@objectstack/lint 16.1.0 → 17.0.0-rc.1

package/dist/index.d.ts

@@ -94,7 +94,7 @@ interface WidgetBindingFinding {
     /** How to fix (or deliberately suppress) it. */
     hint: string;
 }
-type AnyRec$h = Record<string, unknown>;
+type AnyRec$x = Record<string, unknown>;
 /**
  * Validate every dashboard widget's dataset binding. Returns the list of
  * findings (empty = clean). Caller decides how to surface them: `error`
@@ -102,7 +102,7 @@ type AnyRec$h = Record<string, unknown>;
  * should fail validate/build; `warning` findings are advisory and must
  * never fail the build on their own.
  */
-declare function validateWidgetBindings(stack: AnyRec$h): WidgetBindingFinding[];
+declare function validateWidgetBindings(stack: AnyRec$x): WidgetBindingFinding[];
 
 interface ExprIssue {
     where: string;
@@ -115,12 +115,12 @@ interface ExprIssue {
      */
     severity?: 'error' | 'warning';
 }
-type AnyRec$g = Record<string, unknown>;
+type AnyRec$w = Record<string, unknown>;
 /**
  * Validate every predicate in the stack. Returns the list of issues (empty =
  * clean). Caller decides how to surface / whether to fail the build.
  */
-declare function validateStackExpressions(stack: AnyRec$g): ExprIssue[];
+declare function validateStackExpressions(stack: AnyRec$w): ExprIssue[];
 
 type ListViewModeSeverity = 'error' | 'warning';
 interface ListViewModeFinding {
@@ -134,7 +134,7 @@ interface ListViewModeFinding {
     hint: string;
 }
 declare const LIST_VIEW_FILTERS_IN_VIEWS_MODE = "list-view-filters-in-views-mode";
-type AnyRec$f = Record<string, unknown>;
+type AnyRec$v = Record<string, unknown>;
 /**
  * Flag ADR-0047 "views" mode violations on an object's built-in named views or a
  * `defineView` default `list` / named `listViews`: `quickFilters`, or a `tabs`
@@ -144,7 +144,7 @@ type AnyRec$f = Record<string, unknown>;
  *
  * Feed the PRE-parse stack (normalizeStackInput output) — see file header.
  */
-declare function validateListViewMode(stack: AnyRec$f): ListViewModeFinding[];
+declare function validateListViewMode(stack: AnyRec$v): ListViewModeFinding[];
 
 type FlowTriggerReadinessSeverity = 'error' | 'warning';
 interface FlowTriggerReadinessFinding {
@@ -159,12 +159,52 @@ interface FlowTriggerReadinessFinding {
 }
 declare const FLOW_TRIGGER_UNKNOWN_OBJECT = "flow-trigger-unknown-object";
 declare const FLOW_DRAFT_STATUS_AMBIGUOUS = "flow-draft-status-ambiguous";
-type AnyRec$e = Record<string, unknown>;
+type AnyRec$u = Record<string, unknown>;
 /**
  * Validate auto-launched flow trigger wiring against the stack definition.
  * Pure and dependency-free; safe on pre- or post-parse stacks.
  */
-declare function validateFlowTriggerReadiness(stack: AnyRec$e): FlowTriggerReadinessFinding[];
+declare function validateFlowTriggerReadiness(stack: AnyRec$u): FlowTriggerReadinessFinding[];
+
+type FlowTemplatePathSeverity = 'error' | 'warning';
+interface FlowTemplatePathFinding {
+    severity: FlowTemplatePathSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `flow "notify_lead" node "notify"`. */
+    where: string;
+    /** Config path, e.g. `flows[0].nodes[2]`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
+declare const FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
+type AnyRec$t = Record<string, unknown>;
+/**
+ * Validate `{record.<path>}` template references across every record-change
+ * flow. Pure and dependency-free; safe on pre- or post-parse stacks.
+ */
+declare function validateFlowTemplatePaths(stack: AnyRec$t): FlowTemplatePathFinding[];
+
+type ReadonlyFlowWriteSeverity = 'error' | 'warning';
+interface ReadonlyFlowWriteFinding {
+    severity: ReadonlyFlowWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `flow "approve_deal" › node "Mark approved"`. */
+    where: string;
+    /** Config path, e.g. `flows[0].nodes[3].config.fields.approval_status`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
+declare const FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
+type AnyRec$s = Record<string, unknown>;
+/**
+ * Validate flow `update_record` writes against target-object readonly
+ * declarations. Pure and dependency-free; safe on pre- or post-parse stacks.
+ */
+declare function validateReadonlyFlowWrites(stack: AnyRec$s): ReadonlyFlowWriteFinding[];
 
 type ViewContainerSeverity = 'error' | 'warning';
 interface ViewContainerFinding {
@@ -201,14 +241,14 @@ declare const STYLE_CLASSNAME_TAILWIND = "style-classname-tailwind";
 declare const STYLE_RESPONSIVE_NO_BASE = "style-responsive-no-base";
 declare const STYLE_UNKNOWN_CSS_PROPERTY = "style-unknown-css-property";
 declare const STYLE_UNKNOWN_TOKEN = "style-unknown-token";
-type AnyRec$d = Record<string, unknown>;
+type AnyRec$r = Record<string, unknown>;
 /**
  * Validate every page's component tree for SDUI styling correctness (ADR-0065).
  * Returns findings (empty = clean). `error` findings describe styles that are
  * silently dropped and should fail validate/build; `warning` findings are
  * advisory (typos, drift, footguns).
  */
-declare function validateResponsiveStyles(stack: AnyRec$d): StyleFinding[];
+declare function validateResponsiveStyles(stack: AnyRec$r): StyleFinding[];
 
 type JsxPageSeverity = 'error' | 'warning';
 interface JsxPageFinding {
@@ -221,8 +261,8 @@ interface JsxPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$c = Record<string, unknown>;
-declare function validateJsxPages(stack: AnyRec$c, opts?: {
+type AnyRec$q = Record<string, unknown>;
+declare function validateJsxPages(stack: AnyRec$q, opts?: {
     manifest?: Manifest;
 }): JsxPageFinding[];
 
@@ -235,8 +275,8 @@ interface ReactPageFinding {
     message: string;
     hint: string;
 }
-type AnyRec$b = Record<string, unknown>;
-declare function validateReactPages(stack: AnyRec$b): ReactPageFinding[];
+type AnyRec$p = Record<string, unknown>;
+declare function validateReactPages(stack: AnyRec$p): ReactPageFinding[];
 
 type ReactPropSeverity = 'error' | 'warning';
 interface ReactPropFinding {
@@ -247,8 +287,11 @@ interface ReactPropFinding {
     message: string;
     hint: string;
 }
-type AnyRec$a = Record<string, unknown>;
-declare function validateReactPageProps(stack: AnyRec$a): ReactPropFinding[];
+type AnyRec$o = Record<string, unknown>;
+declare const REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
+declare const REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
+declare const REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
+declare function validateReactPageProps(stack: AnyRec$o): ReactPropFinding[];
 
 type SourceStyleSeverity = 'error' | 'warning';
 interface SourceStyleFinding {
@@ -260,8 +303,8 @@ interface SourceStyleFinding {
     hint: string;
 }
 declare const PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-type AnyRec$9 = Record<string, unknown>;
-declare function validatePageSourceStyling(stack: AnyRec$9): SourceStyleFinding[];
+type AnyRec$n = Record<string, unknown>;
+declare function validatePageSourceStyling(stack: AnyRec$n): SourceStyleFinding[];
 
