@cosmicdrift/kumiko-framework 0.299.0 → 0.305.0

package/src/engine/boot-validator/__tests__/no-all-role-in-handler-access.test.ts

@@ -0,0 +1,77 @@
+import { describe, expect, test } from "bun:test";
+import { z } from "zod";
+import { defineFeature } from "../../define-feature";
+import { validateHandlerAccess } from "../entity-handler";
+
+describe('validateHandlerAccess — roles: ["all"] is rejected', () => {
+  test("a write handler with roles: ['all'] throws, naming the handler", () => {
+    const feature = defineFeature("no-all-write", (r) => {
+      r.writeHandler(
+        "note:create",
+        z.object({ title: z.string() }),
+        async () => ({
+          isSuccess: true as const,
+          data: {},
+        }),
+        {
+          access: { roles: ["all"] },
+        },
+      );
+    });
+
+    expect(() => validateHandlerAccess(feature)).toThrow(/no-all-write:write:note:create/);
+    expect(() => validateHandlerAccess(feature)).toThrow(/no session ever carries the role "all"/);
+  });
+
+  test("a query handler with roles: ['all'] throws, naming the handler", () => {
+    const feature = defineFeature("no-all-query", (r) => {
+      r.queryHandler(
+        "note:list",
+        z.object({}),
+        async () => ({ isSuccess: true as const, data: {} }),
+        {
+          access: { roles: ["all"] },
+        },
+      );
+    });
+
+    expect(() => validateHandlerAccess(feature)).toThrow(/no-all-query:query:note:list/);
+  });
+
+  test("openToAll access is unaffected", () => {
+    const feature = defineFeature("open-to-all-ok", (r) => {
+      r.writeHandler(
+        "note:create",
+        z.object({ title: z.string() }),
+        async () => ({
+          isSuccess: true as const,
+          data: {},
+        }),
+        {
+          access: { openToAll: { reason: "any signed-in user" } },
+        },
+      );
+    });
+
+    expect(() => validateHandlerAccess(feature)).not.toThrow();
+  });
+
+  test("roles: ['anonymous'] with a rateLimit boots fine", () => {
+    const feature = defineFeature("anon-ok", (r) => {
+      r.writeHandler(
+        "note:create",
+        z.object({ title: z.string() }),
+        async () => ({
+          isSuccess: true as const,
+          data: {},
+        }),
+        {
+          access: { roles: ["anonymous"] },
+          rateLimit: { per: "ip", limit: 10, windowSeconds: 60 },
+        },
+      );
+    });
+
+    expect(() => validateHandlerAccess(feature)).not.toThrow();
+  });
+});

package/src/engine/boot-validator/access-declarations.ts

@@ -1,67 +1,20 @@
+import {
+  accessAllowsAnonymous,
+  declaredPersonalData,
+  personalFieldNames,
+} from "../personal-data-fields";
+import { ANONYMOUS_ROLE } from "../system-user";
 import type {
   AccessRule,
   FeatureDefinition,
-  OwnershipMap,
-  OwnershipRule,
   QueryHandlerDef,
   StreamHandlerDef,
   WriteHandlerDef,
 } from "../types";
-import type { EntityDefinition, ResolvedPiiFlags } from "../types/fields";
 import { collectZodObjectKeys } from "./zod-shape";
 
 type HandlerKind = "write" | "query" | "stream";
 
