@objectstack/lint 12.5.0 → 13.0.0

package/dist/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  CAPABILITY_REFERENCE_UNKNOWN: () => CAPABILITY_REFERENCE_UNKNOWN,
   CHART_CONFIG_MISSING: () => CHART_CONFIG_MISSING,
   CHART_FIELD_UNKNOWN: () => CHART_FIELD_UNKNOWN,
   FIELD_GROUP_EMPTY: () => FIELD_GROUP_EMPTY,
@@ -29,6 +30,13 @@ __export(index_exports, {
   LIST_VIEW_FILTERS_IN_VIEWS_MODE: () => LIST_VIEW_FILTERS_IN_VIEWS_MODE,
   MEASURE_AGGREGATE_INCOHERENT: () => MEASURE_AGGREGATE_INCOHERENT,
   PAGE_SOURCE_CLASSNAME: () => PAGE_SOURCE_CLASSNAME,
+  SECURITY_ANCHOR_HIGH_PRIVILEGE: () => SECURITY_ANCHOR_HIGH_PRIVILEGE,
+  SECURITY_EXTERNAL_WIDER: () => SECURITY_EXTERNAL_WIDER,
+  SECURITY_OWD_ALIAS: () => SECURITY_OWD_ALIAS,
+  SECURITY_OWD_UNSET: () => SECURITY_OWD_UNSET,
+  SECURITY_PRIVATE_NO_READSCOPE: () => SECURITY_PRIVATE_NO_READSCOPE,
+  SECURITY_ROLE_WORD: () => SECURITY_ROLE_WORD,
+  SECURITY_WILDCARD_VAMA: () => SECURITY_WILDCARD_VAMA,
   SEMANTIC_ROLE_FIELD_UNKNOWN: () => SEMANTIC_ROLE_FIELD_UNKNOWN,
   STYLE_CLASSNAME_TAILWIND: () => STYLE_CLASSNAME_TAILWIND,
   STYLE_NODE_MISSING_ID: () => STYLE_NODE_MISSING_ID,
@@ -41,6 +49,9 @@ __export(index_exports, {
   WIDGET_DATASET_UNKNOWN: () => WIDGET_DATASET_UNKNOWN,
   WIDGET_DIMENSION_UNKNOWN: () => WIDGET_DIMENSION_UNKNOWN,
   WIDGET_MEASURE_UNKNOWN: () => WIDGET_MEASURE_UNKNOWN,
+  buildAccessMatrix: () => buildAccessMatrix,
+  diffAccessMatrix: () => diffAccessMatrix,
+  validateCapabilityReferences: () => validateCapabilityReferences,
   validateFormLayout: () => validateFormLayout,
   validateJsxPages: () => validateJsxPages,
   validateListViewMode: () => validateListViewMode,
@@ -49,6 +60,7 @@ __export(index_exports, {
   validateReactPages: () => validateReactPages,
   validateRecordTitle: () => validateRecordTitle,
   validateResponsiveStyles: () => validateResponsiveStyles,
+  validateSecurityPosture: () => validateSecurityPosture,
   validateSemanticRoles: () => validateSemanticRoles,
   validateStackExpressions: () => validateStackExpressions,
   validateWidgetBindings: () => validateWidgetBindings
@@ -430,7 +442,6 @@ function validateStackExpressions(stack) {
 
 // src/validate-list-view-mode.ts
 var LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-var FORBIDDEN_FIELDS = ["userFilters", "quickFilters"];
 function asArray3(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -444,17 +455,30 @@ function asArray3(v) {
 function scanView(view, where, path, out) {
   if (!view || typeof view !== "object") return;
   const rec = view;
-  for (const field of FORBIDDEN_FIELDS) {
-    if (rec[field] == null) continue;
+  if (rec.quickFilters != null) {
     out.push({
       severity: "error",
       rule: LIST_VIEW_FILTERS_IN_VIEWS_MODE,
       where,
-      path: `${path}.${field}`,
-      message: `\`${field}\` is a page filters-mode control and is ignored on an object list view ("views" mode) \u2014 the ViewTabBar is the only nav control here.`,
-      hint: `Move \`${field}\` to a page list (InterfaceListPage, "filters" mode), or remove it. See ADR-0053.`
+      path: `${path}.quickFilters`,
+      message: '`quickFilters` is a page filters-mode control and is ignored on an object list view ("views" mode) \u2014 the ViewTabBar owns nav here.',
+      hint: 'Move `quickFilters` to a page list (InterfaceListPage, "filters" mode), or remove it. See ADR-0047.'