 /**
  * Build-time record-title diagnostics (ADR-0079).
@@ -305,14 +348,14 @@ interface RecordTitleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$8 = Record<string, unknown>;
+type AnyRec$m = Record<string, unknown>;
 /**
  * Validate every object's record-title declaration. Returns the list of
  * findings (empty = clean). Both rules are advisory (`warning`): the caller
  * must never fail the build on them alone — auto-provision + the `Record #<id>`
  * floor guarantee a resolvable title at runtime.
  */
-declare function validateRecordTitle(stack: AnyRec$8): RecordTitleFinding[];
+declare function validateRecordTitle(stack: AnyRec$m): RecordTitleFinding[];
 
 /**
  * Build-time semantic-role diagnostics (ADR-0085).
@@ -349,13 +392,13 @@ interface SemanticRoleFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$7 = Record<string, unknown>;
+type AnyRec$l = Record<string, unknown>;
 /**
  * Validate every object's semantic-role pointers. Returns the list of
  * findings (empty = clean). Advisory only — the caller must never fail the
  * build on these alone.
  */
-declare function validateSemanticRoles(stack: AnyRec$7): SemanticRoleFinding[];
+declare function validateSemanticRoles(stack: AnyRec$l): SemanticRoleFinding[];
 
 /**
  * Build-time form-layout diagnostics (#2578).
@@ -398,12 +441,12 @@ interface FormLayoutFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$6 = Record<string, unknown>;
+type AnyRec$k = Record<string, unknown>;
 /**
  * Validate authored form-view layout. Returns findings (empty = clean).
  * Advisory only — the caller must never fail the build on these alone.
  */
-declare function validateFormLayout(stack: AnyRec$6): FormLayoutFinding[];
+declare function validateFormLayout(stack: AnyRec$k): FormLayoutFinding[];
 
 /**
  * Build-time conditional-visibility diagnostics (ADR-0089 D3b).
@@ -465,7 +508,7 @@ interface VisibilityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$5 = Record<string, unknown>;
+type AnyRec$j = Record<string, unknown>;
 /**
  * Validate conditional-visibility keys across authored views and pages.
  *
@@ -480,7 +523,7 @@ type AnyRec$5 = Record<string, unknown>;
  * `*.view.ts` / `*.page.ts` surfaces (so a `data.`-rooted predicate is flagged). The
  * alias-deprecated check is layer-agnostic.
  */
-declare function validateVisibilityPredicates(stack: AnyRec$5, opts?: VisibilityOptions): VisibilityFinding[];
+declare function validateVisibilityPredicates(stack: AnyRec$j, opts?: VisibilityOptions): VisibilityFinding[];
 
 declare const CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
 type CapabilityRefSeverity = 'error' | 'warning';
@@ -498,17 +541,22 @@ interface CapabilityRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$4 = Record<string, unknown>;
+type AnyRec$i = Record<string, unknown>;
 /**
  * Validate every capability reference in a stack. Returns findings (empty =
  * clean). Advisory only — callers must not fail the build on these alone.
  */
-declare function validateCapabilityReferences(stack: AnyRec$4): CapabilityRefFinding[];
+declare function validateCapabilityReferences(stack: AnyRec$i): CapabilityRefFinding[];
 
 declare const APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 declare const APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
 declare const APPROVAL_APPROVER_TYPE_UNKNOWN = "approval-approver-type-unknown";
 declare const APPROVAL_ESCALATION_REASSIGN_NO_TARGET = "approval-escalation-reassign-no-target";
+declare const APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY = "approval-approvers-may-resolve-empty";
+declare const APPROVAL_EXPRESSION_INVALID = "approval-expression-invalid";
+declare const APPROVAL_EXPRESSION_NO_EMPTY_POLICY = "approval-expression-no-empty-policy";
+declare const APPROVAL_DECISION_OUTPUTS_RESERVED = "approval-decision-outputs-reserved";
+declare const APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED = "approval-approver-cross-org-unsupported";
 type ApprovalApproverSeverity = 'error' | 'warning' | 'info';
 interface ApprovalApproverFinding {
     severity: ApprovalApproverSeverity;
@@ -523,12 +571,63 @@ interface ApprovalApproverFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$3 = Record<string, unknown>;
+type AnyRec$h = Record<string, unknown>;
 /**
  * Validate the approvers of every Approval node in the stack's flows.
  * Returns findings (empty = clean).
  */
-declare function validateApprovalApprovers(stack: AnyRec$3): ApprovalApproverFinding[];
+declare function validateApprovalApprovers(stack: AnyRec$h): ApprovalApproverFinding[];
+
+type SeedReplaySafetySeverity = 'error' | 'warning';
+interface SeedReplaySafetyFinding {
+    severity: SeedReplaySafetySeverity;
+    rule: string;
+    /** Human-readable location, e.g. `seed "showcase_project_membership"`. */
+    where: string;
+    /** Config path, e.g. `data[12].mode`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const SEED_INSERT_MODE_DUPLICATES_ON_REPLAY = "seed-insert-mode-duplicates-on-replay";
+type AnyRec$g = Record<string, unknown>;
+/**
+ * Flag every seed dataset declared with `mode: 'insert'` — the one non-idempotent
+ * mode, which duplicates its rows on every replay boot (framework#3434). Returns
+ * the findings (empty = clean). The caller decides how to surface them / whether
+ * to fail the build; the CLI folds them in as advisory warnings.
+ *
+ * Reads `stack.data` (the `SeedSchema[]` fixtures). Safe on any shape — a stack
+ * with no `data` array yields no findings.
+ */
+declare function validateSeedReplaySafety(stack: AnyRec$g): SeedReplaySafetyFinding[];
+
+type SeedStateMachineSeverity = 'warning';
+interface SeedStateMachineFinding {
+    severity: SeedStateMachineSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `seed "showcase_project" ("Legacy Sunset")`. */
+    where: string;
+    /** Config path, e.g. `data[4].records[3].status`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const SEED_VALUE_OUTSIDE_STATE_MACHINE = "seed-value-outside-state-machine";
+type AnyRec$f = Record<string, unknown>;
+/**
+ * Flag every seed record whose `state_machine`-governed field carries a value
+ * the machine does not declare (framework#3433 follow-up). Returns the findings
+ * (empty = clean). The caller decides how to surface them; the CLI folds them in
+ * as advisory warnings.
+ *
+ * Reads `stack.objects` (for the state-machine rules) and `stack.data` (the
+ * `SeedSchema[]` fixtures). Safe on any shape — a stack with no objects or no
+ * `data` array yields no findings. A value that is not a plain string (an
+ * unresolved `cel` Expression envelope, a number) is skipped: it cannot be
+ * statically compared to the declared-state set.
+ */
+declare function validateSeedStateMachine(stack: AnyRec$f): SeedStateMachineFinding[];
 
 declare const SECURITY_OWD_UNSET = "security-owd-unset";
 declare const SECURITY_OWD_ALIAS = "security-owd-alias";
@@ -555,7 +654,7 @@ interface SecurityFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$2 = Record<string, unknown>;
+type AnyRec$e = Record<string, unknown>;
 /**
  * Validate the security posture of a stack. Returns findings (empty = clean).
  * `error` findings gate the build in `os compile`; `info` is advisory.
@@ -563,10 +662,68 @@ type AnyRec$2 = Record<string, unknown>;
  * `opts.nowMs` injects the clock for the ADR-0091 authoring-time expiry rule
  * (tests); production callers omit it.
  */
-declare function validateSecurityPosture(stack: AnyRec$2, opts?: {
+declare function validateSecurityPosture(stack: AnyRec$e, opts?: {
     nowMs?: number;
 }): SecurityFinding[];
 
