@objectstack/lint 16.0.0 → 16.1.0

package/dist/index.d.ts

@@ -33,6 +33,16 @@ import { AccessMatrix } from '@objectstack/spec/security';
  *   renders nothing. Errored (not warned) so this class of authoring mistake —
  *   very often an AI emitting a removed shape — fails the build instead of
  *   shipping a blank widget past human review.
+ * - `dashboard-filter-field-unknown` (#3365) — a dashboard-level filter
+ *   (`dateRange` or a `globalFilters[]` entry) is wired into EVERY widget's
+ *   analytics query (#2501), but its EFFECTIVE field (after any `filterBindings`
+ *   re-target) does not exist on a bound widget's dataset object. The widget's
+ *   query then references a non-existent column and crashes at render time
+ *   (`no such column …`) — a build-decidable invariant that previously escaped
+ *   the static gate and failed only when a user opened the dashboard. A widget
+ *   opts out with `filterBindings: { <name>: false }` or re-targets to a real
+ *   field. This is the same field-existence invariant ADR-0032 enforces for
+ *   CEL formula / sharing-rule references, applied to dashboard filter fields.
  *
  * Advisory rules — severity `warning`, build stays green:
  *
@@ -68,6 +78,7 @@ declare const CHART_FIELD_UNKNOWN = "chart-field-unknown";
 declare const CHART_CONFIG_MISSING = "chart-config-missing";
 declare const TABLE_COUNT_ONLY = "table-count-only";
 declare const MEASURE_AGGREGATE_INCOHERENT = "measure-aggregate-incoherent";
+declare const DASHBOARD_FILTER_FIELD_UNKNOWN = "dashboard-filter-field-unknown";
 type WidgetBindingSeverity = 'error' | 'warning';
 interface WidgetBindingFinding {
     /** `error` = unresolvable binding (broken page); `warning` = advisory. */
@@ -83,7 +94,7 @@ interface WidgetBindingFinding {
     /** How to fix (or deliberately suppress) it. */
     hint: string;
 }
-type AnyRec$g = Record<string, unknown>;
+type AnyRec$h = Record<string, unknown>;
 /**
  * Validate every dashboard widget's dataset binding. Returns the list of
  * findings (empty = clean). Caller decides how to surface them: `error`
@@ -91,7 +102,7 @@ type AnyRec$g = Record<string, unknown>;
  * should fail validate/build; `warning` findings are advisory and must
  * never fail the build on their own.
  */
-declare function validateWidgetBindings(stack: AnyRec$g): WidgetBindingFinding[];
+declare function validateWidgetBindings(stack: AnyRec$h): WidgetBindingFinding[];
 
 interface ExprIssue {
     where: string;
@@ -104,12 +115,12 @@ interface ExprIssue {
      */
     severity?: 'error' | 'warning';
 }
-type AnyRec$f = Record<string, unknown>;
+type AnyRec$g = Record<string, unknown>;
 /**
  * Validate every predicate in the stack. Returns the list of issues (empty =
  * clean). Caller decides how to surface / whether to fail the build.
  */
-declare function validateStackExpressions(stack: AnyRec$f): ExprIssue[];
+declare function validateStackExpressions(stack: AnyRec$g): ExprIssue[];
 
 type ListViewModeSeverity = 'error' | 'warning';
 interface ListViewModeFinding {
@@ -123,7 +134,7 @@ interface ListViewModeFinding {
     hint: string;
 }
 declare const LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-type AnyRec$e = Record<string, unknown>;
+type AnyRec$f = Record<string, unknown>;
 /**
  * Flag ADR-0047 "views" mode violations on an object's built-in named views or a
  * `defineView` default `list` / named `listViews`: `quickFilters`, or a `tabs`
@@ -133,7 +144,7 @@ type AnyRec$e = Record<string, unknown>;
  *
  * Feed the PRE-parse stack (normalizeStackInput output) — see file header.
  */
-declare function validateListViewMode(stack: AnyRec$e): ListViewModeFinding[];
+declare function validateListViewMode(stack: AnyRec$f): ListViewModeFinding[];
 
