@cosmicdrift/kumiko-framework 0.269.1 → 0.270.0

package/src/engine/__tests__/extends-registrar.test.ts

@@ -142,7 +142,7 @@ describe("extendsRegistrar", () => {
           isSuccess: true as const,
           data: { id: "c1" },
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.useExtension("audited", "credit");
     });
@@ -181,7 +181,7 @@ describe("extendsRegistrar", () => {
           isSuccess: true as const,
           data: { id: "v1" },
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.writeHandler(
         "vehicle:update",
@@ -190,7 +190,7 @@ describe("extendsRegistrar", () => {
           isSuccess: true as const,
           data: { id: "v1" },
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.useExtension("audited", "vehicle");
     });

package/src/engine/__tests__/feature-crud-shorthand.test.ts

@@ -11,7 +11,9 @@ const taskEntity = createEntity({
 describe("r.crud", () => {
   test("registers the entity + full CRUD handler set, same as registerEntityCrud", () => {
     const write = { access: { roles: ["Admin"] } } as const;
-    const read = { access: { openToAll: true } } as const;
+    const read = {
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+    } as const;
 
     const feature = defineFeature("via-crud", (r) => {
       r.crud("task", taskEntity, { write, read });
@@ -28,7 +30,9 @@ describe("r.crud", () => {
 
   test("without verbAccess, write handlers keep write.access (never fall back to the broader read.access)", () => {
     const write = { access: { roles: ["Manager"] } } as const;
-    const read = { access: { openToAll: true } } as const;
+    const read = {
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+    } as const;
 
     const feature = defineFeature("via-crud-no-verb-access", (r) => {
       r.crud("task", taskEntity, { write, read });
@@ -44,7 +48,9 @@ describe("r.crud", () => {
 
   test("verbAccess overrides access per verb, other verbs keep write/read.access", () => {
     const write = { access: { roles: ["Manager"] } } as const;
-    const read = { access: { openToAll: true } } as const;
+    const read = {
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+    } as const;
     const deleteAccess = { roles: ["Operator"] } as const;
     const restoreAccess = { roles: ["Operator"] } as const;
     const listAccess = { roles: ["Auditor"] } as const;

package/src/engine/__tests__/feature-crud-verb-access.integration.test.ts

@@ -13,7 +13,7 @@ const propertyEntity = createEntity({
 const propertyFeature = defineFeature("crud-verb-access", (r) => {
   r.crud("property", propertyEntity, {
     write: { access: { roles: ["User"] } },
-    read: { access: { openToAll: true } },
+    read: { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
     verbAccess: {
       delete: { roles: ["Admin"] },
       restore: { roles: ["Admin"] },

package/src/engine/__tests__/hook-phases.test.ts

@@ -27,7 +27,7 @@ describe("HookPhases defaults", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
       r.writeHandler("thing:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postSave", "thing:create", noopSave);
     });
@@ -41,7 +41,7 @@ describe("HookPhases defaults", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
       r.writeHandler("thing:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postSave", "thing:create", noopSave, { phase: HookPhases.inTransaction });
     });
@@ -60,7 +60,7 @@ describe("HookPhases defaults", () => {
           isSuccess: true,
           data: null,
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.hook("preDelete", "thing:delete", async () => undefined);
     });
@@ -95,7 +95,7 @@ describe("Registry phase filtering", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
       r.writeHandler("thing:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postSave", "thing:create", inTxFn, { phase: HookPhases.inTransaction });
       r.hook("postSave", "thing:create", afterFn); // default afterCommit
@@ -127,7 +127,7 @@ describe("Registry phase filtering", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
       r.writeHandler("thing:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
 

package/src/engine/__tests__/lifecycle-hooks.test.ts

@@ -69,7 +69,9 @@ describe("lifecycle hooks in registry", () => {
   test("merges preSave hooks within same feature", () => {
     const f1 = defineFeature("a", (r) => {
       r.entity("user", createEntity({ table: "Users", fields: {} }));
-      r.writeHandler("user", z.object({}), stubHandler, { access: { openToAll: true } });
+      r.writeHandler("user", z.object({}), stubHandler, {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("preSave", "user", async (changes) => changes);
       r.hook("preSave", "user", async (changes) => changes);
     });
@@ -81,12 +83,16 @@ describe("lifecycle hooks in registry", () => {
   test("cross-feature hooks use full prefixed name", () => {
     const f1 = defineFeature("a", (r) => {
       r.entity("user", createEntity({ table: "Users", fields: {} }));
-      r.writeHandler("user", z.object({}), stubHandler, { access: { openToAll: true } });
+      r.writeHandler("user", z.object({}), stubHandler, {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("postSave", "user", async () => {});
     });
     // Feature b hooks into a.user by using the full prefixed name
     const f2 = defineFeature("b", (r) => {
-      r.writeHandler("a.user", z.object({}), stubHandler, { access: { openToAll: true } });
+      r.writeHandler("a.user", z.object({}), stubHandler, {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("postSave", "a.user", async () => {});
       r.hook("postSave", "a.user", async () => {});
     });

package/src/engine/__tests__/multiselect-filter.integration.test.ts

@@ -28,7 +28,7 @@ const LIST_QN = "checklist:query:equipment:list";
 const checklistFeature = defineFeature("checklist", (r) => {
   r.crud("equipment", equipmentEntity, {
     write: { access: { roles: ["Admin"] } },
-    read: { access: { openToAll: true } },
+    read: { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   });
 });
 

package/src/engine/__tests__/post-query-hook.test.ts

@@ -24,7 +24,9 @@ describe("postQuery hook registration", () => {
   test("r.hook('postQuery', handlerQn, fn) lands in handler-keyed lifecycleHooks map", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
-      r.queryHandler("thing:list", z.object({}), async () => [], { access: { openToAll: true } });
+      r.queryHandler("thing:list", z.object({}), async () => [], {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("postQuery", "thing:list", noop);
     });
 
@@ -70,7 +72,9 @@ describe("Registry getters", () => {
 
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
-      r.queryHandler("thing:list", z.object({}), async () => [], { access: { openToAll: true } });
+      r.queryHandler("thing:list", z.object({}), async () => [], {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("postQuery", "thing:list", fn);
     });
 

package/src/engine/__tests__/projection-detail-actions.test.ts

@@ -42,13 +42,13 @@ describe("validateBoot — projectionDetail actions (fw#2166)", () => {
   test("valid navigate + writeHandler actions boot cleanly", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("rent:detail", z.object({}), async () => ({ description: "x" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.writeHandler(
         "archive",
         z.object({ id: z.string() }),
         async () => ({ isSuccess: true as const, data: {} }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.screen({
         id: "rent-detail",

package/src/engine/__tests__/projection-detail-singleton.test.ts

@@ -21,7 +21,7 @@ describe("validateBoot — projectionDetail singleton (fw#2312)", () => {
   test("singleton + idParam throws", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("me", z.object({}), async () => ({ id: "u1" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "profile",
@@ -46,7 +46,7 @@ describe("validateBoot — projectionDetail singleton (fw#2312)", () => {
         }),
       );
       r.queryHandler("me", z.object({}), async () => ({ id: "u1" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "profile",
@@ -71,7 +71,7 @@ describe("validateBoot — projectionDetail singleton (fw#2312)", () => {
   test("singleton without idParam/detailFor boots cleanly", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("me", z.object({}), async () => ({ id: "u1" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "profile",

package/src/engine/__tests__/projection-detail-tabs.test.ts

@@ -140,7 +140,7 @@ describe("validateBoot — projectionDetail tabs (fw record-layout)", () => {
   test("object-form metric with its own label needs no fieldLabels entry", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("rent:detail", z.object({}), async () => ({ description: "x" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "rent-detail",
@@ -192,7 +192,7 @@ describe("validateBoot — projectionDetail tabs (fw record-layout)", () => {
   test("metric navigate.tab with no screen/entity — a known section id boots cleanly", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("rent:detail", z.object({}), async () => ({ description: "x" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "rent-detail",
@@ -214,7 +214,7 @@ describe("validateBoot — projectionDetail tabs (fw record-layout)", () => {
   test("valid tabs + header + metrics declaration boots cleanly", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("rent:detail", z.object({}), async () => ({ description: "x" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "rent-detail",

package/src/engine/__tests__/projection-list-filter.integration.test.ts

@@ -37,7 +37,7 @@ const LIST_QN = "roster:query:member:list";
 const rosterFeature = defineFeature("roster", (r) => {
   r.crud("member", memberEntity, {
     write: { access: { roles: ["Admin"] } },
-    read: { access: { openToAll: true } },
+    read: { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   });
   r.screen({
     id: "member-list",

package/src/engine/__tests__/registry.test.ts

@@ -78,13 +78,17 @@ describe("getAllQueryHandlers", () => {
     const taskFeature = defineFeature("registry-test-task", (r) => {
       r.crud("task", taskEntity, {
         write: { access: { roles: ["Admin"] } },
-        read: { access: { openToAll: true } },
+        read: {
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+        },
       });
     });
     const noteFeature = defineFeature("registry-test-note", (r) => {
       r.crud("note", noteEntity, {
         write: { access: { roles: ["Admin"] } },
-        read: { access: { openToAll: true } },
+        read: {
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+        },
       });
     });
 
@@ -109,12 +113,12 @@ describe("getAllStreamHandlers", () => {
   test("returns every registered stream handler, qualified, across multiple features", () => {
     const aiFeature = defineFeature("registry-test-ai", (r) => {
       r.streamHandler("chat:complete", z.object({ prompt: z.string() }), async function* () {}, {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
     const otherFeature = defineFeature("registry-test-other", (r) => {
       r.streamHandler("chat:complete", z.object({ prompt: z.string() }), async function* () {}, {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
 
@@ -137,12 +141,12 @@ describe("getAllStreamHandlers", () => {
   test("duplicate stream-handler short-name across features qualifies independently, no collision", () => {
     const aiFeature = defineFeature("registry-test-dup-a", (r) => {
       r.streamHandler("chat:complete", z.object({}), async function* () {}, {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
     const otherFeature = defineFeature("registry-test-dup-b", (r) => {
       r.streamHandler("chat:complete", z.object({}), async function* () {}, {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
     expect(() => createRegistry([aiFeature, otherFeature])).not.toThrow();
@@ -154,12 +158,12 @@ describe("getAllStreamHandlers", () => {
     // fire) but toKebab() collapses both to the same qualified name.
     const featureA = defineFeature("registry-test-kebab-dup", (r) => {
       r.streamHandler("chat:complete", z.object({}), async function* () {}, {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
     const featureB = defineFeature("registryTestKebabDup", (r) => {
       r.streamHandler("chat:complete", z.object({}), async function* () {}, {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
     expect(() => createRegistry([featureA, featureB])).toThrow(/Duplicate stream handler/);
@@ -173,7 +177,7 @@ describe("getAllStreamHandlers", () => {
         name: "chat:complete",
         schema,
         handler: handlerFn,
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
         rateLimit: { per: "ip+handler", limit: 5, windowSeconds: 60 },
       });
     });
@@ -184,7 +188,9 @@ describe("getAllStreamHandlers", () => {
     expect(registered).toBeDefined();
     expect(registered?.schema).toBe(schema);
     expect(registered?.handler).toBe(handlerFn);
-    expect(registered?.access).toEqual({ openToAll: true });
+    expect(registered?.access).toEqual({
+      openToAll: { reason: "test handler callable by any signed-in test user" },
+    });
     expect(registered?.rateLimit).toEqual({ per: "ip+handler", limit: 5, windowSeconds: 60 });
   });
 });
@@ -196,7 +202,7 @@ describe("double-qualified handler names (#1991)", () => {
         "registry-test-ai-orch:query:duplicate-candidates",
         z.object({}),
         async () => ({}),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
 
@@ -206,7 +212,7 @@ describe("double-qualified handler names (#1991)", () => {
   test("createRegistry allows a sub-structured short name whose entity prefix merely resembles the feature name", () => {
     const feature = defineFeature("registry-test-invoices", (r) => {
       r.queryHandler("invoice:mark-paid", z.object({}), async () => ({}), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
 
@@ -309,7 +315,7 @@ describe("extensionSelector boot-validation", () => {
         "doSomething",
         z.object({}),
         async () => ({ isSuccess: true as const, data: {} }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.useExtension("credit-cap", "credit");
     });

package/src/engine/__tests__/screen.test.ts

@@ -211,7 +211,7 @@ describe("r.screen() — registration", () => {
     const features = [
       defineFeature("app", (r) => {
         r.queryHandler("foo:detail", z.object({}), async () => ({}), {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
         });
         r.screen({
           id: "x",
@@ -281,10 +281,10 @@ describe("r.screen() — registration", () => {
     const features = [
       defineFeature("app", (r) => {
         r.queryHandler("foo:detail", z.object({}), async () => ({}), {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
         });
         r.queryHandler("foo:list", z.object({}), async () => ({ rows: [], nextCursor: null }), {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
         });
         r.screen({
           id: "x",
@@ -345,10 +345,10 @@ describe("r.screen() — registration", () => {
     const features = [
       defineFeature("app", (r) => {
         r.queryHandler("foo:detail", z.object({}), async () => ({}), {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
         });
         r.queryHandler("foo:list", z.object({}), async () => ({ rows: [], nextCursor: null }), {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
         });
         r.screen({
           id: "x",
@@ -370,10 +370,10 @@ describe("r.screen() — registration", () => {
       const features = [
         defineFeature("app", (r) => {
           r.queryHandler("foo:detail", z.object({}), async () => ({}), {
-            access: { openToAll: true },
+            access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
           });
           r.queryHandler("foo:list", z.object({}), async () => ({ rows: [], nextCursor: null }), {
-            access: { openToAll: true },
+            access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
           });
           r.screen({
             id: "x",
@@ -400,13 +400,15 @@ describe("r.screen() — registration", () => {
       const features = [
         defineFeature("app", (r) => {
           r.queryHandler("foo:detail", z.object({}), async () => ({}), {
-            access: { openToAll: true },
+            access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
           });
           r.queryHandler(
             "foo:list",
             z.object({ search: z.string().optional() }),
             async () => ({ rows: [], nextCursor: null }),
-            { access: { openToAll: true } },
+            {
+              access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+            },
           );
           r.screen({
             id: "x",
@@ -433,10 +435,10 @@ describe("r.screen() — registration", () => {
       const features = [
         defineFeature("app", (r) => {
           r.queryHandler("foo:detail", z.object({}), async () => ({}), {
-            access: { openToAll: true },
+            access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
           });
           r.queryHandler("foo:list", z.object({}), async () => ({ rows: [], nextCursor: null }), {
-            access: { openToAll: true },
+            access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
           });
           r.screen({
             id: "x",
@@ -470,13 +472,15 @@ describe("r.screen() — registration", () => {
       const features = [
         defineFeature("app", (r) => {
           r.queryHandler("foo:detail", z.object({}), async () => ({}), {
-            access: { openToAll: true },
+            access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
           });
           r.queryHandler(
             "foo:list",
             z.object({ filters: z.array(z.object({})).optional() }),
             async () => ({ rows: [], nextCursor: null }),
-            { access: { openToAll: true } },
+            {
+              access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+            },
           );
           r.screen({
             id: "x",
@@ -512,13 +516,15 @@ describe("r.screen() — registration", () => {
       const features = [
         defineFeature("app", (r) => {
           r.queryHandler("foo:detail", z.object({}), async () => ({}), {
-            access: { openToAll: true },
+            access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
           });
           r.queryHandler(
             "foo:list",
             z.object({ filters: z.array(z.object({})).optional() }),
             async () => ({ rows: [], nextCursor: null }),
-            { access: { openToAll: true } },
+            {
+              access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+            },
           );
           r.screen({
             id: "x",
@@ -660,10 +666,10 @@ describe("r.screen() — registration", () => {
           },
         );
         r.queryHandler("foo:detail", z.object({}), async () => ({}), {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
         });
         r.queryHandler("foo:list", z.object({}), async () => ({ rows: [], nextCursor: null }), {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
         });
         r.screen({
           id: "x",
@@ -873,7 +879,7 @@ describe("r.screen() — registration", () => {
     const features = [
       defineFeature("app", (r) => {
         r.queryHandler("foo:detail", z.object({}), async () => ({}), {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
         });
         r.writeHandler(
           "save",
@@ -917,7 +923,7 @@ describe("r.screen() — registration", () => {
         // here so the throw below isolates the one key this test is about.
         r.translations({ keys: { "screen:x.title": { en: "X" } } });
         r.queryHandler("foo:detail", z.object({}), async () => ({}), {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
         });
         r.writeHandler(
           "save",
@@ -959,7 +965,7 @@ describe("r.screen() — registration", () => {
           },
         });
         r.queryHandler("foo:detail", z.object({}), async () => ({}), {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
         });
         r.writeHandler(
           "save",

package/src/engine/boot-validator/__tests__/access-declarations.test.ts

@@ -55,7 +55,8 @@ describe("validateAccessDeclarations", () => {
   });
 
   // 1b. malformed openToAll (from untyped sources) counts as invalid, not a crash.
-  test.each([{ openToAll: false }, { openToAll: {} }])(
+  // `{ openToAll: true }` (deprecated) must fail boot too — it never grants access per isOpenToAllGranted.
+  test.each([{ openToAll: false }, { openToAll: {} }, { openToAll: true }])(
     "malformed openToAll %p throws, naming the handler",
     (access) => {
       const feature = defineFeature("notes", (r) => {
@@ -259,9 +260,9 @@ describe("validateAccessDeclarations", () => {
     expect(() => validateAccessDeclarations(feature)).toThrow(/"email"/);
   });
 
-  test("the deprecated openToAll: true form cannot carry personalData", () => {
-    // @ts-expect-error personalData lives only on the { reason } object form
-    const access: AccessRule = { openToAll: true, personalData: "tenant-members" };
+  test("the deprecated openToAll: true form no longer type-checks against AccessRule", () => {
+    // @ts-expect-error `openToAll: true` was removed from AccessRule — see #2858
+    const access: AccessRule = { openToAll: true };
     expect(access).toBeDefined();
   });
 

package/src/engine/boot-validator/__tests__/parent-ref.test.ts

@@ -52,8 +52,16 @@ describe("validateParentRefs", () => {
     const entity = joinEntity(validRef);
     const feature = defineFeature("joins", (r) => {
       r.entity("join", entity);
-      r.queryHandler(defineEntityListHandler("join", entity, { access: { openToAll: true } }));
-      r.queryHandler(defineEntityDetailHandler("join", entity, { access: { openToAll: true } }));
+      r.queryHandler(
+        defineEntityListHandler("join", entity, {
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+        }),
+      );
+      r.queryHandler(
+        defineEntityDetailHandler("join", entity, {
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+        }),
+      );
     });
     expect(() => validate(feature)).not.toThrow();
   });
@@ -65,7 +73,7 @@ describe("validateParentRefs", () => {
         name: "host:list",
         schema: z.object({}),
         handler: async () => ({ rows: [], nextCursor: null }),
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
     expect(() => validate(feature)).not.toThrow();
@@ -99,7 +107,11 @@ describe("validateParentRefs", () => {
     const entity = joinEntity({ ...validRef, allowedTypes: ["host"] });
     const feature = defineFeature("joins", (r) => {
       r.entity("join", entity);
-      r.queryHandler(defineEntityListHandler("join", entity, { access: { openToAll: true } }));
+      r.queryHandler(
+        defineEntityListHandler("join", entity, {
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+        }),
+      );
     });
     expect(() => validate(feature, [hosts])).not.toThrow();
   });
@@ -121,7 +133,7 @@ describe("validateParentRefs", () => {
         name: "join:list",
         schema: z.object({}),
         handler: async () => ({ rows: [], nextCursor: null }),
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
     expect(() => validate(feature)).toThrow(/join:list/);
@@ -134,7 +146,7 @@ describe("validateParentRefs", () => {
         name: "join:detail",
         schema: z.object({ id: z.uuid() }),
         handler: async () => null,
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
     expect(() => validate(feature)).toThrow(/join:detail/);

package/src/engine/boot-validator/access-declarations.ts

@@ -88,12 +88,10 @@ function candidatePersonalFieldNames(
   return names;
 }
 
-// A value that is neither `true` nor an object with a non-empty string `reason`
-// counts as "empty" — catches malformed openToAll from untyped sources too.
+// Not an object with a non-empty string `reason` (incl. deprecated `openToAll: true`) counts as "empty".
 function openToAllReasonIsEmpty(access: AccessRule): boolean {
   if (!("openToAll" in access)) return false;
   const openToAll: unknown = access.openToAll;
-  if (openToAll === true) return false;
   if (typeof openToAll !== "object" || openToAll === null) return true;
   if (!("reason" in openToAll) || typeof openToAll.reason !== "string") return true;
   return openToAll.reason.trim().length === 0;
@@ -125,8 +123,8 @@ function validateOpenToAllReason(
   if (!openToAllReasonIsEmpty(access)) return;
   throw new Error(
     `[Feature ${feature.name}] ${kind} handler "${handlerName}" declares an invalid ` +
-      '{ openToAll: ... } — must be `true` or { reason: "<non-empty explanation>" } ' +
-      "for why any authenticated user may call this handler.",
+      '{ openToAll: ... } — must be { reason: "<non-empty explanation>" } for why any ' +
+      "authenticated user may call this handler. `{ openToAll: true }` is no longer accepted.",
   );
 }