     });
   }
+  const uf = rec.userFilters;
+  if (uf && typeof uf === "object") {
+    const ufRec = uf;
+    if (ufRec.element === "tabs" || ufRec.tabs != null) {
+      out.push({
+        severity: "error",
+        rule: LIST_VIEW_FILTERS_IN_VIEWS_MODE,
+        where,
+        path: `${path}.userFilters`,
+        message: '`userFilters` with `element: "tabs"` is page-only and is ignored on an object list view ("views" mode) \u2014 it would collide with the ViewTabBar.',
+        hint: 'Use `listViews` for named presets on an object (each becomes a segmented tab), switch to `element: "dropdown"` for value chips, or move the `tabs` filter to a page list (InterfaceListPage, "filters" mode). See ADR-0047.'
+      });
+    }
+  }
 }
 function scanListViews(listViews, wherePrefix, pathPrefix, out) {
   if (!listViews || typeof listViews !== "object") return;
@@ -1239,8 +1263,415 @@ function validateFormLayout(stack) {
   }
   return findings;
 }
+
+// src/validate-capability-references.ts
+var import_security = require("@objectstack/spec/security");
+var CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
+function asArray12(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function asCapArray(v) {
+  return Array.isArray(v) ? v.filter((s) => typeof s === "string" && s.length > 0) : [];
+}
+function flattenObjectRequired(v) {
+  if (Array.isArray(v)) return asCapArray(v).map((cap) => ({ cap }));
+  if (v && typeof v === "object") {
+    const out = [];
+    for (const [key, val] of Object.entries(v)) {
+      for (const cap of asCapArray(val)) out.push({ cap, key });
+    }
+    return out;
+  }
+  return [];
+}
+function validateCapabilityReferences(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const known = new Set(import_security.PLATFORM_CAPABILITY_NAMES);
+  for (const ps of asArray12(stack.permissions)) {
+    for (const cap of asCapArray(ps.systemPermissions)) known.add(cap);
+  }
+  for (const seed of asArray12(stack.data)) {
+    if (seed.object !== "sys_capability") continue;
+    for (const rec of Array.isArray(seed.records) ? seed.records : []) {
+      const name = rec?.name;
+      if (typeof name === "string" && name.length > 0) known.add(name);
+    }
+  }
+  const hint = "Fix the capability name, declare it on a permission set\u2019s systemPermissions, ship a sys_capability seed row, or ignore this if the capability is provided by another installed package (references fail closed at runtime).";
+  const flag = (cap, where, path) => {
+    if (known.has(cap)) return;
+    findings.push({
+      severity: "warning",
+      rule: CAPABILITY_REFERENCE_UNKNOWN,
+      where,
+      path,
+      message: `requiredPermissions references capability "${cap}" which is registered nowhere \u2014 no built-in capability, no permission set in this package grants it via systemPermissions, and no sys_capability seed declares it`,
+      hint
+    });
+  };
+  const objects = asArray12(stack.objects);
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj || typeof obj !== "object") continue;
+    const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
+    const objPath = `objects[${i}]`;
+    for (const { cap, key } of flattenObjectRequired(obj.requiredPermissions)) {
+      flag(cap, `object "${objName}"`, `${objPath}.requiredPermissions${key ? `.${key}` : ""}`);
+    }
+    const fields = asArray12(obj.fields);
+    for (const f of fields) {
+      const fname = typeof f.name === "string" ? f.name : "(field)";
+      for (const cap of asCapArray(f.requiredPermissions)) {
+        flag(cap, `field "${objName}.${fname}"`, `${objPath}.fields.${fname}.requiredPermissions`);
+      }
+    }
+    for (const [ai, action] of asArray12(obj.actions).entries()) {
+      const aName = typeof action.name === "string" ? action.name : `(action ${ai})`;
+      for (const cap of asCapArray(action.requiredPermissions)) {
+        flag(cap, `action "${objName}.${aName}"`, `${objPath}.actions[${ai}].requiredPermissions`);
