@objectstack/lint 16.0.0 → 17.0.0-rc.0

package/dist/index.d.cts

@@ -33,6 +33,16 @@ import { AccessMatrix } from '@objectstack/spec/security';
  *   renders nothing. Errored (not warned) so this class of authoring mistake —
  *   very often an AI emitting a removed shape — fails the build instead of
  *   shipping a blank widget past human review.
+ * - `dashboard-filter-field-unknown` (#3365) — a dashboard-level filter
+ *   (`dateRange` or a `globalFilters[]` entry) is wired into EVERY widget's
+ *   analytics query (#2501), but its EFFECTIVE field (after any `filterBindings`
+ *   re-target) does not exist on a bound widget's dataset object. The widget's
+ *   query then references a non-existent column and crashes at render time
+ *   (`no such column …`) — a build-decidable invariant that previously escaped
+ *   the static gate and failed only when a user opened the dashboard. A widget
+ *   opts out with `filterBindings: { <name>: false }` or re-targets to a real
+ *   field. This is the same field-existence invariant ADR-0032 enforces for
+ *   CEL formula / sharing-rule references, applied to dashboard filter fields.
  *
  * Advisory rules — severity `warning`, build stays green:
  *
@@ -68,6 +78,7 @@ declare const CHART_FIELD_UNKNOWN = "chart-field-unknown";
 declare const CHART_CONFIG_MISSING = "chart-config-missing";
 declare const TABLE_COUNT_ONLY = "table-count-only";
 declare const MEASURE_AGGREGATE_INCOHERENT = "measure-aggregate-incoherent";
+declare const DASHBOARD_FILTER_FIELD_UNKNOWN = "dashboard-filter-field-unknown";
 type WidgetBindingSeverity = 'error' | 'warning';
 interface WidgetBindingFinding {
     /** `error` = unresolvable binding (broken page); `warning` = advisory. */
@@ -83,7 +94,7 @@ interface WidgetBindingFinding {
     /** How to fix (or deliberately suppress) it. */
     hint: string;
 }
-type AnyRec$g = Record<string, unknown>;
+type AnyRec$t = Record<string, unknown>;
 /**
  * Validate every dashboard widget's dataset binding. Returns the list of
  * findings (empty = clean). Caller decides how to surface them: `error`
@@ -91,7 +102,7 @@ type AnyRec$g = Record<string, unknown>;
  * should fail validate/build; `warning` findings are advisory and must
  * never fail the build on their own.
  */
-declare function validateWidgetBindings(stack: AnyRec$g): WidgetBindingFinding[];
+declare function validateWidgetBindings(stack: AnyRec$t): WidgetBindingFinding[];
 
 interface ExprIssue {
     where: string;
@@ -104,12 +115,12 @@ interface ExprIssue {
      */
     severity?: 'error' | 'warning';
 }
-type AnyRec$f = Record<string, unknown>;
+type AnyRec$s = Record<string, unknown>;
 /**
  * Validate every predicate in the stack. Returns the list of issues (empty =
  * clean). Caller decides how to surface / whether to fail the build.
  */
-declare function validateStackExpressions(stack: AnyRec$f): ExprIssue[];
+declare function validateStackExpressions(stack: AnyRec$s): ExprIssue[];
 
 type ListViewModeSeverity = 'error' | 'warning';
 interface ListViewModeFinding {
@@ -123,7 +134,7 @@ interface ListViewModeFinding {
     hint: string;
 }
 declare const LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-type AnyRec$e = Record<string, unknown>;
+type AnyRec$r = Record<string, unknown>;
 /**
  * Flag ADR-0047 "views" mode violations on an object's built-in named views or a
  * `defineView` default `list` / named `listViews`: `quickFilters`, or a `tabs`
@@ -133,7 +144,7 @@ type AnyRec$e = Record<string, unknown>;
  *
  * Feed the PRE-parse stack (normalizeStackInput output) — see file header.
  */
-declare function validateListViewMode(stack: AnyRec$e): ListViewModeFinding[];
+declare function validateListViewMode(stack: AnyRec$r): ListViewModeFinding[];
 
 type FlowTriggerReadinessSeverity = 'error' | 'warning';
 interface FlowTriggerReadinessFinding {
@@ -148,12 +159,52 @@ interface FlowTriggerReadinessFinding {
 }
 declare const FLOW_TRIGGER_UNKNOWN_OBJECT = "flow-trigger-unknown-object";
 declare const FLOW_DRAFT_STATUS_AMBIGUOUS = "flow-draft-status-ambiguous";
-type AnyRec$d = Record<string, unknown>;
+type AnyRec$q = Record<string, unknown>;
 /**
  * Validate auto-launched flow trigger wiring against the stack definition.
  * Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateFlowTriggerReadiness(stack: AnyRec$d): FlowTriggerReadinessFinding[];
+declare function validateFlowTriggerReadiness(stack: AnyRec$q): FlowTriggerReadinessFinding[];
+
+type FlowTemplatePathSeverity = 'error' | 'warning';
+interface FlowTemplatePathFinding {
+    severity: FlowTemplatePathSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `flow "notify_lead" node "notify"`. */
+    where: string;
+    /** Config path, e.g. `flows[0].nodes[2]`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
+declare const FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
+type AnyRec$p = Record<string, unknown>;
+/**
+ * Validate `{record.<path>}` template references across every record-change
+ * flow. Pure and dependency-free; safe on pre- or post-parse stacks.
+ */
+declare function validateFlowTemplatePaths(stack: AnyRec$p): FlowTemplatePathFinding[];
+
+type ReadonlyFlowWriteSeverity = 'error' | 'warning';
+interface ReadonlyFlowWriteFinding {
+    severity: ReadonlyFlowWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `flow "approve_deal" › node "Mark approved"`. */
+    where: string;
+    /** Config path, e.g. `flows[0].nodes[3].config.fields.approval_status`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
+declare const FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
+type AnyRec$o = Record<string, unknown>;
+/**
+ * Validate flow `update_record` writes against target-object readonly
+ * declarations. Pure and dependency-free; safe on pre- or post-parse stacks.
+ */
+declare function validateReadonlyFlowWrites(stack: AnyRec$o): ReadonlyFlowWriteFinding[];
 
