrateDbRawSource", () => {
+  it("rewrites a global fetchOne with type args to db.global().fetchOne()", () => {
+    const { input, expected } = readFixture("global-fetch");
+    const result = migrateDbRawSource(input, "global-fetch.ts", {
+      globalTables: DEFAULT_GLOBAL_TABLES,
+    });
+
+    expect(result.output).toBe(expected);
+    expect(result.rewrites).toHaveLength(1);
+    expect(result.rewrites[0]?.rule).toBe("global-table");
+    expect(result.rewrites[0]?.line).toBe(7);
+    expect(result.manual).toHaveLength(0);
+  });
+
+  it("rewrites a global selectMany with options to db.global().selectMany()", () => {
+    const { input, expected } = readFixture("global-select");
+    const result = migrateDbRawSource(input, "global-select.ts", {
+      globalTables: DEFAULT_GLOBAL_TABLES,
+    });
+
+    expect(result.output).toBe(expected);
+    expect(result.rewrites).toHaveLength(1);
+    expect(result.rewrites[0]?.rule).toBe("global-table");
+    expect(result.manual).toHaveLength(0);
+  });
+
+  it("rewrites own-tenant filtering via event.user.tenantId", () => {
+    const { input, expected } = readFixture("own-tenant-event");
+    const result = migrateDbRawSource(input, "own-tenant-event.ts", {
+      globalTables: DEFAULT_GLOBAL_TABLES,
+    });
+
+    expect(result.output).toBe(expected);
+    expect(result.rewrites).toHaveLength(1);
+    expect(result.rewrites[0]?.rule).toBe("own-tenant");
+    expect(result.manual).toHaveLength(0);
+  });
+
+  it("rewrites own-tenant filtering via a const tenantId shorthand binding", () => {
+    const { input, expected } = readFixture("own-tenant-const-shorthand");
+    const result = migrateDbRawSource(input, "own-tenant-const-shorthand.ts", {
+      globalTables: DEFAULT_GLOBAL_TABLES,
+    });
+
+    expect(result.output).toBe(expected);
+    expect(result.rewrites).toHaveLength(1);
+    expect(result.rewrites[0]?.rule).toBe("own-tenant");
+    expect(result.manual).toHaveLength(0);
+  });
+
+  it("leaves unsafe call sites untouched and reports them as manual", () => {
+    const { input, expected } = readFixture("manual-only");
+    const result = migrateDbRawSource(input, "manual-only.ts", {
+      globalTables: DEFAULT_GLOBAL_TABLES,
+    });
+
+    expect(result.output).toBe(expected);
+    expect(result.rewrites).toHaveLength(0);
+    expect(result.manual).toHaveLength(4);
+
+    const byText = new Map(result.manual.map((m) => [m.text, m]));
+
+    const insertOneSite = byText.get(
+      "insertOne(ctx.db.raw, auditTable, { tenantId, action: event.payload.action })",
+    );
+    expect(insertOneSite).toBeDefined();
+    expect(insertOneSite?.line).toBe(9);
+    expect(insertOneSite?.enclosing).toBe("handler");
+
+    const countWhereSite = byText.get('countWhere(ctx.db.raw, invoiceTable, { status: "open" })');
+    expect(countWhereSite).toBeDefined();
+    expect(countWhereSite?.line).toBe(10);
+
+    const createTenantDbSite = byText.get('createTenantDb(ctx.db.raw, x, "system")');
+    expect(createTenantDbSite).toBeDefined();
+    expect(createTenantDbSite?.line).toBe(16);
+    expect(createTenantDbSite?.enclosing).toBe("bootstrapSystemDb");
+
+    const systemDbSite = byText.get("ctx.systemDb.acknowledgeCrossTenant(r).raw");
+    expect(systemDbSite).toBeDefined();
+    expect(systemDbSite?.line).toBe(23);
+  });
+
+  it("does not rewrite when tenantId comes from a non-user-scope source (payload/token)", () => {
+    const { input } = readFixture("manual-only");
+    const result = migrateDbRawSource(input, "manual-only.ts", {
+      globalTables: DEFAULT_GLOBAL_TABLES,
+    });
+
+    expect(result.output).toContain("await insertOne(ctx.db.raw, auditTable");
+  });
+
+  it("prunes an unused free-function import after rewriting its only call site", () => {
+    const { input, expected } = readFixture("global-fetch");
+    const result = migrateDbRawSource(input, "global-fetch.ts", {
+      globalTables: DEFAULT_GLOBAL_TABLES,
+    });
+
+    expect(result.output).not.toContain(
+      'import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";',
+    );
+    expect(result.output).toBe(expected);
+  });
+
+  it("keeps a still-referenced sibling import while pruning the rewritten one", () => {
+    const { input, expected } = readFixture("import-pruning");
+    const result = migrateDbRawSource(input, "import-pruning.ts", {
+      globalTables: DEFAULT_GLOBAL_TABLES,
+    });
+
+    expect(result.output).toBe(expected);
+    expect(result.output).toContain(
+      'import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";',
+    );
+    expect(result.output.split("\n")[0]).not.toContain("fetchOne");
+  });
+});

