@objectstack/lint 12.6.0 → 14.3.0

package/dist/index.cjs

@@ -20,6 +20,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  APPROVAL_APPROVER_TYPE_UNKNOWN: () => APPROVAL_APPROVER_TYPE_UNKNOWN,
+  APPROVAL_ESCALATION_REASSIGN_NO_TARGET: () => APPROVAL_ESCALATION_REASSIGN_NO_TARGET,
+  APPROVAL_ROLE_NOT_MEMBERSHIP_TIER: () => APPROVAL_ROLE_NOT_MEMBERSHIP_TIER,
+  CAPABILITY_REFERENCE_UNKNOWN: () => CAPABILITY_REFERENCE_UNKNOWN,
   CHART_CONFIG_MISSING: () => CHART_CONFIG_MISSING,
   CHART_FIELD_UNKNOWN: () => CHART_FIELD_UNKNOWN,
   FIELD_GROUP_EMPTY: () => FIELD_GROUP_EMPTY,
@@ -29,6 +33,14 @@ __export(index_exports, {
   LIST_VIEW_FILTERS_IN_VIEWS_MODE: () => LIST_VIEW_FILTERS_IN_VIEWS_MODE,
   MEASURE_AGGREGATE_INCOHERENT: () => MEASURE_AGGREGATE_INCOHERENT,
   PAGE_SOURCE_CLASSNAME: () => PAGE_SOURCE_CLASSNAME,
+  SECURITY_ANCHOR_HIGH_PRIVILEGE: () => SECURITY_ANCHOR_HIGH_PRIVILEGE,
+  SECURITY_BOOK_AUDIENCE_UNKNOWN_SET: () => SECURITY_BOOK_AUDIENCE_UNKNOWN_SET,
+  SECURITY_EXTERNAL_WIDER: () => SECURITY_EXTERNAL_WIDER,
+  SECURITY_OWD_ALIAS: () => SECURITY_OWD_ALIAS,
+  SECURITY_OWD_UNSET: () => SECURITY_OWD_UNSET,
+  SECURITY_PRIVATE_NO_READSCOPE: () => SECURITY_PRIVATE_NO_READSCOPE,
+  SECURITY_ROLE_WORD: () => SECURITY_ROLE_WORD,
+  SECURITY_WILDCARD_VAMA: () => SECURITY_WILDCARD_VAMA,
   SEMANTIC_ROLE_FIELD_UNKNOWN: () => SEMANTIC_ROLE_FIELD_UNKNOWN,
   STYLE_CLASSNAME_TAILWIND: () => STYLE_CLASSNAME_TAILWIND,
   STYLE_NODE_MISSING_ID: () => STYLE_NODE_MISSING_ID,
@@ -41,6 +53,10 @@ __export(index_exports, {
   WIDGET_DATASET_UNKNOWN: () => WIDGET_DATASET_UNKNOWN,
   WIDGET_DIMENSION_UNKNOWN: () => WIDGET_DIMENSION_UNKNOWN,
   WIDGET_MEASURE_UNKNOWN: () => WIDGET_MEASURE_UNKNOWN,
+  buildAccessMatrix: () => buildAccessMatrix,
+  diffAccessMatrix: () => diffAccessMatrix,
+  validateApprovalApprovers: () => validateApprovalApprovers,
+  validateCapabilityReferences: () => validateCapabilityReferences,
   validateFormLayout: () => validateFormLayout,
   validateJsxPages: () => validateJsxPages,
   validateListViewMode: () => validateListViewMode,
@@ -49,6 +65,7 @@ __export(index_exports, {
   validateReactPages: () => validateReactPages,
   validateRecordTitle: () => validateRecordTitle,
   validateResponsiveStyles: () => validateResponsiveStyles,
+  validateSecurityPosture: () => validateSecurityPosture,
   validateSemanticRoles: () => validateSemanticRoles,
   validateStackExpressions: () => validateStackExpressions,
   validateWidgetBindings: () => validateWidgetBindings
@@ -1251,8 +1268,571 @@ function validateFormLayout(stack) {
   }
   return findings;
 }
+
+// src/validate-capability-references.ts
+var import_security = require("@objectstack/spec/security");
+var CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
+function asArray12(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function asCapArray(v) {
+  return Array.isArray(v) ? v.filter((s) => typeof s === "string" && s.length > 0) : [];
+}
+function flattenObjectRequired(v) {
+  if (Array.isArray(v)) return asCapArray(v).map((cap) => ({ cap }));
+  if (v && typeof v === "object") {
+    const out = [];
+    for (const [key, val] of Object.entries(v)) {
+      for (const cap of asCapArray(val)) out.push({ cap, key });
+    }
+    return out;
+  }
+  return [];
+}
+function validateCapabilityReferences(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const known = new Set(import_security.PLATFORM_CAPABILITY_NAMES);
+  for (const ps of asArray12(stack.permissions)) {
+    for (const cap of asCapArray(ps.systemPermissions)) known.add(cap);
+  }
+  for (const seed of asArray12(stack.data)) {
+    if (seed.object !== "sys_capability") continue;
+    for (const rec of Array.isArray(seed.records) ? seed.records : []) {