 type ViewContainerSeverity = 'error' | 'warning';
 interface ViewContainerFinding {
@@ -190,14 +241,14 @@ declare const STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
 declare const STYLE_RESPONSIVE_NO_BASE = "style-responsive-no-base";
 declare const STYLE_UNKNOWN_CSS_PROPERTY = "style-unknown-css-property";
 declare const STYLE_UNKNOWN_TOKEN = "style-unknown-token";
-type AnyRec$c = Record<string, unknown>;
+type AnyRec$n = Record<string, unknown>;
 /**
  * Validate every page's component tree for SDUI styling correctness (ADR-0065).
  * Returns findings (empty = clean). `error` findings describe styles that are
  * silently dropped and should fail validate/build; `warning` findings are
  * advisory (typos, drift, footguns).
  */
-declare function validateResponsiveStyles(stack: AnyRec$c): StyleFinding[];
+declare function validateResponsiveStyles(stack: AnyRec$n): StyleFinding[];
 
 type JsxPageSeverity = 'error' | 'warning';
 interface JsxPageFinding {
@@ -210,8 +261,8 @@ interface JsxPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$b = Record<string, unknown>;
-declare function validateJsxPages(stack: AnyRec$b, opts?: {
+type AnyRec$m = Record<string, unknown>;
+declare function validateJsxPages(stack: AnyRec$m, opts?: {
     manifest?: Manifest;
 }): JsxPageFinding[];
 
@@ -224,8 +275,8 @@ interface ReactPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$a = Record<string, unknown>;
-declare function validateReactPages(stack: AnyRec$a): ReactPageFinding[];
+type AnyRec$l = Record<string, unknown>;
+declare function validateReactPages(stack: AnyRec$l): ReactPageFinding[];
 
 type ReactPropSeverity = 'error' | 'warning';
 interface ReactPropFinding {
@@ -236,8 +287,11 @@ interface ReactPropFinding {
     message: string;
     hint: string;
 }
-type AnyRec$9 = Record<string, unknown>;
-declare function validateReactPageProps(stack: AnyRec$9): ReactPropFinding[];
+type AnyRec$k = Record<string, unknown>;
+declare const REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
+declare const REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
+declare const REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
+declare function validateReactPageProps(stack: AnyRec$k): ReactPropFinding[];
 
 type SourceStyleSeverity = 'error' | 'warning';
 interface SourceStyleFinding {
@@ -249,8 +303,8 @@ interface SourceStyleFinding {
     hint: string;
 }
 declare const PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-type AnyRec$8 = Record<string, unknown>;
-declare function validatePageSourceStyling(stack: AnyRec$8): SourceStyleFinding[];
+type AnyRec$j = Record<string, unknown>;
+declare function validatePageSourceStyling(stack: AnyRec$j): SourceStyleFinding[];
 
 /**
  * Build-time record-title diagnostics (ADR-0079).
@@ -294,14 +348,14 @@ interface RecordTitleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$7 = Record<string, unknown>;
+type AnyRec$i = Record<string, unknown>;
 /**
  * Validate every object's record-title declaration. Returns the list of
  * findings (empty = clean). Both rules are advisory (`warning`): the caller
  * must never fail the build on them alone — auto-provision + the `Record #<id>`
  * floor guarantee a resolvable title at runtime.
  */
-declare function validateRecordTitle(stack: AnyRec$7): RecordTitleFinding[];
+declare function validateRecordTitle(stack: AnyRec$i): RecordTitleFinding[];
 
 /**
  * Build-time semantic-role diagnostics (ADR-0085).
@@ -338,13 +392,13 @@ interface SemanticRoleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$6 = Record<string, unknown>;
+type AnyRec$h = Record<string, unknown>;
 /**
  * Validate every object's semantic-role pointers. Returns the list of
  * findings (empty = clean). Advisory only — the caller must never fail the
  * build on these alone.
  */
-declare function validateSemanticRoles(stack: AnyRec$6): SemanticRoleFinding[];
+declare function validateSemanticRoles(stack: AnyRec$h): SemanticRoleFinding[];
 
 /**
  * Build-time form-layout diagnostics (#2578).
@@ -387,12 +441,12 @@ interface FormLayoutFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$5 = Record<string, unknown>;
+type AnyRec$g = Record<string, unknown>;
 /**
  * Validate authored form-view layout. Returns findings (empty = clean).
  * Advisory only — the caller must never fail the build on these alone.
  */
-declare function validateFormLayout(stack: AnyRec$5): FormLayoutFinding[];
+declare function validateFormLayout(stack: AnyRec$g): FormLayoutFinding[];
 