 type FlowTriggerReadinessSeverity = 'error' | 'warning';
 interface FlowTriggerReadinessFinding {
@@ -148,12 +159,12 @@ interface FlowTriggerReadinessFinding {
 }
 declare const FLOW_TRIGGER_UNKNOWN_OBJECT = "flow-trigger-unknown-object";
 declare const FLOW_DRAFT_STATUS_AMBIGUOUS = "flow-draft-status-ambiguous";
-type AnyRec$d = Record<string, unknown>;
+type AnyRec$e = Record<string, unknown>;
 /**
  * Validate auto-launched flow trigger wiring against the stack definition.
  * Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateFlowTriggerReadiness(stack: AnyRec$d): FlowTriggerReadinessFinding[];
+declare function validateFlowTriggerReadiness(stack: AnyRec$e): FlowTriggerReadinessFinding[];
 
 type ViewContainerSeverity = 'error' | 'warning';
 interface ViewContainerFinding {
@@ -190,14 +201,14 @@ declare const STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
 declare const STYLE_RESPONSIVE_NO_BASE = "style-responsive-no-base";
 declare const STYLE_UNKNOWN_CSS_PROPERTY = "style-unknown-css-property";
 declare const STYLE_UNKNOWN_TOKEN = "style-unknown-token";
-type AnyRec$c = Record<string, unknown>;
+type AnyRec$d = Record<string, unknown>;
 /**
  * Validate every page's component tree for SDUI styling correctness (ADR-0065).
  * Returns findings (empty = clean). `error` findings describe styles that are
  * silently dropped and should fail validate/build; `warning` findings are
  * advisory (typos, drift, footguns).
  */
-declare function validateResponsiveStyles(stack: AnyRec$c): StyleFinding[];
+declare function validateResponsiveStyles(stack: AnyRec$d): StyleFinding[];
 
 type JsxPageSeverity = 'error' | 'warning';
 interface JsxPageFinding {
@@ -210,8 +221,8 @@ interface JsxPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$b = Record<string, unknown>;
-declare function validateJsxPages(stack: AnyRec$b, opts?: {
+type AnyRec$c = Record<string, unknown>;
+declare function validateJsxPages(stack: AnyRec$c, opts?: {
     manifest?: Manifest;
 }): JsxPageFinding[];
 
@@ -224,8 +235,8 @@ interface ReactPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$a = Record<string, unknown>;
-declare function validateReactPages(stack: AnyRec$a): ReactPageFinding[];
+type AnyRec$b = Record<string, unknown>;
+declare function validateReactPages(stack: AnyRec$b): ReactPageFinding[];
 
 type ReactPropSeverity = 'error' | 'warning';
 interface ReactPropFinding {
@@ -236,8 +247,8 @@ interface ReactPropFinding {
     message: string;
     hint: string;
 }
-type AnyRec$9 = Record<string, unknown>;
-declare function validateReactPageProps(stack: AnyRec$9): ReactPropFinding[];
+type AnyRec$a = Record<string, unknown>;
+declare function validateReactPageProps(stack: AnyRec$a): ReactPropFinding[];
 
 type SourceStyleSeverity = 'error' | 'warning';
 interface SourceStyleFinding {
@@ -249,8 +260,8 @@ interface SourceStyleFinding {
     hint: string;
 }
 declare const PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-type AnyRec$8 = Record<string, unknown>;
-declare function validatePageSourceStyling(stack: AnyRec$8): SourceStyleFinding[];
+type AnyRec$9 = Record<string, unknown>;
+declare function validatePageSourceStyling(stack: AnyRec$9): SourceStyleFinding[];
 
 /**
  * Build-time record-title diagnostics (ADR-0079).
@@ -294,14 +305,14 @@ interface RecordTitleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$7 = Record<string, unknown>;
+type AnyRec$8 = Record<string, unknown>;
 /**
  * Validate every object's record-title declaration. Returns the list of
  * findings (empty = clean). Both rules are advisory (`warning`): the caller
  * must never fail the build on them alone — auto-provision + the `Record #<id>`
  * floor guarantee a resolvable title at runtime.
  */
-declare function validateRecordTitle(stack: AnyRec$7): RecordTitleFinding[];
+declare function validateRecordTitle(stack: AnyRec$8): RecordTitleFinding[];
 
