@objectstack/lint 16.1.0 → 17.0.0-rc.0

package/dist/index.js

@@ -216,6 +216,15 @@ function validateWidgetBindings(stack) {
           hint: `Declared datasets: ${list(datasets.keys())}.${suggest(dsName, datasets.keys())} Define the dataset with defineDataset() or fix the reference (ADR-0021).`
         });
       }
+      if (!dsName) {
+        push({
+          severity: "error",
+          rule: WIDGET_DATASET_UNKNOWN,
+          message: `binds no \`dataset\` \u2014 the ADR-0021 widget shape requires one, so this widget resolves no data and renders empty.`,
+          hint: `Set \`dataset: '<name>'\` (plus \`values\`, and \`dimensions\` where the chart family needs them). Declared datasets: ${list(datasets.keys())}.`
+        });
+        continue;
+      }
       if (!dataset) continue;
       if (dashFilterDefs.length > 0) {
         const datasetObject = typeof dataset.object === "string" ? dataset.object : void 0;
@@ -277,13 +286,13 @@ function validateWidgetBindings(stack) {
             hint: `Point xAxis.field at a dataset dimension name.${suggest(xAxis.field, dimensionNames)}`
           });
         }
-        const measureField = (label, field) => {
+        const measureField = (label2, field) => {
           if (values.includes(field)) return;
           const declaredButUnselected = measures.has(field);
           push({
             severity: "error",
             rule: CHART_FIELD_UNKNOWN,
-            message: declaredButUnselected ? `chartConfig.${label} "${field}" is a measure of dataset "${dsName}" but is not selected in the widget's values (${list(values)}), so the query result will not contain it.` : `chartConfig.${label} "${field}" does not resolve to a measure of dataset "${dsName}" (declared measures: ${list(measures.keys())}).`,
+            message: declaredButUnselected ? `chartConfig.${label2} "${field}" is a measure of dataset "${dsName}" but is not selected in the widget's values (${list(values)}), so the query result will not contain it.` : `chartConfig.${label2} "${field}" does not resolve to a measure of dataset "${dsName}" (declared measures: ${list(measures.keys())}).`,
             hint: declaredButUnselected ? `Add "${field}" to the widget's values, or bind the chart to a selected measure.` : `Post-cutover data is keyed by the dataset's measure NAME, not the base column.${suggest(field, selectedValues.size > 0 ? selectedValues : measures.keys())}`
           });
         };
@@ -474,8 +483,33 @@ function validateStackExpressions(stack) {
     check(where, rule.condition ?? rule.criteria ?? rule.predicate, ruleObj, "record");
   }
   for (const hook of asArray2(stack.hooks)) {
-    const hookObj = typeof hook.object === "string" ? hook.object : void 0;
-    check(`hook '${hook.name ?? "?"}'${hookObj ? ` (${hookObj})` : ""} condition`, hook.condition, hookObj, "record");
+    const hookName = hook.name ?? "?";
+    if (typeof hook.object === "string") {
+      check(`hook '${hookName}' (${hook.object}) condition`, hook.condition, hook.object, "record");
+      continue;
+    }
+    const targets = Array.isArray(hook.object) ? hook.object.filter((o) => typeof o === "string" && o !== "*") : [];
+    if (targets.length === 0) {
+      check(`hook '${hookName}' condition`, hook.condition, void 0, "record");
+      continue;
+    }
+    const before = issues.length;
+    const seen = /* @__PURE__ */ new Set();
+    const kept = [];
+    for (const target of targets) {
+      const mark = issues.length;
+      check(`hook '${hookName}' (${target}) condition`, hook.condition, target, "record");
+      for (let i = mark; i < issues.length; i++) {
+        const issue = issues[i];
+        const key = `${issue.message}\0${issue.source ?? ""}`;
+        if (!seen.has(key)) {
+          seen.add(key);
+          kept.push(issue);
+        }
+      }
+    }
+    issues.length = before;
+    issues.push(...kept);
   }
   return issues;
 }
@@ -534,14 +568,14 @@ function scanListViews(listViews, wherePrefix, pathPrefix, out) {
 function validateListViewMode(stack) {
   const out = [];
   asArray3(stack.objects).forEach((obj, i) => {
-    const label = typeof obj.name === "string" ? `object "${obj.name}"` : `objects[${i}]`;
-    scanListViews(obj.listViews, label, `objects[${i}]`, out);
+    const label2 = typeof obj.name === "string" ? `object "${obj.name}"` : `objects[${i}]`;
+    scanListViews(obj.listViews, label2, `objects[${i}]`, out);
   });
   asArray3(stack.views).forEach((view, i) => {
     const named = typeof view.objectName === "string" ? view.objectName : typeof view.name === "string" ? view.name : void 0;
-    const label = named ? `view "${named}"` : `views[${i}]`;
-    scanView(view.list, `${label} \u203A list`, `views[${i}].list`, out);
-    scanListViews(view.listViews, label, `views[${i}]`, out);
+    const label2 = named ? `view "${named}"` : `views[${i}]`;
+    scanView(view.list, `${label2} \u203A list`, `views[${i}].list`, out);
+    scanListViews(view.listViews, label2, `views[${i}]`, out);
   });
   return out;
 }
@@ -549,6 +583,8 @@ function validateListViewMode(stack) {
 // src/validate-flow-trigger-readiness.ts
 var FLOW_TRIGGER_UNKNOWN_OBJECT = "flow-trigger-unknown-object";
 var FLOW_DRAFT_STATUS_AMBIGUOUS = "flow-draft-status-ambiguous";
+var FLOW_TRIGGER_UNKNOWN_EVENT = "flow-trigger-unknown-event";
+var VALID_RECORD_TRIGGER = /^record-(?:before|after)-(?:create|insert|update|delete|write)$/;
 function asArray4(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -576,10 +612,11 @@ function validateFlowTriggerReadiness(stack) {
     const start = startNodeOf(flow);
     const config = start?.node.config ?? {};
     const triggerType = typeof config.triggerType === "string" ? config.triggerType : void 0;
-    const isRecordTriggered = !!triggerType && triggerType.startsWith("record-");
+    const isRecordTriggered2 = !!triggerType && triggerType.startsWith("record-");
+    const isArrayRecordTriggered = Array.isArray(config.triggerType) && config.triggerType.some((t) => typeof t === "string" && t.startsWith("record-"));
     const isTimeRelative = config.timeRelative != null && typeof config.timeRelative === "object";
-    const isAutoTriggered = isRecordTriggered || triggerType === "api" || config.schedule != null || isTimeRelative || flow.type === "schedule" || flow.type === "api";
-    if (isRecordTriggered && start) {
+    const isAutoTriggered = isRecordTriggered2 || triggerType === "api" || config.schedule != null || isTimeRelative || flow.type === "schedule" || flow.type === "api";
+    if (isRecordTriggered2 && start) {
       const objectName = typeof config.objectName === "string" ? config.objectName : void 0;
       if (objectName && !objectNames.has(objectName) && !objectName.startsWith("sys_")) {
         findings.push({
@@ -606,6 +643,26 @@ function validateFlowTriggerReadiness(stack) {
         });
       }
     }
+    if (start && isRecordTriggered2 && !VALID_RECORD_TRIGGER.test((triggerType ?? "").trim())) {
+      findings.push({
+        severity: "warning",
+        rule: FLOW_TRIGGER_UNKNOWN_EVENT,
+        where: `flow "${flowName}" \u203A start node`,
+        path: `flows[${flowIndex}].nodes[${start.index}].config.triggerType`,
+        message: `triggerType '${triggerType}' is not a recognized record trigger \u2014 the flow binds to the record-change trigger but never fires (the runtime stays silent about it).`,
+        hint: `Use record-{before,after}-{create,update,delete,write}. 'write' fires on create OR update in one flow (#3427); create/insert are synonyms. There is no "any change" token \u2014 pick the specific event(s).`
+      });
+    }
+    if (start && isArrayRecordTriggered) {
+      findings.push({
+        severity: "warning",
+        rule: FLOW_TRIGGER_UNKNOWN_EVENT,
+        where: `flow "${flowName}" \u203A start node`,
+        path: `flows[${flowIndex}].nodes[${start.index}].config.triggerType`,
+        message: `triggerType is an array (${JSON.stringify(config.triggerType)}), which is not supported \u2014 a start node takes a single trigger event, so the flow binds to nothing and never fires (the runtime stays silent about it).`,
+        hint: `Use one triggerType string. For "created or updated" use record-after-write (one flow, both events, #3427). For any other combination, author one flow per event \u2014 multi-event arrays are deferred (#3457).`
+      });
+    }
     if (isAutoTriggered && (flow.status == null || flow.status === "draft")) {
       findings.push({
         severity: "warning",
@@ -620,6 +677,303 @@ function validateFlowTriggerReadiness(stack) {
   return findings;
 }
 
+// src/validate-flow-template-paths.ts
+var FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
+var FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
+function asArray5(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({
+      name,
+      ...def
+    }));
+  }
+  return [];
+}
+var SYSTEM_FIELDS2 = /* @__PURE__ */ new Set([
+  "id",
+  "name",
+  "owner",
+  "owner_id",
+  "created_at",
+  "created_by",
+  "updated_at",
+  "updated_by",
+  "organization_id",
+  "tenant_id",
+  "is_deleted",
+  "deleted_at",
+  "record_type"
+]);
+var RELATION_TYPES = /* @__PURE__ */ new Set([
+  "lookup",
+  "master_detail",
+  "user",
+  "tree"
+]);
+var FILTER_GUARDED_NODE_TYPES = /* @__PURE__ */ new Set([
+  "get_record",
+  "update_record",
+  "delete_record"
+]);
+function fieldTypesOf(obj) {
+  const types = /* @__PURE__ */ new Map();
+  for (const f of asArray5(obj.fields)) {
+    if (typeof f.name === "string") {
+      types.set(f.name, typeof f.type === "string" ? f.type : "");
+    }
+  }
+  return types;
+}
+function recordRefsIn(text) {
+  const refs = [];
+  const tokenRe = /\{([^{}]+)\}/g;
+  let m;
+  while ((m = tokenRe.exec(text)) !== null) {
+    const body = m[1].trim();
+    if (!/^[A-Za-z_$][\w$]*(?:\.(?:[A-Za-z_$][\w$]*|\d+))*$/.test(body)) continue;
+    const segments = body.split(".");
+    if (segments[0] !== "record") continue;
+    const rest = segments.slice(1);
+    if (rest.length > 0) refs.push(rest);
+  }
+  return refs;
+}
+function stringLeaves(value, out) {
+  if (typeof value === "string") {
+    if (value.includes("{")) out.push(value);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const v of value) stringLeaves(v, out);
+    return;
+  }
+  if (value && typeof value === "object") {
+    for (const v of Object.values(value)) stringLeaves(v, out);
+  }
+}
+var NODE_CONFIG_KEYS = [
+  "config",
+  "notify",
+  "update_record",
+  "create_record",
+  "http",
+  "script",
+  "screen",
+  "wait",
+  "approval",
+  "connector_action",
+  "subflow",
+  "decision",
+  "start"
+];
+function collectNodeLeaves(node, guarded) {
+  const filterLeaves = [];
+  const otherLeaves = [];
+  for (const key of NODE_CONFIG_KEYS) {
+    if (!(key in node)) continue;
+    const block = node[key];
+    const splitFilter = guarded && !!block && typeof block === "object" && !Array.isArray(block);
+    if (splitFilter) {
+      const { filter, ...rest } = block;
+      const inFilter = [];
+      stringLeaves(filter, inFilter);
+      for (const text of inFilter) filterLeaves.push({ text, inFilter: true });
+      const outside = [];
+      stringLeaves(rest, outside);
+      for (const text of outside) otherLeaves.push({ text, inFilter: false });
+      continue;
+    }
+    const plain = [];
+    stringLeaves(block, plain);
+    for (const text of plain) otherLeaves.push({ text, inFilter: false });
+  }
+  return [...filterLeaves, ...otherLeaves];
+}
+function isRecordTriggered(flow, startConfig) {
+  if (flow.type === "record_change") return true;
+  const triggerType = typeof startConfig.triggerType === "string" ? startConfig.triggerType : void 0;
+  return !!triggerType && triggerType.startsWith("record-");
+}
+function boundObjectOf(flow) {
+  const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
+  const start = nodes.find((n) => n?.type === "start");
+  if (!start) return void 0;
+  const config = start.config ?? {};
+  const typed = start.start ?? {};
+  const fromConfig = typeof config.objectName === "string" ? config.objectName : void 0;
+  const fromTyped = typeof typed.objectName === "string" ? typed.objectName : void 0;
+  return fromConfig ?? fromTyped;
+}
+function declaredExpandOf(flow) {
+  const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
+  const start = nodes.find((n) => n?.type === "start");
+  const raw = (start?.config ?? {}).expand;
+  if (typeof raw === "string") return new Set(raw ? [raw] : []);
+  if (Array.isArray(raw)) return new Set(raw.filter((r) => typeof r === "string" && r.length > 0));
+  return /* @__PURE__ */ new Set();
+}
+function validateFlowTemplatePaths(stack) {
+  const findings = [];
+  const flows = asArray5(stack.flows);
+  if (flows.length === 0) return findings;
+  const objectsByName = /* @__PURE__ */ new Map();
+  for (const obj of asArray5(stack.objects)) {
+    if (typeof obj.name === "string") objectsByName.set(obj.name, obj);
+  }
+  flows.forEach((flow, flowIndex) => {
+    const flowName = typeof flow.name === "string" ? flow.name : `#${flowIndex}`;
+    const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
+    const start = nodes.find((n) => n?.type === "start")?.config ?? {};
+    if (!isRecordTriggered(flow, start)) return;
+    const objectName = boundObjectOf(flow);
+    if (!objectName) return;
+    const obj = objectsByName.get(objectName);
+    if (!obj) return;
+    const fieldTypes = fieldTypesOf(obj);
+    const expandSet = declaredExpandOf(flow);
+    nodes.forEach((node, nodeIndex) => {
+      if (typeof node !== "object" || !node) return;
+      const nodeLabel = typeof node.type === "string" ? node.type : typeof node.id === "string" ? node.id : `#${nodeIndex}`;
+      const nodeType = typeof node.type === "string" ? node.type : "";
+      const guarded = FILTER_GUARDED_NODE_TYPES.has(nodeType);
+      const leaves = collectNodeLeaves(node, guarded);
+      if (leaves.length === 0) return;
+      const seenUnknown = /* @__PURE__ */ new Set();
+      const seenTraversal = /* @__PURE__ */ new Set();
+      for (const leaf of leaves) {
+        const inFilter = leaf.inFilter;
+        for (const rest of recordRefsIn(leaf.text)) {
+          const head = rest[0];
+          const hasSubPath = rest.length > 1;
+          const nextIsIdentifier = hasSubPath && !/^\d+$/.test(rest[1]);
+          const isKnown = fieldTypes.has(head) || SYSTEM_FIELDS2.has(head);
+          if (!isKnown) {
+            if (seenUnknown.has(head)) continue;
+            seenUnknown.add(head);
+            findings.push({
+              severity: inFilter ? "error" : "warning",
+              rule: FLOW_TEMPLATE_UNKNOWN_FIELD,
+              where: `flow "${flowName}" node "${nodeLabel}"`,
+              path: `flows[${flowIndex}].nodes[${nodeIndex}]`,
+              message: inFilter ? `${nodeType} filter references '{record.${rest.join(".")}}', but '${head}' is not a field on object '${objectName}' \u2014 the token resolves to nothing, which DROPS the condition from the query instead of narrowing it. The node refuses to run at execution time (#3810).` : `template references '{record.${rest.join(".")}}', but '${head}' is not a field on object '${objectName}' \u2014 it resolves to an empty string at runtime (silently).`,
+              hint: inFilter ? `Check the field name against the object's field definitions (e.g. '{record.full_name}', not '{record.full_naem}'); system columns like id/created_at/owner are also addressable. This gates the build rather than warning: an absent condition WIDENS the query, so the runtime has already decided to refuse this node.` : `Check the field name against the object's field definitions (e.g. '{record.full_name}', not '{record.full_naem}'). System columns like id/created_at/owner are also addressable.`
+            });
+            continue;
+          }
+          if (nextIsIdentifier) {
+            const headType = fieldTypes.get(head) ?? "";
+            if (RELATION_TYPES.has(headType) && !expandSet.has(head)) {
+              const key = rest.join(".");
+              if (seenTraversal.has(key)) continue;
+              seenTraversal.add(key);
+              findings.push({
+                severity: inFilter ? "error" : "warning",
+                rule: FLOW_TEMPLATE_LOOKUP_TRAVERSAL,
+                where: `flow "${flowName}" node "${nodeLabel}"`,
+                path: `flows[${flowIndex}].nodes[${nodeIndex}]`,
+                message: inFilter ? `${nodeType} filter references '{record.${key}}', a cross-object hop through the ${headType} field '${head}' \u2014 the flow record carries '${head}' as a scalar id, not an expanded object, so the token resolves to nothing and the condition is DROPPED from the query instead of narrowing it. The node refuses to run at execution time (#3810).` : `template references '{record.${key}}', a cross-object hop through the ${headType} field '${head}' \u2014 the flow record carries '${head}' as a scalar id, not an expanded object, so this resolves to an empty string at runtime (silently).`,
+                hint: inFilter ? `Opt in to resolve it: add '${head}' to the start node's config.expand (#3475) and the engine re-reads it as the run's identity. Otherwise filter on the foreign-key id directly ('{record.${head}}'), or project the value via a formula field on '${objectName}'. This gates the build rather than warning: an absent condition WIDENS the query.` : `Opt in to resolve it: add '${head}' to the start node's config.expand (#3475) and the engine re-reads it as the run's identity. Otherwise reference the foreign-key id directly ('{record.${head}}'), or project the value via a formula field on '${objectName}'.`
+              });
+            }
+          }
+        }
+      }
+    });
+  });
+  return findings;
+}
+
+// src/validate-readonly-flow-writes.ts
+var FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
+var FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
+function asArray6(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({
+      name,
+      ...def
+    }));
+  }
+  return [];
+}
+function buildReadonlyIndex(objects) {
+  const idx = /* @__PURE__ */ new Map();
+  for (const obj of objects) {
+    const name = typeof obj.name === "string" ? obj.name : void 0;
+    if (!name) continue;
+    const fieldMap = /* @__PURE__ */ new Map();
+    const collect = (fieldName, def) => {
+      const rw = def?.readonlyWhen;
+      const readonlyWhen = rw != null && !(typeof rw === "string" && rw.trim() === "");
+      fieldMap.set(fieldName, { readonly: def?.readonly === true, readonlyWhen });
+    };
+    const fields = obj.fields;
+    if (Array.isArray(fields)) {
+      for (const f of fields) {
+        const fn = f?.name;
+        if (typeof fn === "string") collect(fn, f);
+      }
+    } else if (fields && typeof fields === "object") {
+      for (const [fn, def] of Object.entries(fields)) collect(fn, def);
+    }
+    idx.set(name, fieldMap);
+  }
+  return idx;
+}
+function readLiteralObjectName(config) {
+  const raw = config.objectName ?? config.object;
+  if (typeof raw !== "string" || raw.includes("{")) return void 0;
+  return raw || void 0;
+}
+function validateReadonlyFlowWrites(stack) {
+  const findings = [];
+  const flows = asArray6(stack.flows);
+  if (flows.length === 0) return findings;
+  const roIndex = buildReadonlyIndex(asArray6(stack.objects));
+  flows.forEach((flow, flowIndex) => {
+    if (flow.runAs === "system") return;
+    const runAs = flow.runAs === "user" || flow.runAs === "system" ? flow.runAs : "user";
+    const flowName = typeof flow.name === "string" ? flow.name : `#${flowIndex}`;
+    const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
+    nodes.forEach((node, nodeIndex) => {
+      if (node?.type !== "update_record") return;
+      const config = node.config ?? {};
+      const objectName = readLiteralObjectName(config);
+      if (!objectName) return;
+      const fieldMap = roIndex.get(objectName);
+      if (!fieldMap) return;
+      const fields = config.fields;
+      if (!fields || typeof fields !== "object" || Array.isArray(fields)) return;
+      const nodeName = typeof node.label === "string" && node.label ? node.label : typeof node.id === "string" && node.id ? node.id : `#${nodeIndex}`;
+      for (const fieldName of Object.keys(fields)) {
+        const meta = fieldMap.get(fieldName);
+        if (!meta) continue;
+        if (meta.readonly) {
+          findings.push({
+            severity: "error",
+            rule: FLOW_UPDATE_READONLY_FIELD,
+            where: `flow "${flowName}" \u203A node "${nodeName}"`,
+            path: `flows[${flowIndex}].nodes[${nodeIndex}].config.fields.${fieldName}`,
+            message: `writes field '${fieldName}', which object '${objectName}' declares readonly:true. Under runAs:'${runAs}' the engine silently strips readonly fields from the UPDATE payload (#2948), so this write never lands \u2014 while the step still reports success.`,
+            hint: `If automation is meant to maintain this field, declare the flow runAs:'system' (the intended channel \u2014 readonly governs the end-user/API surface, not trusted system writers). Otherwise remove '${fieldName}' from this update_record node.`
+          });
+        } else if (meta.readonlyWhen) {
+          findings.push({
+            severity: "warning",
+            rule: FLOW_UPDATE_READONLY_WHEN_FIELD,
+            where: `flow "${flowName}" \u203A node "${nodeName}"`,
+            path: `flows[${flowIndex}].nodes[${nodeIndex}].config.fields.${fieldName}`,
+            message: `writes field '${fieldName}', which object '${objectName}' declares readonlyWhen. On records where that predicate is TRUE, a runAs:'${runAs}' UPDATE strips the field (#3042), so this write may silently not land depending on the record's state.`,
+            hint: `If automation must maintain this field regardless of record state, run the flow runAs:'system'. Otherwise confirm this node only targets records whose readonlyWhen predicate is FALSE.`
+          });
+        }
+      }
+    });
+  });
+  return findings;
+}
+
 // src/validate-view-containers.ts
 var VIEW_CONTAINER_SHAPE = "view-container-shape";
 var CONTAINER_SLOT_KEYS = ["list", "form", "listViews", "formViews"];
@@ -642,13 +996,13 @@ function validateViewContainers(stack) {
     const rec = value;
     if (rec.viewKind != null) continue;
     if (containerViewCount(rec) > 0) continue;
-    const label = typeof rec.name === "string" ? ` ("${rec.name}")` : "";
+    const label2 = typeof rec.name === "string" ? ` ("${rec.name}")` : "";
     const hasContainerSlot = CONTAINER_SLOT_KEYS.some((k) => k in rec);
     const looksFlat = !hasContainerSlot && ["type", "columns", "data", "filter", "sort"].some((k) => k in rec);
     out.push({
       severity: "error",
       rule: VIEW_CONTAINER_SHAPE,
-      where: `views${key}${label}`,
+      where: `views${key}${label2}`,
       path: `views${key}`,
       message: looksFlat ? "Flat list-view object is not a view container: `ViewSchema` strips its keys, so it parses to an EMPTY container \u2014 zero views register and the Console renders no view for it." : "View container defines no views \u2014 all of `list` / `form` / `listViews` / `formViews` are absent or empty, so nothing registers.",
       hint: "Wrap every view in a defineView container: defineView({ list: { type, data, columns, ... }, listViews: { ... }, formViews: { ... } }). See examples/app-showcase/src/ui/views/task.view.ts."