-// Personal-data annotation check mirrors pii-retention.ts's hasAnonymizableSubjectField,
-// minus tenantOwned: a tenant-scoped field isn't an individual's personal data in the
-// sense the openToAll personal-data check is guarding against.
-function isPersonalDataField(field: unknown): boolean {
-  const annot = field as ResolvedPiiFlags; // @cast-boundary schema-walk — see pii-retention.ts
-  return Boolean(annot.pii || annot.userOwned || annot.recordOwned);
-}
-
-function isCallerIdRuleOn(rule: OwnershipRule, column: string): boolean {
-  if (rule === "all" || rule.kind !== "from") return false;
-  return rule.refKind === "user" && rule.refPath === "id" && rule.column === column;
-}
-
-// The executor checks access.write against every created/updated row; one "all" role
-// or an empty map (= public) lets a caller write rows owned by someone else.
-function writeMapBindsRowsToCaller(
-  writeMap: OwnershipMap | undefined,
-  ownerColumn: string,
-): boolean {
-  const rules = Object.values(writeMap ?? {});
-  return rules.length > 0 && rules.every((rule) => isCallerIdRuleOn(rule, ownerColumn));
-}
-
-const ROW_ID_COLUMN = "id";
-
-// A self/record-owned field's subject is the row itself, so only from("user:id", "id")
-// makes that row the caller — on any other entity "self" names a third party.
-function callerBindingColumn(annot: ResolvedPiiFlags): string | undefined {
-  if (annot.userOwned) return annot.userOwned.ownerField;
-  if (annot.pii || annot.recordOwned) return ROW_ID_COLUMN;
-  return undefined;
-}
-
-function isOwnerBoundField(field: unknown, entity: EntityDefinition): boolean {
-  const column = callerBindingColumn(field as ResolvedPiiFlags); // @cast-boundary schema-walk — see pii-retention.ts
-  return column !== undefined && writeMapBindsRowsToCaller(entity.access?.write, column);
-}
-
-function personalFieldNames(
-  entity: EntityDefinition,
-  honorOwnerBinding: boolean,
-): ReadonlySet<string> {
-  const names = new Set<string>();
-  for (const [fieldName, field] of Object.entries(entity.fields)) {
-    const exempt = honorOwnerBinding && isOwnerBoundField(field, entity);
-    if (isPersonalDataField(field) && !exempt) names.add(fieldName);
-  }
-  return names;
-}
-
 // escapeHatch and r.systemScope() can write around the entity's write map
 // (db.global(), systemDb, SYSTEM identity), so the map no longer vouches for the row.
 function canWriteAroundExecutor(feature: FeatureDefinition, handler: WriteHandlerDef): boolean {
@@ -73,12 +26,14 @@ function candidatePersonalFieldNames(
   feature: FeatureDefinition,
   handlerName: string,
   handler: WriteHandlerDef,
+  honorOwnerBindingOverride?: boolean,
 ): ReadonlySet<string> {
   const mappedEntityName = feature.handlerEntityMappings?.[handlerName];
   const entities = feature.entities ?? {};
   if (mappedEntityName) {
     const entity = entities[mappedEntityName];
-    const honorOwnerBinding = !canWriteAroundExecutor(feature, handler);
+    const honorOwnerBinding =
+      honorOwnerBindingOverride ?? !canWriteAroundExecutor(feature, handler);
     return entity ? personalFieldNames(entity, honorOwnerBinding) : new Set();
   }
   const names = new Set<string>();
@@ -101,14 +56,6 @@ function hasOpenToAll(access: AccessRule): boolean {
   return "openToAll" in access;
 }
 
