@objectstack/lint 14.7.0 → 15.0.0

package/dist/index.cjs

@@ -53,6 +53,8 @@ __export(index_exports, {
   TABLE_COUNT_ONLY: () => TABLE_COUNT_ONLY,
   TITLE_FORMAT_RETIRED: () => TITLE_FORMAT_RETIRED,
   TITLE_UNRESOLVABLE: () => TITLE_UNRESOLVABLE,
+  VISIBILITY_ALIAS_DEPRECATED: () => VISIBILITY_ALIAS_DEPRECATED,
+  VISIBILITY_ROOT_MISLAYERED: () => VISIBILITY_ROOT_MISLAYERED,
   WIDGET_DATASET_UNKNOWN: () => WIDGET_DATASET_UNKNOWN,
   WIDGET_DIMENSION_UNKNOWN: () => WIDGET_DIMENSION_UNKNOWN,
   WIDGET_MEASURE_UNKNOWN: () => WIDGET_MEASURE_UNKNOWN,
@@ -71,6 +73,7 @@ __export(index_exports, {
   validateSecurityPosture: () => validateSecurityPosture,
   validateSemanticRoles: () => validateSemanticRoles,
   validateStackExpressions: () => validateStackExpressions,
+  validateVisibilityPredicates: () => validateVisibilityPredicates,
   validateWidgetBindings: () => validateWidgetBindings
 });
 module.exports = __toCommonJS(index_exports);
@@ -1272,10 +1275,121 @@ function validateFormLayout(stack) {
   return findings;
 }
 
+// src/validate-visibility-predicates.ts
+var VISIBILITY_ALIAS_DEPRECATED = "visibility-alias-deprecated";
+var VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
+var CANONICAL = "visibleWhen";
+var ALIASES = ["visibleOn", "visibility"];
+function asArray12(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function predicateSource(v) {
+  if (typeof v === "string") return v;
+  if (v && typeof v === "object" && typeof v.source === "string") {
+    return v.source;
+  }
+  return void 0;
+}
+function usesRoot(source, root) {
+  return new RegExp(`(^|[^.\\w$])${root}\\.\\w`).test(source);
+}
+var MISLAYER_BY_LAYER = {
+  runtime: {
+    forbiddenRoot: "data",
+    message: "visibility predicate is rooted at `data.` \u2014 that is the metadata-editing-form root (a `*.form.ts` row under edit), not a runtime surface. A runtime view/page predicate that binds `data.` never matches and the element renders unconditionally (ADR-0089).",
+    hint: "Runtime record surfaces bind `record` + `current_user` (pages also expose `page.<var>`). Use e.g. `record.status == 'open'` instead of `data.status == 'open'`."
+  },
+  metadata: {
+    forbiddenRoot: "record",
+    message: "visibility predicate is rooted at `record.` \u2014 that is the runtime record-surface root (a `*.view.ts` / `*.page.ts` live record), not a metadata-editing form. A `*.form.ts` predicate that binds `record.` never matches and the element renders unconditionally (ADR-0089).",
+    hint: "Metadata-editing forms bind `data` (the row under edit). Use e.g. `data.type == 'grid'` instead of `record.type == 'grid'`."
+  }
+};
+function checkElement(el, where, path, layer, findings) {
+  for (const alias of ALIASES) {
+    if (el[alias] !== void 0) {
+      findings.push({
+        severity: "warning",
+        rule: VISIBILITY_ALIAS_DEPRECATED,
+        where,
+        path: `${path}.${alias}`,
+        message: `\`${alias}\` is the deprecated spelling of the conditional-visibility predicate (ADR-0089). It still works \u2014 it is normalized to \`visibleWhen\` at parse \u2014 but the canonical key is \`visibleWhen\`.`,
+        hint: `Rename the key \`${alias}\` \u2192 \`visibleWhen\` (same CEL value).`
+      });
+    }
+  }
+  const raw = el[CANONICAL] ?? el.visibleOn ?? el.visibility;
+  const source = predicateSource(raw);
+  const rule = MISLAYER_BY_LAYER[layer];
+  if (source && usesRoot(source, rule.forbiddenRoot)) {
+    findings.push({
+      severity: "warning",
+      rule: VISIBILITY_ROOT_MISLAYERED,
+      where,
+      path,
+      message: rule.message,
+      hint: rule.hint
+    });
+  }
+}
+function isFieldObject(entry) {
+  return !!entry && typeof entry === "object" && !Array.isArray(entry);
+}
+function validateVisibilityPredicates(stack, opts = {}) {
+  const layer = opts.layer ?? "runtime";
+  const findings = [];
+  const views = asArray12(stack.views);
+  for (let i = 0; i < views.length; i++) {
+    const view = views[i];
+    if (!view || typeof view !== "object") continue;
+    const viewName = typeof view.name === "string" ? view.name : `(view ${i})`;
+    const where = `view "${viewName}"`;
+    for (const bucket of ["sections", "groups"]) {
+      const sections = Array.isArray(view[bucket]) ? view[bucket] : [];
+      for (let s = 0; s < sections.length; s++) {
+        const sec = sections[s];
+        if (!sec || typeof sec !== "object") continue;
+        const secPath = `views[${i}].${bucket}[${s}]`;
+        checkElement(sec, where, secPath, layer, findings);
+        const secFields = Array.isArray(sec.fields) ? sec.fields : [];
+        for (let f = 0; f < secFields.length; f++) {
+          const entry = secFields[f];
+          if (isFieldObject(entry)) {
+            checkElement(entry, where, `${secPath}.fields[${f}]`, layer, findings);
+          }
+        }
+      }