+      const name = rec?.name;
+      if (typeof name === "string" && name.length > 0) known.add(name);
+    }
+  }
+  const hint = "Fix the capability name, declare it on a permission set\u2019s systemPermissions, ship a sys_capability seed row, or ignore this if the capability is provided by another installed package (references fail closed at runtime).";
+  const flag = (cap, where, path) => {
+    if (known.has(cap)) return;
+    findings.push({
+      severity: "warning",
+      rule: CAPABILITY_REFERENCE_UNKNOWN,
+      where,
+      path,
+      message: `requiredPermissions references capability "${cap}" which is registered nowhere \u2014 no built-in capability, no permission set in this package grants it via systemPermissions, and no sys_capability seed declares it`,
+      hint
+    });
+  };
+  const objects = asArray12(stack.objects);
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj || typeof obj !== "object") continue;
+    const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
+    const objPath = `objects[${i}]`;
+    for (const { cap, key } of flattenObjectRequired(obj.requiredPermissions)) {
+      flag(cap, `object "${objName}"`, `${objPath}.requiredPermissions${key ? `.${key}` : ""}`);
+    }
+    const fields = asArray12(obj.fields);
+    for (const f of fields) {
+      const fname = typeof f.name === "string" ? f.name : "(field)";
+      for (const cap of asCapArray(f.requiredPermissions)) {
+        flag(cap, `field "${objName}.${fname}"`, `${objPath}.fields.${fname}.requiredPermissions`);
+      }
+    }
+    for (const [ai, action] of asArray12(obj.actions).entries()) {
+      const aName = typeof action.name === "string" ? action.name : `(action ${ai})`;
+      for (const cap of asCapArray(action.requiredPermissions)) {
+        flag(cap, `action "${objName}.${aName}"`, `${objPath}.actions[${ai}].requiredPermissions`);
+      }
+    }
+  }
+  for (const [i, action] of asArray12(stack.actions).entries()) {
+    const aName = typeof action.name === "string" ? action.name : `(action ${i})`;
+    for (const cap of asCapArray(action.requiredPermissions)) {
+      flag(cap, `action "${aName}"`, `actions[${i}].requiredPermissions`);
+    }
+  }
+  const apps = asArray12(stack.apps);
+  for (let i = 0; i < apps.length; i++) {
+    const app = apps[i];
+    if (!app || typeof app !== "object") continue;
+    const appName = typeof app.name === "string" ? app.name : `(app ${i})`;
+    const walk = (node, path) => {
+      if (!node || typeof node !== "object") return;
+      if (Array.isArray(node)) {
+        node.forEach((child, ci) => walk(child, `${path}[${ci}]`));
+        return;
+      }
+      const rec = node;
+      for (const cap of asCapArray(rec.requiredPermissions)) {
+        flag(cap, `app "${appName}"`, `${path}.requiredPermissions`);
+      }
+      if (rec.navigation) walk(rec.navigation, `${path}.navigation`);
+      if (rec.areas) walk(rec.areas, `${path}.areas`);
+      if (rec.tabs) walk(rec.tabs, `${path}.tabs`);
+      if (rec.children) walk(rec.children, `${path}.children`);
+      if (rec.items) walk(rec.items, `${path}.items`);
+    };
+    walk(app, `apps[${i}]`);
+  }
+  return findings;
+}
+
+// src/validate-approval-approvers.ts
+var import_automation = require("@objectstack/spec/automation");
+var APPROVAL_ROLE_NOT_MEMBERSHIP_TIER = "approval-role-not-membership-tier";
+var APPROVAL_APPROVER_TYPE_UNKNOWN = "approval-approver-type-unknown";
+var APPROVAL_ESCALATION_REASSIGN_NO_TARGET = "approval-escalation-reassign-no-target";
+var MEMBERSHIP_TIERS = /* @__PURE__ */ new Set(["owner", "admin", "member", "guest"]);
+var TYPE_FIX = {
+  business_unit: "department",
+  bu: "department"
+};
