@objectstack/lint 16.1.0 → 17.0.0-rc.1

package/dist/index.js

@@ -1,5 +1,16 @@
 // src/validate-widget-bindings.ts
 import { isIncoherentAggregate } from "@objectstack/spec/data";
+import { ChartTypeSchema } from "@objectstack/spec/ui";
+
+// src/system-fields.ts
+import { FIELD_GROUP_SYSTEM_FIELDS } from "@objectstack/spec/data";
+import { SystemFieldName } from "@objectstack/spec/system";
+var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
+  ...FIELD_GROUP_SYSTEM_FIELDS,
+  ...Object.values(SystemFieldName)
+]);
+
+// src/validate-widget-bindings.ts
 var WIDGET_DATASET_UNKNOWN = "widget-dataset-unknown";
 var WIDGET_DIMENSION_UNKNOWN = "widget-dimension-unknown";
 var WIDGET_MEASURE_UNKNOWN = "widget-measure-unknown";
@@ -30,20 +41,18 @@ function asArray(v) {
 function asStrings(v) {
   return Array.isArray(v) ? v.filter((s) => typeof s === "string") : [];
 }
-var CHART_TYPES = /* @__PURE__ */ new Set([
-  "bar",
-  "horizontal-bar",
-  "column",
-  "line",
-  "area",
-  "pie",
-  "donut",
-  "funnel",
-  "scatter",
-  "treemap",
-  "sankey",
-  "radar"
+var MEASURE_EXEMPT_CHART_TYPES = /* @__PURE__ */ new Set([
+  "gauge",
+  "solid-gauge",
+  "metric",
+  "kpi",
+  "bullet",
+  "table",
+  "pivot"
 ]);
+var CHART_TYPES = new Set(
+  ChartTypeSchema.options.filter((t) => !MEASURE_EXEMPT_CHART_TYPES.has(t))
+);
 function levenshtein(a, b) {
   const m = a.length, n = b.length;
   let prev = Array.from({ length: n + 1 }, (_, j) => j);
@@ -89,18 +98,6 @@ function list(names) {
 }
 var DATE_RANGE_FILTER_NAME = "dateRange";
 var DATE_RANGE_DEFAULT_FIELD = "created_at";
-var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
-  "id",
-  "created_at",
-  "created_by",
-  "updated_at",
-  "updated_by",
-  "owner_id",
-  "organization_id",
-  "tenant_id",
-  "user_id",
-  "deleted_at"
-]);
 function dashboardFilterDefs(dash) {
   const byName = /* @__PURE__ */ new Map();
   const dateRange = dash.dateRange;
@@ -216,6 +213,15 @@ function validateWidgetBindings(stack) {
           hint: `Declared datasets: ${list(datasets.keys())}.${suggest(dsName, datasets.keys())} Define the dataset with defineDataset() or fix the reference (ADR-0021).`
         });
       }
+      if (!dsName) {
+        push({
+          severity: "error",
+          rule: WIDGET_DATASET_UNKNOWN,
+          message: `binds no \`dataset\` \u2014 the ADR-0021 widget shape requires one, so this widget resolves no data and renders empty.`,
+          hint: `Set \`dataset: '<name>'\` (plus \`values\`, and \`dimensions\` where the chart family needs them). Declared datasets: ${list(datasets.keys())}.`
+        });
+        continue;
+      }
       if (!dataset) continue;
       if (dashFilterDefs.length > 0) {
         const datasetObject = typeof dataset.object === "string" ? dataset.object : void 0;
@@ -277,13 +283,13 @@ function validateWidgetBindings(stack) {
             hint: `Point xAxis.field at a dataset dimension name.${suggest(xAxis.field, dimensionNames)}`
           });
         }
-        const measureField = (label, field) => {
+        const measureField = (label2, field) => {
           if (values.includes(field)) return;
           const declaredButUnselected = measures.has(field);
           push({
             severity: "error",
             rule: CHART_FIELD_UNKNOWN,
-            message: declaredButUnselected ? `chartConfig.${label} "${field}" is a measure of dataset "${dsName}" but is not selected in the widget's values (${list(values)}), so the query result will not contain it.` : `chartConfig.${label} "${field}" does not resolve to a measure of dataset "${dsName}" (declared measures: ${list(measures.keys())}).`,
+            message: declaredButUnselected ? `chartConfig.${label2} "${field}" is a measure of dataset "${dsName}" but is not selected in the widget's values (${list(values)}), so the query result will not contain it.` : `chartConfig.${label2} "${field}" does not resolve to a measure of dataset "${dsName}" (declared measures: ${list(measures.keys())}).`,
             hint: declaredButUnselected ? `Add "${field}" to the widget's values, or bind the chart to a selected measure.` : `Post-cutover data is keyed by the dataset's measure NAME, not the base column.${suggest(field, selectedValues.size > 0 ? selectedValues : measures.keys())}`
           });
         };
@@ -325,6 +331,7 @@ function validateWidgetBindings(stack) {
 
 // src/validate-expressions.ts
 import { validateExpression } from "@objectstack/formula";
+import { collectFlowGraphs, resolveFlowNodeExpressions } from "@objectstack/spec/automation";
 function asArray2(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -385,37 +392,53 @@ function validateStackExpressions(stack) {
     for (const e of res.errors) issues.push({ where, message: e.message, source: e.source, severity: "error" });
     for (const w of res.warnings) issues.push({ where, message: w.message, source: w.source, severity: "warning" });
   };
+  const checkDeclaredPredicate = (where, raw) => {
+    if (raw == null) return;
+    const res = validateExpression("predicate", raw);
+    for (const e of res.errors) issues.push({ where, message: e.message, source: e.source, severity: "error" });
+    for (const w of res.warnings) issues.push({ where, message: w.message, source: w.source, severity: "warning" });
+  };
   for (const flow of asArray2(stack.flows)) {
     const flowName = typeof flow.name === "string" ? flow.name : "(unnamed flow)";
     const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
-    const edges = Array.isArray(flow.edges) ? flow.edges : [];
     const startNode = nodes.find((n) => n.type === "start");
     const startCfg = startNode?.config ?? {};
     const objectName = typeof startCfg.objectName === "string" ? startCfg.objectName : void 0;
-    for (const node of nodes) {
-      const cfg = node.config ?? {};
-      check(`flow '${flowName}' \xB7 node '${node.id}' (${node.type}) condition`, cfg.condition, objectName);
-      if (node.type === "script") {
-        const fn = (typeof cfg.function === "string" ? cfg.function.trim() : "") || (typeof cfg.functionName === "string" ? cfg.functionName.trim() : "");
-        const action = typeof cfg.actionType === "string" ? cfg.actionType.trim() : "";
-        const inline = typeof cfg.script === "string" ? cfg.script.trim() : "";
-        if (!fn && !action && !inline) {
-          issues.push({
-            where: `flow '${flowName}' \xB7 node '${node.id}' (script) callable`,
-            message: `script node declares neither \`actionType\` nor \`function\` \u2014 it would do nothing at runtime. Name a built-in action (e.g. \`actionType: 'email'\`) or a registered function (\`function: 'my_fn'\`, registered via \`defineStack({ functions })\`).`,
-            source: JSON.stringify({ id: node.id, type: node.type, config: cfg })
-          });
-        } else if (action === "invoke_function" && !fn) {
-          issues.push({
-            where: `flow '${flowName}' \xB7 node '${node.id}' (script) callable`,
-            message: `script node uses \`actionType: 'invoke_function'\` but no \`function\` (or \`functionName\`) \u2014 it names no callable. Set \`function: 'my_fn'\` and register it via \`defineStack({ functions })\`.`,
-            source: JSON.stringify({ id: node.id, type: node.type, config: cfg })
-          });
+    for (const graph of collectFlowGraphs(flow)) {
+      const at = graph.scope ? `flow '${flowName}' \xB7 ${graph.scope}` : `flow '${flowName}'`;
+      for (const node of graph.nodes) {
+        const cfg = node.config ?? {};
+        check(`${at} \xB7 node '${node.id}' (${node.type}) condition`, cfg.condition, objectName);
+        const nodeType = typeof node.type === "string" ? node.type : "";
+        for (const found of resolveFlowNodeExpressions(nodeType, cfg)) {
+          if (found.entry.role !== "predicate") continue;
+          checkDeclaredPredicate(
+            `${at} \xB7 node '${node.id}' (${nodeType}) ${found.entry.label} at config.${found.path}`,
+            found.value
+          );
+        }
+        if (node.type === "script") {
+          const fn = (typeof cfg.function === "string" ? cfg.function.trim() : "") || (typeof cfg.functionName === "string" ? cfg.functionName.trim() : "");
+          const action = typeof cfg.actionType === "string" ? cfg.actionType.trim() : "";
+          const inline = typeof cfg.script === "string" ? cfg.script.trim() : "";
+          if (!fn && !action && !inline) {
+            issues.push({
+              where: `${at} \xB7 node '${node.id}' (script) callable`,
+              message: `script node declares neither \`actionType\` nor \`function\` \u2014 it would do nothing at runtime. Name a built-in action (e.g. \`actionType: 'email'\`) or a registered function (\`function: 'my_fn'\`, registered via \`defineStack({ functions })\`).`,
+              source: JSON.stringify({ id: node.id, type: node.type, config: cfg })
+            });
+          } else if (action === "invoke_function" && !fn) {
+            issues.push({
+              where: `${at} \xB7 node '${node.id}' (script) callable`,
+              message: `script node uses \`actionType: 'invoke_function'\` but no \`function\` (or \`functionName\`) \u2014 it names no callable. Set \`function: 'my_fn'\` and register it via \`defineStack({ functions })\`.`,
+              source: JSON.stringify({ id: node.id, type: node.type, config: cfg })
+            });
+          }
         }
       }
-    }
-    for (const edge of edges) {
-      check(`flow '${flowName}' \xB7 edge '${edge.id}' (${edge.source}\u2192${edge.target}) condition`, edge.condition, objectName);
+      for (const edge of graph.edges) {
+        check(`${at} \xB7 edge '${edge.id}' (${edge.source}\u2192${edge.target}) condition`, edge.condition, objectName);
+      }
     }
   }
   for (const obj of objects) {
@@ -474,8 +497,33 @@ function validateStackExpressions(stack) {
     check(where, rule.condition ?? rule.criteria ?? rule.predicate, ruleObj, "record");
   }
   for (const hook of asArray2(stack.hooks)) {
-    const hookObj = typeof hook.object === "string" ? hook.object : void 0;
-    check(`hook '${hook.name ?? "?"}'${hookObj ? ` (${hookObj})` : ""} condition`, hook.condition, hookObj, "record");
+    const hookName = hook.name ?? "?";
+    if (typeof hook.object === "string") {
+      check(`hook '${hookName}' (${hook.object}) condition`, hook.condition, hook.object, "record");
+      continue;
+    }
+    const targets = Array.isArray(hook.object) ? hook.object.filter((o) => typeof o === "string" && o !== "*") : [];
+    if (targets.length === 0) {
+      check(`hook '${hookName}' condition`, hook.condition, void 0, "record");
+      continue;
+    }
+    const before = issues.length;
+    const seen = /* @__PURE__ */ new Set();
+    const kept = [];
+    for (const target of targets) {
+      const mark = issues.length;
+      check(`hook '${hookName}' (${target}) condition`, hook.condition, target, "record");
+      for (let i = mark; i < issues.length; i++) {
+        const issue = issues[i];
+        const key = `${issue.message}\0${issue.source ?? ""}`;
+        if (!seen.has(key)) {
+          seen.add(key);
+          kept.push(issue);
+        }
+      }
+    }
+    issues.length = before;
+    issues.push(...kept);
   }
   return issues;
 }
@@ -534,14 +582,14 @@ function scanListViews(listViews, wherePrefix, pathPrefix, out) {
 function validateListViewMode(stack) {
   const out = [];
   asArray3(stack.objects).forEach((obj, i) => {
-    const label = typeof obj.name === "string" ? `object "${obj.name}"` : `objects[${i}]`;
-    scanListViews(obj.listViews, label, `objects[${i}]`, out);
+    const label2 = typeof obj.name === "string" ? `object "${obj.name}"` : `objects[${i}]`;
+    scanListViews(obj.listViews, label2, `objects[${i}]`, out);
   });
   asArray3(stack.views).forEach((view, i) => {
     const named = typeof view.objectName === "string" ? view.objectName : typeof view.name === "string" ? view.name : void 0;
-    const label = named ? `view "${named}"` : `views[${i}]`;
-    scanView(view.list, `${label} \u203A list`, `views[${i}].list`, out);
-    scanListViews(view.listViews, label, `views[${i}]`, out);
+    const label2 = named ? `view "${named}"` : `views[${i}]`;
+    scanView(view.list, `${label2} \u203A list`, `views[${i}].list`, out);
+    scanListViews(view.listViews, label2, `views[${i}]`, out);
   });
   return out;
 }
@@ -549,6 +597,8 @@ function validateListViewMode(stack) {
 // src/validate-flow-trigger-readiness.ts
 var FLOW_TRIGGER_UNKNOWN_OBJECT = "flow-trigger-unknown-object";
 var FLOW_DRAFT_STATUS_AMBIGUOUS = "flow-draft-status-ambiguous";
+var FLOW_TRIGGER_UNKNOWN_EVENT = "flow-trigger-unknown-event";
+var VALID_RECORD_TRIGGER = /^record-(?:before|after)-(?:create|insert|update|delete|write)$/;
 function asArray4(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -576,10 +626,11 @@ function validateFlowTriggerReadiness(stack) {
     const start = startNodeOf(flow);
     const config = start?.node.config ?? {};
     const triggerType = typeof config.triggerType === "string" ? config.triggerType : void 0;
-    const isRecordTriggered = !!triggerType && triggerType.startsWith("record-");
+    const isRecordTriggered2 = !!triggerType && triggerType.startsWith("record-");
+    const isArrayRecordTriggered = Array.isArray(config.triggerType) && config.triggerType.some((t) => typeof t === "string" && t.startsWith("record-"));
     const isTimeRelative = config.timeRelative != null && typeof config.timeRelative === "object";
-    const isAutoTriggered = isRecordTriggered || triggerType === "api" || config.schedule != null || isTimeRelative || flow.type === "schedule" || flow.type === "api";
-    if (isRecordTriggered && start) {
+    const isAutoTriggered = isRecordTriggered2 || triggerType === "api" || config.schedule != null || isTimeRelative || flow.type === "schedule" || flow.type === "api";
+    if (isRecordTriggered2 && start) {
       const objectName = typeof config.objectName === "string" ? config.objectName : void 0;
       if (objectName && !objectNames.has(objectName) && !objectName.startsWith("sys_")) {
         findings.push({
@@ -606,6 +657,26 @@ function validateFlowTriggerReadiness(stack) {
         });
       }
     }
+    if (start && isRecordTriggered2 && !VALID_RECORD_TRIGGER.test((triggerType ?? "").trim())) {
+      findings.push({
+        severity: "warning",
+        rule: FLOW_TRIGGER_UNKNOWN_EVENT,
+        where: `flow "${flowName}" \u203A start node`,
+        path: `flows[${flowIndex}].nodes[${start.index}].config.triggerType`,
+        message: `triggerType '${triggerType}' is not a recognized record trigger \u2014 the flow binds to the record-change trigger but never fires (the runtime stays silent about it).`,
+        hint: `Use record-{before,after}-{create,update,delete,write}. 'write' fires on create OR update in one flow (#3427); create/insert are synonyms. There is no "any change" token \u2014 pick the specific event(s).`
+      });
+    }
+    if (start && isArrayRecordTriggered) {
+      findings.push({
+        severity: "warning",
+        rule: FLOW_TRIGGER_UNKNOWN_EVENT,
+        where: `flow "${flowName}" \u203A start node`,
+        path: `flows[${flowIndex}].nodes[${start.index}].config.triggerType`,
+        message: `triggerType is an array (${JSON.stringify(config.triggerType)}), which is not supported \u2014 a start node takes a single trigger event, so the flow binds to nothing and never fires (the runtime stays silent about it).`,
+        hint: `Use one triggerType string. For "created or updated" use record-after-write (one flow, both events, #3427). For any other combination, author one flow per event \u2014 multi-event arrays are deferred (#3457).`
+      });
+    }
     if (isAutoTriggered && (flow.status == null || flow.status === "draft")) {
       findings.push({
         severity: "warning",
@@ -620,6 +691,375 @@ function validateFlowTriggerReadiness(stack) {
   return findings;
 }
 
+// src/flow-walk.ts
+import { FLOW_REGION_SLOTS_BY_TYPE, FLOW_REGION_CONFIG_KEYS } from "@objectstack/spec/automation";
+function isRec(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+var REGION_SLOTS = new Map(
+  [...FLOW_REGION_SLOTS_BY_TYPE].map(([type, slots]) => [type, slots.map((s) => s.key)])
+);
+var REGION_CONFIG_KEYS = FLOW_REGION_CONFIG_KEYS;
+var MAX_REGION_DEPTH = 16;
+function flowNodeLabel(node, index) {
+  return strName(node.label) ?? strName(node.id) ?? `#${index}`;
+}
+function stripRegions(config) {
+  if (!isRec(config)) return void 0;
+  let out;
+  for (const key of Object.keys(config)) {
+    if (!REGION_CONFIG_KEYS.has(key)) continue;
+    out ?? (out = { ...config });
+    delete out[key];
+  }
+  return out ?? config;
+}
+function walkFlowNodes(flow, flowPath) {
+  const out = [];
+  if (!isRec(flow)) return out;
+  const visitList = (nodes, basePath, trail, depth) => {
+    if (!Array.isArray(nodes) || depth > MAX_REGION_DEPTH) return;
+    nodes.forEach((raw, index) => {
+      if (!isRec(raw)) return;
+      const path = `${basePath}[${index}]`;
+      out.push({
+        node: raw,
+        path,
+        localConfig: stripRegions(raw.config),
+        regionTrail: trail,
+        depth
+      });
+      const type = strName(raw.type);
+      const slots = type ? REGION_SLOTS.get(type) : void 0;
+      if (!slots || !isRec(raw.config)) return;
+      const config = raw.config;
+      const here = `${type} "${flowNodeLabel(raw, index)}"`;
+      for (const slot of slots) {
+        const value = config[slot];
+        if (slot === "branches") {
+          if (!Array.isArray(value)) continue;
+          value.forEach((branch, b) => {
+            if (!isRec(branch)) return;
+            const branchName = strName(branch.name) ?? `#${b}`;
+            visitList(
+              branch.nodes,
+              `${path}.config.branches[${b}].nodes`,
+              joinTrail(trail, `${here} \u203A branch ${branchName}`),
+              depth + 1
+            );
+          });
+          continue;
+        }
+        if (!isRec(value)) continue;
+        visitList(
+          value.nodes,
+          `${path}.config.${slot}.nodes`,
+          joinTrail(trail, `${here} \u203A ${slot}`),
+          depth + 1
+        );
+      }
+    });
+  };
+  visitList(flow.nodes, `${flowPath}.nodes`, "", 0);
+  return out;
+}
+function joinTrail(trail, segment) {
+  return trail ? `${trail} \u203A ${segment}` : segment;
+}
+
+// src/validate-flow-template-paths.ts
+var FLOW_TEMPLATE_UNKNOWN_FIELD = "flow-template-unknown-field";
+var FLOW_TEMPLATE_LOOKUP_TRAVERSAL = "flow-template-lookup-traversal";
+function asArray5(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({
+      name,
+      ...def
+    }));
+  }
+  return [];
+}
+var IMPLICIT_HEADS = /* @__PURE__ */ new Set([
+  ...SYSTEM_FIELDS,
+  "name",
+  "owner",
+  "record_type"
+]);
+var RELATION_TYPES = /* @__PURE__ */ new Set([
+  "lookup",
+  "master_detail",
+  "user",
+  "tree"
+]);
+var FILTER_GUARDED_NODE_TYPES = /* @__PURE__ */ new Set([
+  "get_record",
+  "update_record",
+  "delete_record"
+]);
+function fieldTypesOf(obj) {
+  const types = /* @__PURE__ */ new Map();
+  for (const f of asArray5(obj.fields)) {
+    if (typeof f.name === "string") {
+      types.set(f.name, typeof f.type === "string" ? f.type : "");
+    }
+  }
+  return types;
+}
+function recordRefsIn(text) {
+  const refs = [];
+  const tokenRe = /\{([^{}]+)\}/g;
+  let m;
+  while ((m = tokenRe.exec(text)) !== null) {
+    const body = m[1].trim();
+    if (!/^[A-Za-z_$][\w$]*(?:\.(?:[A-Za-z_$][\w$]*|\d+))*$/.test(body)) continue;
+    const segments = body.split(".");
+    if (segments[0] !== "record") continue;
+    const rest = segments.slice(1);
+    if (rest.length > 0) refs.push(rest);
+  }
+  return refs;
+}
+function stringLeaves(value, out) {
+  if (typeof value === "string") {
+    if (value.includes("{")) out.push(value);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const v of value) stringLeaves(v, out);
+    return;
+  }
+  if (value && typeof value === "object") {
+    for (const v of Object.values(value)) stringLeaves(v, out);
+  }
+}
+var NODE_CONFIG_KEYS = [
+  "config",
+  "notify",
+  "update_record",
+  "create_record",
+  "http",
+  "script",
+  "screen",
+  "wait",
+  "approval",
+  "connector_action",
+  "subflow",
+  "decision",
+  "start"
+];
+function collectNodeLeaves(node, guarded) {
+  const filterLeaves = [];
+  const otherLeaves = [];
+  for (const key of NODE_CONFIG_KEYS) {
+    if (!(key in node)) continue;
+    const block = node[key];
+    const splitFilter = guarded && !!block && typeof block === "object" && !Array.isArray(block);
+    if (splitFilter) {
+      const { filter, ...rest } = block;
+      const inFilter = [];
+      stringLeaves(filter, inFilter);
+      for (const text of inFilter) filterLeaves.push({ text, inFilter: true });
+      const outside = [];
+      stringLeaves(rest, outside);
+      for (const text of outside) otherLeaves.push({ text, inFilter: false });
+      continue;
+    }
+    const plain = [];
+    stringLeaves(block, plain);
+    for (const text of plain) otherLeaves.push({ text, inFilter: false });
+  }
+  return [...filterLeaves, ...otherLeaves];
+}
+function isRecordTriggered(flow, startConfig) {
+  if (flow.type === "record_change") return true;
+  const triggerType = typeof startConfig.triggerType === "string" ? startConfig.triggerType : void 0;
+  return !!triggerType && triggerType.startsWith("record-");
+}
+function boundObjectOf(flow) {
+  const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
+  const start = nodes.find((n) => n?.type === "start");
+  if (!start) return void 0;
+  const config = start.config ?? {};
+  const typed = start.start ?? {};
+  const fromConfig = typeof config.objectName === "string" ? config.objectName : void 0;
+  const fromTyped = typeof typed.objectName === "string" ? typed.objectName : void 0;
+  return fromConfig ?? fromTyped;
+}
+function declaredExpandOf(flow) {
+  const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
+  const start = nodes.find((n) => n?.type === "start");
+  const raw = (start?.config ?? {}).expand;
+  if (typeof raw === "string") return new Set(raw ? [raw] : []);
+  if (Array.isArray(raw)) return new Set(raw.filter((r) => typeof r === "string" && r.length > 0));
+  return /* @__PURE__ */ new Set();
+}
+function validateFlowTemplatePaths(stack) {
+  const findings = [];
+  const flows = asArray5(stack.flows);
+  if (flows.length === 0) return findings;
+  const objectsByName = /* @__PURE__ */ new Map();
+  for (const obj of asArray5(stack.objects)) {
+    if (typeof obj.name === "string") objectsByName.set(obj.name, obj);
+  }
+  flows.forEach((flow, flowIndex) => {
+    const flowName = typeof flow.name === "string" ? flow.name : `#${flowIndex}`;
+    const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
+    const start = nodes.find((n) => n?.type === "start")?.config ?? {};
+    if (!isRecordTriggered(flow, start)) return;
+    const objectName = boundObjectOf(flow);
+    if (!objectName) return;
+    const obj = objectsByName.get(objectName);
+    if (!obj) return;
+    const fieldTypes = fieldTypesOf(obj);
+    const expandSet = declaredExpandOf(flow);
+    walkFlowNodes(flow, `flows[${flowIndex}]`).forEach(({ node, path: nodePath, regionTrail, localConfig }, walkIndex) => {
+      const nodeLabel = typeof node.type === "string" ? node.type : typeof node.id === "string" ? node.id : `#${walkIndex}`;
+      const where = regionTrail ? `flow "${flowName}" ${regionTrail} node "${nodeLabel}"` : `flow "${flowName}" node "${nodeLabel}"`;
+      const nodeType = typeof node.type === "string" ? node.type : "";
+      const guarded = FILTER_GUARDED_NODE_TYPES.has(nodeType);
+      const scanNode = localConfig !== void 0 && localConfig !== node.config ? { ...node, config: localConfig } : node;
+      const leaves = collectNodeLeaves(scanNode, guarded);
+      if (leaves.length === 0) return;
+      const seenUnknown = /* @__PURE__ */ new Set();
+      const seenTraversal = /* @__PURE__ */ new Set();
+      for (const leaf of leaves) {
+        const inFilter = leaf.inFilter;
+        for (const rest of recordRefsIn(leaf.text)) {
+          const head = rest[0];
+          const hasSubPath = rest.length > 1;
+          const nextIsIdentifier = hasSubPath && !/^\d+$/.test(rest[1]);
+          const isKnown = fieldTypes.has(head) || IMPLICIT_HEADS.has(head);
+          if (!isKnown) {
+            if (seenUnknown.has(head)) continue;
+            seenUnknown.add(head);
+            findings.push({
+              severity: inFilter ? "error" : "warning",
+              rule: FLOW_TEMPLATE_UNKNOWN_FIELD,
+              where,
+              path: nodePath,
+              message: inFilter ? `${nodeType} filter references '{record.${rest.join(".")}}', but '${head}' is not a field on object '${objectName}' \u2014 the token resolves to nothing, which DROPS the condition from the query instead of narrowing it. The node refuses to run at execution time (#3810).` : `template references '{record.${rest.join(".")}}', but '${head}' is not a field on object '${objectName}' \u2014 it resolves to an empty string at runtime (silently).`,
+              hint: inFilter ? `Check the field name against the object's field definitions (e.g. '{record.full_name}', not '{record.full_naem}'); system columns like id/created_at/owner are also addressable. This gates the build rather than warning: an absent condition WIDENS the query, so the runtime has already decided to refuse this node.` : `Check the field name against the object's field definitions (e.g. '{record.full_name}', not '{record.full_naem}'). System columns like id/created_at/owner are also addressable.`
+            });
+            continue;
+          }
+          if (nextIsIdentifier) {
+            const headType = fieldTypes.get(head) ?? "";
+            if (RELATION_TYPES.has(headType) && !expandSet.has(head)) {
+              const key = rest.join(".");
+              if (seenTraversal.has(key)) continue;
+              seenTraversal.add(key);
+              findings.push({
+                severity: inFilter ? "error" : "warning",
+                rule: FLOW_TEMPLATE_LOOKUP_TRAVERSAL,
+                where,
+                path: nodePath,
+                message: inFilter ? `${nodeType} filter references '{record.${key}}', a cross-object hop through the ${headType} field '${head}' \u2014 the flow record carries '${head}' as a scalar id, not an expanded object, so the token resolves to nothing and the condition is DROPPED from the query instead of narrowing it. The node refuses to run at execution time (#3810).` : `template references '{record.${key}}', a cross-object hop through the ${headType} field '${head}' \u2014 the flow record carries '${head}' as a scalar id, not an expanded object, so this resolves to an empty string at runtime (silently).`,
+                hint: inFilter ? `Opt in to resolve it: add '${head}' to the start node's config.expand (#3475) and the engine re-reads it as the run's identity. Otherwise filter on the foreign-key id directly ('{record.${head}}'), or project the value via a formula field on '${objectName}'. This gates the build rather than warning: an absent condition WIDENS the query.` : `Opt in to resolve it: add '${head}' to the start node's config.expand (#3475) and the engine re-reads it as the run's identity. Otherwise reference the foreign-key id directly ('{record.${head}}'), or project the value via a formula field on '${objectName}'.`
+              });
+            }
+          }
+        }
+      }
+    });
+  });
+  return findings;
+}
+
+// src/validate-readonly-flow-writes.ts
+var FLOW_UPDATE_READONLY_FIELD = "flow-update-readonly-field";
+var FLOW_UPDATE_READONLY_WHEN_FIELD = "flow-update-readonly-when-field";
+function asArray6(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({
+      name,
+      ...def
+    }));
+  }
+  return [];
+}
+function buildReadonlyIndex(objects) {
+  const idx = /* @__PURE__ */ new Map();
+  for (const obj of objects) {
+    const name = typeof obj.name === "string" ? obj.name : void 0;
+    if (!name) continue;
+    const fieldMap = /* @__PURE__ */ new Map();
+    const collect = (fieldName, def) => {
+      const rw = def?.readonlyWhen;
+      const readonlyWhen = rw != null && !(typeof rw === "string" && rw.trim() === "");
+      fieldMap.set(fieldName, { readonly: def?.readonly === true, readonlyWhen });
+    };
+    const fields = obj.fields;
+    if (Array.isArray(fields)) {
+      for (const f of fields) {
+        const fn = f?.name;
+        if (typeof fn === "string") collect(fn, f);
+      }
+    } else if (fields && typeof fields === "object") {
+      for (const [fn, def] of Object.entries(fields)) collect(fn, def);
+    }
+    idx.set(name, fieldMap);
+  }
+  return idx;
+}
+function readLiteralObjectName(config) {
+  const raw = config.objectName ?? config.object;
+  if (typeof raw !== "string" || raw.includes("{")) return void 0;
+  return raw || void 0;
+}
+function validateReadonlyFlowWrites(stack) {
+  const findings = [];
+  const flows = asArray6(stack.flows);
+  if (flows.length === 0) return findings;
+  const roIndex = buildReadonlyIndex(asArray6(stack.objects));
+  flows.forEach((flow, flowIndex) => {
+    if (flow.runAs === "system") return;
+    const runAs = flow.runAs === "user" || flow.runAs === "system" ? flow.runAs : "user";
+    const flowName = typeof flow.name === "string" ? flow.name : `#${flowIndex}`;
+    const walked = walkFlowNodes(flow, `flows[${flowIndex}]`);
+    walked.forEach(({ node, path: nodePath, regionTrail }, walkIndex) => {
+      if (node?.type !== "update_record") return;
+      const config = node.config ?? {};
+      const objectName = readLiteralObjectName(config);
+      if (!objectName) return;
+      const fieldMap = roIndex.get(objectName);
+      if (!fieldMap) return;
+      const fields = config.fields;
+      if (!fields || typeof fields !== "object" || Array.isArray(fields)) return;
+      const nodeName = flowNodeLabel(node, walkIndex);
+      const where = regionTrail ? `flow "${flowName}" \u203A ${regionTrail} \u203A node "${nodeName}"` : `flow "${flowName}" \u203A node "${nodeName}"`;
+      for (const fieldName of Object.keys(fields)) {
+        const meta = fieldMap.get(fieldName);
+        if (!meta) continue;
+        if (meta.readonly) {
+          findings.push({
+            severity: "error",
+            rule: FLOW_UPDATE_READONLY_FIELD,
+            where,
+            path: `${nodePath}.config.fields.${fieldName}`,
+            message: `writes field '${fieldName}', which object '${objectName}' declares readonly:true. Under runAs:'${runAs}' the engine silently strips readonly fields from the UPDATE payload (#2948), so this write never lands \u2014 while the step still reports success.`,
+            hint: `If automation is meant to maintain this field, declare the flow runAs:'system' (the intended channel \u2014 readonly governs the end-user/API surface, not trusted system writers). Otherwise remove '${fieldName}' from this update_record node.`
+          });
+        } else if (meta.readonlyWhen) {
+          findings.push({
+            severity: "warning",
+            rule: FLOW_UPDATE_READONLY_WHEN_FIELD,
+            where,
+            path: `${nodePath}.config.fields.${fieldName}`,
+            message: `writes field '${fieldName}', which object '${objectName}' declares readonlyWhen. On records where that predicate is TRUE, a runAs:'${runAs}' UPDATE strips the field (#3042), so this write may silently not land depending on the record's state.`,
+            hint: `If automation must maintain this field regardless of record state, run the flow runAs:'system'. Otherwise confirm this node only targets records whose readonlyWhen predicate is FALSE.`
+          });
+        }
+      }
+    });
+  });
+  return findings;
+}
+
 // src/validate-view-containers.ts
 var VIEW_CONTAINER_SHAPE = "view-container-shape";
 var CONTAINER_SLOT_KEYS = ["list", "form", "listViews", "formViews"];
@@ -642,13 +1082,13 @@ function validateViewContainers(stack) {
     const rec = value;
     if (rec.viewKind != null) continue;
     if (containerViewCount(rec) > 0) continue;
-    const label = typeof rec.name === "string" ? ` ("${rec.name}")` : "";
+    const label2 = typeof rec.name === "string" ? ` ("${rec.name}")` : "";
     const hasContainerSlot = CONTAINER_SLOT_KEYS.some((k) => k in rec);
     const looksFlat = !hasContainerSlot && ["type", "columns", "data", "filter", "sort"].some((k) => k in rec);
     out.push({
       severity: "error",
       rule: VIEW_CONTAINER_SHAPE,
-      where: `views${key}${label}`,
+      where: `views${key}${label2}`,
       path: `views${key}`,
       message: looksFlat ? "Flat list-view object is not a view container: `ViewSchema` strips its keys, so it parses to an EMPTY container \u2014 zero views register and the Console renders no view for it." : "View container defines no views \u2014 all of `list` / `form` / `listViews` / `formViews` are absent or empty, so nothing registers.",
       hint: "Wrap every view in a defineView container: defineView({ list: { type, data, columns, ... }, listViews: { ... }, formViews: { ... } }). See examples/app-showcase/src/ui/views/task.view.ts."