package/src/__tests__/migrate-open-to-all-codemod.test.ts

@@ -0,0 +1,84 @@
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { migrateOpenToAllSource } from "../scripts/codemod/migrate-open-to-all";
+
+const FIXTURES_DIR = join(import.meta.dir, "fixtures", "migrate-open-to-all");
+const DEFAULT_REASON = "test handler callable by any signed-in test user";
+
+function readFixture(name: string): { input: string; expected: string } {
+  return {
+    input: readFileSync(join(FIXTURES_DIR, `${name}.input.ts`), "utf8"),
+    expected: readFileSync(join(FIXTURES_DIR, `${name}.expected.ts`), "utf8"),
+  };
+}
+
+describe("migrateOpenToAllSource", () => {
+  it("rewrites a top-level openToAll: true in a *.test.ts file to the default test reason", () => {
+    const { input, expected } = readFixture("test-simple");
+    const result = migrateOpenToAllSource(input, "widget-list.test.ts", {
+      testReason: DEFAULT_REASON,
+    });
+
+    expect(result.output).toBe(expected);
+    expect(result.rewrites).toHaveLength(1);
+    expect(result.rewrites[0]?.after).toBe(`openToAll: { reason: "${DEFAULT_REASON}" }`);
+    expect(result.manual).toHaveLength(0);
+  });
+
+  it("rewrites openToAll: true under a __tests__/ path even without a .test.ts suffix", () => {
+    const { input, expected } = readFixture("test-simple");
+    const result = migrateOpenToAllSource(input, "packages/framework/__tests__/widget-list.ts", {
+      testReason: DEFAULT_REASON,
+    });
+
+    expect(result.output).toBe(expected);
+    expect(result.rewrites).toHaveLength(1);
+  });
+
+  it("honors a custom --test-reason for test files", () => {
+    const { input } = readFixture("test-simple");
+    const result = migrateOpenToAllSource(input, "widget-list.test.ts", {
+      testReason: "custom reason for this suite",
+    });
+
+    expect(result.output).toContain(
+      'access: { openToAll: { reason: "custom reason for this suite" } }',
+    );
+  });
+
+  it("rewrites nested shorthand openToAll: true (verbAccess, read.access) in test files", () => {
+    const { input, expected } = readFixture("test-nested-shorthand");
+    const result = migrateOpenToAllSource(input, "config.test.ts", { testReason: DEFAULT_REASON });
+
+    expect(result.output).toBe(expected);
+    expect(result.rewrites).toHaveLength(2);
+    expect(result.manual).toHaveLength(0);
+  });
+
+  it("leaves non-test files untouched and reports manual sites with derived handler name + description", () => {
+    const { input, expected } = readFixture("manual-only");
+    const result = migrateOpenToAllSource(input, "handlers.ts", { testReason: DEFAULT_REASON });
+
+    expect(result.output).toBe(expected);
+    expect(result.rewrites).toHaveLength(0);
+    expect(result.manual).toHaveLength(2);
+
+    const withDescription = result.manual.find((m) => m.handlerName === "widget:list");
+    expect(withDescription).toBeDefined();
+    expect(withDescription?.description).toBe("Lists all widgets; visible to everyone");
+    expect(withDescription?.line).toBe(7);
+
+    const withoutDescription = result.manual.find((m) => m.handlerName === "legacy:ping");
+    expect(withoutDescription).toBeDefined();
+    expect(withoutDescription?.description).toBeUndefined();
+    expect(withoutDescription?.line).toBe(14);
+  });
+
+  it("never rewrites in a non-test file, even when a description is present", () => {
+    const { input } = readFixture("manual-only");
+    const result = migrateOpenToAllSource(input, "handlers.ts", { testReason: DEFAULT_REASON });
+
+    expect(result.output).toContain("access: { openToAll: true }");
+  });
+});

package/src/__tests__/transition-guard.integration.test.ts

@@ -86,7 +86,7 @@ const feature = defineFeature("txguard", (r) => {
         event.user,
         ctx.db,
       ),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.writeHandler(
@@ -102,7 +102,7 @@ const feature = defineFeature("txguard", (r) => {
         event.user,
         ctx.db,
       ),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.writeHandler(
@@ -114,7 +114,7 @@ const feature = defineFeature("txguard", (r) => {
         event.user,
         ctx.db,
       ),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.writeHandler(
@@ -130,7 +130,7 @@ const feature = defineFeature("txguard", (r) => {
         event.user,
         ctx.db,
       ),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.writeHandler(
@@ -142,7 +142,7 @@ const feature = defineFeature("txguard", (r) => {
         event.user,
         ctx.db,
       ),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.writeHandler(
@@ -154,7 +154,7 @@ const feature = defineFeature("txguard", (r) => {
         event.user,
         ctx.db,
       ),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.writeHandler(
@@ -170,7 +170,7 @@ const feature = defineFeature("txguard", (r) => {
         event.user,
         ctx.db,
       ),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 });