@@ -860,7 +1214,7 @@ function looksLikeTailwind(className) {
     return false;
   });
 }
-function asArray5(v) {
+function asArray7(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -953,13 +1307,13 @@ function checkNode(node, pageName, path, findings) {
 }
 function validateResponsiveStyles(stack) {
   const findings = [];
-  const pages = asArray5(stack.pages);
+  const pages = asArray7(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     const pageName = typeof page.name === "string" ? page.name : `pages[${p}]`;
-    const regions = asArray5(page.regions);
+    const regions = asArray7(page.regions);
     for (let r = 0; r < regions.length; r++) {
-      const components = asArray5(regions[r].components);
+      const components = asArray7(regions[r].components);
       for (let c = 0; c < components.length; c++) {
         checkNode(components[c], pageName, `pages[${p}].regions[${r}].components[${c}]`, findings);
       }
@@ -970,10 +1324,10 @@ function validateResponsiveStyles(stack) {
 
 // src/validate-jsx-pages.ts
 import { parseJsx, compile } from "@objectstack/sdui-parser";
-var asArray6 = (v) => Array.isArray(v) ? v : [];
+var asArray8 = (v) => Array.isArray(v) ? v : [];
 function validateJsxPages(stack, opts = {}) {
   const findings = [];
-  const pages = asArray6(stack.pages);
+  const pages = asArray8(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "html" && page.kind !== "jsx") continue;
@@ -1020,10 +1374,10 @@ function loadSucraseTransform() {
   }
   return cachedTransform;
 }
-var asArray7 = (v) => Array.isArray(v) ? v : [];
+var asArray9 = (v) => Array.isArray(v) ? v : [];
 function validateReactPages(stack) {
   const findings = [];
-  const pages = asArray7(stack.pages);
+  const pages = asArray9(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "react") continue;
@@ -1060,7 +1414,7 @@ function validateReactPages(stack) {
 
 // src/validate-react-page-props.ts
 import { createRequire as createRequire2 } from "module";
-import { REACT_BLOCKS } from "@objectstack/spec/ui";
+import { REACT_BLOCKS, chartAggregateResultKeys } from "@objectstack/spec/ui";
 var cachedTs = null;
 function loadTypeScript() {
   if (cachedTs) return cachedTs;
@@ -1074,7 +1428,7 @@ function loadTypeScript() {
   }
   return cachedTs;
 }
-var asArray8 = (v) => Array.isArray(v) ? v : [];
+var asArray10 = (v) => Array.isArray(v) ? v : [];
 var BLOCKS = new Map(
   REACT_BLOCKS.map((b) => [
     b.tag,
@@ -1111,9 +1465,173 @@ function nearestKnown(prop, known) {
   }
   return bestD <= 2 ? best : null;
 }
+var NOT_STATIC = /* @__PURE__ */ Symbol("not-static");
+function staticValue(tsc, sf, node) {
+  if (!node) return NOT_STATIC;
+  if (tsc.isParenthesizedExpression(node)) return staticValue(tsc, sf, node.expression);
+  if (tsc.isStringLiteral(node) || tsc.isNoSubstitutionTemplateLiteral(node)) return node.text;
+  if (tsc.isNumericLiteral(node)) return Number(node.text);
+  if (node.kind === tsc.SyntaxKind.TrueKeyword) return true;
+  if (node.kind === tsc.SyntaxKind.FalseKeyword) return false;
+  if (node.kind === tsc.SyntaxKind.NullKeyword) return null;
+  if (tsc.isArrayLiteralExpression(node)) {
+    const out = [];
+    for (const el of node.elements) {
+      const v = staticValue(tsc, sf, el);
+      if (v === NOT_STATIC) return NOT_STATIC;
+      out.push(v);
+    }
+    return out;
+  }
+  if (tsc.isObjectLiteralExpression(node)) {
+    const out = {};
+    for (const p of node.properties) {
+      if (!tsc.isPropertyAssignment(p)) return NOT_STATIC;
+      const key = tsc.isIdentifier(p.name) || tsc.isStringLiteral(p.name) ? p.name.text : null;
+      if (key === null) return NOT_STATIC;
+      const v = staticValue(tsc, sf, p.initializer);
+      if (v === NOT_STATIC) return NOT_STATIC;
+      out[key] = v;
+    }
+    return out;
+  }
+  return NOT_STATIC;
+}
+function attrValue(tsc, sf, attr) {
+  const init = attr.initializer;
+  if (!init) return true;
+  if (tsc.isStringLiteral(init)) return init.text;
+  if (tsc.isJsxExpression(init)) return staticValue(tsc, sf, init.expression);
+  return NOT_STATIC;
+}
+var REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
+var REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
+var REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
+var CHART_FUNCTIONS = ["count", "sum", "avg", "min", "max"];
+var SYSTEM_FIELDS3 = /* @__PURE__ */ new Set([
+  "id",
+  "created_at",
+  "created_by",
+  "updated_at",
+  "updated_by",
+  "owner_id",
+  "organization_id",
+  "tenant_id",
+  "user_id",
+  "deleted_at"
+]);
+function namedArray(v) {
+  if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({
+      name,
+      ...def && typeof def === "object" ? def : {}
+    }));
+  }
+  return [];
+}
+function indexObjectFields(stack) {
+  const out = /* @__PURE__ */ new Map();
+  for (const obj of namedArray(stack.objects)) {
+    const name = typeof obj.name === "string" ? obj.name : void 0;
+    if (!name) continue;
+    const names = /* @__PURE__ */ new Set();
+    for (const f of namedArray(obj.fields)) {
+      if (typeof f.name === "string" && f.name) names.add(f.name);
+    }
+    out.set(name, names);
+  }
+  return out;
+}
+var isRec = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var strOf = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
+function checkObjectChart(attrs, objectFields, findings) {
+  const { values, where, path } = attrs;
+  const push = (severity, rule, message, hint) => findings.push({ severity, rule, where, path, message, hint });
+  if (values.has("data")) return;
+  const aggregate = values.get("aggregate");
+  if (aggregate === void 0 || aggregate === NOT_STATIC) return;
+  if (!isRec(aggregate)) return;
+  const fn = strOf(aggregate.function);
+  const field = strOf(aggregate.field);
+  const groupBy = aggregate.groupBy;
+  const groupByField = strOf(groupBy) ?? (isRec(groupBy) ? strOf(groupBy.field) : void 0);
+  if (fn && !CHART_FUNCTIONS.includes(fn)) {
+    push(
+      "error",
+      REACT_CHART_AGGREGATE_INVALID,
+      `aggregate.function "${fn}" is not an aggregation this chart can run.`,
+      `Use one of: ${CHART_FUNCTIONS.join(", ")}.`
+    );
+  } else if (fn && fn !== "count" && !field) {
+    push(
+      "error",
+      REACT_CHART_AGGREGATE_INVALID,
+      `aggregate.function "${fn}" has no "field" to aggregate.`,
+      'Add aggregate.field, or use function "count" (the only one that may omit it).'
+    );
+  }
+  const objectName = strOf(values.get("objectName"));
+  const known = objectName ? objectFields.get(objectName) : void 0;
+  if (objectName && known) {
+    const fieldRef = (name, prop) => {
+      if (!name) return;
+      if (name.includes(".")) return;
+      if (known.has(name) || SYSTEM_FIELDS3.has(name)) return;
+      push(
+        "error",
+        REACT_CHART_FIELD_UNKNOWN,
+        `aggregate.${prop} "${name}" is not a field on object "${objectName}" \u2014 the aggregate query has nothing to ${prop === "groupBy" ? "group by" : "aggregate"}, so the chart comes back empty.`,
+        `Fix the field name, or add "${name}" to ${objectName}.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+      );
+    };
+    fieldRef(field, "field");
+    fieldRef(groupByField, "groupBy");
+  }
+  const keys = chartAggregateResultKeys({ field, function: fn, groupBy });
+  const columns = [keys.category, keys.value].filter((k) => !!k);
+  if (columns.length === 0) return;
+  const axisRef = (name, prop) => {
+    if (!name) return;
+    if (columns.includes(name)) return;
+    if (keys.comparison && name === keys.comparison) return;
+    push(
+      "error",
+      REACT_CHART_AXIS_UNKNOWN,
+      `"${name}" is not a column this aggregate returns, so the axis plots nothing. Object-bound aggregate rows are keyed by the RAW FIELD NAMES (unlike a dataset, whose rows are keyed by measure name).`,
+      `Result columns: ${columns.join(", ")}` + (keys.comparison ? ` (plus "${keys.comparison}" with a comparison overlay)` : "") + `. Bind ${prop} to one of them.`
+    );
+  };
+  const xAxisRaw = values.get("xAxis");
+  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
+  const categoryProp = values.has("xAxisKey") ? "xAxisKey" : "xAxis.field";
+  axisRef(categoryAxis, categoryProp);
+  const yAxisRaw = values.get("yAxis");
+  const yAxisList = Array.isArray(yAxisRaw) ? yAxisRaw : yAxisRaw !== void 0 ? [yAxisRaw] : [];
+  for (const a of yAxisList) {
+    axisRef(strOf(a) ?? (isRec(a) ? strOf(a.field) : void 0), "yAxis[].field");
+  }
+  const series = values.get("series");
+  if (Array.isArray(series)) {
+    for (const s of series) {
+      if (!isRec(s)) continue;
+      const dataKey = strOf(s.dataKey);
+      axisRef(dataKey ?? strOf(s.name), dataKey ? "series[].dataKey" : "series[].name");
+    }
+  }
+  if (categoryAxis && keys.category && categoryAxis !== keys.category && categoryAxis === keys.value) {
+    push(
+      "error",
+      REACT_CHART_AXIS_UNKNOWN,
+      `${categoryProp} "${categoryAxis}" is the aggregate's VALUE column, not its category column.`,
+      `The category axis is keyed by groupBy \u2014 bind it to "${keys.category}".`
+    );
+  }
+}
 function validateReactPageProps(stack) {
   const findings = [];
-  const pages = asArray8(stack.pages);
+  const objectFields = indexObjectFields(stack);
+  const pages = asArray10(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "react") continue;
@@ -1134,12 +1652,17 @@ function validateReactPageProps(stack) {
         if (block) {
           let hasSpread = false;
           const used = /* @__PURE__ */ new Set();
+          const values = /* @__PURE__ */ new Map();
           for (const a of node.attributes.properties) {
             if (tsc.isJsxSpreadAttribute(a)) {
               hasSpread = true;
               continue;
             }
-            if (tsc.isJsxAttribute(a)) used.add(a.name.getText(sf));
+            if (tsc.isJsxAttribute(a)) {
+              const propName = a.name.getText(sf);
+              used.add(propName);
+              values.set(propName, attrValue(tsc, sf, a));
+            }
           }
           const where = `page "${name}" \u203A <${tag}>`;
           const path = `pages[${p}].source`;
@@ -1170,6 +1693,9 @@ function validateReactPageProps(stack) {
               });
             }
           }
+          if (tag === "ObjectChart" && !hasSpread) {
+            checkObjectChart({ values, where, path }, objectFields, findings);
+          }
         }
       }
       tsc.forEachChild(node, visit);
@@ -1181,11 +1707,11 @@ function validateReactPageProps(stack) {
 
 // src/validate-page-source-styling.ts
 var PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-var asArray9 = (v) => Array.isArray(v) ? v : [];
+var asArray11 = (v) => Array.isArray(v) ? v : [];
 var CLASSNAME_ATTR = /\bclassName\s*=\s*["'{]/g;
 function validatePageSourceStyling(stack) {
   const findings = [];
-  const pages = asArray9(stack.pages);
+  const pages = asArray11(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page) continue;
@@ -1214,7 +1740,7 @@ function validatePageSourceStyling(stack) {
 import { objectTitleCompleteness } from "@objectstack/spec/data";
 var TITLE_FORMAT_RETIRED = "title-format-retired";
 var TITLE_UNRESOLVABLE = "title-unresolvable";
-function asArray10(v) {
+function asArray12(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1223,7 +1749,7 @@ function asArray10(v) {
 }
 function validateRecordTitle(stack) {
   const findings = [];
-  const objects = asArray10(stack.objects);
+  const objects = asArray12(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
@@ -1259,7 +1785,7 @@ var FIELD_GROUP_UNDECLARED = "field-group-undeclared";
 var FIELD_GROUP_EMPTY = "field-group-empty";
 var FIELD_GROUP_SHADOWED = "field-group-shadowed";
 var SEMANTIC_ROLE_FIELD_UNKNOWN = "semantic-role-field-unknown";
-function asArray11(v) {
+function asArray13(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1268,7 +1794,7 @@ function asArray11(v) {
 }
 function validateSemanticRoles(stack) {
   const findings = [];
-  const objects = asArray11(stack.objects);
+  const objects = asArray13(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -1363,7 +1889,7 @@ function validateSemanticRoles(stack) {
 // src/validate-form-layout.ts
 var FORM_FIELD_UNKNOWN = "form-field-unknown";
 var FORM_COLSPAN_ABSOLUTE = "absolute-colspan-discouraged";
-function asArray12(v) {
+function asArray14(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1388,13 +1914,13 @@ function boundObject(view) {
 function validateFormLayout(stack) {
   const findings = [];
   const objectFields = /* @__PURE__ */ new Map();
-  for (const obj of asArray12(stack.objects)) {
+  for (const obj of asArray14(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : void 0;
     if (!name) continue;
     const fields = obj.fields && typeof obj.fields === "object" && !Array.isArray(obj.fields) ? Object.keys(obj.fields) : [];
     objectFields.set(name, new Set(fields));
   }
-  const views = asArray12(stack.views);
+  const views = asArray14(stack.views);
   for (let i = 0; i < views.length; i++) {
     const view = views[i];
     if (!view || typeof view !== "object") continue;
@@ -1444,7 +1970,7 @@ var VISIBILITY_ALIAS_DEPRECATED = "visibility-alias-deprecated";
 var VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
 var CANONICAL = "visibleWhen";
 var ALIASES = ["visibleOn", "visibility"];
-function asArray13(v) {
+function asArray15(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1506,7 +2032,7 @@ function isFieldObject(entry) {
 function validateVisibilityPredicates(stack, opts = {}) {
   const layer = opts.layer ?? "runtime";
   const findings = [];
-  const views = asArray13(stack.views);
+  const views = asArray15(stack.views);
   for (let i = 0; i < views.length; i++) {
     const view = views[i];
     if (!view || typeof view !== "object") continue;
@@ -1529,7 +2055,7 @@ function validateVisibilityPredicates(stack, opts = {}) {
       }
     }
   }
-  const pages = asArray13(stack.pages);
+  const pages = asArray15(stack.pages);
   for (let i = 0; i < pages.length; i++) {
     const page = pages[i];
     if (!page || typeof page !== "object") continue;
@@ -1553,7 +2079,7 @@ function validateVisibilityPredicates(stack, opts = {}) {
 // src/validate-capability-references.ts
 import { PLATFORM_CAPABILITY_NAMES } from "@objectstack/spec/security";
 var CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
-function asArray14(v) {
+function asArray16(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1578,13 +2104,13 @@ function validateCapabilityReferences(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const known = new Set(PLATFORM_CAPABILITY_NAMES);
-  for (const cap of asArray14(stack.capabilities)) {
+  for (const cap of asArray16(stack.capabilities)) {
     if (typeof cap.name === "string" && cap.name.length > 0) known.add(cap.name);
   }
-  for (const ps of asArray14(stack.permissions)) {
+  for (const ps of asArray16(stack.permissions)) {
     for (const cap of asCapArray(ps.systemPermissions)) known.add(cap);
   }
-  for (const seed of asArray14(stack.data)) {
+  for (const seed of asArray16(stack.data)) {
     if (seed.object !== "sys_capability") continue;
     for (const rec of Array.isArray(seed.records) ? seed.records : []) {
       const name = rec?.name;
@@ -1603,7 +2129,7 @@ function validateCapabilityReferences(stack) {
       hint
     });