+/**
+ * [ADR-0105 D6] The two organization-axis red lines, enforced at authoring time.
+ *
+ * ADR-0105 gives organizations a reporting/grouping dimension
+ * (`sys_organization.parent_organization_id`, sibling ordering). That dimension
+ * is load-bearing for consolidated reporting — and dangerous, because it LOOKS
+ * like a permission hierarchy. Two lines keep it from becoming one:
+ *
+ * | Rule                                    | Red line                          |
+ * |-----------------------------------------|-----------------------------------|
+ * | org-axis-permission-inheritance (error) | D6 ①: no inheritance along the org tree |
+ * | org-axis-cross-org-bu-grant     (error) | D6 ②: business-unit trees stay org-internal |
+ *
+ * **① No permission inheritance along the org axis.** Cross-organization
+ * visibility comes from membership union (`accessible_org_ids`, ADR-0105 D2) —
+ * the engine's own Layer 0 wall — never from walking a parent reference. An RLS
+ * policy or sharing rule that reads `parent_organization_id` builds a SECOND
+ * permission hierarchy beside the business-unit tree: exactly the dual-hierarchy
+ * mistake ADR-0057 D5 retired and ADR-0090 D3 finalized for positions. It also
+ * silently outranks the wall it sits behind, since a Layer-1 policy cannot widen
+ * Layer 0 (W1) — so the author gets a rule that appears to grant access and
+ * does not. Fail at authoring, not in a support ticket.
+ *
+ * **② Business-unit trees remain org-internal.** `sys_business_unit` is
+ * org-scoped and every BU mechanism (`unit_and_subordinates` sharing,
+ * `adminScope` delegation, depth scopes) resolves within ONE organization. A
+ * business-unit sharing rule on a PLATFORM-GLOBAL object (`tenancy.enabled:
+ * false`) has no organization column to scope against, so the grant spans every
+ * organization in the database — a cross-org BU grant by construction, and the
+ * "cross-org BU mega-tree" the ADR rejected, arrived at by accident.
+ *
+ * Both are `error`, per ADR-0049 discipline: each mirrors a real enforcement
+ * property (the Layer 0 wall's independence; the org-predicated BU resolver),
+ * so the lint moves the failure from silent-wrong-answer to author-time fix-it.
+ *
+ * Pure `(stack) => Finding[]`; accepts the NORMALIZED stack input.
+ */
+declare const ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
+declare const ORG_AXIS_CROSS_ORG_BU_GRANT = "org-axis-cross-org-bu-grant";
+type OrgAxisSeverity = 'error' | 'warning';
+interface OrgAxisFinding {
+    severity: OrgAxisSeverity;
+    /** Diagnostic rule id (`org-axis-*`). */
+    rule: string;
+    /** Human-readable location, e.g. `permission set "plant_reader"`. */
+    where: string;
+    /** Config path, e.g. `permissions[2].rowLevelSecurity[0].using`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/**
+ * Lint an ObjectStack config for the ADR-0105 D6 organization-axis red lines.
+ */
+declare function validateOrgAxisRedLines(stack: unknown): OrgAxisFinding[];
+
 /**
  * [ADR-0049 — references] Reference-integrity for dashboard header & widget
  * action targets (issue #3367).
@@ -639,13 +796,723 @@ interface DashboardActionRefFinding {
     /** How to fix it. */
     hint: string;
 }
-type AnyRec$1 = Record<string, unknown>;
+type AnyRec$d = Record<string, unknown>;
 /**
  * Validate every dashboard header / widget action reference in a stack. Returns
  * findings (empty = clean). `script`/`modal` dead targets are errors; `url`
  * unresolved routes are warnings.
  */
-declare function validateDashboardActionRefs(stack: AnyRec$1): DashboardActionRefFinding[];
+declare function validateDashboardActionRefs(stack: AnyRec$d): DashboardActionRefFinding[];
+
+/**
+ * Build-time filter-placeholder diagnostics (issue #3574).
+ *
+ * Filter values travel as JSON, so a user-scoped or time-scoped slice cannot
+ * call code inline — it writes a placeholder that the client resolves just
+ * before querying:
+ *
+ *     { owner_id: '{current_user_id}', created_at: { $gte: '{week_start}' } }
+ *
+ * Exactly two vocabularies resolve inside a filter value: context tokens
+ * (`{current_user_id}`, `{current_org_id}` — see `context-tokens.zod.ts`) and
+ * date macros (`{today}`, `{30_days_ago}` — see `date-macros.zod.ts`).
+ * Anything else is passed to the data engine **verbatim**, matches no row, and
+ * the surface renders an empty result.
+ *
+ * ## Why this is an error, not a warning
+ *
+ * The runtime failure mode is silent and indistinguishable from success. A
+ * metric widget filtered on an unresolved `{current_user}` renders `0`, which
+ * looks exactly like a metric that is legitimately zero — no console error, no
+ * server log, nothing for a human reviewer to notice. Issue #3574 found a
+ * dashboard that had been broken this way since the day it was written.
+ *
+ * That failure mode is worse for AI authors than for humans. An AI reads a
+ * successful query returning `0` as a correct answer and builds on it — it has
+ * no instinct that the number looks wrong. Its correction loop is
+ * "author → validate → fix", so a diagnostic only reaches it if the diagnostic
+ * can fail the build. A runtime warning in a server log is invisible to it.
+ * Hence: authoring-time error.
+ *
+ * The near-miss spellings this catches are not hypothetical. Each is a correct
+ * spelling *somewhere else* in the platform, which is precisely why authors
+ * reach for them:
+ *
+ * - `{current_user}` — `current_user.id` is the RLS expression root
+ * - `{user_id}` — `{user_id}` is valid `titleFormat` field interpolation
+ * - `{current_organization_id}` — `organization_id` is the real column name
+ *
+ * `CONTEXT_TOKEN_SUGGESTIONS` maps each to what the author meant, so the
+ * diagnostic names the fix instead of only reporting the symptom.
+ *
+ * ## Scope — filter subtrees only
+ *
+ * The walk descends into `filter` / `filters` / `runtimeFilter` subtrees and
+ * classifies string values inside them. It deliberately does NOT check
+ * navigation `recordId` / `params`, which resolve an additional vocabulary —
+ * `AppContextSelector` ids such as `{active_package}` — that is meaningless in
+ * a filter because filters are not evaluated with the sidebar's selector
+ * state. Restricting the walk keeps that legitimate usage out of the rule and
+ * holds false positives at zero.
+ *
+ * Only whole-string placeholders are considered (`'{token}'` / `'${token}'`,
+ * anchored). A value that merely contains braces is left alone.
+ */
+declare const FILTER_TOKEN_UNKNOWN = "filter-token-unknown";
+type FilterTokenSeverity = 'error' | 'warning';
+interface FilterTokenFinding {
+    /** Always `error` today — an unresolved placeholder silently matches nothing. */
+    severity: FilterTokenSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `dashboard "sales" · widget "my_deals"`. */
+    where: string;
+    /** Config path, e.g. `dashboards[0].widgets[2].filter.owner_id`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/**
+ * Validate filter placeholders across a schema-parsed stack.
+ *
+ * Pure `(stack) => Finding[]`; no I/O. Covers dashboards (widget + global
