@objectstack/lint 12.6.0 → 14.3.0

package/dist/index.d.cts

@@ -1,4 +1,5 @@
 import { Manifest } from '@objectstack/sdui-parser';
+import { AccessMatrix } from '@objectstack/spec/security';
 
 /**
  * Build-time dashboard widget binding diagnostics (issues #1719, #1721).
@@ -69,7 +70,7 @@ interface WidgetBindingFinding {
     /** How to fix (or deliberately suppress) it. */
     hint: string;
 }
-type AnyRec$a = Record<string, unknown>;
+type AnyRec$e = Record<string, unknown>;
 /**
  * Validate every dashboard widget's dataset binding. Returns the list of
  * findings (empty = clean). Caller decides how to surface them: `error`
@@ -77,7 +78,7 @@ type AnyRec$a = Record<string, unknown>;
  * should fail validate/build; `warning` findings are advisory and must
  * never fail the build on their own.
  */
-declare function validateWidgetBindings(stack: AnyRec$a): WidgetBindingFinding[];
+declare function validateWidgetBindings(stack: AnyRec$e): WidgetBindingFinding[];
 
 interface ExprIssue {
     where: string;
@@ -90,12 +91,12 @@ interface ExprIssue {
      */
     severity?: 'error' | 'warning';
 }
-type AnyRec$9 = Record<string, unknown>;
+type AnyRec$d = Record<string, unknown>;
 /**
  * Validate every predicate in the stack. Returns the list of issues (empty =
  * clean). Caller decides how to surface / whether to fail the build.
  */
-declare function validateStackExpressions(stack: AnyRec$9): ExprIssue[];
+declare function validateStackExpressions(stack: AnyRec$d): ExprIssue[];
 
 type ListViewModeSeverity = 'error' | 'warning';
 interface ListViewModeFinding {
@@ -109,7 +110,7 @@ interface ListViewModeFinding {
     hint: string;
 }
 declare const LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-type AnyRec$8 = Record<string, unknown>;
+type AnyRec$c = Record<string, unknown>;
 /**
  * Flag ADR-0047 "views" mode violations on an object's built-in named views or a
  * `defineView` default `list` / named `listViews`: `quickFilters`, or a `tabs`
@@ -119,7 +120,7 @@ type AnyRec$8 = Record<string, unknown>;
  *
  * Feed the PRE-parse stack (normalizeStackInput output) — see file header.
  */
-declare function validateListViewMode(stack: AnyRec$8): ListViewModeFinding[];
+declare function validateListViewMode(stack: AnyRec$c): ListViewModeFinding[];
 
 type StyleSeverity = 'error' | 'warning';
 interface StyleFinding {
@@ -137,14 +138,14 @@ declare const STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
 declare const STYLE_RESPONSIVE_NO_BASE = "style-responsive-no-base";
 declare const STYLE_UNKNOWN_CSS_PROPERTY = "style-unknown-css-property";
 declare const STYLE_UNKNOWN_TOKEN = "style-unknown-token";
-type AnyRec$7 = Record<string, unknown>;
+type AnyRec$b = Record<string, unknown>;
 /**
  * Validate every page's component tree for SDUI styling correctness (ADR-0065).
  * Returns findings (empty = clean). `error` findings describe styles that are
  * silently dropped and should fail validate/build; `warning` findings are
  * advisory (typos, drift, footguns).
  */
-declare function validateResponsiveStyles(stack: AnyRec$7): StyleFinding[];
+declare function validateResponsiveStyles(stack: AnyRec$b): StyleFinding[];
 
 type JsxPageSeverity = 'error' | 'warning';
 interface JsxPageFinding {
@@ -157,8 +158,8 @@ interface JsxPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$6 = Record<string, unknown>;
-declare function validateJsxPages(stack: AnyRec$6, opts?: {
+type AnyRec$a = Record<string, unknown>;
+declare function validateJsxPages(stack: AnyRec$a, opts?: {
     manifest?: Manifest;
 }): JsxPageFinding[];
 