@@ -860,7 +1300,7 @@ function looksLikeTailwind(className) {
     return false;
   });
 }
-function asArray5(v) {
+function asArray7(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -953,13 +1393,13 @@ function checkNode(node, pageName, path, findings) {
 }
 function validateResponsiveStyles(stack) {
   const findings = [];
-  const pages = asArray5(stack.pages);
+  const pages = asArray7(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     const pageName = typeof page.name === "string" ? page.name : `pages[${p}]`;
-    const regions = asArray5(page.regions);
+    const regions = asArray7(page.regions);
     for (let r = 0; r < regions.length; r++) {
-      const components = asArray5(regions[r].components);
+      const components = asArray7(regions[r].components);
       for (let c = 0; c < components.length; c++) {
         checkNode(components[c], pageName, `pages[${p}].regions[${r}].components[${c}]`, findings);
       }
@@ -970,10 +1410,10 @@ function validateResponsiveStyles(stack) {
 
 // src/validate-jsx-pages.ts
 import { parseJsx, compile } from "@objectstack/sdui-parser";
-var asArray6 = (v) => Array.isArray(v) ? v : [];
+var asArray8 = (v) => Array.isArray(v) ? v : [];
 function validateJsxPages(stack, opts = {}) {
   const findings = [];
-  const pages = asArray6(stack.pages);
+  const pages = asArray8(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "html" && page.kind !== "jsx") continue;
@@ -1020,10 +1460,10 @@ function loadSucraseTransform() {
   }
   return cachedTransform;
 }
-var asArray7 = (v) => Array.isArray(v) ? v : [];
+var asArray9 = (v) => Array.isArray(v) ? v : [];
 function validateReactPages(stack) {
   const findings = [];
-  const pages = asArray7(stack.pages);
+  const pages = asArray9(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page || page.kind !== "react") continue;
@@ -1060,87 +1500,783 @@ function validateReactPages(stack) {
 
 // src/validate-react-page-props.ts
 import { createRequire as createRequire2 } from "module";
-import { REACT_BLOCKS } from "@objectstack/spec/ui";
-var cachedTs = null;
-function loadTypeScript() {
-  if (cachedTs) return cachedTs;
-  const anchor = typeof import.meta !== "undefined" && import.meta.url ? import.meta.url : typeof __filename !== "undefined" ? __filename : process.cwd() + "/";
-  try {
-    cachedTs = createRequire2(anchor)("typescript");
-  } catch (err) {
-    throw new Error(
-      `@objectstack/lint: validating a kind:'react' page requires the "typescript" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "typescript" in the image; it is only loaded when a react-source page is validated.`
-    );
+import { REACT_BLOCKS, chartAggregateResultKeys } from "@objectstack/spec/ui";
+import { VALID_AST_OPERATORS } from "@objectstack/spec/data";
+
+// src/validate-searchable-fields.ts
+var SEARCHABLE_FIELD_UNKNOWN = "searchable-field-unknown";
+function asArray10(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
-  return cachedTs;
+  return [];
 }
-var asArray8 = (v) => Array.isArray(v) ? v : [];
-var BLOCKS = new Map(
-  REACT_BLOCKS.map((b) => [
-    b.tag,
-    {
-      requiredBindings: b.interactions.filter((i) => i.required).map((i) => i.name),
-      knownProps: new Set(b.interactions.map((i) => i.name))
-    }
-  ])
-);
-function editDistance(a, b, cap = 2) {
-  if (Math.abs(a.length - b.length) > cap) return cap + 1;
-  const dp = Array.from({ length: a.length + 1 }, (_, i) => i);
-  for (let j = 1; j <= b.length; j++) {
-    let prev = dp[0];
-    dp[0] = j;
-    for (let i = 1; i <= a.length; i++) {
-      const tmp = dp[i];
-      dp[i] = Math.min(dp[i] + 1, dp[i - 1] + 1, prev + (a[i - 1] === b[j - 1] ? 0 : 1));
-      prev = tmp;
+function isRec2(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName2(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function declaredFieldNames(obj) {
+  const fields = obj.fields;
+  if (!fields || typeof fields !== "object") return null;
+  const names = /* @__PURE__ */ new Set();
+  for (const f of asArray10(fields)) {
+    const n = strName2(f.name);
+    if (n) names.add(n);
+  }
+  return names.size > 0 ? names : null;
+}
+function suggest2(target, known) {
+  let best;
+  let bestScore = Infinity;
+  for (const candidate of known) {
+    const d = distance(target, candidate);
+    if (d < bestScore) {
+      bestScore = d;
+      best = candidate;
     }
   }
-  return dp[a.length];
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
 }
-function nearestKnown(prop, known) {
-  if (known.has(prop)) return null;
-  let best = null;
-  let bestD = 3;
-  for (const k of known) {
-    const d = editDistance(prop, k);
-    if (d < bestD) {
-      bestD = d;
-      best = k;
+function distance(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
     }
+    prev = curr;
   }
-  return bestD <= 2 ? best : null;
+  return prev[n];
 }
-function validateReactPageProps(stack) {
+function indexObjectSearchTargets(stack) {
+  const fieldsByObject = /* @__PURE__ */ new Map();
+  if (!isRec2(stack)) return fieldsByObject;
+  for (const obj of asArray10(stack.objects)) {
+    const name = strName2(obj.name);
+    if (name) fieldsByObject.set(name, declaredFieldNames(obj));
+  }
+  return fieldsByObject;
+}
+function checkSearchableFieldList(declared, objectName, fieldsByObject, where, path, subject) {
   const findings = [];
-  const pages = asArray8(stack.pages);
-  for (let p = 0; p < pages.length; p++) {
-    const page = pages[p];
-    if (!page || page.kind !== "react") continue;
-    const source = page.source;
-    if (typeof source !== "string" || source.trim() === "") continue;
-    const name = String(page.name ?? `#${p}`);
-    const tsc = loadTypeScript();
-    let sf;
-    try {
-      sf = tsc.createSourceFile("page.tsx", source, tsc.ScriptTarget.Latest, true, tsc.ScriptKind.TSX);
-    } catch {
-      continue;
-    }
-    const visit = (node) => {
-      if (tsc.isJsxOpeningElement(node) || tsc.isJsxSelfClosingElement(node)) {
-        const tag = node.tagName.getText(sf);
-        const block = BLOCKS.get(tag);
-        if (block) {
-          let hasSpread = false;
-          const used = /* @__PURE__ */ new Set();
-          for (const a of node.attributes.properties) {
-            if (tsc.isJsxSpreadAttribute(a)) {
-              hasSpread = true;
-              continue;
-            }
-            if (tsc.isJsxAttribute(a)) used.add(a.name.getText(sf));
-          }
+  if (!Array.isArray(declared) || declared.length === 0) return findings;
+  if (!objectName) return findings;
+  if (!fieldsByObject.has(objectName)) return findings;
+  const known = fieldsByObject.get(objectName);
+  if (!known) return findings;
+  for (let i = 0; i < declared.length; i++) {
+    const entry = declared[i];
+    const name = strName2(entry);
+    if (!name) continue;
+    if (known.has(name) || SYSTEM_FIELDS.has(name)) continue;
+    const dotted = name.includes(".");
+    findings.push({
+      severity: "error",
+      rule: SEARCHABLE_FIELD_UNKNOWN,
+      where,
+      path: `${path}[${i}]`,
+      message: `${subject} entry "${name}" is not a field on object "${objectName}". The declaration is stale: searching it can never match, and the engine silently drops it \u2014 leaving a narrower search than declared, or the auto-default set once every entry is dropped.` + (dotted ? "" : suggest2(name, known)),
+      hint: (dotted ? `'search' scans this object's own columns, so a related record's column cannot be a search target \u2014 expand the relation and search the related object, or copy the value onto a formula field here. ` : `Fix the name, or add "${name}" to ${objectName}.fields. `) + `Clients echo this declaration verbatim as the '$searchFields' override, so a stale entry becomes a 400 INVALID_FIELD on list search (#4254), not just a quietly narrowed one.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+    });
+  }
+  return findings;
+}
+function validateSearchableFields(stack) {
+  const findings = [];
+  if (!isRec2(stack)) return findings;
+  const objects = asArray10(stack.objects);
+  const fieldsByObject = indexObjectSearchTargets(stack);
+  const check = (declared, objectName, where, path, subject) => {
+    findings.push(
+      ...checkSearchableFieldList(declared, objectName, fieldsByObject, where, path, subject)
+    );
+  };
+  for (let oi = 0; oi < objects.length; oi++) {
+    const obj = objects[oi];
+    if (!isRec2(obj)) continue;
+    const objName = strName2(obj.name);
+    const label2 = objName ? `object "${objName}"` : `objects[${oi}]`;
+    check(
+      obj.searchableFields,
+      objName,
+      label2,
+      `objects[${oi}].searchableFields`,
+      "searchableFields"
+    );
+    if (isRec2(obj.listViews)) {
+      for (const [key, lv] of Object.entries(obj.listViews)) {
+        if (!isRec2(lv)) continue;
+        check(
+          lv.searchableFields,
+          // A built-in list view belongs to its object; an inline `data.object`
+          // may still retarget it (ADR-0047 allows the explicit binding).
+          listViewObject(lv) ?? objName,
+          `${label2} \u203A listViews.${key}`,
+          `objects[${oi}].listViews.${key}.searchableFields`,
+          "list-view searchableFields"
+        );
+      }
+    }
+  }
+  const views = asArray10(stack.views);
+  for (let vi = 0; vi < views.length; vi++) {
+    const view = views[vi];
+    if (!isRec2(view)) continue;
+    const viewLabel = strName2(view.name) ?? strName2(view.objectName) ?? `#${vi}`;
+    const viewObject = strName2(view.objectName) ?? strName2(view.object);
+    if (isRec2(view.list)) {
+      check(
+        view.list.searchableFields,
+        listViewObject(view.list) ?? viewObject,
+        `view "${viewLabel}" \u203A list`,
+        `views[${vi}].list.searchableFields`,
+        "list-view searchableFields"
+      );
+    }
+    if (isRec2(view.listViews)) {
+      for (const [key, lv] of Object.entries(view.listViews)) {
+        if (!isRec2(lv)) continue;
+        check(
+          lv.searchableFields,
+          listViewObject(lv) ?? viewObject,
+          `view "${viewLabel}" \u203A listViews.${key}`,
+          `views[${vi}].listViews.${key}.searchableFields`,
+          "list-view searchableFields"
+        );
+      }
+    }
+  }
+  return findings;
+}
+function listViewObject(listView) {
+  const data = listView.data;
+  return isRec2(data) ? strName2(data.object) : void 0;
+}
+
+// src/page-walk.ts
+function isRec3(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function strName3(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+var SOURCE_AUTHORED_KINDS = /* @__PURE__ */ new Set(["html", "react", "jsx"]);
+function isSourceAuthoredPage(page) {
+  const kind = strName3(page.kind);
+  return kind !== void 0 && SOURCE_AUTHORED_KINDS.has(kind);
+}
+function walkPageComponents(page, pagePath) {
+  const out = [];
+  if (!isRec3(page) || isSourceAuthoredPage(page)) return out;
+  const pageObject = strName3(page.object);
+  const visit = (node, path, inheritedObject) => {
+    if (!isRec3(node)) return;
+    const props = isRec3(node.properties) ? node.properties : void 0;
+    const dataSource = isRec3(node.dataSource) ? node.dataSource : void 0;
+    const objectName = strName3(dataSource?.object) ?? strName3(props?.object) ?? inheritedObject;
+    out.push({ component: node, path, objectName });
+    if (!props) return;
+    if (Array.isArray(props.items)) {
+      for (let i = 0; i < props.items.length; i++) {
+        const item = props.items[i];
+        if (!isRec3(item) || !Array.isArray(item.children)) continue;
+        for (let c = 0; c < item.children.length; c++) {
+          visit(item.children[c], `${path}.properties.items[${i}].children[${c}]`, objectName);
+        }
+      }
+    }
+    if (Array.isArray(props.children)) {
+      for (let i = 0; i < props.children.length; i++) {
+        visit(props.children[i], `${path}.properties.children[${i}]`, objectName);
+      }
+    }
+    for (const key of ["body", "footer"]) {
+      const slotList = props[key];
+      if (!Array.isArray(slotList)) continue;
+      for (let i = 0; i < slotList.length; i++) {
+        visit(slotList[i], `${path}.properties.${key}[${i}]`, objectName);
+      }
+    }
+  };
+  const regions = Array.isArray(page.regions) ? page.regions : [];
+  for (let r = 0; r < regions.length; r++) {
+    const region = regions[r];
+    if (!isRec3(region) || !Array.isArray(region.components)) continue;
+    for (let c = 0; c < region.components.length; c++) {
+      visit(region.components[c], `${pagePath}.regions[${r}].components[${c}]`, pageObject);
+    }
+  }
+  const slots = isRec3(page.slots) ? page.slots : void 0;
+  if (slots) {
+    for (const [slot, value] of Object.entries(slots)) {
+      const list3 = Array.isArray(value) ? value : [value];
+      const indexed = Array.isArray(value);
+      for (let i = 0; i < list3.length; i++) {
+        visit(list3[i], `${pagePath}.slots.${slot}${indexed ? `[${i}]` : ""}`, pageObject);
+      }
+    }
+  }
+  return out;
+}
+
+// src/validate-page-field-bindings.ts
+var PAGE_FIELD_UNKNOWN = "page-field-unknown";
+function asArray11(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName4(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function isRec4(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function fieldRefsFrom(value, basePath) {
+  const out = [];
+  const one = (v, path) => {
+    const bare = strName4(v);
+    if (bare) {
+      out.push({ name: bare, path });
+      return;
+    }
+    if (!isRec4(v)) return;
+    const named = strName4(v.field) ?? strName4(v.name);
+    if (named) out.push({ name: named, path: `${path}.${strName4(v.field) ? "field" : "name"}` });
+  };
+  if (Array.isArray(value)) {
+    for (let i = 0; i < value.length; i++) one(value[i], `${basePath}[${i}]`);
+  } else {
+    one(value, basePath);
+  }
+  return out;
+}
+function sortFieldRefs(value, basePath) {
+  if (typeof value === "string") {
+    const head = value.trim().split(/\s+/)[0];
+    return head ? [{ name: head, path: basePath }] : [];
+  }
+  return fieldRefsFrom(value, basePath);
+}
+var COMPONENT_FIELD_SPECS = {
+  "record:highlights": { props: ["fields"] },
+  // `sections`/`hideFields` are not in RecordDetailsProps, but every real page
+  // authors them (they survive because `properties` is unvalidated).
+  "record:details": { props: ["fields", "hideFields"], nestedSections: ["sections"] },
+  "record:path": { props: ["statusField"] },
+  "element:number": { props: ["field"] },
+  "element:filter": { props: ["fields"] },
+  "element:form": { props: ["fields"] },
+  // The schema says `displayField`; real pages author `labelField`. Accept both.
+  "element:record_picker": { props: ["displayField", "labelField", "searchFields"] }
+};
+var RELATED_LIST_TYPE = "record:related_list";
+function componentFieldRefs(type, props, basePath, sep = ".") {
+  const spec = COMPONENT_FIELD_SPECS[type];
+  if (!spec) return null;
+  const refs = [];
+  for (const key of spec.props ?? []) {
+    refs.push(...fieldRefsFrom(props[key], `${basePath}${sep}${key}`));
+  }
+  for (const key of spec.nestedSections ?? []) {
+    const sections = Array.isArray(props[key]) ? props[key] : [];
+    for (let si = 0; si < sections.length; si++) {
+      const section = sections[si];
+      if (!isRec4(section)) continue;
+      refs.push(...fieldRefsFrom(section.fields, `${basePath}${sep}${key}[${si}].fields`));
+    }
+  }
+  return refs;
+}
+function relatedListFieldRefs(props, basePath, sep = ".") {
+  const add = isRec4(props.add) ? props.add : void 0;
+  const picker = add && isRec4(add.picker) ? add.picker : void 0;
+  const at = (key) => `${basePath}${sep}${key}`;
+  return {
+    relatedObject: strName4(props.objectName),
+    related: [
+      ...fieldRefsFrom(props.columns, at("columns")),
+      ...sortFieldRefs(props.sort, at("sort")),
+      ...fieldRefsFrom(props.filter, at("filter")),
+      ...fieldRefsFrom(props.relationshipField, at("relationshipField")),
+      ...add ? fieldRefsFrom(add.linkField, at("add.linkField")) : []
+    ],
+    parent: fieldRefsFrom(props.relationshipValueField, at("relationshipValueField")),
+    pickerObject: picker ? strName4(picker.object) : void 0,
+    picker: picker ? [
+      ...fieldRefsFrom(picker.valueField, at("add.picker.valueField")),
+      ...fieldRefsFrom(picker.labelField, at("add.picker.labelField"))
+    ] : []
+  };
+}
+function indexObjectFields(stack) {
+  const objectFields = /* @__PURE__ */ new Map();
+  if (!isRec4(stack)) return objectFields;
+  for (const obj of asArray11(stack.objects)) {
+    const name = strName4(obj.name);
+    if (!name) continue;
+    const names = /* @__PURE__ */ new Set();
+    for (const f of asArray11(obj.fields)) {
+      const fn = strName4(f.name);
+      if (fn) names.add(fn);
+    }
+    objectFields.set(name, names);
+  }
+  return objectFields;
+}
+function checkFieldRefs(refs, objectName, objectFields, where, consequence = "skipped") {
+  const findings = [];
+  if (!objectName) return findings;
+  const known = objectFields.get(objectName);
+  if (!known) return findings;
+  for (const ref of refs) {
+    if (ref.name.includes(".")) continue;
+    if (known.has(ref.name) || SYSTEM_FIELDS.has(ref.name)) continue;
+    findings.push({
+      severity: consequence === "queried" ? "error" : "warning",
+      rule: PAGE_FIELD_UNKNOWN,
+      where,
+      path: ref.path,
+      message: `field "${ref.name}" is not a field on object "${objectName}" \u2014 ` + (consequence === "queried" ? 'it is used in a QUERY, so the predicate can never match: the surface renders an empty result that looks exactly like "there is no data".' : "the component silently skips it, so it never renders."),
+      hint: `Fix the field name, or add "${ref.name}" to ${objectName}. References must match the object's field names exactly.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+    });
+  }
+  return findings;
+}
+function validatePageFieldBindings(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const objectFields = indexObjectFields(stack);
+  const pages = asArray11(stack.pages);
+  for (let pi = 0; pi < pages.length; pi++) {
+    const page = pages[pi];
+    if (!page || typeof page !== "object") continue;
+    const pageName = strName4(page.name) ?? `#${pi}`;
+    const checkRefs = (refs, objectName, where) => {
+      findings.push(...checkFieldRefs(refs, objectName, objectFields, where));
+    };
+    for (const { component, path, objectName } of walkPageComponents(page, `pages[${pi}]`)) {
+      const type = strName4(component.type);
+      const props = isRec4(component.properties) ? component.properties : void 0;
+      if (!type || !props) continue;
+      const where = `page "${pageName}" \xB7 ${type}`;
+      const base = `${path}.properties`;
+      if (type === RELATED_LIST_TYPE) {
+        const split = relatedListFieldRefs(props, base);
+        checkRefs(split.related, split.relatedObject, where);
+        checkRefs(split.parent, objectName, where);
+        checkRefs(split.picker, split.pickerObject, where);
+        continue;
+      }
+      const refs = componentFieldRefs(type, props, base);
+      if (!refs) continue;
+      checkRefs(refs, objectName, where);
+    }
+    const cfg = isRec4(page.interfaceConfig) ? page.interfaceConfig : void 0;
+    if (cfg) {
+      const cfgObject = strName4(cfg.source) ?? strName4(page.object);
+      const base = `pages[${pi}].interfaceConfig`;
+      const refs = [
+        ...fieldRefsFrom(cfg.columns, `${base}.columns`),
+        ...sortFieldRefs(cfg.sort, `${base}.sort`),
+        ...fieldRefsFrom(cfg.filterBy, `${base}.filterBy`)
+      ];
+      const userFilters = isRec4(cfg.userFilters) ? cfg.userFilters : void 0;
+      if (userFilters) {
+        refs.push(...fieldRefsFrom(userFilters.fields, `${base}.userFilters.fields`));
+      }
+      checkRefs(refs, cfgObject, `page "${pageName}" \xB7 interfaceConfig`);
+    }
+  }
+  return findings;
+}
+
+// src/validate-react-page-props.ts
+var cachedTs = null;
+function loadTypeScript() {
+  if (cachedTs) return cachedTs;
+  const anchor = typeof import.meta !== "undefined" && import.meta.url ? import.meta.url : typeof __filename !== "undefined" ? __filename : process.cwd() + "/";
+  try {
+    cachedTs = createRequire2(anchor)("typescript");
+  } catch (err) {
+    throw new Error(
+      `@objectstack/lint: validating a kind:'react' page requires the "typescript" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "typescript" in the image; it is only loaded when a react-source page is validated.`
+    );
+  }
+  return cachedTs;
+}
+var asArray12 = (v) => Array.isArray(v) ? v : [];
+var BLOCKS = new Map(
+  REACT_BLOCKS.map((b) => [
+    b.tag,
+    {
+      requiredBindings: b.interactions.filter((i) => i.required).map((i) => i.name),
+      knownProps: new Set(b.interactions.map((i) => i.name))
+    }
+  ])
+);
+function editDistance(a, b, cap = 2) {
+  if (Math.abs(a.length - b.length) > cap) return cap + 1;
+  const dp = Array.from({ length: a.length + 1 }, (_, i) => i);
+  for (let j = 1; j <= b.length; j++) {
+    let prev = dp[0];
+    dp[0] = j;
+    for (let i = 1; i <= a.length; i++) {
+      const tmp = dp[i];
+      dp[i] = Math.min(dp[i] + 1, dp[i - 1] + 1, prev + (a[i - 1] === b[j - 1] ? 0 : 1));
+      prev = tmp;
+    }
+  }
+  return dp[a.length];
+}
+function nearestKnown(prop, known) {
+  if (known.has(prop)) return null;
+  let best = null;
+  let bestD = 3;
+  for (const k of known) {
+    const d = editDistance(prop, k);
+    if (d < bestD) {
+      bestD = d;
+      best = k;
+    }
+  }
+  return bestD <= 2 ? best : null;
+}
+var NOT_STATIC = /* @__PURE__ */ Symbol("not-static");
+function staticValue(tsc, sf, node) {
+  if (!node) return NOT_STATIC;
+  if (tsc.isParenthesizedExpression(node)) return staticValue(tsc, sf, node.expression);
+  if (tsc.isStringLiteral(node) || tsc.isNoSubstitutionTemplateLiteral(node)) return node.text;
+  if (tsc.isNumericLiteral(node)) return Number(node.text);
+  if (node.kind === tsc.SyntaxKind.TrueKeyword) return true;
+  if (node.kind === tsc.SyntaxKind.FalseKeyword) return false;
+  if (node.kind === tsc.SyntaxKind.NullKeyword) return null;
+  if (tsc.isArrayLiteralExpression(node)) {
+    const out = [];
+    for (const el of node.elements) {
+      const v = staticValue(tsc, sf, el);
+      if (v === NOT_STATIC) return NOT_STATIC;
+      out.push(v);
+    }
+    return out;
+  }
+  if (tsc.isObjectLiteralExpression(node)) {
+    const out = {};
+    for (const p of node.properties) {
+      if (!tsc.isPropertyAssignment(p)) return NOT_STATIC;
+      const key = tsc.isIdentifier(p.name) || tsc.isStringLiteral(p.name) ? p.name.text : null;
+      if (key === null) return NOT_STATIC;
+      const v = staticValue(tsc, sf, p.initializer);
+      if (v === NOT_STATIC) return NOT_STATIC;
+      out[key] = v;
+    }
+    return out;
+  }
+  return NOT_STATIC;
+}
+function attrValue(tsc, sf, attr) {
+  const init = attr.initializer;
+  if (!init) return true;
+  if (tsc.isStringLiteral(init)) return init.text;
+  if (tsc.isJsxExpression(init)) return staticValue(tsc, sf, init.expression);
+  return NOT_STATIC;
+}
+function filterAttrValue(tsc, sf, attr) {
+  const init = attr.initializer;
+  if (!init || !tsc.isJsxExpression(init)) return NOT_STATIC;
+  const perPosition = (node) => {
+    if (!node) return NOT_STATIC;
+    if (tsc.isParenthesizedExpression(node)) return perPosition(node.expression);
+    if (tsc.isArrayLiteralExpression(node)) return node.elements.map((el) => perPosition(el));
+    return staticValue(tsc, sf, node);
+  };
+  return perPosition(init.expression);
+}
+var REACT_CHART_FIELD_UNKNOWN = "react-chart-field-unknown";
+var REACT_CHART_AGGREGATE_INVALID = "react-chart-aggregate-invalid";
+var REACT_CHART_AXIS_UNKNOWN = "react-chart-axis-unknown";
+var CHART_FUNCTIONS = ["count", "sum", "avg", "min", "max"];
+var isRec5 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var strOf = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
+function checkObjectChart(attrs, objectFields, findings) {
+  const { values, where, path } = attrs;
+  const push = (severity, rule, message, hint) => findings.push({ severity, rule, where, path, message, hint });
+  if (values.has("data")) return;
+  const aggregate = values.get("aggregate");
+  if (aggregate === void 0 || aggregate === NOT_STATIC) return;
+  if (!isRec5(aggregate)) return;
+  const fn = strOf(aggregate.function);
+  const field = strOf(aggregate.field);
+  const groupBy = aggregate.groupBy;
+  const groupByField = strOf(groupBy) ?? (isRec5(groupBy) ? strOf(groupBy.field) : void 0);
+  if (fn && !CHART_FUNCTIONS.includes(fn)) {
+    push(
+      "error",
+      REACT_CHART_AGGREGATE_INVALID,
+      `aggregate.function "${fn}" is not an aggregation this chart can run.`,
+      `Use one of: ${CHART_FUNCTIONS.join(", ")}.`
+    );
+  } else if (fn && fn !== "count" && !field) {
+    push(
+      "error",
+      REACT_CHART_AGGREGATE_INVALID,
+      `aggregate.function "${fn}" has no "field" to aggregate.`,
+      'Add aggregate.field, or use function "count" (the only one that may omit it).'