 /**
  * Build-time semantic-role diagnostics (ADR-0085).
@@ -338,13 +349,13 @@ interface SemanticRoleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$6 = Record<string, unknown>;
+type AnyRec$7 = Record<string, unknown>;
 /**
  * Validate every object's semantic-role pointers. Returns the list of
  * findings (empty = clean). Advisory only — the caller must never fail the
  * build on these alone.
  */
-declare function validateSemanticRoles(stack: AnyRec$6): SemanticRoleFinding[];
+declare function validateSemanticRoles(stack: AnyRec$7): SemanticRoleFinding[];
 
 /**
  * Build-time form-layout diagnostics (#2578).
@@ -387,12 +398,12 @@ interface FormLayoutFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$5 = Record<string, unknown>;
+type AnyRec$6 = Record<string, unknown>;
 /**
  * Validate authored form-view layout. Returns findings (empty = clean).
  * Advisory only — the caller must never fail the build on these alone.
  */
-declare function validateFormLayout(stack: AnyRec$5): FormLayoutFinding[];
+declare function validateFormLayout(stack: AnyRec$6): FormLayoutFinding[];
 
 /**
  * Build-time conditional-visibility diagnostics (ADR-0089 D3b).
@@ -454,7 +465,7 @@ interface VisibilityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$4 = Record<string, unknown>;
+type AnyRec$5 = Record<string, unknown>;
 /**
  * Validate conditional-visibility keys across authored views and pages.
  *
@@ -469,7 +480,7 @@ type AnyRec$4 = Record<string, unknown>;
  * `*.view.ts` / `*.page.ts` surfaces (so a `data.`-rooted predicate is flagged). The
  * alias-deprecated check is layer-agnostic.
  */
-declare function validateVisibilityPredicates(stack: AnyRec$4, opts?: VisibilityOptions): VisibilityFinding[];
+declare function validateVisibilityPredicates(stack: AnyRec$5, opts?: VisibilityOptions): VisibilityFinding[];
 
 declare const CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
 type CapabilityRefSeverity = 'error' | 'warning';
@@ -487,12 +498,12 @@ interface CapabilityRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$3 = Record<string, unknown>;
+type AnyRec$4 = Record<string, unknown>;
 /**
  * Validate every capability reference in a stack. Returns findings (empty =
  * clean). Advisory only — callers must not fail the build on these alone.
  */
-declare function validateCapabilityReferences(stack: AnyRec$3): CapabilityRefFinding[];
+declare function validateCapabilityReferences(stack: AnyRec$4): CapabilityRefFinding[];
 
 declare const APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 declare const APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
@@ -512,12 +523,12 @@ interface ApprovalApproverFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$2 = Record<string, unknown>;
+type AnyRec$3 = Record<string, unknown>;
 /**
  * Validate the approvers of every Approval node in the stack's flows.
  * Returns findings (empty = clean).
  */
-declare function validateApprovalApprovers(stack: AnyRec$2): ApprovalApproverFinding[];
+declare function validateApprovalApprovers(stack: AnyRec$3): ApprovalApproverFinding[];
 
 declare const SECURITY_OWD_UNSET = "security-owd-unset";
 declare const SECURITY_OWD_ALIAS = "security-owd-alias";
@@ -544,7 +555,7 @@ interface SecurityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$1 = Record<string, unknown>;
+type AnyRec$2 = Record<string, unknown>;
 /**
  * Validate the security posture of a stack. Returns findings (empty = clean).
  * `error` findings gate the build in `os compile`; `info` is advisory.
@@ -552,10 +563,90 @@ type AnyRec$1 = Record<string, unknown>;
  * `opts.nowMs` injects the clock for the ADR-0091 authoring-time expiry rule
  * (tests); production callers omit it.
  */
-declare function validateSecurityPosture(stack: AnyRec$1, opts?: {
+declare function validateSecurityPosture(stack: AnyRec$2, opts?: {
     nowMs?: number;
 }): SecurityFinding[];
 