 /**
  * Build-time conditional-visibility diagnostics (ADR-0089 D3b).
@@ -454,7 +508,7 @@ interface VisibilityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$4 = Record<string, unknown>;
+type AnyRec$f = Record<string, unknown>;
 /**
  * Validate conditional-visibility keys across authored views and pages.
  *
@@ -469,7 +523,7 @@ type AnyRec$4 = Record<string, unknown>;
  * `*.view.ts` / `*.page.ts` surfaces (so a `data.`-rooted predicate is flagged). The
  * alias-deprecated check is layer-agnostic.
  */
-declare function validateVisibilityPredicates(stack: AnyRec$4, opts?: VisibilityOptions): VisibilityFinding[];
+declare function validateVisibilityPredicates(stack: AnyRec$f, opts?: VisibilityOptions): VisibilityFinding[];
 
 declare const CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
 type CapabilityRefSeverity = 'error' | 'warning';
@@ -487,17 +541,22 @@ interface CapabilityRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$3 = Record<string, unknown>;
+type AnyRec$e = Record<string, unknown>;
 /**
  * Validate every capability reference in a stack. Returns findings (empty =
  * clean). Advisory only — callers must not fail the build on these alone.
  */
-declare function validateCapabilityReferences(stack: AnyRec$3): CapabilityRefFinding[];
+declare function validateCapabilityReferences(stack: AnyRec$e): CapabilityRefFinding[];
 
 declare const APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 declare const APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
 declare const APPROVAL_APPROVER_TYPE_UNKNOWN = "approval-approver-type-unknown";
 declare const APPROVAL_ESCALATION_REASSIGN_NO_TARGET = "approval-escalation-reassign-no-target";
+declare const APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY = "approval-approvers-may-resolve-empty";
+declare const APPROVAL_EXPRESSION_INVALID = "approval-expression-invalid";
+declare const APPROVAL_EXPRESSION_NO_EMPTY_POLICY = "approval-expression-no-empty-policy";
+declare const APPROVAL_DECISION_OUTPUTS_RESERVED = "approval-decision-outputs-reserved";
+declare const APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED = "approval-approver-cross-org-unsupported";
 type ApprovalApproverSeverity = 'error' | 'warning' | 'info';
 interface ApprovalApproverFinding {
     severity: ApprovalApproverSeverity;
@@ -512,12 +571,63 @@ interface ApprovalApproverFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$2 = Record<string, unknown>;
+type AnyRec$d = Record<string, unknown>;
 /**
  * Validate the approvers of every Approval node in the stack's flows.
  * Returns findings (empty = clean).
  */
-declare function validateApprovalApprovers(stack: AnyRec$2): ApprovalApproverFinding[];
+declare function validateApprovalApprovers(stack: AnyRec$d): ApprovalApproverFinding[];
+
+type SeedReplaySafetySeverity = 'error' | 'warning';
+interface SeedReplaySafetyFinding {
+    severity: SeedReplaySafetySeverity;
+    rule: string;
+    /** Human-readable location, e.g. `seed "showcase_project_membership"`. */
+    where: string;
+    /** Config path, e.g. `data[12].mode`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const SEED_INSERT_MODE_DUPLICATES_ON_REPLAY = "seed-insert-mode-duplicates-on-replay";
+type AnyRec$c = Record<string, unknown>;
+/**
+ * Flag every seed dataset declared with `mode: 'insert'` — the one non-idempotent
+ * mode, which duplicates its rows on every replay boot (framework#3434). Returns
+ * the findings (empty = clean). The caller decides how to surface them / whether
+ * to fail the build; the CLI folds them in as advisory warnings.
+ *
+ * Reads `stack.data` (the `SeedSchema[]` fixtures). Safe on any shape — a stack
+ * with no `data` array yields no findings.
+ */
+declare function validateSeedReplaySafety(stack: AnyRec$c): SeedReplaySafetyFinding[];
+
+type SeedStateMachineSeverity = 'warning';
+interface SeedStateMachineFinding {
+    severity: SeedStateMachineSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `seed "showcase_project" ("Legacy Sunset")`. */
+    where: string;
+    /** Config path, e.g. `data[4].records[3].status`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const SEED_VALUE_OUTSIDE_STATE_MACHINE = "seed-value-outside-state-machine";
+type AnyRec$b = Record<string, unknown>;
+/**
+ * Flag every seed record whose `state_machine`-governed field carries a value
+ * the machine does not declare (framework#3433 follow-up). Returns the findings
+ * (empty = clean). The caller decides how to surface them; the CLI folds them in
+ * as advisory warnings.
+ *
+ * Reads `stack.objects` (for the state-machine rules) and `stack.data` (the
+ * `SeedSchema[]` fixtures). Safe on any shape — a stack with no objects or no
+ * `data` array yields no findings. A value that is not a plain string (an
+ * unresolved `cel` Expression envelope, a number) is skipped: it cannot be
+ * statically compared to the declared-state set.
+ */
+declare function validateSeedStateMachine(stack: AnyRec$b): SeedStateMachineFinding[];
 
 declare const SECURITY_OWD_UNSET = "security-owd-unset";
 declare const SECURITY_OWD_ALIAS = "security-owd-alias";
@@ -544,7 +654,7 @@ interface SecurityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$1 = Record<string, unknown>;
+type AnyRec$a = Record<string, unknown>;
 /**
  * Validate the security posture of a stack. Returns findings (empty = clean).
  * `error` findings gate the build in `os compile`; `info` is advisory.
@@ -552,10 +662,622 @@ type AnyRec$1 = Record<string, unknown>;
  * `opts.nowMs` injects the clock for the ADR-0091 authoring-time expiry rule
  * (tests); production callers omit it.
  */
-declare function validateSecurityPosture(stack: AnyRec$1, opts?: {
+declare function validateSecurityPosture(stack: AnyRec$a, opts?: {
     nowMs?: number;
 }): SecurityFinding[];
 