+ * filters), objects (list views), top-level view containers, reports,
+ * datasets, and pages.
+ */
+declare function validateFilterTokens(stack: Record<string, unknown> | undefined | null): FilterTokenFinding[];
+
+declare const OBJECT_REFERENCE_UNKNOWN = "object-reference-unknown";
+declare const OBJECT_REFERENCE_UNREGISTERED_PLATFORM = "object-reference-unregistered-platform";
+type ObjectRefSeverity = 'error' | 'warning';
+interface ObjectRefFinding {
+    /** `error` for an unresolvable own-stack name; `warning` for an unknown platform name. */
+    severity: ObjectRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `action "mass_update" · param "owner"`. */
+    where: string;
+    /** Config path, e.g. `actions[2].params[0].reference`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$c = Record<string, unknown>;
+/**
+ * Validate every object-name reference on the surfaces listed in the module
+ * header. Returns findings (empty = clean).
+ */
+declare function validateObjectReferences(stack: AnyRec$c): ObjectRefFinding[];
+
+declare const SEARCHABLE_FIELD_UNKNOWN = "searchable-field-unknown";
+type SearchableFieldSeverity = 'error' | 'warning';
+interface SearchableFieldFinding {
+    /** Always `error` — a stale entry narrows, widens or refuses the search (see module note). */
+    severity: SearchableFieldSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `object "crm_lead"`. */
+    where: string;
+    /** Config path, e.g. `objects[0].searchableFields[2]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$b = Record<string, unknown>;
+/**
+ * Validate every `searchableFields` declaration in the stack — the object's own
+ * (the canonical set, ADR-0061) and the list views that narrow it. Returns
+ * findings (empty = clean).
+ *
+ * The react page surface (`<ListView searchableFields={…}>`) is deliberately
+ * NOT walked here: its declaration lives inside JSX source, and
+ * `validate-react-page-props` — the gate that already parses that source —
+ * runs the same `checkSearchableFieldList` core on it (#4329).
+ */
+declare function validateSearchableFields(stack: AnyRec$b): SearchableFieldFinding[];
+
+declare const ACTION_NAME_UNDEFINED = "action-name-undefined";
+type ActionNameRefSeverity = 'error' | 'warning';
+interface ActionNameRefFinding {
+    /** Always `error` — a name-bound action that resolves nowhere is a dead button. */
+    severity: ActionNameRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `view "crm_lead" · list "all" · bulkActions`. */
+    where: string;
+    /** Config path, e.g. `views[0].list.bulkActions[1]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$a = Record<string, unknown>;
+/**
+ * Validate every name-bound action reference in a stack. Returns findings
+ * (empty = clean).
+ */
+declare function validateActionNameRefs(stack: AnyRec$a): ActionNameRefFinding[];
+
+/**
+ * Shared page-component traversal for the lint rules that inspect
+ * `PageComponent.properties` (issue #3583).
+ *
+ * Getting this walk right is subtle enough that duplicating it has already
+ * produced one dead rule, so it lives here once:
+ *
+ *   - Components hang off `page.regions[].components[]` and `page.slots.<slot>`
+ *     — there is NO top-level `page.components`. A walker that reads
+ *     `page.components` silently visits nothing on a schema-parsed stack.
+ *   - `slots.<slot>` is `PageComponent | PageComponent[]` — a single component
+ *     is legal and must be normalized.
+ *   - `PageComponentSchema` is `.strict()`, so a component carries no `children`
+ *     key of its own. Sub-trees live INSIDE the untyped `properties` bag:
+ *     `page:tabs` → `properties.items[].children`, `page:accordion` →
+ *     `properties.items[].children`, `page:card` → `properties.body` /
+ *     `properties.footer`. All are `z.array(z.unknown())`, so the recursion is
+ *     untyped and has to be done by hand.
+ *   - `kind: 'html' | 'react' | 'jsx'` pages are authored as `source`, which is
+ *     authoritative; their `regions` hold at most a DERIVED cache that the
+ *     source wins over. Linting that cache reports findings about metadata the
+ *     author never wrote, so those pages are skipped here and covered by
+ *     `validate-jsx-pages` / `validate-react-page-props` instead.
+ */
+type AnyRec$9 = Record<string, unknown>;
+
+/**
+ * [ADR-0078 — completeness] Field-reference integrity for page components
+ * (issue #3583, assessment R3).
+ *
+ * `PageComponent.properties` is `z.record(z.string(), z.unknown())` — an
+ * untyped bag. The typed prop schemas exist (`ComponentPropsMap` in
+ * `@objectstack/spec/ui`) but nothing validates `properties` against them, so
+ * every field name a component references ships exactly as typed. The HotCRM
+ * audit found KPI cards and page headers bound to fields the object does not
+ * have; each renders blank or falls back, and nothing reports the miss.
+ *
+ * Field-existence lint already exists for forms (`FORM_FIELD_UNKNOWN`),
+ * semantic roles, and flow templates. This is the same check for pages, at the
+ * same advisory severity: every consumer degrades gracefully (a missing field
+ * is skipped, not crashed on), so a warning is the honest level.
+ *
+ * ── Which object a component binds ──────────────────────────────────────
+ *
+ * `dataSource.object` → `properties.object` → the page's `object`. A per-element
+ * `dataSource` exists precisely so one page can bind several objects, and the
+ * `element:*` family declares its own `object`; both must win over the page's.
+ *
+ * ── Why a hand-written descriptor table ─────────────────────────────────
+ *
+ * `ComponentPropsMap` cannot drive this rule: a Zod schema does not say which
+ * of its `z.string()` props is a FIELD NAME (`RecordPathProps.statusField` and
+ * `AIChatWindowProps.agentId` are both plain strings), and the type universe is
+ * open anyway — `PageComponent.type` is `z.union([PageComponentType,
+ * z.string()])`, so unregistered types like `record:line_items` parse and are
+ * authored in the wild. The table below names the field-bearing props
+ * explicitly; an unknown component type is SKIPPED silently, never flagged.
+ *
+ * The table also covers shapes the props schemas do not yet describe but real
+ * pages authored anyway (they pass only because `properties` is unvalidated):
+ * `record:details` `sections[].fields[]` and `hideFields[]`, and the record
+ * picker's `labelField`. Linting the schema's shape alone would find nothing on
+ * the actual corpus.
+ *
+ * ── Shared with the react page surface ──────────────────────────────────
+ *
+ * A `kind:'react'` page authors the SAME components, one surface over, as JSX
+ * props instead of a `properties` bag (`<RecordHighlights fields={…}>`). The
+ * extraction and the check are therefore exported — `COMPONENT_FIELD_SPECS`,
+ * {@link componentFieldRefs}, {@link relatedListFieldRefs},
+ * {@link indexObjectFields}, {@link checkFieldRefs} — and
+ * `validate-react-page-props` runs them on the parsed JSX (#4340). Same table,
+ * same skips, same rule id: the two surfaces agree on what counts as a field by