+/**
+ * [ADR-0049 — references] Reference-integrity for dashboard header & widget
+ * action targets (issue #3367).
+ *
+ * ADR-0049 established the "enforce-or-remove" gate for spec *properties*: a
+ * declared property the runtime does not honour is a false promise and must be
+ * enforced, marked experimental, or removed. This rule applies the SAME honesty
+ * principle to *references*. A dashboard header action (or a widget's header
+ * action button) names a target — a `script`/`modal` action, or a `url` route —
+ * that must actually resolve. A dangling target ships a button that renders and,
+ * on click, silently does nothing: a false affordance, exactly the failure
+ * ADR-0049 exists to prevent, just for a reference rather than a property.
+ *
+ * Nothing in the protocol schema can express this: `actionUrl` is a free string,
+ * so `{ actionType: 'script', actionUrl: 'export_dashboard_pdf' }` parses and
+ * ships even when no such action is defined anywhere in the stack.
+ *
+ * Surfaces checked:
+ *   - dashboard `header.actions[]` — each `{ actionType, actionUrl }`
+ *   - dashboard `widgets[].actionUrl` (+ `actionType`) — the per-widget button
+ *
+ * Resolution mirrors the objectui runtime dispatch (`DashboardRenderer` +
+ * `DashboardView`) so the lint flags exactly what would fail to resolve at
+ * runtime:
+ *
+ *   actionType 'script' → `actionUrl` must name a DEFINED action (`stack.actions`
+ *       or any `object.actions`, by `name`). A script target that names no
+ *       defined action fails open at runtime ("action not found"). → ERROR.
+ *
+ *   actionType 'modal'  → `actionUrl` resolves if it names a defined action, OR
+ *       matches the runtime `<verb>_<object>` convention the modalHandler
+ *       implements (create_/new_/add_/edit_/update_ + a defined object), OR is a
+ *       bare defined object name (the handler falls back to that object's create
+ *       form). Otherwise → ERROR.
+ *
+ *   actionType 'url'    → a relative in-app path. WARN when a recognizable
+ *       `<collection>/<name>` segment (objects/reports/dashboards/pages/views)
+ *       names an entity that does not exist in this stack. External URLs
+ *       (`http(s)://`, `//`), interpolated targets (`${…}`), and opaque routes
+ *       (no recognized collection segment) are skipped — they cannot be resolved
+ *       statically and may be host/app/plugin routes. → WARNING.
+ *
+ *   actionType 'flow' | 'api' — not checked: flow targets resolve against the
+ *       automation engine / other packages, and api targets are opaque endpoints.
+ *       Out of scope for #3367.
+ *
+ * Severity split follows the issue's acceptance criteria: an undefined
+ * `script`/`modal` target FAILS validation (a genuine dead reference that fails
+ * open at runtime as a dead button); an unresolved `url` route is advisory
+ * (route resolution is app-context-dependent, and a path may be served by
+ * another installed package or a host/console route). External, interpolated,
+ * convention, and opaque targets are exempted to keep false positives near zero
+ * — the same conservative posture as the sibling `lint-view-refs` and
+ * `validate-capability-references` rules.
+ */
+declare const DASHBOARD_ACTION_TARGET_UNDEFINED = "dashboard-action-target-undefined";
+declare const DASHBOARD_ACTION_ROUTE_UNRESOLVED = "dashboard-action-route-unresolved";
+type DashboardActionRefSeverity = 'error' | 'warning';
+interface DashboardActionRefFinding {
+    /** `error` for a dangling script/modal action; `warning` for an unresolved url route. */
+    severity: DashboardActionRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `dashboard "sales_overview" · header action "Export PDF"`. */
+    where: string;
+    /** Config path, e.g. `dashboards[2].header.actions[0].actionUrl`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$1 = Record<string, unknown>;
+/**
+ * Validate every dashboard header / widget action reference in a stack. Returns
+ * findings (empty = clean). `script`/`modal` dead targets are errors; `url`
+ * unresolved routes are warnings.
+ */
+declare function validateDashboardActionRefs(stack: AnyRec$1): DashboardActionRefFinding[];
+
 /**
  * [ADR-0090 D6] Access-matrix snapshot — authoring-time companion to the
  * runtime explain engine.
@@ -580,4 +671,4 @@ declare function buildAccessMatrix(stack: AnyRec): AccessMatrix;
  */
 declare function diffAccessMatrix(before: AccessMatrix, after: AccessMatrix): string[];
 