+    }
+  }
+  const pages = asArray12(stack.pages);
+  for (let i = 0; i < pages.length; i++) {
+    const page = pages[i];
+    if (!page || typeof page !== "object") continue;
+    const pageName = typeof page.name === "string" ? page.name : `(page ${i})`;
+    const where = `page "${pageName}"`;
+    const regions = Array.isArray(page.regions) ? page.regions : [];
+    for (let r = 0; r < regions.length; r++) {
+      const region = regions[r];
+      const components = region && typeof region === "object" && Array.isArray(region.components) ? region.components : [];
+      for (let c = 0; c < components.length; c++) {
+        const comp = components[c];
+        if (comp && typeof comp === "object") {
+          checkElement(comp, where, `pages[${i}].regions[${r}].components[${c}]`, layer, findings);
+        }
+      }
+    }
+  }
+  return findings;
+}
+
 // src/validate-capability-references.ts
 var import_security = require("@objectstack/spec/security");
 var CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
-function asArray12(v) {
+function asArray13(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1300,17 +1414,20 @@ function validateCapabilityReferences(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const known = new Set(import_security.PLATFORM_CAPABILITY_NAMES);
-  for (const ps of asArray12(stack.permissions)) {
+  for (const cap of asArray13(stack.capabilities)) {
+    if (typeof cap.name === "string" && cap.name.length > 0) known.add(cap.name);
+  }
+  for (const ps of asArray13(stack.permissions)) {
     for (const cap of asCapArray(ps.systemPermissions)) known.add(cap);
   }
-  for (const seed of asArray12(stack.data)) {
+  for (const seed of asArray13(stack.data)) {
     if (seed.object !== "sys_capability") continue;
     for (const rec of Array.isArray(seed.records) ? seed.records : []) {
       const name = rec?.name;
       if (typeof name === "string" && name.length > 0) known.add(name);
     }
   }
-  const hint = "Fix the capability name, declare it on a permission set\u2019s systemPermissions, ship a sys_capability seed row, or ignore this if the capability is provided by another installed package (references fail closed at runtime).";
+  const hint = "Fix the capability name, define it with defineCapability (stack.capabilities), declare it on a permission set\u2019s systemPermissions, ship a sys_capability seed row, or ignore this if the capability is provided by another installed package (references fail closed at runtime).";
   const flag = (cap, where, path) => {
     if (known.has(cap)) return;
     findings.push({
@@ -1322,7 +1439,7 @@ function validateCapabilityReferences(stack) {
       hint
     });
   };
-  const objects = asArray12(stack.objects);
+  const objects = asArray13(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -1331,27 +1448,27 @@ function validateCapabilityReferences(stack) {
     for (const { cap, key } of flattenObjectRequired(obj.requiredPermissions)) {
       flag(cap, `object "${objName}"`, `${objPath}.requiredPermissions${key ? `.${key}` : ""}`);
     }
-    const fields = asArray12(obj.fields);
+    const fields = asArray13(obj.fields);
     for (const f of fields) {
       const fname = typeof f.name === "string" ? f.name : "(field)";
       for (const cap of asCapArray(f.requiredPermissions)) {
         flag(cap, `field "${objName}.${fname}"`, `${objPath}.fields.${fname}.requiredPermissions`);
       }
     }
-    for (const [ai, action] of asArray12(obj.actions).entries()) {
+    for (const [ai, action] of asArray13(obj.actions).entries()) {
       const aName = typeof action.name === "string" ? action.name : `(action ${ai})`;
       for (const cap of asCapArray(action.requiredPermissions)) {
         flag(cap, `action "${objName}.${aName}"`, `${objPath}.actions[${ai}].requiredPermissions`);
       }
     }
   }
-  for (const [i, action] of asArray12(stack.actions).entries()) {
+  for (const [i, action] of asArray13(stack.actions).entries()) {
     const aName = typeof action.name === "string" ? action.name : `(action ${i})`;
     for (const cap of asCapArray(action.requiredPermissions)) {
       flag(cap, `action "${aName}"`, `actions[${i}].requiredPermissions`);
     }
   }
-  const apps = asArray12(stack.apps);
+  const apps = asArray13(stack.apps);
   for (let i = 0; i < apps.length; i++) {
     const app = apps[i];
     if (!app || typeof app !== "object") continue;
@@ -1387,7 +1504,7 @@ var TYPE_FIX = {
   business_unit: "department",
   bu: "department"
 };
-function asArray13(v) {
+function asArray14(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1397,7 +1514,7 @@ function asArray13(v) {
 function validateApprovalApprovers(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const flows = asArray13(stack.flows);
+  const flows = asArray14(stack.flows);
   const validTypes = new Set(import_automation.ApproverType.options);