+function asArray13(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function validateApprovalApprovers(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const flows = asArray13(stack.flows);
+  const validTypes = new Set(import_automation.ApproverType.options);
+  for (let fi = 0; fi < flows.length; fi++) {
+    const flow = flows[fi];
+    if (!flow || typeof flow !== "object") continue;
+    const flowName = typeof flow.name === "string" ? flow.name : `(flow ${fi})`;
+    const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
+    for (let ni = 0; ni < nodes.length; ni++) {
+      const node = nodes[ni];
+      if (!node || node.type !== import_automation.APPROVAL_NODE_TYPE) continue;
+      const nodeId = typeof node.id === "string" ? node.id : `(node ${ni})`;
+      const cfg = node.config ?? {};
+      const approvers = Array.isArray(cfg.approvers) ? cfg.approvers : [];
+      const where = `flow "${flowName}" \xB7 node "${nodeId}"`;
+      for (let ai = 0; ai < approvers.length; ai++) {
+        const a = approvers[ai];
+        if (!a || typeof a !== "object") continue;
+        const type = typeof a.type === "string" ? a.type : "";
+        const value = typeof a.value === "string" ? a.value : "";
+        const path = `flows[${fi}].nodes[${ni}].config.approvers[${ai}]`;
+        if (type && !validTypes.has(type)) {
+          const fix = TYPE_FIX[type];
+          findings.push({
+            severity: "warning",
+            rule: APPROVAL_APPROVER_TYPE_UNKNOWN,
+            where,
+            path: `${path}.type`,
+            message: `approver type '${type}' is not an ApproverType (${import_automation.ApproverType.options.join(" | ")}).`,
+            hint: fix ? `Use the spec value: { type: '${fix}', value: '${value}' }.` : `Pick one of the spec values; unmapped types degrade to an inert '${type}:${value}' literal at runtime.`
+          });
+          continue;
+        }
+        if (type === "role" && value && !MEMBERSHIP_TIERS.has(value.toLowerCase())) {
+          findings.push({
+            severity: "warning",
+            rule: APPROVAL_ROLE_NOT_MEMBERSHIP_TIER,
+            where,
+            path: `${path}.value`,
+            message: `approver { type: 'role', value: '${value}' } resolves against the better-auth org-membership tier (sys_member.role: owner/admin/member) \u2014 '${value}' is not a membership tier, so this approver matches nobody and the request stalls.`,
+            hint: `If '${value}' is an org position, author { type: 'position', value: '${value}' } (resolved via sys_user_position, ADR-0090 D3). Keep type 'role' only for membership tiers (owner/admin/member).`
+          });
+        }
+      }
+      const escalation = cfg.escalation ?? null;
+      if (escalation && typeof escalation === "object" && escalation.action === "reassign") {
+        const target = typeof escalation.escalateTo === "string" ? escalation.escalateTo.trim() : "";
+        if (!target) {
+          findings.push({
+            severity: "warning",
+            rule: APPROVAL_ESCALATION_REASSIGN_NO_TARGET,
+            where,
+            path: `flows[${fi}].nodes[${ni}].config.escalation.escalateTo`,
+            message: `escalation.action is 'reassign' but escalateTo is empty \u2014 at runtime the escalation degrades to a notify and the request stays with the original approvers.`,
+            hint: `Set escalateTo to a position machine name (expanded via sys_user_position, ADR-0090 D3) or a specific user id, or change action to 'notify'.`
+          });
+        }
+      }
+    }
+  }
+  return findings;
+}
+
+// src/validate-security-posture.ts
+var import_security2 = require("@objectstack/spec/security");
+var SECURITY_OWD_UNSET = "security-owd-unset";