+      }
+    }
+  }
+  for (const [i, action] of asArray12(stack.actions).entries()) {
+    const aName = typeof action.name === "string" ? action.name : `(action ${i})`;
+    for (const cap of asCapArray(action.requiredPermissions)) {
+      flag(cap, `action "${aName}"`, `actions[${i}].requiredPermissions`);
+    }
+  }
+  const apps = asArray12(stack.apps);
+  for (let i = 0; i < apps.length; i++) {
+    const app = apps[i];
+    if (!app || typeof app !== "object") continue;
+    const appName = typeof app.name === "string" ? app.name : `(app ${i})`;
+    const walk = (node, path) => {
+      if (!node || typeof node !== "object") return;
+      if (Array.isArray(node)) {
+        node.forEach((child, ci) => walk(child, `${path}[${ci}]`));
+        return;
+      }
+      const rec = node;
+      for (const cap of asCapArray(rec.requiredPermissions)) {
+        flag(cap, `app "${appName}"`, `${path}.requiredPermissions`);
+      }
+      if (rec.navigation) walk(rec.navigation, `${path}.navigation`);
+      if (rec.areas) walk(rec.areas, `${path}.areas`);
+      if (rec.tabs) walk(rec.tabs, `${path}.tabs`);
+      if (rec.children) walk(rec.children, `${path}.children`);
+      if (rec.items) walk(rec.items, `${path}.items`);
+    };
+    walk(app, `apps[${i}]`);
+  }
+  return findings;
+}
+
+// src/validate-security-posture.ts
+var import_security2 = require("@objectstack/spec/security");
+var SECURITY_OWD_UNSET = "security-owd-unset";
+var SECURITY_OWD_ALIAS = "security-owd-alias";
+var SECURITY_EXTERNAL_WIDER = "security-external-wider-than-internal";
+var SECURITY_WILDCARD_VAMA = "security-wildcard-vama";
+var SECURITY_ANCHOR_HIGH_PRIVILEGE = "security-anchor-high-privilege";
+var SECURITY_ROLE_WORD = "security-role-word";
+var SECURITY_PRIVATE_NO_READSCOPE = "security-private-no-readscope";
+var CANONICAL_OWD = ["private", "public_read", "public_read_write", "controlled_by_parent"];
+var OWD_ALIAS_FIX = {
+  read: "public_read",
+  read_write: "public_read_write",
+  full: "public_read_write",
+  public: "public_read_write"
+};
+var OWD_WIDTH = {
+  private: 0,
+  public_read: 1,
+  public_read_write: 2
+};
+function asArray13(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function owdOf(obj) {
+  return obj.sharingModel ?? obj.security?.sharingModel;
+}
+function isSystemObject(obj) {
+  return obj.isSystem === true || String(obj.name ?? "").startsWith("sys_");
+}
+function identifierHasRoleToken(name) {
+  if (typeof name !== "string") return false;
+  return name.toLowerCase().split(/[^a-z0-9]+/).some((tok) => tok === "role" || tok === "roles");
+}
+function labelHasRoleWord(label) {
+  if (typeof label !== "string") return false;
+  return /\brole(s)?\b/i.test(label);
+}
+function validateSecurityPosture(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const objects = asArray13(stack.objects);
+  const permissionSets = asArray13(stack.permissions);
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj || typeof obj !== "object") continue;
+    const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
+    const objPath = `objects[${i}]`;
+    const owd = owdOf(obj);
+    const external = obj.externalSharingModel;
+    if (!isSystemObject(obj)) {
+      if (owd == null) {
+        findings.push({
+          severity: "error",
+          rule: SECURITY_OWD_UNSET,
+          where: `object "${objName}"`,
+          path: `${objPath}.sharingModel`,
+          message: `custom object "${objName}" declares no sharingModel (OWD). The runtime fails CLOSED to 'private' (ADR-0090 D1), but the baseline must be an authored decision, not an accident \u2014 this is the exact shape of the leave_request incident (objectui#2348).`,
+          hint: `Declare sharingModel explicitly: 'private' (owner + shares; recommended default), 'public_read', 'public_read_write', or 'controlled_by_parent' (master-detail children).`
+        });
+      } else if (typeof owd === "string" && OWD_ALIAS_FIX[owd]) {