   };
-  const objects = asArray14(stack.objects);
+  const objects = asArray16(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -1612,27 +2138,27 @@ function validateCapabilityReferences(stack) {
     for (const { cap, key } of flattenObjectRequired(obj.requiredPermissions)) {
       flag(cap, `object "${objName}"`, `${objPath}.requiredPermissions${key ? `.${key}` : ""}`);
     }
-    const fields = asArray14(obj.fields);
+    const fields = asArray16(obj.fields);
     for (const f of fields) {
       const fname = typeof f.name === "string" ? f.name : "(field)";
       for (const cap of asCapArray(f.requiredPermissions)) {
         flag(cap, `field "${objName}.${fname}"`, `${objPath}.fields.${fname}.requiredPermissions`);
       }
     }
-    for (const [ai, action] of asArray14(obj.actions).entries()) {
+    for (const [ai, action] of asArray16(obj.actions).entries()) {
       const aName = typeof action.name === "string" ? action.name : `(action ${ai})`;
       for (const cap of asCapArray(action.requiredPermissions)) {
         flag(cap, `action "${objName}.${aName}"`, `${objPath}.actions[${ai}].requiredPermissions`);
       }
     }
   }
-  for (const [i, action] of asArray14(stack.actions).entries()) {
+  for (const [i, action] of asArray16(stack.actions).entries()) {
     const aName = typeof action.name === "string" ? action.name : `(action ${i})`;
     for (const cap of asCapArray(action.requiredPermissions)) {
       flag(cap, `action "${aName}"`, `actions[${i}].requiredPermissions`);
     }
   }
-  const apps = asArray14(stack.apps);
+  const apps = asArray16(stack.apps);
   for (let i = 0; i < apps.length; i++) {
     const app = apps[i];
     if (!app || typeof app !== "object") continue;
@@ -1663,18 +2189,33 @@ import {
   ApproverType,
   APPROVAL_NODE_TYPE,
   DEPRECATED_APPROVER_TYPES,
-  canonicalApproverType
+  APPROVER_VALUE_BINDINGS,
+  approverTypeIsOrgScoped,
+  canonicalApproverType,
+  normalizeDecisionOutputs
 } from "@objectstack/spec/automation";
+import { BUILTIN_MEMBERSHIP_ROLES } from "@objectstack/spec";
+import { collectCelRootIdentifiers } from "@objectstack/formula";
 var APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 var APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
 var APPROVAL_APPROVER_TYPE_UNKNOWN = "approval-approver-type-unknown";
+var APPROVAL_APPROVER_TYPE_UNSUPPORTED = "approval-approver-type-unsupported";
 var APPROVAL_ESCALATION_REASSIGN_NO_TARGET = "approval-escalation-reassign-no-target";
-var MEMBERSHIP_TIERS = /* @__PURE__ */ new Set(["owner", "admin", "member", "guest"]);
+var APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY = "approval-approvers-may-resolve-empty";
+var APPROVAL_EXPRESSION_INVALID = "approval-expression-invalid";
+var APPROVAL_EXPRESSION_NO_EMPTY_POLICY = "approval-expression-no-empty-policy";
+var APPROVAL_DECISION_OUTPUTS_RESERVED = "approval-decision-outputs-reserved";
+var APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED = "approval-approver-cross-org-unsupported";
+var EXPRESSION_ROOTS = /* @__PURE__ */ new Set(["current", "trigger", "vars"]);
+var RESERVED_OUTPUT_KEYS = /* @__PURE__ */ new Set(["decision", "requestId"]);
+var GROUP_ROUTED_TYPES = /* @__PURE__ */ new Set(["position", "team", "department"]);
+var MEMBERSHIP_TIERS = new Set(BUILTIN_MEMBERSHIP_ROLES);
+var MEMBERSHIP_TIER_LIST = BUILTIN_MEMBERSHIP_ROLES.join("/");
 var TYPE_FIX = {
   business_unit: "department",
   bu: "department"
 };
-function asArray15(v) {
+function asArray17(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1684,7 +2225,7 @@ function asArray15(v) {
 function validateApprovalApprovers(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const flows = asArray15(stack.flows);
+  const flows = asArray17(stack.flows);
   const validTypes = new Set(ApproverType.options);
   for (let fi = 0; fi < flows.length; fi++) {
     const flow = flows[fi];
@@ -1717,14 +2258,61 @@ function validateApprovalApprovers(stack) {
           continue;
         }
         const canonical = canonicalApproverType(type);
+        if (canonical === "expression") {
+          const source = value.trim();
+          if (!source) {
+            findings.push({
+              severity: "error",
+              rule: APPROVAL_EXPRESSION_INVALID,
+              where,
+              path: `${path}.value`,
+              message: `expression approver has an empty expression \u2014 the node fails at entry.`,
+              hint: `Write a CEL expression over current.* (the record's live state at node entry), trigger.* (the submit-time snapshot) or vars.* (flow variables), e.g. current.approvers_dynamic or vars.approval_lead.picked_departments.`
+            });
+          } else {
+            const parsed = collectCelRootIdentifiers(source);
+            if (!parsed.ok) {
+              findings.push({
+                severity: "error",
+                rule: APPROVAL_EXPRESSION_INVALID,
+                where,
+                path: `${path}.value`,
+                message: `expression approver does not parse as CEL: ${parsed.error}.`,
+                hint: `Approver expressions are bare CEL (no {\u2026} template braces), e.g. current.approvers_dynamic or vars.get_reviewers.record.owner_id.`
+              });
+            } else {
+              const illegal = parsed.roots.filter((r) => !EXPRESSION_ROOTS.has(r));
+              if (illegal.length) {
+                const wantsRecord = illegal.includes("record") || illegal.includes("previous");
+                findings.push({
+                  severity: "error",
+                  rule: APPROVAL_EXPRESSION_INVALID,
+                  where,
+                  path: `${path}.value`,
+                  message: `expression approver references \`${illegal.join("`, `")}\` \u2014 only current.*, trigger.* and vars.* are available, and the node fails at entry on any other root.`,
+                  hint: wantsRecord ? `\`record\`/\`previous\` are not bound here (on this platform \`record\` always means "the record at event time", which is ambiguous at an approval node). Write current.<field> for the live value at node entry, trigger.<field> for the submit-time snapshot (vars.previous carries the pre-update row).` : `Did you mean current.<field> (live record), trigger.<field> (submit snapshot), or vars.<name> (flow variable)?`
+                });
+              }
+            }
+          }
+        } else if (a.resolveAs != null) {
+          findings.push({
+            severity: "info",
+            rule: APPROVAL_EXPRESSION_INVALID,
+            where,
+            path: `${path}.resolveAs`,
+            message: `resolveAs has no effect on a '${type}' approver \u2014 it only applies to type 'expression'.`,
+            hint: `Remove it, or switch this approver to { type: 'expression', value: '<CEL>', resolveAs: '${String(a.resolveAs)}' }.`
+          });
+        }
         if (canonical === "org_membership_level" && value && !MEMBERSHIP_TIERS.has(value.toLowerCase())) {
           findings.push({
             severity: "warning",
             rule: APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER,
             where,
             path: `${path}.value`,
-            message: `approver { type: '${type}', value: '${value}' } resolves against the better-auth org-membership tier (sys_member.role: owner/admin/member) \u2014 '${value}' is not a membership tier, so this approver matches nobody and the request stalls.`,
-            hint: `If '${value}' is an org position, author { type: 'position', value: '${value}' } (resolved via sys_user_position, ADR-0090 D3). Keep type 'org_membership_level' only for membership tiers (owner/admin/member).`
+            message: `approver { type: '${type}', value: '${value}' } resolves against the better-auth org-membership tier (sys_member.role: ${MEMBERSHIP_TIER_LIST}) \u2014 '${value}' is not a membership tier, so this approver matches nobody and the request stalls.`,
+            hint: `If '${value}' is an org position, author { type: 'position', value: '${value}' } (resolved via sys_user_position, ADR-0090 D3). Keep type 'org_membership_level' only for membership tiers (${MEMBERSHIP_TIER_LIST}) \u2014 the vocabulary is closed (ADR-0108), so a business role is always a position.`
           });
         } else if (type in DEPRECATED_APPROVER_TYPES) {
           const fix = canonicalApproverType(type);
@@ -1736,7 +2324,66 @@ function validateApprovalApprovers(stack) {
             message: `approver type '${type}' is the deprecated spelling of '${fix}' (ADR-0090 D3) and is removed in the next major.`,
             hint: `Author { type: '${fix}', value: '${value}' }. It resolves identically today.`
           });
+        } else if (APPROVER_VALUE_BINDINGS[canonical]?.source === "unsupported") {
+          findings.push({
+            severity: "warning",
+            rule: APPROVAL_APPROVER_TYPE_UNSUPPORTED,
+            where,
+            path: `${path}.type`,
+            message: `approver type '${type}' is declared but not implemented by the runtime (#3508) \u2014 the slot resolves to nobody and the request stalls.`,
+            hint: `Route to people the engine can expand: { type: 'team' | 'department' | 'position', ... }. Queue approvers need a real ownership-queue implementation before they take effect.`
+          });
         }
+        const declaredOrg = a.organization;
+        if (typeof declaredOrg === "string" && declaredOrg.trim() !== "" && ApproverType.options.includes(canonical) && !approverTypeIsOrgScoped(canonical)) {
+          findings.push({
+            severity: "error",
+            rule: APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED,
+            where,
+            path: `${path}.organization`,
+            message: `approver type '${type}' does not resolve through an organization directory, so 'organization: ${declaredOrg}' has no effect (ADR-0105 D9) \u2014 the runtime refuses it.`,
+            hint: `Drop 'organization' here. Cross-organization targeting applies to 'position', 'org_membership_level', 'department' and 'expression' approvers.`
+          });
+        }
+      }
+      const routable = approvers.filter(
+        (a) => a && typeof a === "object" && typeof a.type === "string"
+      );
+      if (routable.length > 0 && routable.every((a) => GROUP_ROUTED_TYPES.has(canonicalApproverType(String(a.type))))) {
+        const locks = cfg.lockRecord !== false;
+        findings.push({
+          severity: "info",
+          rule: APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY,
+          where,
+          path: `flows[${fi}].nodes[${ni}].config.approvers`,
+          message: `every approver on this node routes to a group (position/team/department) whose members are runtime data \u2014 if none is staffed, the request resolves to an empty slate and waits forever` + (locks ? `, and (lockRecord) the record stays locked with no in-product recovery.` : `.`),
+          hint: `Make sure at least one target is always staffed, or add a guaranteed-staffed fallback approver, e.g. { type: 'org_membership_level', value: 'owner' }. A request that still lands empty is recoverable only by a platform/tenant admin override (#3424).`
+        });
+      }
+      const hasExpression = approvers.some(
+        (a) => a && typeof a === "object" && canonicalApproverType(String(a.type ?? "")) === "expression"
+      );
+      if (hasExpression && cfg.onEmptyApprovers == null) {
+        findings.push({
+          severity: "info",
+          rule: APPROVAL_EXPRESSION_NO_EMPTY_POLICY,
+          where,
+          path: `flows[${fi}].nodes[${ni}].config`,
+          message: `this node resolves approvers from an expression but declares no onEmptyApprovers \u2014 an empty result falls back to the default ('admin_rescue': request opens, only a privileged admin can act).`,
+          hint: `Declare the empty-slate policy explicitly: onEmptyApprovers: 'admin_rescue' (hold for admin takeover), 'fail' (fail the node \u2014 config bug), or 'auto_approve' (wave through, output.autoApproved = true).`
+        });
+      }
+      const declaredOutputs = normalizeDecisionOutputs(cfg.decisionOutputs).map((d) => d.key);
+      const reserved = declaredOutputs.filter((k) => RESERVED_OUTPUT_KEYS.has(k));
+      if (reserved.length) {
+        findings.push({
+          severity: "error",
+          rule: APPROVAL_DECISION_OUTPUTS_RESERVED,
+          where,
+          path: `flows[${fi}].nodes[${ni}].config.decisionOutputs`,
+          message: `decisionOutputs declares reserved key(s) \`${reserved.join("`, `")}\` \u2014 the resume envelope owns them, so every decide carrying them is rejected.`,
+          hint: `Rename the output key(s); any name other than 'decision'/'requestId' works.`
+        });
       }
       const escalation = cfg.escalation ?? null;
       if (escalation && typeof escalation === "object" && escalation.action === "reassign") {
@@ -1757,33 +2404,123 @@ function validateApprovalApprovers(stack) {
   return findings;
 }
 
-// src/validate-security-posture.ts
-import { describeAnchorForbiddenBits } from "@objectstack/spec/security";
-var SECURITY_OWD_UNSET = "security-owd-unset";
-var SECURITY_OWD_ALIAS = "security-owd-alias";
-var SECURITY_EXTERNAL_WIDER = "security-external-wider-than-internal";
-var SECURITY_WILDCARD_VAMA = "security-wildcard-vama";
-var SECURITY_ANCHOR_HIGH_PRIVILEGE = "security-anchor-high-privilege";
-var SECURITY_ROLE_WORD = "security-role-word";
-var SECURITY_BOOK_AUDIENCE_UNKNOWN_SET = "security-book-audience-unknown-set";
-var SECURITY_PRIVATE_NO_READSCOPE = "security-private-no-readscope";
-var SECURITY_MASTER_DETAIL_UNGRANTED = "security-master-detail-ungranted";
-var SECURITY_FLS_UNQUALIFIED_KEY = "security-fls-unqualified-key";
-var SECURITY_GRANT_EXPIRED_AT_AUTHORING = "security-grant-expired-at-authoring";
-var SECURITY_DELEGATION_MISSING_REASON = "security-delegation-missing-reason";
-var CANONICAL_OWD = ["private", "public_read", "public_read_write", "controlled_by_parent"];
-var OWD_ALIAS_FIX = {
-  read: "public_read",
-  read_write: "public_read_write",
-  full: "public_read_write",
-  public: "public_read_write"
+// src/validate-seed-replay-safety.ts
+var SEED_INSERT_MODE_DUPLICATES_ON_REPLAY = "seed-insert-mode-duplicates-on-replay";
+function validateSeedReplaySafety(stack) {
+  const out = [];
+  const seeds = Array.isArray(stack.data) ? stack.data : [];
+  seeds.forEach((seed, i) => {
+    if (!seed || typeof seed !== "object") return;
+    if (seed.mode !== "insert") return;
+    const object = typeof seed.object === "string" ? seed.object : void 0;
+    const where = object ? `seed "${object}"` : `data[${i}]`;
+    out.push({
+      severity: "warning",
+      rule: SEED_INSERT_MODE_DUPLICATES_ON_REPLAY,
+      where,
+      path: `data[${i}].mode`,
+      message: "`mode: 'insert'` re-inserts every record on each replay boot (dev-server restart, package re-publish) with no existing-row check, so the dataset duplicates the table on every restart \u2014 seeds are replayed, not applied once.",
+      hint: "Use `mode: 'ignore'` (skip rows that already exist) or `'upsert'` (create-or-update), and declare an `externalId` to match on: a single natural-key field (e.g. `externalId: 'code'`), or a COMPOSITE list of fields for a join / junction table with no single natural key (e.g. `externalId: ['team', 'project']`)."