+    );
+  }
+  const objectName = strOf(values.get("objectName"));
+  const known = objectName ? objectFields.get(objectName) : void 0;
+  if (objectName && known) {
+    const fieldRef = (name, prop) => {
+      if (!name) return;
+      if (name.includes(".")) return;
+      if (known.has(name) || SYSTEM_FIELDS.has(name)) return;
+      push(
+        "error",
+        REACT_CHART_FIELD_UNKNOWN,
+        `aggregate.${prop} "${name}" is not a field on object "${objectName}" \u2014 the aggregate query has nothing to ${prop === "groupBy" ? "group by" : "aggregate"}, so the chart comes back empty.`,
+        `Fix the field name, or add "${name}" to ${objectName}.` + (known.size > 0 ? ` Object fields: ${[...known].sort().join(", ")}.` : "")
+      );
+    };
+    fieldRef(field, "field");
+    fieldRef(groupByField, "groupBy");
+  }
+  const keys = chartAggregateResultKeys({ field, function: fn, groupBy });
+  const columns = [keys.category, keys.value].filter((k) => !!k);
+  if (columns.length === 0) return;
+  const axisRef = (name, prop) => {
+    if (!name) return;
+    if (columns.includes(name)) return;
+    if (keys.comparison && name === keys.comparison) return;
+    push(
+      "error",
+      REACT_CHART_AXIS_UNKNOWN,
+      `"${name}" is not a column this aggregate returns, so the axis plots nothing. Object-bound aggregate rows are keyed by the RAW FIELD NAMES (unlike a dataset, whose rows are keyed by measure name).`,
+      `Result columns: ${columns.join(", ")}` + (keys.comparison ? ` (plus "${keys.comparison}" with a comparison overlay)` : "") + `. Bind ${prop} to one of them.`
+    );
+  };
+  const xAxisRaw = values.get("xAxis");
+  const categoryAxis = strOf(values.get("xAxisKey")) ?? strOf(xAxisRaw) ?? (isRec5(xAxisRaw) ? strOf(xAxisRaw.field) : void 0);
+  const categoryProp = values.has("xAxisKey") ? "xAxisKey" : "xAxis.field";
+  axisRef(categoryAxis, categoryProp);
+  const yAxisRaw = values.get("yAxis");
+  const yAxisList = Array.isArray(yAxisRaw) ? yAxisRaw : yAxisRaw !== void 0 ? [yAxisRaw] : [];
+  for (const a of yAxisList) {
+    axisRef(strOf(a) ?? (isRec5(a) ? strOf(a.field) : void 0), "yAxis[].field");
+  }
+  const series = values.get("series");
+  if (Array.isArray(series)) {
+    for (const s of series) {
+      if (!isRec5(s)) continue;
+      const dataKey = strOf(s.dataKey);
+      axisRef(dataKey ?? strOf(s.name), dataKey ? "series[].dataKey" : "series[].name");
+    }
+  }
+  if (categoryAxis && keys.category && categoryAxis !== keys.category && categoryAxis === keys.value) {
+    push(
+      "error",
+      REACT_CHART_AXIS_UNKNOWN,
+      `${categoryProp} "${categoryAxis}" is the aggregate's VALUE column, not its category column.`,
+      `The category axis is keyed by groupBy \u2014 bind it to "${keys.category}".`
+    );
+  }
+}
+var REACT_FIELD_SPECS = {
+  ListView: {
+    // `fields` is the React overlay's "limit/order the columns"; `columns` the
+    // spec ListView prop. Both name columns on the bound object, and a page may
+    // write either. `hiddenFields`/`fieldOrder`/`filterableFields` are schema
+    // props outside the curated contract — unadvertised but honored by the
+    // renderer, so a stale name there is drift just the same.
+    fields: ["fields", "columns", "hiddenFields", "fieldOrder", "filterableFields"],
+    sorts: ["sort"],
+    nestedFields: ["userFilters", "grouping"],
+    filterArrays: ["filters"]
+  },
+  ObjectForm: {
+    fields: ["fields"],
+    keyedByField: ["initialValues"],
+    // `groups` is FormViewSchema's legacy alias for `sections`.
+    sections: ["sections", "groups"]
+  },
+  ObjectChart: {
+    // The axes are result columns (checkObjectChart owns them); `filter` is an
+    // ordinary ObjectQL predicate over the bound object, like ListView's.
+    filterArrays: ["filter"]
+  }
+};
+var PATH_SEP = " \u203A ";
+var SCHEMA_TYPE_BY_TAG = new Map(
+  REACT_BLOCKS.map((b) => [b.tag, b.schemaType])
+);
+var FILTER_PROPS = new Set(
+  Object.values(REACT_FIELD_SPECS).flatMap((s) => s.filterArrays ?? [])
+);
+function readableProps(values) {
+  const out = {};
+  for (const [k, v] of values) if (v !== NOT_STATIC) out[k] = v;
+  return out;
+}
+function subformFieldRefs(value, basePath) {
+  const child = [];
+  const parent = [];
+  if (!Array.isArray(value)) return { child, parent };
+  for (let i = 0; i < value.length; i++) {
+    const sub = value[i];
+    if (!isRec5(sub)) continue;
+    const at = (key) => `${basePath}[${i}].${key}`;
+    child.push({
+      objectName: strOf(sub.childObject),
+      refs: [
+        ...fieldRefsFrom(sub.columns, at("columns")),
+        ...fieldRefsFrom(sub.relationshipField, at("relationshipField")),
+        ...fieldRefsFrom(sub.amountField, at("amountField"))
+      ]
+    });
+    parent.push(...fieldRefsFrom(sub.totalField, at("totalField")));
+  }
+  return { child, parent };
+}
+function filterFieldRefs(node, basePath, out) {
+  if (!Array.isArray(node) || node.length === 0) return;
+  const head = node[0];
+  if (typeof head === "string" && (head.toLowerCase() === "and" || head.toLowerCase() === "or")) {
+    for (let i = 1; i < node.length; i++) filterFieldRefs(node[i], `${basePath}[${i}]`, out);
+    return;
+  }
+  if (Array.isArray(head)) {
+    for (let i = 0; i < node.length; i++) filterFieldRefs(node[i], `${basePath}[${i}]`, out);
+    return;
+  }
+  if (typeof head === "string" && head.length > 0 && node.length >= 2 && typeof node[1] === "string" && VALID_AST_OPERATORS.has(node[1].toLowerCase())) {
+    out.push({ name: head, path: `${basePath}[0]` });
+  }
+}
+function reactFieldRefs(spec, values, basePath) {
+  const own = [];
+  const queried = [];
+  const readable = (key) => {
+    const v = values.get(key);
+    return v === NOT_STATIC ? void 0 : v;
+  };
+  const at = (key) => `${basePath}${PATH_SEP}${key}`;
+  for (const key of spec.fields ?? []) {
+    own.push(...fieldRefsFrom(readable(key), at(key)));
+  }
+  for (const key of spec.sorts ?? []) {
+    own.push(...sortFieldRefs(readable(key), at(key)));
+  }
+  for (const key of spec.nestedFields ?? []) {
+    const v = readable(key);
+    if (isRec5(v)) own.push(...fieldRefsFrom(v.fields, at(`${key}.fields`)));
+  }
+  for (const key of spec.sections ?? []) {
+    const v = readable(key);
+    if (!Array.isArray(v)) continue;
+    for (let i = 0; i < v.length; i++) {
+      const section = v[i];
+      if (!isRec5(section)) continue;
+      own.push(...fieldRefsFrom(section.fields, at(`${key}[${i}].fields`)));
+    }
+  }
+  for (const key of spec.keyedByField ?? []) {
+    const v = readable(key);
+    if (!isRec5(v)) continue;
+    for (const k of Object.keys(v)) own.push({ name: k, path: at(`${key}.${k}`) });
+  }
+  for (const key of spec.filterArrays ?? []) {
+    filterFieldRefs(values.get(key), at(key), queried);
+  }
+  return { own, queried };
+}
+function checkBlockFieldProps(tag, values, objectFields, where, path) {
+  const objectName = strOf(values.get("objectName"));
+  const out = [];
+  const spec = REACT_FIELD_SPECS[tag];
+  if (spec) {
+    const { own, queried } = reactFieldRefs(spec, values, path);
+    out.push(...checkFieldRefs(own, objectName, objectFields, where));
+    out.push(...checkFieldRefs(queried, objectName, objectFields, where, "queried"));
+  }
+  if (tag === "ObjectForm") {
+    const raw = values.get("subforms");
+    const subs = subformFieldRefs(raw === NOT_STATIC ? void 0 : raw, `${path}${PATH_SEP}subforms`);
+    for (const sub of subs.child) {
+      out.push(...checkFieldRefs(sub.refs, sub.objectName, objectFields, where));
+    }
+    out.push(...checkFieldRefs(subs.parent, objectName, objectFields, where));
+  }
+  const schemaType = tag === "Block" ? strOf(values.get("type")) : SCHEMA_TYPE_BY_TAG.get(tag);
+  if (schemaType) {
+    const props = readableProps(values);
+    if (schemaType === RELATED_LIST_TYPE) {
+      const split = relatedListFieldRefs(props, path, PATH_SEP);
+      out.push(...checkFieldRefs(split.related, split.relatedObject, objectFields, where));
+      out.push(...checkFieldRefs(split.picker, split.pickerObject, objectFields, where));
+    } else if (COMPONENT_FIELD_SPECS[schemaType]) {
+      out.push(
+        ...checkFieldRefs(
+          componentFieldRefs(schemaType, props, path, PATH_SEP) ?? [],
+          objectName,
+          objectFields,
+          where
+        )
+      );
+    }
+  }
+  return out;
+}
+function validateReactPageProps(stack) {
+  const findings = [];
+  const objectFields = indexObjectFields(stack);
+  const searchTargets = indexObjectSearchTargets(stack);
+  const pages = asArray12(stack.pages);
+  for (let p = 0; p < pages.length; p++) {
+    const page = pages[p];
+    if (!page || page.kind !== "react") continue;
+    const source = page.source;
+    if (typeof source !== "string" || source.trim() === "") continue;
+    const name = String(page.name ?? `#${p}`);
+    const tsc = loadTypeScript();
+    let sf;
+    try {
+      sf = tsc.createSourceFile("page.tsx", source, tsc.ScriptTarget.Latest, true, tsc.ScriptKind.TSX);
+    } catch {
+      continue;
+    }
+    const visit = (node) => {
+      if (tsc.isJsxOpeningElement(node) || tsc.isJsxSelfClosingElement(node)) {
+        const tag = node.tagName.getText(sf);
+        const block = BLOCKS.get(tag);
+        if (block) {
+          let hasSpread = false;
+          const used = /* @__PURE__ */ new Set();
+          const values = /* @__PURE__ */ new Map();
+          for (const a of node.attributes.properties) {
+            if (tsc.isJsxSpreadAttribute(a)) {
+              hasSpread = true;
+              continue;
+            }
+            if (tsc.isJsxAttribute(a)) {
+              const propName = a.name.getText(sf);
+              used.add(propName);
+              values.set(
+                propName,
+                FILTER_PROPS.has(propName) ? filterAttrValue(tsc, sf, a) : attrValue(tsc, sf, a)
+              );
+            }
+          }
           const where = `page "${name}" \u203A <${tag}>`;
           const path = `pages[${p}].source`;
           if (!hasSpread) {
@@ -1170,6 +2306,26 @@ function validateReactPageProps(stack) {
               });
             }
           }
+          if (tag === "ObjectChart" && !hasSpread) {
+            checkObjectChart({ values, where, path }, objectFields, findings);
+          }
+          if (tag === "ListView" && !hasSpread) {
+            findings.push(
+              ...checkSearchableFieldList(
+                values.get("searchableFields"),
+                strOf(values.get("objectName")),
+                searchTargets,
+                where,
+                `${path} \u203A searchableFields`,
+                "searchableFields"
+              )
+            );
+          }
+          if (!hasSpread) {
+            findings.push(
+              ...checkBlockFieldProps(tag, values, objectFields, where, path)
+            );
+          }
         }
       }
       tsc.forEachChild(node, visit);
@@ -1181,11 +2337,11 @@ function validateReactPageProps(stack) {
 
 // src/validate-page-source-styling.ts
 var PAGE_SOURCE_CLASSNAME = "page-source-className-tailwind";
-var asArray9 = (v) => Array.isArray(v) ? v : [];
+var asArray13 = (v) => Array.isArray(v) ? v : [];
 var CLASSNAME_ATTR = /\bclassName\s*=\s*["'{]/g;
 function validatePageSourceStyling(stack) {
   const findings = [];
-  const pages = asArray9(stack.pages);
+  const pages = asArray13(stack.pages);
   for (let p = 0; p < pages.length; p++) {
     const page = pages[p];
     if (!page) continue;
@@ -1214,7 +2370,7 @@ function validatePageSourceStyling(stack) {
 import { objectTitleCompleteness } from "@objectstack/spec/data";
 var TITLE_FORMAT_RETIRED = "title-format-retired";
 var TITLE_UNRESOLVABLE = "title-unresolvable";
-function asArray10(v) {
+function asArray14(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1223,7 +2379,7 @@ function asArray10(v) {
 }
 function validateRecordTitle(stack) {
   const findings = [];
-  const objects = asArray10(stack.objects);
+  const objects = asArray14(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
@@ -1259,7 +2415,7 @@ var FIELD_GROUP_UNDECLARED = "field-group-undeclared";
 var FIELD_GROUP_EMPTY = "field-group-empty";
 var FIELD_GROUP_SHADOWED = "field-group-shadowed";
 var SEMANTIC_ROLE_FIELD_UNKNOWN = "semantic-role-field-unknown";
-function asArray11(v) {
+function asArray15(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1268,7 +2424,7 @@ function asArray11(v) {
 }
 function validateSemanticRoles(stack) {
   const findings = [];
-  const objects = asArray11(stack.objects);
+  const objects = asArray15(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -1363,7 +2519,7 @@ function validateSemanticRoles(stack) {
 // src/validate-form-layout.ts
 var FORM_FIELD_UNKNOWN = "form-field-unknown";
 var FORM_COLSPAN_ABSOLUTE = "absolute-colspan-discouraged";
-function asArray12(v) {
+function asArray16(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1388,13 +2544,13 @@ function boundObject(view) {
 function validateFormLayout(stack) {
   const findings = [];
   const objectFields = /* @__PURE__ */ new Map();
-  for (const obj of asArray12(stack.objects)) {
+  for (const obj of asArray16(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : void 0;
     if (!name) continue;
     const fields = obj.fields && typeof obj.fields === "object" && !Array.isArray(obj.fields) ? Object.keys(obj.fields) : [];
     objectFields.set(name, new Set(fields));
   }
-  const views = asArray12(stack.views);
+  const views = asArray16(stack.views);
   for (let i = 0; i < views.length; i++) {
     const view = views[i];
     if (!view || typeof view !== "object") continue;
@@ -1444,7 +2600,7 @@ var VISIBILITY_ALIAS_DEPRECATED = "visibility-alias-deprecated";
 var VISIBILITY_ROOT_MISLAYERED = "visibility-root-mislayered";
 var CANONICAL = "visibleWhen";
 var ALIASES = ["visibleOn", "visibility"];
-function asArray13(v) {
+function asArray17(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1506,7 +2662,7 @@ function isFieldObject(entry) {
 function validateVisibilityPredicates(stack, opts = {}) {
   const layer = opts.layer ?? "runtime";
   const findings = [];
-  const views = asArray13(stack.views);
+  const views = asArray17(stack.views);
   for (let i = 0; i < views.length; i++) {
     const view = views[i];
     if (!view || typeof view !== "object") continue;
@@ -1529,7 +2685,7 @@ function validateVisibilityPredicates(stack, opts = {}) {
       }
     }
   }
-  const pages = asArray13(stack.pages);
+  const pages = asArray17(stack.pages);
   for (let i = 0; i < pages.length; i++) {
     const page = pages[i];
     if (!page || typeof page !== "object") continue;
@@ -1553,7 +2709,7 @@ function validateVisibilityPredicates(stack, opts = {}) {
 // src/validate-capability-references.ts
 import { PLATFORM_CAPABILITY_NAMES } from "@objectstack/spec/security";
 var CAPABILITY_REFERENCE_UNKNOWN = "capability-reference-unknown";
-function asArray14(v) {
+function asArray18(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1578,13 +2734,13 @@ function validateCapabilityReferences(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const known = new Set(PLATFORM_CAPABILITY_NAMES);
-  for (const cap of asArray14(stack.capabilities)) {
+  for (const cap of asArray18(stack.capabilities)) {
     if (typeof cap.name === "string" && cap.name.length > 0) known.add(cap.name);
   }
-  for (const ps of asArray14(stack.permissions)) {
+  for (const ps of asArray18(stack.permissions)) {
     for (const cap of asCapArray(ps.systemPermissions)) known.add(cap);
   }
-  for (const seed of asArray14(stack.data)) {
+  for (const seed of asArray18(stack.data)) {
     if (seed.object !== "sys_capability") continue;
     for (const rec of Array.isArray(seed.records) ? seed.records : []) {
       const name = rec?.name;
@@ -1603,7 +2759,7 @@ function validateCapabilityReferences(stack) {
       hint
     });
   };
-  const objects = asArray14(stack.objects);
+  const objects = asArray18(stack.objects);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -1612,27 +2768,27 @@ function validateCapabilityReferences(stack) {
     for (const { cap, key } of flattenObjectRequired(obj.requiredPermissions)) {
       flag(cap, `object "${objName}"`, `${objPath}.requiredPermissions${key ? `.${key}` : ""}`);
     }
-    const fields = asArray14(obj.fields);
+    const fields = asArray18(obj.fields);
     for (const f of fields) {
       const fname = typeof f.name === "string" ? f.name : "(field)";
       for (const cap of asCapArray(f.requiredPermissions)) {
         flag(cap, `field "${objName}.${fname}"`, `${objPath}.fields.${fname}.requiredPermissions`);
       }
     }
-    for (const [ai, action] of asArray14(obj.actions).entries()) {
+    for (const [ai, action] of asArray18(obj.actions).entries()) {
       const aName = typeof action.name === "string" ? action.name : `(action ${ai})`;
       for (const cap of asCapArray(action.requiredPermissions)) {
         flag(cap, `action "${objName}.${aName}"`, `${objPath}.actions[${ai}].requiredPermissions`);
       }
     }
   }
-  for (const [i, action] of asArray14(stack.actions).entries()) {
+  for (const [i, action] of asArray18(stack.actions).entries()) {
     const aName = typeof action.name === "string" ? action.name : `(action ${i})`;
     for (const cap of asCapArray(action.requiredPermissions)) {
       flag(cap, `action "${aName}"`, `actions[${i}].requiredPermissions`);
     }
   }
-  const apps = asArray14(stack.apps);
+  const apps = asArray18(stack.apps);
   for (let i = 0; i < apps.length; i++) {
     const app = apps[i];
     if (!app || typeof app !== "object") continue;
@@ -1663,18 +2819,33 @@ import {
   ApproverType,
   APPROVAL_NODE_TYPE,
   DEPRECATED_APPROVER_TYPES,
-  canonicalApproverType
+  APPROVER_VALUE_BINDINGS,
+  approverTypeIsOrgScoped,
+  canonicalApproverType,
+  normalizeDecisionOutputs
 } from "@objectstack/spec/automation";
+import { BUILTIN_MEMBERSHIP_ROLES } from "@objectstack/spec";
+import { collectCelRootIdentifiers } from "@objectstack/formula";
 var APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER = "approval-approver-not-membership-tier";
 var APPROVAL_APPROVER_TYPE_DEPRECATED = "approval-approver-type-deprecated";
 var APPROVAL_APPROVER_TYPE_UNKNOWN = "approval-approver-type-unknown";
+var APPROVAL_APPROVER_TYPE_UNSUPPORTED = "approval-approver-type-unsupported";
 var APPROVAL_ESCALATION_REASSIGN_NO_TARGET = "approval-escalation-reassign-no-target";
-var MEMBERSHIP_TIERS = /* @__PURE__ */ new Set(["owner", "admin", "member", "guest"]);
+var APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY = "approval-approvers-may-resolve-empty";
+var APPROVAL_EXPRESSION_INVALID = "approval-expression-invalid";
+var APPROVAL_EXPRESSION_NO_EMPTY_POLICY = "approval-expression-no-empty-policy";
+var APPROVAL_DECISION_OUTPUTS_RESERVED = "approval-decision-outputs-reserved";
+var APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED = "approval-approver-cross-org-unsupported";
+var EXPRESSION_ROOTS = /* @__PURE__ */ new Set(["current", "trigger", "vars"]);
+var RESERVED_OUTPUT_KEYS = /* @__PURE__ */ new Set(["decision", "requestId"]);
+var GROUP_ROUTED_TYPES = /* @__PURE__ */ new Set(["position", "team", "department"]);
+var MEMBERSHIP_TIERS = new Set(BUILTIN_MEMBERSHIP_ROLES);
+var MEMBERSHIP_TIER_LIST = BUILTIN_MEMBERSHIP_ROLES.join("/");
 var TYPE_FIX = {
   business_unit: "department",
   bu: "department"
 };
-function asArray15(v) {
+function asArray19(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1684,15 +2855,15 @@ function asArray15(v) {
 function validateApprovalApprovers(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const flows = asArray15(stack.flows);
+  const flows = asArray19(stack.flows);
   const validTypes = new Set(ApproverType.options);
   for (let fi = 0; fi < flows.length; fi++) {
     const flow = flows[fi];
     if (!flow || typeof flow !== "object") continue;
     const flowName = typeof flow.name === "string" ? flow.name : `(flow ${fi})`;
-    const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
-    for (let ni = 0; ni < nodes.length; ni++) {
-      const node = nodes[ni];
+    const walked = walkFlowNodes(flow, `flows[${fi}]`);
+    for (let ni = 0; ni < walked.length; ni++) {
+      const { node, path: nodePath } = walked[ni];
       if (!node || node.type !== APPROVAL_NODE_TYPE) continue;
       const nodeId = typeof node.id === "string" ? node.id : `(node ${ni})`;
       const cfg = node.config ?? {};
@@ -1703,7 +2874,7 @@ function validateApprovalApprovers(stack) {
         if (!a || typeof a !== "object") continue;
         const type = typeof a.type === "string" ? a.type : "";
         const value = typeof a.value === "string" ? a.value : "";
-        const path = `flows[${fi}].nodes[${ni}].config.approvers[${ai}]`;
+        const path = `${nodePath}.config.approvers[${ai}]`;
         if (type && !validTypes.has(type)) {
           const fix = TYPE_FIX[type];
           findings.push({
@@ -1717,14 +2888,61 @@ function validateApprovalApprovers(stack) {
           continue;
         }
         const canonical = canonicalApproverType(type);
+        if (canonical === "expression") {
+          const source = value.trim();
+          if (!source) {
+            findings.push({
+              severity: "error",
+              rule: APPROVAL_EXPRESSION_INVALID,
+              where,
+              path: `${path}.value`,
+              message: `expression approver has an empty expression \u2014 the node fails at entry.`,
+              hint: `Write a CEL expression over current.* (the record's live state at node entry), trigger.* (the submit-time snapshot) or vars.* (flow variables), e.g. current.approvers_dynamic or vars.approval_lead.picked_departments.`
+            });
+          } else {
+            const parsed = collectCelRootIdentifiers(source);
+            if (!parsed.ok) {
+              findings.push({
+                severity: "error",
+                rule: APPROVAL_EXPRESSION_INVALID,
+                where,
+                path: `${path}.value`,
+                message: `expression approver does not parse as CEL: ${parsed.error}.`,
+                hint: `Approver expressions are bare CEL (no {\u2026} template braces), e.g. current.approvers_dynamic or vars.get_reviewers.record.owner_id.`
+              });
+            } else {
+              const illegal = parsed.roots.filter((r) => !EXPRESSION_ROOTS.has(r));
+              if (illegal.length) {
+                const wantsRecord = illegal.includes("record") || illegal.includes("previous");
+                findings.push({
+                  severity: "error",
+                  rule: APPROVAL_EXPRESSION_INVALID,
+                  where,
+                  path: `${path}.value`,
+                  message: `expression approver references \`${illegal.join("`, `")}\` \u2014 only current.*, trigger.* and vars.* are available, and the node fails at entry on any other root.`,
+                  hint: wantsRecord ? `\`record\`/\`previous\` are not bound here (on this platform \`record\` always means "the record at event time", which is ambiguous at an approval node). Write current.<field> for the live value at node entry, trigger.<field> for the submit-time snapshot (vars.previous carries the pre-update row).` : `Did you mean current.<field> (live record), trigger.<field> (submit snapshot), or vars.<name> (flow variable)?`
+                });
+              }
+            }
+          }
+        } else if (a.resolveAs != null) {
+          findings.push({
+            severity: "info",
+            rule: APPROVAL_EXPRESSION_INVALID,
+            where,
+            path: `${path}.resolveAs`,
+            message: `resolveAs has no effect on a '${type}' approver \u2014 it only applies to type 'expression'.`,
+            hint: `Remove it, or switch this approver to { type: 'expression', value: '<CEL>', resolveAs: '${String(a.resolveAs)}' }.`
+          });
+        }
         if (canonical === "org_membership_level" && value && !MEMBERSHIP_TIERS.has(value.toLowerCase())) {
           findings.push({
             severity: "warning",
             rule: APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER,
             where,
             path: `${path}.value`,
-            message: `approver { type: '${type}', value: '${value}' } resolves against the better-auth org-membership tier (sys_member.role: owner/admin/member) \u2014 '${value}' is not a membership tier, so this approver matches nobody and the request stalls.`,
-            hint: `If '${value}' is an org position, author { type: 'position', value: '${value}' } (resolved via sys_user_position, ADR-0090 D3). Keep type 'org_membership_level' only for membership tiers (owner/admin/member).`
+            message: `approver { type: '${type}', value: '${value}' } resolves against the better-auth org-membership tier (sys_member.role: ${MEMBERSHIP_TIER_LIST}) \u2014 '${value}' is not a membership tier, so this approver matches nobody and the request stalls.`,
+            hint: `If '${value}' is an org position, author { type: 'position', value: '${value}' } (resolved via sys_user_position, ADR-0090 D3). Keep type 'org_membership_level' only for membership tiers (${MEMBERSHIP_TIER_LIST}) \u2014 the vocabulary is closed (ADR-0108), so a business role is always a position.`
           });
         } else if (type in DEPRECATED_APPROVER_TYPES) {
           const fix = canonicalApproverType(type);
@@ -1736,7 +2954,66 @@ function validateApprovalApprovers(stack) {
             message: `approver type '${type}' is the deprecated spelling of '${fix}' (ADR-0090 D3) and is removed in the next major.`,