-export { APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, type ApprovalApproverFinding, type ApprovalApproverSeverity, CAPABILITY_REFERENCE_UNKNOWN, CHART_CONFIG_MISSING, CHART_FIELD_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ExprIssue, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_TRIGGER_UNKNOWN_OBJECT, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FormLayoutFinding, type FormLayoutSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, type ListViewModeFinding, type ListViewModeSeverity, MEASURE_AGGREGATE_INCOHERENT, PAGE_SOURCE_CLASSNAME, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type RecordTitleFinding, type RecordTitleSeverity, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SecurityFinding, type SecuritySeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, VIEW_CONTAINER_SHAPE, VISIBILITY_ALIAS_DEPRECATED, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, validateApprovalApprovers, validateCapabilityReferences, validateFlowTriggerReadiness, validateFormLayout, validateJsxPages, validateListViewMode, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateRecordTitle, validateResponsiveStyles, validateSecurityPosture, validateSemanticRoles, validateStackExpressions, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings };
+export { APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, type ApprovalApproverFinding, type ApprovalApproverSeverity, CAPABILITY_REFERENCE_UNKNOWN, CHART_CONFIG_MISSING, CHART_FIELD_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, type DashboardActionRefFinding, type DashboardActionRefSeverity, type ExprIssue, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_TRIGGER_UNKNOWN_OBJECT, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FormLayoutFinding, type FormLayoutSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, type ListViewModeFinding, type ListViewModeSeverity, MEASURE_AGGREGATE_INCOHERENT, PAGE_SOURCE_CLASSNAME, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type RecordTitleFinding, type RecordTitleSeverity, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SecurityFinding, type SecuritySeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, VIEW_CONTAINER_SHAPE, VISIBILITY_ALIAS_DEPRECATED, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, validateApprovalApprovers, validateCapabilityReferences, validateDashboardActionRefs, validateFlowTriggerReadiness, validateFormLayout, validateJsxPages, validateListViewMode, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateRecordTitle, validateResponsiveStyles, validateSecurityPosture, validateSemanticRoles, validateStackExpressions, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings };

package/dist/index.js

@@ -9,6 +9,7 @@ var TABLE_COUNT_ONLY = "table-count-only";
 var MEASURE_AGGREGATE_INCOHERENT = "measure-aggregate-incoherent";
 var WIDGET_LEGACY_ANALYTICS_SHAPE = "widget-legacy-analytics-shape";
 var WIDGET_LEGACY_ANALYTICS_UNRENDERABLE = "widget-legacy-analytics-unrenderable";
+var DASHBOARD_FILTER_FIELD_UNKNOWN = "dashboard-filter-field-unknown";
 var LEGACY_ANALYTICS_KEYS = [
   "categoryField",
   "valueField",
@@ -86,6 +87,47 @@ function list(names) {
   const arr = [...names];
   return arr.length > 0 ? arr.join(", ") : "(none)";
 }
+var DATE_RANGE_FILTER_NAME = "dateRange";
+var DATE_RANGE_DEFAULT_FIELD = "created_at";
+var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
+  "id",
+  "created_at",
+  "created_by",
+  "updated_at",
+  "updated_by",
+  "owner_id",
+  "organization_id",
+  "tenant_id",
+  "user_id",
+  "deleted_at"
+]);
+function dashboardFilterDefs(dash) {
+  const byName = /* @__PURE__ */ new Map();
+  const dateRange = dash.dateRange;
+  if (dateRange && typeof dateRange === "object") {
+    const declared = dateRange.field;
+    const field = typeof declared === "string" && declared ? declared : DATE_RANGE_DEFAULT_FIELD;
+    byName.set(DATE_RANGE_FILTER_NAME, { name: DATE_RANGE_FILTER_NAME, field });
+  }
+  for (const f of asArray(dash.globalFilters)) {
+    if (typeof f.field !== "string" || !f.field) continue;
+    const name = typeof f.name === "string" && f.name ? f.name : f.field;
+    const targetWidgets = Array.isArray(f.targetWidgets) ? f.targetWidgets.filter((w) => typeof w === "string") : void 0;
+    byName.set(name, { name, field: f.field, targetWidgets });
+  }
+  return [...byName.values()];
+}
+function effectiveFilterField(widget, def) {
+  const bindings = widget.filterBindings;
+  const binding = bindings && typeof bindings === "object" ? bindings[def.name] : void 0;
+  if (binding === false) return void 0;
+  if (typeof binding === "string" && binding) return { field: binding, explicit: true };
+  if (def.targetWidgets && def.targetWidgets.length > 0) {
+    const id = typeof widget.id === "string" ? widget.id : void 0;
+    if (!id || !def.targetWidgets.includes(id)) return void 0;
+  }
+  return { field: def.field, explicit: false };
+}
 function validateWidgetBindings(stack) {
   const findings = [];
   const datasets = /* @__PURE__ */ new Map();
@@ -130,6 +172,7 @@ function validateWidgetBindings(stack) {
     const dash = dashboards[i];
     const dashName = typeof dash.name === "string" ? dash.name : `(dashboard ${i})`;
     const widgets = Array.isArray(dash.widgets) ? dash.widgets : [];
+    const dashFilterDefs = dashboardFilterDefs(dash);
     for (let j = 0; j < widgets.length; j++) {
       const w = widgets[j];
       const widgetId = typeof w.id === "string" ? w.id : `(widget ${j})`;
@@ -174,6 +217,25 @@ function validateWidgetBindings(stack) {
         });
       }
       if (!dataset) continue;
+      if (dashFilterDefs.length > 0) {
+        const datasetObject = typeof dataset.object === "string" ? dataset.object : void 0;
+        const objectFields = datasetObject ? objectFieldTypes.get(datasetObject) : void 0;
+        if (objectFields) {
+          for (const def of dashFilterDefs) {
+            const eff = effectiveFilterField(w, def);
+            if (!eff) continue;
+            const field = eff.field;
+            if (field.includes(".")) continue;
+            if (objectFields.has(field) || SYSTEM_FIELDS.has(field)) continue;
+            push({
+              severity: "error",
+              rule: DASHBOARD_FILTER_FIELD_UNKNOWN,
+              message: eff.explicit ? `binds dashboard filter \`${def.name}\` to field \`${field}\` (via filterBindings), but object \`${datasetObject}\` (dataset "${dsName}") has no field \`${field}\`.` : `inherits dashboard filter \`${def.name}(${field})\`, but object \`${datasetObject}\` (dataset "${dsName}") has no field \`${field}\`.`,
+              hint: eff.explicit ? `Point filterBindings: { ${def.name}: '<field>' } at a field that exists on \`${datasetObject}\`, or opt out with filterBindings: { ${def.name}: false }.${suggest(field, objectFields.keys())} Object fields: ${list(objectFields.keys())}.` : `Set filterBindings: { ${def.name}: false } on this widget to opt out, or re-target to an existing field with filterBindings: { ${def.name}: '<field>' }.${suggest(field, objectFields.keys())} Object fields: ${list(objectFields.keys())}.`
+            });
+          }
+        }
+      }
       const dimensionNames = /* @__PURE__ */ new Set();
       for (const d of asArray(dataset.dimensions)) {
         if (typeof d.name === "string") dimensionNames.add(d.name);
@@ -2032,7 +2094,9 @@ function validateSecurityPosture(stack, opts) {
   return findings;
 }
 