@@ -171,8 +172,8 @@ interface ReactPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$5 = Record<string, unknown>;
-declare function validateReactPages(stack: AnyRec$5): ReactPageFinding[];
+type AnyRec$9 = Record<string, unknown>;
+declare function validateReactPages(stack: AnyRec$9): ReactPageFinding[];
 
 type ReactPropSeverity = 'error' | 'warning';
 interface ReactPropFinding {
@@ -183,8 +184,8 @@ interface ReactPropFinding {
     message: string;
     hint: string;
 }
-type AnyRec$4 = Record<string, unknown>;
-declare function validateReactPageProps(stack: AnyRec$4): ReactPropFinding[];
+type AnyRec$8 = Record<string, unknown>;
+declare function validateReactPageProps(stack: AnyRec$8): ReactPropFinding[];
 
 type SourceStyleSeverity = 'error' | 'warning';
 interface SourceStyleFinding {
@@ -196,8 +197,8 @@ interface SourceStyleFinding {
     hint: string;
 }
 declare const PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-type AnyRec$3 = Record<string, unknown>;
-declare function validatePageSourceStyling(stack: AnyRec$3): SourceStyleFinding[];
+type AnyRec$7 = Record<string, unknown>;
+declare function validatePageSourceStyling(stack: AnyRec$7): SourceStyleFinding[];
 
 /**
  * Build-time record-title diagnostics (ADR-0079).
@@ -241,14 +242,14 @@ interface RecordTitleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$2 = Record<string, unknown>;
+type AnyRec$6 = Record<string, unknown>;
 /**
  * Validate every object's record-title declaration. Returns the list of
  * findings (empty = clean). Both rules are advisory (`warning`): the caller
  * must never fail the build on them alone — auto-provision + the `Record #<id>`
  * floor guarantee a resolvable title at runtime.
  */
-declare function validateRecordTitle(stack: AnyRec$2): RecordTitleFinding[];
+declare function validateRecordTitle(stack: AnyRec$6): RecordTitleFinding[];
 
 /**
  * Build-time semantic-role diagnostics (ADR-0085).
@@ -285,13 +286,13 @@ interface SemanticRoleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$1 = Record<string, unknown>;
+type AnyRec$5 = Record<string, unknown>;
 /**
  * Validate every object's semantic-role pointers. Returns the list of
  * findings (empty = clean). Advisory only — the caller must never fail the
  * build on these alone.
  */
-declare function validateSemanticRoles(stack: AnyRec$1): SemanticRoleFinding[];
+declare function validateSemanticRoles(stack: AnyRec$5): SemanticRoleFinding[];
 