             hint: `Author { type: '${fix}', value: '${value}' }. It resolves identically today.`
           });
+        } else if (APPROVER_VALUE_BINDINGS[canonical]?.source === "unsupported") {
+          findings.push({
+            severity: "warning",
+            rule: APPROVAL_APPROVER_TYPE_UNSUPPORTED,
+            where,
+            path: `${path}.type`,
+            message: `approver type '${type}' is declared but not implemented by the runtime (#3508) \u2014 the slot resolves to nobody and the request stalls.`,
+            hint: `Route to people the engine can expand: { type: 'team' | 'department' | 'position', ... }. Queue approvers need a real ownership-queue implementation before they take effect.`
+          });
         }
+        const declaredOrg = a.organization;
+        if (typeof declaredOrg === "string" && declaredOrg.trim() !== "" && ApproverType.options.includes(canonical) && !approverTypeIsOrgScoped(canonical)) {
+          findings.push({
+            severity: "error",
+            rule: APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED,
+            where,
+            path: `${path}.organization`,
+            message: `approver type '${type}' does not resolve through an organization directory, so 'organization: ${declaredOrg}' has no effect (ADR-0105 D9) \u2014 the runtime refuses it.`,
+            hint: `Drop 'organization' here. Cross-organization targeting applies to 'position', 'org_membership_level', 'department' and 'expression' approvers.`
+          });
+        }
+      }
+      const routable = approvers.filter(
+        (a) => a && typeof a === "object" && typeof a.type === "string"
+      );
+      if (routable.length > 0 && routable.every((a) => GROUP_ROUTED_TYPES.has(canonicalApproverType(String(a.type))))) {
+        const locks = cfg.lockRecord !== false;
+        findings.push({
+          severity: "info",
+          rule: APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY,
+          where,
+          path: `${nodePath}.config.approvers`,
+          message: `every approver on this node routes to a group (position/team/department) whose members are runtime data \u2014 if none is staffed, the request resolves to an empty slate and waits forever` + (locks ? `, and (lockRecord) the record stays locked with no in-product recovery.` : `.`),
+          hint: `Make sure at least one target is always staffed, or add a guaranteed-staffed fallback approver, e.g. { type: 'org_membership_level', value: 'owner' }. A request that still lands empty is recoverable only by a platform/tenant admin override (#3424).`
+        });
+      }
+      const hasExpression = approvers.some(
+        (a) => a && typeof a === "object" && canonicalApproverType(String(a.type ?? "")) === "expression"
+      );
+      if (hasExpression && cfg.onEmptyApprovers == null) {
+        findings.push({
+          severity: "info",
+          rule: APPROVAL_EXPRESSION_NO_EMPTY_POLICY,
+          where,
+          path: `${nodePath}.config`,
+          message: `this node resolves approvers from an expression but declares no onEmptyApprovers \u2014 an empty result falls back to the default ('admin_rescue': request opens, only a privileged admin can act).`,
+          hint: `Declare the empty-slate policy explicitly: onEmptyApprovers: 'admin_rescue' (hold for admin takeover), 'fail' (fail the node \u2014 config bug), or 'auto_approve' (wave through, output.autoApproved = true).`
+        });
+      }
+      const declaredOutputs = normalizeDecisionOutputs(cfg.decisionOutputs).map((d) => d.key);
+      const reserved = declaredOutputs.filter((k) => RESERVED_OUTPUT_KEYS.has(k));
+      if (reserved.length) {
+        findings.push({
+          severity: "error",
+          rule: APPROVAL_DECISION_OUTPUTS_RESERVED,
+          where,
+          path: `${nodePath}.config.decisionOutputs`,
+          message: `decisionOutputs declares reserved key(s) \`${reserved.join("`, `")}\` \u2014 the resume envelope owns them, so every decide carrying them is rejected.`,
+          hint: `Rename the output key(s); any name other than 'decision'/'requestId' works.`
+        });
       }
       const escalation = cfg.escalation ?? null;
       if (escalation && typeof escalation === "object" && escalation.action === "reassign") {
@@ -1746,7 +3023,7 @@ function validateApprovalApprovers(stack) {
             severity: "warning",
             rule: APPROVAL_ESCALATION_REASSIGN_NO_TARGET,
             where,
-            path: `flows[${fi}].nodes[${ni}].config.escalation.escalateTo`,
+            path: `${nodePath}.config.escalation.escalateTo`,
             message: `escalation.action is 'reassign' but escalateTo is empty \u2014 at runtime the escalation degrades to a notify and the request stays with the original approvers.`,
             hint: `Set escalateTo to a position machine name (expanded via sys_user_position, ADR-0090 D3) or a specific user id, or change action to 'notify'.`
           });
@@ -1757,6 +3034,96 @@ function validateApprovalApprovers(stack) {
   return findings;
 }
 
+// src/validate-seed-replay-safety.ts
+var SEED_INSERT_MODE_DUPLICATES_ON_REPLAY = "seed-insert-mode-duplicates-on-replay";
+function validateSeedReplaySafety(stack) {
+  const out = [];
+  const seeds = Array.isArray(stack.data) ? stack.data : [];
+  seeds.forEach((seed, i) => {
+    if (!seed || typeof seed !== "object") return;
+    if (seed.mode !== "insert") return;
+    const object = typeof seed.object === "string" ? seed.object : void 0;
+    const where = object ? `seed "${object}"` : `data[${i}]`;
+    out.push({
+      severity: "warning",
+      rule: SEED_INSERT_MODE_DUPLICATES_ON_REPLAY,
+      where,
+      path: `data[${i}].mode`,
+      message: "`mode: 'insert'` re-inserts every record on each replay boot (dev-server restart, package re-publish) with no existing-row check, so the dataset duplicates the table on every restart \u2014 seeds are replayed, not applied once.",
+      hint: "Use `mode: 'ignore'` (skip rows that already exist) or `'upsert'` (create-or-update), and declare an `externalId` to match on: a single natural-key field (e.g. `externalId: 'code'`), or a COMPOSITE list of fields for a join / junction table with no single natural key (e.g. `externalId: ['team', 'project']`)."
+    });
+  });
+  return out;
+}
+
+// src/validate-seed-state-machine.ts
+var SEED_VALUE_OUTSIDE_STATE_MACHINE = "seed-value-outside-state-machine";
+function fsmRulesByObject(objects) {
+  const map = /* @__PURE__ */ new Map();
+  for (const obj of objects) {
+    if (!obj || typeof obj !== "object") continue;
+    const name = typeof obj.name === "string" ? obj.name : void 0;
+    if (!name) continue;
+    const validations = Array.isArray(obj.validations) ? obj.validations : [];
+    const rules = [];
+    for (const v of validations) {
+      if (!v || typeof v !== "object" || v.type !== "state_machine") continue;
+      const field = typeof v.field === "string" ? v.field : void 0;
+      if (!field) continue;
+      const transitions = v.transitions && typeof v.transitions === "object" ? v.transitions : {};
+      const states = /* @__PURE__ */ new Set();
+      for (const s of Array.isArray(v.initialStates) ? v.initialStates : []) states.add(String(s));
+      for (const from of Object.keys(transitions)) {
+        states.add(String(from));
+        const targets = transitions[from];
+        for (const to of Array.isArray(targets) ? targets : []) states.add(String(to));
+      }
+      if (states.size > 0) rules.push({ field, states });
+    }
+    if (rules.length > 0) map.set(name, rules);
+  }
+  return map;
+}
+function recordLabel(record, externalId, index) {
+  const keys = Array.isArray(externalId) ? externalId.map(String) : typeof externalId === "string" ? [externalId] : ["name"];
+  const parts = keys.map((k) => record[k]).filter((v) => v != null && v !== "");
+  return parts.length > 0 ? parts.map(String).join(" \xB7 ") : `#${index}`;
+}
+function validateSeedStateMachine(stack) {
+  const out = [];
+  const objects = Array.isArray(stack.objects) ? stack.objects : [];
+  const seeds = Array.isArray(stack.data) ? stack.data : [];
+  if (objects.length === 0 || seeds.length === 0) return out;
+  const rulesByObject = fsmRulesByObject(objects);
+  if (rulesByObject.size === 0) return out;
+  seeds.forEach((seed, i) => {
+    if (!seed || typeof seed !== "object") return;
+    const objectName = typeof seed.object === "string" ? seed.object : void 0;
+    if (!objectName) return;
+    const rules = rulesByObject.get(objectName);
+    if (!rules) return;
+    const records = Array.isArray(seed.records) ? seed.records : [];
+    records.forEach((record, j) => {
+      if (!record || typeof record !== "object") return;
+      for (const rule of rules) {
+        const value = record[rule.field];
+        if (value == null || value === "") continue;
+        if (typeof value !== "string") continue;
+        if (rule.states.has(value)) continue;
+        out.push({
+          severity: "warning",
+          rule: SEED_VALUE_OUTSIDE_STATE_MACHINE,
+          where: `seed "${objectName}" (${recordLabel(record, seed.externalId, j)})`,
+          path: `data[${i}].records[${j}].${rule.field}`,
+          message: `seeds '${rule.field}=${value}', which the '${objectName}' state machine does not declare (known states: ${[...rule.states].sort().join(", ")}). Seed writes are exempt from the state_machine rule (#3433), so this is NOT rejected at write time \u2014 a typo lands silently.`,
+          hint: `If '${value}' is a real state, add it to the state machine (as an initial state or a transition endpoint). If it is a typo, correct it to a declared state. The exemption lets a seed be born mid-lifecycle; it is not a licence to write an unknown state.`
+        });
+      }
+    });
+  });
+  return out;
+}
+
 // src/validate-security-posture.ts
 import { describeAnchorForbiddenBits } from "@objectstack/spec/security";
 var SECURITY_OWD_UNSET = "security-owd-unset";
@@ -1783,7 +3150,7 @@ var OWD_WIDTH = {
   public_read: 1,
   public_read_write: 2
 };
-function asArray16(v) {
+function asArray20(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
@@ -1800,16 +3167,16 @@ function identifierHasRoleToken(name) {
   if (typeof name !== "string") return false;
   return name.toLowerCase().split(/[^a-z0-9]+/).some((tok) => tok === "role" || tok === "roles");
 }
-function labelHasRoleWord(label) {
-  if (typeof label !== "string") return false;
-  return /\brole(s)?\b/i.test(label);
+function labelHasRoleWord(label2) {
+  if (typeof label2 !== "string") return false;
+  return /\brole(s)?\b/i.test(label2);
 }
 function refOf(def) {
   const r = def.reference ?? def.reference_to;
   return typeof r === "string" && r ? r : void 0;
 }
 function firstMasterDetailField(obj) {
-  for (const f of asArray16(obj.fields)) {
+  for (const f of asArray20(obj.fields)) {
     if (f.type === "master_detail") {
       return { name: String(f.name ?? "?"), parent: refOf(f) };
     }
@@ -1822,8 +3189,8 @@ function grantsObjectAccess(p) {
 function validateSecurityPosture(stack, opts) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const objects = asArray16(stack.objects);
-  const permissionSets = asArray16(stack.permissions);
+  const objects = asArray20(stack.objects);
+  const permissionSets = asArray20(stack.permissions);
   for (let i = 0; i < objects.length; i++) {
     const obj = objects[i];
     if (!obj || typeof obj !== "object") continue;
@@ -1926,7 +3293,7 @@ function validateSecurityPosture(stack, opts) {
       }
     }
   }
-  const flagRole = (kind, name, label, where, path) => {
+  const flagRole = (kind, name, label2, where, path) => {
     if (identifierHasRoleToken(name)) {
       findings.push({
         severity: "error",
@@ -1936,13 +3303,13 @@ function validateSecurityPosture(stack, opts) {
         message: `${kind} name "${String(name)}" uses the reserved word "role" \u2014 the platform vocabulary is permission_set (capability), position (distribution), business_unit (hierarchy) (ADR-0090 D3).`,
         hint: `Rename using 'position' for distribution groups or a domain word (e.g. 'function', 'duty').`
       });
-    } else if (labelHasRoleWord(label)) {
+    } else if (labelHasRoleWord(label2)) {
       findings.push({
         severity: "error",
         rule: SECURITY_ROLE_WORD,
         where,
         path: `${path.replace(/\.name$/, "")}.label`,
-        message: `${kind} label "${String(label)}" uses the reserved word "role" (ADR-0090 D3).`,
+        message: `${kind} label "${String(label2)}" uses the reserved word "role" (ADR-0090 D3).`,
         hint: `Relabel with 'Position' (distribution) or a domain word \u2014 admins must meet ONE vocabulary.`
       });
     }
@@ -1952,10 +3319,10 @@ function validateSecurityPosture(stack, opts) {
     if (!obj || typeof obj !== "object" || isSystemObject(obj)) continue;
     const objName = typeof obj.name === "string" ? obj.name : `(object ${i})`;
     flagRole("object", obj.name, obj.label, `object "${objName}"`, `objects[${i}].name`);
-    for (const f of asArray16(obj.fields)) {
+    for (const f of asArray20(obj.fields)) {
       flagRole("field", f.name, f.label, `field "${objName}.${String(f.name ?? "?")}"`, `objects[${i}].fields.${String(f.name ?? "?")}.name`);
     }
-    for (const [ai, action] of asArray16(obj.actions).entries()) {
+    for (const [ai, action] of asArray20(obj.actions).entries()) {
       flagRole("action", action.name, action.label, `action "${objName}.${String(action.name ?? "?")}"`, `objects[${i}].actions[${ai}].name`);
     }
   }
@@ -1964,19 +3331,19 @@ function validateSecurityPosture(stack, opts) {
     if (!ps || typeof ps !== "object") continue;
     flagRole("permission set", ps.name, ps.label, `permission set "${String(ps.name ?? i)}"`, `permissions[${i}].name`);
   }
-  for (const [i, pos] of asArray16(stack.positions).entries()) {
+  for (const [i, pos] of asArray20(stack.positions).entries()) {
     flagRole("position", pos.name, pos.label, `position "${String(pos.name ?? i)}"`, `positions[${i}].name`);
   }
-  for (const [i, app] of asArray16(stack.apps).entries()) {
+  for (const [i, app] of asArray20(stack.apps).entries()) {
     flagRole("app", app.name, app.label, `app "${String(app.name ?? i)}"`, `apps[${i}].name`);
   }
-  for (const [i, book] of asArray16(stack.books).entries()) {
+  for (const [i, book] of asArray20(stack.books).entries()) {
     flagRole("book", book.name, book.label, `book "${String(book.name ?? i)}"`, `books[${i}].name`);
   }
   const stackSetNames = new Set(
     permissionSets.map((ps) => typeof ps.name === "string" ? ps.name : void 0).filter((n) => !!n)
   );
-  for (const [i, book] of asArray16(stack.books).entries()) {
+  for (const [i, book] of asArray20(stack.books).entries()) {
     const audience = book.audience;
     if (!audience || typeof audience !== "object") continue;
     const setName = audience.permissionSet;
@@ -2054,7 +3421,7 @@ function validateSecurityPosture(stack, opts) {
   }
   const GRANT_SEED_OBJECTS = /* @__PURE__ */ new Set(["sys_user_position", "sys_user_permission_set"]);
   const nowMs = opts?.nowMs ?? Date.now();
-  for (const [i, seed] of asArray16(stack.data).entries()) {
+  for (const [i, seed] of asArray20(stack.data).entries()) {
     const seedObject = typeof seed.object === "string" ? seed.object : "";
     if (!GRANT_SEED_OBJECTS.has(seedObject)) continue;
     const records = Array.isArray(seed.records) ? seed.records : [];
@@ -2094,17 +3461,110 @@ function validateSecurityPosture(stack, opts) {
   return findings;
 }
 
+// src/validate-org-axis-red-lines.ts
+var ORG_AXIS_PERMISSION_INHERITANCE = "org-axis-permission-inheritance";
+var ORG_AXIS_CROSS_ORG_BU_GRANT = "org-axis-cross-org-bu-grant";
+var ORG_PARENT_FIELD = "parent_organization_id";
+function asArray21(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function str(v) {
+  return typeof v === "string" ? v : "";
+}
+function isTenancyDisabled(object) {
+  const tenancy = object.tenancy;
+  if (tenancy && typeof tenancy === "object" && tenancy.enabled === false) return true;
+  const systemFields = object.systemFields;
+  if (systemFields && typeof systemFields === "object" && systemFields.tenant === false) return true;
+  return false;
+}
+var INHERITANCE_HINT = `Remove the ${ORG_PARENT_FIELD} reference. Cross-organization visibility comes from MEMBERSHIP: under the \`group\` tenancy posture the engine's Layer 0 wall is \`organization_id IN accessible_org_ids\`, so a user who should see several organizations is made a member of them (ADR-0105 D2). A Layer-1 policy cannot widen Layer 0 anyway, so this rule would not grant the access it appears to. For a hierarchy INSIDE one organization, use the business-unit tree (\`unit_and_subordinates\` sharing, or a depth scope anchored on \`sys_user_position\`).`;
+function validateOrgAxisRedLines(stack) {
+  const findings = [];
+  const cfg = stack ?? {};
+  const permissionSets = asArray21(cfg.permissions ?? cfg.permissionSets);
+  permissionSets.forEach((ps, psIndex) => {
+    asArray21(ps.rowLevelSecurity).forEach((policy, pIndex) => {
+      for (const clause of ["using", "check"]) {
+        if (!str(policy[clause]).includes(ORG_PARENT_FIELD)) continue;
+        findings.push({
+          severity: "error",
+          rule: ORG_AXIS_PERMISSION_INHERITANCE,
+          where: `permission set "${str(ps.name) || psIndex}" policy "${str(policy.name) || pIndex}"`,
+          path: `permissions[${psIndex}].rowLevelSecurity[${pIndex}].${clause}`,
+          message: `RLS ${clause} reads \`${ORG_PARENT_FIELD}\`, which builds a permission hierarchy along the organization axis. ADR-0105 D6 forbids it: the org tree is a REPORTING dimension only.`,
+          hint: INHERITANCE_HINT
+        });
+      }
+    });
+  });
+  const objects = asArray21(cfg.objects);
+  objects.forEach((object, oIndex) => {
+    const objectName = str(object.name) || String(oIndex);
+    asArray21(object.rowLevelSecurity ?? object.rls).forEach((policy, pIndex) => {
+      for (const clause of ["using", "check"]) {
+        if (!str(policy[clause]).includes(ORG_PARENT_FIELD)) continue;
+        findings.push({
+          severity: "error",
+          rule: ORG_AXIS_PERMISSION_INHERITANCE,
+          where: `object "${objectName}" policy "${str(policy.name) || pIndex}"`,
+          path: `objects[${oIndex}].rowLevelSecurity[${pIndex}].${clause}`,
+          message: `RLS ${clause} reads \`${ORG_PARENT_FIELD}\`, which builds a permission hierarchy along the organization axis. ADR-0105 D6 forbids it: the org tree is a REPORTING dimension only.`,
+          hint: INHERITANCE_HINT
+        });
+      }
+    });
+  });
+  asArray21(cfg.sharingRules ?? cfg.sharing).forEach((rule, rIndex) => {
+    const criteria = JSON.stringify(rule.criteria ?? rule.filter ?? "");
+    const sharedTo = JSON.stringify(rule.sharedTo ?? rule.recipient ?? "");
+    if (criteria.includes(ORG_PARENT_FIELD) || sharedTo.includes(ORG_PARENT_FIELD)) {
+      findings.push({
+        severity: "error",
+        rule: ORG_AXIS_PERMISSION_INHERITANCE,
+        where: `sharing rule "${str(rule.name) || rIndex}"`,
+        path: `sharingRules[${rIndex}]`,
+        message: `Sharing rule reads \`${ORG_PARENT_FIELD}\`, granting access by walking the organization tree. ADR-0105 D6 forbids permission inheritance along the org axis.`,
+        hint: INHERITANCE_HINT
+      });
+    }
+  });
+  const tenancyDisabledObjects = new Set(
+    objects.filter((o) => isTenancyDisabled(o)).map((o) => str(o.name)).filter(Boolean)
+  );
+  asArray21(cfg.sharingRules ?? cfg.sharing).forEach((rule, rIndex) => {
+    const target = str(rule.object ?? rule.objectName);
+    if (!target || !tenancyDisabledObjects.has(target)) return;
+    const sharedTo = rule.sharedTo ?? rule.recipient;
+    const recipientType = str(sharedTo?.type);
+    if (recipientType !== "business_unit") return;
+    findings.push({
+      severity: "error",
+      rule: ORG_AXIS_CROSS_ORG_BU_GRANT,
+      where: `sharing rule "${str(rule.name) || rIndex}" on object "${target}"`,
+      path: `sharingRules[${rIndex}].sharedTo`,
+      message: `A business-unit sharing rule targets "${target}", which opted out of tenancy (\`tenancy.enabled: false\`). Platform-global objects carry no organization column, so this grant spans EVERY organization \u2014 a cross-organization business-unit grant, which ADR-0105 D6 forbids (BU trees are org-internal).`,
+      hint: `Either scope the object to organizations (drop \`tenancy.enabled: false\` so Layer 0 walls it), or share it to a position / permission-set audience instead of a business unit. A platform-global catalog that everyone should read wants an OWD of \`public_read\`, not a BU grant.`
+    });
+  });
+  return findings;
+}
+
 // src/validate-dashboard-action-refs.ts
 var DASHBOARD_ACTION_TARGET_UNDEFINED = "dashboard-action-target-undefined";
 var DASHBOARD_ACTION_ROUTE_UNRESOLVED = "dashboard-action-route-unresolved";
-function asArray17(v) {
+function asArray22(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function strName(v) {
+function strName5(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 var MODAL_VERB_RE = /^(?:create|new|add|edit|update)_(.+)$/;
@@ -2121,7 +3581,7 @@ var URL_COLLECTION_TO_STACK_KEY = {
   views: "views"
 };
 function viewContainerName(item) {
-  return strName(item.name) ?? strName(item.id) ?? strName(item.object) ?? strName(item.list?.data && item.list.data.object) ?? strName(item.form?.data && item.form.data.object);
+  return strName5(item.name) ?? strName5(item.id) ?? strName5(item.object) ?? strName5(item.list?.data && item.list.data.object) ?? strName5(item.form?.data && item.form.data.object);
 }
 function collectKnownTargets(stack) {
   const actions = /* @__PURE__ */ new Set();
@@ -2131,22 +3591,22 @@ function collectKnownTargets(stack) {
   const pages = /* @__PURE__ */ new Set();
   const views = /* @__PURE__ */ new Set();
   const collectNames = (v, into, name) => {
-    for (const item of asArray17(v)) {
+    for (const item of asArray22(v)) {
       if (!item || typeof item !== "object") continue;
       const n = name(item);
       if (n) into.add(n);
     }
   };
-  collectNames(stack.actions, actions, (a) => strName(a.name));
-  for (const obj of asArray17(stack.objects)) {
+  collectNames(stack.actions, actions, (a) => strName5(a.name));
+  for (const obj of asArray22(stack.objects)) {
     if (!obj || typeof obj !== "object") continue;
-    const n = strName(obj.name);
+    const n = strName5(obj.name);
     if (n) objects.add(n);
-    collectNames(obj.actions, actions, (a) => strName(a.name));
+    collectNames(obj.actions, actions, (a) => strName5(a.name));
   }
-  collectNames(stack.reports, reports, (r) => strName(r.name));
-  collectNames(stack.dashboards, dashboards, (d) => strName(d.name));
-  collectNames(stack.pages, pages, (p) => strName(p.name));
+  collectNames(stack.reports, reports, (r) => strName5(r.name));
+  collectNames(stack.dashboards, dashboards, (d) => strName5(d.name));
+  collectNames(stack.pages, pages, (p) => strName5(p.name));
   collectNames(stack.views, views, viewContainerName);
   for (const o of objects) views.add(o);
   return { actions, objects, reports, dashboards, pages, views };
@@ -2178,14 +3638,14 @@ function resolveUrlRoute(target, known) {
 function validateDashboardActionRefs(stack) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
-  const dashboards = asArray17(stack.dashboards);
+  const dashboards = asArray22(stack.dashboards);
   if (dashboards.length === 0) return findings;
   const known = collectKnownTargets(stack);
   const checkOne = (action, where, path) => {
-    const target = strName(action.actionUrl);
+    const target = strName5(action.actionUrl);
     if (!target) return;
     if (target.includes("${")) return;
-    const actionType = strName(action.actionType) ?? "url";
+    const actionType = strName5(action.actionType) ?? "url";
     if (actionType === "script" || actionType === "modal") {
       if (resolveActionTarget(actionType, target, known)) return;
       const kindWord = actionType === "script" ? "script" : "modal";
@@ -2216,25 +3676,25 @@ function validateDashboardActionRefs(stack) {
   for (let di = 0; di < dashboards.length; di++) {
     const dash = dashboards[di];
     if (!dash || typeof dash !== "object") continue;
-    const dashName = strName(dash.name) ?? `(dashboard ${di})`;
+    const dashName = strName5(dash.name) ?? `(dashboard ${di})`;
     const dashPath = `dashboards[${di}]`;
-    const headerActions = asArray17(dash.header?.actions);
+    const headerActions = asArray22(dash.header?.actions);
     for (let ai = 0; ai < headerActions.length; ai++) {
       const action = headerActions[ai];
       if (!action || typeof action !== "object") continue;
-      const label = strName(action.label) ?? strName(action.actionUrl) ?? `#${ai}`;
+      const label2 = strName5(action.label) ?? strName5(action.actionUrl) ?? `#${ai}`;
       checkOne(
         action,
-        `dashboard "${dashName}" \xB7 header action "${label}"`,
+        `dashboard "${dashName}" \xB7 header action "${label2}"`,
         `${dashPath}.header.actions[${ai}].actionUrl`
       );
     }
-    const widgets = asArray17(dash.widgets);
+    const widgets = asArray22(dash.widgets);
     for (let wi = 0; wi < widgets.length; wi++) {
       const widget = widgets[wi];
       if (!widget || typeof widget !== "object") continue;
-      if (!strName(widget.actionUrl)) continue;
-      const widgetId = strName(widget.id) ?? `#${wi}`;
+      if (!strName5(widget.actionUrl)) continue;