-// src/build-access-matrix.ts
+// src/validate-dashboard-action-refs.ts
+var DASHBOARD_ACTION_TARGET_UNDEFINED = "dashboard-action-target-undefined";
+var DASHBOARD_ACTION_ROUTE_UNRESOLVED = "dashboard-action-route-unresolved";
 function asArray17(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -2040,17 +2104,166 @@ function asArray17(v) {
   }
   return [];
 }
+function strName(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+var MODAL_VERB_RE = /^(?:create|new|add|edit|update)_(.+)$/;
+var URL_COLLECTION_TO_STACK_KEY = {
+  object: "objects",
+  objects: "objects",
+  report: "reports",
+  reports: "reports",
+  dashboard: "dashboards",
+  dashboards: "dashboards",
+  page: "pages",
+  pages: "pages",
+  view: "views",
+  views: "views"
+};
+function viewContainerName(item) {
+  return strName(item.name) ?? strName(item.id) ?? strName(item.object) ?? strName(item.list?.data && item.list.data.object) ?? strName(item.form?.data && item.form.data.object);
+}
+function collectKnownTargets(stack) {
+  const actions = /* @__PURE__ */ new Set();
+  const objects = /* @__PURE__ */ new Set();
+  const reports = /* @__PURE__ */ new Set();
+  const dashboards = /* @__PURE__ */ new Set();
+  const pages = /* @__PURE__ */ new Set();
+  const views = /* @__PURE__ */ new Set();
+  const collectNames = (v, into, name) => {
+    for (const item of asArray17(v)) {
+      if (!item || typeof item !== "object") continue;
+      const n = name(item);
+      if (n) into.add(n);
+    }
+  };
+  collectNames(stack.actions, actions, (a) => strName(a.name));
+  for (const obj of asArray17(stack.objects)) {
+    if (!obj || typeof obj !== "object") continue;
+    const n = strName(obj.name);
+    if (n) objects.add(n);
+    collectNames(obj.actions, actions, (a) => strName(a.name));
+  }
+  collectNames(stack.reports, reports, (r) => strName(r.name));
+  collectNames(stack.dashboards, dashboards, (d) => strName(d.name));
+  collectNames(stack.pages, pages, (p) => strName(p.name));
+  collectNames(stack.views, views, viewContainerName);
+  for (const o of objects) views.add(o);
+  return { actions, objects, reports, dashboards, pages, views };
+}
+function resolveActionTarget(actionType, target, known) {
+  if (known.actions.has(target)) return true;
+  if (actionType === "modal") {
+    if (known.objects.has(target)) return true;
+    const m = MODAL_VERB_RE.exec(target);
+    if (m && known.objects.has(m[1])) return true;
+  }
+  return false;
+}
+function resolveUrlRoute(target, known) {
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(target) || target.startsWith("//")) return null;
+  if (target.includes("${")) return null;
+  if (!target.startsWith("/")) return null;
+  const pathPart = target.split(/[?#]/, 1)[0];
+  const segments = pathPart.split("/").filter(Boolean);
+  for (let i = 0; i < segments.length - 1; i++) {
+    const stackKey = URL_COLLECTION_TO_STACK_KEY[segments[i]];
+    if (!stackKey) continue;
+    const name = segments[i + 1];
+    if (known[stackKey].has(name)) return void 0;
+    return { collection: segments[i], name };
+  }
+  return null;
+}
+function validateDashboardActionRefs(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const dashboards = asArray17(stack.dashboards);
+  if (dashboards.length === 0) return findings;
+  const known = collectKnownTargets(stack);
+  const checkOne = (action, where, path) => {
+    const target = strName(action.actionUrl);
+    if (!target) return;
+    if (target.includes("${")) return;
+    const actionType = strName(action.actionType) ?? "url";
+    if (actionType === "script" || actionType === "modal") {
+      if (resolveActionTarget(actionType, target, known)) return;
+      const kindWord = actionType === "script" ? "script" : "modal";
+      findings.push({
+        severity: "error",
+        rule: DASHBOARD_ACTION_TARGET_UNDEFINED,
+        where,
+        path,
