@cosmicdrift/kumiko-framework 0.269.2 → 0.270.0

package/src/engine/__tests__/engine.test.ts

@@ -87,7 +87,7 @@ describe("defineFeature", () => {
           const _email: string = event.payload.email;
           return { isSuccess: true, data: { id: 1 } };
         },
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
 
@@ -105,7 +105,7 @@ describe("defineFeature", () => {
           isSuccess: true,
           data: null,
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
     expect(ref?.name).toBe("order:create");
@@ -115,7 +115,7 @@ describe("defineFeature", () => {
     let ref: { name: string } | undefined;
     defineFeature("test", (r) => {
       ref = r.queryHandler("order:list", z.object({}), async () => [], {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
     expect(ref?.name).toBe("order:list");
@@ -130,13 +130,15 @@ describe("defineFeature", () => {
         async function* (query) {
           yield `echo:${query.payload.prompt}`;
         },
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
     expect(ref?.name).toBe("chat:complete");
 
     const stored = feature.streamHandlers["chat:complete"];
-    expect(stored?.access).toEqual({ openToAll: true });
+    expect(stored?.access).toEqual({
+      openToAll: { reason: "test handler callable by any signed-in test user" },
+    });
 
     const chunks: string[] = [];
     for await (const chunk of stored!.handler(
@@ -225,7 +227,7 @@ describe("defineFeature", () => {
           const _id: number = query.payload.userId;
           return { id: _id, email: "test@test.de" };
         },
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
 
@@ -239,7 +241,7 @@ describe("defineFeature", () => {
       handler: async () => {
         return [{ id: 1, email: "test@test.de" }];
       },
-      access: { openToAll: true },
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
     });
 
     const feature = defineFeature("test", (r) => {
@@ -402,12 +404,12 @@ describe("createRegistry", () => {
   test("looks up handlers across features", () => {
     const f1 = defineFeature("admin", (r) => {
       r.writeHandler("user:invite", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
     const f2 = defineFeature("profile", (r) => {
       r.queryHandler("profile:me", z.object({}), async () => ({ id: 1 }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
 
@@ -442,12 +444,12 @@ describe("createRegistry", () => {
   test("different features can have same handler short name (prefixed differently)", () => {
     const f1 = defineFeature("a", (r) => {
       r.writeHandler("user:invite", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
     const f2 = defineFeature("b", (r) => {
       r.writeHandler("user:invite", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
 
@@ -513,7 +515,7 @@ describe("createRegistry", () => {
       );
       // Handler name "promote" has no entity prefix → can't be mapped
       r.writeHandler("promote", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
 
@@ -531,7 +533,7 @@ describe("createRegistry", () => {
       );
       // No field-access rules on entity → "reset" without entity prefix is fine
       r.writeHandler("reset", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
 
@@ -562,7 +564,7 @@ describe("createRegistry", () => {
           isSuccess: true,
           data: null,
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
     });
 
@@ -591,10 +593,12 @@ describe("createRegistry", () => {
           isSuccess: true,
           data: null,
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       // Typo: "emp" instead of "employee"
-      r.queryHandler("emp:list", z.object({}), async () => [], { access: { openToAll: true } });
+      r.queryHandler("emp:list", z.object({}), async () => [], {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
     });
 
     expect(() => createRegistry([feature])).toThrow(/emp:list.*entity-bound.*no matching entity/i);
@@ -622,13 +626,15 @@ describe("createRegistry", () => {
           isSuccess: true,
           data: null,
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       // Standalone queries — no dot, intentionally not entity-bound
       r.queryHandler("dashboard", z.object({}), async () => ({ total: 42 }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
+      r.queryHandler("orgChart", z.object({}), async () => [], {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
-      r.queryHandler("orgChart", z.object({}), async () => [], { access: { openToAll: true } });
     });
 
     expect(() => createRegistry([feature])).not.toThrow();
@@ -924,12 +930,20 @@ describe("hasAccess", () => {
 
   test("openToAll grants access to any authenticated user", () => {
     const user = createTestUser({ roles: ["Employee"] });
-    expect(hasAccess(user, { openToAll: true })).toBe(true);
+    expect(
+      hasAccess(user, {
+        openToAll: { reason: "test handler callable by any signed-in test user" },
+      }),
+    ).toBe(true);
   });
 
   test("openToAll grants access even to user with no roles", () => {
     const user = createTestUser({ roles: [] });
-    expect(hasAccess(user, { openToAll: true })).toBe(true);
+    expect(
+      hasAccess(user, {
+        openToAll: { reason: "test handler callable by any signed-in test user" },
+      }),
+    ).toBe(true);
   });
 