+/**
+ * [ADR-0105 D6] The two organization-axis red lines, enforced at authoring time.
+ *
+ * ADR-0105 gives organizations a reporting/grouping dimension
+ * (`sys_organization.parent_organization_id`, sibling ordering). That dimension
+ * is load-bearing for consolidated reporting — and dangerous, because it LOOKS
+ * like a permission hierarchy. Two lines keep it from becoming one:
+ *
+ * | Rule                                    | Red line                          |
+ * |-----------------------------------------|-----------------------------------|
+ * | org-axis-permission-inheritance (error) | D6 ①: no inheritance along the org tree |
+ * | org-axis-cross-org-bu-grant     (error) | D6 ②: business-unit trees stay org-internal |
+ *
+ * **① No permission inheritance along the org axis.** Cross-organization
+ * visibility comes from membership union (`accessible_org_ids`, ADR-0105 D2) —
+ * the engine's own Layer 0 wall — never from walking a parent reference. An RLS
+ * policy or sharing rule that reads `parent_organization_id` builds a SECOND
+ * permission hierarchy beside the business-unit tree: exactly the dual-hierarchy
+ * mistake ADR-0057 D5 retired and ADR-0090 D3 finalized for positions. It also
+ * silently outranks the wall it sits behind, since a Layer-1 policy cannot widen
+ * Layer 0 (W1) — so the author gets a rule that appears to grant access and
+ * does not. Fail at authoring, not in a support ticket.
+ *
+ * **② Business-unit trees remain org-internal.** `sys_business_unit` is
+ * org-scoped and every BU mechanism (`unit_and_subordinates` sharing,
+ * `adminScope` delegation, depth scopes) resolves within ONE organization. A
+ * business-unit sharing rule on a PLATFORM-GLOBAL object (`tenancy.enabled:
+ * false`) has no organization column to scope against, so the grant spans every
+ * organization in the database — a cross-org BU grant by construction, and the
+ * "cross-org BU mega-tree" the ADR rejected, arrived at by accident.
+ *
+ * Both are `error`, per ADR-0049 discipline: each mirrors a real enforcement
+ * property (the Layer 0 wall's independence; the org-predicated BU resolver),
+ * so the lint moves the failure from silent-wrong-answer to author-time fix-it.
+ *
+ * Pure `(stack) => Finding[]`; accepts the NORMALIZED stack input.
+ */
+declare const ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
+declare const ORG_AXIS_CROSS_ORG_BU_GRANT = "org-axis-cross-org-bu-grant";
+type OrgAxisSeverity = 'error' | 'warning';
+interface OrgAxisFinding {
+    severity: OrgAxisSeverity;
+    /** Diagnostic rule id (`org-axis-*`). */
+    rule: string;
+    /** Human-readable location, e.g. `permission set "plant_reader"`. */
+    where: string;
+    /** Config path, e.g. `permissions[2].rowLevelSecurity[0].using`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/**
+ * Lint an ObjectStack config for the ADR-0105 D6 organization-axis red lines.
+ */
+declare function validateOrgAxisRedLines(stack: unknown): OrgAxisFinding[];
+
+/**
+ * [ADR-0049 — references] Reference-integrity for dashboard header & widget
+ * action targets (issue #3367).
+ *
+ * ADR-0049 established the "enforce-or-remove" gate for spec *properties*: a
+ * declared property the runtime does not honour is a false promise and must be
+ * enforced, marked experimental, or removed. This rule applies the SAME honesty
+ * principle to *references*. A dashboard header action (or a widget's header
+ * action button) names a target — a `script`/`modal` action, or a `url` route —
+ * that must actually resolve. A dangling target ships a button that renders and,
+ * on click, silently does nothing: a false affordance, exactly the failure
+ * ADR-0049 exists to prevent, just for a reference rather than a property.
+ *
+ * Nothing in the protocol schema can express this: `actionUrl` is a free string,
+ * so `{ actionType: 'script', actionUrl: 'export_dashboard_pdf' }` parses and
+ * ships even when no such action is defined anywhere in the stack.
+ *
+ * Surfaces checked:
+ *   - dashboard `header.actions[]` — each `{ actionType, actionUrl }`
+ *   - dashboard `widgets[].actionUrl` (+ `actionType`) — the per-widget button
+ *
+ * Resolution mirrors the objectui runtime dispatch (`DashboardRenderer` +
+ * `DashboardView`) so the lint flags exactly what would fail to resolve at
+ * runtime:
+ *
+ *   actionType 'script' → `actionUrl` must name a DEFINED action (`stack.actions`
+ *       or any `object.actions`, by `name`). A script target that names no
+ *       defined action fails open at runtime ("action not found"). → ERROR.
+ *
+ *   actionType 'modal'  → `actionUrl` resolves if it names a defined action, OR
+ *       matches the runtime `<verb>_<object>` convention the modalHandler
+ *       implements (create_/new_/add_/edit_/update_ + a defined object), OR is a
+ *       bare defined object name (the handler falls back to that object's create
+ *       form). Otherwise → ERROR.
+ *
+ *   actionType 'url'    → a relative in-app path. WARN when a recognizable
+ *       `<collection>/<name>` segment (objects/reports/dashboards/pages/views)
+ *       names an entity that does not exist in this stack. External URLs
+ *       (`http(s)://`, `//`), interpolated targets (`${…}`), and opaque routes
+ *       (no recognized collection segment) are skipped — they cannot be resolved
+ *       statically and may be host/app/plugin routes. → WARNING.
+ *
+ *   actionType 'flow' | 'api' — not checked: flow targets resolve against the
+ *       automation engine / other packages, and api targets are opaque endpoints.
+ *       Out of scope for #3367.
+ *
+ * Severity split follows the issue's acceptance criteria: an undefined
+ * `script`/`modal` target FAILS validation (a genuine dead reference that fails
+ * open at runtime as a dead button); an unresolved `url` route is advisory
+ * (route resolution is app-context-dependent, and a path may be served by
+ * another installed package or a host/console route). External, interpolated,
+ * convention, and opaque targets are exempted to keep false positives near zero
+ * — the same conservative posture as the sibling `lint-view-refs` and
+ * `validate-capability-references` rules.
+ */
+declare const DASHBOARD_ACTION_TARGET_UNDEFINED = "dashboard-action-target-undefined";
+declare const DASHBOARD_ACTION_ROUTE_UNRESOLVED = "dashboard-action-route-unresolved";
+type DashboardActionRefSeverity = 'error' | 'warning';
+interface DashboardActionRefFinding {
+    /** `error` for a dangling script/modal action; `warning` for an unresolved url route. */
+    severity: DashboardActionRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `dashboard "sales_overview" · header action "Export PDF"`. */
+    where: string;
+    /** Config path, e.g. `dashboards[2].header.actions[0].actionUrl`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$9 = Record<string, unknown>;
+/**
+ * Validate every dashboard header / widget action reference in a stack. Returns
+ * findings (empty = clean). `script`/`modal` dead targets are errors; `url`