   for (let fi = 0; fi < flows.length; fi++) {
     const flow = flows[fi];
@@ -1485,7 +1602,7 @@ var OWD_WIDTH = {
   public_read: 1,
   public_read_write: 2
 };
-function asArray14(v) {
+function asArray15(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1511,7 +1628,7 @@ function refOf(def) {
   return typeof r === "string" && r ? r : void 0;
 }
 function firstMasterDetailField(obj) {
-  for (const f of asArray14(obj.fields)) {
+  for (const f of asArray15(obj.fields)) {
     if (f.type === "master_detail") {
       return { name: String(f.name ?? "?"), parent: refOf(f) };
     }
@@ -1524,8 +1641,8 @@ function grantsObjectAccess(p) {
 function validateSecurityPosture(stack, opts) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const objects = asArray14(stack.objects);
-  const permissionSets = asArray14(stack.permissions);
+  const objects = asArray15(stack.objects);
+  const permissionSets = asArray15(stack.permissions);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -1654,10 +1771,10 @@ function validateSecurityPosture(stack, opts) {
     if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
     const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
     flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
-    for (const f of asArray14(obj.fields)) {
+    for (const f of asArray15(obj.fields)) {
       flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
     }
-    for (const [ai, action] of asArray14(obj.actions).entries()) {
+    for (const [ai, action] of asArray15(obj.actions).entries()) {
       flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
     }
   }
@@ -1666,19 +1783,19 @@ function validateSecurityPosture(stack, opts) {
     if (!ps || typeof ps !== "object") continue;
     flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
   }
-  for (const [i, pos] of asArray14(stack.positions).entries()) {
+  for (const [i, pos] of asArray15(stack.positions).entries()) {
     flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
   }
-  for (const [i, app] of asArray14(stack.apps).entries()) {
+  for (const [i, app] of asArray15(stack.apps).entries()) {
     flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
   }
-  for (const [i, book] of asArray14(stack.books).entries()) {
+  for (const [i, book] of asArray15(stack.books).entries()) {
     flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
   }
   const stackSetNames = new Set(
     permissionSets.map((ps) => typeof ps.name === "string" ? ps.name : void 0).filter((n) => !!n)
   );
-  for (const [i, book] of asArray14(stack.books).entries()) {
+  for (const [i, book] of asArray15(stack.books).entries()) {
     const audience = book.audience;
     if (!audience || typeof audience !== "object") continue;
     const setName = audience.permissionSet;
@@ -1756,7 +1873,7 @@ function validateSecurityPosture(stack, opts) {
   }
   const GRANT_SEED_OBJECTS = /* @__PURE__ */ new Set(["sys_user_position", "sys_user_permission_set"]);
   const nowMs = opts?.nowMs ?? Date.now();
-  for (const [i, seed] of asArray14(stack.data).entries()) {
+  for (const [i, seed] of asArray15(stack.data).entries()) {
     const seedObject = typeof seed.object === "string" ? seed.object : "";
     if (!GRANT_SEED_OBJECTS.has(seedObject)) continue;
     const records = Array.isArray(seed.records) ? seed.records : [];
@@ -1797,7 +1914,7 @@ function validateSecurityPosture(stack, opts) {
 }
 
 // src/build-access-matrix.ts
-function asArray15(v) {
+function asArray16(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1808,13 +1925,13 @@ function buildAccessMatrix(stack) {
   const entries = [];
   if (!stack || typeof stack !== "object") return { version: 1, entries };
   const owdByObject = /* @__PURE__ */ new Map();
-  for (const obj of asArray15(stack.objects)) {
+  for (const obj of asArray16(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : "";
     if (!name) continue;
     const owd = obj.sharingModel ?? obj.security?.sharingModel;
     if (typeof owd === "string") owdByObject.set(name, owd);
   }
-  for (const ps of asArray15(stack.permissions)) {
+  for (const ps of asArray16(stack.permissions)) {
     const psName = typeof ps.name === "string" ? ps.name : "";
     if (!psName) continue;
     const objects = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
@@ -1919,6 +2036,8 @@ function diffAccessMatrix(before, after) {
   TABLE_COUNT_ONLY,
   TITLE_FORMAT_RETIRED,
   TITLE_UNRESOLVABLE,
+  VISIBILITY_ALIAS_DEPRECATED,
+  VISIBILITY_ROOT_MISLAYERED,
   WIDGET_DATASET_UNKNOWN,
   WIDGET_DIMENSION_UNKNOWN,
   WIDGET_MEASURE_UNKNOWN,
@@ -1937,6 +2056,7 @@ function diffAccessMatrix(before, after) {
   validateSecurityPosture,
   validateSemanticRoles,
   validateStackExpressions,
+  validateVisibilityPredicates,
   validateWidgetBindings
 });
 //# sourceMappingURL=index.cjs.map