+      const widgetId = strName5(widget.id) ?? `#${wi}`;
       checkOne(
         { actionType: widget.actionType, actionUrl: widget.actionUrl },
         `dashboard "${dashName}" \xB7 widget "${widgetId}" action`,
@@ -2245,114 +3705,2167 @@ function validateDashboardActionRefs(stack) {
   return findings;
 }
 
-// src/build-access-matrix.ts
-function asArray18(v) {
+// src/validate-filter-tokens.ts
+import { classifyFilterToken, CONTEXT_TOKENS } from "@objectstack/spec/data";
+var FILTER_TOKEN_UNKNOWN = "filter-token-unknown";
+var FILTER_KEYS = /* @__PURE__ */ new Set(["filter", "filters", "runtimeFilter"]);
+function asArray23(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
     return Object.entries(v).map(([name, def]) => ({ name, ...def }));
   }
   return [];
 }
-function buildAccessMatrix(stack) {
-  const entries = [];
-  if (!stack || typeof stack !== "object") return { version: 1, entries };
-  const owdByObject = /* @__PURE__ */ new Map();
-  for (const obj of asArray18(stack.objects)) {
-    const name = typeof obj.name === "string" ? obj.name : "";
-    if (!name) continue;
-    const owd = obj.sharingModel ?? obj.security?.sharingModel;
-    if (typeof owd === "string") owdByObject.set(name, owd);
-  }
-  for (const ps of asArray18(stack.permissions)) {
-    const psName = typeof ps.name === "string" ? ps.name : "";
-    if (!psName) continue;
-    const objects = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
-    for (const [objName, rawPerm] of Object.entries(objects)) {
-      const p = rawPerm ?? {};
-      const entry = {
-        permissionSet: psName,
-        object: objName,
-        create: p.allowCreate === true,
-        read: p.allowRead === true || p.viewAllRecords === true || p.modifyAllRecords === true,
-        edit: p.allowEdit === true || p.modifyAllRecords === true,
-        delete: p.allowDelete === true || p.modifyAllRecords === true,
-        viewAllRecords: p.viewAllRecords === true,
-        modifyAllRecords: p.modifyAllRecords === true
-      };
-      if (typeof p.readScope === "string") entry.readScope = p.readScope;
-      if (typeof p.writeScope === "string") entry.writeScope = p.writeScope;
-      const owd = owdByObject.get(objName);
-      if (owd) entry.sharingModel = owd;
-      entries.push(entry);
+function label(v, fallback) {
+  return typeof v === "string" && v.length > 0 ? v : fallback;
+}
+var KNOWN_LIST = CONTEXT_TOKENS.join("}, {");
+function walkFilterValues(node, path, where, out, seen) {
+  if (node === null || node === void 0) return;
+  if (typeof node === "string") {
+    const cls = classifyFilterToken(node);
+    if (cls?.kind === "unknown") {
+      const suggestion = cls.suggestion;
+      out.push({
+        severity: "error",
+        rule: FILTER_TOKEN_UNKNOWN,
+        where,
+        path,
+        message: `Filter value "${node}" is not a resolvable placeholder. It is sent to the data engine as a literal string, matches no record, and the surface renders empty.`,
+        hint: suggestion ? `Did you mean "{${suggestion}}"? Context tokens are {${KNOWN_LIST}}; time-based values use date macros such as {today} or {30_days_ago}.` : `Resolvable placeholders are the context tokens {${KNOWN_LIST}} and the date macros (e.g. {today}, {week_start}, {30_days_ago}). To filter on a literal value that happens to look like a placeholder, this is not supported \u2014 rename the value.`
+      });
     }
+    return;
+  }
+  if (typeof node !== "object") return;
+  if (seen.has(node)) return;
+  seen.add(node);
+  if (Array.isArray(node)) {
+    node.forEach((v, i) => walkFilterValues(v, `${path}[${i}]`, where, out, seen));
+    return;
+  }
+  for (const [k, v] of Object.entries(node)) {
+    walkFilterValues(v, `${path}.${k}`, where, out, seen);
   }
-  entries.sort(
-    (a, b) => a.permissionSet === b.permissionSet ? a.object.localeCompare(b.object) : a.permissionSet.localeCompare(b.permissionSet)
-  );
-  return { version: 1, entries };
 }
-var BIT_LABELS = [
-  ["create", "create"],
-  ["read", "read"],
-  ["edit", "edit"],
-  ["delete", "delete"],
-  ["viewAllRecords", "View All Data"],
-  ["modifyAllRecords", "Modify All Data"]
-];
-function diffAccessMatrix(before, after) {
-  const lines = [];
-  const key = (e) => `${e.permissionSet}\0${e.object}`;
-  const beforeMap = new Map((before?.entries ?? []).map((e) => [key(e), e]));
-  const afterMap = new Map((after?.entries ?? []).map((e) => [key(e), e]));
-  for (const [k, b] of beforeMap) {
-    if (!afterMap.has(k)) {
-      lines.push(`'${b.permissionSet}' loses ALL access to '${b.object}' (entry removed)`);
-    }
+function scanForFilters(node, path, where, out, seen) {
+  if (!node || typeof node !== "object") return;
+  if (seen.has(node)) return;
+  seen.add(node);
+  if (Array.isArray(node)) {
+    node.forEach((v, i) => scanForFilters(v, `${path}[${i}]`, where, out, seen));
+    return;
   }
-  for (const [k, a] of afterMap) {
-    const b = beforeMap.get(k);
-    if (!b) {
-      const grants = BIT_LABELS.filter(([bit]) => a[bit] === true).map(([, label]) => label);
-      lines.push(`'${a.permissionSet}' gains access to '${a.object}' (${grants.join(", ") || "no bits set"})`);
+  for (const [k, v] of Object.entries(node)) {
+    const childPath = `${path}.${k}`;
+    if (FILTER_KEYS.has(k)) {
+      walkFilterValues(v, childPath, where, out, /* @__PURE__ */ new Set());
       continue;
     }
-    for (const [bit, label] of BIT_LABELS) {
-      if (b[bit] !== a[bit]) {
-        lines.push(`'${a.permissionSet}' ${a[bit] ? "gains" : "loses"} ${label} on '${a.object}'`);
+    scanForFilters(v, childPath, where, out, seen);
+  }
+}
+function validateFilterTokens(stack) {
+  if (!stack || typeof stack !== "object") return [];
+  const out = [];
+  const surfaces = [
+    ["dashboards", "dashboard"],
+    ["objects", "object"],
+    ["views", "view"],
+    ["reports", "report"],
+    ["datasets", "dataset"],
+    ["pages", "page"],
+    ["apps", "app"]
+  ];
+  for (const [key, kind] of surfaces) {
+    const items = asArray23(stack[key]);
+    items.forEach((item, i) => {
+      const name = label(item.name ?? item.id, `#${i}`);
+      if (kind === "dashboard") {
+        const widgets = Array.isArray(item.widgets) ? item.widgets : [];
+        widgets.forEach((w, wi) => {
+          const wName = label(w.id ?? w.title, `#${wi}`);
+          scanForFilters(
+            w,
+            `${key}[${i}].widgets[${wi}]`,
+            `dashboard "${name}" \xB7 widget "${wName}"`,
+            out,
+            /* @__PURE__ */ new Set()
+          );
+        });
+        const { widgets: _skip, ...rest } = item;
+        scanForFilters(rest, `${key}[${i}]`, `dashboard "${name}"`, out, /* @__PURE__ */ new Set());
+        return;
       }
+      scanForFilters(item, `${key}[${i}]`, `${kind} "${name}"`, out, /* @__PURE__ */ new Set());
+    });
+  }
+  return out;
+}
+
+// src/validate-object-references.ts
+import {
+  hasPlatformObjectPrefix,
+  isPlatformProvidedObjectName,
+  PLATFORM_PROVIDED_OBJECT_NAMES
+} from "@objectstack/spec/system";
+var PLATFORM_NAMES = [...PLATFORM_PROVIDED_OBJECT_NAMES];
+var OBJECT_REFERENCE_UNKNOWN = "object-reference-unknown";
+var OBJECT_REFERENCE_UNREGISTERED_PLATFORM = "object-reference-unregistered-platform";
+function asArray24(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName6(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function isInterpolated(target) {
+  if (target.includes("${")) return true;
+  const open = target.indexOf("{");
+  return open !== -1 && target.indexOf("}", open + 2) !== -1;
+}
+function suggest3(target, known) {
+  let best;
+  let bestScore = Infinity;
+  for (const candidate of known) {
+    const d = distance2(target, candidate);
+    if (d < bestScore) {
+      bestScore = d;
+      best = candidate;
     }
-    if ((b.readScope ?? "own") !== (a.readScope ?? "own")) {
-      lines.push(`'${a.permissionSet}' read depth on '${a.object}': ${b.readScope ?? "own"} \u2192 ${a.readScope ?? "own"}`);
+  }
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
+}
+function distance2(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
     }
-    if ((b.writeScope ?? "own") !== (a.writeScope ?? "own")) {
-      lines.push(`'${a.permissionSet}' write depth on '${a.object}': ${b.writeScope ?? "own"} \u2192 ${a.writeScope ?? "own"}`);
+    prev = curr;
+  }
+  return prev[n];
+}
+function validateObjectReferences(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const objects = asArray24(stack.objects);
+  const ownObjects = /* @__PURE__ */ new Set();
+  for (const obj of objects) {
+    const n = strName6(obj.name);
+    if (n) ownObjects.add(n);
+  }
+  const check = (target, where, path, subject, fix) => {
+    const name = strName6(target);
+    if (!name) return;
+    if (isInterpolated(name)) return;
+    if (ownObjects.has(name)) return;
+    if (isPlatformProvidedObjectName(name)) return;
+    if (hasPlatformObjectPrefix(name)) {
+      findings.push({
+        severity: "warning",
+        rule: OBJECT_REFERENCE_UNREGISTERED_PLATFORM,
+        where,
+        path,
+        message: `${subject} "${name}" carries a platform namespace prefix, but no platform package, official plugin, or cloud runtime object registers that name \u2014 and this stack does not define it either. If nothing provides it at runtime the reference resolves to nothing and fails silently.` + suggest3(name, PLATFORM_NAMES),
+        hint: `Check the spelling against the object the providing package actually registers (e.g. "sys_approval_request", not "sys_approval_process" \u2014 the process object was removed when approval became a flow node, ADR-0019). If a third-party package genuinely provides it, this warning is expected. ${fix}`
+      });
+      return;
     }
-    if ((b.sharingModel ?? "") !== (a.sharingModel ?? "")) {
-      lines.push(`'${a.object}' record baseline (OWD): ${b.sharingModel ?? "(unset)"} \u2192 ${a.sharingModel ?? "(unset)"} (affects every principal)`);
+    findings.push({
+      severity: "error",
+      rule: OBJECT_REFERENCE_UNKNOWN,
+      where,
+      path,
+      message: `${subject} "${name}" resolves to no object defined in this stack. The reference is inert at runtime \u2014 nothing reports the miss.` + suggest3(name, ownObjects),
+      hint: `Point it at one of this stack's objects, or at a platform object by its full name (the platform user object is "sys_user", not "user"). ${fix}` + (ownObjects.size > 0 ? ` Defined objects: ${[...ownObjects].sort().join(", ")}.` : "")
+    });
+  };
+  const checkActionParams2 = (action, actionPath, actionLabel) => {
+    const params = asArray24(action.params);
+    for (let pi = 0; pi < params.length; pi++) {
+      const param = params[pi];
+      if (!param || typeof param !== "object") continue;
+      const paramLabel = strName6(param.name) ?? strName6(param.field) ?? `#${pi}`;
+      const where = `${actionLabel} \xB7 param "${paramLabel}"`;
+      check(
+        strName6(param.reference),
+        where,
+        `${actionPath}.params[${pi}].reference`,
+        "record-picker target",
+        "Without a resolvable target the picker degrades to a raw record-id text input."
+      );
+      check(
+        strName6(param.objectOverride),
+        where,
+        `${actionPath}.params[${pi}].objectOverride`,
+        "field-backed param object",
+        "The param inherits type/options from a field on this object, so an unknown object leaves it untyped."
+      );
     }
+  };
+  const globalActions = asArray24(stack.actions);
+  for (let ai = 0; ai < globalActions.length; ai++) {
+    const action = globalActions[ai];
+    if (!action || typeof action !== "object") continue;
+    checkActionParams2(action, `actions[${ai}]`, `action "${strName6(action.name) ?? `#${ai}`}"`);
   }
-  return lines;
+  for (let oi = 0; oi < objects.length; oi++) {
+    const obj = objects[oi];
+    if (!obj || typeof obj !== "object") continue;
+    const objName = strName6(obj.name) ?? `#${oi}`;
+    const objActions = asArray24(obj.actions);
+    for (let ai = 0; ai < objActions.length; ai++) {
+      const action = objActions[ai];
+      if (!action || typeof action !== "object") continue;
+      checkActionParams2(
+        action,
+        `objects[${oi}].actions[${ai}]`,
+        `object "${objName}" \xB7 action "${strName6(action.name) ?? `#${ai}`}"`
+      );
+    }
+  }
+  const dashboards = asArray24(stack.dashboards);
+  for (let di = 0; di < dashboards.length; di++) {
+    const dash = dashboards[di];
+    if (!dash || typeof dash !== "object") continue;
+    const dashName = strName6(dash.name) ?? `#${di}`;
+    const filters = asArray24(dash.globalFilters);
+    for (let fi = 0; fi < filters.length; fi++) {
+      const filter = filters[fi];
+      if (!filter || typeof filter !== "object") continue;
+      const optionsFrom = filter.optionsFrom;
+      if (!optionsFrom || typeof optionsFrom !== "object") continue;
+      check(
+        strName6(optionsFrom.object),
+        `dashboard "${dashName}" \xB7 filter "${strName6(filter.name) ?? `#${fi}`}"`,
+        `dashboards[${di}].globalFilters[${fi}].optionsFrom.object`,
+        "filter options source",
+        "The dropdown fetches its options from this object; an unknown one renders an always-empty filter."
+      );
+    }
+  }
+  const apps = asArray24(stack.apps);
+  for (let ai = 0; ai < apps.length; ai++) {
+    const app = apps[ai];
+    if (!app || typeof app !== "object") continue;
+    const appName = strName6(app.name) ?? `#${ai}`;
+    const walkNav = (items, basePath) => {
+      const navItems = asArray24(items);
+      for (let ni = 0; ni < navItems.length; ni++) {
+        const nav = navItems[ni];
+        if (!nav || typeof nav !== "object") continue;
+        const navId = strName6(nav.id) ?? `#${ni}`;
+        const where = `app "${appName}" \xB7 nav "${navId}"`;
+        const navPath = `${basePath}[${ni}]`;
+        check(
+          strName6(nav.requiresObject),
+          where,
+          `${navPath}.requiresObject`,
+          "capability gate object",
+          "The entry is hidden unless this object is registered, so a typo hides it permanently \u2014 and it suppresses the nav cross-reference check that would have caught the target."
+        );
+        if (nav.requiresObject && strName6(nav.objectName)) {
+          check(
+            strName6(nav.objectName),
+            where,
+            `${navPath}.objectName`,
+            "navigation target",
+            "Declaring `requiresObject` exempts this target from the build-time check, so it is only verified here."
+          );
+        }
+        if (Array.isArray(nav.children)) walkNav(nav.children, `${navPath}.children`);
+      }
+    };
+    walkNav(app.navigation, `apps[${ai}].navigation`);
+    const areas = asArray24(app.areas);
+    for (let ri = 0; ri < areas.length; ri++) {
+      walkNav(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
+    }
+  }
+  return findings;
+}
+
+// src/validate-action-name-refs.ts
+var ACTION_NAME_UNDEFINED = "action-name-undefined";
+function asArray25(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName7(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function strList(v) {
+  return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
+}
+function distance3(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+function suggest4(target, known) {
+  let best;
+  let bestScore = Infinity;
+  for (const candidate of known) {
+    const d = distance3(target, candidate);
+    if (d < bestScore) {
+      bestScore = d;
+      best = candidate;
+    }
+  }
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
+}
+function collectActionNames(stack) {
+  const names = /* @__PURE__ */ new Set();
+  for (const action of asArray25(stack.actions)) {
+    const n = strName7(action?.name);
+    if (n) names.add(n);
+  }
+  for (const obj of asArray25(stack.objects)) {
+    if (!obj || typeof obj !== "object") continue;
+    for (const action of asArray25(obj.actions)) {
+      const n = strName7(action?.name);
+      if (n) names.add(n);
+    }
+  }
+  return names;
+}
+function validateActionNameRefs(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const known = collectActionNames(stack);
+  const check = (name, where, path, surface) => {
+    if (known.has(name)) return;
+    findings.push({
+      severity: "error",
+      rule: ACTION_NAME_UNDEFINED,
+      where,
+      path,
+      message: `${surface} names action "${name}", which is defined by no action in this stack (neither \`stack.actions\` nor any object's \`actions\`). The button renders and does nothing when clicked \u2014 a dead affordance the runtime cannot dispatch.` + suggest4(name, known),
+      hint: `Define an action named "${name}" (in \`stack.actions\` or the object's \`actions\`) with the location this surface needs, remove the reference, or ignore this if the action is contributed by another installed package.` + (known.size > 0 ? ` Defined actions: ${[...known].sort().join(", ")}.` : "")
+    });
+  };
+  const views = asArray25(stack.views);
+  for (let vi = 0; vi < views.length; vi++) {
+    const view = views[vi];
+    if (!view || typeof view !== "object") continue;
+    const viewName = strName7(view.name) ?? strName7(view.object) ?? `#${vi}`;
+    const checkListContainer = (container, label2, path) => {
+      if (!container || typeof container !== "object") return;
+      const list3 = container;
+      for (const key of ["rowActions", "bulkActions"]) {
+        const names = strList(list3[key]);
+        for (let ai = 0; ai < names.length; ai++) {
+          check(
+            names[ai],
+            `view "${viewName}" \xB7 ${label2} \xB7 ${key}`,
+            `${path}.${key}[${ai}]`,
+            key === "bulkActions" ? "Bulk-action menu" : "Row-action menu"
+          );
+        }
+      }
+    };
+    checkListContainer(view.list, "list", `views[${vi}].list`);
+    const listViews = view.listViews;
+    if (listViews && typeof listViews === "object" && !Array.isArray(listViews)) {
+      for (const [key, lv] of Object.entries(listViews)) {
+        checkListContainer(lv, `listViews.${key}`, `views[${vi}].listViews.${key}`);
+      }
+    }
+  }
+  const pages = asArray25(stack.pages);
+  for (let pi = 0; pi < pages.length; pi++) {
+    const page = pages[pi];
+    if (!page || typeof page !== "object") continue;
+    const pageName = strName7(page.name) ?? `#${pi}`;
+    for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
+      const props = component.properties;
+      if (!props || typeof props !== "object") continue;
+      const names = strList(props.actionNames);
+      for (let ai = 0; ai < names.length; ai++) {
+        check(
+          names[ai],
+          `page "${pageName}" \xB7 component "${strName7(component.type) ?? "?"}"`,
+          `${path}.properties.actionNames[${ai}]`,
+          "Quick-actions bar"
+        );
+      }
+    }
+  }
+  const apps = asArray25(stack.apps);
+  for (let ai = 0; ai < apps.length; ai++) {
+    const app = apps[ai];
+    if (!app || typeof app !== "object") continue;
+    const appName = strName7(app.name) ?? `#${ai}`;
+    const walkNav = (items, basePath) => {
+      const navItems = asArray25(items);
+      for (let ni = 0; ni < navItems.length; ni++) {
+        const nav = navItems[ni];
+        if (!nav || typeof nav !== "object") continue;
+        const navPath = `${basePath}[${ni}]`;
+        const actionDef = nav.actionDef;
+        const actionName = strName7(actionDef?.actionName);
+        if (nav.type === "action" && actionName) {
+          check(
+            actionName,
+            `app "${appName}" \xB7 nav "${strName7(nav.id) ?? `#${ni}`}"`,
+            `${navPath}.actionDef.actionName`,
+            "Navigation action item"
+          );
+        }
+        if (Array.isArray(nav.children)) walkNav(nav.children, `${navPath}.children`);
+      }
+    };
+    walkNav(app.navigation, `apps[${ai}].navigation`);
+    const areas = asArray25(app.areas);
+    for (let ri = 0; ri < areas.length; ri++) {
+      walkNav(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
+    }
+  }
+  return findings;
+}
+
+// src/validate-chart-bindings.ts
+var CHART_DIMENSION_UNKNOWN = "chart-dimension-unknown";
+var CHART_MEASURE_UNKNOWN = "chart-measure-unknown";
+var CHART_DATASET_UNKNOWN = "chart-dataset-unknown";
+var CHART_AXIS_NOT_SELECTED = "chart-axis-not-selected";
+function asArray26(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName8(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function strList2(v) {
+  return Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
+}
+function isRec6(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function distance4(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+function suggest5(target, known) {
+  let best;
+  let bestScore = Infinity;
+  for (const c of known) {
+    const d = distance4(target, c);
+    if (d < bestScore) {
+      bestScore = d;
+      best = c;
+    }
+  }
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
+}
+function list2(names) {
+  const all = [...names].sort();
+  return all.length ? all.join(", ") : "(none)";
+}
+function indexDatasets(stack) {
+  const out = /* @__PURE__ */ new Map();
+  for (const ds of asArray26(stack.datasets)) {
+    const name = strName8(ds.name);
+    if (!name) continue;
+    const dimensions = /* @__PURE__ */ new Set();
+    for (const d of asArray26(ds.dimensions)) {
+      const n = strName8(d.name);
+      if (n) dimensions.add(n);
+    }
+    const measures = /* @__PURE__ */ new Set();
+    for (const m of asArray26(ds.measures)) {
+      const n = strName8(m.name);
+      if (n) measures.add(n);
+    }
+    out.set(name, { dimensions, measures });
+  }
+  return out;
+}
+function validateChartBindings(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const datasets = indexDatasets(stack);
+  if (datasets.size === 0 && !stack.reports && !stack.views && !stack.pages) return findings;
+  const check = (binding) => {
+    const dsName = binding.dataset;
+    if (!dsName) return;
+    const ds = datasets.get(dsName);
+    if (!ds) {
+      findings.push({
+        severity: "error",
+        rule: CHART_DATASET_UNKNOWN,
+        where: binding.where,
+        path: `${binding.path}.dataset`,
+        message: `binds dataset "${dsName}", which resolves to no declared dataset \u2014 the chart has no data to render.`,
+        hint: `Declared datasets: ${list2(datasets.keys())}.${suggest5(dsName, datasets.keys())} Define it with defineDataset() or fix the reference (ADR-0021).`
+      });
+      return;
+    }
+    const dimensionRef = (name, path) => {
+      if (ds.dimensions.has(name)) return;
+      findings.push({
+        severity: "error",
+        rule: CHART_DIMENSION_UNKNOWN,
+        where: binding.where,
+        path,
+        message: `"${name}" is not a dimension declared by dataset "${dsName}". Post-ADR-0021 result rows are keyed by DIMENSION NAME, not the base field, so this axis renders with no categories.`,
+        hint: `Dataset dimensions: ${list2(ds.dimensions)}.${suggest5(name, ds.dimensions)} Declare the dimension on the dataset, or bind an existing one.`
+      });
+    };
+    const measureRef = (name, path, selected2) => {
+      if (!ds.measures.has(name)) {
+        findings.push({
+          severity: "error",
+          rule: CHART_MEASURE_UNKNOWN,
+          where: binding.where,
+          path,
+          message: `"${name}" is not a measure declared by dataset "${dsName}". Post-ADR-0021 result rows are keyed by MEASURE NAME (e.g. "sum_amount"), not the base field (e.g. "amount"), so this series comes back empty.`,
+          hint: `Dataset measures: ${list2(ds.measures)}.${suggest5(name, ds.measures)} Declare the measure on the dataset, or bind an existing one.`
+        });
+        return;
+      }
+      if (selected2 && selected2.size > 0 && !selected2.has(name)) {
+        findings.push({
+          severity: "warning",
+          rule: CHART_AXIS_NOT_SELECTED,
+          where: binding.where,
+          path,
+          message: `"${name}" is a declared measure of "${dsName}" but is not in this chart's selected values (${list2(selected2)}) \u2014 the query does not return it, so the series plots nothing.`,
+          hint: `Add "${name}" to \`values\`, or point the axis at a selected measure.`
+        });
+      }
+    };
+    const dimSel = binding.dimensions;
+    if (dimSel) {
+      for (let i = 0; i < dimSel.names.length; i++) {
+        dimensionRef(dimSel.names[i], `${dimSel.path}[${i}]`);
+      }
+    }
+    const valSel = binding.values;
+    const selected = new Set(valSel?.names ?? []);
+    if (valSel) {
+      for (let i = 0; i < valSel.names.length; i++) {
+        measureRef(valSel.names[i], `${valSel.path}[${i}]`);
+      }
+    }
+    if (binding.xAxis) dimensionRef(binding.xAxis.name, binding.xAxis.path);
+    if (binding.yAxis) measureRef(binding.yAxis.name, binding.yAxis.path, selected);
+    for (const s of binding.series ?? []) measureRef(s.name, s.path, selected);
+  };
+  const reports = asArray26(stack.reports);
+  for (let ri = 0; ri < reports.length; ri++) {
+    const report = reports[ri];
+    if (!isRec6(report)) continue;
+    const reportName = strName8(report.name) ?? `#${ri}`;
+    const checkReportChart = (chart, dataset, values, where, path) => {
+      if (!isRec6(chart)) return;
+      check({
+        dataset,
+        // `values` is the report's measure SELECTION, not a chart ref; feeding
+        // it in lets the yAxis "declared but not selected" check work without
+        // reporting the selection itself twice.