+ * unresolved routes are warnings.
+ */
+declare function validateDashboardActionRefs(stack: AnyRec$9): DashboardActionRefFinding[];
+
+/**
+ * Build-time filter-placeholder diagnostics (issue #3574).
+ *
+ * Filter values travel as JSON, so a user-scoped or time-scoped slice cannot
+ * call code inline — it writes a placeholder that the client resolves just
+ * before querying:
+ *
+ *     { owner_id: '{current_user_id}', created_at: { $gte: '{week_start}' } }
+ *
+ * Exactly two vocabularies resolve inside a filter value: context tokens
+ * (`{current_user_id}`, `{current_org_id}` — see `context-tokens.zod.ts`) and
+ * date macros (`{today}`, `{30_days_ago}` — see `date-macros.zod.ts`).
+ * Anything else is passed to the data engine **verbatim**, matches no row, and
+ * the surface renders an empty result.
+ *
+ * ## Why this is an error, not a warning
+ *
+ * The runtime failure mode is silent and indistinguishable from success. A
+ * metric widget filtered on an unresolved `{current_user}` renders `0`, which
+ * looks exactly like a metric that is legitimately zero — no console error, no
+ * server log, nothing for a human reviewer to notice. Issue #3574 found a
+ * dashboard that had been broken this way since the day it was written.
+ *
+ * That failure mode is worse for AI authors than for humans. An AI reads a
+ * successful query returning `0` as a correct answer and builds on it — it has
+ * no instinct that the number looks wrong. Its correction loop is
+ * "author → validate → fix", so a diagnostic only reaches it if the diagnostic
+ * can fail the build. A runtime warning in a server log is invisible to it.
+ * Hence: authoring-time error.
+ *
+ * The near-miss spellings this catches are not hypothetical. Each is a correct
+ * spelling *somewhere else* in the platform, which is precisely why authors
+ * reach for them:
+ *
+ * - `{current_user}` — `current_user.id` is the RLS expression root
+ * - `{user_id}` — `{user_id}` is valid `titleFormat` field interpolation
+ * - `{current_organization_id}` — `organization_id` is the real column name
+ *
+ * `CONTEXT_TOKEN_SUGGESTIONS` maps each to what the author meant, so the
+ * diagnostic names the fix instead of only reporting the symptom.
+ *
+ * ## Scope — filter subtrees only
+ *
+ * The walk descends into `filter` / `filters` / `runtimeFilter` subtrees and
+ * classifies string values inside them. It deliberately does NOT check
+ * navigation `recordId` / `params`, which resolve an additional vocabulary —
+ * `AppContextSelector` ids such as `{active_package}` — that is meaningless in
+ * a filter because filters are not evaluated with the sidebar's selector
+ * state. Restricting the walk keeps that legitimate usage out of the rule and
+ * holds false positives at zero.
+ *
+ * Only whole-string placeholders are considered (`'{token}'` / `'${token}'`,
+ * anchored). A value that merely contains braces is left alone.
+ */
+declare const FILTER_TOKEN_UNKNOWN = "filter-token-unknown";
+type FilterTokenSeverity = 'error' | 'warning';
+interface FilterTokenFinding {
+    /** Always `error` today — an unresolved placeholder silently matches nothing. */
+    severity: FilterTokenSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `dashboard "sales" · widget "my_deals"`. */
+    where: string;
+    /** Config path, e.g. `dashboards[0].widgets[2].filter.owner_id`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/**
+ * Validate filter placeholders across a schema-parsed stack.
+ *
+ * Pure `(stack) => Finding[]`; no I/O. Covers dashboards (widget + global
+ * filters), objects (list views), top-level view containers, reports,
+ * datasets, and pages.
+ */
+declare function validateFilterTokens(stack: Record<string, unknown> | undefined | null): FilterTokenFinding[];
+
+declare const OBJECT_REFERENCE_UNKNOWN = "object-reference-unknown";
+declare const OBJECT_REFERENCE_UNREGISTERED_PLATFORM = "object-reference-unregistered-platform";
+type ObjectRefSeverity = 'error' | 'warning';
+interface ObjectRefFinding {
+    /** `error` for an unresolvable own-stack name; `warning` for an unknown platform name. */
+    severity: ObjectRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `action "mass_update" · param "owner"`. */
+    where: string;
+    /** Config path, e.g. `actions[2].params[0].reference`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$8 = Record<string, unknown>;
+/**
+ * Validate every object-name reference on the surfaces listed in the module
+ * header. Returns findings (empty = clean).
+ */
+declare function validateObjectReferences(stack: AnyRec$8): ObjectRefFinding[];
+
+declare const ACTION_NAME_UNDEFINED = "action-name-undefined";
+type ActionNameRefSeverity = 'error' | 'warning';
+interface ActionNameRefFinding {
+    /** Always `error` — a name-bound action that resolves nowhere is a dead button. */
+    severity: ActionNameRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `view "crm_lead" · list "all" · bulkActions`. */
+    where: string;
+    /** Config path, e.g. `views[0].list.bulkActions[1]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$7 = Record<string, unknown>;
+/**
+ * Validate every name-bound action reference in a stack. Returns findings
+ * (empty = clean).
+ */
+declare function validateActionNameRefs(stack: AnyRec$7): ActionNameRefFinding[];
+
+/**
+ * Shared page-component traversal for the lint rules that inspect
+ * `PageComponent.properties` (issue #3583).
+ *
+ * Getting this walk right is subtle enough that duplicating it has already
+ * produced one dead rule, so it lives here once:
+ *
+ *   - Components hang off `page.regions[].components[]` and `page.slots.<slot>`
+ *     — there is NO top-level `page.components`. A walker that reads
+ *     `page.components` silently visits nothing on a schema-parsed stack.
+ *   - `slots.<slot>` is `PageComponent | PageComponent[]` — a single component
+ *     is legal and must be normalized.
+ *   - `PageComponentSchema` is `.strict()`, so a component carries no `children`
+ *     key of its own. Sub-trees live INSIDE the untyped `properties` bag:
+ *     `page:tabs` → `properties.items[].children`, `page:accordion` →
+ *     `properties.items[].children`, `page:card` → `properties.body` /
+ *     `properties.footer`. All are `z.array(z.unknown())`, so the recursion is
+ *     untyped and has to be done by hand.
+ *   - `kind: 'html' | 'react' | 'jsx'` pages are authored as `source`, which is
+ *     authoritative; their `regions` hold at most a DERIVED cache that the
+ *     source wins over. Linting that cache reports findings about metadata the
+ *     author never wrote, so those pages are skipped here and covered by
+ *     `validate-jsx-pages` / `validate-react-page-props` instead.
+ */
+type AnyRec$6 = Record<string, unknown>;
+
+/**
+ * [ADR-0078 — completeness] Field-reference integrity for page components
+ * (issue #3583, assessment R3).
+ *
+ * `PageComponent.properties` is `z.record(z.string(), z.unknown())` — an