-// Read via `unknown`: access can come from untyped sources (pattern JSON, Designer).
-function declaredPersonalData(access: AccessRule): unknown {
-  if (!("openToAll" in access)) return undefined;
-  const openToAll: unknown = access.openToAll;
-  if (typeof openToAll !== "object" || openToAll === null) return undefined;
-  return "personalData" in openToAll ? openToAll.personalData : undefined;
-}
-
 function declaresTenantMembersPersonalData(access: AccessRule): boolean {
   return declaredPersonalData(access) === "tenant-members";
 }
@@ -154,9 +101,10 @@ function validatePersonalDataOnlyOnWrite(
 ): void {
   // skip: write handlers may declare personalData, or it wasn't declared here
   if (kind === "write" || declaredPersonalData(access) === undefined) return;
+  const property = "openToAll" in access ? "openToAll.personalData" : "access.personalData";
   throw new Error(
     `[Feature ${feature.name}] ${kind} handler "${handlerName}" declares ` +
-      "openToAll.personalData — it only applies to write handlers, whose input is " +
+      `${property} — it only applies to write handlers, whose input is ` +
       "checked for personal-data fields.",
   );
 }
@@ -167,11 +115,29 @@ function validatePersonalDataValue(
   access: AccessRule,
 ): void {
   const declared = declaredPersonalData(access);
-  // skip: nothing declared, or the one supported value
-  if (declared === undefined || declared === "tenant-members") return;
+  // skip: nothing declared
+  if (declared === undefined) return;
+  if ("openToAll" in access) {
+    // skip: the one supported value on openToAll
+    if (declared === "tenant-members") return;
+    throw new Error(
+      `[Feature ${feature.name}] write handler "${handlerName}" declares an unknown ` +
+        `openToAll.personalData ${JSON.stringify(declared)} — the only supported value is "tenant-members".`,
+    );
+  }
+  if (declared !== "public-intake") {
+    throw new Error(
+      `[Feature ${feature.name}] write handler "${handlerName}" declares an unknown ` +
+        `access.personalData ${JSON.stringify(declared)} — the only supported value is "public-intake".`,
+    );
+  }
+  // skip: roles include "anonymous", which personalData: "public-intake" requires
+  if (Array.isArray(access.roles) && access.roles.includes(ANONYMOUS_ROLE)) return;
   throw new Error(
-    `[Feature ${feature.name}] write handler "${handlerName}" declares an unknown ` +
-      `openToAll.personalData ${JSON.stringify(declared)} — the only supported value is "tenant-members".`,
+    `[Feature ${feature.name}] write handler "${handlerName}" declares ` +
+      'access.personalData: "public-intake" but its roles do not include ' +
+      `"${ANONYMOUS_ROLE}" — personalData: "public-intake" only applies to handlers ` +
+      "that allow anonymous callers.",
   );
 }
 
@@ -200,12 +166,37 @@ function validateOpenToAllPersonalData(
   );
 }
 
+// Anonymous callers all share one user.id, so honorOwnerBindingOverride is always false here.
+function validateAnonymousPersonalData(
+  feature: FeatureDefinition,
+  handlerName: string,
+  handler: WriteHandlerDef,
+): void {
+  const access = handler.access;
+  // skip: not reachable by an anonymous caller, or already declares public-intake
+  if (!accessAllowsAnonymous(access) || declaredPersonalData(access) === "public-intake") return;
+  const inputKeys = collectZodObjectKeys(handler.schema);
+  const personalNames = candidatePersonalFieldNames(feature, handlerName, handler, false);
+  const offending = [...inputKeys].filter((key) => personalNames.has(key));
+  // skip: no personal-data fields in the handler's input
+  if (offending.length === 0) return;
+  throw new Error(
+    `[Feature ${feature.name}] write handler "${handlerName}" allows anonymous callers ` +
+      `("${ANONYMOUS_ROLE}" in access.roles) and accepts personal-data field(s) ` +
+      `${offending.map((f) => `"${f}"`).join(", ")}. Declare ` +
+      'access: { roles: [..., "anonymous"], personalData: "public-intake" } — every anonymous ' +
+      'request shares one caller identity, so owner-binding via from("user:id", ...) does not ' +
+      "vouch for it; protection comes from the handler's required rateLimit (per ip).",
+  );
+}
+
 export function validateAccessDeclarations(feature: FeatureDefinition): void {
   for (const [handlerName, handler] of Object.entries(feature.writeHandlers)) {
     validateOpenToAllReason(feature, "write", handlerName, handler.access);
     validateEscapeHatchReason(feature, "write", handlerName, handler.escapeHatch);
     validatePersonalDataValue(feature, handlerName, handler.access);
     validateOpenToAllPersonalData(feature, handlerName, handler);
+    validateAnonymousPersonalData(feature, handlerName, handler);
   }
   for (const [handlerName, handler] of Object.entries(feature.queryHandlers)) {
     validateOpenToAllReason(feature, "query", handlerName, handler.access);

package/src/engine/boot-validator/entity-handler.ts

@@ -148,6 +148,7 @@ export function validateHandlerAccess(feature: FeatureDefinition): void {
             `Set { roles: [...] } for role-based access, or { openToAll: { reason: "..." } } for any authenticated user.`,
         );
       }
+      validateNoAllRoleInHandlerAccess(feature.name, kind, name, handler.access);
       validateAnonymousRateLimit(feature.name, kind, name, handler.access, handler.rateLimit);
       validateRateLimitDisabledReason(feature.name, kind, name, handler.rateLimit);
     }
@@ -171,6 +172,25 @@ export function validateRateLimitDisabledReason(
   }
 }
 