+        values: { names: values, path: `${path}.values` },
+        xAxis: strName8(chart.xAxis) ? { name: strName8(chart.xAxis), path: `${path}.chart.xAxis` } : void 0,
+        yAxis: strName8(chart.yAxis) ? { name: strName8(chart.yAxis), path: `${path}.chart.yAxis` } : void 0,
+        series: asArray26(chart.series).map((s, si) => ({ name: strName8(s.name), path: `${path}.chart.series[${si}].name` })).filter((s) => !!s.name),
+        where,
+        path: `${path}.chart`
+      });
+    };
+    checkReportChart(
+      report.chart,
+      strName8(report.dataset),
+      strList2(report.values),
+      `report "${reportName}" \xB7 chart`,
+      `reports[${ri}]`
+    );
+    const blocks = Array.isArray(report.blocks) ? report.blocks : [];
+    for (let bi = 0; bi < blocks.length; bi++) {
+      const block = blocks[bi];
+      if (!isRec6(block)) continue;
+      checkReportChart(
+        block.chart,
+        strName8(block.dataset),
+        strList2(block.values),
+        `report "${reportName}" \xB7 block "${strName8(block.name) ?? `#${bi}`}" chart`,
+        `reports[${ri}].blocks[${bi}]`
+      );
+    }
+  }
+  const checkListChart = (container, where, path) => {
+    if (!isRec6(container)) return;
+    const chart = container.chart;
+    if (!isRec6(chart)) return;
+    check({
+      dataset: strName8(chart.dataset),
+      dimensions: { names: strList2(chart.dimensions), path: `${path}.chart.dimensions` },
+      values: { names: strList2(chart.values), path: `${path}.chart.values` },
+      where,
+      path: `${path}.chart`
+    });
+  };
+  const views = asArray26(stack.views);
+  for (let vi = 0; vi < views.length; vi++) {
+    const view = views[vi];
+    if (!isRec6(view)) continue;
+    const viewName = strName8(view.name) ?? strName8(view.objectName) ?? `#${vi}`;
+    checkListChart(view.list, `view "${viewName}" \xB7 list chart`, `views[${vi}].list`);
+    if (isRec6(view.listViews)) {
+      for (const [key, lv] of Object.entries(view.listViews)) {
+        checkListChart(lv, `view "${viewName}" \xB7 listViews.${key} chart`, `views[${vi}].listViews.${key}`);
+      }
+    }
+  }
+  const objects = asArray26(stack.objects);
+  for (let oi = 0; oi < objects.length; oi++) {
+    const obj = objects[oi];
+    if (!isRec6(obj) || !isRec6(obj.listViews)) continue;
+    const objName = strName8(obj.name) ?? `#${oi}`;
+    for (const [key, lv] of Object.entries(obj.listViews)) {
+      checkListChart(
+        lv,
+        `object "${objName}" \xB7 listViews.${key} chart`,
+        `objects[${oi}].listViews.${key}`
+      );
+    }
+  }
+  const pages = asArray26(stack.pages);
+  for (let pi = 0; pi < pages.length; pi++) {
+    const page = pages[pi];
+    if (!isRec6(page)) continue;
+    const pageName = strName8(page.name) ?? `#${pi}`;
+    for (const { component, path } of walkPageComponents(page, `pages[${pi}]`)) {
+      const props = isRec6(component.properties) ? component.properties : void 0;
+      if (!props || !strName8(props.dataset)) continue;
+      const axisRefs = asArray26(props.yAxis).map((a, ai) => ({ name: strName8(a.field), path: `${path}.properties.yAxis[${ai}].field` })).filter((a) => !!a.name);
+      const seriesRefs = asArray26(props.series).map((s, si) => ({ name: strName8(s.name), path: `${path}.properties.series[${si}].name` })).filter((s) => !!s.name);
+      check({
+        dataset: strName8(props.dataset),
+        dimensions: { names: strList2(props.dimensions), path: `${path}.properties.dimensions` },
+        values: { names: strList2(props.values), path: `${path}.properties.values` },
+        series: [...axisRefs, ...seriesRefs],
+        where: `page "${pageName}" \xB7 ${strName8(component.type) ?? "chart"}`,
+        path: `${path}.properties`
+      });
+    }
+  }
+  return findings;
+}
+
+// src/validate-nav-access.ts
+import { isPlatformProvidedObjectName as isPlatformProvidedObjectName2 } from "@objectstack/spec/system";
+
+// src/build-access-matrix.ts
+function asArray27(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function buildAccessMatrix(stack) {
+  const entries = [];
+  if (!stack || typeof stack !== "object") return { version: 1, entries };
+  const owdByObject = /* @__PURE__ */ new Map();
+  for (const obj of asArray27(stack.objects)) {
+    const name = typeof obj.name === "string" ? obj.name : "";
+    if (!name) continue;
+    const owd = obj.sharingModel ?? obj.security?.sharingModel;
+    if (typeof owd === "string") owdByObject.set(name, owd);
+  }
+  for (const ps of asArray27(stack.permissions)) {
+    const psName = typeof ps.name === "string" ? ps.name : "";
+    if (!psName) continue;
+    const objects = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
+    for (const [objName, rawPerm] of Object.entries(objects)) {
+      const p = rawPerm ?? {};
+      const entry = {
+        permissionSet: psName,
+        object: objName,
+        create: p.allowCreate === true,
+        read: p.allowRead === true || p.viewAllRecords === true || p.modifyAllRecords === true,
+        edit: p.allowEdit === true || p.modifyAllRecords === true,
+        delete: p.allowDelete === true || p.modifyAllRecords === true,
+        viewAllRecords: p.viewAllRecords === true,
+        modifyAllRecords: p.modifyAllRecords === true
+      };
+      if (typeof p.readScope === "string") entry.readScope = p.readScope;
+      if (typeof p.writeScope === "string") entry.writeScope = p.writeScope;
+      const owd = owdByObject.get(objName);
+      if (owd) entry.sharingModel = owd;
+      entries.push(entry);
+    }
+  }
+  entries.sort(
+    (a, b) => a.permissionSet === b.permissionSet ? a.object.localeCompare(b.object) : a.permissionSet.localeCompare(b.permissionSet)
+  );
+  return { version: 1, entries };
+}
+var BIT_LABELS = [
+  ["create", "create"],
+  ["read", "read"],
+  ["edit", "edit"],
+  ["delete", "delete"],
+  ["viewAllRecords", "View All Data"],
+  ["modifyAllRecords", "Modify All Data"]
+];
+function diffAccessMatrix(before, after) {
+  const lines = [];
+  const key = (e) => `${e.permissionSet}\0${e.object}`;
+  const beforeMap = new Map((before?.entries ?? []).map((e) => [key(e), e]));
+  const afterMap = new Map((after?.entries ?? []).map((e) => [key(e), e]));
+  for (const [k, b] of beforeMap) {
+    if (!afterMap.has(k)) {
+      lines.push(`'${b.permissionSet}' loses ALL access to '${b.object}' (entry removed)`);
+    }
+  }
+  for (const [k, a] of afterMap) {
+    const b = beforeMap.get(k);
+    if (!b) {
+      const grants = BIT_LABELS.filter(([bit]) => a[bit] === true).map(([, label2]) => label2);
+      lines.push(`'${a.permissionSet}' gains access to '${a.object}' (${grants.join(", ") || "no bits set"})`);
+      continue;
+    }
+    for (const [bit, label2] of BIT_LABELS) {
+      if (b[bit] !== a[bit]) {
+        lines.push(`'${a.permissionSet}' ${a[bit] ? "gains" : "loses"} ${label2} on '${a.object}'`);
+      }
+    }
+    if ((b.readScope ?? "own") !== (a.readScope ?? "own")) {
+      lines.push(`'${a.permissionSet}' read depth on '${a.object}': ${b.readScope ?? "own"} \u2192 ${a.readScope ?? "own"}`);
+    }
+    if ((b.writeScope ?? "own") !== (a.writeScope ?? "own")) {
+      lines.push(`'${a.permissionSet}' write depth on '${a.object}': ${b.writeScope ?? "own"} \u2192 ${a.writeScope ?? "own"}`);
+    }
+    if ((b.sharingModel ?? "") !== (a.sharingModel ?? "")) {
+      lines.push(`'${a.object}' record baseline (OWD): ${b.sharingModel ?? "(unset)"} \u2192 ${a.sharingModel ?? "(unset)"} (affects every principal)`);
+    }
+  }
+  return lines;
+}
+
+// src/validate-nav-access.ts
+var NAV_OBJECT_UNGRANTED = "nav-object-ungranted";
+function asArray28(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName9(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function collectNavExposures(stack) {
+  const out = [];
+  const apps = asArray28(stack.apps);
+  for (let ai = 0; ai < apps.length; ai++) {
+    const app = apps[ai];
+    if (!app || typeof app !== "object") continue;
+    const appName = strName9(app.name) ?? `#${ai}`;
+    const walk = (items, basePath) => {
+      const navItems = asArray28(items);
+      for (let ni = 0; ni < navItems.length; ni++) {
+        const nav = navItems[ni];
+        if (!nav || typeof nav !== "object") continue;
+        const navPath = `${basePath}[${ni}]`;
+        const objectName = strName9(nav.objectName);
+        if (nav.type === "object" && objectName) {
+          out.push({
+            objectName,
+            where: `app "${appName}" \xB7 nav "${strName9(nav.id) ?? `#${ni}`}"`,
+            path: `${navPath}.objectName`
+          });
+        }
+        if (Array.isArray(nav.children)) walk(nav.children, `${navPath}.children`);
+      }
+    };
+    walk(app.navigation, `apps[${ai}].navigation`);
+    const areas = asArray28(app.areas);
+    for (let ri = 0; ri < areas.length; ri++) {
+      walk(areas[ri]?.navigation, `apps[${ai}].areas[${ri}].navigation`);
+    }
+  }
+  return out;
+}
+function validateNavAccess(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const permissionSets = asArray28(stack.permissions);
+  if (permissionSets.length === 0) return findings;
+  const exposures = collectNavExposures(stack);
+  if (exposures.length === 0) return findings;
+  const ownObjects = /* @__PURE__ */ new Set();
+  for (const obj of asArray28(stack.objects)) {
+    const n = strName9(obj.name);
+    if (n) ownObjects.add(n);
+  }
+  const readable = /* @__PURE__ */ new Set();
+  for (const entry of buildAccessMatrix(stack).entries) {
+    if (entry.read) readable.add(entry.object);
+  }
+  if (readable.has("*")) return findings;
+  const reported = /* @__PURE__ */ new Set();
+  for (const exposure of exposures) {
+    const { objectName } = exposure;
+    if (reported.has(objectName)) continue;
+    if (isPlatformProvidedObjectName2(objectName)) continue;
+    if (!ownObjects.has(objectName)) continue;
+    if (readable.has(objectName)) continue;
+    reported.add(objectName);
+    findings.push({
+      severity: "warning",
+      rule: NAV_OBJECT_UNGRANTED,
+      where: exposure.where,
+      path: exposure.path,
+      message: `navigation exposes object "${objectName}", but no permission set this stack declares grants read on it \u2014 the entry renders, and opening it fails permission-denied for every principal except one holding the platform's built-in wildcard admin set. It works when you browse as an administrator and breaks for the users the app ships permission sets for.`,
+      hint: `Add "${objectName}" to a permission set's \`objects\` with \`allowRead: true\` (or \`viewAllRecords\`), gate the entry with \`requiredPermissions\`/\`visible\` if it is meant for admins only, or drop it. Ignore this if a permission set from another installed package grants it.`
+    });
+  }
+  return findings;
+}
+
+// src/validate-translation-references.ts
+import { hasPlatformObjectPrefix as hasPlatformObjectPrefix2, isPlatformProvidedObjectName as isPlatformProvidedObjectName3 } from "@objectstack/spec/system";
+var TRANSLATION_TARGET_UNKNOWN = "translation-target-unknown";
+var TRANSLATION_OPTION_KEY_UNKNOWN = "translation-option-key-unknown";
+function isRec7(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function asArray29(v) {
+  if (Array.isArray(v)) return v;
+  if (isRec7(v)) return Object.entries(v).map(([name, def]) => ({ name, ...isRec7(def) ? def : {} }));
+  return [];
+}
+function strName10(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function distance5(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+function suggest6(target, known) {
+  const names = [...known];
+  const segmentMatch = names.find(
+    (candidate) => candidate.endsWith(`_${target}`) || candidate.startsWith(`${target}_`)
+  );
+  if (segmentMatch) return ` Did you mean "${segmentMatch}"?`;
+  let best;
+  let bestScore = Infinity;
+  for (const candidate of names) {
+    const d = distance5(target, candidate);
+    if (d < bestScore) {
+      bestScore = d;
+      best = candidate;
+    }
+  }
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
+}
+function listNames(names, max = 12) {
+  const all = [...names].sort();
+  if (all.length === 0) return "";
+  const shown = all.slice(0, max).join(", ");
+  return all.length > max ? `${shown}, \u2026 (${all.length} total)` : shown;
+}
+var IMPLICIT_FIELDS = /* @__PURE__ */ new Set([
+  ...SYSTEM_FIELDS,
+  "_id",
+  "name",
+  "space"
+]);
+function emptyFacts() {
+  return { fields: /* @__PURE__ */ new Map(), views: /* @__PURE__ */ new Set(), actions: /* @__PURE__ */ new Map(), sections: /* @__PURE__ */ new Set() };
+}
+function collectViewRecord(view, factsFor) {
+  const recordObject = viewObjectName(view);
+  const bindingOf = (container) => viewObjectName(container) ?? recordObject;
+  const addView = (objectName, name) => {
+    if (objectName && name) factsFor(objectName).views.add(name);
+  };
+  const listBinding = isRec7(view.list) ? bindingOf(view.list) : void 0;
+  if (isRec7(view.list)) addView(listBinding, strName10(view.list.name));
+  addView(recordObject ?? listBinding, strName10(view.name));
+  for (const key of ["listViews", "formViews"]) {
+    const container = view[key];
+    if (!isRec7(container)) continue;
+    for (const [subKey, sub] of Object.entries(container)) {
+      if (!isRec7(sub)) continue;
+      const binding = bindingOf(sub) ?? listBinding;
+      addView(binding, subKey);
+      addView(binding, strName10(sub.name));
+      if (binding) {
+        for (const section of asArray29(sub.sections)) {
+          const sectionName = strName10(section.name);
+          if (sectionName) factsFor(binding).sections.add(sectionName);
+        }
+      }
+    }
+  }
+  const sectionBinding = recordObject ?? listBinding;
+  if (sectionBinding) {
+    for (const section of asArray29(view.sections)) {
+      const sectionName = strName10(section.name);
+      if (sectionName) factsFor(sectionBinding).sections.add(sectionName);
+    }
+  }
+}
+function viewObjectName(view) {
+  return strName10(view.objectName) ?? strName10(view.object) ?? (isRec7(view.data) ? strName10(view.data.object) : void 0);
+}
+function readOptions(field) {
+  const raw = field.options;
+  const values = /* @__PURE__ */ new Set();
+  const byLabel = /* @__PURE__ */ new Map();
+  if (Array.isArray(raw)) {
+    for (const opt of raw) {
+      if (typeof opt === "string") {
+        values.add(opt);
+        continue;
+      }
+      if (!isRec7(opt)) continue;
+      const value = strName10(opt.value);
+      if (!value) continue;
+      values.add(value);
+      const label2 = strName10(opt.label);
+      if (label2) byLabel.set(label2.toLowerCase(), value);
+    }
+  } else if (isRec7(raw)) {
+    for (const [value, label2] of Object.entries(raw)) {
+      values.add(value);
+      if (typeof label2 === "string" && label2.length > 0) byLabel.set(label2.toLowerCase(), value);
+    }
+  } else {
+    return void 0;
+  }
+  return values.size > 0 ? { values, byLabel } : void 0;
+}
+function buildUniverse(stack) {
+  const objects = /* @__PURE__ */ new Map();
+  const factsFor = (name) => {
+    let facts = objects.get(name);
+    if (!facts) {
+      facts = emptyFacts();
+      objects.set(name, facts);
+    }
+    return facts;
+  };
+  for (const obj of asArray29(stack.objects)) {
+    const objectName = strName10(obj.name);
+    if (!objectName) continue;
+    const facts = factsFor(objectName);
+    for (const field of asArray29(obj.fields)) {
+      const fieldName = strName10(field.name);
+      if (fieldName) facts.fields.set(fieldName, field);
+    }
+    for (const action of asArray29(obj.actions)) {
+      const actionName = strName10(action.name);
+      if (actionName) facts.actions.set(actionName, action);
+    }
+    for (const view of asArray29(obj.views)) {
+      collectViewRecord({ ...view, object: strName10(view.object) ?? objectName }, factsFor);
+    }
+    collectViewRecord({ object: objectName, listViews: obj.listViews }, factsFor);
+    for (const group of asArray29(obj.fieldGroups)) {
+      const key = strName10(group.key) ?? strName10(group.name);
+      if (key) facts.sections.add(key);
+    }
+  }
+  for (const view of asArray29(stack.views)) {
+    collectViewRecord(view, factsFor);
+  }
+  const pages = asArray29(stack.pages);
+  for (let pi = 0; pi < pages.length; pi++) {
+    for (const walked of walkPageComponents(pages[pi], `pages[${pi}]`)) {
+      if (!walked.objectName) continue;
+      const props = isRec7(walked.component.properties) ? walked.component.properties : void 0;
+      if (!props) continue;
+      for (const section of asArray29(props.sections)) {
+        const sectionName = strName10(section.name);
+        if (sectionName) factsFor(walked.objectName).sections.add(sectionName);
+      }
+    }
+  }
+  const globalActions = /* @__PURE__ */ new Map();
+  const actionOwners = /* @__PURE__ */ new Map();
+  for (const action of asArray29(stack.actions)) {
+    const actionName = strName10(action.name);
+    if (!actionName) continue;
+    const owner = strName10(action.objectName) ?? strName10(action.object);
+    if (owner) {
+      factsFor(owner).actions.set(actionName, action);
+      actionOwners.set(actionName, owner);
+    } else {
+      globalActions.set(actionName, action);
+    }
+  }
+  for (const [objectName, facts] of objects) {
+    for (const actionName of facts.actions.keys()) {
+      if (!actionOwners.has(actionName)) actionOwners.set(actionName, objectName);
+    }
+  }
+  const apps = /* @__PURE__ */ new Map();
+  for (const app of asArray29(stack.apps)) {
+    const appName = strName10(app.name);
+    if (!appName) continue;
+    const navIds = apps.get(appName) ?? /* @__PURE__ */ new Set();
+    const walkNav = (items) => {
+      for (const item of asArray29(items)) {
+        const id = strName10(item.id);
+        if (id) navIds.add(id);
+        if (item.children) walkNav(item.children);
+      }
+    };
+    walkNav(app.navigation);
+    for (const area of asArray29(app.areas)) {
+      const areaId = strName10(area.id);
+      if (areaId) navIds.add(areaId);
+      walkNav(area.navigation);
+    }
+    apps.set(appName, navIds);
+  }
+  const dashboards = /* @__PURE__ */ new Map();
+  for (const dash of asArray29(stack.dashboards)) {
+    const dashName = strName10(dash.name);
+    if (!dashName) continue;
+    const widgets = /* @__PURE__ */ new Set();
+    for (const widget of asArray29(dash.widgets)) {
+      const id = strName10(widget.id) ?? strName10(widget.name);
+      if (id) widgets.add(id);
+    }
+    const actions = /* @__PURE__ */ new Set();
+    const headerActions = [
+      ...asArray29(isRec7(dash.header) ? dash.header.actions : void 0),
+      ...asArray29(dash.actions)
+    ];
+    for (const action of headerActions) {
+      const key = strName10(action.actionUrl) ?? strName10(action.url) ?? strName10(action.name);
+      if (key) actions.add(key);
+    }
+    dashboards.set(dashName, { widgets, actions });
+  }
+  return { objects, apps, dashboards, globalActions, actionOwners };
+}
+function localePath(bundleIndex, locale) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(locale) ? `translations[${bundleIndex}].${locale}` : `translations[${bundleIndex}]["${locale}"]`;
+}
+function validateTranslationReferences(stack) {
+  const findings = [];
+  if (!isRec7(stack)) return findings;
+  const bundles = Array.isArray(stack.translations) ? stack.translations : [];
+  if (bundles.length === 0) return findings;
+  const universe = buildUniverse(stack);
+  const orphan = (where, path, message, hint) => {
+    findings.push({ severity: "warning", rule: TRANSLATION_TARGET_UNKNOWN, where, path, message, hint });
+  };
+  for (let bi = 0; bi < bundles.length; bi++) {
+    const bundle = bundles[bi];
+    if (!isRec7(bundle)) continue;
+    for (const [locale, rawData] of Object.entries(bundle)) {
+      if (!isRec7(rawData)) continue;
+      const base = localePath(bi, locale);
+      const inLocale = `locale "${locale}"`;
+      for (const [objectName, rawNode] of Object.entries(asRecord(rawData.objects))) {
+        if (!isRec7(rawNode)) continue;
+        const objPath = `${base}.objects.${objectName}`;
+        const facts = universe.objects.get(objectName);
+        if (!facts) {
+          if (isPlatformProvidedObjectName3(objectName)) continue;
+          orphan(
+            `${inLocale} \xB7 object "${objectName}"`,
+            objPath,
+            hasPlatformObjectPrefix2(objectName) ? `Translations are keyed to "${objectName}", which carries a platform namespace prefix but is registered by no platform package, official plugin, or cloud runtime object \u2014 and this stack does not define it either. Nothing resolves these keys.` + suggest6(objectName, universe.objects.keys()) : `Translations are keyed to "${objectName}", which no object in this stack defines. The resolver looks up keys derived from the metadata, so this whole subtree is dead weight \u2014 every label it carries renders untranslated.` + suggest6(objectName, universe.objects.keys()),
+            `Rename the key to the object it was written for, drop it, or ignore this if the object is contributed by another installed package.` + (universe.objects.size > 0 ? ` Defined objects: ${listNames(universe.objects.keys())}.` : "")
+          );
+          continue;
+        }
+        for (const [fieldName, rawField] of Object.entries(asRecord(rawNode.fields))) {
+          const fieldPath = `${objPath}.fields.${fieldName}`;
+          const field = facts.fields.get(fieldName);
+          if (!field) {
+            if (IMPLICIT_FIELDS.has(fieldName)) continue;
+            orphan(
+              `${inLocale} \xB7 object "${objectName}" \xB7 field "${fieldName}"`,
+              fieldPath,
+              `Translations are keyed to field "${fieldName}", which object "${objectName}" does not declare. The label renders untranslated in this locale \u2014 and because every neighbouring field DOES resolve, the hole reads as a styling quirk rather than a missing translation.` + suggest6(fieldName, facts.fields.keys()),
+              `Point the key at a declared field, or drop it if the field was removed or renamed.` + (facts.fields.size > 0 ? ` Declared fields: ${listNames(facts.fields.keys())}.` : "")
+            );
+            continue;
+          }
+          if (!isRec7(rawField)) continue;
+          checkOptionKeys(findings, {
+            optionMap: rawField.options,
+            field,
+            fieldName,
+            objectName,
+            path: `${fieldPath}.options`,
+            where: `${inLocale} \xB7 object "${objectName}" \xB7 field "${fieldName}"`
+          });
+        }
+        for (const viewName of Object.keys(asRecord(rawNode._views))) {
+          if (facts.views.has(viewName)) continue;
+          orphan(
+            `${inLocale} \xB7 object "${objectName}" \xB7 view "${viewName}"`,
+            `${objPath}._views.${viewName}`,
+            `Translations are keyed to view "${viewName}", which no view of object "${objectName}" declares. The view tab keeps its source-locale label.` + suggest6(viewName, facts.views),