+ * construction rather than by two lists that happen to match, which is the
+ * drift #4330 had just finished removing from the system-field lists.
+ */
+declare const PAGE_FIELD_UNKNOWN = "page-field-unknown";
+type PageFieldSeverity = 'error' | 'warning';
+interface PageFieldFinding {
+    /**
+     * `warning` on every surface this rule itself walks — page renderers skip an
+     * unknown field rather than fail. The shared {@link checkFieldRefs} core also
+     * serves the react page surface, where one batch of refs reaches a QUERY
+     * rather than a renderer and gates instead; see {@link FieldRefConsequence}.
+     */
+    severity: PageFieldSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `page "task_detail" · record:highlights`. */
+    where: string;
+    /** Config path, e.g. `pages[0].regions[1].components[0].properties.fields[2]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+
+declare function validatePageFieldBindings(stack: AnyRec$9): PageFieldFinding[];
+
+/**
+ * [ADR-0021 — semantic layer] Chart-binding integrity for the surfaces the
+ * dashboard rule does not reach (issue #3583, assessment R4).
+ *
+ * `validate-widget-bindings` already resolves a dashboard widget's
+ * `chartConfig` axes against its dataset's declared dimensions and measures
+ * (`chart-field-unknown`). It is scoped to `stack.dashboards`, so three other
+ * chart surfaces ship unchecked — and the HotCRM audit found exactly the bug
+ * that scoping allows: an axis naming a RAW FIELD instead of a dataset measure.
+ * Post-ADR-0021 the result rows are keyed by measure NAME (`sum_amount`), not
+ * the base column (`amount`), so the axis renders and the series is empty.
+ *
+ * Surfaces covered here:
+ *
+ *   1. **Report charts** — `report.chart` and `report.blocks[].chart`.
+ *      `ReportChartSchema` narrows `xAxis`/`yAxis` from ChartConfig's
+ *      object/array shapes to bare STRINGS, which is why simply pointing the
+ *      dashboard rule at reports would find nothing: its `Array.isArray(yAxis)`
+ *      guard skips a string silently. `series[].name` keeps the array shape.
+ *   2. **List-view charts** — `ListChartConfigSchema` (`dataset` +
+ *      `dimensions` + `values`), reachable through `views[].list`,
+ *      `views[].listViews.<key>`, and `objects[].listViews.<key>`.
+ *   3. **Dataset-bound page chart components** — a `PageComponent` whose
+ *      `properties` carry a `dataset` (the `object-chart` component). Same
+ *      binding shape as a list chart, but it arrives through the untyped
+ *      `properties` bag.
+ *
+ * Not covered HERE, and deliberately so: the react `<ObjectChart>` block. It is
+ * OBJECT-bound (`objectName` + an inline `aggregate`), so its result rows are
+ * keyed by the RAW FIELD NAMES rather than by a measure name — the opposite
+ * convention, which would make `chart-measure-unknown`'s message a lie. It also
+ * arrives as JSX rather than config, so it needs the TypeScript compiler this
+ * rule has no business loading. It is checked by `validate-react-page-props`
+ * instead, against the naming convention `chartAggregateResultKeys`
+ * (`@objectstack/spec/ui`) now pins down (#3701).
+ */
+declare const CHART_DIMENSION_UNKNOWN = "chart-dimension-unknown";
+declare const CHART_MEASURE_UNKNOWN = "chart-measure-unknown";
+declare const CHART_DATASET_UNKNOWN = "chart-dataset-unknown";
+declare const CHART_AXIS_NOT_SELECTED = "chart-axis-not-selected";
+type ChartBindingSeverity = 'error' | 'warning';
+interface ChartBindingFinding {
+    severity: ChartBindingSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `report "hours_by_status" · chart`. */
+    where: string;
+    /** Config path, e.g. `reports[2].chart.yAxis`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+
+declare function validateChartBindings(stack: AnyRec$9): ChartBindingFinding[];
+
+declare const NAV_OBJECT_UNGRANTED = "nav-object-ungranted";
+type NavAccessSeverity = 'error' | 'warning';
+interface NavAccessFinding {
+    /** Always `warning` — a grant may come from a package this stack cannot see. */
+    severity: NavAccessSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `app "crm" · nav "nav_forecast"`. */
+    where: string;
+    /** Config path, e.g. `apps[0].navigation[3].objectName`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$8 = Record<string, unknown>;
+/**
+ * Validate that every object a stack's navigation exposes is readable by at
+ * least one permission set the stack declares. Returns findings (empty = clean).
+ */
+declare function validateNavAccess(stack: AnyRec$8): NavAccessFinding[];
+
+declare const TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
+declare const TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
+type TranslationRefSeverity = 'warning';
+interface TranslationRefFinding {
+    /** Always `warning` — an orphan translation key is inert, not broken. */
+    severity: TranslationRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `locale "zh-CN" · object "crm_lead"`. */
+    where: string;
+    /** Config path, e.g. `translations[0]["zh-CN"].objects.crm_lead.fields.campaign`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$7 = Record<string, unknown>;
+/**
+ * Validate every reference a translation bundle makes against the metadata it
+ * claims to translate. Returns findings (empty = clean).
+ */
+declare function validateTranslationReferences(stack: AnyRec$7): TranslationRefFinding[];
+
+/**
+ * [ADR-0064 §3] Skill ↔ agent surface affinity (issue #3820).
+ *
+ * An agent binds a product surface (`'ask'` | `'build'`, ADR-0063 §1) and a
+ * skill declares which surface it belongs to (`'ask'` | `'build'` | `'both'`,
+ * ADR-0063 §3). A skill may only attach to an agent whose surface it matches —
+ * `'both'` attaches to either. The runtime treats a violation as a FAST LOAD
+ * ERROR: `resolveActiveSkills()` throws on the first incompatible binding, so
+ * an agent shipping one mismatched skill reference fails at **chat time** with
+ * a 500 — after parse, after validate, after deploy.
+ *
+ * Both sides of the check are declared in the same stack, so the contradiction
+ * is statically provable and this rule carries severity **error** with zero
+ * false positives by construction. Both sides default to `'ask'` when the
+ * `surface` field is absent (mirroring the runtime's defaults), so the rule is
+ * safe on the raw/normalized config the `lint` path carries as well as the
+ * schema-parsed stack.
+ *
+ * Scope note: this rule deliberately does NOT check that `agent.skills[]`
+ * names resolve at all. Kernel skills (`schema_reader`, the `ask`/`build`
+ * bundles) are runtime-registered and statically invisible, and whether
+ * app-stack tool/skill namespaces get a platform-name registry is an open
+ * decision (#3820 D0/D2) — resolving names against `stack.skills` alone would
+ * flag every kernel-skill reference. An unresolved name is therefore skipped
+ * here; only a reference that resolves in-stack AND contradicts the affinity
+ * contract is reported.
+ */
+declare const AI_SKILL_SURFACE_MISMATCH = "ai-skill-surface-mismatch";