+ * untyped bag. The typed prop schemas exist (`ComponentPropsMap` in
+ * `@objectstack/spec/ui`) but nothing validates `properties` against them, so
+ * every field name a component references ships exactly as typed. The HotCRM
+ * audit found KPI cards and page headers bound to fields the object does not
+ * have; each renders blank or falls back, and nothing reports the miss.
+ *
+ * Field-existence lint already exists for forms (`FORM_FIELD_UNKNOWN`),
+ * semantic roles, and flow templates. This is the same check for pages, at the
+ * same advisory severity: every consumer degrades gracefully (a missing field
+ * is skipped, not crashed on), so a warning is the honest level.
+ *
+ * ── Which object a component binds ──────────────────────────────────────
+ *
+ * `dataSource.object` → `properties.object` → the page's `object`. A per-element
+ * `dataSource` exists precisely so one page can bind several objects, and the
+ * `element:*` family declares its own `object`; both must win over the page's.
+ *
+ * ── Why a hand-written descriptor table ─────────────────────────────────
+ *
+ * `ComponentPropsMap` cannot drive this rule: a Zod schema does not say which
+ * of its `z.string()` props is a FIELD NAME (`RecordPathProps.statusField` and
+ * `AIChatWindowProps.agentId` are both plain strings), and the type universe is
+ * open anyway — `PageComponent.type` is `z.union([PageComponentType,
+ * z.string()])`, so unregistered types like `record:line_items` parse and are
+ * authored in the wild. The table below names the field-bearing props
+ * explicitly; an unknown component type is SKIPPED silently, never flagged.
+ *
+ * The table also covers shapes the props schemas do not yet describe but real
+ * pages authored anyway (they pass only because `properties` is unvalidated):
+ * `record:details` `sections[].fields[]` and `hideFields[]`, and the record
+ * picker's `labelField`. Linting the schema's shape alone would find nothing on
+ * the actual corpus.
+ */
+declare const PAGE_FIELD_UNKNOWN = "page-field-unknown";
+type PageFieldSeverity = 'error' | 'warning';
+interface PageFieldFinding {
+    /** Always `warning` — page renderers skip an unknown field rather than fail. */
+    severity: PageFieldSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `page "task_detail" · record:highlights`. */
+    where: string;
+    /** Config path, e.g. `pages[0].regions[1].components[0].properties.fields[2]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+
+declare function validatePageFieldBindings(stack: AnyRec$6): PageFieldFinding[];
+
+/**
+ * [ADR-0021 — semantic layer] Chart-binding integrity for the surfaces the
+ * dashboard rule does not reach (issue #3583, assessment R4).
+ *
+ * `validate-widget-bindings` already resolves a dashboard widget's
+ * `chartConfig` axes against its dataset's declared dimensions and measures
+ * (`chart-field-unknown`). It is scoped to `stack.dashboards`, so three other
+ * chart surfaces ship unchecked — and the HotCRM audit found exactly the bug
+ * that scoping allows: an axis naming a RAW FIELD instead of a dataset measure.
+ * Post-ADR-0021 the result rows are keyed by measure NAME (`sum_amount`), not
+ * the base column (`amount`), so the axis renders and the series is empty.
+ *
+ * Surfaces covered here:
+ *
+ *   1. **Report charts** — `report.chart` and `report.blocks[].chart`.
+ *      `ReportChartSchema` narrows `xAxis`/`yAxis` from ChartConfig's
+ *      object/array shapes to bare STRINGS, which is why simply pointing the
+ *      dashboard rule at reports would find nothing: its `Array.isArray(yAxis)`
+ *      guard skips a string silently. `series[].name` keeps the array shape.
+ *   2. **List-view charts** — `ListChartConfigSchema` (`dataset` +
+ *      `dimensions` + `values`), reachable through `views[].list`,
+ *      `views[].listViews.<key>`, and `objects[].listViews.<key>`.
+ *   3. **Dataset-bound page chart components** — a `PageComponent` whose
+ *      `properties` carry a `dataset` (the `object-chart` component). Same
+ *      binding shape as a list chart, but it arrives through the untyped
+ *      `properties` bag.
+ *
+ * Not covered HERE, and deliberately so: the react `<ObjectChart>` block. It is
+ * OBJECT-bound (`objectName` + an inline `aggregate`), so its result rows are
+ * keyed by the RAW FIELD NAMES rather than by a measure name — the opposite
+ * convention, which would make `chart-measure-unknown`'s message a lie. It also
+ * arrives as JSX rather than config, so it needs the TypeScript compiler this
+ * rule has no business loading. It is checked by `validate-react-page-props`
+ * instead, against the naming convention `chartAggregateResultKeys`
+ * (`@objectstack/spec/ui`) now pins down (#3701).
+ */
+declare const CHART_DIMENSION_UNKNOWN = "chart-dimension-unknown";
+declare const CHART_MEASURE_UNKNOWN = "chart-measure-unknown";
+declare const CHART_DATASET_UNKNOWN = "chart-dataset-unknown";
+declare const CHART_AXIS_NOT_SELECTED = "chart-axis-not-selected";
+type ChartBindingSeverity = 'error' | 'warning';
+interface ChartBindingFinding {
+    severity: ChartBindingSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `report "hours_by_status" · chart`. */
+    where: string;
+    /** Config path, e.g. `reports[2].chart.yAxis`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+
+declare function validateChartBindings(stack: AnyRec$6): ChartBindingFinding[];
+
+declare const NAV_OBJECT_UNGRANTED = "nav-object-ungranted";
+type NavAccessSeverity = 'error' | 'warning';
+interface NavAccessFinding {
+    /** Always `warning` — a grant may come from a package this stack cannot see. */
+    severity: NavAccessSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `app "crm" · nav "nav_forecast"`. */
+    where: string;
+    /** Config path, e.g. `apps[0].navigation[3].objectName`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$5 = Record<string, unknown>;
+/**
+ * Validate that every object a stack's navigation exposes is readable by at
+ * least one permission set the stack declares. Returns findings (empty = clean).
+ */
+declare function validateNavAccess(stack: AnyRec$5): NavAccessFinding[];
+
+declare const TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
+declare const TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
+type TranslationRefSeverity = 'warning';
+interface TranslationRefFinding {
+    /** Always `warning` — an orphan translation key is inert, not broken. */
+    severity: TranslationRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `locale "zh-CN" · object "crm_lead"`. */
+    where: string;
+    /** Config path, e.g. `translations[0]["zh-CN"].objects.crm_lead.fields.campaign`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$4 = Record<string, unknown>;
+/**
+ * Validate every reference a translation bundle makes against the metadata it
+ * claims to translate. Returns findings (empty = clean).
+ */
+declare function validateTranslationReferences(stack: AnyRec$4): TranslationRefFinding[];
+
+/**