 /**
  * Build-time form-layout diagnostics (#2578).
@@ -334,11 +335,111 @@ interface FormLayoutFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec = Record<string, unknown>;
+type AnyRec$4 = Record<string, unknown>;
 /**
  * Validate authored form-view layout. Returns findings (empty = clean).
  * Advisory only — the caller must never fail the build on these alone.
  */
-declare function validateFormLayout(stack: AnyRec): FormLayoutFinding[];
+declare function validateFormLayout(stack: AnyRec$4): FormLayoutFinding[];
+
+declare const CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
+type CapabilityRefSeverity = 'error' | 'warning';
+interface CapabilityRefFinding {
+    /** Always `warning` — the reference fails closed at runtime (see module note). */
+    severity: CapabilityRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `object "sys_license"`. */
+    where: string;
+    /** Config path, e.g. `objects[3].requiredPermissions`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$3 = Record<string, unknown>;
+/**
+ * Validate every capability reference in a stack. Returns findings (empty =
+ * clean). Advisory only — callers must not fail the build on these alone.
+ */
+declare function validateCapabilityReferences(stack: AnyRec$3): CapabilityRefFinding[];
+
+declare const APPROVAL_ROLE_NOT_MEMBERSHIP_TIER = "approval-role-not-membership-tier";
+declare const APPROVAL_APPROVER_TYPE_UNKNOWN = "approval-approver-type-unknown";
+declare const APPROVAL_ESCALATION_REASSIGN_NO_TARGET = "approval-escalation-reassign-no-target";
+type ApprovalApproverSeverity = 'error' | 'warning' | 'info';
+interface ApprovalApproverFinding {
+    severity: ApprovalApproverSeverity;
+    /** Diagnostic rule id (`approval-*`). */
+    rule: string;
+    /** Human-readable location, e.g. `flow "expense_approval" · node "step1"`. */
+    where: string;
+    /** Config path, e.g. `flows[0].nodes[2].config.approvers[0]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$2 = Record<string, unknown>;
+/**
+ * Validate the approvers of every Approval node in the stack's flows.
+ * Returns findings (empty = clean).
+ */
+declare function validateApprovalApprovers(stack: AnyRec$2): ApprovalApproverFinding[];
+
+declare const SECURITY_OWD_UNSET = "security-owd-unset";
+declare const SECURITY_OWD_ALIAS = "security-owd-alias";
+declare const SECURITY_EXTERNAL_WIDER = "security-external-wider-than-internal";
+declare const SECURITY_WILDCARD_VAMA = "security-wildcard-vama";
+declare const SECURITY_ANCHOR_HIGH_PRIVILEGE = "security-anchor-high-privilege";
+declare const SECURITY_ROLE_WORD = "security-role-word";
+declare const SECURITY_BOOK_AUDIENCE_UNKNOWN_SET = "security-book-audience-unknown-set";
+declare const SECURITY_PRIVATE_NO_READSCOPE = "security-private-no-readscope";
+type SecuritySeverity = 'error' | 'warning' | 'info';
+interface SecurityFinding {
+    severity: SecuritySeverity;
+    /** Diagnostic rule id (`security-*`). */
+    rule: string;
+    /** Human-readable location, e.g. `object "leave_request"`. */
+    where: string;
+    /** Config path, e.g. `objects[3].sharingModel`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$1 = Record<string, unknown>;
+/**
+ * Validate the security posture of a stack. Returns findings (empty = clean).
+ * `error` findings gate the build in `os compile`; `info` is advisory.
+ */
+declare function validateSecurityPosture(stack: AnyRec$1): SecurityFinding[];
+
+/**
+ * [ADR-0090 D6] Access-matrix snapshot — authoring-time companion to the
+ * runtime explain engine.
+ *
+ * `buildAccessMatrix(stack)` derives, PURELY from metadata, one row per
+ * (permission set × object) the stack declares: the CRUD/VAMA bits, the
+ * depth axes, and the object's OWD for context. The matrix is snapshotted to
+ * `access-matrix.json` and diffed on every compile: an unchanged matrix
+ * auto-passes; a changed one fails the build until the snapshot is updated —
+ * so every capability change becomes a REVIEWABLE, semantic diff
+ * ("`crm_admin` gains delete on `crm_lead`") instead of a buried JSON hunk.
+ * This is the publish-gate substrate the AI-authoring safety story needs:
+ * AI may draft grants freely; it cannot silently change who can do what.
+ */
+
+type AnyRec = Record<string, unknown>;
+/** Build the sorted access matrix for a normalized stack. */
+declare function buildAccessMatrix(stack: AnyRec): AccessMatrix;
+/**
+ * Semantic diff between two matrices — human-review lines, empty = identical.
+ * Ordered: removals, additions, then per-entry bit/scope changes.
+ */
+declare function diffAccessMatrix(before: AccessMatrix, after: AccessMatrix): string[];
 
-export { CHART_CONFIG_MISSING, CHART_FIELD_UNKNOWN, type ExprIssue, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FormLayoutFinding, type FormLayoutSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, type ListViewModeFinding, type ListViewModeSeverity, MEASURE_AGGREGATE_INCOHERENT, PAGE_SOURCE_CLASSNAME, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type RecordTitleFinding, type RecordTitleSeverity, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SemanticRoleFinding, type SemanticRoleSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, validateFormLayout, validateJsxPages, validateListViewMode, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateRecordTitle, validateResponsiveStyles, validateSemanticRoles, validateStackExpressions, validateWidgetBindings };
+export { APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_ROLE_NOT_MEMBERSHIP_TIER, type ApprovalApproverFinding, type ApprovalApproverSeverity, CAPABILITY_REFERENCE_UNKNOWN, CHART_CONFIG_MISSING, CHART_FIELD_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ExprIssue, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FormLayoutFinding, type FormLayoutSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, type ListViewModeFinding, type ListViewModeSeverity, MEASURE_AGGREGATE_INCOHERENT, PAGE_SOURCE_CLASSNAME, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type RecordTitleFinding, type RecordTitleSeverity, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_EXTERNAL_WIDER, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SecurityFinding, type SecuritySeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, validateApprovalApprovers, validateCapabilityReferences, validateFormLayout, validateJsxPages, validateListViewMode, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateRecordTitle, validateResponsiveStyles, validateSecurityPosture, validateSemanticRoles, validateStackExpressions, validateWidgetBindings };