+// No session ever carries the role "all" — `roles: ["all"]` is unreachable dead config, not a wildcard.
+export function validateNoAllRoleInHandlerAccess(
+  featureName: string,
+  kind: "write" | "query" | "stream",
+  handlerName: string,
+  access: NonNullable<FeatureDefinition["writeHandlers"][string]["access"]>,
+): void {
+  // skip: openToAll has no roles list to check
+  if (!("roles" in access)) return;
+  // skip: no "all" in the roles list, nothing unreachable to report
+  if (!access.roles.includes("all")) return;
+  throw new Error(
+    `${kind} handler "${featureName}:${kind}:${handlerName}" declares access: { roles: ["all"] } — ` +
+      `no session ever carries the role "all", so this handler is unreachable by any caller. ` +
+      `Use access: { roles: ["anonymous"] } plus rateLimit: { per: "ip", ... } (or "ip+handler") ` +
+      `for unauthenticated callers, or access: { openToAll: { reason: "..." } } for any signed-in user.`,
+  );
+}
+
 export function validateAnonymousRateLimit(
   featureName: string,
   kind: "write" | "query" | "stream",

package/src/engine/feature-ast/__tests__/patch.test.ts

@@ -239,6 +239,7 @@ describe("patch coverage for the remaining pattern-kinds", () => {
       method: "GET",
       path: "/health",
       handlerSource: "async (c) => c.json({ ok: true })",
+      anonymous: true,
     });
     expect(parseSourceFile(sf).patterns).toHaveLength(3);
     removePattern(sf, { kind: "httpRoute", method: "GET", path: "/health" });

package/src/engine/feature-ast/__tests__/patcher.test.ts

@@ -328,6 +328,7 @@ describe("FeaturePatcher — coverage for the remaining typed adds", () => {
       method: "GET",
       path: "/health",
       handlerSource: "async (c) => c.json({ ok: true })",
+      anonymous: true,
     });
     const result = parseSourceFile(sf);
     expect(result.errors).toEqual([]);

package/src/engine/feature-ast/__tests__/read-optional-access-rule.test.ts

@@ -26,3 +26,17 @@ describe("readOptionalAccessRule — openToAll.personalData", () => {
     ).toBeUndefined();
   });
 });
+
+describe("readOptionalAccessRule — roles.personalData", () => {
+  test("keeps personalData: public-intake on the roles form", () => {
+    expect(readOptionalAccessRule({ roles: ["anonymous"], personalData: "public-intake" })).toEqual(
+      { roles: ["anonymous"], personalData: "public-intake" },
+    );
+  });
+
+  test("drops an unknown personalData value on the roles form", () => {
+    expect(
+      readOptionalAccessRule({ roles: ["anonymous"], personalData: "tenant-members" }),
+    ).toEqual({ roles: ["anonymous"] });
+  });
+});

package/src/engine/feature-ast/extractors/hooks.ts

@@ -41,7 +41,9 @@ export function readOptionalPhase(node: Node | undefined): HookPhase | undefined
 export function readOptionalAccessRule(value: unknown): AccessRule | undefined {
   if (!isPlainObject(value)) return undefined;
   if (Array.isArray(value["roles"]) && value["roles"].every((r) => typeof r === "string")) {
-    return { roles: value["roles"] as readonly string[] };
+    const personalData =
+      value["personalData"] === "public-intake" ? { personalData: "public-intake" as const } : {};
+    return { roles: value["roles"] as readonly string[], ...personalData };
   }
   const openToAll = value["openToAll"];
   if (isPlainObject(openToAll) && typeof openToAll["reason"] === "string") {