+ * [ADR-0064 §3] Skill ↔ agent surface affinity (issue #3820).
+ *
+ * An agent binds a product surface (`'ask'` | `'build'`, ADR-0063 §1) and a
+ * skill declares which surface it belongs to (`'ask'` | `'build'` | `'both'`,
+ * ADR-0063 §3). A skill may only attach to an agent whose surface it matches —
+ * `'both'` attaches to either. The runtime treats a violation as a FAST LOAD
+ * ERROR: `resolveActiveSkills()` throws on the first incompatible binding, so
+ * an agent shipping one mismatched skill reference fails at **chat time** with
+ * a 500 — after parse, after validate, after deploy.
+ *
+ * Both sides of the check are declared in the same stack, so the contradiction
+ * is statically provable and this rule carries severity **error** with zero
+ * false positives by construction. Both sides default to `'ask'` when the
+ * `surface` field is absent (mirroring the runtime's defaults), so the rule is
+ * safe on the raw/normalized config the `lint` path carries as well as the
+ * schema-parsed stack.
+ *
+ * Scope note: this rule deliberately does NOT check that `agent.skills[]`
+ * names resolve at all. Kernel skills (`schema_reader`, the `ask`/`build`
+ * bundles) are runtime-registered and statically invisible, and whether
+ * app-stack tool/skill namespaces get a platform-name registry is an open
+ * decision (#3820 D0/D2) — resolving names against `stack.skills` alone would
+ * flag every kernel-skill reference. An unresolved name is therefore skipped
+ * here; only a reference that resolves in-stack AND contradicts the affinity
+ * contract is reported.
+ */
+declare const AI_SKILL_SURFACE_MISMATCH = "ai-skill-surface-mismatch";
+type AiSurfaceAffinitySeverity = 'error' | 'warning';
+interface AiSurfaceAffinityFinding {
+    /** Always `error` — the runtime throws on this binding at chat time. */
+    severity: AiSurfaceAffinitySeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `agent "sales_copilot" · skills`. */
+    where: string;
+    /** Config path, e.g. `agents[0].skills[2]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$3 = Record<string, unknown>;
+/**
+ * Validate every in-stack agent→skill binding against the ADR-0064 §3 surface
+ * affinity contract. Returns findings (empty = clean).
+ */
+declare function validateAiSurfaceAffinity(stack: AnyRec$3): AiSurfaceAffinityFinding[];
+
+declare const AI_SKILL_TOOL_UNRESOLVED = "ai-skill-tool-unresolved";
+type AiToolRefSeverity = 'error' | 'warning';
+interface AiToolRefFinding {
+    /** Always `warning` — see the header for why this rule starts advisory. */
+    severity: AiToolRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `skill "revenue_forecasting" · tools`. */
+    where: string;
+    /** Config path, e.g. `skills[3].tools[1]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$2 = Record<string, unknown>;
+/**
+ * Validate every `skill.tools[]` reference in a stack. Returns findings
+ * (empty = clean).
+ */
+declare function validateAiToolReferences(stack: AnyRec$2): AiToolRefFinding[];
+
+/**
+ * [ADR-0063 §2] `stack.agents` is a platform-internal slot (issue #3820).
+ *
+ * ADR-0063 §2 withdrew tenant/app-package custom agents: the kernel ships
+ * exactly two agents (`ask`, `build`), the surface the user is in binds one,
+ * and third parties extend the platform by authoring **skills**, never
+ * `*.agent.ts`. The `agent` metadata type carries the decision
+ * (`allowRuntimeCreate: false, allowOrgOverride: false`), and the runtime
+ * enforces it on both paths — `listAgents()` filters non-platform records out
+ * of the catalog, and `loadAgent()` refuses them outright (cloud#904), so a
+ * stack-authored agent 404s on chat and cannot be pinned via
+ * `app.defaultAgent`.
+ *
+ * What was missing is the AUTHORING-time signal. `defineStack` still accepts
+ * an `agents` array, so an app package could declare agents that parse,
+ * validate, and build into the artifact — and then do nothing at runtime.
+ * HotCRM shipped two of them for months. That is the ADR-0078 shape this rule
+ * closes: loud at the producer, tolerant at the consumer (Prime Directive
+ * #12).
+ *
+ * Severity is **warning**, not error, for one reason: the platform's own
+ * packages legitimately author agent records, and this rule cannot tell a
+ * platform package from an app package by reading the stack alone. A warning
+ * that names the runtime consequence is honest for both readers; the runtime
+ * is what actually gates. Deliberately NOT a Zod refine — an existing stack
+ * must keep parsing (ADR-0078 non-goal #1).
+ */
+declare const AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
+type AiAgentAuthoringSeverity = 'error' | 'warning';
+interface AiAgentAuthoringFinding {
+    /** Always `warning` — the runtime is the gate; this is the authoring-time signal. */
+    severity: AiAgentAuthoringSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `agent "sales_copilot"`. */
+    where: string;
+    /** Config path, e.g. `agents[0]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$1 = Record<string, unknown>;
+/**
+ * Flag every agent declared in a stack. Returns findings (empty = clean,
+ * which is what every app package should be).
+ */
+declare function validateAiAgentAuthoring(stack: AnyRec$1): AiAgentAuthoringFinding[];
+
+type ReferenceIntegritySeverity = 'error' | 'warning';
+/**
+ * The shape every rule in the suite already returns. Declared here so callers
+ * can hold one type instead of a six-way union.
+ */
+interface ReferenceIntegrityFinding {
+    /** `error` = the reference is dead; `warning` = it may resolve elsewhere, or the miss is inert. */
+    severity: ReferenceIntegritySeverity;
+    /** Diagnostic rule id (stable; used by allowlists and docs). */
+    rule: string;
+    /** Human-readable location. */
+    where: string;
+    /** Config path. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/** One member of the suite. `name` is the exported function's name — the id a wiring test can assert on. */
+interface ReferenceIntegrityRule {
+    name: string;
+    run: (stack: Record<string, unknown>) => ReferenceIntegrityFinding[];
+}
+/**
+ * Every reference-integrity rule, in the order their findings are reported.
+ *
+ * ADDING A RULE: append it here and it runs on `validate`, `lint` and
+ * `compile` at once. Do not re-wire the commands.
+ */
+declare const REFERENCE_INTEGRITY_RULES: readonly ReferenceIntegrityRule[];
+/**
+ * Run every reference-integrity rule over a stack. Returns the concatenated
+ * findings (empty = clean). Pure: no I/O, safe on both the schema-parsed stack
+ * and the raw/normalized config the `lint` path carries.
+ */
+declare function validateReferenceIntegrity(stack: Record<string, unknown>): ReferenceIntegrityFinding[];
+
 /**
  * [ADR-0090 D6] Access-matrix snapshot — authoring-time companion to the
  * runtime explain engine.
@@ -580,4 +1302,4 @@ declare function buildAccessMatrix(stack: AnyRec): AccessMatrix;
  */
 declare function diffAccessMatrix(before: AccessMatrix, after: AccessMatrix): string[];
 