+    });
+  });
+  return out;
+}
+
+// src/validate-seed-state-machine.ts
+var SEED_VALUE_OUTSIDE_STATE_MACHINE = "seed-value-outside-state-machine";
+function fsmRulesByObject(objects) {
+  const map = /* @__PURE__ */ new Map();
+  for (const obj of objects) {
+    if (!obj || typeof obj !== "object") continue;
+    const name = typeof obj.name === "string" ? obj.name : void 0;
+    if (!name) continue;
+    const validations = Array.isArray(obj.validations) ? obj.validations : [];
+    const rules = [];
+    for (const v of validations) {
+      if (!v || typeof v !== "object" || v.type !== "state_machine") continue;
+      const field = typeof v.field === "string" ? v.field : void 0;
+      if (!field) continue;
+      const transitions = v.transitions && typeof v.transitions === "object" ? v.transitions : {};
+      const states = /* @__PURE__ */ new Set();
+      for (const s of Array.isArray(v.initialStates) ? v.initialStates : []) states.add(String(s));
+      for (const from of Object.keys(transitions)) {
+        states.add(String(from));
+        const targets = transitions[from];
+        for (const to of Array.isArray(targets) ? targets : []) states.add(String(to));
+      }
+      if (states.size > 0) rules.push({ field, states });
+    }
+    if (rules.length > 0) map.set(name, rules);
+  }
+  return map;
+}
+function recordLabel(record, externalId, index) {
+  const keys = Array.isArray(externalId) ? externalId.map(String) : typeof externalId === "string" ? [externalId] : ["name"];
+  const parts = keys.map((k) => record[k]).filter((v) => v != null && v !== "");
+  return parts.length > 0 ? parts.map(String).join(" \xB7 ") : `#${index}`;
+}
+function validateSeedStateMachine(stack) {
+  const out = [];
+  const objects = Array.isArray(stack.objects) ? stack.objects : [];
+  const seeds = Array.isArray(stack.data) ? stack.data : [];
+  if (objects.length === 0 || seeds.length === 0) return out;
+  const rulesByObject = fsmRulesByObject(objects);
+  if (rulesByObject.size === 0) return out;
+  seeds.forEach((seed, i) => {
+    if (!seed || typeof seed !== "object") return;
+    const objectName = typeof seed.object === "string" ? seed.object : void 0;
+    if (!objectName) return;
+    const rules = rulesByObject.get(objectName);
+    if (!rules) return;
+    const records = Array.isArray(seed.records) ? seed.records : [];
+    records.forEach((record, j) => {
+      if (!record || typeof record !== "object") return;
+      for (const rule of rules) {
+        const value = record[rule.field];
+        if (value == null || value === "") continue;
+        if (typeof value !== "string") continue;
+        if (rule.states.has(value)) continue;
+        out.push({
+          severity: "warning",
+          rule: SEED_VALUE_OUTSIDE_STATE_MACHINE,
+          where: `seed "${objectName}" (${recordLabel(record, seed.externalId, j)})`,
+          path: `data[${i}].records[${j}].${rule.field}`,
+          message: `seeds '${rule.field}=${value}', which the '${objectName}' state machine does not declare (known states: ${[...rule.states].sort().join(", ")}). Seed writes are exempt from the state_machine rule (#3433), so this is NOT rejected at write time \u2014 a typo lands silently.`,
+          hint: `If '${value}' is a real state, add it to the state machine (as an initial state or a transition endpoint). If it is a typo, correct it to a declared state. The exemption lets a seed be born mid-lifecycle; it is not a licence to write an unknown state.`
+        });
+      }
+    });
+  });
+  return out;
+}
+
+// src/validate-security-posture.ts
+import { describeAnchorForbiddenBits } from "@objectstack/spec/security";
+var SECURITY_OWD_UNSET = "security-owd-unset";
+var SECURITY_OWD_ALIAS = "security-owd-alias";
+var SECURITY_EXTERNAL_WIDER = "security-external-wider-than-internal";
+var SECURITY_WILDCARD_VAMA = "security-wildcard-vama";
+var SECURITY_ANCHOR_HIGH_PRIVILEGE = "security-anchor-high-privilege";
+var SECURITY_ROLE_WORD = "security-role-word";
+var SECURITY_BOOK_AUDIENCE_UNKNOWN_SET = "security-book-audience-unknown-set";
+var SECURITY_PRIVATE_NO_READSCOPE = "security-private-no-readscope";
+var SECURITY_MASTER_DETAIL_UNGRANTED = "security-master-detail-ungranted";
+var SECURITY_FLS_UNQUALIFIED_KEY = "security-fls-unqualified-key";
+var SECURITY_GRANT_EXPIRED_AT_AUTHORING = "security-grant-expired-at-authoring";
+var SECURITY_DELEGATION_MISSING_REASON = "security-delegation-missing-reason";
+var CANONICAL_OWD = ["private", "public_read", "public_read_write", "controlled_by_parent"];
+var OWD_ALIAS_FIX = {
+  read: "public_read",
+  read_write: "public_read_write",
+  full: "public_read_write",
+  public: "public_read_write"
 };
 var OWD_WIDTH = {
   private: 0,
   public_read: 1,
   public_read_write: 2
 };
-function asArray16(v) {
+function asArray18(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1800,16 +2537,16 @@ function identifierHasRoleToken(name) {
   if (typeof name !== "string") return false;
   return name.toLowerCase().split(/[^a-z0-9]+/).some((tok) => tok === "role" || tok === "roles");
 }
-function labelHasRoleWord(label) {
-  if (typeof label !== "string") return false;
-  return /\brole(s)?\b/i.test(label);
+function labelHasRoleWord(label2) {
+  if (typeof label2 !== "string") return false;
+  return /\brole(s)?\b/i.test(label2);
 }
 function refOf(def) {
   const r = def.reference ?? def.reference_to;
   return typeof r === "string" && r ? r : void 0;
 }
 function firstMasterDetailField(obj) {
-  for (const f of asArray16(obj.fields)) {
+  for (const f of asArray18(obj.fields)) {
     if (f.type === "master_detail") {
       return { name: String(f.name ?? "?"), parent: refOf(f) };
     }
@@ -1822,8 +2559,8 @@ function grantsObjectAccess(p) {
 function validateSecurityPosture(stack, opts) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const objects = asArray16(stack.objects);
-  const permissionSets = asArray16(stack.permissions);
+  const objects = asArray18(stack.objects);
+  const permissionSets = asArray18(stack.permissions);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -1926,7 +2663,7 @@ function validateSecurityPosture(stack, opts) {
       }
     }
   }
-  const flagRole = (kind, name, label, where, path) => {
+  const flagRole = (kind, name, label2, where, path) => {
     if (identifierHasRoleToken(name)) {
       findings.push({
         severity: "error",
@@ -1936,13 +2673,13 @@ function validateSecurityPosture(stack, opts) {
         message: `${kind} name "${String(name)}" uses the reserved word "role" \u2014 the platform vocabulary is permission_set (capability), position (distribution), business_unit (hierarchy) (ADR-0090 D3).`,
         hint: `Rename using 'position' for distribution groups or a domain word (e.g. 'function', 'duty').`
       });
-    } else if (labelHasRoleWord(label)) {
+    } else if (labelHasRoleWord(label2)) {
       findings.push({
         severity: "error",
         rule: SECURITY_ROLE_WORD,
         where,
         path: `${path.replace(/\.name$/, "")}.label`,
-        message: `${kind} label "${String(label)}" uses the reserved word "role" (ADR-0090 D3).`,
+        message: `${kind} label "${String(label2)}" uses the reserved word "role" (ADR-0090 D3).`,
         hint: `Relabel with 'Position' (distribution) or a domain word \u2014 admins must meet ONE vocabulary.`
       });
     }
@@ -1952,10 +2689,10 @@ function validateSecurityPosture(stack, opts) {
     if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
     const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
     flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
-    for (const f of asArray16(obj.fields)) {
+    for (const f of asArray18(obj.fields)) {
       flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
     }
-    for (const [ai, action] of asArray16(obj.actions).entries()) {
+    for (const [ai, action] of asArray18(obj.actions).entries()) {
       flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
     }
   }
@@ -1964,19 +2701,19 @@ function validateSecurityPosture(stack, opts) {
     if (!ps || typeof ps !== "object") continue;
     flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
   }
-  for (const [i, pos] of asArray16(stack.positions).entries()) {
+  for (const [i, pos] of asArray18(stack.positions).entries()) {
     flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
   }
-  for (const [i, app] of asArray16(stack.apps).entries()) {
+  for (const [i, app] of asArray18(stack.apps).entries()) {
     flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
   }
-  for (const [i, book] of asArray16(stack.books).entries()) {
+  for (const [i, book] of asArray18(stack.books).entries()) {
     flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
   }
   const stackSetNames = new Set(
     permissionSets.map((ps) => typeof ps.name === "string" ? ps.name : void 0).filter((n) => !!n)
   );
-  for (const [i, book] of asArray16(stack.books).entries()) {
+  for (const [i, book] of asArray18(stack.books).entries()) {
     const audience = book.audience;
     if (!audience || typeof audience !== "object") continue;
     const setName = audience.permissionSet;
@@ -2054,7 +2791,7 @@ function validateSecurityPosture(stack, opts) {
   }
   const GRANT_SEED_OBJECTS = /* @__PURE__ */ new Set(["sys_user_position", "sys_user_permission_set"]);
   const nowMs = opts?.nowMs ?? Date.now();
-  for (const [i, seed] of asArray16(stack.data).entries()) {
+  for (const [i, seed] of asArray18(stack.data).entries()) {
     const seedObject = typeof seed.object === "string" ? seed.object : "";
     if (!GRANT_SEED_OBJECTS.has(seedObject)) continue;
     const records = Array.isArray(seed.records) ? seed.records : [];
@@ -2094,10 +2831,103 @@ function validateSecurityPosture(stack, opts) {
   return findings;
 }
 
+// src/validate-org-axis-red-lines.ts
+var ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
+var ORG_AXIS_CROSS_ORG_BU_GRANT = "org-axis-cross-org-bu-grant";
+var ORG_PARENT_FIELD = "parent_organization_id";
+function asArray19(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function str(v) {
+  return typeof v === "string" ? v : "";
+}
+function isTenancyDisabled(object) {
+  const tenancy = object.tenancy;
+  if (tenancy && typeof tenancy === "object" && tenancy.enabled === false) return true;
+  const systemFields = object.systemFields;
+  if (systemFields && typeof systemFields === "object" && systemFields.tenant === false) return true;
+  return false;
+}
+var INHERITANCE_HINT = `Remove the ${ORG_PARENT_FIELD} reference. Cross-organization visibility comes from MEMBERSHIP: under the \`group\` tenancy posture the engine's Layer 0 wall is \`organization_id IN accessible_org_ids\`, so a user who should see several organizations is made a member of them (ADR-0105 D2). A Layer-1 policy cannot widen Layer 0 anyway, so this rule would not grant the access it appears to. For a hierarchy INSIDE one organization, use the business-unit tree (\`unit_and_subordinates\` sharing, or a depth scope anchored on \`sys_user_position\`).`;
+function validateOrgAxisRedLines(stack) {
+  const findings = [];
+  const cfg = stack ?? {};
+  const permissionSets = asArray19(cfg.permissions ?? cfg.permissionSets);
+  permissionSets.forEach((ps, psIndex) => {
+    asArray19(ps.rowLevelSecurity).forEach((policy, pIndex) => {
+      for (const clause of ["using", "check"]) {
+        if (!str(policy[clause]).includes(ORG_PARENT_FIELD)) continue;
+        findings.push({
+          severity: "error",
+          rule: ORG_AXIS_PERMISSION_INHERITANCE,
+          where: `permission set "${str(ps.name) || psIndex}" policy "${str(policy.name) || pIndex}"`,
+          path: `permissions[${psIndex}].rowLevelSecurity[${pIndex}].${clause}`,
+          message: `RLS ${clause} reads \`${ORG_PARENT_FIELD}\`, which builds a permission hierarchy along the organization axis. ADR-0105 D6 forbids it: the org tree is a REPORTING dimension only.`,
+          hint: INHERITANCE_HINT
+        });
+      }
+    });
+  });
+  const objects = asArray19(cfg.objects);
+  objects.forEach((object, oIndex) => {
+    const objectName = str(object.name) || String(oIndex);
+    asArray19(object.rowLevelSecurity ?? object.rls).forEach((policy, pIndex) => {
+      for (const clause of ["using", "check"]) {
+        if (!str(policy[clause]).includes(ORG_PARENT_FIELD)) continue;
+        findings.push({
+          severity: "error",
+          rule: ORG_AXIS_PERMISSION_INHERITANCE,
+          where: `object "${objectName}" policy "${str(policy.name) || pIndex}"`,
+          path: `objects[${oIndex}].rowLevelSecurity[${pIndex}].${clause}`,
+          message: `RLS ${clause} reads \`${ORG_PARENT_FIELD}\`, which builds a permission hierarchy along the organization axis. ADR-0105 D6 forbids it: the org tree is a REPORTING dimension only.`,
+          hint: INHERITANCE_HINT
+        });
+      }
+    });
+  });
+  asArray19(cfg.sharingRules ?? cfg.sharing).forEach((rule, rIndex) => {
+    const criteria = JSON.stringify(rule.criteria ?? rule.filter ?? "");
+    const sharedTo = JSON.stringify(rule.sharedTo ?? rule.recipient ?? "");
+    if (criteria.includes(ORG_PARENT_FIELD) || sharedTo.includes(ORG_PARENT_FIELD)) {
+      findings.push({
+        severity: "error",
+        rule: ORG_AXIS_PERMISSION_INHERITANCE,
+        where: `sharing rule "${str(rule.name) || rIndex}"`,
+        path: `sharingRules[${rIndex}]`,
+        message: `Sharing rule reads \`${ORG_PARENT_FIELD}\`, granting access by walking the organization tree. ADR-0105 D6 forbids permission inheritance along the org axis.`,
+        hint: INHERITANCE_HINT
+      });
+    }
+  });
+  const tenancyDisabledObjects = new Set(
+    objects.filter((o) => isTenancyDisabled(o)).map((o) => str(o.name)).filter(Boolean)
+  );
+  asArray19(cfg.sharingRules ?? cfg.sharing).forEach((rule, rIndex) => {
+    const target = str(rule.object ?? rule.objectName);
+    if (!target || !tenancyDisabledObjects.has(target)) return;
+    const sharedTo = rule.sharedTo ?? rule.recipient;
+    const recipientType = str(sharedTo?.type);
+    if (recipientType !== "business_unit") return;
+    findings.push({
+      severity: "error",
+      rule: ORG_AXIS_CROSS_ORG_BU_GRANT,
+      where: `sharing rule "${str(rule.name) || rIndex}" on object "${target}"`,
+      path: `sharingRules[${rIndex}].sharedTo`,
+      message: `A business-unit sharing rule targets "${target}", which opted out of tenancy (\`tenancy.enabled: false\`). Platform-global objects carry no organization column, so this grant spans EVERY organization \u2014 a cross-organization business-unit grant, which ADR-0105 D6 forbids (BU trees are org-internal).`,
+      hint: `Either scope the object to organizations (drop \`tenancy.enabled: false\` so Layer 0 walls it), or share it to a position / permission-set audience instead of a business unit. A platform-global catalog that everyone should read wants an OWD of \`public_read\`, not a BU grant.`
+    });
+  });
+  return findings;
+}
+
 // src/validate-dashboard-action-refs.ts
 var DASHBOARD_ACTION_TARGET_UNDEFINED = "dashboard-action-target-undefined";
 var DASHBOARD_ACTION_ROUTE_UNRESOLVED = "dashboard-action-route-unresolved";
-function asArray17(v) {
+function asArray20(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -2131,14 +2961,14 @@ function collectKnownTargets(stack) {
   const pages = /* @__PURE__ */ new Set();
   const views = /* @__PURE__ */ new Set();
   const collectNames = (v, into, name) => {
-    for (const item of asArray17(v)) {
+    for (const item of asArray20(v)) {
       if (!item || typeof item !== "object") continue;
       const n = name(item);
       if (n) into.add(n);
     }
   };
   collectNames(stack.actions, actions, (a) => strName(a.name));
-  for (const obj of asArray17(stack.objects)) {
+  for (const obj of asArray20(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
     const n = strName(obj.name);
     if (n) objects.add(n);
@@ -2178,7 +3008,7 @@ function resolveUrlRoute(target, known) {
 function validateDashboardActionRefs(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const dashboards = asArray17(stack.dashboards);
+  const dashboards = asArray20(stack.dashboards);
   if (dashboards.length === 0) return findings;
   const known = collectKnownTargets(stack);
   const checkOne = (action, where, path) => {
@@ -2218,18 +3048,18 @@ function validateDashboardActionRefs(stack) {
     if (!dash || typeof dash !== "object") continue;
     const dashName = strName(dash.name) ?? `(dashboard ${di})`;
     const dashPath = `dashboards[${di}]`;
-    const headerActions = asArray17(dash.header?.actions);
+    const headerActions = asArray20(dash.header?.actions);
     for (let ai = 0; ai < headerActions.length; ai++) {
       const action = headerActions[ai];
       if (!action || typeof action !== "object") continue;
-      const label = strName(action.label) ?? strName(action.actionUrl) ?? `#${ai}`;
+      const label2 = strName(action.label) ?? strName(action.actionUrl) ?? `#${ai}`;
       checkOne(
         action,
-        `dashboard "${dashName}" \xB7 header action "${label}"`,
+        `dashboard "${dashName}" \xB7 header action "${label2}"`,
         `${dashPath}.header.actions[${ai}].actionUrl`
       );
     }
-    const widgets = asArray17(dash.widgets);
+    const widgets = asArray20(dash.widgets);
     for (let wi = 0; wi < widgets.length; wi++) {
       const widget = widgets[wi];
       if (!widget || typeof widget !== "object") continue;
@@ -2245,114 +3075,1852 @@ function validateDashboardActionRefs(stack) {
   return findings;
 }
 
-// src/build-access-matrix.ts
-function asArray18(v) {
+// src/validate-filter-tokens.ts
+import { classifyFilterToken, CONTEXT_TOKENS } from "@objectstack/spec/data";
+var FILTER_TOKEN_UNKNOWN = "filter-token-unknown";
+var FILTER_KEYS = /* @__PURE__ */ new Set(["filter", "filters", "runtimeFilter"]);
+function asArray21(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function buildAccessMatrix(stack) {
-  const entries = [];
-  if (!stack || typeof stack !== "object") return { version: 1, entries };
-  const owdByObject = /* @__PURE__ */ new Map();
-  for (const obj of asArray18(stack.objects)) {
-    const name = typeof obj.name === "string" ? obj.name : "";
-    if (!name) continue;
-    const owd = obj.sharingModel ?? obj.security?.sharingModel;
-    if (typeof owd === "string") owdByObject.set(name, owd);
+function label(v, fallback) {
+  return typeof v === "string" && v.length > 0 ? v : fallback;
+}
+var KNOWN_LIST = CONTEXT_TOKENS.join("}, {");
+function walkFilterValues(node, path, where, out, seen) {
+  if (node === null || node === void 0) return;
+  if (typeof node === "string") {
+    const cls = classifyFilterToken(node);
+    if (cls?.kind === "unknown") {
+      const suggestion = cls.suggestion;
+      out.push({
+        severity: "error",
+        rule: FILTER_TOKEN_UNKNOWN,
+        where,
+        path,
+        message: `Filter value "${node}" is not a resolvable placeholder. It is sent to the data engine as a literal string, matches no record, and the surface renders empty.`,
+        hint: suggestion ? `Did you mean "{${suggestion}}"? Context tokens are {${KNOWN_LIST}}; time-based values use date macros such as {today} or {30_days_ago}.` : `Resolvable placeholders are the context tokens {${KNOWN_LIST}} and the date macros (e.g. {today}, {week_start}, {30_days_ago}). To filter on a literal value that happens to look like a placeholder, this is not supported \u2014 rename the value.`
+      });
+    }
+    return;
   }
-  for (const ps of asArray18(stack.permissions)) {
-    const psName = typeof ps.name === "string" ? ps.name : "";
-    if (!psName) continue;
-    const objects = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
-    for (const [objName, rawPerm] of Object.entries(objects)) {
-      const p = rawPerm ?? {};
-      const entry = {
-        permissionSet: psName,
-        object: objName,
-        create: p.allowCreate === true,
-        read: p.allowRead === true || p.viewAllRecords === true || p.modifyAllRecords === true,
-        edit: p.allowEdit === true || p.modifyAllRecords === true,
-        delete: p.allowDelete === true || p.modifyAllRecords === true,
-        viewAllRecords: p.viewAllRecords === true,
-        modifyAllRecords: p.modifyAllRecords === true
-      };
-      if (typeof p.readScope === "string") entry.readScope = p.readScope;
-      if (typeof p.writeScope === "string") entry.writeScope = p.writeScope;
-      const owd = owdByObject.get(objName);
-      if (owd) entry.sharingModel = owd;
-      entries.push(entry);
+  if (typeof node !== "object") return;
+  if (seen.has(node)) return;
+  seen.add(node);
+  if (Array.isArray(node)) {
+    node.forEach((v, i) => walkFilterValues(v, `${path}[${i}]`, where, out, seen));
+    return;
+  }
+  for (const [k, v] of Object.entries(node)) {
+    walkFilterValues(v, `${path}.${k}`, where, out, seen);
+  }
+}
+function scanForFilters(node, path, where, out, seen) {
+  if (!node || typeof node !== "object") return;
+  if (seen.has(node)) return;
+  seen.add(node);
+  if (Array.isArray(node)) {
+    node.forEach((v, i) => scanForFilters(v, `${path}[${i}]`, where, out, seen));
+    return;
+  }
+  for (const [k, v] of Object.entries(node)) {
+    const childPath = `${path}.${k}`;
+    if (FILTER_KEYS.has(k)) {
+      walkFilterValues(v, childPath, where, out, /* @__PURE__ */ new Set());
+      continue;
     }
+    scanForFilters(v, childPath, where, out, seen);
   }
-  entries.sort(
-    (a, b) => a.permissionSet === b.permissionSet ? a.object.localeCompare(b.object) : a.permissionSet.localeCompare(b.permissionSet)
-  );
-  return { version: 1, entries };
 }
-var BIT_LABELS = [
-  ["create", "create"],
-  ["read", "read"],
-  ["edit", "edit"],
-  ["delete", "delete"],
-  ["viewAllRecords", "View All Data"],
-  ["modifyAllRecords", "Modify All Data"]
-];
-function diffAccessMatrix(before, after) {
-  const lines = [];
-  const key = (e) => `${e.permissionSet}\0${e.object}`;
-  const beforeMap = new Map((before?.entries ?? []).map((e) => [key(e), e]));
-  const afterMap = new Map((after?.entries ?? []).map((e) => [key(e), e]));
-  for (const [k, b] of beforeMap) {
-    if (!afterMap.has(k)) {
-      lines.push(`'${b.permissionSet}' loses ALL access to '${b.object}' (entry removed)`);
+function validateFilterTokens(stack) {
+  if (!stack || typeof stack !== "object") return [];
+  const out = [];
+  const surfaces = [
+    ["dashboards", "dashboard"],
+    ["objects", "object"],
+    ["views", "view"],
+    ["reports", "report"],
+    ["datasets", "dataset"],
+    ["pages", "page"],
+    ["apps", "app"]
+  ];
+  for (const [key, kind] of surfaces) {
+    const items = asArray21(stack[key]);
+    items.forEach((item, i) => {
+      const name = label(item.name ?? item.id, `#${i}`);
+      if (kind === "dashboard") {
+        const widgets = Array.isArray(item.widgets) ? item.widgets : [];
+        widgets.forEach((w, wi) => {
+          const wName = label(w.id ?? w.title, `#${wi}`);
+          scanForFilters(
+            w,
+            `${key}[${i}].widgets[${wi}]`,
+            `dashboard "${name}" \xB7 widget "${wName}"`,
+            out,
+            /* @__PURE__ */ new Set()
+          );
+        });
+        const { widgets: _skip, ...rest } = item;
+        scanForFilters(rest, `${key}[${i}]`, `dashboard "${name}"`, out, /* @__PURE__ */ new Set());
+        return;
+      }
+      scanForFilters(item, `${key}[${i}]`, `${kind} "${name}"`, out, /* @__PURE__ */ new Set());
+    });
+  }
+  return out;
+}
+
+// src/validate-object-references.ts
+import {
+  hasPlatformObjectPrefix,
+  isPlatformProvidedObjectName,
+  PLATFORM_PROVIDED_OBJECT_NAMES
+} from "@objectstack/spec/system";
+var PLATFORM_NAMES = [...PLATFORM_PROVIDED_OBJECT_NAMES];
+var OBJECT_REFERENCE_UNKNOWN = "object-reference-unknown";
+var OBJECT_REFERENCE_UNREGISTERED_PLATFORM = "object-reference-unregistered-platform";
+function asArray22(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName2(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function isInterpolated(target) {
+  if (target.includes("${")) return true;
+  const open = target.indexOf("{");
+  return open !== -1 && target.indexOf("}", open + 2) !== -1;
+}
+function suggest2(target, known) {
+  let best;
+  let bestScore = Infinity;
+  for (const candidate of known) {
+    const d = distance(target, candidate);
+    if (d < bestScore) {
+      bestScore = d;
+      best = candidate;
     }
   }
-  for (const [k, a] of afterMap) {
-    const b = beforeMap.get(k);
-    if (!b) {
-      const grants = BIT_LABELS.filter(([bit]) => a[bit] === true).map(([, label]) => label);
-      lines.push(`'${a.permissionSet}' gains access to '${a.object}' (${grants.join(", ") || "no bits set"})`);
-      continue;
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
+}
+function distance(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
     }
-    for (const [bit, label] of BIT_LABELS) {
-      if (b[bit] !== a[bit]) {
-        lines.push(`'${a.permissionSet}' ${a[bit] ? "gains" : "loses"} ${label} on '${a.object}'`);
+    prev = curr;
+  }
+  return prev[n];
+}
+function validateObjectReferences(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const objects = asArray22(stack.objects);
+  const ownObjects = /* @__PURE__ */ new Set();
+  for (const obj of objects) {
+    const n = strName2(obj.name);
+    if (n) ownObjects.add(n);
+  }
+  const check = (target, where, path, subject, fix) => {
+    const name = strName2(target);
+    if (!name) return;
+    if (isInterpolated(name)) return;
+    if (ownObjects.has(name)) return;
+    if (isPlatformProvidedObjectName(name)) return;
+    if (hasPlatformObjectPrefix(name)) {
+      findings.push({
+        severity: "warning",
+        rule: OBJECT_REFERENCE_UNREGISTERED_PLATFORM,
+        where,
+        path,
+        message: `${subject} "${name}" carries a platform namespace prefix, but no platform package, official plugin, or cloud runtime object registers that name \u2014 and this stack does not define it either. If nothing provides it at runtime the reference resolves to nothing and fails silently.` + suggest2(name, PLATFORM_NAMES),
+        hint: `Check the spelling against the object the providing package actually registers (e.g. "sys_approval_request", not "sys_approval_process" \u2014 the process object was removed when approval became a flow node, ADR-0019). If a third-party package genuinely provides it, this warning is expected. ${fix}`
+      });
+      return;
+    }
+    findings.push({
+      severity: "error",
+      rule: OBJECT_REFERENCE_UNKNOWN,
+      where,
+      path,
+      message: `${subject} "${name}" resolves to no object defined in this stack. The reference is inert at runtime \u2014 nothing reports the miss.` + suggest2(name, ownObjects),
+      hint: `Point it at one of this stack's objects, or at a platform object by its full name (the platform user object is "sys_user", not "user"). ${fix}` + (ownObjects.size > 0 ? ` Defined objects: ${[...ownObjects].sort().join(", ")}.` : "")
+    });
+  };
+  const checkActionParams2 = (action, actionPath, actionLabel) => {
+    const params = asArray22(action.params);
+    for (let pi = 0; pi < params.length; pi++) {
+      const param = params[pi];
+      if (!param || typeof param !== "object") continue;
+      const paramLabel = strName2(param.name) ?? strName2(param.field) ?? `#${pi}`;
+      const where = `${actionLabel} \xB7 param "${paramLabel}"`;
+      check(
+        strName2(param.reference),
+        where,
+        `${actionPath}.params[${pi}].reference`,
+        "record-picker target",
+        "Without a resolvable target the picker degrades to a raw record-id text input."