   test.each([{ openToAll: false }, { openToAll: {} }])(
@@ -2105,10 +2119,10 @@ describe("registry boot validation", () => {
     const feature = defineFeature("shop", (r) => {
       r.entity("order", createEntity({ table: "Orders", fields: {} }));
       r.writeHandler("order:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.writeHandler("order:cancel", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       // Ein Job-Body, zwei Trigger — DRY-Pattern für Fanout-Cases.
       r.job(
@@ -2129,7 +2143,7 @@ describe("registry boot validation", () => {
     const feature = defineFeature("shop", (r) => {
       r.entity("order", createEntity({ table: "Orders", fields: {} }));
       r.writeHandler("order:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       // create existiert, cancel nicht — zweiter Trigger ist Geist
       r.job(
@@ -2153,7 +2167,7 @@ describe("registry boot validation", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("item", createEntity({ table: "Items", fields: {} }));
       r.writeHandler("item.create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postSave", "item.create", async () => {});
     });

package/src/engine/__tests__/entity-handlers.test.ts

@@ -149,9 +149,11 @@ describe("defineEntityQueryHandler", () => {
 
   test("access option is forwarded", () => {
     const def = defineEntityListHandler("note", noteEntity, {
-      access: { openToAll: true },
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+    });
+    expect(def.access).toEqual({
+      openToAll: { reason: "test handler callable by any signed-in test user" },
     });
-    expect(def.access).toEqual({ openToAll: true });
   });
 });
 
@@ -180,10 +182,12 @@ describe("defineProjectionQueryHandler", () => {
     const def = defineProjectionQueryHandler(
       "revenue:list",
       "showcase:projection:customer-revenue",
-      { access: { openToAll: true } },
+      { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
     );
     expect(def.name).toBe("revenue:list");
-    expect(def.access).toEqual({ openToAll: true });
+    expect(def.access).toEqual({
+      openToAll: { reason: "test handler callable by any signed-in test user" },
+    });
     // Empty-object schema — handler takes no payload fields.
     expect(def.schema.safeParse({}).success).toBe(true);
   });
@@ -192,7 +196,7 @@ describe("defineProjectionQueryHandler", () => {
     const def = defineProjectionQueryHandler(
       "revenue:list",
       "showcase:projection:customer-revenue",
-      { access: { openToAll: true } },
+      { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
     );
     const fakeRows = [{ customer: "a", totalCents: 100 }];
     const ctx = {
@@ -215,7 +219,10 @@ describe("defineProjectionQueryHandler", () => {
     const def = defineProjectionQueryHandler(
       "revenue:list",
       "showcase:projection:customer-revenue",
-      { access: { openToAll: true }, unsafeAllTenants: true },
+      {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+        unsafeAllTenants: true,
+      },
     );
     const ctx = { queryProjection: mock().mockResolvedValue([]) };
     await def.handler(
@@ -328,7 +335,9 @@ describe("registerEntityCrud", () => {
     const { r, entities, writes, queries } = createCrudRegistrarMock();
     registerEntityCrud(r, "note", noteEntitySoftDelete, {
       write: { access: { roles: ["Admin"] } },
-      read: { access: { openToAll: true } },
+      read: {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      },
     });
     expect(entities["note"]).toBe(noteEntitySoftDelete);
     expect(writes.map((w) => w.name)).toEqual([
@@ -339,7 +348,9 @@ describe("registerEntityCrud", () => {
     ]);
     expect(queries.map((q) => q.name)).toEqual(["note:list", "note:detail"]);
     expect(writes[0]?.access).toEqual({ roles: ["Admin"] });
-    expect(queries[0]?.access).toEqual({ openToAll: true });
+    expect(queries[0]?.access).toEqual({
+      openToAll: { reason: "test handler callable by any signed-in test user" },
+    });
   });
 
   test("verbs.delete: false skips delete handler", () => {

package/src/engine/__tests__/entity-presave-wiring.integration.test.ts

@@ -50,7 +50,7 @@ const throwOnPreSave: import("../types").PreSaveHookFn = async () => {
 const contactFeature = defineFeature("presave-wiring", (r) => {
   r.crud("contact", contactEntity, {
     write: { access: { roles: ["User"] } },
-    read: { access: { openToAll: true } },
+    read: { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   });
 