package/src/engine/feature-ast/extractors/jobs-routes.ts

@@ -210,13 +210,16 @@ export function extractHttpRoute(
       "handler must be an inline arrow function or function expression",
     );
   }
-  const anonymous = readBooleanProperty(arg, "anonymous");
+  // Missing/non-boolean `anonymous` reads as false (the safe side — mounted
+  // behind the session auth chain, not public) so a source file that predates
+  // the required field still parses instead of erroring here.
+  const anonymous = readBooleanProperty(arg, "anonymous") === true;
   return ok({
     kind: "httpRoute",
     source: sourceLocationFromNode(call, sourceFile),
     method: methodValue,
     path: pathLiteral.getLiteralValue(),
     handlerBody: sourceLocationFromNode(fn, sourceFile),
-    ...(anonymous === true && { anonymous: true }),
+    anonymous,
   });
 }

package/src/engine/feature-ast/patcher.ts

@@ -149,7 +149,7 @@ export type AddHttpRouteArgs = {
   readonly method: HttpRouteMethod;
   readonly path: string;
   readonly handlerSource: string;
-  readonly anonymous?: boolean;
+  readonly anonymous: boolean;
 };
 
 export type AddDefineEventArgs = {
@@ -480,7 +480,7 @@ export function createFeaturePatcher(sourceFile: SourceFile): FeaturePatcher {
         method,
         path,
         handlerBody: rawLoc(handlerSource),
-        ...(anonymous === true && { anonymous: true }),
+        anonymous,
       });
     },
 

package/src/engine/feature-ast/patterns.ts

@@ -508,7 +508,7 @@ export type HttpRoutePattern = {
   readonly source: SourceLocation;
   readonly method: HttpRouteMethod;
   readonly path: string;
-  readonly anonymous?: boolean;
+  readonly anonymous: boolean;
   readonly handlerBody: SourceLocation;
 };
 

package/src/engine/feature-ast/render.ts

@@ -558,7 +558,7 @@ function renderHttpRoute(p: HttpRoutePattern): string {
   const lines: string[] = ["r.httpRoute({"];
   lines.push(`  method: ${JSON.stringify(p.method)},`);
   lines.push(`  path: ${JSON.stringify(p.path)},`);
-  if (p.anonymous === true) lines.push("  anonymous: true,");
+  lines.push(`  anonymous: ${p.anonymous},`);
   lines.push(`  handler: ${p.handlerBody.raw},`);
   lines.push("});");
   return lines.join("\n");

package/src/engine/feature-ui-extensions.ts

@@ -498,6 +498,12 @@ export function buildUiExtensionsMethods<TName extends string>(
             `Pick a different path or use r.queryHandler / r.writeHandler.`,
         );
       }
+      if (typeof definition.anonymous !== "boolean") {
+        throw new Error(
+          `[Feature ${name}] httpRoute "${definition.method} ${definition.path}" must declare ` +
+            `anonymous: true | false — true mounts it public, false behind the session auth chain.`,
+        );
+      }
       const key = `${definition.method} ${definition.path}`;
       if (state.httpRoutes[key]) {
         throw new Error(

package/src/engine/index.ts

@@ -410,6 +410,8 @@ export type {
   HookMap,
   ImageFieldDef,
   ImagesFieldDef,
+  JobBackoff,
+  JobBackoffStrategy,
   JobContext,
   JobDefinition,
   JobHandlerFn,
@@ -476,6 +478,8 @@ export type {
   RelationDefinition,
   ResolvedPiiFlags,
   RetentionDef,
+  RoleAccessPersonalData,
+  RoleAccessRule,
   RowAction,
   RowActionNavigate,
   RowActionNavigateBase,

package/src/engine/membership-roles.ts

@@ -6,8 +6,9 @@
 // survive a projection rebuild: replaying a stored membership event goes
 // through the apply path, not the handler. stripForbiddenMembershipRoles is
 // the read-time backstop — applied at every JWT mint that derives roles from
-// membership, it neutralises a resurrected role without touching globalRoles
-// (where SystemAdmin legitimately lives).
+// membership, it neutralises a resurrected role. buildSessionRoles applies a
+// matching strip (anonymous/all only) to globalRoles, where SystemAdmin
+// legitimately lives.
 