+      );
+      check(
+        strName2(param.objectOverride),
+        where,
+        `${actionPath}.params[${pi}].objectOverride`,
+        "field-backed param object",
+        "The param inherits type/options from a field on this object, so an unknown object leaves it untyped."
+      );
+    }
+  };
+  const globalActions = asArray22(stack.actions);
+  for (let ai = 0; ai < globalActions.length; ai++) {
+    const action = globalActions[ai];
+    if (!action || typeof action !== "object") continue;
+    checkActionParams2(action, `actions[${ai}]`, `action "${strName2(action.name) ?? `#${ai}`}"`);
+  }
+  for (let oi = 0; oi < objects.length; oi++) {
+    const obj = objects[oi];
+    if (!obj || typeof obj !== "object") continue;
+    const objName = strName2(obj.name) ?? `#${oi}`;
+    const objActions = asArray22(obj.actions);
+    for (let ai = 0; ai < objActions.length; ai++) {
+      const action = objActions[ai];
+      if (!action || typeof action !== "object") continue;
+      checkActionParams2(
+        action,
+        `objects[${oi}].actions[${ai}]`,
+        `object "${objName}" \xB7 action "${strName2(action.name) ?? `#${ai}`}"`
+      );
+    }
+  }
+  const dashboards = asArray22(stack.dashboards);
+  for (let di = 0; di < dashboards.length; di++) {
+    const dash = dashboards[di];
+    if (!dash || typeof dash !== "object") continue;
+    const dashName = strName2(dash.name) ?? `#${di}`;
+    const filters = asArray22(dash.globalFilters);
+    for (let fi = 0; fi < filters.length; fi++) {
+      const filter = filters[fi];
+      if (!filter || typeof filter !== "object") continue;
+      const optionsFrom = filter.optionsFrom;
+      if (!optionsFrom || typeof optionsFrom !== "object") continue;
+      check(
+        strName2(optionsFrom.object),
+        `dashboard "${dashName}" \xB7 filter "${strName2(filter.name) ?? `#${fi}`}"`,
+        `dashboards[${di}].globalFilters[${fi}].optionsFrom.object`,
+        "filter options source",
+        "The dropdown fetches its options from this object; an unknown one renders an always-empty filter."
+      );
+    }
+  }
+  const apps = asArray22(stack.apps);
+  for (let ai = 0; ai < apps.length; ai++) {
+    const app = apps[ai];
+    if (!app || typeof app !== "object") continue;
+    const appName = strName2(app.name) ?? `#${ai}`;
+    const walkNav = (items, basePath) => {
+      const navItems = asArray22(items);
+      for (let ni = 0; ni < navItems.length; ni++) {
+        const nav = navItems[ni];
+        if (!nav || typeof nav !== "object") continue;
+        const navId = strName2(nav.id) ?? `#${ni}`;
+        const where = `app "${appName}" \xB7 nav "${navId}"`;
+        const navPath = `${basePath}[${ni}]`;
+        check(
+          strName2(nav.requiresObject),
+          where,
+          `${navPath}.requiresObject`,
+          "capability gate object",
+          "The entry is hidden unless this object is registered, so a typo hides it permanently \u2014 and it suppresses the nav cross-reference check that would have caught the target."
+        );
+        if (nav.requiresObject && strName2(nav.objectName)) {
+          check(
+            strName2(nav.objectName),
+            where,
+            `${navPath}.objectName`,
+            "navigation target",
+            "Declaring `requiresObject` exempts this target from the build-time check, so it is only verified here."
+          );
+        }
+        if (Array.isArray(nav.children)) walkNav(nav.children, `${navPath}.children`);
       }
+    };
+    walkNav(app.navigation, `apps[${ai}].navigation`);
+    const areas = asArray22(app.areas);
+    for (let ri = 0; ri < areas.length; ri++) {
+      walkNav(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
     }
-    if ((b.readScope ?? "own") !== (a.readScope ?? "own")) {
-      lines.push(`'${a.permissionSet}' read depth on '${a.object}': ${b.readScope ?? "own"} \u2192 ${a.readScope ?? "own"}`);
+  }
+  return findings;
+}
+
+// src/page-walk.ts
+function isRec2(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName3(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+var SOURCE_AUTHORED_KINDS = /* @__PURE__ */ new Set(["html", "react", "jsx"]);
+function isSourceAuthoredPage(page) {
+  const kind = strName3(page.kind);
+  return kind !== void 0 && SOURCE_AUTHORED_KINDS.has(kind);
+}
+function walkPageComponents(page, pagePath) {
+  const out = [];
+  if (!isRec2(page) || isSourceAuthoredPage(page)) return out;
+  const pageObject = strName3(page.object);
+  const visit = (node, path, inheritedObject) => {
+    if (!isRec2(node)) return;
+    const props = isRec2(node.properties) ? node.properties : void 0;
+    const dataSource = isRec2(node.dataSource) ? node.dataSource : void 0;
+    const objectName = strName3(dataSource?.object) ?? strName3(props?.object) ?? inheritedObject;
+    out.push({ component: node, path, objectName });
+    if (!props) return;
+    if (Array.isArray(props.items)) {
+      for (let i = 0; i < props.items.length; i++) {
+        const item = props.items[i];
+        if (!isRec2(item) || !Array.isArray(item.children)) continue;
+        for (let c = 0; c < item.children.length; c++) {
+          visit(item.children[c], `${path}.properties.items[${i}].children[${c}]`, objectName);
+        }
+      }
     }
-    if ((b.writeScope ?? "own") !== (a.writeScope ?? "own")) {
-      lines.push(`'${a.permissionSet}' write depth on '${a.object}': ${b.writeScope ?? "own"} \u2192 ${a.writeScope ?? "own"}`);
+    if (Array.isArray(props.children)) {
+      for (let i = 0; i < props.children.length; i++) {
+        visit(props.children[i], `${path}.properties.children[${i}]`, objectName);
+      }
     }
-    if ((b.sharingModel ?? "") !== (a.sharingModel ?? "")) {
-      lines.push(`'${a.object}' record baseline (OWD): ${b.sharingModel ?? "(unset)"} \u2192 ${a.sharingModel ?? "(unset)"} (affects every principal)`);
+    for (const key of ["body", "footer"]) {
+      const slotList = props[key];
+      if (!Array.isArray(slotList)) continue;
+      for (let i = 0; i < slotList.length; i++) {
+        visit(slotList[i], `${path}.properties.${key}[${i}]`, objectName);
+      }
+    }
+  };
+  const regions = Array.isArray(page.regions) ? page.regions : [];
+  for (let r = 0; r < regions.length; r++) {
+    const region = regions[r];
+    if (!isRec2(region) || !Array.isArray(region.components)) continue;
+    for (let c = 0; c < region.components.length; c++) {
+      visit(region.components[c], `${pagePath}.regions[${r}].components[${c}]`, pageObject);
     }
   }
-  return lines;
+  const slots = isRec2(page.slots) ? page.slots : void 0;
+  if (slots) {
+    for (const [slot, value] of Object.entries(slots)) {
+      const list3 = Array.isArray(value) ? value : [value];
+      const indexed = Array.isArray(value);
+      for (let i = 0; i < list3.length; i++) {
+        visit(list3[i], `${pagePath}.slots.${slot}${indexed ? `[${i}]` : ""}`, pageObject);
+      }
+    }
+  }
+  return out;
+}
+
+// src/validate-action-name-refs.ts
+var ACTION_NAME_UNDEFINED = "action-name-undefined";
+function asArray23(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName4(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function strList(v) {
+  return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
+}
+function distance2(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+function suggest3(target, known) {
+  let best;
+  let bestScore = Infinity;
+  for (const candidate of known) {
+    const d = distance2(target, candidate);
+    if (d < bestScore) {
+      bestScore = d;
+      best = candidate;
+    }
+  }
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
+}
+function collectActionNames(stack) {
+  const names = /* @__PURE__ */ new Set();
+  for (const action of asArray23(stack.actions)) {
+    const n = strName4(action?.name);
+    if (n) names.add(n);
+  }
+  for (const obj of asArray23(stack.objects)) {
+    if (!obj || typeof obj !== "object") continue;
+    for (const action of asArray23(obj.actions)) {
+      const n = strName4(action?.name);
+      if (n) names.add(n);
+    }
+  }
+  return names;
+}
+function validateActionNameRefs(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const known = collectActionNames(stack);
+  const check = (name, where, path, surface) => {
+    if (known.has(name)) return;
+    findings.push({
+      severity: "error",
+      rule: ACTION_NAME_UNDEFINED,
+      where,
+      path,
+      message: `${surface} names action "${name}", which is defined by no action in this stack (neither \`stack.actions\` nor any object's \`actions\`). The button renders and does nothing when clicked \u2014 a dead affordance the runtime cannot dispatch.` + suggest3(name, known),
+      hint: `Define an action named "${name}" (in \`stack.actions\` or the object's \`actions\`) with the location this surface needs, remove the reference, or ignore this if the action is contributed by another installed package.` + (known.size > 0 ? ` Defined actions: ${[...known].sort().join(", ")}.` : "")
+    });
+  };
+  const views = asArray23(stack.views);
+  for (let vi = 0; vi < views.length; vi++) {
+    const view = views[vi];
+    if (!view || typeof view !== "object") continue;
+    const viewName = strName4(view.name) ?? strName4(view.object) ?? `#${vi}`;
+    const checkListContainer = (container, label2, path) => {
+      if (!container || typeof container !== "object") return;
+      const list3 = container;
+      for (const key of ["rowActions", "bulkActions"]) {
+        const names = strList(list3[key]);
+        for (let ai = 0; ai < names.length; ai++) {
+          check(
+            names[ai],
+            `view "${viewName}" \xB7 ${label2} \xB7 ${key}`,
+            `${path}.${key}[${ai}]`,
+            key === "bulkActions" ? "Bulk-action menu" : "Row-action menu"
+          );
+        }
+      }
+    };
+    checkListContainer(view.list, "list", `views[${vi}].list`);
+    const listViews = view.listViews;
+    if (listViews && typeof listViews === "object" && !Array.isArray(listViews)) {
+      for (const [key, lv] of Object.entries(listViews)) {
+        checkListContainer(lv, `listViews.${key}`, `views[${vi}].listViews.${key}`);
+      }
+    }
+  }
+  const pages = asArray23(stack.pages);
+  for (let pi = 0; pi < pages.length; pi++) {
+    const page = pages[pi];
+    if (!page || typeof page !== "object") continue;
+    const pageName = strName4(page.name) ?? `#${pi}`;
+    for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
+      const props = component.properties;
+      if (!props || typeof props !== "object") continue;
+      const names = strList(props.actionNames);
+      for (let ai = 0; ai < names.length; ai++) {
+        check(
+          names[ai],
+          `page "${pageName}" \xB7 component "${strName4(component.type) ?? "?"}"`,
+          `${path}.properties.actionNames[${ai}]`,
+          "Quick-actions bar"
+        );
+      }
+    }
+  }
+  const apps = asArray23(stack.apps);
+  for (let ai = 0; ai < apps.length; ai++) {
+    const app = apps[ai];
+    if (!app || typeof app !== "object") continue;
+    const appName = strName4(app.name) ?? `#${ai}`;
+    const walkNav = (items, basePath) => {
+      const navItems = asArray23(items);
+      for (let ni = 0; ni < navItems.length; ni++) {
+        const nav = navItems[ni];
+        if (!nav || typeof nav !== "object") continue;
+        const navPath = `${basePath}[${ni}]`;
+        const actionDef = nav.actionDef;
+        const actionName = strName4(actionDef?.actionName);
+        if (nav.type === "action" && actionName) {
+          check(
+            actionName,
+            `app "${appName}" \xB7 nav "${strName4(nav.id) ?? `#${ni}`}"`,
+            `${navPath}.actionDef.actionName`,
+            "Navigation action item"
+          );
+        }
+        if (Array.isArray(nav.children)) walkNav(nav.children, `${navPath}.children`);
+      }
+    };
+    walkNav(app.navigation, `apps[${ai}].navigation`);
+    const areas = asArray23(app.areas);
+    for (let ri = 0; ri < areas.length; ri++) {
+      walkNav(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
+    }
+  }
+  return findings;
+}
+
+// src/validate-page-field-bindings.ts
+var PAGE_FIELD_UNKNOWN = "page-field-unknown";
+var SYSTEM_FIELDS4 = /* @__PURE__ */ new Set([
+  "id",
+  "created_at",
+  "created_by",
+  "updated_at",
+  "updated_by",
+  "owner_id",
+  "organization_id",
+  "tenant_id",
+  "user_id",
+  "deleted_at"
+]);
+function asArray24(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName5(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function isRec3(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function fieldRefsFrom(value, basePath) {
+  const out = [];
+  const one = (v, path) => {
+    const bare = strName5(v);
+    if (bare) {
+      out.push({ name: bare, path });
+      return;
+    }
+    if (!isRec3(v)) return;
+    const named = strName5(v.field) ?? strName5(v.name);
+    if (named) out.push({ name: named, path: `${path}.${strName5(v.field) ? "field" : "name"}` });
+  };
+  if (Array.isArray(value)) {
+    for (let i = 0; i < value.length; i++) one(value[i], `${basePath}[${i}]`);
+  } else {
+    one(value, basePath);
+  }
+  return out;
+}
+var COMPONENT_FIELD_SPECS = {
+  "record:highlights": { props: ["fields"] },
+  // `sections`/`hideFields` are not in RecordDetailsProps, but every real page
+  // authors them (they survive because `properties` is unvalidated).
+  "record:details": { props: ["fields", "hideFields"], nestedSections: ["sections"] },
+  "record:path": { props: ["statusField"] },
+  "element:number": { props: ["field"] },
+  "element:filter": { props: ["fields"] },
+  "element:form": { props: ["fields"] },
+  // The schema says `displayField`; real pages author `labelField`. Accept both.