+        findings.push({
+          severity: "error",
+          rule: SECURITY_OWD_ALIAS,
+          where: `object "${objName}"`,
+          path: `${objPath}.sharingModel`,
+          message: `sharingModel '${owd}' is a retired alias (ADR-0090 D4). The runtime fails CLOSED to 'private' on unknown values, so this object is NOT ${owd === "read" ? "readable" : "writable"} org-wide.`,
+          hint: `Replace with the canonical value: sharingModel: '${OWD_ALIAS_FIX[owd]}'.`
+        });
+      } else if (typeof owd === "string" && !CANONICAL_OWD.includes(owd)) {
+        findings.push({
+          severity: "error",
+          rule: SECURITY_OWD_ALIAS,
+          where: `object "${objName}"`,
+          path: `${objPath}.sharingModel`,
+          message: `sharingModel '${owd}' is not a canonical OWD value; the runtime fails CLOSED to 'private'.`,
+          hint: `Use one of: ${CANONICAL_OWD.join(", ")}.`
+        });
+      }
+    }
+    if (typeof external === "string") {
+      if (OWD_ALIAS_FIX[external]) {
+        findings.push({
+          severity: "error",
+          rule: SECURITY_OWD_ALIAS,
+          where: `object "${objName}"`,
+          path: `${objPath}.externalSharingModel`,
+          message: `externalSharingModel '${external}' is a retired alias (ADR-0090 D4).`,
+          hint: `Replace with the canonical value: externalSharingModel: '${OWD_ALIAS_FIX[external]}'.`
+        });
+      } else if (typeof owd === "string" && external in OWD_WIDTH && owd in OWD_WIDTH && OWD_WIDTH[external] > OWD_WIDTH[owd]) {
+        findings.push({
+          severity: "error",
+          rule: SECURITY_EXTERNAL_WIDER,
+          where: `object "${objName}"`,
+          path: `${objPath}.externalSharingModel`,
+          message: `externalSharingModel '${external}' is WIDER than the internal sharingModel '${owd}' \u2014 the external baseline must never exceed the internal one (ADR-0090 D11).`,
+          hint: `Narrow externalSharingModel to '${owd}' or below (ordering: private < public_read < public_read_write).`
+        });
+      }
+    }
+  }
+  for (let i = 0; i < permissionSets.length; i++) {
+    const ps = permissionSets[i];
+    if (!ps || typeof ps !== "object") continue;
+    const psName = typeof ps.name === "string" ? ps.name : `(permission set ${i})`;
+    const psPath = `permissions[${i}]`;
+    const objectsMap = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
+    const wildcard = objectsMap["*"];
+    if (wildcard && (wildcard.viewAllRecords === true || wildcard.modifyAllRecords === true)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_WILDCARD_VAMA,
+        where: `permission set "${psName}"`,
+        path: `${psPath}.objects.*`,
+        message: `'*' wildcard carrying View All / Modify All Data \u2014 a package-authored superuser. Only the platform's own admin set may combine the wildcard with VAMA (ADR-0066).`,
+        hint: `Enumerate the objects this set really needs, or drop viewAllRecords/modifyAllRecords from the wildcard entry. App-level admins belong in an ordinary set the customer binds to a position of their choosing (ADR-0090 D9).`
+      });
+    }
+    if (ps.isDefault === true) {
+      const offending = (0, import_security2.describeAnchorForbiddenBits)(ps, "everyone");
+      if (offending) {
+        findings.push({
+          severity: "error",
+          rule: SECURITY_ANCHOR_HIGH_PRIVILEGE,
+          where: `permission set "${psName}"`,
+          path: `${psPath}.isDefault`,
+          message: `isDefault:true suggests binding this set to the 'everyone' audience anchor, but it carries ${offending} \u2014 the runtime will refuse the binding (ADR-0090 D5/D9).`,
+          hint: `Split the powerful bits into a separate set granted through ordinary positions, and keep the everyone-suggested set low-privilege.`
+        });
+      }
+    }
+  }
+  const flagRole = (kind, name, label, where, path) => {
+    if (identifierHasRoleToken(name)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_ROLE_WORD,