   // preSave has no entity-wide `{ allOf }` shorthand (unlike postSave/
@@ -70,7 +70,7 @@ const throwingEntity = createEntity({
 const throwingFeature = defineFeature("presave-wiring-throw", (r) => {
   r.crud("thing", throwingEntity, {
     write: { access: { roles: ["User"] } },
-    read: { access: { openToAll: true } },
+    read: { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   });
   r.hook("preSave", "thing:create", throwOnPreSave);
 });

package/src/engine/__tests__/extends-registrar.test.ts

@@ -142,7 +142,7 @@ describe("extendsRegistrar", () => {
           isSuccess: true as const,
           data: { id: "c1" },
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.useExtension("audited", "credit");
     });
@@ -181,7 +181,7 @@ describe("extendsRegistrar", () => {
           isSuccess: true as const,
           data: { id: "v1" },
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.writeHandler(
         "vehicle:update",
@@ -190,7 +190,7 @@ describe("extendsRegistrar", () => {
           isSuccess: true as const,
           data: { id: "v1" },
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.useExtension("audited", "vehicle");
     });

package/src/engine/__tests__/feature-crud-shorthand.test.ts

@@ -11,7 +11,9 @@ const taskEntity = createEntity({
 describe("r.crud", () => {
   test("registers the entity + full CRUD handler set, same as registerEntityCrud", () => {
     const write = { access: { roles: ["Admin"] } } as const;
-    const read = { access: { openToAll: true } } as const;
+    const read = {
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+    } as const;
 
     const feature = defineFeature("via-crud", (r) => {
       r.crud("task", taskEntity, { write, read });
@@ -28,7 +30,9 @@ describe("r.crud", () => {
 
   test("without verbAccess, write handlers keep write.access (never fall back to the broader read.access)", () => {
     const write = { access: { roles: ["Manager"] } } as const;
-    const read = { access: { openToAll: true } } as const;
+    const read = {
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+    } as const;
 
     const feature = defineFeature("via-crud-no-verb-access", (r) => {
       r.crud("task", taskEntity, { write, read });
@@ -44,7 +48,9 @@ describe("r.crud", () => {
 
   test("verbAccess overrides access per verb, other verbs keep write/read.access", () => {
     const write = { access: { roles: ["Manager"] } } as const;
-    const read = { access: { openToAll: true } } as const;
+    const read = {
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+    } as const;
     const deleteAccess = { roles: ["Operator"] } as const;
     const restoreAccess = { roles: ["Operator"] } as const;
     const listAccess = { roles: ["Auditor"] } as const;

package/src/engine/__tests__/feature-crud-verb-access.integration.test.ts

@@ -13,7 +13,7 @@ const propertyEntity = createEntity({
 const propertyFeature = defineFeature("crud-verb-access", (r) => {
   r.crud("property", propertyEntity, {
     write: { access: { roles: ["User"] } },
-    read: { access: { openToAll: true } },
+    read: { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
     verbAccess: {
       delete: { roles: ["Admin"] },
       restore: { roles: ["Admin"] },

package/src/engine/__tests__/hook-phases.test.ts

@@ -27,7 +27,7 @@ describe("HookPhases defaults", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
       r.writeHandler("thing:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postSave", "thing:create", noopSave);
     });
@@ -41,7 +41,7 @@ describe("HookPhases defaults", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
       r.writeHandler("thing:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postSave", "thing:create", noopSave, { phase: HookPhases.inTransaction });
     });
@@ -60,7 +60,7 @@ describe("HookPhases defaults", () => {
           isSuccess: true,
           data: null,
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.hook("preDelete", "thing:delete", async () => undefined);
     });
@@ -95,7 +95,7 @@ describe("Registry phase filtering", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
       r.writeHandler("thing:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postSave", "thing:create", inTxFn, { phase: HookPhases.inTransaction });
       r.hook("postSave", "thing:create", afterFn); // default afterCommit
@@ -127,7 +127,7 @@ describe("Registry phase filtering", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
       r.writeHandler("thing:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
 