+  "element:record_picker": { props: ["displayField", "labelField", "searchFields"] }
+};
+var RELATED_LIST_TYPE = "record:related_list";
+function validatePageFieldBindings(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const objectFields = /* @__PURE__ */ new Map();
+  for (const obj of asArray24(stack.objects)) {
+    const name = strName5(obj.name);
+    if (!name) continue;
+    const names = /* @__PURE__ */ new Set();
+    for (const f of asArray24(obj.fields)) {
+      const fn = strName5(f.name);
+      if (fn) names.add(fn);
+    }
+    objectFields.set(name, names);
+  }
+  const pages = asArray24(stack.pages);
+  for (let pi = 0; pi < pages.length; pi++) {
+    const page = pages[pi];
+    if (!page || typeof page !== "object") continue;
+    const pageName = strName5(page.name) ?? `#${pi}`;
+    const checkRefs = (refs, objectName, where) => {
+      if (!objectName) return;
+      const known = objectFields.get(objectName);
+      if (!known) return;
+      for (const ref of refs) {
+        if (ref.name.includes(".")) continue;
+        if (known.has(ref.name) || SYSTEM_FIELDS4.has(ref.name)) continue;
+        findings.push({
+          severity: "warning",
+          rule: PAGE_FIELD_UNKNOWN,
+          where,
+          path: ref.path,
+          message: `field "${ref.name}" is not a field on object "${objectName}" \u2014 the component silently skips it, so it never renders.`,
+          hint: `Fix the field name, or add "${ref.name}" to ${objectName}. References must match the object's field names exactly.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+        });
+      }
+    };
+    for (const { component, path, objectName } of walkPageComponents(page, `pages[${pi}]`)) {
+      const type = strName5(component.type);
+      const props = isRec3(component.properties) ? component.properties : void 0;
+      if (!type || !props) continue;
+      const where = `page "${pageName}" \xB7 ${type}`;
+      if (type === RELATED_LIST_TYPE) {
+        const relatedObject = strName5(props.objectName);
+        const relatedRefs = [
+          ...fieldRefsFrom(props.columns, `${path}.properties.columns`),
+          ...fieldRefsFrom(props.sort, `${path}.properties.sort`),
+          ...fieldRefsFrom(props.filter, `${path}.properties.filter`),
+          ...fieldRefsFrom(props.relationshipField, `${path}.properties.relationshipField`)
+        ];
+        checkRefs(relatedRefs, relatedObject, where);
+        checkRefs(
+          fieldRefsFrom(props.relationshipValueField, `${path}.properties.relationshipValueField`),
+          objectName,
+          where
+        );
+        const add = isRec3(props.add) ? props.add : void 0;
+        const picker = add && isRec3(add.picker) ? add.picker : void 0;
+        if (picker) {
+          checkRefs(
+            [
+              ...fieldRefsFrom(picker.valueField, `${path}.properties.add.picker.valueField`),
+              ...fieldRefsFrom(picker.labelField, `${path}.properties.add.picker.labelField`)
+            ],
+            strName5(picker.object),
+            where
+          );
+        }
+        if (add) {
+          checkRefs(
+            fieldRefsFrom(add.linkField, `${path}.properties.add.linkField`),
+            relatedObject,
+            where
+          );
+        }
+        continue;
+      }
+      const spec = COMPONENT_FIELD_SPECS[type];
+      if (!spec) continue;
+      const refs = [];
+      for (const key of spec.props ?? []) {
+        refs.push(...fieldRefsFrom(props[key], `${path}.properties.${key}`));
+      }
+      for (const key of spec.nestedSections ?? []) {
+        const sections = Array.isArray(props[key]) ? props[key] : [];
+        for (let si = 0; si < sections.length; si++) {
+          const section = sections[si];
+          if (!isRec3(section)) continue;
+          refs.push(
+            ...fieldRefsFrom(section.fields, `${path}.properties.${key}[${si}].fields`)
+          );
+        }
+      }
+      checkRefs(refs, objectName, where);
+    }
+    const cfg = isRec3(page.interfaceConfig) ? page.interfaceConfig : void 0;
+    if (cfg) {
+      const cfgObject = strName5(cfg.source) ?? strName5(page.object);
+      const base = `pages[${pi}].interfaceConfig`;
+      const refs = [
+        ...fieldRefsFrom(cfg.columns, `${base}.columns`),
+        ...fieldRefsFrom(cfg.sort, `${base}.sort`),
+        ...fieldRefsFrom(cfg.filterBy, `${base}.filterBy`)
+      ];
+      const userFilters = isRec3(cfg.userFilters) ? cfg.userFilters : void 0;
+      if (userFilters) {
+        refs.push(...fieldRefsFrom(userFilters.fields, `${base}.userFilters.fields`));
+      }
+      checkRefs(refs, cfgObject, `page "${pageName}" \xB7 interfaceConfig`);
+    }
+  }
+  return findings;
+}
+
+// src/validate-chart-bindings.ts
+var CHART_DIMENSION_UNKNOWN = "chart-dimension-unknown";
+var CHART_MEASURE_UNKNOWN = "chart-measure-unknown";
+var CHART_DATASET_UNKNOWN = "chart-dataset-unknown";
+var CHART_AXIS_NOT_SELECTED = "chart-axis-not-selected";
+function asArray25(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName6(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function strList2(v) {
+  return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
+}
+function isRec4(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function distance3(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+function suggest4(target, known) {
+  let best;
+  let bestScore = Infinity;
+  for (const c of known) {
+    const d = distance3(target, c);
+    if (d < bestScore) {
+      bestScore = d;
+      best = c;
+    }
+  }
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
+}
+function list2(names) {
+  const all = [...names].sort();
+  return all.length ? all.join(", ") : "(none)";
+}
+function indexDatasets(stack) {
+  const out = /* @__PURE__ */ new Map();
+  for (const ds of asArray25(stack.datasets)) {
+    const name = strName6(ds.name);
+    if (!name) continue;
+    const dimensions = /* @__PURE__ */ new Set();
+    for (const d of asArray25(ds.dimensions)) {
+      const n = strName6(d.name);
+      if (n) dimensions.add(n);
+    }
+    const measures = /* @__PURE__ */ new Set();
+    for (const m of asArray25(ds.measures)) {
+      const n = strName6(m.name);
+      if (n) measures.add(n);
+    }
+    out.set(name, { dimensions, measures });
+  }
+  return out;
+}
+function validateChartBindings(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const datasets = indexDatasets(stack);
+  if (datasets.size === 0 && !stack.reports && !stack.views && !stack.pages) return findings;
+  const check = (binding) => {
+    const dsName = binding.dataset;
+    if (!dsName) return;
+    const ds = datasets.get(dsName);
+    if (!ds) {
+      findings.push({
+        severity: "error",
+        rule: CHART_DATASET_UNKNOWN,
+        where: binding.where,
+        path: `${binding.path}.dataset`,
+        message: `binds dataset "${dsName}", which resolves to no declared dataset \u2014 the chart has no data to render.`,
+        hint: `Declared datasets: ${list2(datasets.keys())}.${suggest4(dsName, datasets.keys())} Define it with defineDataset() or fix the reference (ADR-0021).`
+      });
+      return;
+    }
+    const dimensionRef = (name, path) => {
+      if (ds.dimensions.has(name)) return;
+      findings.push({
+        severity: "error",
+        rule: CHART_DIMENSION_UNKNOWN,
+        where: binding.where,
+        path,
+        message: `"${name}" is not a dimension declared by dataset "${dsName}". Post-ADR-0021 result rows are keyed by DIMENSION NAME, not the base field, so this axis renders with no categories.`,
+        hint: `Dataset dimensions: ${list2(ds.dimensions)}.${suggest4(name, ds.dimensions)} Declare the dimension on the dataset, or bind an existing one.`
+      });
+    };
+    const measureRef = (name, path, selected2) => {
+      if (!ds.measures.has(name)) {
+        findings.push({
+          severity: "error",
+          rule: CHART_MEASURE_UNKNOWN,
+          where: binding.where,
+          path,
+          message: `"${name}" is not a measure declared by dataset "${dsName}". Post-ADR-0021 result rows are keyed by MEASURE NAME (e.g. "sum_amount"), not the base field (e.g. "amount"), so this series comes back empty.`,
+          hint: `Dataset measures: ${list2(ds.measures)}.${suggest4(name, ds.measures)} Declare the measure on the dataset, or bind an existing one.`
+        });
+        return;
+      }
+      if (selected2 && selected2.size > 0 && !selected2.has(name)) {
+        findings.push({
+          severity: "warning",
+          rule: CHART_AXIS_NOT_SELECTED,
+          where: binding.where,
+          path,
+          message: `"${name}" is a declared measure of "${dsName}" but is not in this chart's selected values (${list2(selected2)}) \u2014 the query does not return it, so the series plots nothing.`,
+          hint: `Add "${name}" to \`values\`, or point the axis at a selected measure.`
+        });
+      }
+    };
+    const dimSel = binding.dimensions;
+    if (dimSel) {
+      for (let i = 0; i < dimSel.names.length; i++) {
+        dimensionRef(dimSel.names[i], `${dimSel.path}[${i}]`);
+      }
+    }
+    const valSel = binding.values;
+    const selected = new Set(valSel?.names ?? []);
+    if (valSel) {
+      for (let i = 0; i < valSel.names.length; i++) {
+        measureRef(valSel.names[i], `${valSel.path}[${i}]`);
+      }
+    }
+    if (binding.xAxis) dimensionRef(binding.xAxis.name, binding.xAxis.path);
+    if (binding.yAxis) measureRef(binding.yAxis.name, binding.yAxis.path, selected);
+    for (const s of binding.series ?? []) measureRef(s.name, s.path, selected);
+  };
+  const reports = asArray25(stack.reports);
+  for (let ri = 0; ri < reports.length; ri++) {
+    const report = reports[ri];
+    if (!isRec4(report)) continue;
+    const reportName = strName6(report.name) ?? `#${ri}`;
+    const checkReportChart = (chart, dataset, values, where, path) => {
+      if (!isRec4(chart)) return;
+      check({
+        dataset,
+        // `values` is the report's measure SELECTION, not a chart ref; feeding
+        // it in lets the yAxis "declared but not selected" check work without
+        // reporting the selection itself twice.
+        values: { names: values, path: `${path}.values` },
+        xAxis: strName6(chart.xAxis) ? { name: strName6(chart.xAxis), path: `${path}.chart.xAxis` } : void 0,
+        yAxis: strName6(chart.yAxis) ? { name: strName6(chart.yAxis), path: `${path}.chart.yAxis` } : void 0,
+        series: asArray25(chart.series).map((s, si) => ({ name: strName6(s.name), path: `${path}.chart.series[${si}].name` })).filter((s) => !!s.name),
+        where,
+        path: `${path}.chart`
+      });
+    };
+    checkReportChart(
+      report.chart,
+      strName6(report.dataset),
+      strList2(report.values),
+      `report "${reportName}" \xB7 chart`,
+      `reports[${ri}]`
+    );
+    const blocks = Array.isArray(report.blocks) ? report.blocks : [];
+    for (let bi = 0; bi < blocks.length; bi++) {
+      const block = blocks[bi];
+      if (!isRec4(block)) continue;
+      checkReportChart(
+        block.chart,
+        strName6(block.dataset),
+        strList2(block.values),
+        `report "${reportName}" \xB7 block "${strName6(block.name) ?? `#${bi}`}" chart`,
+        `reports[${ri}].blocks[${bi}]`
+      );
+    }
+  }
+  const checkListChart = (container, where, path) => {
+    if (!isRec4(container)) return;
+    const chart = container.chart;
+    if (!isRec4(chart)) return;
+    check({
+      dataset: strName6(chart.dataset),
+      dimensions: { names: strList2(chart.dimensions), path: `${path}.chart.dimensions` },
+      values: { names: strList2(chart.values), path: `${path}.chart.values` },
+      where,
+      path: `${path}.chart`
+    });
+  };
+  const views = asArray25(stack.views);
+  for (let vi = 0; vi < views.length; vi++) {
+    const view = views[vi];
+    if (!isRec4(view)) continue;
+    const viewName = strName6(view.name) ?? strName6(view.objectName) ?? `#${vi}`;
+    checkListChart(view.list, `view "${viewName}" \xB7 list chart`, `views[${vi}].list`);
+    if (isRec4(view.listViews)) {
+      for (const [key, lv] of Object.entries(view.listViews)) {
+        checkListChart(lv, `view "${viewName}" \xB7 listViews.${key} chart`, `views[${vi}].listViews.${key}`);
+      }
+    }
+  }
+  const objects = asArray25(stack.objects);
+  for (let oi = 0; oi < objects.length; oi++) {
+    const obj = objects[oi];
+    if (!isRec4(obj) || !isRec4(obj.listViews)) continue;
+    const objName = strName6(obj.name) ?? `#${oi}`;
+    for (const [key, lv] of Object.entries(obj.listViews)) {
+      checkListChart(
+        lv,
+        `object "${objName}" \xB7 listViews.${key} chart`,
+        `objects[${oi}].listViews.${key}`
+      );
+    }
+  }
+  const pages = asArray25(stack.pages);
+  for (let pi = 0; pi < pages.length; pi++) {
+    const page = pages[pi];
+    if (!isRec4(page)) continue;
+    const pageName = strName6(page.name) ?? `#${pi}`;
+    for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
+      const props = isRec4(component.properties) ? component.properties : void 0;
+      if (!props || !strName6(props.dataset)) continue;
+      const axisRefs = asArray25(props.yAxis).map((a, ai) => ({ name: strName6(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
+      const seriesRefs = asArray25(props.series).map((s, si) => ({ name: strName6(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
+      check({
+        dataset: strName6(props.dataset),
+        dimensions: { names: strList2(props.dimensions), path: `${path}.properties.dimensions` },
+        values: { names: strList2(props.values), path: `${path}.properties.values` },
+        series: [...axisRefs, ...seriesRefs],
+        where: `page "${pageName}" \xB7 ${strName6(component.type) ?? "chart"}`,
+        path: `${path}.properties`
+      });
+    }
+  }
+  return findings;
+}
+
+// src/validate-nav-access.ts
+import { isPlatformProvidedObjectName as isPlatformProvidedObjectName2 } from "@objectstack/spec/system";
+
+// src/build-access-matrix.ts
+function asArray26(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function buildAccessMatrix(stack) {
+  const entries = [];
+  if (!stack || typeof stack !== "object") return { version: 1, entries };
+  const owdByObject = /* @__PURE__ */ new Map();
+  for (const obj of asArray26(stack.objects)) {
+    const name = typeof obj.name === "string" ? obj.name : "";
+    if (!name) continue;
+    const owd = obj.sharingModel ?? obj.security?.sharingModel;
+    if (typeof owd === "string") owdByObject.set(name, owd);
+  }
+  for (const ps of asArray26(stack.permissions)) {
+    const psName = typeof ps.name === "string" ? ps.name : "";
+    if (!psName) continue;
+    const objects = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
+    for (const [objName, rawPerm] of Object.entries(objects)) {
+      const p = rawPerm ?? {};
+      const entry = {
+        permissionSet: psName,
+        object: objName,
+        create: p.allowCreate === true,
+        read: p.allowRead === true || p.viewAllRecords === true || p.modifyAllRecords === true,
+        edit: p.allowEdit === true || p.modifyAllRecords === true,
+        delete: p.allowDelete === true || p.modifyAllRecords === true,
+        viewAllRecords: p.viewAllRecords === true,
+        modifyAllRecords: p.modifyAllRecords === true
+      };
+      if (typeof p.readScope === "string") entry.readScope = p.readScope;
+      if (typeof p.writeScope === "string") entry.writeScope = p.writeScope;
+      const owd = owdByObject.get(objName);
+      if (owd) entry.sharingModel = owd;
+      entries.push(entry);
+    }
+  }
+  entries.sort(
+    (a, b) => a.permissionSet === b.permissionSet ? a.object.localeCompare(b.object) : a.permissionSet.localeCompare(b.permissionSet)
+  );
+  return { version: 1, entries };
+}
+var BIT_LABELS = [
+  ["create", "create"],
+  ["read", "read"],
+  ["edit", "edit"],
+  ["delete", "delete"],
+  ["viewAllRecords", "View All Data"],
+  ["modifyAllRecords", "Modify All Data"]
+];
+function diffAccessMatrix(before, after) {
+  const lines = [];
+  const key = (e) => `${e.permissionSet}\0${e.object}`;
+  const beforeMap = new Map((before?.entries ?? []).map((e) => [key(e), e]));
+  const afterMap = new Map((after?.entries ?? []).map((e) => [key(e), e]));
+  for (const [k, b] of beforeMap) {
+    if (!afterMap.has(k)) {
+      lines.push(`'${b.permissionSet}' loses ALL access to '${b.object}' (entry removed)`);
+    }
+  }
+  for (const [k, a] of afterMap) {
+    const b = beforeMap.get(k);
+    if (!b) {
+      const grants = BIT_LABELS.filter(([bit]) => a[bit] === true).map(([, label2]) => label2);
+      lines.push(`'${a.permissionSet}' gains access to '${a.object}' (${grants.join(", ") || "no bits set"})`);
+      continue;
+    }
+    for (const [bit, label2] of BIT_LABELS) {
+      if (b[bit] !== a[bit]) {
+        lines.push(`'${a.permissionSet}' ${a[bit] ? "gains" : "loses"} ${label2} on '${a.object}'`);
+      }
+    }
+    if ((b.readScope ?? "own") !== (a.readScope ?? "own")) {
+      lines.push(`'${a.permissionSet}' read depth on '${a.object}': ${b.readScope ?? "own"} \u2192 ${a.readScope ?? "own"}`);
+    }
+    if ((b.writeScope ?? "own") !== (a.writeScope ?? "own")) {
+      lines.push(`'${a.permissionSet}' write depth on '${a.object}': ${b.writeScope ?? "own"} \u2192 ${a.writeScope ?? "own"}`);
+    }
+    if ((b.sharingModel ?? "") !== (a.sharingModel ?? "")) {
+      lines.push(`'${a.object}' record baseline (OWD): ${b.sharingModel ?? "(unset)"} \u2192 ${a.sharingModel ?? "(unset)"} (affects every principal)`);
+    }
+  }
+  return lines;
+}
+
+// src/validate-nav-access.ts
+var NAV_OBJECT_UNGRANTED = "nav-object-ungranted";
+function asArray27(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName7(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function collectNavExposures(stack) {
+  const out = [];
+  const apps = asArray27(stack.apps);
+  for (let ai = 0; ai < apps.length; ai++) {
+    const app = apps[ai];
+    if (!app || typeof app !== "object") continue;
+    const appName = strName7(app.name) ?? `#${ai}`;
+    const walk = (items, basePath) => {
+      const navItems = asArray27(items);
+      for (let ni = 0; ni < navItems.length; ni++) {
+        const nav = navItems[ni];
+        if (!nav || typeof nav !== "object") continue;
+        const navPath = `${basePath}[${ni}]`;
+        const objectName = strName7(nav.objectName);
+        if (nav.type === "object" && objectName) {
+          out.push({
+            objectName,
+            where: `app "${appName}" \xB7 nav "${strName7(nav.id) ?? `#${ni}`}"`,
+            path: `${navPath}.objectName`
+          });
+        }
+        if (Array.isArray(nav.children)) walk(nav.children, `${navPath}.children`);
+      }
+    };
+    walk(app.navigation, `apps[${ai}].navigation`);
+    const areas = asArray27(app.areas);
+    for (let ri = 0; ri < areas.length; ri++) {
+      walk(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
+    }
+  }
+  return out;
+}