 import { access } from "./config-helpers";
 
@@ -26,11 +27,21 @@ export function findForbiddenMembershipRole(roles: readonly string[]): string |
 }
 
 // Filters reserved roles out of the membership portion only. Callers merge the
-// result with globalRoles, which is never filtered.
+// result with globalRoles, which buildSessionRoles filters separately below.
 export function stripForbiddenMembershipRoles(roles: readonly string[]): readonly string[] {
   return roles.filter((role) => !isForbiddenMembershipRole(role));
 }
 
+// "anonymous"/"all" are never legitimate global roles; system/SystemAdmin stay.
+const NON_MINTABLE_GLOBAL_ROLES: ReadonlySet<string> = new Set<string>([
+  ...access.all,
+  ...access.anonymous,
+]);
+
+function stripNonMintableGlobalRoles(roles: readonly string[]): readonly string[] {
+  return roles.filter((role) => !NON_MINTABLE_GLOBAL_ROLES.has(role));
+}
+
 // Single mint path for session roles: merges globalRoles with the stripped
 // membership portion and dedupes. Every place that builds a session's roles
 // from a membership should go through this instead of repeating
@@ -41,5 +52,10 @@ export function buildSessionRoles(
   globalRoles: readonly string[],
   membershipRoles: readonly string[],
 ): readonly string[] {
-  return Array.from(new Set([...globalRoles, ...stripForbiddenMembershipRoles(membershipRoles)]));
+  return Array.from(
+    new Set([
+      ...stripNonMintableGlobalRoles(globalRoles),
+      ...stripForbiddenMembershipRoles(membershipRoles),
+    ]),
+  );
 }

package/src/engine/pattern-library/__tests__/library.test.ts

@@ -315,6 +315,7 @@ function makePlaceholderPattern(kind: FeaturePatternKind): FeaturePattern {
         source: PLACEHOLDER_LOC,
         method: "GET",
         path: "/x",
+        anonymous: true,
         handlerBody: PLACEHOLDER_BODY_LOC,
       };
     case "projection":

package/src/engine/pattern-library/mixed-schemas.ts

@@ -453,6 +453,7 @@ export const httpRouteSchema: PatternFormSchema = {
       path: "anonymous",
       label: { en: "Anonymous (no auth)", de: "Anonym (keine Auth)" },
       input: "boolean",
+      required: true,
     },
     {
       path: "handlerBody",