+var SECURITY_OWD_ALIAS = "security-owd-alias";
+var SECURITY_EXTERNAL_WIDER = "security-external-wider-than-internal";
+var SECURITY_WILDCARD_VAMA = "security-wildcard-vama";
+var SECURITY_ANCHOR_HIGH_PRIVILEGE = "security-anchor-high-privilege";
+var SECURITY_ROLE_WORD = "security-role-word";
+var SECURITY_BOOK_AUDIENCE_UNKNOWN_SET = "security-book-audience-unknown-set";
+var SECURITY_PRIVATE_NO_READSCOPE = "security-private-no-readscope";
+var SECURITY_MASTER_DETAIL_UNGRANTED = "security-master-detail-ungranted";
+var CANONICAL_OWD = ["private", "public_read", "public_read_write", "controlled_by_parent"];
+var OWD_ALIAS_FIX = {
+  read: "public_read",
+  read_write: "public_read_write",
+  full: "public_read_write",
+  public: "public_read_write"
+};
+var OWD_WIDTH = {
+  private: 0,
+  public_read: 1,
+  public_read_write: 2
+};
+function asArray14(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function owdOf(obj) {
+  return obj.sharingModel ?? obj.security?.sharingModel;
+}
+function isSystemObject(obj) {
+  return obj.isSystem === true || String(obj.name ?? "").startsWith("sys_");
+}
+function identifierHasRoleToken(name) {
+  if (typeof name !== "string") return false;
+  return name.toLowerCase().split(/[^a-z0-9]+/).some((tok) => tok === "role" || tok === "roles");
+}
+function labelHasRoleWord(label) {
+  if (typeof label !== "string") return false;
+  return /\brole(s)?\b/i.test(label);
+}
+function refOf(def) {
+  const r = def.reference ?? def.reference_to;
+  return typeof r === "string" && r ? r : void 0;
+}
+function firstMasterDetailField(obj) {
+  for (const f of asArray14(obj.fields)) {
+    if (f.type === "master_detail") {
+      return { name: String(f.name ?? "?"), parent: refOf(f) };
+    }
+  }
+  return void 0;
+}
+function grantsObjectAccess(p) {
+  return p.allowRead === true || p.allowCreate === true || p.allowEdit === true || p.allowDelete === true || p.viewAllRecords === true || p.modifyAllRecords === true;
+}
+function validateSecurityPosture(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const objects = asArray14(stack.objects);
+  const permissionSets = asArray14(stack.permissions);
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj || typeof obj !== "object") continue;
+    const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
+    const objPath = `objects[${i}]`;
+    const owd = owdOf(obj);
+    const external = obj.externalSharingModel;
+    if (!isSystemObject(obj)) {
+      if (owd == null) {
+        findings.push({
+          severity: "error",
+          rule: SECURITY_OWD_UNSET,
+          where: `object "${objName}"`,
+          path: `${objPath}.sharingModel`,
+          message: `custom object "${objName}" declares no sharingModel (OWD). The runtime fails CLOSED to 'private' (ADR-0090 D1), but the baseline must be an authored decision, not an accident \u2014 this is the exact shape of the leave_request incident (objectui#2348).`,
+          hint: `Declare sharingModel explicitly: 'private' (owner + shares; recommended default), 'public_read', 'public_read_write', or 'controlled_by_parent' (master-detail children).`
+        });
+      } else if (typeof owd === "string" && OWD_ALIAS_FIX[owd]) {
+        findings.push({
+          severity: "error",
+          rule: SECURITY_OWD_ALIAS,
+          where: `object "${objName}"`,
+          path: `${objPath}.sharingModel`,
+          message: `sharingModel '${owd}' is a retired alias (ADR-0090 D4). The runtime fails CLOSED to 'private' on unknown values, so this object is NOT ${owd === "read" ? "readable" : "writable"} org-wide.`,
+          hint: `Replace with the canonical value: sharingModel: '${OWD_ALIAS_FIX[owd]}'.`
+        });