+function validateNavAccess(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const permissionSets = asArray27(stack.permissions);
+  if (permissionSets.length === 0) return findings;
+  const exposures = collectNavExposures(stack);
+  if (exposures.length === 0) return findings;
+  const ownObjects = /* @__PURE__ */ new Set();
+  for (const obj of asArray27(stack.objects)) {
+    const n = strName7(obj.name);
+    if (n) ownObjects.add(n);
+  }
+  const readable = /* @__PURE__ */ new Set();
+  for (const entry of buildAccessMatrix(stack).entries) {
+    if (entry.read) readable.add(entry.object);
+  }
+  if (readable.has("*")) return findings;
+  const reported = /* @__PURE__ */ new Set();
+  for (const exposure of exposures) {
+    const { objectName } = exposure;
+    if (reported.has(objectName)) continue;
+    if (isPlatformProvidedObjectName2(objectName)) continue;
+    if (!ownObjects.has(objectName)) continue;
+    if (readable.has(objectName)) continue;
+    reported.add(objectName);
+    findings.push({
+      severity: "warning",
+      rule: NAV_OBJECT_UNGRANTED,
+      where: exposure.where,
+      path: exposure.path,
+      message: `navigation exposes object "${objectName}", but no permission set this stack declares grants read on it \u2014 the entry renders, and opening it fails permission-denied for every principal except one holding the platform's built-in wildcard admin set. It works when you browse as an administrator and breaks for the users the app ships permission sets for.`,
+      hint: `Add "${objectName}" to a permission set's \`objects\` with \`allowRead: true\` (or \`viewAllRecords\`), gate the entry with \`requiredPermissions\`/\`visible\` if it is meant for admins only, or drop it. Ignore this if a permission set from another installed package grants it.`
+    });
+  }
+  return findings;
+}
+
+// src/validate-translation-references.ts
+import { hasPlatformObjectPrefix as hasPlatformObjectPrefix2, isPlatformProvidedObjectName as isPlatformProvidedObjectName3 } from "@objectstack/spec/system";
+var TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
+var TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
+function isRec5(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function asArray28(v) {
+  if (Array.isArray(v)) return v;
+  if (isRec5(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec5(def) ? def : {} }));
+  return [];
+}
+function strName8(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function distance4(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+function suggest5(target, known) {
+  const names = [...known];
+  const segmentMatch = names.find(
+    (candidate) => candidate.endsWith(`_${target}`) || candidate.startsWith(`${target}_`)
+  );
+  if (segmentMatch) return ` Did you mean "${segmentMatch}"?`;
+  let best;
+  let bestScore = Infinity;
+  for (const candidate of names) {
+    const d = distance4(target, candidate);
+    if (d < bestScore) {
+      bestScore = d;
+      best = candidate;
+    }
+  }
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
+}
+function listNames(names, max = 12) {
+  const all = [...names].sort();
+  if (all.length === 0) return "";
+  const shown = all.slice(0, max).join(", ");
+  return all.length > max ? `${shown}, \u2026 (${all.length} total)` : shown;
+}
+var SYSTEM_FIELDS5 = /* @__PURE__ */ new Set([
+  "id",
+  "_id",
+  "name",
+  "created_at",
+  "created_by",
+  "updated_at",
+  "updated_by",
+  "owner_id",
+  "organization_id",
+  "tenant_id",
+  "user_id",
+  "is_deleted",
+  "deleted_at",
+  "space"
+]);
+function emptyFacts() {
+  return { fields: /* @__PURE__ */ new Map(), views: /* @__PURE__ */ new Set(), actions: /* @__PURE__ */ new Map(), sections: /* @__PURE__ */ new Set() };
+}
+function collectViewRecord(view, factsFor) {
+  const recordObject = viewObjectName(view);
+  const bindingOf = (container) => viewObjectName(container) ?? recordObject;
+  const addView = (objectName, name) => {
+    if (objectName && name) factsFor(objectName).views.add(name);
+  };
+  const listBinding = isRec5(view.list) ? bindingOf(view.list) : void 0;
+  if (isRec5(view.list)) addView(listBinding, strName8(view.list.name));
+  addView(recordObject ?? listBinding, strName8(view.name));
+  for (const key of ["listViews", "formViews"]) {
+    const container = view[key];
+    if (!isRec5(container)) continue;
+    for (const [subKey, sub] of Object.entries(container)) {
+      if (!isRec5(sub)) continue;
+      const binding = bindingOf(sub) ?? listBinding;
+      addView(binding, subKey);
+      addView(binding, strName8(sub.name));
+      if (binding) {
+        for (const section of asArray28(sub.sections)) {
+          const sectionName = strName8(section.name);
+          if (sectionName) factsFor(binding).sections.add(sectionName);
+        }
+      }
+    }
+  }
+  const sectionBinding = recordObject ?? listBinding;
+  if (sectionBinding) {
+    for (const section of asArray28(view.sections)) {
+      const sectionName = strName8(section.name);
+      if (sectionName) factsFor(sectionBinding).sections.add(sectionName);
+    }
+  }
+}
+function viewObjectName(view) {
+  return strName8(view.objectName) ?? strName8(view.object) ?? (isRec5(view.data) ? strName8(view.data.object) : void 0);
+}
+function readOptions(field) {
+  const raw = field.options;
+  const values = /* @__PURE__ */ new Set();
+  const byLabel = /* @__PURE__ */ new Map();
+  if (Array.isArray(raw)) {
+    for (const opt of raw) {
+      if (typeof opt === "string") {
+        values.add(opt);
+        continue;
+      }
+      if (!isRec5(opt)) continue;
+      const value = strName8(opt.value);
+      if (!value) continue;
+      values.add(value);
+      const label2 = strName8(opt.label);
+      if (label2) byLabel.set(label2.toLowerCase(), value);
+    }
+  } else if (isRec5(raw)) {
+    for (const [value, label2] of Object.entries(raw)) {
+      values.add(value);
+      if (typeof label2 === "string" && label2.length > 0) byLabel.set(label2.toLowerCase(), value);
+    }
+  } else {
+    return void 0;
+  }
+  return values.size > 0 ? { values, byLabel } : void 0;
+}
+function buildUniverse(stack) {
+  const objects = /* @__PURE__ */ new Map();
+  const factsFor = (name) => {
+    let facts = objects.get(name);
+    if (!facts) {
+      facts = emptyFacts();
+      objects.set(name, facts);
+    }
+    return facts;
+  };
+  for (const obj of asArray28(stack.objects)) {
+    const objectName = strName8(obj.name);
+    if (!objectName) continue;
+    const facts = factsFor(objectName);
+    for (const field of asArray28(obj.fields)) {
+      const fieldName = strName8(field.name);
+      if (fieldName) facts.fields.set(fieldName, field);
+    }
+    for (const action of asArray28(obj.actions)) {
+      const actionName = strName8(action.name);
+      if (actionName) facts.actions.set(actionName, action);
+    }
+    for (const view of asArray28(obj.views)) {
+      collectViewRecord({ ...view, object: strName8(view.object) ?? objectName }, factsFor);
+    }
+    collectViewRecord({ object: objectName, listViews: obj.listViews }, factsFor);
+    for (const group of asArray28(obj.fieldGroups)) {
+      const key = strName8(group.key) ?? strName8(group.name);
+      if (key) facts.sections.add(key);
+    }
+  }
+  for (const view of asArray28(stack.views)) {
+    collectViewRecord(view, factsFor);
+  }
+  const pages = asArray28(stack.pages);
+  for (let pi = 0; pi < pages.length; pi++) {
+    for (const walked of walkPageComponents(pages[pi], `pages[${pi}]`)) {
+      if (!walked.objectName) continue;
+      const props = isRec5(walked.component.properties) ? walked.component.properties : void 0;
+      if (!props) continue;
+      for (const section of asArray28(props.sections)) {
+        const sectionName = strName8(section.name);
+        if (sectionName) factsFor(walked.objectName).sections.add(sectionName);
+      }
+    }
+  }
+  const globalActions = /* @__PURE__ */ new Map();
+  const actionOwners = /* @__PURE__ */ new Map();
+  for (const action of asArray28(stack.actions)) {
+    const actionName = strName8(action.name);
+    if (!actionName) continue;
+    const owner = strName8(action.objectName) ?? strName8(action.object);
+    if (owner) {
+      factsFor(owner).actions.set(actionName, action);
+      actionOwners.set(actionName, owner);
+    } else {
+      globalActions.set(actionName, action);
+    }
+  }
+  for (const [objectName, facts] of objects) {
+    for (const actionName of facts.actions.keys()) {
+      if (!actionOwners.has(actionName)) actionOwners.set(actionName, objectName);
+    }
+  }
+  const apps = /* @__PURE__ */ new Map();
+  for (const app of asArray28(stack.apps)) {
+    const appName = strName8(app.name);
+    if (!appName) continue;
+    const navIds = apps.get(appName) ?? /* @__PURE__ */ new Set();
+    const walkNav = (items) => {
+      for (const item of asArray28(items)) {
+        const id = strName8(item.id);
+        if (id) navIds.add(id);
+        if (item.children) walkNav(item.children);
+      }
+    };
+    walkNav(app.navigation);
+    for (const area of asArray28(app.areas)) {
+      const areaId = strName8(area.id);
+      if (areaId) navIds.add(areaId);
+      walkNav(area.navigation);
+    }
+    apps.set(appName, navIds);
+  }
+  const dashboards = /* @__PURE__ */ new Map();
+  for (const dash of asArray28(stack.dashboards)) {
+    const dashName = strName8(dash.name);
+    if (!dashName) continue;
+    const widgets = /* @__PURE__ */ new Set();
+    for (const widget of asArray28(dash.widgets)) {
+      const id = strName8(widget.id) ?? strName8(widget.name);
+      if (id) widgets.add(id);
+    }
+    const actions = /* @__PURE__ */ new Set();
+    const headerActions = [
+      ...asArray28(isRec5(dash.header) ? dash.header.actions : void 0),
+      ...asArray28(dash.actions)
+    ];
+    for (const action of headerActions) {
+      const key = strName8(action.actionUrl) ?? strName8(action.url) ?? strName8(action.name);
+      if (key) actions.add(key);
+    }
+    dashboards.set(dashName, { widgets, actions });
+  }
+  return { objects, apps, dashboards, globalActions, actionOwners };
+}
+function localePath(bundleIndex, locale) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(locale) ? `translations[${bundleIndex}].${locale}` : `translations[${bundleIndex}]["${locale}"]`;
+}
+function validateTranslationReferences(stack) {
+  const findings = [];
+  if (!isRec5(stack)) return findings;
+  const bundles = Array.isArray(stack.translations) ? stack.translations : [];
+  if (bundles.length === 0) return findings;
+  const universe = buildUniverse(stack);
+  const orphan = (where, path, message, hint) => {
+    findings.push({ severity: "warning", rule: TRANSLATION_TARGET_UNKNOWN, where, path, message, hint });
+  };
+  for (let bi = 0; bi < bundles.length; bi++) {
+    const bundle = bundles[bi];
+    if (!isRec5(bundle)) continue;
+    for (const [locale, rawData] of Object.entries(bundle)) {
+      if (!isRec5(rawData)) continue;
+      const base = localePath(bi, locale);
+      const inLocale = `locale "${locale}"`;
+      for (const [objectName, rawNode] of Object.entries(asRecord(rawData.objects))) {
+        if (!isRec5(rawNode)) continue;
+        const objPath = `${base}.objects.${objectName}`;
+        const facts = universe.objects.get(objectName);
+        if (!facts) {
+          if (isPlatformProvidedObjectName3(objectName)) continue;
+          orphan(
+            `${inLocale} \xB7 object "${objectName}"`,
+            objPath,
+            hasPlatformObjectPrefix2(objectName) ? `Translations are keyed to "${objectName}", which carries a platform namespace prefix but is registered by no platform package, official plugin, or cloud runtime object \u2014 and this stack does not define it either. Nothing resolves these keys.` + suggest5(objectName, universe.objects.keys()) : `Translations are keyed to "${objectName}", which no object in this stack defines. The resolver looks up keys derived from the metadata, so this whole subtree is dead weight \u2014 every label it carries renders untranslated.` + suggest5(objectName, universe.objects.keys()),
+            `Rename the key to the object it was written for, drop it, or ignore this if the object is contributed by another installed package.` + (universe.objects.size > 0 ? ` Defined objects: ${listNames(universe.objects.keys())}.` : "")
+          );
+          continue;
+        }
+        for (const [fieldName, rawField] of Object.entries(asRecord(rawNode.fields))) {
+          const fieldPath = `${objPath}.fields.${fieldName}`;
+          const field = facts.fields.get(fieldName);
+          if (!field) {
+            if (SYSTEM_FIELDS5.has(fieldName)) continue;
+            orphan(
+              `${inLocale} \xB7 object "${objectName}" \xB7 field "${fieldName}"`,
+              fieldPath,
+              `Translations are keyed to field "${fieldName}", which object "${objectName}" does not declare. The label renders untranslated in this locale \u2014 and because every neighbouring field DOES resolve, the hole reads as a styling quirk rather than a missing translation.` + suggest5(fieldName, facts.fields.keys()),
+              `Point the key at a declared field, or drop it if the field was removed or renamed.` + (facts.fields.size > 0 ? ` Declared fields: ${listNames(facts.fields.keys())}.` : "")
+            );
+            continue;
+          }
+          if (!isRec5(rawField)) continue;
+          checkOptionKeys(findings, {
+            optionMap: rawField.options,
+            field,
+            fieldName,
+            objectName,
+            path: `${fieldPath}.options`,
+            where: `${inLocale} \xB7 object "${objectName}" \xB7 field "${fieldName}"`
+          });
+        }
+        for (const viewName of Object.keys(asRecord(rawNode._views))) {
+          if (facts.views.has(viewName)) continue;
+          orphan(
+            `${inLocale} \xB7 object "${objectName}" \xB7 view "${viewName}"`,
+            `${objPath}._views.${viewName}`,
+            `Translations are keyed to view "${viewName}", which no view of object "${objectName}" declares. The view tab keeps its source-locale label.` + suggest5(viewName, facts.views),
+            `Match the key to the view's \`name\` (not its label), or drop it.` + (facts.views.size > 0 ? ` Declared views: ${listNames(facts.views)}.` : "")
+          );
+        }
+        for (const sectionName of Object.keys(asRecord(rawNode._sections))) {
+          if (facts.sections.has(sectionName)) continue;
+          orphan(
+            `${inLocale} \xB7 object "${objectName}" \xB7 section "${sectionName}"`,
+            `${objPath}._sections.${sectionName}`,
+            `Translations are keyed to section "${sectionName}", which nothing on object "${objectName}" declares \u2014 no \`fieldGroups[].key\`, no named form-view section, no named \`record:details\` section. The section heading stays in the source locale.` + suggest5(sectionName, facts.sections),
+            `Sections are translatable only through a STABLE NAME: give the group/section a \`key\`/\`name\` and use it here, or drop the translation.` + (facts.sections.size > 0 ? ` Declared sections: ${listNames(facts.sections)}.` : ` Object "${objectName}" declares no named section at all.`)
+          );
+        }
+        for (const [actionName, rawAction] of Object.entries(asRecord(rawNode._actions))) {
+          const actionPath = `${objPath}._actions.${actionName}`;
+          const action = facts.actions.get(actionName);
+          if (!action) {
+            orphan(
+              `${inLocale} \xB7 object "${objectName}" \xB7 action "${actionName}"`,
+              actionPath,
+              `Translations are keyed to action "${actionName}", which is defined by neither object "${objectName}"'s \`actions\` nor a \`stack.actions\` entry bound to it. The button keeps its source-locale label.` + suggest5(actionName, facts.actions.keys()),
+              `Match the key to a defined action name, move it under the object that owns the action, or drop it.` + (facts.actions.size > 0 ? ` Actions on this object: ${listNames(facts.actions.keys())}.` : "")
+            );
+            continue;
+          }
+          checkActionParams(findings, {
+            rawAction,
+            action,
+            path: actionPath,
+            where: `${inLocale} \xB7 object "${objectName}" \xB7 action "${actionName}"`,
+            subject: `action "${actionName}"`
+          });
+        }
+      }
+      for (const [actionName, rawAction] of Object.entries(asRecord(rawData.globalActions))) {
+        const actionPath = `${base}.globalActions.${actionName}`;
+        const action = universe.globalActions.get(actionName);
+        if (!action) {
+          const owner = universe.actionOwners.get(actionName);
+          orphan(
+            `${inLocale} \xB7 global action "${actionName}"`,
+            actionPath,
+            owner ? `Action "${actionName}" is bound to object "${owner}", so the resolver looks it up under \`objects.${owner}._actions.${actionName}\` \u2014 never under \`globalActions\`, which is only consulted for object-less actions. This key is never read.` : `Translations are keyed to global action "${actionName}", which no object-less action in this stack defines. The button keeps its source-locale label.` + suggest5(actionName, universe.globalActions.keys()),
+            owner ? `Move these keys under \`objects.${owner}._actions.${actionName}\`.` : `Match the key to an object-less action's name, or drop it.` + (universe.globalActions.size > 0 ? ` Object-less actions: ${listNames(universe.globalActions.keys())}.` : "")
+          );
+          continue;
+        }
+        checkActionParams(findings, {
+          rawAction,
+          action,
+          path: actionPath,
+          where: `${inLocale} \xB7 global action "${actionName}"`,
+          subject: `action "${actionName}"`
+        });
+      }
+      for (const [appName, rawApp] of Object.entries(asRecord(rawData.apps))) {
+        const appPath = `${base}.apps.${appName}`;
+        const navIds = universe.apps.get(appName);
+        if (!navIds) {
+          orphan(
+            `${inLocale} \xB7 app "${appName}"`,
+            appPath,
+            `Translations are keyed to app "${appName}", which this stack does not define. The app launcher shows the source-locale label.` + suggest5(appName, universe.apps.keys()),
+            `Match the key to an app's \`name\`, or drop it.` + (universe.apps.size > 0 ? ` Defined apps: ${listNames(universe.apps.keys())}.` : "")
+          );
+          continue;
+        }
+        if (!isRec5(rawApp)) continue;
+        for (const navId of Object.keys(asRecord(rawApp.navigation))) {
+          if (navIds.has(navId)) continue;
+          orphan(
+            `${inLocale} \xB7 app "${appName}" \xB7 navigation "${navId}"`,
+            `${appPath}.navigation.${navId}`,
+            `Translations are keyed to navigation item "${navId}", which app "${appName}" does not declare. The menu entry keeps its source-locale label.` + suggest5(navId, navIds),