package/src/engine/personal-data-fields.ts

@@ -0,0 +1,66 @@
+import { ANONYMOUS_ROLE } from "./system-user";
+import type { AccessRule, OwnershipMap, OwnershipRule } from "./types";
+import type { EntityDefinition, ResolvedPiiFlags } from "./types/fields";
+
+// Personal-data annotation check mirrors pii-retention.ts's hasAnonymizableSubjectField,
+// minus tenantOwned: a tenant-scoped field isn't an individual's personal data in the
+// sense the openToAll / public-intake personal-data checks are guarding against.
+function isPersonalDataField(field: unknown): boolean {
+  const annot = field as ResolvedPiiFlags; // @cast-boundary schema-walk — see pii-retention.ts
+  return Boolean(annot.pii || annot.userOwned || annot.recordOwned);
+}
+
+function isCallerIdRuleOn(rule: OwnershipRule, column: string): boolean {
+  if (rule === "all" || rule.kind !== "from") return false;
+  return rule.refKind === "user" && rule.refPath === "id" && rule.column === column;
+}
+
+// The executor checks access.write against every created/updated row; one "all" role
+// or an empty map (= public) lets a caller write rows owned by someone else.
+function writeMapBindsRowsToCaller(
+  writeMap: OwnershipMap | undefined,
+  ownerColumn: string,
+): boolean {
+  const rules = Object.values(writeMap ?? {});
+  return rules.length > 0 && rules.every((rule) => isCallerIdRuleOn(rule, ownerColumn));
+}
+
+const ROW_ID_COLUMN = "id";
+
+// A self/record-owned field's subject is the row itself, so only from("user:id", "id")
+// makes that row the caller — on any other entity "self" names a third party.
+function callerBindingColumn(annot: ResolvedPiiFlags): string | undefined {
+  if (annot.userOwned) return annot.userOwned.ownerField;
+  if (annot.pii || annot.recordOwned) return ROW_ID_COLUMN;
+  return undefined;
+}
+
+function isOwnerBoundField(field: unknown, entity: EntityDefinition): boolean {
+  const column = callerBindingColumn(field as ResolvedPiiFlags); // @cast-boundary schema-walk — see pii-retention.ts
+  return column !== undefined && writeMapBindsRowsToCaller(entity.access?.write, column);
+}
+
+export function personalFieldNames(
+  entity: EntityDefinition,
+  honorOwnerBinding: boolean,
+): ReadonlySet<string> {
+  const names = new Set<string>();
+  for (const [fieldName, field] of Object.entries(entity.fields)) {
+    const exempt = honorOwnerBinding && isOwnerBoundField(field, entity);
+    if (isPersonalDataField(field) && !exempt) names.add(fieldName);
+  }
+  return names;
+}
+
+// Read via `unknown`: access can come from untyped sources (pattern JSON, Designer).
+export function declaredPersonalData(access: AccessRule): unknown {
+  if (!("openToAll" in access)) return access.personalData;
+  const openToAll: unknown = access.openToAll;
+  if (typeof openToAll !== "object" || openToAll === null) return undefined;
+  return "personalData" in openToAll ? openToAll.personalData : undefined;
+}
+
+export function accessAllowsAnonymous(access: AccessRule): boolean {
+  if ("openToAll" in access) return false;
+  return Array.isArray(access.roles) && access.roles.includes(ANONYMOUS_ROLE);
+}

package/src/engine/registry-validate.ts

@@ -729,6 +729,21 @@ export function validateBootGates(state: RegistryState): void {
   }
 }
 
+export function validateJobBackoff(state: RegistryState): void {
+  // Object-form backoff carries an explicit delayMs base — catch a bad value
+  // at boot instead of letting BullMQ silently compute NaN/undefined delays.
+  for (const [jobName, jobDef] of state.jobMap) {
+    if (typeof jobDef.backoff !== "object") continue;
+    const { delayMs } = jobDef.backoff;
+    if (delayMs === undefined) continue;
+    if (!Number.isInteger(delayMs) || delayMs <= 0) {
+      throw new Error(
+        `Job "${jobName}" backoff.delayMs must be a positive integer (got ${delayMs})`,
+      );
+    }
+  }
+}
+
 export function validateExtensionUsageTargets(state: RegistryState): void {
   // Validate: extension usages must reference existing extensions
   for (const usage of state.extensionUsages) {

package/src/engine/registry.ts

@@ -34,6 +34,7 @@ import {
   validateExtensionSelectors,
   validateExtensionUsageTargets,
   validateFieldAccessHandlersAreEntityMapped,
+  validateJobBackoff,
   validateJobTriggers,
   validateLifecycleHookTargets,
   validateProjectionApplyKeys,
@@ -83,6 +84,7 @@ export function createRegistry(rawFeatures: readonly FeatureDefinition[]): Regis
   validateEntityHookTargets(state, features);
   validateJobTriggers(state);
   validateBootGates(state);
+  validateJobBackoff(state);
   validateExtensionUsageTargets(state);
   computeHasRateLimitedHandler(state);
   publishEventPiiCatalog(state);

package/src/engine/types/index.ts

@@ -32,6 +32,8 @@ export type {
   CreateTenantSeedOptions,
   CreateUserSeedOptions,
   ExtensionSelectorDef,
+  JobBackoff,
+  JobBackoffStrategy,
   JobDefinition,
   JobHandlerFn,
   JobRunIn,
@@ -194,6 +196,8 @@ export type {
   RateLimitDisabled,
   RateLimitOption,
   RateLimitPer,
+  RoleAccessPersonalData,
+  RoleAccessRule,
   SessionUser,
   SessionUserOrigin,
   StreamHandlerDef,