+      } else if (typeof owd === "string" && !CANONICAL_OWD.includes(owd)) {
+        findings.push({
+          severity: "error",
+          rule: SECURITY_OWD_ALIAS,
+          where: `object "${objName}"`,
+          path: `${objPath}.sharingModel`,
+          message: `sharingModel '${owd}' is not a canonical OWD value; the runtime fails CLOSED to 'private'.`,
+          hint: `Use one of: ${CANONICAL_OWD.join(", ")}.`
+        });
+      }
+    }
+    if (typeof external === "string") {
+      if (OWD_ALIAS_FIX[external]) {
+        findings.push({
+          severity: "error",
+          rule: SECURITY_OWD_ALIAS,
+          where: `object "${objName}"`,
+          path: `${objPath}.externalSharingModel`,
+          message: `externalSharingModel '${external}' is a retired alias (ADR-0090 D4).`,
+          hint: `Replace with the canonical value: externalSharingModel: '${OWD_ALIAS_FIX[external]}'.`
+        });
+      } else if (typeof owd === "string" && external in OWD_WIDTH && owd in OWD_WIDTH && OWD_WIDTH[external] > OWD_WIDTH[owd]) {
+        findings.push({
+          severity: "error",
+          rule: SECURITY_EXTERNAL_WIDER,
+          where: `object "${objName}"`,
+          path: `${objPath}.externalSharingModel`,
+          message: `externalSharingModel '${external}' is WIDER than the internal sharingModel '${owd}' \u2014 the external baseline must never exceed the internal one (ADR-0090 D11).`,
+          hint: `Narrow externalSharingModel to '${owd}' or below (ordering: private < public_read < public_read_write).`
+        });
+      }
+    }
+  }
+  for (let i = 0; i < permissionSets.length; i++) {
+    const ps = permissionSets[i];
+    if (!ps || typeof ps !== "object") continue;
+    const psName = typeof ps.name === "string" ? ps.name : `(permission set ${i})`;
+    const psPath = `permissions[${i}]`;
+    const objectsMap = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
+    const wildcard = objectsMap["*"];
+    if (wildcard && (wildcard.viewAllRecords === true || wildcard.modifyAllRecords === true)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_WILDCARD_VAMA,
+        where: `permission set "${psName}"`,
+        path: `${psPath}.objects.*`,
+        message: `'*' wildcard carrying View All / Modify All Data \u2014 a package-authored superuser. Only the platform's own admin set may combine the wildcard with VAMA (ADR-0066).`,
+        hint: `Enumerate the objects this set really needs, or drop viewAllRecords/modifyAllRecords from the wildcard entry. App-level admins belong in an ordinary set the customer binds to a position of their choosing (ADR-0090 D9).`
+      });
+    }
+    if (ps.isDefault === true) {
+      const offending = (0, import_security2.describeAnchorForbiddenBits)(ps, "everyone");
+      if (offending) {
+        findings.push({
+          severity: "error",
+          rule: SECURITY_ANCHOR_HIGH_PRIVILEGE,
+          where: `permission set "${psName}"`,
+          path: `${psPath}.isDefault`,
+          message: `isDefault:true suggests binding this set to the 'everyone' audience anchor, but it carries ${offending} \u2014 the runtime will refuse the binding (ADR-0090 D5/D9).`,
+          hint: `Split the powerful bits into a separate set granted through ordinary positions, and keep the everyone-suggested set low-privilege.`
+        });
+      }
+    }
+  }
+  const flagRole = (kind, name, label, where, path) => {
+    if (identifierHasRoleToken(name)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_ROLE_WORD,
+        where,
+        path,
+        message: `${kind} name "${String(name)}" uses the reserved word "role" \u2014 the platform vocabulary is permission_set (capability), position (distribution), business_unit (hierarchy) (ADR-0090 D3).`,
+        hint: `Rename using 'position' for distribution groups or a domain word (e.g. 'function', 'duty').`
+      });
+    } else if (labelHasRoleWord(label)) {
+      findings.push({
+        severity: "error",
+        rule: SECURITY_ROLE_WORD,
+        where,
+        path: `${path.replace(/\.name$/, "")}.label`,
+        message: `${kind} label "${String(label)}" uses the reserved word "role" (ADR-0090 D3).`,
+        hint: `Relabel with 'Position' (distribution) or a domain word \u2014 admins must meet ONE vocabulary.`
+      });
+    }
+  };
+  for (let i = 0; i < objects.length; i++) {
+    const obj = objects[i];
+    if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
+    const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
+    flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
+    for (const f of asArray14(obj.fields)) {
+      flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
+    }
+    for (const [ai, action] of asArray14(obj.actions).entries()) {
+      flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
+    }
+  }
+  for (let i = 0; i < permissionSets.length; i++) {
+    const ps = permissionSets[i];
+    if (!ps || typeof ps !== "object") continue;
+    flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
+  }
+  for (const [i, pos] of asArray14(stack.positions).entries()) {
+    flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
+  }
+  for (const [i, app] of asArray14(stack.apps).entries()) {
+    flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
+  }
+  for (const [i, book] of asArray14(stack.books).entries()) {
+    flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
+  }
+  const stackSetNames = new Set(
+    permissionSets.map((ps) => typeof ps.name === "string" ? ps.name : void 0).filter((n) => !!n)
+  );
+  for (const [i, book] of asArray14(stack.books).entries()) {
+    const audience = book.audience;
+    if (!audience || typeof audience !== "object") continue;
+    const setName = audience.permissionSet;
+    if (typeof setName !== "string" || setName.length === 0) continue;
+    if (!stackSetNames.has(setName)) {
+      findings.push({
+        severity: "warning",
+        rule: SECURITY_BOOK_AUDIENCE_UNKNOWN_SET,
+        where: `book "${String(book.name ?? i)}"`,
+        path: `books[${i}].audience.permissionSet`,
+        message: `book audience references permission set "${setName}", which this stack does not declare. The runtime fails closed \u2014 no holder means NO reader can open the book.`,
+        hint: `Gate the book on one of this package's own permission sets (ADR-0090 D9, e.g. its admin set), or fix the typo. Ignore if the set is intentionally provided by another installed package.`
+      });
+    }
+  }
+  const privateObjects = new Set(
+    objects.filter((o) => o && typeof o === "object" && !isSystemObject(o)).filter((o) => {
+      const owd = owdOf(o);
+      return owd == null || owd === "private";
+    }).map((o) => String(o.name ?? ""))
+  );
+  if (privateObjects.size > 0) {
+    for (let i = 0; i < permissionSets.length; i++) {
+      const ps = permissionSets[i];
+      if (!ps || typeof ps !== "object") continue;
+      const psName = typeof ps.name === "string" ? ps.name : `(permission set ${i})`;
+      const objectsMap = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
+      for (const [objName, rawPerm] of Object.entries(objectsMap)) {
+        if (!privateObjects.has(objName)) continue;
+        const p = rawPerm ?? {};
+        if (p.allowRead === true && p.readScope == null && p.viewAllRecords !== true) {
+          findings.push({
+            severity: "info",
+            rule: SECURITY_PRIVATE_NO_READSCOPE,
+            where: `permission set "${psName}"`,