+            `Match the key to the navigation item's \`id\`, or drop it.` + (navIds.size > 0 ? ` Declared navigation ids: ${listNames(navIds)}.` : "")
+          );
+        }
+      }
+      for (const [dashName, rawDash] of Object.entries(asRecord(rawData.dashboards))) {
+        const dashPath = `${base}.dashboards.${dashName}`;
+        const dash = universe.dashboards.get(dashName);
+        if (!dash) {
+          orphan(
+            `${inLocale} \xB7 dashboard "${dashName}"`,
+            dashPath,
+            `Translations are keyed to dashboard "${dashName}", which this stack does not define. The dashboard title stays in the source locale.` + suggest5(dashName, universe.dashboards.keys()),
+            `Match the key to a dashboard's \`name\`, or drop it.` + (universe.dashboards.size > 0 ? ` Defined dashboards: ${listNames(universe.dashboards.keys())}.` : "")
+          );
+          continue;
+        }
+        if (!isRec5(rawDash)) continue;
+        for (const widgetId of Object.keys(asRecord(rawDash.widgets))) {
+          if (dash.widgets.has(widgetId)) continue;
+          orphan(
+            `${inLocale} \xB7 dashboard "${dashName}" \xB7 widget "${widgetId}"`,
+            `${dashPath}.widgets.${widgetId}`,
+            `Translations are keyed to widget "${widgetId}", which dashboard "${dashName}" does not declare. The widget title stays in the source locale.` + suggest5(widgetId, dash.widgets),
+            `Match the key to the widget's \`id\`, or drop it.` + (dash.widgets.size > 0 ? ` Declared widget ids: ${listNames(dash.widgets)}.` : "")
+          );
+        }
+        for (const actionKey of Object.keys(asRecord(rawDash.actions))) {
+          if (dash.actions.has(actionKey)) continue;
+          orphan(
+            `${inLocale} \xB7 dashboard "${dashName}" \xB7 action "${actionKey}"`,
+            `${dashPath}.actions.${actionKey}`,
+            `Translations are keyed to header action "${actionKey}", which dashboard "${dashName}" does not declare. The button keeps its source-locale label.` + suggest5(actionKey, dash.actions),
+            `Header-action translations are keyed by the action's \`actionUrl\`, not its label.` + (dash.actions.size > 0 ? ` Declared header actions: ${listNames(dash.actions)}.` : "")
+          );
+        }
+      }
+    }
+  }
+  return findings;
+}
+function asRecord(v) {
+  return isRec5(v) ? v : {};
+}
+function checkOptionKeys(findings, ctx) {
+  const optionKeys = Object.keys(asRecord(ctx.optionMap));
+  if (optionKeys.length === 0) return;
+  const declared = readOptions(ctx.field);
+  if (!declared) {
+    findings.push({
+      severity: "warning",
+      rule: TRANSLATION_OPTION_KEY_UNKNOWN,
+      where: ctx.where,
+      path: ctx.path,
+      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName8(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
+      hint: `Declare the options on the field, move the translations to the field that owns them, or drop them.`
+    });
+    return;
+  }
+  for (const key of optionKeys) {
+    if (declared.values.has(key)) continue;
+    const byLabel = declared.byLabel.get(key.toLowerCase());
+    findings.push({
+      severity: "warning",
+      rule: TRANSLATION_OPTION_KEY_UNKNOWN,
+      where: ctx.where,
+      path: `${ctx.path}.${key}`,
+      message: byLabel ? `Option translation is keyed by the DISPLAY LABEL "${key}" instead of the stored value "${byLabel}". The resolver looks the option up by value, so this entry is never found and the option renders with its source-locale label.` : `Option translation is keyed by "${key}", which is not one of the values declared by field "${ctx.objectName}.${ctx.fieldName}". The option renders untranslated.` + suggest5(key, declared.values),
+      hint: byLabel ? `Rename the key to "${byLabel}".` : `Option keys are the stored \`value\`, not the label and not a variant spelling (\`direct_mail\`, not \`direct-mail\`). Declared values: ${listNames(declared.values)}.`
+    });
+  }
+}
+function checkActionParams(findings, ctx) {
+  const rawParams = Object.keys(asRecord(isRec5(ctx.rawAction) ? ctx.rawAction.params : void 0));
+  if (rawParams.length === 0) return;
+  const declared = /* @__PURE__ */ new Set();
+  for (const param of asArray28(ctx.action.params)) {
+    const name = strName8(param.name) ?? strName8(param.field);
+    if (name) declared.add(name);
+  }
+  for (const paramName of rawParams) {
+    if (declared.has(paramName)) continue;
+    findings.push({
+      severity: "warning",
+      rule: TRANSLATION_TARGET_UNKNOWN,
+      where: `${ctx.where} \xB7 param "${paramName}"`,
+      path: `${ctx.path}.params.${paramName}`,
+      message: `Translations are keyed to parameter "${paramName}", which ${ctx.subject} does not declare. The parameter's label and help text render untranslated in the action dialog.` + suggest5(paramName, declared),
+      hint: `Match the key to a declared param \`name\`, or drop it.` + (declared.size > 0 ? ` Declared params: ${listNames(declared)}.` : "")
+    });
+  }
+}
+
+// src/validate-ai-surface-affinity.ts
+var AI_SKILL_SURFACE_MISMATCH = "ai-skill-surface-mismatch";
+function asArray29(v) {
+  if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName9(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function surfaceOf(v) {
+  return typeof v === "string" && v.length > 0 ? v : "ask";
+}
+function validateAiSurfaceAffinity(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const skillsByName = /* @__PURE__ */ new Map();
+  for (const skill of asArray29(stack.skills)) {
+    const n = strName9(skill.name);
+    if (n) skillsByName.set(n, skill);
+  }
+  const agents = asArray29(stack.agents);
+  for (let ai = 0; ai < agents.length; ai++) {
+    const agent = agents[ai];
+    const agentName = strName9(agent.name) ?? `#${ai}`;
+    const agentSurface = surfaceOf(agent.surface);
+    const skillRefs = Array.isArray(agent.skills) ? agent.skills : [];
+    for (let si = 0; si < skillRefs.length; si++) {
+      const ref = strName9(skillRefs[si]);
+      if (!ref) continue;
+      const skill = skillsByName.get(ref);
+      if (!skill) continue;
+      const skillSurface = surfaceOf(skill.surface);
+      if (skillSurface === "both" || skillSurface === agentSurface) continue;
+      findings.push({
+        severity: "error",
+        rule: AI_SKILL_SURFACE_MISMATCH,
+        where: `agent "${agentName}" \xB7 skills`,
+        path: `agents[${ai}].skills[${si}]`,
+        message: `Agent "${agentName}" (surface: '${agentSurface}') references skill "${ref}" (surface: '${skillSurface}') \u2014 incompatible affinity (ADR-0064 \xA73). The runtime refuses this binding with a load error, so chatting with this agent fails at request time even though the stack parses and validates cleanly.`,
+        hint: `A skill may only attach to an agent whose surface it matches. Move "${ref}" to a '${skillSurface}'-surface agent, change its \`surface\` to '${agentSurface}', or \u2014 only if it is a genuinely shared, read-only capability \u2014 declare \`surface: 'both'\`.`
+      });
+    }
+  }
+  return findings;
+}
+
+// src/validate-ai-tool-references.ts
+import { PLATFORM_PROVIDED_TOOL_NAMES, PLATFORM_TOOL_FAMILY_PREFIXES } from "@objectstack/spec/system";
+var AI_SKILL_TOOL_UNRESOLVED = "ai-skill-tool-unresolved";
+function asArray30(v) {
+  if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName10(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function distance5(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+function suggest6(target, known) {
+  for (const prefix of PLATFORM_TOOL_FAMILY_PREFIXES) {
+    if (known.has(`${prefix}${target}`)) return ` Did you mean "${prefix}${target}"?`;
+  }
+  let best;
+  let bestScore = Infinity;
+  for (const candidate of known) {
+    const d = distance5(target, candidate);
+    if (d < bestScore) {
+      bestScore = d;
+      best = candidate;
+    }
+  }
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
+}
+var HEADLESS_ACTION_TYPES = /* @__PURE__ */ new Set(["script", "api", "flow"]);
+function materialisesAsTool(action) {
+  const ai = action.ai;
+  if (!ai || typeof ai !== "object") return false;
+  const aiRec = ai;
+  if (aiRec.exposed !== true) return false;
+  if (!strName10(aiRec.description)) return false;
+  const type = strName10(action.type);
+  if (!type || !HEADLESS_ACTION_TYPES.has(type)) return false;
+  if (type === "script") return Boolean(action.target || action.body);
+  return Boolean(action.target);
+}
+function collectToolUniverse(stack) {
+  const universe = new Set(PLATFORM_PROVIDED_TOOL_NAMES);
+  for (const tool of asArray30(stack.tools)) {
+    const n = strName10(tool.name);
+    if (n) universe.add(n);
+  }
+  const addActionFamily = (actions) => {
+    for (const action of asArray30(actions)) {
+      const n = strName10(action.name);
+      if (n && materialisesAsTool(action)) universe.add(`action_${n}`);
+    }
+  };
+  addActionFamily(stack.actions);
+  for (const obj of asArray30(stack.objects)) {
+    addActionFamily(obj.actions);
+  }
+  return universe;
+}
+function collectUnexposedActionNames(stack) {
+  const names = /* @__PURE__ */ new Set();
+  const scan = (actions) => {
+    for (const action of asArray30(actions)) {
+      const n = strName10(action.name);
+      if (n && !materialisesAsTool(action)) names.add(n);
+    }
+  };
+  scan(stack.actions);
+  for (const obj of asArray30(stack.objects)) scan(obj.actions);
+  return names;
+}
+function validateAiToolReferences(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const universe = collectToolUniverse(stack);
+  const unexposedActions = collectUnexposedActionNames(stack);
+  const resolves = (ref) => {
+    if (ref.endsWith("*")) {
+      const prefix = ref.slice(0, -1);
+      for (const name of universe) {
+        if (name.startsWith(prefix)) return true;
+      }
+      return false;
+    }
+    return universe.has(ref);
+  };
+  const skills = asArray30(stack.skills);
+  for (let si = 0; si < skills.length; si++) {
+    const skill = skills[si];
+    const skillName = strName10(skill.name) ?? `#${si}`;
+    const refs = Array.isArray(skill.tools) ? skill.tools : [];
+    for (let ti = 0; ti < refs.length; ti++) {
+      const ref = strName10(refs[ti]);
+      if (!ref || resolves(ref)) continue;
+      const isPattern = ref.endsWith("*");
+      const unexposed = !isPattern && ref.startsWith("action_") && unexposedActions.has(ref.slice("action_".length)) ? ref.slice("action_".length) : void 0;
+      findings.push({
+        severity: "warning",
+        rule: AI_SKILL_TOOL_UNRESOLVED,
+        where: `skill "${skillName}" \xB7 tools`,
+        path: `skills[${si}].tools[${ti}]`,
+        message: isPattern ? `Skill "${skillName}" subscribes to tool family "${ref}", which matches nothing this stack can resolve (no declared tool, no platform tool, and no AI-exposed declarative action materialises into it). The subscription contributes zero tools at runtime.` : unexposed ? `Skill "${skillName}" references tool "${ref}", but the action "${unexposed}" does not become an AI tool: the runtime materialises \`action_<name>\` only for an action that opts in with \`ai.exposed: true\` + \`ai.description\` (ADR-0011) AND has a headless path (type \`script\`/\`api\`/\`flow\` with a target or body \u2014 \`url\`/\`modal\`/\`form\` are UI-only). The reference is dropped at runtime, so the skill promises a capability the agent cannot call.` : `Skill "${skillName}" references tool "${ref}", which resolves to nothing this stack can see: not a \`stack.tools\` record, not a platform-registered tool, and not a materialised action tool (\`action_<name>\`). The runtime silently drops the reference, so the skill's instructions claim a capability the agent does not have \u2014 the assistant will improvise or fail when asked to use it.` + suggest6(ref, universe),
+        hint: unexposed ? `Either opt "${unexposed}" in \u2014 set \`ai: { exposed: true, description: '\u2026' }\` (\u226540 chars, LLM-facing) and give it a headless type \u2014 or drop the reference and have the skill's instructions recommend the UI action instead. A \`modal\`/\`form\`/\`url\` action stays human-driven by design; that is a legitimate answer, not a gap.` : `Back "${ref}" with a real executable: declare a declarative action (or flow), opt it in with \`ai.exposed: true\` + \`ai.description\`, and reference its materialised tool (\`action_<name>\` \u2014 the ADR-0109 default path, no tool record needed); or reference a platform tool by its registered name; or remove the reference and the instructions that mention it. Ignore this only if a runtime plugin outside the platform registry provides "${ref}". Family prefixes materialised by the runtime: ${PLATFORM_TOOL_FAMILY_PREFIXES.join(", ")}.`
+      });
+    }
+  }
+  return findings;
+}
+
+// src/validate-ai-agent-authoring.ts
+var AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
+function asArray31(v) {
+  if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName11(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+var PLATFORM_AGENT_NAMES = /* @__PURE__ */ new Set(["ask", "build", "data_chat", "metadata_assistant"]);
+function validateAiAgentAuthoring(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const agents = asArray31(stack.agents);
+  for (let ai = 0; ai < agents.length; ai++) {
+    const agent = agents[ai];
+    const name = strName11(agent.name) ?? `#${ai}`;
+    const isPlatformName = PLATFORM_AGENT_NAMES.has(name);
+    const skillCount = Array.isArray(agent.skills) ? agent.skills.length : 0;
+    findings.push({
+      severity: "warning",
+      rule: AGENT_AUTHORING_WITHDRAWN,
+      where: `agent "${name}"`,
+      path: `agents[${ai}]`,
+      message: isPlatformName ? `This stack declares an agent named "${name}", which is a PLATFORM agent id. The runtime serves its own record for that name and ignores this one \u2014 the declaration has no effect and will drift from the platform's definition.` : `This stack declares the agent "${name}", but tenant/app-package agents were withdrawn (ADR-0063 \xA72): the kernel ships exactly two agents (\`ask\`, \`build\`) and the surface the user is in binds one. The runtime filters this record out of the agent catalog and refuses to load it, so it never runs \u2014 it parses, validates, and ships as inert metadata.`,
+      hint: isPlatformName ? `Remove the declaration; the platform owns "${name}". Extend it with skills instead.` : `Delete the agent and express its capability as skills. Everything an agent carried that a skill does not is persona text: move the useful parts of \`instructions\` into the skills' own instructions.` + (skillCount > 0 ? ` The ${skillCount} skill${skillCount === 1 ? "" : "s"} this agent references already carry the capability \u2014 they attach to the platform agent by \`surface\` affinity, so nothing is lost by dropping the persona.` : ``)
+    });
+  }
+  return findings;
+}
+
+// src/reference-integrity-suite.ts
+var REFERENCE_INTEGRITY_RULES = [
+  { name: "validateObjectReferences", run: validateObjectReferences },
+  { name: "validateActionNameRefs", run: validateActionNameRefs },
+  { name: "validatePageFieldBindings", run: validatePageFieldBindings },
+  { name: "validateChartBindings", run: validateChartBindings },
+  { name: "validateNavAccess", run: validateNavAccess },
+  { name: "validateTranslationReferences", run: validateTranslationReferences },
+  { name: "validateFlowTemplatePaths", run: validateFlowTemplatePaths },
+  { name: "validateAiSurfaceAffinity", run: validateAiSurfaceAffinity },
+  { name: "validateAiToolReferences", run: validateAiToolReferences },
+  { name: "validateAiAgentAuthoring", run: validateAiAgentAuthoring }
+];
+function validateReferenceIntegrity(stack) {
+  const findings = [];
+  for (const rule of REFERENCE_INTEGRITY_RULES) {
+    findings.push(...rule.run(stack));
+  }
+  return findings;
 }
 export {
+  ACTION_NAME_UNDEFINED,
+  AGENT_AUTHORING_WITHDRAWN,
+  AI_SKILL_SURFACE_MISMATCH,
+  AI_SKILL_TOOL_UNRESOLVED,
+  APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY,
+  APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED,
   APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER,
   APPROVAL_APPROVER_TYPE_DEPRECATED,
   APPROVAL_APPROVER_TYPE_UNKNOWN,
+  APPROVAL_DECISION_OUTPUTS_RESERVED,
   APPROVAL_ESCALATION_REASSIGN_NO_TARGET,
+  APPROVAL_EXPRESSION_INVALID,
+  APPROVAL_EXPRESSION_NO_EMPTY_POLICY,
   CAPABILITY_REFERENCE_UNKNOWN,
+  CHART_AXIS_NOT_SELECTED,
   CHART_CONFIG_MISSING,
+  CHART_DATASET_UNKNOWN,
+  CHART_DIMENSION_UNKNOWN,
   CHART_FIELD_UNKNOWN,
+  CHART_MEASURE_UNKNOWN,
   DASHBOARD_ACTION_ROUTE_UNRESOLVED,
   DASHBOARD_ACTION_TARGET_UNDEFINED,
   DASHBOARD_FILTER_FIELD_UNKNOWN,
   FIELD_GROUP_EMPTY,
   FIELD_GROUP_UNDECLARED,
+  FILTER_TOKEN_UNKNOWN,
   FLOW_DRAFT_STATUS_AMBIGUOUS,
+  FLOW_TEMPLATE_LOOKUP_TRAVERSAL,
+  FLOW_TEMPLATE_UNKNOWN_FIELD,
   FLOW_TRIGGER_UNKNOWN_OBJECT,
+  FLOW_UPDATE_READONLY_FIELD,
+  FLOW_UPDATE_READONLY_WHEN_FIELD,
   FORM_COLSPAN_ABSOLUTE,
   FORM_FIELD_UNKNOWN,
   LIST_VIEW_FILTERS_IN_VIEWS_MODE,
   MEASURE_AGGREGATE_INCOHERENT,
+  NAV_OBJECT_UNGRANTED,
+  OBJECT_REFERENCE_UNKNOWN,
+  OBJECT_REFERENCE_UNREGISTERED_PLATFORM,
+  ORG_AXIS_CROSS_ORG_BU_GRANT,
+  ORG_AXIS_PERMISSION_INHERITANCE,
+  PAGE_FIELD_UNKNOWN,
   PAGE_SOURCE_CLASSNAME,
+  REACT_CHART_AGGREGATE_INVALID,
+  REACT_CHART_AXIS_UNKNOWN,
+  REACT_CHART_FIELD_UNKNOWN,
+  REFERENCE_INTEGRITY_RULES,
   SECURITY_ANCHOR_HIGH_PRIVILEGE,
   SECURITY_BOOK_AUDIENCE_UNKNOWN_SET,
   SECURITY_DELEGATION_MISSING_REASON,
@@ -2364,6 +4932,8 @@ export {
   SECURITY_PRIVATE_NO_READSCOPE,
   SECURITY_ROLE_WORD,
   SECURITY_WILDCARD_VAMA,
+  SEED_INSERT_MODE_DUPLICATES_ON_REPLAY,
+  SEED_VALUE_OUTSIDE_STATE_MACHINE,
   SEMANTIC_ROLE_FIELD_UNKNOWN,
   STYLE_CLASSNAME_TAILWIND,
   STYLE_NODE_MISSING_ID,
@@ -2373,6 +4943,8 @@ export {
   TABLE_COUNT_ONLY,
   TITLE_FORMAT_RETIRED,
   TITLE_UNRESOLVABLE,
+  TRANSLATION_OPTION_KEY_UNKNOWN,
+  TRANSLATION_TARGET_UNKNOWN,
   VIEW_CONTAINER_SHAPE,
   VISIBILITY_ALIAS_DEPRECATED,
   VISIBILITY_ROOT_MISLAYERED,
@@ -2381,21 +4953,37 @@ export {
   WIDGET_MEASURE_UNKNOWN,
   buildAccessMatrix,
   diffAccessMatrix,
+  validateActionNameRefs,
+  validateAiAgentAuthoring,
+  validateAiSurfaceAffinity,
+  validateAiToolReferences,
   validateApprovalApprovers,
   validateCapabilityReferences,
+  validateChartBindings,
   validateDashboardActionRefs,
+  validateFilterTokens,
+  validateFlowTemplatePaths,
   validateFlowTriggerReadiness,
   validateFormLayout,
   validateJsxPages,
   validateListViewMode,
+  validateNavAccess,
+  validateObjectReferences,
+  validateOrgAxisRedLines,
+  validatePageFieldBindings,
   validatePageSourceStyling,
   validateReactPageProps,
   validateReactPages,
+  validateReadonlyFlowWrites,
   validateRecordTitle,
+  validateReferenceIntegrity,
   validateResponsiveStyles,
   validateSecurityPosture,
+  validateSeedReplaySafety,
+  validateSeedStateMachine,
   validateSemanticRoles,
   validateStackExpressions,
+  validateTranslationReferences,
   validateViewContainers,
   validateVisibilityPredicates,
   validateWidgetBindings