+        where,
+        path,
+        message: `${kind} name "${String(name)}" uses the reserved word "role" \u2014 the platform vocabulary is permission_set (capability), position (distribution), business_unit (hierarchy) (ADR-0090 D3).`,
+        hint: `Rename using 'position' for distribution groups or a domain word (e.g. 'function', 'duty').`
+      });
+    } else if (labelHasRoleWord(label)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_ROLE_WORD,
+        where,
+        path: `${path.replace(/\.name$/, "")}.label`,
+        message: `${kind} label "${String(label)}" uses the reserved word "role" (ADR-0090 D3).`,
+        hint: `Relabel with 'Position' (distribution) or a domain word \u2014 admins must meet ONE vocabulary.`
+      });
+    }
+  };
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
+    const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
+    flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
+    for (const f of asArray13(obj.fields)) {
+      flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
+    }
+    for (const [ai, action] of asArray13(obj.actions).entries()) {
+      flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
+    }
+  }
+  for (let i = 0; i < permissionSets.length; i++) {
+    const ps = permissionSets[i];
+    if (!ps || typeof ps !== "object") continue;
+    flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
+  }
+  for (const [i, pos] of asArray13(stack.positions).entries()) {
+    flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
+  }
+  for (const [i, app] of asArray13(stack.apps).entries()) {
+    flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
+  }
+  const privateObjects = new Set(
+    objects.filter((o) => o && typeof o === "object" && !isSystemObject(o)).filter((o) => {
+      const owd = owdOf(o);
+      return owd == null || owd === "private";
+    }).map((o) => String(o.name ?? ""))
+  );
+  if (privateObjects.size > 0) {
+    for (let i = 0; i < permissionSets.length; i++) {
+      const ps = permissionSets[i];
+      if (!ps || typeof ps !== "object") continue;
+      const psName = typeof ps.name === "string" ? ps.name : `(permission set ${i})`;
+      const objectsMap = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
+      for (const [objName, rawPerm] of Object.entries(objectsMap)) {
+        if (!privateObjects.has(objName)) continue;
+        const p = rawPerm ?? {};
+        if (p.allowRead === true && p.readScope == null && p.viewAllRecords !== true) {
+          findings.push({
+            severity: "info",
+            rule: SECURITY_PRIVATE_NO_READSCOPE,
+            where: `permission set "${psName}"`,
+            path: `permissions[${i}].objects.${objName}.readScope`,
+            message: `"${objName}" is private (OWD) and this set grants allowRead without a readScope \u2014 holders see ONLY records they own (plus explicit shares).`,
+            hint: `If that is intended (personal data), ignore this. Otherwise add readScope: 'own_and_reports' | 'unit' | 'unit_and_below' | 'org', or widen the object's sharingModel.`
+          });
+        }
+      }
+    }
+  }
+  return findings;
+}
+
+// src/build-access-matrix.ts
+function asArray14(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function buildAccessMatrix(stack) {
+  const entries = [];
+  if (!stack || typeof stack !== "object") return { version: 1, entries };
+  const owdByObject = /* @__PURE__ */ new Map();
+  for (const obj of asArray14(stack.objects)) {
+    const name = typeof obj.name === "string" ? obj.name : "";
+    if (!name) continue;
+    const owd = obj.sharingModel ?? obj.security?.sharingModel;
+    if (typeof owd === "string") owdByObject.set(name, owd);
+  }
+  for (const ps of asArray14(stack.permissions)) {
+    const psName = typeof ps.name === "string" ? ps.name : "";
+    if (!psName) continue;
+    const objects = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