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { Manifest } from '@objectstack/sdui-parser';
+import { AccessMatrix } from '@objectstack/spec/security';
 
 /**
  * Build-time dashboard widget binding diagnostics (issues #1719, #1721).
@@ -69,7 +70,7 @@ interface WidgetBindingFinding {
     /** How to fix (or deliberately suppress) it. */
     hint: string;
 }
-type AnyRec$a = Record<string, unknown>;
+type AnyRec$e = Record<string, unknown>;
 /**
  * Validate every dashboard widget's dataset binding. Returns the list of
  * findings (empty = clean). Caller decides how to surface them: `error`
@@ -77,7 +78,7 @@ type AnyRec$a = Record<string, unknown>;
  * should fail validate/build; `warning` findings are advisory and must
  * never fail the build on their own.
  */
-declare function validateWidgetBindings(stack: AnyRec$a): WidgetBindingFinding[];
+declare function validateWidgetBindings(stack: AnyRec$e): WidgetBindingFinding[];
 
 interface ExprIssue {
     where: string;
@@ -90,12 +91,12 @@ interface ExprIssue {
      */
     severity?: 'error' | 'warning';
 }
-type AnyRec$9 = Record<string, unknown>;
+type AnyRec$d = Record<string, unknown>;
 /**
  * Validate every predicate in the stack. Returns the list of issues (empty =
  * clean). Caller decides how to surface / whether to fail the build.
  */
-declare function validateStackExpressions(stack: AnyRec$9): ExprIssue[];
+declare function validateStackExpressions(stack: AnyRec$d): ExprIssue[];
 
 type ListViewModeSeverity = 'error' | 'warning';
 interface ListViewModeFinding {
@@ -109,7 +110,7 @@ interface ListViewModeFinding {
     hint: string;
 }
 declare const LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-type AnyRec$8 = Record<string, unknown>;
+type AnyRec$c = Record<string, unknown>;
 /**
  * Flag ADR-0047 "views" mode violations on an object's built-in named views or a
  * `defineView` default `list` / named `listViews`: `quickFilters`, or a `tabs`
@@ -119,7 +120,7 @@ type AnyRec$8 = Record<string, unknown>;
  *
  * Feed the PRE-parse stack (normalizeStackInput output) — see file header.
  */
-declare function validateListViewMode(stack: AnyRec$8): ListViewModeFinding[];
+declare function validateListViewMode(stack: AnyRec$c): ListViewModeFinding[];
 
 type StyleSeverity = 'error' | 'warning';
 interface StyleFinding {
@@ -137,14 +138,14 @@ declare const STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
 declare const STYLE_RESPONSIVE_NO_BASE = "style-responsive-no-base";
 declare const STYLE_UNKNOWN_CSS_PROPERTY = "style-unknown-css-property";
 declare const STYLE_UNKNOWN_TOKEN = "style-unknown-token";
-type AnyRec$7 = Record<string, unknown>;
+type AnyRec$b = Record<string, unknown>;
 /**
  * Validate every page's component tree for SDUI styling correctness (ADR-0065).
  * Returns findings (empty = clean). `error` findings describe styles that are
  * silently dropped and should fail validate/build; `warning` findings are
  * advisory (typos, drift, footguns).
  */
-declare function validateResponsiveStyles(stack: AnyRec$7): StyleFinding[];
+declare function validateResponsiveStyles(stack: AnyRec$b): StyleFinding[];
 
 type JsxPageSeverity = 'error' | 'warning';
 interface JsxPageFinding {
@@ -157,8 +158,8 @@ interface JsxPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$6 = Record<string, unknown>;
-declare function validateJsxPages(stack: AnyRec$6, opts?: {
+type AnyRec$a = Record<string, unknown>;
+declare function validateJsxPages(stack: AnyRec$a, opts?: {
     manifest?: Manifest;
 }): JsxPageFinding[];
 