+        message: `${kindWord} action target "${target}" resolves to no defined action` + (actionType === "modal" ? " or object" : "") + `. The button renders but does nothing when clicked \u2014 a dangling reference the runtime cannot dispatch (ADR-0049: a declared reference must resolve).`,
+        hint: actionType === "modal" ? `Define an action named "${target}" (stack.actions or the object's actions), use the "<verb>_<object>" convention against a real object (e.g. "create_<object>"), point actionUrl at an existing object, or remove the button.` : `Define a script action named "${target}" (stack.actions or the object's actions) with an inline body or a registered handler, or remove the button.`
+      });
+      return;
+    }
+    if (actionType === "url") {
+      const route = resolveUrlRoute(target, known);
+      if (!route) return;
+      findings.push({
+        severity: "warning",
+        rule: DASHBOARD_ACTION_ROUTE_UNRESOLVED,
+        where,
+        path,
+        message: `url action target "${target}" points at ${route.collection}/${route.name}, but no ${route.collection.replace(/s$/, "")} named "${route.name}" is registered in this stack \u2014 the button likely navigates to a dead route.`,
+        hint: `Check the path for a typo, define the referenced ${route.collection.replace(/s$/, "")}, or ignore this if the route is served by another installed package or a host/console route.`
+      });
+      return;
+    }
+  };
+  for (let di = 0; di < dashboards.length; di++) {
+    const dash = dashboards[di];
+    if (!dash || typeof dash !== "object") continue;
+    const dashName = strName(dash.name) ?? `(dashboard ${di})`;
+    const dashPath = `dashboards[${di}]`;
+    const headerActions = asArray17(dash.header?.actions);
+    for (let ai = 0; ai < headerActions.length; ai++) {
+      const action = headerActions[ai];
+      if (!action || typeof action !== "object") continue;
+      const label = strName(action.label) ?? strName(action.actionUrl) ?? `#${ai}`;
+      checkOne(
+        action,
+        `dashboard "${dashName}" \xB7 header action "${label}"`,
+        `${dashPath}.header.actions[${ai}].actionUrl`
+      );
+    }
+    const widgets = asArray17(dash.widgets);
+    for (let wi = 0; wi < widgets.length; wi++) {
+      const widget = widgets[wi];
+      if (!widget || typeof widget !== "object") continue;
+      if (!strName(widget.actionUrl)) continue;
+      const widgetId = strName(widget.id) ?? `#${wi}`;
+      checkOne(
+        { actionType: widget.actionType, actionUrl: widget.actionUrl },
+        `dashboard "${dashName}" \xB7 widget "${widgetId}" action`,
+        `${dashPath}.widgets[${wi}].actionUrl`
+      );
+    }
+  }
+  return findings;
+}
+
+// src/build-access-matrix.ts
+function asArray18(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
 function buildAccessMatrix(stack) {
   const entries = [];
   if (!stack || typeof stack !== "object") return { version: 1, entries };
   const owdByObject = /* @__PURE__ */ new Map();
-  for (const obj of asArray17(stack.objects)) {
+  for (const obj of asArray18(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : "";
     if (!name) continue;
     const owd = obj.sharingModel ?? obj.security?.sharingModel;
     if (typeof owd === "string") owdByObject.set(name, owd);
   }
-  for (const ps of asArray17(stack.permissions)) {
+  for (const ps of asArray18(stack.permissions)) {
     const psName = typeof ps.name === "string" ? ps.name : "";
     if (!psName) continue;
     const objects = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
@@ -2128,6 +2341,9 @@ export {
   CAPABILITY_REFERENCE_UNKNOWN,
   CHART_CONFIG_MISSING,
   CHART_FIELD_UNKNOWN,
+  DASHBOARD_ACTION_ROUTE_UNRESOLVED,
+  DASHBOARD_ACTION_TARGET_UNDEFINED,
+  DASHBOARD_FILTER_FIELD_UNKNOWN,
   FIELD_GROUP_EMPTY,
   FIELD_GROUP_UNDECLARED,
   FLOW_DRAFT_STATUS_AMBIGUOUS,
@@ -2167,6 +2383,7 @@ export {
   diffAccessMatrix,
   validateApprovalApprovers,
   validateCapabilityReferences,
+  validateDashboardActionRefs,
   validateFlowTriggerReadiness,
   validateFormLayout,
   validateJsxPages,