+            path: `permissions[${i}].objects.${objName}.readScope`,
+            message: `"${objName}" is private (OWD) and this set grants allowRead without a readScope \u2014 holders see ONLY records they own (plus explicit shares).`,
+            hint: `If that is intended (personal data), ignore this. Otherwise add readScope: 'own_and_reports' | 'unit' | 'unit_and_below' | 'org', or widen the object's sharingModel.`
+          });
+        }
+      }
+    }
+  }
+  if (permissionSets.length > 0) {
+    const wildcardGrantsAll = permissionSets.some(
+      (ps) => grantsObjectAccess(ps.objects?.["*"] ?? {})
+    );
+    if (!wildcardGrantsAll) {
+      const grantedObjects = /* @__PURE__ */ new Set();
+      for (const ps of permissionSets) {
+        const objectsMap = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
+        for (const [objName, rawPerm] of Object.entries(objectsMap)) {
+          if (objName === "*") continue;
+          if (grantsObjectAccess(rawPerm ?? {})) grantedObjects.add(objName);
+        }
+      }
+      for (let i = 0; i < objects.length; i++) {
+        const obj = objects[i];
+        if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
+        const objName = typeof obj.name === "string" ? obj.name : "";
+        if (!objName || grantedObjects.has(objName)) continue;
+        const md = firstMasterDetailField(obj);
+        if (!md) continue;
+        const parentText = md.parent ? ` \u2192 "${md.parent}"` : "";
+        findings.push({
+          severity: "warning",
+          rule: SECURITY_MASTER_DETAIL_UNGRANTED,
+          where: `object "${objName}"`,
+          path: `objects[${i}].fields.${md.name}`,
+          message: `detail object "${objName}" (master_detail "${md.name}"${parentText}) has no object-level CRUD grant in any permission set. A master-detail child derives its RECORD-level access from the master (ADR-0055 controlled_by_parent), but object-level CRUD is a SEPARATE gate that is never derived \u2014 role-bound non-admin users are denied (403) before the parent-derived access is ever consulted (the silent "can't submit the subtable" trap).`,
+          hint: `Grant "${objName}" in at least one permission set that already grants its master${md.parent ? ` "${md.parent}"` : ""} \u2014 e.g. permissions[i].objects.${objName} = { allowRead: true, allowCreate: true, allowEdit: true }. If no role should ever touch it (a pure system/internal table), name it sys_* or set isSystem: true.`
+        });
+      }
+    }
+  }
+  return findings;
+}
+
+// src/build-access-matrix.ts
+function asArray15(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function buildAccessMatrix(stack) {
+  const entries = [];
+  if (!stack || typeof stack !== "object") return { version: 1, entries };
+  const owdByObject = /* @__PURE__ */ new Map();
+  for (const obj of asArray15(stack.objects)) {
+    const name = typeof obj.name === "string" ? obj.name : "";
+    if (!name) continue;
+    const owd = obj.sharingModel ?? obj.security?.sharingModel;
+    if (typeof owd === "string") owdByObject.set(name, owd);
+  }
+  for (const ps of asArray15(stack.permissions)) {
+    const psName = typeof ps.name === "string" ? ps.name : "";
+    if (!psName) continue;
+    const objects = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
+    for (const [objName, rawPerm] of Object.entries(objects)) {
+      const p = rawPerm ?? {};
+      const entry = {
+        permissionSet: psName,
+        object: objName,
+        create: p.allowCreate === true,
+        read: p.allowRead === true || p.viewAllRecords === true || p.modifyAllRecords === true,
+        edit: p.allowEdit === true || p.modifyAllRecords === true,