+type AiSurfaceAffinitySeverity = 'error' | 'warning';
+interface AiSurfaceAffinityFinding {
+    /** Always `error` — the runtime throws on this binding at chat time. */
+    severity: AiSurfaceAffinitySeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `agent "sales_copilot" · skills`. */
+    where: string;
+    /** Config path, e.g. `agents[0].skills[2]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$6 = Record<string, unknown>;
+/**
+ * Validate every in-stack agent→skill binding against the ADR-0064 §3 surface
+ * affinity contract. Returns findings (empty = clean).
+ */
+declare function validateAiSurfaceAffinity(stack: AnyRec$6): AiSurfaceAffinityFinding[];
+
+declare const AI_SKILL_TOOL_UNRESOLVED = "ai-skill-tool-unresolved";
+type AiToolRefSeverity = 'error' | 'warning';
+interface AiToolRefFinding {
+    /** Always `warning` — see the header for why this rule starts advisory. */
+    severity: AiToolRefSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `skill "revenue_forecasting" · tools`. */
+    where: string;
+    /** Config path, e.g. `skills[3].tools[1]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$5 = Record<string, unknown>;
+/**
+ * Validate every `skill.tools[]` reference in a stack. Returns findings
+ * (empty = clean).
+ */
+declare function validateAiToolReferences(stack: AnyRec$5): AiToolRefFinding[];
+
+/**
+ * [ADR-0063 §2] `stack.agents` is a platform-internal slot (issue #3820).
+ *
+ * ADR-0063 §2 withdrew tenant/app-package custom agents: the kernel ships
+ * exactly two agents (`ask`, `build`), the surface the user is in binds one,
+ * and third parties extend the platform by authoring **skills**, never
+ * `*.agent.ts`. The `agent` metadata type carries the decision
+ * (`allowRuntimeCreate: false, allowOrgOverride: false`), and the runtime
+ * enforces it on both paths — `listAgents()` filters non-platform records out
+ * of the catalog, and `loadAgent()` refuses them outright (cloud#904), so a
+ * stack-authored agent 404s on chat and cannot be pinned via
+ * `app.defaultAgent`.
+ *
+ * What was missing is the AUTHORING-time signal. `defineStack` still accepts
+ * an `agents` array, so an app package could declare agents that parse,
+ * validate, and build into the artifact — and then do nothing at runtime.
+ * HotCRM shipped two of them for months. That is the ADR-0078 shape this rule
+ * closes: loud at the producer, tolerant at the consumer (Prime Directive
+ * #12).
+ *
+ * Severity is **warning**, not error, for one reason: the platform's own
+ * packages legitimately author agent records, and this rule cannot tell a
+ * platform package from an app package by reading the stack alone. A warning
+ * that names the runtime consequence is honest for both readers; the runtime
+ * is what actually gates. Deliberately NOT a Zod refine — an existing stack
+ * must keep parsing (ADR-0078 non-goal #1).
+ */
+declare const AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
+type AiAgentAuthoringSeverity = 'error' | 'warning';
+interface AiAgentAuthoringFinding {
+    /** Always `warning` — the runtime is the gate; this is the authoring-time signal. */
+    severity: AiAgentAuthoringSeverity;
+    /** Diagnostic rule id. */
+    rule: string;
+    /** Human-readable location, e.g. `agent "sales_copilot"`. */
+    where: string;
+    /** Config path, e.g. `agents[0]`. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+type AnyRec$4 = Record<string, unknown>;
+/**
+ * Flag every agent declared in a stack. Returns findings (empty = clean,
+ * which is what every app package should be).
+ */
+declare function validateAiAgentAuthoring(stack: AnyRec$4): AiAgentAuthoringFinding[];
+
+type HookBodyWriteSeverity = 'warning';
+interface HookBodyWriteFinding {
+    /** v1 is advisory-only by contract — the type says so. */
+    severity: HookBodyWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `hook "normalize_lead" › body`. */
+    where: string;
+    /** Config path, e.g. `hooks[0].body.source`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const HOOK_BODY_WRITE_UNKNOWN_FIELD = "hook-body-write-unknown-field";
+/** One syntactic write shape the extractor recognizes. */
+interface HookBodyWritePattern {
+    /** Stable pattern id, carried on every extracted write. */
+    readonly id: string;
+    /** Author-facing syntax summary (for docs/diagnostics, not matching). */
+    readonly syntax: string;
+    /** Reconciliation fixture: extracting `source` must yield exactly `writes`. */
+    readonly example: {
+        readonly source: string;
+        readonly writes: ReadonlyArray<{
+            field: string;
+            object?: string;
+        }>;
+    };
+}
+declare const HOOK_BODY_WRITE_PATTERNS: readonly HookBodyWritePattern[];
+/** A ledger pattern a given rule does NOT consume, and why. */
+interface BodyWritePatternExclusion {
+    /** The {@link HOOK_BODY_WRITE_PATTERNS} entry id being excluded. */
+    readonly id: string;
+    /** Why the shape does not mean the same thing on this rule's surface. */
+    readonly reason: string;
+}
+/**
+ * The ledger shapes THIS rule consumes.
+ *
+ * Declared rather than implied: before the ledger carried a shape the hook
+ * surface does not have, every write with no `object` was necessarily a
+ * `ctx.input` write, and the rule could branch on that alone. It no longer can
+ * — a `record-property-assign` write also carries no object, and would have
+ * been reported as "the hook writes 'stage' to its input", which is false.
+ * Each consumer declaring its own subset is what stops the next added shape
+ * from silently landing in a branch that was never written for it.
+ */
+declare const HOOK_BODY_WRITE_PATTERN_IDS: readonly string[];
+/** Ledger shapes this rule leaves alone, each with its reason. */
+declare const HOOK_BODY_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
+type AnyRec$3 = Record<string, unknown>;
+/** One statically-extracted field write found in an L2 body. */
+interface ExtractedHookBodyWrite {
+    /** Which {@link HOOK_BODY_WRITE_PATTERNS} entry matched. */
+    patternId: string;
+    /** Target object name; `undefined` = the hook's own target object(s). */
+    object?: string;
+    /** The `ctx.api` method for diagnostics (`insert`/`create`/`update`/`updateById`). */
+    method?: string;
+    field: string;
+}
+/** Everything one parse of an L2 body yields. */
+interface ExtractedHookBodyWriteSet {
+    /** Every literal write the {@link HOOK_BODY_WRITE_PATTERNS} ledger declares. */
+    writes: ExtractedHookBodyWrite[];
+    /**
+     * `ctx.record` is handed to something as a VALUE somewhere in the body — an
+     * argument, an assignment RHS, a spread, a return — rather than only having
+     * its properties read and written, or being truthiness/type tested.
+     *
+     * The action rule needs this to tell a dead snapshot write from a live one:
+     * `ctx.record.stage = 'won'; await ctx.api.object('d').update(ctx.record)`
+     * builds a payload and persists it, so the assignment is not a no-op. When
+     * this is true, no record write in the body can be judged, and none is