+            `Match the key to the view's \`name\` (not its label), or drop it.` + (facts.views.size > 0 ? ` Declared views: ${listNames(facts.views)}.` : "")
+          );
+        }
+        for (const sectionName of Object.keys(asRecord(rawNode._sections))) {
+          if (facts.sections.has(sectionName)) continue;
+          orphan(
+            `${inLocale} \xB7 object "${objectName}" \xB7 section "${sectionName}"`,
+            `${objPath}._sections.${sectionName}`,
+            `Translations are keyed to section "${sectionName}", which nothing on object "${objectName}" declares \u2014 no \`fieldGroups[].key\`, no named form-view section, no named \`record:details\` section. The section heading stays in the source locale.` + suggest6(sectionName, facts.sections),
+            `Sections are translatable only through a STABLE NAME: give the group/section a \`key\`/\`name\` and use it here, or drop the translation.` + (facts.sections.size > 0 ? ` Declared sections: ${listNames(facts.sections)}.` : ` Object "${objectName}" declares no named section at all.`)
+          );
+        }
+        for (const [actionName, rawAction] of Object.entries(asRecord(rawNode._actions))) {
+          const actionPath = `${objPath}._actions.${actionName}`;
+          const action = facts.actions.get(actionName);
+          if (!action) {
+            orphan(
+              `${inLocale} \xB7 object "${objectName}" \xB7 action "${actionName}"`,
+              actionPath,
+              `Translations are keyed to action "${actionName}", which is defined by neither object "${objectName}"'s \`actions\` nor a \`stack.actions\` entry bound to it. The button keeps its source-locale label.` + suggest6(actionName, facts.actions.keys()),
+              `Match the key to a defined action name, move it under the object that owns the action, or drop it.` + (facts.actions.size > 0 ? ` Actions on this object: ${listNames(facts.actions.keys())}.` : "")
+            );
+            continue;
+          }
+          checkActionParams(findings, {
+            rawAction,
+            action,
+            path: actionPath,
+            where: `${inLocale} \xB7 object "${objectName}" \xB7 action "${actionName}"`,
+            subject: `action "${actionName}"`
+          });
+        }
+      }
+      for (const [actionName, rawAction] of Object.entries(asRecord(rawData.globalActions))) {
+        const actionPath = `${base}.globalActions.${actionName}`;
+        const action = universe.globalActions.get(actionName);
+        if (!action) {
+          const owner = universe.actionOwners.get(actionName);
+          orphan(
+            `${inLocale} \xB7 global action "${actionName}"`,
+            actionPath,
+            owner ? `Action "${actionName}" is bound to object "${owner}", so the resolver looks it up under \`objects.${owner}._actions.${actionName}\` \u2014 never under \`globalActions\`, which is only consulted for object-less actions. This key is never read.` : `Translations are keyed to global action "${actionName}", which no object-less action in this stack defines. The button keeps its source-locale label.` + suggest6(actionName, universe.globalActions.keys()),
+            owner ? `Move these keys under \`objects.${owner}._actions.${actionName}\`.` : `Match the key to an object-less action's name, or drop it.` + (universe.globalActions.size > 0 ? ` Object-less actions: ${listNames(universe.globalActions.keys())}.` : "")
+          );
+          continue;
+        }
+        checkActionParams(findings, {
+          rawAction,
+          action,
+          path: actionPath,
+          where: `${inLocale} \xB7 global action "${actionName}"`,
+          subject: `action "${actionName}"`
+        });
+      }
+      for (const [appName, rawApp] of Object.entries(asRecord(rawData.apps))) {
+        const appPath = `${base}.apps.${appName}`;
+        const navIds = universe.apps.get(appName);
+        if (!navIds) {
+          orphan(
+            `${inLocale} \xB7 app "${appName}"`,
+            appPath,
+            `Translations are keyed to app "${appName}", which this stack does not define. The app launcher shows the source-locale label.` + suggest6(appName, universe.apps.keys()),
+            `Match the key to an app's \`name\`, or drop it.` + (universe.apps.size > 0 ? ` Defined apps: ${listNames(universe.apps.keys())}.` : "")
+          );
+          continue;
+        }
+        if (!isRec7(rawApp)) continue;
+        for (const navId of Object.keys(asRecord(rawApp.navigation))) {
+          if (navIds.has(navId)) continue;
+          orphan(
+            `${inLocale} \xB7 app "${appName}" \xB7 navigation "${navId}"`,
+            `${appPath}.navigation.${navId}`,
+            `Translations are keyed to navigation item "${navId}", which app "${appName}" does not declare. The menu entry keeps its source-locale label.` + suggest6(navId, navIds),
+            `Match the key to the navigation item's \`id\`, or drop it.` + (navIds.size > 0 ? ` Declared navigation ids: ${listNames(navIds)}.` : "")
+          );
+        }
+      }
+      for (const [dashName, rawDash] of Object.entries(asRecord(rawData.dashboards))) {
+        const dashPath = `${base}.dashboards.${dashName}`;
+        const dash = universe.dashboards.get(dashName);
+        if (!dash) {
+          orphan(
+            `${inLocale} \xB7 dashboard "${dashName}"`,
+            dashPath,
+            `Translations are keyed to dashboard "${dashName}", which this stack does not define. The dashboard title stays in the source locale.` + suggest6(dashName, universe.dashboards.keys()),
+            `Match the key to a dashboard's \`name\`, or drop it.` + (universe.dashboards.size > 0 ? ` Defined dashboards: ${listNames(universe.dashboards.keys())}.` : "")
+          );
+          continue;
+        }
+        if (!isRec7(rawDash)) continue;
+        for (const widgetId of Object.keys(asRecord(rawDash.widgets))) {
+          if (dash.widgets.has(widgetId)) continue;
+          orphan(
+            `${inLocale} \xB7 dashboard "${dashName}" \xB7 widget "${widgetId}"`,
+            `${dashPath}.widgets.${widgetId}`,
+            `Translations are keyed to widget "${widgetId}", which dashboard "${dashName}" does not declare. The widget title stays in the source locale.` + suggest6(widgetId, dash.widgets),
+            `Match the key to the widget's \`id\`, or drop it.` + (dash.widgets.size > 0 ? ` Declared widget ids: ${listNames(dash.widgets)}.` : "")
+          );
+        }
+        for (const actionKey of Object.keys(asRecord(rawDash.actions))) {
+          if (dash.actions.has(actionKey)) continue;
+          orphan(
+            `${inLocale} \xB7 dashboard "${dashName}" \xB7 action "${actionKey}"`,
+            `${dashPath}.actions.${actionKey}`,
+            `Translations are keyed to header action "${actionKey}", which dashboard "${dashName}" does not declare. The button keeps its source-locale label.` + suggest6(actionKey, dash.actions),
+            `Header-action translations are keyed by the action's \`actionUrl\`, not its label.` + (dash.actions.size > 0 ? ` Declared header actions: ${listNames(dash.actions)}.` : "")
+          );
+        }
+      }
+    }
+  }
+  return findings;
+}
+function asRecord(v) {
+  return isRec7(v) ? v : {};
+}
+function checkOptionKeys(findings, ctx) {
+  const optionKeys = Object.keys(asRecord(ctx.optionMap));
+  if (optionKeys.length === 0) return;
+  const declared = readOptions(ctx.field);
+  if (!declared) {
+    findings.push({
+      severity: "warning",
+      rule: TRANSLATION_OPTION_KEY_UNKNOWN,
+      where: ctx.where,
+      path: ctx.path,
+      message: `Option translations are keyed under field "${ctx.fieldName}" of object "${ctx.objectName}", which declares no \`options\` at all (field type "${strName10(ctx.field.type) ?? "unknown"}"). Nothing reads this map.`,
+      hint: `Declare the options on the field, move the translations to the field that owns them, or drop them.`
+    });
+    return;
+  }
+  for (const key of optionKeys) {
+    if (declared.values.has(key)) continue;
+    const byLabel = declared.byLabel.get(key.toLowerCase());
+    findings.push({
+      severity: "warning",
+      rule: TRANSLATION_OPTION_KEY_UNKNOWN,
+      where: ctx.where,
+      path: `${ctx.path}.${key}`,
+      message: byLabel ? `Option translation is keyed by the DISPLAY LABEL "${key}" instead of the stored value "${byLabel}". The resolver looks the option up by value, so this entry is never found and the option renders with its source-locale label.` : `Option translation is keyed by "${key}", which is not one of the values declared by field "${ctx.objectName}.${ctx.fieldName}". The option renders untranslated.` + suggest6(key, declared.values),
+      hint: byLabel ? `Rename the key to "${byLabel}".` : `Option keys are the stored \`value\`, not the label and not a variant spelling (\`direct_mail\`, not \`direct-mail\`). Declared values: ${listNames(declared.values)}.`
+    });
+  }
+}
+function checkActionParams(findings, ctx) {
+  const rawParams = Object.keys(asRecord(isRec7(ctx.rawAction) ? ctx.rawAction.params : void 0));
+  if (rawParams.length === 0) return;
+  const declared = /* @__PURE__ */ new Set();
+  for (const param of asArray29(ctx.action.params)) {
+    const name = strName10(param.name) ?? strName10(param.field);
+    if (name) declared.add(name);
+  }
+  for (const paramName of rawParams) {
+    if (declared.has(paramName)) continue;
+    findings.push({
+      severity: "warning",
+      rule: TRANSLATION_TARGET_UNKNOWN,
+      where: `${ctx.where} \xB7 param "${paramName}"`,
+      path: `${ctx.path}.params.${paramName}`,
+      message: `Translations are keyed to parameter "${paramName}", which ${ctx.subject} does not declare. The parameter's label and help text render untranslated in the action dialog.` + suggest6(paramName, declared),
+      hint: `Match the key to a declared param \`name\`, or drop it.` + (declared.size > 0 ? ` Declared params: ${listNames(declared)}.` : "")
+    });
+  }
+}
+
+// src/validate-ai-surface-affinity.ts
+var AI_SKILL_SURFACE_MISMATCH = "ai-skill-surface-mismatch";
+function asArray30(v) {
+  if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName11(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function surfaceOf(v) {
+  return typeof v === "string" && v.length > 0 ? v : "ask";
+}
+function validateAiSurfaceAffinity(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const skillsByName = /* @__PURE__ */ new Map();
+  for (const skill of asArray30(stack.skills)) {
+    const n = strName11(skill.name);
+    if (n) skillsByName.set(n, skill);
+  }
+  const agents = asArray30(stack.agents);
+  for (let ai = 0; ai < agents.length; ai++) {
+    const agent = agents[ai];
+    const agentName = strName11(agent.name) ?? `#${ai}`;
+    const agentSurface = surfaceOf(agent.surface);
+    const skillRefs = Array.isArray(agent.skills) ? agent.skills : [];
+    for (let si = 0; si < skillRefs.length; si++) {
+      const ref = strName11(skillRefs[si]);
+      if (!ref) continue;
+      const skill = skillsByName.get(ref);
+      if (!skill) continue;
+      const skillSurface = surfaceOf(skill.surface);
+      if (skillSurface === "both" || skillSurface === agentSurface) continue;
+      findings.push({
+        severity: "error",
+        rule: AI_SKILL_SURFACE_MISMATCH,
+        where: `agent "${agentName}" \xB7 skills`,
+        path: `agents[${ai}].skills[${si}]`,
+        message: `Agent "${agentName}" (surface: '${agentSurface}') references skill "${ref}" (surface: '${skillSurface}') \u2014 incompatible affinity (ADR-0064 \xA73). The runtime refuses this binding with a load error, so chatting with this agent fails at request time even though the stack parses and validates cleanly.`,
+        hint: `A skill may only attach to an agent whose surface it matches. Move "${ref}" to a '${skillSurface}'-surface agent, change its \`surface\` to '${agentSurface}', or \u2014 only if it is a genuinely shared, read-only capability \u2014 declare \`surface: 'both'\`.`
+      });
+    }
+  }
+  return findings;
+}
+
+// src/validate-ai-tool-references.ts
+import { PLATFORM_PROVIDED_TOOL_NAMES, PLATFORM_TOOL_FAMILY_PREFIXES } from "@objectstack/spec/system";
+var AI_SKILL_TOOL_UNRESOLVED = "ai-skill-tool-unresolved";
+function asArray31(v) {
+  if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName12(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function distance6(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const curr = [i, ...new Array(n).fill(0)];
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    prev = curr;
+  }
+  return prev[n];
+}
+function suggest7(target, known) {
+  for (const prefix of PLATFORM_TOOL_FAMILY_PREFIXES) {
+    if (known.has(`${prefix}${target}`)) return ` Did you mean "${prefix}${target}"?`;
+  }
+  let best;
+  let bestScore = Infinity;
+  for (const candidate of known) {
+    const d = distance6(target, candidate);
+    if (d < bestScore) {
+      bestScore = d;
+      best = candidate;
+    }
+  }
+  const limit = Math.max(2, Math.floor(target.length / 3));
+  return best && bestScore <= limit ? ` Did you mean "${best}"?` : "";
+}
+var HEADLESS_ACTION_TYPES = /* @__PURE__ */ new Set(["script", "api", "flow"]);
+function materialisesAsTool(action) {
+  const ai = action.ai;
+  if (!ai || typeof ai !== "object") return false;
+  const aiRec = ai;
+  if (aiRec.exposed !== true) return false;
+  if (!strName12(aiRec.description)) return false;
+  const type = strName12(action.type);
+  if (!type || !HEADLESS_ACTION_TYPES.has(type)) return false;
+  if (type === "script") return Boolean(action.target || action.body);
+  return Boolean(action.target);
+}
+function collectToolUniverse(stack) {
+  const universe = new Set(PLATFORM_PROVIDED_TOOL_NAMES);
+  for (const tool of asArray31(stack.tools)) {
+    const n = strName12(tool.name);
+    if (n) universe.add(n);
+  }
+  const addActionFamily = (actions) => {
+    for (const action of asArray31(actions)) {
+      const n = strName12(action.name);
+      if (n && materialisesAsTool(action)) universe.add(`action_${n}`);
+    }
+  };
+  addActionFamily(stack.actions);
+  for (const obj of asArray31(stack.objects)) {
+    addActionFamily(obj.actions);
+  }
+  return universe;
+}
+function collectUnexposedActionNames(stack) {
+  const names = /* @__PURE__ */ new Set();
+  const scan = (actions) => {
+    for (const action of asArray31(actions)) {
+      const n = strName12(action.name);
+      if (n && !materialisesAsTool(action)) names.add(n);
+    }
+  };
+  scan(stack.actions);
+  for (const obj of asArray31(stack.objects)) scan(obj.actions);
+  return names;
+}
+function validateAiToolReferences(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const universe = collectToolUniverse(stack);
+  const unexposedActions = collectUnexposedActionNames(stack);
+  const resolves = (ref) => {
+    if (ref.endsWith("*")) {
+      const prefix = ref.slice(0, -1);
+      for (const name of universe) {
+        if (name.startsWith(prefix)) return true;
+      }
+      return false;
+    }
+    return universe.has(ref);
+  };
+  const skills = asArray31(stack.skills);
+  for (let si = 0; si < skills.length; si++) {
+    const skill = skills[si];
+    const skillName = strName12(skill.name) ?? `#${si}`;
+    const refs = Array.isArray(skill.tools) ? skill.tools : [];
+    for (let ti = 0; ti < refs.length; ti++) {
+      const ref = strName12(refs[ti]);
+      if (!ref || resolves(ref)) continue;
+      const isPattern = ref.endsWith("*");
+      const unexposed = !isPattern && ref.startsWith("action_") && unexposedActions.has(ref.slice("action_".length)) ? ref.slice("action_".length) : void 0;
+      findings.push({
+        severity: "warning",
+        rule: AI_SKILL_TOOL_UNRESOLVED,
+        where: `skill "${skillName}" \xB7 tools`,
+        path: `skills[${si}].tools[${ti}]`,
+        message: isPattern ? `Skill "${skillName}" subscribes to tool family "${ref}", which matches nothing this stack can resolve (no declared tool, no platform tool, and no AI-exposed declarative action materialises into it). The subscription contributes zero tools at runtime.` : unexposed ? `Skill "${skillName}" references tool "${ref}", but the action "${unexposed}" does not become an AI tool: the runtime materialises \`action_<name>\` only for an action that opts in with \`ai.exposed: true\` + \`ai.description\` (ADR-0011) AND has a headless path (type \`script\`/\`api\`/\`flow\` with a target or body \u2014 \`url\`/\`modal\`/\`form\` are UI-only). The reference is dropped at runtime, so the skill promises a capability the agent cannot call.` : `Skill "${skillName}" references tool "${ref}", which resolves to nothing this stack can see: not a \`stack.tools\` record, not a platform-registered tool, and not a materialised action tool (\`action_<name>\`). The runtime silently drops the reference, so the skill's instructions claim a capability the agent does not have \u2014 the assistant will improvise or fail when asked to use it.` + suggest7(ref, universe),
+        hint: unexposed ? `Either opt "${unexposed}" in \u2014 set \`ai: { exposed: true, description: '\u2026' }\` (\u226540 chars, LLM-facing) and give it a headless type \u2014 or drop the reference and have the skill's instructions recommend the UI action instead. A \`modal\`/\`form\`/\`url\` action stays human-driven by design; that is a legitimate answer, not a gap.` : `Back "${ref}" with a real executable: declare a declarative action (or flow), opt it in with \`ai.exposed: true\` + \`ai.description\`, and reference its materialised tool (\`action_<name>\` \u2014 the ADR-0109 default path, no tool record needed); or reference a platform tool by its registered name; or remove the reference and the instructions that mention it. Ignore this only if a runtime plugin outside the platform registry provides "${ref}". Family prefixes materialised by the runtime: ${PLATFORM_TOOL_FAMILY_PREFIXES.join(", ")}.`
+      });
+    }
+  }
+  return findings;
+}
+
+// src/validate-ai-agent-authoring.ts
+var AGENT_AUTHORING_WITHDRAWN = "agent-authoring-withdrawn";
+function asArray32(v) {
+  if (Array.isArray(v)) return v.filter((x) => !!x && typeof x === "object");
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
+function strName13(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+var PLATFORM_AGENT_NAMES = /* @__PURE__ */ new Set(["ask", "build", "data_chat", "metadata_assistant"]);
+function validateAiAgentAuthoring(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const agents = asArray32(stack.agents);
+  for (let ai = 0; ai < agents.length; ai++) {
+    const agent = agents[ai];
+    const name = strName13(agent.name) ?? `#${ai}`;
+    const isPlatformName = PLATFORM_AGENT_NAMES.has(name);
+    const skillCount = Array.isArray(agent.skills) ? agent.skills.length : 0;
+    findings.push({
+      severity: "warning",
+      rule: AGENT_AUTHORING_WITHDRAWN,
+      where: `agent "${name}"`,
+      path: `agents[${ai}]`,
+      message: isPlatformName ? `This stack declares an agent named "${name}", which is a PLATFORM agent id. The runtime serves its own record for that name and ignores this one \u2014 the declaration has no effect and will drift from the platform's definition.` : `This stack declares the agent "${name}", but tenant/app-package agents were withdrawn (ADR-0063 \xA72): the kernel ships exactly two agents (\`ask\`, \`build\`) and the surface the user is in binds one. The runtime filters this record out of the agent catalog and refuses to load it, so it never runs \u2014 it parses, validates, and ships as inert metadata.`,
+      hint: isPlatformName ? `Remove the declaration; the platform owns "${name}". Extend it with skills instead.` : `Delete the agent and express its capability as skills. Everything an agent carried that a skill does not is persona text: move the useful parts of \`instructions\` into the skills' own instructions.` + (skillCount > 0 ? ` The ${skillCount} skill${skillCount === 1 ? "" : "s"} this agent references already carry the capability \u2014 they attach to the platform agent by \`surface\` affinity, so nothing is lost by dropping the persona.` : ``)
+    });
+  }
+  return findings;
+}
+
+// src/validate-hook-body-writes.ts
+import { createRequire as createRequire3 } from "module";
+import { findClosestMatches, formatSuggestion } from "@objectstack/spec/shared";
+var cachedTs2 = null;
+function loadTypeScript2() {
+  if (cachedTs2) return cachedTs2;
+  const anchor = typeof import.meta !== "undefined" && import.meta.url ? import.meta.url : typeof __filename !== "undefined" ? __filename : process.cwd() + "/";
+  try {
+    cachedTs2 = createRequire3(anchor)("typescript");
+  } catch (err) {
+    throw new Error(
+      `@objectstack/lint: checking an L2 (language:'js') hook body requires the "typescript" package, which could not be loaded (${err instanceof Error ? err.message : String(err)}). It is a declared dependency of @objectstack/lint \u2014 if this deployment prunes packages, keep "typescript" in the image; it is only loaded when a hook with a JS body is validated.`
+    );
+  }
+  return cachedTs2;
+}
+var HOOK_BODY_WRITE_UNKNOWN_FIELD = "hook-body-write-unknown-field";
+var HOOK_BODY_WRITE_PATTERNS = [
+  {
+    id: "input-property-assign",
+    syntax: "ctx.input.<field> = \u2026 | ctx.input['<field>'] \u27E8op\u27E9= \u2026",
+    example: {
+      // Compound (`+=`) and logical (`??=`) assignment operators write their
+      // LHS exactly like `=` does — the example pins the whole operator range.
+      source: "ctx.input.total = 0; ctx.input['status'] ??= 'open'; ctx.input.retries += 1;",
+      writes: [{ field: "total" }, { field: "status" }, { field: "retries" }]
+    }
+  },
+  {
+    id: "input-object-assign",
+    syntax: "Object.assign(ctx.input, { <field>: \u2026 })",
+    example: {
+      source: "Object.assign(ctx.input, { total: 5, 'status': 'open', discount });",
+      writes: [{ field: "total" }, { field: "status" }, { field: "discount" }]
+    }
+  },
+  {
+    // ACTION-only shape (the hook sandbox context has no `ctx.record` at all).
+    // Declared here because this ledger is the extractor's shape inventory, not
+    // any one rule's; every consumer declares which shapes it consumes.
+    id: "record-property-assign",
+    syntax: "ctx.record.<field> = \u2026 | ctx.record['<field>'] \u27E8op\u27E9= \u2026",
+    example: {
+      source: "ctx.record.stage = 'won'; ctx.record['amount'] += 1;",
+      writes: [{ field: "stage" }, { field: "amount" }]
+    }
+  },
+  {
+    id: "api-crud-literal",
+    syntax: "ctx.api.object('<object>').insert({\u2026}) | .create({\u2026}) | .update({\u2026}) | .updateById(id, {\u2026})",
+    example: {
+      // Real ObjectRepository signatures: the record payload is argument 0 for
+      // insert/create/update and argument 1 for updateById. (`update(data)` —
+      // NOT `update(id, data)`; the id travels inside the payload/options.)