-export { APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, type ApprovalApproverFinding, type ApprovalApproverSeverity, CAPABILITY_REFERENCE_UNKNOWN, CHART_CONFIG_MISSING, CHART_FIELD_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ExprIssue, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_TRIGGER_UNKNOWN_OBJECT, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FormLayoutFinding, type FormLayoutSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, type ListViewModeFinding, type ListViewModeSeverity, MEASURE_AGGREGATE_INCOHERENT, PAGE_SOURCE_CLASSNAME, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type RecordTitleFinding, type RecordTitleSeverity, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SecurityFinding, type SecuritySeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, VIEW_CONTAINER_SHAPE, VISIBILITY_ALIAS_DEPRECATED, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, validateApprovalApprovers, validateCapabilityReferences, validateFlowTriggerReadiness, validateFormLayout, validateJsxPages, validateListViewMode, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateRecordTitle, validateResponsiveStyles, validateSecurityPosture, validateSemanticRoles, validateStackExpressions, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings };
+export { ACTION_NAME_UNDEFINED, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, type DashboardActionRefFinding, type DashboardActionRefSeverity, type ExprIssue, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FILTER_TOKEN_UNKNOWN, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FilterTokenFinding, type FilterTokenSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FormLayoutFinding, type FormLayoutSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, type ListViewModeFinding, type ListViewModeSeverity, MEASURE_AGGREGATE_INCOHERENT, NAV_OBJECT_UNGRANTED, type NavAccessFinding, type NavAccessSeverity, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_SOURCE_CLASSNAME, type PageFieldFinding, type PageFieldSeverity, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_FIELD_UNKNOWN, REFERENCE_INTEGRITY_RULES, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_TARGET_UNKNOWN, type TranslationRefFinding, type TranslationRefSeverity, VIEW_CONTAINER_SHAPE, VISIBILITY_ALIAS_DEPRECATED, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateDashboardActionRefs, validateFilterTokens, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateJsxPages, validateListViewMode, validateNavAccess, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateReadonlyFlowWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateSecurityPosture, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateStackExpressions, validateTranslationReferences, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings };