@cosmicdrift/kumiko-framework 0.269.1 → 0.270.0

package/src/entrypoint/__tests__/entrypoint-job-wiring.integration.test.ts

@@ -33,7 +33,7 @@ const wiringFeature = defineFeature("wiring", (r) => {
       isSuccess: true as const,
       data: { id: 1, sku: event.payload.sku },
     }),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
   r.job(
     "record-order",
@@ -57,7 +57,7 @@ const mixedLaneFeature = defineFeature("mixed", (r) => {
       isSuccess: true as const,
       data: { id: 1, msg: event.payload.msg },
     }),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
   r.job(
     "handle-on-worker",
@@ -240,7 +240,7 @@ const featureGateJobFeature = defineFeature("featuregate", (r) => {
       isSuccess: true as const,
       data: { id: 1, msg: event.payload.msg },
     }),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
   r.job(
     "record-features",

package/src/entrypoint/__tests__/split-deploy.integration.test.ts

@@ -57,7 +57,7 @@ const workerWriteFeature = defineFeature("workerWrite", (r) => {
       });
       return { isSuccess: true as const, data: { note: event.payload.note } };
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
   r.multiStreamProjection({
     name: "consume-notes",

package/src/es-ops/__tests__/runner.integration.test.ts

@@ -58,7 +58,7 @@ const seedTestFeature = defineFeature("esopstest", (r) => {
     "probe:create",
     z.object({ label: z.string().min(1) }),
     async (event, ctx) => probeExecutor.create(event.payload, event.user, ctx.db),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
   r.writeHandler(
     "probe:fail",
@@ -70,7 +70,7 @@ const seedTestFeature = defineFeature("esopstest", (r) => {
         currentVersion: 2,
       });
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
   // Role-gated handler (no openToAll): the bare system actor has no bypass
   // for explicit role gates — only systemWriteAs' extraRoles reaches it.

package/src/jobs/__tests__/job-event-trigger.integration.test.ts

@@ -26,7 +26,7 @@ const ordersFeature = defineFeature("orders", (r) => {
         data: { id: 1, product: event.payload.product, amount: event.payload.amount },
       };
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 });
 
@@ -51,7 +51,7 @@ const analyticsFeature = defineFeature("analytics", (r) => {
       isSuccess: true as const,
       data: null,
     }),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.job("trackOrder", { trigger: { on: "orders:write:orders:create" } }, async (payload) => {

package/src/jobs/__tests__/job-multi-trigger.integration.test.ts

@@ -27,13 +27,13 @@ const orderFeature = defineFeature("multi", (r) => {
     "order:open",
     z.object({ id: z.string() }),
     async (event) => ({ isSuccess: true, data: { id: event.payload.id } }),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
   r.writeHandler(
     "order:cancel",
     z.object({ id: z.string() }),
     async (event) => ({ isSuccess: true, data: { id: event.payload.id } }),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
   r.job(
     "fanout",

package/src/jobs/__tests__/jobs.integration.test.ts

@@ -119,7 +119,7 @@ const testFeature = defineFeature("test", (r) => {
     "capped-event",
     z.object({ n: z.number() }),
     async (event) => ({ isSuccess: true, data: { n: event.payload.n } }),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
   // Event-triggered twin — exercises handleEvent's maxPerTenant guard
   // (dispatch and handleEvent share isOverPerTenantLimit).

package/src/observability/__tests__/observability.integration.test.ts

@@ -33,7 +33,7 @@ const productFeature = defineFeature("product", (r) => {
       ctx.metrics.inc("tracked_total", { kind: event.payload.kind });
       return { isSuccess: true, data: { ok: true } };
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 });
 
@@ -44,7 +44,7 @@ const errorFeature = defineFeature("err", (r) => {
     async () => {
       throw new Error("boom from handler");
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 });
 
@@ -90,7 +90,7 @@ const todoFeature = defineFeature("todo", (r) => {
         },
       };
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.hook("postSave", "create", async (_save: SaveContext) => {
@@ -288,7 +288,7 @@ describe("Observability (integration) — Redis wrapper", () => {
         await ctx.redis.get("session:abc123:token");
         return { isSuccess: true, data: { ok: true } };
       },
-      { access: { openToAll: true } },
+      { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
     );
   });
 
@@ -352,7 +352,7 @@ describe("Observability (integration) — Pino trace bridge", () => {
         ctx.log?.info(event.payload.msg, { custom: "field" });
         return { isSuccess: true, data: { ok: true } };
       },
-      { access: { openToAll: true } },
+      { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
     );
   });
 
@@ -581,7 +581,7 @@ const consumerAFeature = defineFeature("consumer-a", (r) => {
       recordSharedCall(ctx);
       return { isSuccess: true, data: { ok: true } };
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 });
 
@@ -594,7 +594,7 @@ const consumerBFeature = defineFeature("consumer-b", (r) => {
       ctx.metricsFor("unregistered-lib").inc("never_total");
       return { isSuccess: true, data: { ok: true } };
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 });
 

package/src/pipeline/__tests__/archive-stream.integration.test.ts

@@ -109,14 +109,14 @@ const archFeature = defineFeature("archtest", (r) => {
     "item:events",
     z.object({ id: z.uuid() }),
     async (query, ctx) => ctx.loadAggregate(query.payload.id),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.queryHandler(
     "item:is-archived",
     z.object({ id: z.uuid() }),
     async (query, ctx) => ctx.isStreamArchived(query.payload.id),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 });
 

package/src/pipeline/__tests__/dispatcher.test.ts

@@ -33,7 +33,7 @@ const echoFeature = defineFeature("echo", (r) => {
       items: [],
       search: query.payload.search,
     }),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.streamHandler(
@@ -137,7 +137,7 @@ describe("dispatcher.write", () => {
         z.object({ name: z.string() }),
         async (event) => ({ isSuccess: true, data: { name: event.payload.name } }),
         {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
           rateLimit: { per: "ip+handler", limit: 3, windowSeconds: 60 },
         },
       );
@@ -168,7 +168,7 @@ describe("dispatcher.write", () => {
         z.object({ name: z.string() }),
         async (event) => ({ isSuccess: true, data: { name: event.payload.name } }),
         {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
           rateLimit: { per: "user", limit: 3, windowSeconds: 60 },
         },
       );
@@ -428,7 +428,7 @@ describe("dispatcher.stream", () => {
             yield { i };
           }
         },
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
     const dispatcher = createDispatcher(createRegistry([nestedFeature]), {
@@ -466,7 +466,7 @@ describe("dispatcher.stream", () => {
             throw new Error("close-boom");
           }
         },
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
     const dispatcher = createDispatcher(createRegistry([closeFailFeature]), {
@@ -500,7 +500,7 @@ describe("dispatcher.stream", () => {
           yield { i: 0 };
           yield { i: 1 };
         },
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
     const dispatcher = createDispatcher(createRegistry([feature]), {
@@ -536,7 +536,7 @@ describe("dispatcher.stream", () => {
           yield { i: 1 };
           yield { i: 2 };
         },
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
     const dispatcher = createDispatcher(createRegistry([feature]), {
@@ -571,7 +571,7 @@ describe("dispatcher.query postQuery hooks", () => {
     // pass on entity-existence makes such a hook register silently + never run.
     const feature = defineFeature("dash", (r) => {
       r.queryHandler("dashboard", z.object({}), async () => ({ count: 1 }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postQuery", "dashboard", async ({ entityName, rows }) => {
         expect(entityName).toBeUndefined();
@@ -590,7 +590,7 @@ describe("dispatcher.query postQuery hooks", () => {
     // [...null]). The hook here returns the row unchanged so the shape survives.
     const feature = defineFeature("nullrows", (r) => {
       r.queryHandler("dashboard", z.object({}), async () => ({ rows: null, nextCursor: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postQuery", "dashboard", async ({ rows }) => ({ rows }));
     });
@@ -603,7 +603,7 @@ describe("dispatcher.query postQuery hooks", () => {
   test("single-object postQuery hook returning ≠1 row throws", async () => {
     const feature = defineFeature("multi", (r) => {
       r.queryHandler("dashboard", z.object({}), async () => ({ count: 1 }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postQuery", "dashboard", async ({ rows }) => ({ rows: [...rows, ...rows] }));
     });
@@ -708,7 +708,7 @@ describe("dispatcher feature-gate", () => {
         }),
       );
       r.queryHandler("widget:list", z.object({}).passthrough(), async () => ({ items: [] }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.writeHandler(
         "widget:create",
@@ -728,7 +728,7 @@ describe("dispatcher feature-gate", () => {
             i++;
           }
         },
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
   }
@@ -900,7 +900,7 @@ describe("dispatcher feature-gate", () => {
         "check",
         z.object({}).passthrough(),
         async (_event, ctx) => ({ enabled: await ctx.hasFeature("toggled") }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
     const registry = createRegistry([toggled(), probe]);
@@ -940,7 +940,7 @@ describe("dispatcher feature-gate", () => {
         "check",
         z.object({}).passthrough(),
         async (_event, ctx) => ({ enabled: await ctx.hasFeature("premium-companion") }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
     const registry = createRegistry([probe]);
@@ -1027,7 +1027,7 @@ describe("dispatcher context.geoTzProvider (680/1)", () => {
             longitude: query.payload.longitude,
           }),
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
     const registry = createRegistry([geoFeature]);

package/src/pipeline/__tests__/lifecycle-pipeline.test.ts

@@ -24,7 +24,7 @@ function makeRegistry(hooks?: { preSave?: PreSaveHookFn[]; postSave?: PostSaveHo
     );
     // Dummy handler so hook targets resolve (boot validation requires it)
     r.writeHandler("user", z.object({}), async () => ({ isSuccess: true as const, data: null }), {
-      access: { openToAll: true },
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
     });
     if (hooks?.preSave) {
       for (const h of hooks.preSave) r.hook("preSave", "user", h);
@@ -296,7 +296,7 @@ describe("runPostSave phase routing", () => {
     const feature = defineFeature("phases", (r) => {
       r.entity("user", createEntity({ table: "Users", fields: {} }));
       r.writeHandler("user", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook(
         "postSave",
@@ -325,7 +325,7 @@ describe("runPostSave phase routing", () => {
     const feature = defineFeature("phases", (r) => {
       r.entity("user", createEntity({ table: "Users", fields: {} }));
       r.writeHandler("user", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook(
         "postSave",
@@ -351,7 +351,7 @@ describe("runPostSave phase routing", () => {
       const feature = defineFeature("phases", (r) => {
         r.entity("user", createEntity({ table: "Users", fields: {} }));
         r.writeHandler("user", z.object({}), async () => ({ isSuccess: true, data: null }), {
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
         });
         r.hook("postSave", "user", async () => {
           throw new Error("afterCommit-boom");
@@ -378,7 +378,7 @@ describe("runPostSave phase routing", () => {
     const feature = defineFeature("phases", (r) => {
       r.entity("user", createEntity({ table: "Users", fields: {} }));
       r.writeHandler("user", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
     const registry = createRegistry([feature]);
@@ -439,7 +439,7 @@ describe("Sprint 8a: per-tenant entity-hook filter", () => {
         "widget:create",
         z.object({ name: z.string() }),
         async () => ({ isSuccess: true as const, data: null }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
 
@@ -570,7 +570,7 @@ describe("runPreDelete", () => {
         }),
       );
       r.writeHandler("user", z.object({}), async () => ({ isSuccess: true as const, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("preDelete", "user", async () => {
         calls.push("handler");
@@ -606,7 +606,7 @@ describe("runPreDelete", () => {
         }),
       );
       r.writeHandler("user", z.object({}), async () => ({ isSuccess: true as const, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("preDelete", "user", async () => {
         throw new Error("blocked-delete");
@@ -652,7 +652,7 @@ describe("runPostDelete", () => {
         }),
       );
       r.writeHandler("user", z.object({}), async () => ({ isSuccess: true as const, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postDelete", "user", async () => {
         calls.push("feature");
@@ -685,7 +685,7 @@ describe("runPostDelete", () => {
         }),
       );
       r.writeHandler("user", z.object({}), async () => ({ isSuccess: true as const, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook(
         "postDelete",

package/src/pipeline/__tests__/load-aggregate-query.integration.test.ts

@@ -133,7 +133,7 @@ const asOfFeature = defineFeature("asoftest", (r) => {
       }
       return state;
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 });
 

package/src/pipeline/__tests__/post-query-hook.integration.test.ts

@@ -58,7 +58,7 @@ const postQueryFeature = defineFeature("postquerytest", (r) => {
       ],
       nextCursor: null,
     }),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   // Handler-keyed: fires only for widget:list
@@ -91,13 +91,13 @@ const duplicateRowHook: PostQueryHookFn = async ({ rows }) => ({ rows: [...rows,
 const singleObjectFeature = defineFeature("singleobjtest", (r) => {
   const gadget = r.entity("gadget", gadgetEntity);
   r.queryHandler("gadget:get", z.object({}), async () => ({ id: "g1", name: "Gadget" }), {
-    access: { openToAll: true },
+    access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
   });
   r.hook("postQuery", { allOf: gadget }, dropRowHook);
 
   const gizmo = r.entity("gizmo", gizmoEntity);
   r.queryHandler("gizmo:get", z.object({}), async () => ({ id: "z1", name: "Gizmo" }), {
-    access: { openToAll: true },
+    access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
   });
   r.hook("postQuery", { allOf: gizmo }, duplicateRowHook);
 });

package/src/pipeline/__tests__/query-projection.integration.test.ts

@@ -92,7 +92,7 @@ const qpFeature = defineFeature("qp", (r) => {
     "widget:list-tenant",
     z.object({}),
     async (_query, ctx) => ctx.queryProjection("qp:projection:widget-count-tenant"),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.queryHandler(
@@ -102,14 +102,14 @@ const qpFeature = defineFeature("qp", (r) => {
       ctx.queryProjection("qp:projection:widget-audit", {
         unsafeAllTenants: query.payload.unsafeAllTenants ?? false,
       }),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 
   r.queryHandler(
     "widget:list-ghost",
     z.object({}),
     async (_query, ctx) => ctx.queryProjection("qp:projection:does-not-exist"),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 });