+        delete: p.allowDelete === true || p.modifyAllRecords === true,
+        viewAllRecords: p.viewAllRecords === true,
+        modifyAllRecords: p.modifyAllRecords === true
+      };
+      if (typeof p.readScope === "string") entry.readScope = p.readScope;
+      if (typeof p.writeScope === "string") entry.writeScope = p.writeScope;
+      const owd = owdByObject.get(objName);
+      if (owd) entry.sharingModel = owd;
+      entries.push(entry);
+    }
+  }
+  entries.sort(
+    (a, b) => a.permissionSet === b.permissionSet ? a.object.localeCompare(b.object) : a.permissionSet.localeCompare(b.permissionSet)
+  );
+  return { version: 1, entries };
+}
+var BIT_LABELS = [
+  ["create", "create"],
+  ["read", "read"],
+  ["edit", "edit"],
+  ["delete", "delete"],
+  ["viewAllRecords", "View All Data"],
+  ["modifyAllRecords", "Modify All Data"]
+];
+function diffAccessMatrix(before, after) {
+  const lines = [];
+  const key = (e) => `${e.permissionSet}\0${e.object}`;
+  const beforeMap = new Map((before?.entries ?? []).map((e) => [key(e), e]));
+  const afterMap = new Map((after?.entries ?? []).map((e) => [key(e), e]));
+  for (const [k, b] of beforeMap) {
+    if (!afterMap.has(k)) {
+      lines.push(`'${b.permissionSet}' loses ALL access to '${b.object}' (entry removed)`);
+    }
+  }
+  for (const [k, a] of afterMap) {
+    const b = beforeMap.get(k);
+    if (!b) {
+      const grants = BIT_LABELS.filter(([bit]) => a[bit] === true).map(([, label]) => label);
+      lines.push(`'${a.permissionSet}' gains access to '${a.object}' (${grants.join(", ") || "no bits set"})`);
+      continue;
+    }
+    for (const [bit, label] of BIT_LABELS) {
+      if (b[bit] !== a[bit]) {
+        lines.push(`'${a.permissionSet}' ${a[bit] ? "gains" : "loses"} ${label} on '${a.object}'`);
+      }
+    }
+    if ((b.readScope ?? "own") !== (a.readScope ?? "own")) {
+      lines.push(`'${a.permissionSet}' read depth on '${a.object}': ${b.readScope ?? "own"} \u2192 ${a.readScope ?? "own"}`);
+    }
+    if ((b.writeScope ?? "own") !== (a.writeScope ?? "own")) {
+      lines.push(`'${a.permissionSet}' write depth on '${a.object}': ${b.writeScope ?? "own"} \u2192 ${a.writeScope ?? "own"}`);
+    }
+    if ((b.sharingModel ?? "") !== (a.sharingModel ?? "")) {
+      lines.push(`'${a.object}' record baseline (OWD): ${b.sharingModel ?? "(unset)"} \u2192 ${a.sharingModel ?? "(unset)"} (affects every principal)`);
+    }
+  }
+  return lines;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  APPROVAL_APPROVER_TYPE_UNKNOWN,
+  APPROVAL_ESCALATION_REASSIGN_NO_TARGET,
+  APPROVAL_ROLE_NOT_MEMBERSHIP_TIER,
+  CAPABILITY_REFERENCE_UNKNOWN,
   CHART_CONFIG_MISSING,
   CHART_FIELD_UNKNOWN,
   FIELD_GROUP_EMPTY,
@@ -1262,6 +1842,14 @@ function validateFormLayout(stack) {
   LIST_VIEW_FILTERS_IN_VIEWS_MODE,
   MEASURE_AGGREGATE_INCOHERENT,
   PAGE_SOURCE_CLASSNAME,
+  SECURITY_ANCHOR_HIGH_PRIVILEGE,
+  SECURITY_BOOK_AUDIENCE_UNKNOWN_SET,
+  SECURITY_EXTERNAL_WIDER,
+  SECURITY_OWD_ALIAS,
+  SECURITY_OWD_UNSET,
+  SECURITY_PRIVATE_NO_READSCOPE,
+  SECURITY_ROLE_WORD,
+  SECURITY_WILDCARD_VAMA,
   SEMANTIC_ROLE_FIELD_UNKNOWN,
   STYLE_CLASSNAME_TAILWIND,
   STYLE_NODE_MISSING_ID,
@@ -1274,6 +1862,10 @@ function validateFormLayout(stack) {
   WIDGET_DATASET_UNKNOWN,
   WIDGET_DIMENSION_UNKNOWN,
   WIDGET_MEASURE_UNKNOWN,
+  buildAccessMatrix,
+  diffAccessMatrix,
+  validateApprovalApprovers,
+  validateCapabilityReferences,
   validateFormLayout,
   validateJsxPages,
   validateListViewMode,
@@ -1282,6 +1874,7 @@ function validateFormLayout(stack) {
   validateReactPages,
   validateRecordTitle,
   validateResponsiveStyles,
+  validateSecurityPosture,
   validateSemanticRoles,
   validateStackExpressions,
   validateWidgetBindings