+     * reported. (One-level aliasing — `const r = ctx.record` — reads as an
+     * escape too, which is the safe direction: it suppresses findings.)
+     */
+    ctxRecordEscapes: boolean;
+}
+/**
+ * Extract every literal field write the pattern ledger declares from an L2
+ * body's source. Parse-only (the source is never executed), error-tolerant
+ * (a body with syntax errors simply yields fewer matches), and lazy: the
+ * TypeScript compiler is not loaded when no pattern can possibly match.
+ *
+ * Thin projection of {@link extractHookBodyWriteSet} — use that one when the
+ * `ctx.record` liveness signal matters, so the body is parsed once, not twice.
+ */
+declare function extractHookBodyWrites(source: string): ExtractedHookBodyWrite[];
+/** {@link extractHookBodyWrites} plus the `ctx.record` liveness signal, one parse. */
+declare function extractHookBodyWriteSet(source: string): ExtractedHookBodyWriteSet;
+/**
+ * Validate L2 hook-body writes against target-object field declarations.
+ * Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or post-parse stacks.
+ */
+declare function validateHookBodyWrites(stack: AnyRec$3): HookBodyWriteFinding[];
+
+type ActionBodyWriteSeverity = 'warning';
+interface ActionBodyWriteFinding {
+    /** Advisory-only by contract, exactly like the hook rule — the type says so. */
+    severity: ActionBodyWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `action "close_deal" › body`. */
+    where: string;
+    /** Config path, e.g. `actions[0].body.source`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const ACTION_BODY_WRITE_UNKNOWN_FIELD = "action-body-write-unknown-field";
+declare const ACTION_RECORD_WRITE_DISCARDED = "action-record-write-discarded";
+/** @deprecated alias — the exclusion shape is shared with the hook rule. */
+type ActionBodyWriteExclusion = BodyWritePatternExclusion;
+/**
+ * Ledger shapes the UNKNOWN-FIELD check consumes — resolved against the named
+ * object's declared fields.
+ *
+ * Include-list, not exclude-list, on purpose: an unclassified new pattern is
+ * then inert here (a missed finding) rather than live against a context it was
+ * never reasoned about (a false one) — the same asymmetry the extractor's
+ * silent bails follow.
+ */
+declare const ACTION_BODY_WRITE_PATTERN_IDS: readonly string[];
+/**
+ * Ledger shapes the DISCARDED-RECORD-WRITE check consumes — never resolved
+ * against anything, because no field name can make a discarded write land.
+ */
+declare const ACTION_RECORD_WRITE_PATTERN_IDS: readonly string[];
+/** Shared-ledger patterns neither check consumes, each with its reason. */
+declare const ACTION_BODY_WRITE_EXCLUSIONS: readonly BodyWritePatternExclusion[];
+/**
+ * The subset of the shared ledger the unknown-field check sees — the published
+ * answer to "which writes does the action lint resolve against fields?".
+ */
+declare const ACTION_BODY_WRITE_PATTERNS: readonly HookBodyWritePattern[];
+/** The subset the discarded-record-write check sees. */
+declare const ACTION_RECORD_WRITE_PATTERNS: readonly HookBodyWritePattern[];
+type AnyRec$2 = Record<string, unknown>;
+/**
+ * Validate L2 action-body writes against target-object field declarations.
+ * Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or post-parse stacks.
+ */
+declare function validateActionBodyWrites(stack: AnyRec$2): ActionBodyWriteFinding[];
+
+type FlowNodeWriteSeverity = 'error';
+interface FlowNodeWriteFinding {
+    /** Always `error` — a literal key against a literal object is a certainty (see module note). */
+    severity: FlowNodeWriteSeverity;
+    rule: string;
+    /** Human-readable location, e.g. `flow "close_deal" › node "Mark won"`. */
+    where: string;
+    /** Config path, e.g. `flows[0].nodes[3].config.fields.stagee`. */
+    path: string;
+    message: string;
+    hint: string;
+}
+declare const FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
+/** Flow node types whose `config.fields` keys this rule resolves. */
+declare const FLOW_WRITE_NODE_TYPES: readonly string[];
+/** A `fields`-bearing node type this rule does NOT cover yet, and why. */
+interface FlowWriteNodeDeferral {
+    /** The `FlowNode.type` left uncovered. */
+    readonly type: string;
+    /** Why it is not covered, in terms a reviewer can act on. */
+    readonly reason: string;
+}
+/**
+ * `fields`-bearing CRUD node types deliberately left uncovered.
+ *
+ * **Empty, and that is the point.** #4369 shipped `update_record` alone and
+ * parked `create_record` here with its reason — a gating rule earning its
+ * severity one measured surface at a time — rather than leaving the other half
+ * as silence. #4371 measured the INSERT path (`table deal has no column named
+ * stagee`, and the row never created at all), found it strictly worse than the
+ * UPDATE one, and moved it across.
+ *
+ * The slot stays because the partition test derives the full `fields`-write-map
+ * set from the spec's own config schemas: a node type that grows one later
+ * belongs to neither list and fails that test until someone puts it in one.
+ * Deleting this array would turn that forced decision back into a default.
+ */
+declare const FLOW_WRITE_NODE_TYPES_DEFERRED: readonly FlowWriteNodeDeferral[];
+type AnyRec$1 = Record<string, unknown>;
+/**
+ * Validate flow write-node `fields` keys against the target object's declared
+ * fields. Pure `(stack) => Finding[]` (ADR-0019); safe on pre- or post-parse
+ * stacks.
+ */
+declare function validateFlowNodeWrites(stack: AnyRec$1): FlowNodeWriteFinding[];
+
+type ReferenceIntegritySeverity = 'error' | 'warning';
+/**
+ * The shape every rule in the suite already returns. Declared here so callers
+ * can hold one type instead of a six-way union.
+ */
+interface ReferenceIntegrityFinding {
+    /** `error` = the reference is dead; `warning` = it may resolve elsewhere, or the miss is inert. */
+    severity: ReferenceIntegritySeverity;
+    /** Diagnostic rule id (stable; used by allowlists and docs). */
+    rule: string;
+    /** Human-readable location. */
+    where: string;
+    /** Config path. */
+    path: string;
+    /** What is wrong. */
+    message: string;
+    /** How to fix it. */
+    hint: string;
+}
+/** One member of the suite. `name` is the exported function's name — the id a wiring test can assert on. */
+interface ReferenceIntegrityRule {
+    name: string;
+    run: (stack: Record<string, unknown>) => ReferenceIntegrityFinding[];
+}
+/**
+ * Every reference-integrity rule, in the order their findings are reported.
+ *
+ * ADDING A RULE: append it here and it runs on `validate`, `lint` and
+ * `compile` at once. Do not re-wire the commands.
+ */
+declare const REFERENCE_INTEGRITY_RULES: readonly ReferenceIntegrityRule[];
+/**
+ * Run every reference-integrity rule over a stack. Returns the concatenated
+ * findings (empty = clean). Pure: no I/O, safe on both the schema-parsed stack
+ * and the raw/normalized config the `lint` path carries.
+ */
+declare function validateReferenceIntegrity(stack: Record<string, unknown>): ReferenceIntegrityFinding[];
 