@@ -171,8 +172,8 @@ interface ReactPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$5 = Record<string, unknown>;
-declare function validateReactPages(stack: AnyRec$5): ReactPageFinding[];
+type AnyRec$9 = Record<string, unknown>;
+declare function validateReactPages(stack: AnyRec$9): ReactPageFinding[];
 
 type ReactPropSeverity = 'error' | 'warning';
 interface ReactPropFinding {
@@ -183,8 +184,8 @@ interface ReactPropFinding {
     message: string;
     hint: string;
 }
-type AnyRec$4 = Record<string, unknown>;
-declare function validateReactPageProps(stack: AnyRec$4): ReactPropFinding[];
+type AnyRec$8 = Record<string, unknown>;
+declare function validateReactPageProps(stack: AnyRec$8): ReactPropFinding[];
 
 type SourceStyleSeverity = 'error' | 'warning';
 interface SourceStyleFinding {
@@ -196,8 +197,8 @@ interface SourceStyleFinding {
     hint: string;
 }
 declare const PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-type AnyRec$3 = Record<string, unknown>;
-declare function validatePageSourceStyling(stack: AnyRec$3): SourceStyleFinding[];
+type AnyRec$7 = Record<string, unknown>;
+declare function validatePageSourceStyling(stack: AnyRec$7): SourceStyleFinding[];
 
 /**
  * Build-time record-title diagnostics (ADR-0079).
@@ -241,14 +242,14 @@ interface RecordTitleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$2 = Record<string, unknown>;
+type AnyRec$6 = Record<string, unknown>;
 /**
  * Validate every object's record-title declaration. Returns the list of
  * findings (empty = clean). Both rules are advisory (`warning`): the caller
  * must never fail the build on them alone — auto-provision + the `Record #<id>`
  * floor guarantee a resolvable title at runtime.
  */
-declare function validateRecordTitle(stack: AnyRec$2): RecordTitleFinding[];
+declare function validateRecordTitle(stack: AnyRec$6): RecordTitleFinding[];
 
 /**
  * Build-time semantic-role diagnostics (ADR-0085).
@@ -285,13 +286,13 @@ interface SemanticRoleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$1 = Record<string, unknown>;
+type AnyRec$5 = Record<string, unknown>;
 /**
  * Validate every object's semantic-role pointers. Returns the list of
  * findings (empty = clean). Advisory only — the caller must never fail the
  * build on these alone.
  */
-declare function validateSemanticRoles(stack: AnyRec$1): SemanticRoleFinding[];
+declare function validateSemanticRoles(stack: AnyRec$5): SemanticRoleFinding[];
 