+      source: "await ctx.api.object('audit_log').insert({ event: 'won' }); await ctx.api.object('crm_deal').updateById(id, { stage: 'won' });",
+      writes: [
+        { field: "event", object: "audit_log" },
+        { field: "stage", object: "crm_deal" }
+      ]
+    }
+  }
+];
+var HOOK_BODY_WRITE_PATTERN_IDS = [
+  "input-property-assign",
+  "input-object-assign",
+  "api-crud-literal"
+];
+var HOOK_BODY_WRITE_EXCLUSIONS = [
+  {
+    id: "record-property-assign",
+    reason: "a hook sandbox context has no `ctx.record` at all \u2014 `buildSandboxContext` never sets it (a hook\u2019s record IS `ctx.input`), so the expression throws at run time rather than silently no-op\u2019ing. A loud failure the author sees on the first run is not this advisory rule\u2019s business"
+  }
+];
+var HOOK_APPLICABLE_IDS = new Set(HOOK_BODY_WRITE_PATTERN_IDS);
+var API_WRITE_METHODS = /* @__PURE__ */ new Map([
+  ["insert", 0],
+  ["create", 0],
+  ["update", 0],
+  ["updateById", 1]
+]);
+var INPUT_ENVELOPE_KEYS = /* @__PURE__ */ new Set(["id", "options", "ast", "data"]);
+var IMPLICIT_FIELDS2 = /* @__PURE__ */ new Set([
+  ...SYSTEM_FIELDS,
+  "_id",
+  "name",
+  "space",
+  "owner",
+  "record_type"
+]);
+var isRec8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray33(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec8(x));
+  if (isRec8(v)) {
+    return Object.entries(v).map(([name, def]) => ({
+      name,
+      ...isRec8(def) ? def : {}
+    }));
+  }
+  return [];
+}
+function indexObjectFields2(stack) {
+  const out = /* @__PURE__ */ new Map();
+  for (const obj of asArray33(stack.objects)) {
+    const name = typeof obj.name === "string" ? obj.name : void 0;
+    if (!name) continue;
+    const names = /* @__PURE__ */ new Set();
+    for (const f of asArray33(obj.fields)) {
+      if (typeof f.name === "string" && f.name) names.add(f.name);
+    }
+    out.set(name, names);
+  }
+  return out;
+}
+function judgeableFieldsOf(index, objectName) {
+  const declared = index.get(objectName);
+  if (!declared || declared.size === 0) return void 0;
+  return declared;
+}
+function extractHookBodyWrites(source) {
+  return extractHookBodyWriteSet(source).writes;
+}
+function extractHookBodyWriteSet(source) {
+  if (!/\bctx\b/.test(source) && !/\bObject\b/.test(source)) {
+    return { writes: [], ctxRecordEscapes: false };
+  }
+  const tsc = loadTypeScript2();
+  const sf = tsc.createSourceFile(
+    "hook-body.ts",
+    `async function __body(ctx) {
+${source}
+}`,
+    tsc.ScriptTarget.Latest,
+    /* setParentNodes */
+    false,
+    tsc.ScriptKind.TS
+  );
+  const writes = [];
+  const recordRefs = [];
+  const consumedRecordRefs = /* @__PURE__ */ new Set();
+  const isCtxDot = (node, prop) => tsc.isPropertyAccessExpression(node) && tsc.isIdentifier(node.expression) && node.expression.text === "ctx" && node.name.text === prop;
+  const fieldOfCtxLhs = (lhs, prop) => {
+    if (tsc.isPropertyAccessExpression(lhs) && tsc.isIdentifier(lhs.name) && isCtxDot(lhs.expression, prop)) {
+      return lhs.name.text;
+    }
+    if (tsc.isElementAccessExpression(lhs) && isCtxDot(lhs.expression, prop)) {
+      const arg = lhs.argumentExpression;
+      if (tsc.isStringLiteral(arg) || tsc.isNoSubstitutionTemplateLiteral(arg)) return arg.text;
+    }
+    return void 0;
+  };
+  const literalObjectKeys = (node) => {
+    if (!tsc.isObjectLiteralExpression(node)) return [];
+    const keys = [];
+    for (const p of node.properties) {
+      if (tsc.isPropertyAssignment(p)) {
+        if (tsc.isIdentifier(p.name) || tsc.isStringLiteral(p.name)) keys.push(p.name.text);
+      } else if (tsc.isShorthandPropertyAssignment(p)) {
+        keys.push(p.name.text);
+      }
+    }
+    return keys;
+  };
+  const visit = (node) => {
+    if (tsc.isBinaryExpression(node) && node.operatorToken.kind >= tsc.SyntaxKind.FirstAssignment && node.operatorToken.kind <= tsc.SyntaxKind.LastAssignment) {
+      const inputField = fieldOfCtxLhs(node.left, "input");
+      if (inputField !== void 0 && !INPUT_ENVELOPE_KEYS.has(inputField)) {
+        writes.push({ patternId: "input-property-assign", field: inputField });
+      }
+      const recordField = fieldOfCtxLhs(node.left, "record");
+      if (recordField !== void 0) {
+        writes.push({ patternId: "record-property-assign", field: recordField });
+      }
+    }
+    if (tsc.isPropertyAccessExpression(node) || tsc.isElementAccessExpression(node)) {
+      if (isCtxDot(node.expression, "record")) consumedRecordRefs.add(node.expression);
+    }
+    if (tsc.isBinaryExpression(node)) {
+      const op = node.operatorToken.kind;
+      if ((op === tsc.SyntaxKind.AmpersandAmpersandToken || op === tsc.SyntaxKind.BarBarToken || op === tsc.SyntaxKind.QuestionQuestionToken) && isCtxDot(node.left, "record")) {
+        consumedRecordRefs.add(node.left);
+      }
+    }
+    if (tsc.isPrefixUnaryExpression(node) && node.operator === tsc.SyntaxKind.ExclamationToken) {
+      if (isCtxDot(node.operand, "record")) consumedRecordRefs.add(node.operand);
+    }
+    if (tsc.isTypeOfExpression(node) && isCtxDot(node.expression, "record")) {
+      consumedRecordRefs.add(node.expression);
+    }
+    if ((tsc.isIfStatement(node) || tsc.isWhileStatement(node) || tsc.isDoStatement(node)) && isCtxDot(node.expression, "record")) {
+      consumedRecordRefs.add(node.expression);
+    }
+    if (tsc.isConditionalExpression(node) && isCtxDot(node.condition, "record")) {
+      consumedRecordRefs.add(node.condition);
+    }
+    if (isCtxDot(node, "record")) recordRefs.push(node);
+    if (tsc.isCallExpression(node)) {
+      const callee = node.expression;
+      if (tsc.isPropertyAccessExpression(callee) && tsc.isIdentifier(callee.expression) && callee.expression.text === "Object" && callee.name.text === "assign" && node.arguments.length >= 2 && isCtxDot(node.arguments[0], "input")) {
+        for (const arg of node.arguments.slice(1)) {
+          for (const field of literalObjectKeys(arg)) {
+            if (!INPUT_ENVELOPE_KEYS.has(field)) {
+              writes.push({ patternId: "input-object-assign", field });
+            }
+          }
+        }
+      }
+      if (tsc.isPropertyAccessExpression(callee) && tsc.isIdentifier(callee.name)) {
+        const payloadIndex = API_WRITE_METHODS.get(callee.name.text);
+        const recv = callee.expression;
+        if (payloadIndex !== void 0 && tsc.isCallExpression(recv) && tsc.isPropertyAccessExpression(recv.expression) && recv.expression.name.text === "object" && isCtxDot(recv.expression.expression, "api") && recv.arguments.length === 1) {
+          const objArg = recv.arguments[0];
+          const objectName = tsc.isStringLiteral(objArg) || tsc.isNoSubstitutionTemplateLiteral(objArg) ? objArg.text : void 0;
+          const payload = node.arguments[payloadIndex];
+          if (objectName && payload !== void 0) {
+            for (const field of literalObjectKeys(payload)) {
+              writes.push({
+                patternId: "api-crud-literal",
+                object: objectName,
+                method: callee.name.text,
+                field
+              });
+            }
+          }
+        }
+      }
+    }
+    tsc.forEachChild(node, visit);
+  };
+  visit(sf);
+  return {
+    writes,
+    ctxRecordEscapes: recordRefs.some((ref) => !consumedRecordRefs.has(ref))
+  };
+}
+function validateHookBodyWrites(stack) {
+  const findings = [];
+  const hooks = asArray33(stack.hooks);
+  if (hooks.length === 0) return findings;
+  let objectFields = null;
+  hooks.forEach((hook, hookIndex) => {
+    const body = hook.body;
+    if (!isRec8(body) || body.language !== "js") return;
+    const source = body.source;
+    if (typeof source !== "string" || source.trim() === "") return;
+    const writes = extractHookBodyWrites(source).filter((w) => HOOK_APPLICABLE_IDS.has(w.patternId));
+    if (writes.length === 0) return;
+    objectFields ?? (objectFields = indexObjectFields2(stack));
+    const hookName = typeof hook.name === "string" && hook.name ? hook.name : `#${hookIndex}`;
+    const targets = (Array.isArray(hook.object) ? hook.object : [hook.object]).filter(
+      (o) => typeof o === "string" && o.trim() !== ""
+    );
+    const targetSets = targets.map((t) => judgeableFieldsOf(objectFields, t));
+    const inputJudgeable = targets.length > 0 && !targets.includes("*") && targetSets.every((s) => s !== void 0);
+    const where = `hook "${hookName}" \u203A body`;
+    const path = `hooks[${hookIndex}].body.source`;
+    const reported = /* @__PURE__ */ new Set();
+    for (const w of writes) {
+      const dedupeKey = `${w.object ?? ""}\0${w.field}`;
+      if (reported.has(dedupeKey)) continue;
+      if (w.object === void 0) {
+        if (!inputJudgeable) continue;
+        if (IMPLICIT_FIELDS2.has(w.field)) continue;
+        if (targetSets.some((s) => s.has(w.field))) continue;
+        reported.add(dedupeKey);
+        const objDesc = targets.length === 1 ? `object '${targets[0]}'` : `none of its target objects (${targets.join(", ")})`;
+        const declares = targets.length === 1 ? "declares no such field" : "declare that field";
+        findings.push({
+          severity: "warning",
+          rule: HOOK_BODY_WRITE_UNKNOWN_FIELD,
+          where,
+          path,
+          message: `body writes '${w.field}' to its input, but ${objDesc} ${declares}. The sandboxed script runs clean and the value is copied back onto the record payload unfiltered \u2014 on a SQL driver the stray column then fails the WHOLE write with a driver-level error far from here; on a schemaless driver (memory, MongoDB) it is persisted as an undeclared key (#4271).`,
+          hint: fixHint(w.field, unionCandidates(targetSets))
+        });
+      } else {
+        const known = judgeableFieldsOf(objectFields, w.object);
+        if (!known) continue;
+        if (IMPLICIT_FIELDS2.has(w.field) || known.has(w.field)) continue;
+        reported.add(dedupeKey);
+        findings.push({
+          severity: "warning",
+          rule: HOOK_BODY_WRITE_UNKNOWN_FIELD,
+          where,
+          path,
+          message: `body calls ctx.api.object('${w.object}').${w.method ?? "update"}(\u2026) writing '${w.field}', but object '${w.object}' declares no such field. The write-path validator skips the unknown key \u2014 on a SQL driver the whole call then fails with a driver-level error far from here; on a schemaless driver (memory, MongoDB) the stray key is persisted (#4271).`,
+          hint: fixHint(w.field, [...known])
+        });
+      }
+    }
+  });
+  return findings;
+}
+function unionCandidates(targetSets) {
+  const out = /* @__PURE__ */ new Set();
+  for (const s of targetSets) for (const f of s ?? []) out.add(f);
+  return [...out];
+}
+function fixHint(field, declared) {
+  const suggestion = formatSuggestion(findClosestMatches(field, [...declared, ...IMPLICIT_FIELDS2]));
+  return (suggestion ? `${suggestion} ` : "") + `Fix the field name, or declare '${field}' on the object. Only the literal write patterns in HOOK_BODY_WRITE_PATTERNS are checked \u2014 computed keys, spreads and aliased input are not \u2014 and this warning never blocks a build.`;
+}
+
+// src/validate-action-body-writes.ts
+import { findClosestMatches as findClosestMatches2, formatSuggestion as formatSuggestion2 } from "@objectstack/spec/shared";
+var ACTION_BODY_WRITE_UNKNOWN_FIELD = "action-body-write-unknown-field";
+var ACTION_RECORD_WRITE_DISCARDED = "action-record-write-discarded";
+var ACTION_BODY_WRITE_PATTERN_IDS = ["api-crud-literal"];
+var ACTION_RECORD_WRITE_PATTERN_IDS = ["record-property-assign"];
+var ACTION_BODY_WRITE_EXCLUSIONS = [
+  {
+    id: "input-property-assign",
+    reason: "an action's ctx.input is its params bag (`input: unwrapProxyToPlain(actionCtx?.params)`), not a record \u2014 `ctx.input.<name>` writes a declared PARAMETER, which object fields cannot judge"
+  },
+  {
+    id: "input-object-assign",
+    reason: "same surface as input-property-assign \u2014 Object.assign(ctx.input, \u2026) targets the params bag"
+  }
+];
+var ACTION_BODY_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_BODY_WRITE_PATTERN_IDS.includes(p.id));
+var ACTION_RECORD_WRITE_PATTERNS = HOOK_BODY_WRITE_PATTERNS.filter((p) => ACTION_RECORD_WRITE_PATTERN_IDS.includes(p.id));
+var APPLICABLE_IDS = new Set(ACTION_BODY_WRITE_PATTERN_IDS);
+var RECORD_WRITE_IDS = new Set(ACTION_RECORD_WRITE_PATTERN_IDS);
+var isRec9 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray34(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec9(x));
+  if (isRec9(v)) {
+    return Object.entries(v).map(([name, def]) => ({
+      name,
+      ...isRec9(def) ? def : {}
+    }));
+  }
+  return [];
+}
+function actionObjectBinding(action, parentObject) {
+  if (typeof action.object === "string" && action.object) return action.object;
+  if (typeof action.objectName === "string" && action.objectName) return action.objectName;
+  return parentObject;
+}
+function collectActionBodies(stack) {
+  const sites = [];
+  const seen = /* @__PURE__ */ new Set();
+  const collect = (actions, pathPrefix, parentObject) => {
+    asArray34(actions).forEach((action, index) => {
+      const body = action.body;
+      if (!isRec9(body) || body.language !== "js") return;
+      const source = body.source;
+      if (typeof source !== "string" || source.trim() === "") return;
+      const name = typeof action.name === "string" && action.name ? action.name : `#${index}`;
+      const key = `${actionObjectBinding(action, parentObject) ?? ""}\0${name}\0${source}`;
+      if (seen.has(key)) return;
+      seen.add(key);
+      sites.push({ name, source, path: `${pathPrefix}[${index}].body.source` });
+    });
+  };
+  collect(stack.actions, "actions");
+  asArray34(stack.objects).forEach((obj, objIndex) => {
+    const parentObject = typeof obj.name === "string" && obj.name ? obj.name : void 0;
+    collect(obj.actions, `objects[${objIndex}].actions`, parentObject);
+  });
+  return sites;
+}
+function validateActionBodyWrites(stack) {
+  const findings = [];
+  if (!isRec9(stack)) return findings;
+  const sites = collectActionBodies(stack);
+  if (sites.length === 0) return findings;
+  let objectFields = null;
+  for (const site of sites) {
+    if (!/\bapi\b/.test(site.source) && !/\brecord\b/.test(site.source)) continue;
+    const { writes: allWrites, ctxRecordEscapes } = extractHookBodyWriteSet(site.source);
+    const writes = allWrites.filter((w) => APPLICABLE_IDS.has(w.patternId));
+    const recordWrites = allWrites.filter((w) => RECORD_WRITE_IDS.has(w.patternId));
+    if (writes.length === 0 && recordWrites.length === 0) continue;
+    const where = `action "${site.name}" \u203A body`;
+    if (recordWrites.length > 0 && !ctxRecordEscapes) {
+      const reportedFields = /* @__PURE__ */ new Set();
+      for (const w of recordWrites) {
+        if (reportedFields.has(w.field)) continue;
+        reportedFields.add(w.field);
+        findings.push({
+          severity: "warning",
+          rule: ACTION_RECORD_WRITE_DISCARDED,
+          where,
+          path: site.path,
+          message: `body assigns ctx.record.${w.field}, but an action's ctx.record is a plain snapshot the runtime never writes back \u2014 the action returns success and the assignment is discarded, whether or not '${w.field}' is a declared field (#4345).`,
+          hint: `To persist it, write through the API: ctx.api.object('<object>').updateById(ctx.recordId, { ${w.field}: \u2026 }). Reported only because ctx.record is never passed anywhere in this body \u2014 mutating the snapshot and then handing it to an API write is a live payload and is not flagged. This warning never blocks a build.`
+        });
+      }
+    }
+    if (writes.length === 0) continue;
+    objectFields ?? (objectFields = indexObjectFields2(stack));
+    const reported = /* @__PURE__ */ new Set();
+    for (const w of writes) {
+      if (w.object === void 0) continue;
+      const dedupeKey = `${w.object}\0${w.field}`;
+      if (reported.has(dedupeKey)) continue;
+      const known = judgeableFieldsOf(objectFields, w.object);
+      if (!known) continue;
+      if (IMPLICIT_FIELDS2.has(w.field) || known.has(w.field)) continue;
+      reported.add(dedupeKey);
+      findings.push({
+        severity: "warning",
+        rule: ACTION_BODY_WRITE_UNKNOWN_FIELD,
+        where,
+        path: site.path,
+        message: `body calls ctx.api.object('${w.object}').${w.method ?? "update"}(\u2026) writing '${w.field}', but object '${w.object}' declares no such field. The write-path validator skips the unknown key \u2014 on a SQL driver the whole action then fails with a driver-level error far from here; on a schemaless driver (memory, MongoDB) the stray key is persisted (#4271).`,
+        hint: fixHint2(w.field, [...known])
+      });
+    }
+  }
+  return findings;
+}
+function fixHint2(field, declared) {
+  const suggestion = formatSuggestion2(findClosestMatches2(field, [...declared, ...IMPLICIT_FIELDS2]));
+  return (suggestion ? `${suggestion} ` : "") + `Fix the field name, or declare '${field}' on the object. Only the literal write patterns in ACTION_BODY_WRITE_PATTERNS are checked \u2014 an action's ctx.input is its params bag, so it is not a record-write surface and is never resolved against fields \u2014 and this warning never blocks a build.`;
+}
+
+// src/validate-flow-node-writes.ts
+import { findClosestMatches as findClosestMatches3, formatSuggestion as formatSuggestion3 } from "@objectstack/spec/shared";
+var FLOW_NODE_WRITE_UNKNOWN_FIELD = "flow-node-write-unknown-field";
+var FLOW_WRITE_NODE_TYPES = ["update_record", "create_record"];
+var FLOW_WRITE_NODE_TYPES_DEFERRED = [];
+var isRec10 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function asArray35(v) {
+  if (Array.isArray(v)) return v.filter((x) => isRec10(x));
+  if (isRec10(v)) {
+    return Object.entries(v).map(([name, def]) => ({
+      name,
+      ...isRec10(def) ? def : {}
+    }));
+  }
+  return [];
+}
+function readLiteralObjectName2(config) {
+  const raw = config.objectName ?? config.object;
+  if (typeof raw !== "string" || raw.includes("{")) return void 0;
+  return raw || void 0;
+}
+var COVERED_TYPES = new Set(FLOW_WRITE_NODE_TYPES);
+function validateFlowNodeWrites(stack) {
+  const findings = [];
+  if (!isRec10(stack)) return findings;
+  const flows = asArray35(stack.flows);
+  if (flows.length === 0) return findings;
+  let objectFields = null;
+  flows.forEach((flow, flowIndex) => {
+    const flowName = typeof flow.name === "string" && flow.name ? flow.name : `#${flowIndex}`;
+    const walked = walkFlowNodes(flow, `flows[${flowIndex}]`);
+    walked.forEach(({ node, path: nodePath, regionTrail }, walkIndex) => {
+      if (typeof node.type !== "string" || !COVERED_TYPES.has(node.type)) return;
+      const config = isRec10(node.config) ? node.config : void 0;
+      if (!config) return;
+      const fields = config.fields;
+      if (!isRec10(fields)) return;
+      const written = Object.keys(fields);
+      if (written.length === 0) return;
+      const objectName = readLiteralObjectName2(config);
+      if (!objectName) return;
+      objectFields ?? (objectFields = indexObjectFields2(stack));
+      const known = judgeableFieldsOf(objectFields, objectName);
+      if (!known) return;
+      const nodeName = flowNodeLabel(node, walkIndex);
+      const nodeWhere = regionTrail ? `${regionTrail} \u203A node "${nodeName}"` : `node "${nodeName}"`;
+      for (const fieldName of written) {
+        if (known.has(fieldName) || IMPLICIT_FIELDS2.has(fieldName)) continue;
+        if (fieldName.includes(".")) continue;
+        findings.push({
+          severity: "error",
+          rule: FLOW_NODE_WRITE_UNKNOWN_FIELD,
+          where: `flow "${flowName}" \u203A ${nodeWhere}`,
+          path: `${nodePath}.config.fields.${fieldName}`,
+          message: `${node.type} writes '${fieldName}', but object '${objectName}' declares no such field. Nothing between the node and storage removes the key: on a SQL datasource the driver rejects the whole statement ('no such column'), so the correctly named fields in this same payload never land either${node.type === "create_record" ? " and the record is never created at all" : ""}; on a schemaless one the stray key is persisted into a column no read surface returns.`,
+          hint: fixHint3(fieldName, [...known])
+        });
+      }
+    });
+  });
+  return findings;
+}
+function fixHint3(field, declared) {
+  const suggestion = formatSuggestion3(findClosestMatches3(field, [...declared, ...IMPLICIT_FIELDS2]));
+  return (suggestion ? `${suggestion} ` : "") + `Fix the field name, or declare '${field}' on the object. This gates the build rather than warning: the key is literal and so is the object, so unlike the hook/action body rules there is nothing here that could have been mis-extracted.`;
+}
+
+// src/reference-integrity-suite.ts
+var REFERENCE_INTEGRITY_RULES = [
+  { name: "validateObjectReferences", run: validateObjectReferences },
+  { name: "validateSearchableFields", run: validateSearchableFields },
+  { name: "validateActionNameRefs", run: validateActionNameRefs },
+  { name: "validatePageFieldBindings", run: validatePageFieldBindings },
+  { name: "validateChartBindings", run: validateChartBindings },
+  { name: "validateNavAccess", run: validateNavAccess },
+  { name: "validateTranslationReferences", run: validateTranslationReferences },
+  { name: "validateFlowTemplatePaths", run: validateFlowTemplatePaths },
+  { name: "validateAiSurfaceAffinity", run: validateAiSurfaceAffinity },
+  { name: "validateAiToolReferences", run: validateAiToolReferences },
+  { name: "validateAiAgentAuthoring", run: validateAiAgentAuthoring },
+  // Field names WRITTEN by an L2 hook body (`ctx.input.x = …`,
+  // `ctx.api.object('y').update({ x })`), resolved against the target object's
+  // declared fields — the write-side counterpart of validateFlowTemplatePaths'
+  // read-side membership (#4271). Lazy: only a hook that actually carries a
+  // `language:'js'` body loads the TypeScript parser.
+  { name: "validateHookBodyWrites", run: validateHookBodyWrites },
+  // The same check on the other surface that carries a `HookBodySchema` body:
+  // action bodies, run by the same sandbox. Only the `ctx.api` write family
+  // carries over — an action's `ctx.input` is its params bag, not a record
+  // (see that module's ledger). Lazy on the same terms.
+  //
+  // The first member here to emit more than one rule id (`validateReactPageProps`
+  // below is the other, and carries the most). Besides resolving `ctx.api`
+  // writes against declared fields (`action-body-write-unknown-field`), it
+  // reports a `ctx.record` write that can reach nothing
+  // (`action-record-write-discarded`, #4345) — not a resolution question, so
+  // by the charter above it does not belong in the suite. It rides along
+  // anyway because it falls out of the SAME parse of the SAME source: a
+  // separate member would parse every action body twice to say two things
+  // about one walk, and hand-wiring it into the CLI instead is exactly the
+  // drift this suite exists to end — which `validateReadonlyFlowWrites` was
+  // the standing proof of, until it joined the suite below.
+  { name: "validateActionBodyWrites", run: validateActionBodyWrites },
+  // The third surface that writes a record field set: a flow `update_record`
+  // node's `config.fields`. Same question as the two rules above, but the map
+  // is structural metadata rather than parsed JS, so a finding is a certainty
+  // and gates (`error`) — see that module for why, and why the docs' long-
+  // standing "prefer a flow node, it's checked" advice was the least true of
+  // the three until it landed.
+  { name: "validateFlowNodeWrites", run: validateFlowNodeWrites },
+  // The OTHER question about that same `config.fields` map: not "does this
+  // field exist?" but "is it writable?" — a `runAs:'user'` update_record
+  // writing a static-`readonly` field is stripped by the engine and the step
+  // still reports success (#2948/#3425). It walks the identical map the rule
+  // above walks, so the two splitting call sites was never defensible: hand-
+  // wired into `validate` and `compile` only, it left `os lint` PASSING a flow
+  // `os validate` refuses — and this one gates, so the divergence shipped a
+  // build the other command would have stopped. Joining the suite is the whole
+  // fix; the two hand-wired call sites are deleted with it (#4345 follow-up).
+  { name: "validateReadonlyFlowWrites", run: validateReadonlyFlowWrites },
+  // The `kind:'react'` page surface. Every prop a react block binds BY FIELD
+  // NAME is resolved against the object it names (#4340) — `<ListView columns>`,
+  // `<ObjectForm fields>`, the `record:*` family through the SAME
+  // `COMPONENT_FIELD_SPECS` table `validatePageFieldBindings` walks one surface
+  // over, plus `<ObjectChart>`'s aggregate/axes (#3701/#3729) and
+  // `searchableFields` (#4329). Squarely the charter's question, on the surface
+  // where it had no answer at all.
+  //
+  // It was hand-wired into `os validate` ALONE, so `os lint` and `os compile`
+  // accepted a react page whose every field binding was stale — including the
+  // gating ones (a missing required binding, a filter position naming no field:
+  // the predicate can never match and the list comes back empty). That is
+  // `validateReadonlyFlowWrites`' divergence again, one surface over, and it is
+  // the reason this entry exists rather than a fourth hand-wiring.
+  //
+  // Like `validateActionBodyWrites` above, it emits ids that are not resolution
+  // questions — `react-prop-missing-required` and `react-prop-typo` are shape,
+  // and by the charter belong outside. They ride along for the same reason: they
+  // fall out of the SAME TypeScript parse of the SAME page source, and splitting
+  // them into a second member would parse every react page twice to say two
+  // things about one walk. Lazy on the same terms as the hook/action body rules
+  // — only a page that is actually `kind:'react'` loads the compiler.
+  { name: "validateReactPageProps", run: validateReactPageProps }
+];
+function validateReferenceIntegrity(stack) {
+  const findings = [];
+  for (const rule of REFERENCE_INTEGRITY_RULES) {
+    findings.push(...rule.run(stack));
+  }
+  return findings;
 }
 export {
+  ACTION_BODY_WRITE_EXCLUSIONS,
+  ACTION_BODY_WRITE_PATTERNS,
+  ACTION_BODY_WRITE_PATTERN_IDS,
+  ACTION_BODY_WRITE_UNKNOWN_FIELD,
+  ACTION_NAME_UNDEFINED,
+  ACTION_RECORD_WRITE_DISCARDED,
+  ACTION_RECORD_WRITE_PATTERNS,
+  ACTION_RECORD_WRITE_PATTERN_IDS,
+  AGENT_AUTHORING_WITHDRAWN,
+  AI_SKILL_SURFACE_MISMATCH,
+  AI_SKILL_TOOL_UNRESOLVED,
+  APPROVAL_APPROVERS_MAY_RESOLVE_EMPTY,
+  APPROVAL_APPROVER_CROSS_ORG_UNSUPPORTED,
   APPROVAL_APPROVER_NOT_MEMBERSHIP_TIER,
   APPROVAL_APPROVER_TYPE_DEPRECATED,
   APPROVAL_APPROVER_TYPE_UNKNOWN,
+  APPROVAL_DECISION_OUTPUTS_RESERVED,
   APPROVAL_ESCALATION_REASSIGN_NO_TARGET,
+  APPROVAL_EXPRESSION_INVALID,
+  APPROVAL_EXPRESSION_NO_EMPTY_POLICY,
   CAPABILITY_REFERENCE_UNKNOWN,
+  CHART_AXIS_NOT_SELECTED,
   CHART_CONFIG_MISSING,
+  CHART_DATASET_UNKNOWN,
+  CHART_DIMENSION_UNKNOWN,
   CHART_FIELD_UNKNOWN,
+  CHART_MEASURE_UNKNOWN,
   DASHBOARD_ACTION_ROUTE_UNRESOLVED,
   DASHBOARD_ACTION_TARGET_UNDEFINED,
   DASHBOARD_FILTER_FIELD_UNKNOWN,
   FIELD_GROUP_EMPTY,
   FIELD_GROUP_UNDECLARED,
+  FILTER_TOKEN_UNKNOWN,
   FLOW_DRAFT_STATUS_AMBIGUOUS,
+  FLOW_NODE_WRITE_UNKNOWN_FIELD,
+  FLOW_TEMPLATE_LOOKUP_TRAVERSAL,
+  FLOW_TEMPLATE_UNKNOWN_FIELD,
   FLOW_TRIGGER_UNKNOWN_OBJECT,
+  FLOW_UPDATE_READONLY_FIELD,
+  FLOW_UPDATE_READONLY_WHEN_FIELD,
+  FLOW_WRITE_NODE_TYPES,
+  FLOW_WRITE_NODE_TYPES_DEFERRED,
   FORM_COLSPAN_ABSOLUTE,
   FORM_FIELD_UNKNOWN,
+  HOOK_BODY_WRITE_EXCLUSIONS,
+  HOOK_BODY_WRITE_PATTERNS,
+  HOOK_BODY_WRITE_PATTERN_IDS,
+  HOOK_BODY_WRITE_UNKNOWN_FIELD,
   LIST_VIEW_FILTERS_IN_VIEWS_MODE,
   MEASURE_AGGREGATE_INCOHERENT,
+  NAV_OBJECT_UNGRANTED,
+  OBJECT_REFERENCE_UNKNOWN,
+  OBJECT_REFERENCE_UNREGISTERED_PLATFORM,
+  ORG_AXIS_CROSS_ORG_BU_GRANT,
+  ORG_AXIS_PERMISSION_INHERITANCE,
+  PAGE_FIELD_UNKNOWN,
   PAGE_SOURCE_CLASSNAME,
+  REACT_CHART_AGGREGATE_INVALID,
+  REACT_CHART_AXIS_UNKNOWN,
+  REACT_CHART_FIELD_UNKNOWN,
+  REFERENCE_INTEGRITY_RULES,
+  SEARCHABLE_FIELD_UNKNOWN,
   SECURITY_ANCHOR_HIGH_PRIVILEGE,
   SECURITY_BOOK_AUDIENCE_UNKNOWN_SET,
   SECURITY_DELEGATION_MISSING_REASON,
@@ -2364,6 +5877,8 @@ export {
   SECURITY_PRIVATE_NO_READSCOPE,
   SECURITY_ROLE_WORD,
   SECURITY_WILDCARD_VAMA,
+  SEED_INSERT_MODE_DUPLICATES_ON_REPLAY,
+  SEED_VALUE_OUTSIDE_STATE_MACHINE,
   SEMANTIC_ROLE_FIELD_UNKNOWN,
   STYLE_CLASSNAME_TAILWIND,
   STYLE_NODE_MISSING_ID,
@@ -2373,6 +5888,8 @@ export {
   TABLE_COUNT_ONLY,
   TITLE_FORMAT_RETIRED,
   TITLE_UNRESOLVABLE,
+  TRANSLATION_OPTION_KEY_UNKNOWN,
+  TRANSLATION_TARGET_UNKNOWN,
   VIEW_CONTAINER_SHAPE,
   VISIBILITY_ALIAS_DEPRECATED,
   VISIBILITY_ROOT_MISLAYERED,
@@ -2381,21 +5898,43 @@ export {
   WIDGET_MEASURE_UNKNOWN,
   buildAccessMatrix,
   diffAccessMatrix,
+  extractHookBodyWriteSet,
+  extractHookBodyWrites,
+  validateActionBodyWrites,
+  validateActionNameRefs,
+  validateAiAgentAuthoring,
+  validateAiSurfaceAffinity,
+  validateAiToolReferences,
   validateApprovalApprovers,
   validateCapabilityReferences,
+  validateChartBindings,
   validateDashboardActionRefs,
+  validateFilterTokens,
+  validateFlowNodeWrites,
+  validateFlowTemplatePaths,
   validateFlowTriggerReadiness,
   validateFormLayout,
+  validateHookBodyWrites,
   validateJsxPages,
   validateListViewMode,
+  validateNavAccess,
+  validateObjectReferences,
+  validateOrgAxisRedLines,
+  validatePageFieldBindings,
   validatePageSourceStyling,
   validateReactPageProps,
   validateReactPages,
+  validateReadonlyFlowWrites,
   validateRecordTitle,
+  validateReferenceIntegrity,
   validateResponsiveStyles,
+  validateSearchableFields,
   validateSecurityPosture,
+  validateSeedReplaySafety,
+  validateSeedStateMachine,
   validateSemanticRoles,
   validateStackExpressions,
+  validateTranslationReferences,
   validateViewContainers,
   validateVisibilityPredicates,
   validateWidgetBindings