 /**
  * [ADR-0090 D6] Access-matrix snapshot — authoring-time companion to the
@@ -671,4 +1538,4 @@ declare function buildAccessMatrix(stack: AnyRec): AccessMatrix;
  */
 declare function diffAccessMatrix(before: AccessMatrix, after: AccessMatrix): string[];
 
-export { APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, type ApprovalApproverFinding, type ApprovalApproverSeverity, CAPABILITY_REFERENCE_UNKNOWN, CHART_CONFIG_MISSING, CHART_FIELD_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, type DashboardActionRefFinding, type DashboardActionRefSeverity, type ExprIssue, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_TRIGGER_UNKNOWN_OBJECT, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FormLayoutFinding, type FormLayoutSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, type ListViewModeFinding, type ListViewModeSeverity, MEASURE_AGGREGATE_INCOHERENT, PAGE_SOURCE_CLASSNAME, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type RecordTitleFinding, type RecordTitleSeverity, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SecurityFinding, type SecuritySeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, VIEW_CONTAINER_SHAPE, VISIBILITY_ALIAS_DEPRECATED, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, validateApprovalApprovers, validateCapabilityReferences, validateDashboardActionRefs, validateFlowTriggerReadiness, validateFormLayout, validateJsxPages, validateListViewMode, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateRecordTitle, validateResponsiveStyles, validateSecurityPosture, validateSemanticRoles, validateStackExpressions, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings };
+export { ACTION_BODY_WRITE_EXCLUSIONS, ACTION_BODY_WRITE_PATTERNS, ACTION_BODY_WRITE_PATTERN_IDS, ACTION_BODY_WRITE_UNKNOWN_FIELD, ACTION_NAME_UNDEFINED, ACTION_RECORD_WRITE_DISCARDED, ACTION_RECORD_WRITE_PATTERNS, ACTION_RECORD_WRITE_PATTERN_IDS, AGENT_AUTHORING_WITHDRAWN, AI_SKILL_SURFACE_MISMATCH, AI_SKILL_TOOL_UNRESOLVED, APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY, APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED, APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER, APPROVAL_APPROVER_TYPE_DEPRECATED, APPROVAL_APPROVER_TYPE_UNKNOWN, APPROVAL_DECISION_OUTPUTS_RESERVED, APPROVAL_ESCALATION_REASSIGN_NO_TARGET, APPROVAL_EXPRESSION_INVALID, APPROVAL_EXPRESSION_NO_EMPTY_POLICY, type ActionBodyWriteExclusion, type ActionBodyWriteFinding, type ActionBodyWriteSeverity, type ActionNameRefFinding, type ActionNameRefSeverity, type AiAgentAuthoringFinding, type AiAgentAuthoringSeverity, type AiSurfaceAffinityFinding, type AiSurfaceAffinitySeverity, type AiToolRefFinding, type AiToolRefSeverity, type ApprovalApproverFinding, type ApprovalApproverSeverity, type BodyWritePatternExclusion, CAPABILITY_REFERENCE_UNKNOWN, CHART_AXIS_NOT_SELECTED, CHART_CONFIG_MISSING, CHART_DATASET_UNKNOWN, CHART_DIMENSION_UNKNOWN, CHART_FIELD_UNKNOWN, CHART_MEASURE_UNKNOWN, type CapabilityRefFinding, type CapabilityRefSeverity, type ChartBindingFinding, type ChartBindingSeverity, DASHBOARD_ACTION_ROUTE_UNRESOLVED, DASHBOARD_ACTION_TARGET_UNDEFINED, DASHBOARD_FILTER_FIELD_UNKNOWN, type DashboardActionRefFinding, type DashboardActionRefSeverity, type ExprIssue, type ExtractedHookBodyWrite, type ExtractedHookBodyWriteSet, FIELD_GROUP_EMPTY, FIELD_GROUP_UNDECLARED, FILTER_TOKEN_UNKNOWN, FLOW_DRAFT_STATUS_AMBIGUOUS, FLOW_NODE_WRITE_UNKNOWN_FIELD, FLOW_TEMPLATE_LOOKUP_TRAVERSAL, FLOW_TEMPLATE_UNKNOWN_FIELD, FLOW_TRIGGER_UNKNOWN_OBJECT, FLOW_UPDATE_READONLY_FIELD, FLOW_UPDATE_READONLY_WHEN_FIELD, FLOW_WRITE_NODE_TYPES, FLOW_WRITE_NODE_TYPES_DEFERRED, FORM_COLSPAN_ABSOLUTE, FORM_FIELD_UNKNOWN, type FilterTokenFinding, type FilterTokenSeverity, type FlowNodeWriteFinding, type FlowNodeWriteSeverity, type FlowTemplatePathFinding, type FlowTemplatePathSeverity, type FlowTriggerReadinessFinding, type FlowTriggerReadinessSeverity, type FlowWriteNodeDeferral, type FormLayoutFinding, type FormLayoutSeverity, HOOK_BODY_WRITE_EXCLUSIONS, HOOK_BODY_WRITE_PATTERNS, HOOK_BODY_WRITE_PATTERN_IDS, HOOK_BODY_WRITE_UNKNOWN_FIELD, type HookBodyWriteFinding, type HookBodyWritePattern, type HookBodyWriteSeverity, type JsxPageFinding, type JsxPageSeverity, LIST_VIEW_FILTERS_IN_VIEWS_MODE, type ListViewModeFinding, type ListViewModeSeverity, MEASURE_AGGREGATE_INCOHERENT, NAV_OBJECT_UNGRANTED, type NavAccessFinding, type NavAccessSeverity, OBJECT_REFERENCE_UNKNOWN, OBJECT_REFERENCE_UNREGISTERED_PLATFORM, ORG_AXIS_CROSS_ORG_BU_GRANT, ORG_AXIS_PERMISSION_INHERITANCE, type ObjectRefFinding, type ObjectRefSeverity, type OrgAxisFinding, type OrgAxisSeverity, PAGE_FIELD_UNKNOWN, PAGE_SOURCE_CLASSNAME, type PageFieldFinding, type PageFieldSeverity, REACT_CHART_AGGREGATE_INVALID, REACT_CHART_AXIS_UNKNOWN, REACT_CHART_FIELD_UNKNOWN, REFERENCE_INTEGRITY_RULES, type ReactPageFinding, type ReactPageSeverity, type ReactPropFinding, type ReactPropSeverity, type ReadonlyFlowWriteFinding, type ReadonlyFlowWriteSeverity, type RecordTitleFinding, type RecordTitleSeverity, type ReferenceIntegrityFinding, type ReferenceIntegrityRule, type ReferenceIntegritySeverity, SEARCHABLE_FIELD_UNKNOWN, SECURITY_ANCHOR_HIGH_PRIVILEGE, SECURITY_BOOK_AUDIENCE_UNKNOWN_SET, SECURITY_DELEGATION_MISSING_REASON, SECURITY_EXTERNAL_WIDER, SECURITY_GRANT_EXPIRED_AT_AUTHORING, SECURITY_MASTER_DETAIL_UNGRANTED, SECURITY_OWD_ALIAS, SECURITY_OWD_UNSET, SECURITY_PRIVATE_NO_READSCOPE, SECURITY_ROLE_WORD, SECURITY_WILDCARD_VAMA, SEED_INSERT_MODE_DUPLICATES_ON_REPLAY, SEED_VALUE_OUTSIDE_STATE_MACHINE, SEMANTIC_ROLE_FIELD_UNKNOWN, STYLE_CLASSNAME_TAILWIND, STYLE_NODE_MISSING_ID, STYLE_RESPONSIVE_NO_BASE, STYLE_UNKNOWN_CSS_PROPERTY, STYLE_UNKNOWN_TOKEN, type SearchableFieldFinding, type SearchableFieldSeverity, type SecurityFinding, type SecuritySeverity, type SeedReplaySafetyFinding, type SeedReplaySafetySeverity, type SeedStateMachineFinding, type SeedStateMachineSeverity, type SemanticRoleFinding, type SemanticRoleSeverity, type SourceStyleFinding, type SourceStyleSeverity, type StyleFinding, type StyleSeverity, TABLE_COUNT_ONLY, TITLE_FORMAT_RETIRED, TITLE_UNRESOLVABLE, TRANSLATION_OPTION_KEY_UNKNOWN, TRANSLATION_TARGET_UNKNOWN, type TranslationRefFinding, type TranslationRefSeverity, VIEW_CONTAINER_SHAPE, VISIBILITY_ALIAS_DEPRECATED, VISIBILITY_ROOT_MISLAYERED, type ViewContainerFinding, type ViewContainerSeverity, type VisibilityFinding, type VisibilityLayer, type VisibilityOptions, type VisibilitySeverity, WIDGET_DATASET_UNKNOWN, WIDGET_DIMENSION_UNKNOWN, WIDGET_MEASURE_UNKNOWN, type WidgetBindingFinding, type WidgetBindingSeverity, buildAccessMatrix, diffAccessMatrix, extractHookBodyWriteSet, extractHookBodyWrites, validateActionBodyWrites, validateActionNameRefs, validateAiAgentAuthoring, validateAiSurfaceAffinity, validateAiToolReferences, validateApprovalApprovers, validateCapabilityReferences, validateChartBindings, validateDashboardActionRefs, validateFilterTokens, validateFlowNodeWrites, validateFlowTemplatePaths, validateFlowTriggerReadiness, validateFormLayout, validateHookBodyWrites, validateJsxPages, validateListViewMode, validateNavAccess, validateObjectReferences, validateOrgAxisRedLines, validatePageFieldBindings, validatePageSourceStyling, validateReactPageProps, validateReactPages, validateReadonlyFlowWrites, validateRecordTitle, validateReferenceIntegrity, validateResponsiveStyles, validateSearchableFields, validateSecurityPosture, validateSeedReplaySafety, validateSeedStateMachine, validateSemanticRoles, validateStackExpressions, validateTranslationReferences, validateViewContainers, validateVisibilityPredicates, validateWidgetBindings };