 /**
  * Build-time form-layout diagnostics (#2578).
@@ -334,11 +335,111 @@ interface FormLayoutFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec = Record<string, unknown>;
+type AnyRec$4 = Record<string, unknown>;
 /**
  * Validate authored form-view layout. Returns findings (empty = clean).
  * Advisory only — the caller must never fail the build on these alone.
  */
-declare function validateFormLayout(stack: AnyRec): FormLayoutFinding[];
+declare function validateFormLayout(stack: AnyRec$4): FormLayoutFinding[];
+
+declare const CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
+type CapabilityRefSeverity = 'error' | 'warning';
+interface CapabilityRefFinding {
+    /** Always `warning` — the reference fails closed at runtime (see module note). */
+    severity: CapabilityRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `object "sys_license"`. */
+    where: string;
+    /** Config path, e.g. `objects[3].requiredPermissions`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$3 = Record<string, unknown>;
+/**
+ * Validate every capability reference in a stack. Returns findings (empty =
+ * clean). Advisory only — callers must not fail the build on these alone.
+ */
+declare function validateCapabilityReferences(stack: AnyRec$3): CapabilityRefFinding[];
+
+declare const APPROVAL_ROLE_NOT_MEMBERSHIP_TIER = "approval-role-not-membership-tier";
+declare const APPROVAL_APPROVER_TYPE_UNKNOWN = "approval-approver-type-unknown";
+declare const APPROVAL_ESCALATION_REASSIGN_NO_TARGET = "approval-escalation-reassign-no-target";
+type ApprovalApproverSeverity = 'error' | 'warning' | 'info';
+interface ApprovalApproverFinding {
+    severity: ApprovalApproverSeverity;
+    /** Diagnostic rule id (`approval-*`). */
+    rule: string;
+    /** Human-readable location, e.g. `flow "expense_approval" · node "step1"`. */
+    where: string;
+    /** Config path, e.g. `flows[0].nodes[2].config.approvers[0]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$2 = Record<string, unknown>;
+/**
+ * Validate the approvers of every Approval node in the stack's flows.
+ * Returns findings (empty = clean).
+ */
+declare function validateApprovalApprovers(stack: AnyRec$2): ApprovalApproverFinding[];
+
+declare const SECURITY_OWD_UNSET = "security-owd-unset";
+declare const SECURITY_OWD_ALIAS = "security-owd-alias";
+declare const SECURITY_EXTERNAL_WIDER = "security-external-wider-than-internal";
+declare const SECURITY_WILDCARD_VAMA = "security-wildcard-vama";
+declare const SECURITY_ANCHOR_HIGH_PRIVILEGE = "security-anchor-high-privilege";
+declare const SECURITY_ROLE_WORD = "security-role-word";
+declare const SECURITY_BOOK_AUDIENCE_UNKNOWN_SET = "security-book-audience-unknown-set";
+declare const SECURITY_PRIVATE_NO_READSCOPE = "security-private-no-readscope";
+type SecuritySeverity = 'error' | 'warning' | 'info';
+interface SecurityFinding {
+    severity: SecuritySeverity;
+    /** Diagnostic rule id (`security-*`). */
+    rule: string;
+    /** Human-readable location, e.g. `object "leave_request"`. */
+    where: string;
+    /** Config path, e.g. `objects[3].sharingModel`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$1 = Record<string, unknown>;
+/**
+ * Validate the security posture of a stack. Returns findings (empty = clean).
+ * `error` findings gate the build in `os compile`; `info` is advisory.
+ */
+declare function validateSecurityPosture(stack: AnyRec$1): SecurityFinding[];
+
+/**
+ * [ADR-0090 D6] Access-matrix snapshot — authoring-time companion to the
+ * runtime explain engine.
+ *
+ * `buildAccessMatrix(stack)` derives, PURELY from metadata, one row per
+ * (permission set × object) the stack declares: the CRUD/VAMA bits, the
+ * depth axes, and the object's OWD for context. The matrix is snapshotted to
+ * `access-matrix.json` and diffed on every compile: an unchanged matrix
+ * auto-passes; a changed one fails the build until the snapshot is updated —
+ * so every capability change becomes a REVIEWABLE, semantic diff
+ * ("`crm_admin` gains delete on `crm_lead`") instead of a buried JSON hunk.
+ * This is the publish-gate substrate the AI-authoring safety story needs:
+ * AI may draft grants freely; it cannot silently change who can do what.
+ */
+
+type AnyRec = Record<string, unknown>;
+/** Build the sorted access matrix for a normalized stack. */
+declare function buildAccessMatrix(stack: AnyRec): AccessMatrix;
+/**
+ * Semantic diff between two matrices — human-review lines, empty = identical.
+ * Ordered: removals, additions, then per-entry bit/scope changes.
+ */
+declare function diffAccessMatrix(before: AccessMatrix, after: AccessMatrix): string[];
 
-export { CHART_CONFIG_MISSING, CHART_FIELD_UNKNOWN, type ExprIssue, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FormLayoutFinding, type FormLayoutSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, type ListViewModeFinding, type ListViewModeSeverity, MEASURE_AGGREGATE_INCOHERENT, PAGE_SOURCE_CLASSNAME, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type RecordTitleFinding, type RecordTitleSeverity, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SemanticRoleFinding, type SemanticRoleSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, validateFormLayout, validateJsxPages, validateListViewMode, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateRecordTitle, validateResponsiveStyles, validateSemanticRoles, validateStackExpressions, validateWidgetBindings };
+export { APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_ROLE_NOT_MEMBERSHIP_TIER, type ApprovalApproverFinding, type ApprovalApproverSeverity, CAPABILITY_REFERENCE_UNKNOWN, CHART_CONFIG_MISSING, CHART_FIELD_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ExprIssue, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FormLayoutFinding, type FormLayoutSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, type ListViewModeFinding, type ListViewModeSeverity, MEASURE_AGGREGATE_INCOHERENT, PAGE_SOURCE_CLASSNAME, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type RecordTitleFinding, type RecordTitleSeverity, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_EXTERNAL_WIDER, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SecurityFinding, type SecuritySeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, validateApprovalApprovers, validateCapabilityReferences, validateFormLayout, validateJsxPages, validateListViewMode, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateRecordTitle, validateResponsiveStyles, validateSecurityPosture, validateSemanticRoles, validateStackExpressions, validateWidgetBindings };