+    for (const [objName, rawPerm] of Object.entries(objects)) {
+      const p = rawPerm ?? {};
+      const entry = {
+        permissionSet: psName,
+        object: objName,
+        create: p.allowCreate === true,
+        read: p.allowRead === true || p.viewAllRecords === true || p.modifyAllRecords === true,
+        edit: p.allowEdit === true || p.modifyAllRecords === true,
+        delete: p.allowDelete === true || p.modifyAllRecords === true,
+        viewAllRecords: p.viewAllRecords === true,
+        modifyAllRecords: p.modifyAllRecords === true
+      };
+      if (typeof p.readScope === "string") entry.readScope = p.readScope;
+      if (typeof p.writeScope === "string") entry.writeScope = p.writeScope;
+      const owd = owdByObject.get(objName);
+      if (owd) entry.sharingModel = owd;
+      entries.push(entry);
+    }
+  }
+  entries.sort(
+    (a, b) => a.permissionSet === b.permissionSet ? a.object.localeCompare(b.object) : a.permissionSet.localeCompare(b.permissionSet)
+  );
+  return { version: 1, entries };
+}
+var BIT_LABELS = [
+  ["create", "create"],
+  ["read", "read"],
+  ["edit", "edit"],
+  ["delete", "delete"],
+  ["viewAllRecords", "View All Data"],
+  ["modifyAllRecords", "Modify All Data"]
+];
+function diffAccessMatrix(before, after) {
+  const lines = [];
+  const key = (e) => `${e.permissionSet}\0${e.object}`;
+  const beforeMap = new Map((before?.entries ?? []).map((e) => [key(e), e]));
+  const afterMap = new Map((after?.entries ?? []).map((e) => [key(e), e]));
+  for (const [k, b] of beforeMap) {
+    if (!afterMap.has(k)) {
+      lines.push(`'${b.permissionSet}' loses ALL access to '${b.object}' (entry removed)`);
+    }
+  }
+  for (const [k, a] of afterMap) {
+    const b = beforeMap.get(k);
+    if (!b) {
+      const grants = BIT_LABELS.filter(([bit]) => a[bit] === true).map(([, label]) => label);
+      lines.push(`'${a.permissionSet}' gains access to '${a.object}' (${grants.join(", ") || "no bits set"})`);
+      continue;
+    }
+    for (const [bit, label] of BIT_LABELS) {
+      if (b[bit] !== a[bit]) {
+        lines.push(`'${a.permissionSet}' ${a[bit] ? "gains" : "loses"} ${label} on '${a.object}'`);
+      }
+    }
+    if ((b.readScope ?? "own") !== (a.readScope ?? "own")) {
+      lines.push(`'${a.permissionSet}' read depth on '${a.object}': ${b.readScope ?? "own"} \u2192 ${a.readScope ?? "own"}`);
+    }
+    if ((b.writeScope ?? "own") !== (a.writeScope ?? "own")) {
+      lines.push(`'${a.permissionSet}' write depth on '${a.object}': ${b.writeScope ?? "own"} \u2192 ${a.writeScope ?? "own"}`);
+    }
+    if ((b.sharingModel ?? "") !== (a.sharingModel ?? "")) {
+      lines.push(`'${a.object}' record baseline (OWD): ${b.sharingModel ?? "(unset)"} \u2192 ${a.sharingModel ?? "(unset)"} (affects every principal)`);
+    }
+  }
+  return lines;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  CAPABILITY_REFERENCE_UNKNOWN,
   CHART_CONFIG_MISSING,
   CHART_FIELD_UNKNOWN,
   FIELD_GROUP_EMPTY,
@@ -1250,6 +1681,13 @@ function validateFormLayout(stack) {
   LIST_VIEW_FILTERS_IN_VIEWS_MODE,
   MEASURE_AGGREGATE_INCOHERENT,
   PAGE_SOURCE_CLASSNAME,
+  SECURITY_ANCHOR_HIGH_PRIVILEGE,
+  SECURITY_EXTERNAL_WIDER,
+  SECURITY_OWD_ALIAS,
+  SECURITY_OWD_UNSET,
+  SECURITY_PRIVATE_NO_READSCOPE,
+  SECURITY_ROLE_WORD,
+  SECURITY_WILDCARD_VAMA,
   SEMANTIC_ROLE_FIELD_UNKNOWN,
   STYLE_CLASSNAME_TAILWIND,
   STYLE_NODE_MISSING_ID,
@@ -1262,6 +1700,9 @@ function validateFormLayout(stack) {
   WIDGET_DATASET_UNKNOWN,
   WIDGET_DIMENSION_UNKNOWN,
   WIDGET_MEASURE_UNKNOWN,
+  buildAccessMatrix,
+  diffAccessMatrix,
+  validateCapabilityReferences,
   validateFormLayout,
   validateJsxPages,
   validateListViewMode,
@@ -1270,6 +1711,7 @@ function validateFormLayout(stack) {
   validateReactPages,
   validateRecordTitle,
   validateResponsiveStyles,
+  validateSecurityPosture,
   validateSemanticRoles,
   validateStackExpressions,
   validateWidgetBindings