@objectstack/lint 14.8.0 → 15.0.0

package/dist/index.cjs

@@ -1294,10 +1294,22 @@ function predicateSource(v) {
   }
   return void 0;
 }
-function usesDataRoot(source) {
-  return /(^|[^.\w$])data\.\w/.test(source);
+function usesRoot(source, root) {
+  return new RegExp(`(^|[^.\\w$])${root}\\.\\w`).test(source);
 }
-function checkElement(el, where, path, findings) {
+var MISLAYER_BY_LAYER = {
+  runtime: {
+    forbiddenRoot: "data",
+    message: "visibility predicate is rooted at `data.` \u2014 that is the metadata-editing-form root (a `*.form.ts` row under edit), not a runtime surface. A runtime view/page predicate that binds `data.` never matches and the element renders unconditionally (ADR-0089).",
+    hint: "Runtime record surfaces bind `record` + `current_user` (pages also expose `page.<var>`). Use e.g. `record.status == 'open'` instead of `data.status == 'open'`."
+  },
+  metadata: {
+    forbiddenRoot: "record",
+    message: "visibility predicate is rooted at `record.` \u2014 that is the runtime record-surface root (a `*.view.ts` / `*.page.ts` live record), not a metadata-editing form. A `*.form.ts` predicate that binds `record.` never matches and the element renders unconditionally (ADR-0089).",
+    hint: "Metadata-editing forms bind `data` (the row under edit). Use e.g. `data.type == 'grid'` instead of `record.type == 'grid'`."
+  }
+};
+function checkElement(el, where, path, layer, findings) {
   for (const alias of ALIASES) {
     if (el[alias] !== void 0) {
       findings.push({
@@ -1312,21 +1324,23 @@ function checkElement(el, where, path, findings) {
   }
   const raw = el[CANONICAL] ?? el.visibleOn ?? el.visibility;
   const source = predicateSource(raw);
-  if (source && usesDataRoot(source)) {
+  const rule = MISLAYER_BY_LAYER[layer];
+  if (source && usesRoot(source, rule.forbiddenRoot)) {
     findings.push({
       severity: "warning",
       rule: VISIBILITY_ROOT_MISLAYERED,
       where,
       path,
-      message: `visibility predicate is rooted at \`data.\` \u2014 that is the metadata-editing-form root (a \`*.form.ts\` row under edit), not a runtime surface. A runtime view/page predicate that binds \`data.\` never matches and the element renders unconditionally (ADR-0089).`,
-      hint: `Runtime record surfaces bind \`record\` + \`current_user\` (pages also expose \`page.<var>\`). Use e.g. \`record.status == 'open'\` instead of \`data.status == 'open'\`.`
+      message: rule.message,
+      hint: rule.hint
     });
   }
 }
 function isFieldObject(entry) {
   return !!entry && typeof entry === "object" && !Array.isArray(entry);
 }
-function validateVisibilityPredicates(stack) {
+function validateVisibilityPredicates(stack, opts = {}) {
+  const layer = opts.layer ?? "runtime";
   const findings = [];
   const views = asArray12(stack.views);
   for (let i = 0; i < views.length; i++) {
@@ -1340,12 +1354,12 @@ function validateVisibilityPredicates(stack) {
         const sec = sections[s];
         if (!sec || typeof sec !== "object") continue;
         const secPath = `views[${i}].${bucket}[${s}]`;
-        checkElement(sec, where, secPath, findings);
+        checkElement(sec, where, secPath, layer, findings);
         const secFields = Array.isArray(sec.fields) ? sec.fields : [];
         for (let f = 0; f < secFields.length; f++) {
           const entry = secFields[f];
           if (isFieldObject(entry)) {
-            checkElement(entry, where, `${secPath}.fields[${f}]`, findings);
+            checkElement(entry, where, `${secPath}.fields[${f}]`, layer, findings);
           }
         }
       }
@@ -1364,7 +1378,7 @@ function validateVisibilityPredicates(stack) {
       for (let c = 0; c < components.length; c++) {
         const comp = components[c];
         if (comp && typeof comp === "object") {
-          checkElement(comp, where, `pages[${i}].regions[${r}].components[${c}]`, findings);
+          checkElement(comp, where, `pages[${i}].regions[${r}].components[${c}]`, layer, findings);
         }
       }
     }
@@ -1400,6 +1414,9 @@ function validateCapabilityReferences(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const known = new Set(import_security.PLATFORM_CAPABILITY_NAMES);
+  for (const cap of asArray13(stack.capabilities)) {
+    if (typeof cap.name === "string" && cap.name.length > 0) known.add(cap.name);
+  }
   for (const ps of asArray13(stack.permissions)) {
     for (const cap of asCapArray(ps.systemPermissions)) known.add(cap);
   }
@@ -1410,7 +1427,7 @@ function validateCapabilityReferences(stack) {
       if (typeof name === "string" && name.length > 0) known.add(name);
     }
   }
-  const hint = "Fix the capability name, declare it on a permission set\u2019s systemPermissions, ship a sys_capability seed row, or ignore this if the capability is provided by another installed package (references fail closed at runtime).";
+  const hint = "Fix the capability name, define it with defineCapability (stack.capabilities), declare it on a permission set\u2019s systemPermissions, ship a sys_capability seed row, or ignore this if the capability is provided by another installed package (references fail closed at runtime).";
   const flag = (cap, where, path) => {
     if (known.has(cap)) return;
     findings.push({