package/src/engine/__tests__/lifecycle-hooks.test.ts

@@ -69,7 +69,9 @@ describe("lifecycle hooks in registry", () => {
   test("merges preSave hooks within same feature", () => {
     const f1 = defineFeature("a", (r) => {
       r.entity("user", createEntity({ table: "Users", fields: {} }));
-      r.writeHandler("user", z.object({}), stubHandler, { access: { openToAll: true } });
+      r.writeHandler("user", z.object({}), stubHandler, {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("preSave", "user", async (changes) => changes);
       r.hook("preSave", "user", async (changes) => changes);
     });
@@ -81,12 +83,16 @@ describe("lifecycle hooks in registry", () => {
   test("cross-feature hooks use full prefixed name", () => {
     const f1 = defineFeature("a", (r) => {
       r.entity("user", createEntity({ table: "Users", fields: {} }));
-      r.writeHandler("user", z.object({}), stubHandler, { access: { openToAll: true } });
+      r.writeHandler("user", z.object({}), stubHandler, {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("postSave", "user", async () => {});
     });
     // Feature b hooks into a.user by using the full prefixed name
     const f2 = defineFeature("b", (r) => {
-      r.writeHandler("a.user", z.object({}), stubHandler, { access: { openToAll: true } });
+      r.writeHandler("a.user", z.object({}), stubHandler, {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("postSave", "a.user", async () => {});
       r.hook("postSave", "a.user", async () => {});
     });

package/src/engine/__tests__/multiselect-filter.integration.test.ts

@@ -28,7 +28,7 @@ const LIST_QN = "checklist:query:equipment:list";
 const checklistFeature = defineFeature("checklist", (r) => {
   r.crud("equipment", equipmentEntity, {
     write: { access: { roles: ["Admin"] } },
-    read: { access: { openToAll: true } },
+    read: { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   });
 });
 

package/src/engine/__tests__/post-query-hook.test.ts

@@ -24,7 +24,9 @@ describe("postQuery hook registration", () => {
   test("r.hook('postQuery', handlerQn, fn) lands in handler-keyed lifecycleHooks map", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
-      r.queryHandler("thing:list", z.object({}), async () => [], { access: { openToAll: true } });
+      r.queryHandler("thing:list", z.object({}), async () => [], {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("postQuery", "thing:list", noop);
     });
 
@@ -70,7 +72,9 @@ describe("Registry getters", () => {
 
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
-      r.queryHandler("thing:list", z.object({}), async () => [], { access: { openToAll: true } });
+      r.queryHandler("thing:list", z.object({}), async () => [], {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("postQuery", "thing:list", fn);
     });
 

package/src/engine/__tests__/projection-detail-actions.test.ts

@@ -42,13 +42,13 @@ describe("validateBoot — projectionDetail actions (fw#2166)", () => {
   test("valid navigate + writeHandler actions boot cleanly", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("rent:detail", z.object({}), async () => ({ description: "x" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.writeHandler(
         "archive",
         z.object({ id: z.string() }),
         async () => ({ isSuccess: true as const, data: {} }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.screen({
         id: "rent-detail",

package/src/engine/__tests__/projection-detail-singleton.test.ts

@@ -21,7 +21,7 @@ describe("validateBoot — projectionDetail singleton (fw#2312)", () => {
   test("singleton + idParam throws", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("me", z.object({}), async () => ({ id: "u1" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "profile",
@@ -46,7 +46,7 @@ describe("validateBoot — projectionDetail singleton (fw#2312)", () => {
         }),
       );
       r.queryHandler("me", z.object({}), async () => ({ id: "u1" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "profile",
@@ -71,7 +71,7 @@ describe("validateBoot — projectionDetail singleton (fw#2312)", () => {
   test("singleton without idParam/detailFor boots cleanly", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("me", z.object({}), async () => ({ id: "u1" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "profile",

package/src/engine/__tests__/projection-detail-tabs.test.ts

@@ -140,7 +140,7 @@ describe("validateBoot — projectionDetail tabs (fw record-layout)", () => {
   test("object-form metric with its own label needs no fieldLabels entry", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("rent:detail", z.object({}), async () => ({ description: "x" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "rent-detail",
@@ -192,7 +192,7 @@ describe("validateBoot — projectionDetail tabs (fw record-layout)", () => {
   test("metric navigate.tab with no screen/entity — a known section id boots cleanly", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("rent:detail", z.object({}), async () => ({ description: "x" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "rent-detail",
@@ -214,7 +214,7 @@ describe("validateBoot — projectionDetail tabs (fw record-layout)", () => {
   test("valid tabs + header + metrics declaration boots cleanly", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("rent:detail", z.object({}), async () => ({ description: "x" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "rent-detail",

package/src/engine/__tests__/projection-list-filter.integration.test.ts

@@ -37,7 +37,7 @@ const LIST_QN = "roster:query:member:list";
 const rosterFeature = defineFeature("roster", (r) => {
   r.crud("member", memberEntity, {
     write: { access: { roles: ["Admin"] } },
-    read: { access: { openToAll: true } },
+    read: { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   });
   r.screen({
     id: "member-list",